A marketing compliance review is the documented check of an advertisement or other consumer-facing communication, before publication, against the rules that govern financial advertising. For consumer credit, Regulation Z's advertising rules (12 CFR 1026.16 for open-end credit, 1026.24 for closed-end credit) require certain disclosures when trigger terms appear. For deposit accounts, Regulation DD (12 CFR 1030.8) governs rate and fee statements. The FDIC's rule at 12 CFR Part 328, subpart B, prohibits misrepresenting deposit insurance and requires specific disclosures from non-banks. All of it sits under the general bans on unfair or deceptive practices in section 5 of the FTC Act and on unfair, deceptive or abusive practices in 12 U.S.C. 5531 and 5536. The standard workflow is an inventory, pre-publication review against a checklist, approval, and retention of the approved version.
A marketing compliance review is the process by which a financial services provider examines an advertisement, web page, app screen, social media post, email or other consumer-facing communication, before it is published, to confirm that it complies with the laws governing financial advertising, and records the result. For a fintech operating through a bank partner, the review usually has two layers: the fintech's own review and the sponsor bank's review or approval. The rules applied are consistent across providers and are set out in federal regulation.
The governing rules
Regulation Z: credit advertising
Regulation Z, which implements the Truth in Lending Act, contains separate advertising rules for open-end credit (12 CFR 1026.16) and closed-end credit (12 CFR 1026.24). Both begin with the same principle: an advertisement may state specific credit terms only if those terms actually are or will be arranged or offered by the creditor (1026.16(a); 1026.24(a)).
The central mechanism is the trigger term. For closed-end credit, if an advertisement states the amount or percentage of a down payment, the number of payments or period of repayment, the amount of any payment, or the amount of any finance charge (1026.24(d)(1)), it must also state the down payment, the terms of repayment, and the annual percentage rate, including whether the rate may increase after consummation (1026.24(d)(2)). A rate of finance charge must be stated as an "annual percentage rate" (1026.24(c)). For open-end credit such as credit cards and lines of credit, 1026.16(b) lists its own triggering terms and required disclosures, 1026.16(g) requires promotional-rate advertisements to state when the promotional rate ends and the rate that applies afterward, and 1026.16(h) governs deferred-interest offers. Additional rules apply to credit secured by a dwelling, including a list of prohibited practices in 1026.24(i).
Regulation DD: deposit account advertising
Regulation DD, which implements the Truth in Savings Act, governs advertising of deposit accounts at 12 CFR 1030.8. An advertisement may not be misleading or inaccurate or misrepresent the deposit contract; an account may not be described as "free" or "no cost" if a maintenance or activity fee may be imposed; and the word "profit" may not be used to describe interest (1030.8(a)). A rate of return must be stated as an "annual percentage yield" (1030.8(b)). When the annual percentage yield is stated, the advertisement must also disclose items such as whether the rate is variable, the period for which it is offered, minimum balance and opening-deposit requirements, and the effect of fees (1030.8(c)). Bonus advertisements carry their own required disclosures (1030.8(d)).
FDIC rule on misrepresentation of insured status
The FDIC's regulation at 12 CFR Part 328, subpart B, prohibits false advertising, misrepresentation of insured status, and misuse of the FDIC's name or logo. It prohibits any person from representing or implying that an uninsured financial product is insured or guaranteed by the FDIC, and from knowingly making false or misleading representations about deposit insurance (12 CFR 328.102(a) and (b)). A statement is a misrepresentation if it contains material representations that would tend to mislead a reasonable consumer, or omits or fails to clearly and conspicuously disclose material information (328.102(b)(3)). For fintechs, 328.102(b)(5) is the central provision. It lists omissions of material information that make a deposit insurance statement misleading: a non-bank that makes such statements is expected to clearly and conspicuously identify the insured depository institution or institutions where deposits are placed (b)(5)(i); to disclose that it is not an FDIC-insured depository institution and that FDIC insurance covers only the failure of the insured institution (b)(5)(ii); to differentiate insured deposits from non-deposit products offered alongside them (b)(5)(iii); and, where it refers to pass-through coverage, to disclose that certain conditions must be satisfied for that coverage to apply (b)(5)(iv).
The FDIC adopted the current version of Part 328 by final rule on December 20, 2023. Compliance with the subpart B provisions was required from January 1, 2025. The separate signage requirements for digital channels and ATMs in subpart A (12 CFR 328.4 and 328.5) were delayed and then amended by a final rule published January 29, 2026, effective March 2, 2026, with compliance required by April 1, 2027.
FTC Act section 5 and UDAAP
Beyond the specific rules, every advertisement is subject to the general prohibitions. Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive acts or practices in or affecting commerce (15 U.S.C. 45(a)). The FTC's Policy Statement on Deception (1983) describes deception as a representation, omission or practice that is likely to mislead a consumer acting reasonably in the circumstances, to the consumer's detriment, where the representation is material. For consumer financial products, the Consumer Financial Protection Act prohibits covered persons and service providers from engaging in unfair, deceptive or abusive acts or practices (12 U.S.C. 5531 and 5536(a)(1)(B)). The statute defines unfairness (5531(c)) and abusiveness (5531(d)); deception is not defined in the statute, and the CFPB's UDAAP examination procedures apply a three-part deception test (a representation, omission, act or practice that misleads or is likely to mislead, a reasonable consumer interpretation, and materiality) that parallels the FTC's. The UDAAP reference covers these standards in detail. In advertising review, UDAAP is most often engaged by net impressions: an advertisement can satisfy every trigger-term rule and still mislead through prominence, placement or omission.
Sponsor-bank oversight of partner marketing
Where a fintech offers a product through a bank, the bank remains responsible for compliance of the product with consumer protection law, and its oversight of the fintech is a third-party risk management obligation. The Interagency Guidance on Third-Party Relationships: Risk Management, issued by the OCC, the Federal Reserve Board and the FDIC in June 2023 (88 FR 37920), describes the bank's oversight of third parties, including those that interact with the bank's customers. In September 2026 the agencies proposed guidance that would replace it; until a replacement is final, the 2023 guidance remains the published standard. In practice, sponsor-bank agreements commonly require the fintech to submit marketing for bank review or approval before publication and to maintain records of approved materials. The sponsor-bank oversight reference describes how that responsibility is allocated.
The review workflow
- Inventory. The provider maintains a list of every consumer-facing communication in use, by channel: website pages, app screens, emails, social posts, paid ads, affiliate and influencer content, scripts and printed material. Content produced by third parties on the provider's behalf is included.
- Classification. Each item is classified by product (credit, deposit, payments, investment) so that the applicable rules are known. A single page that mentions both a card and a savings feature is reviewed against both regimes.
- Pre-publication review. A reviewer independent of the marketing author applies a written checklist: trigger terms and required disclosures under Regulation Z; APY and "free" rules under Regulation DD; deposit insurance statements and the non-bank disclosures of 328.102(b)(5); substantiation for every factual claim; clarity, prominence and placement of disclosures; and the net impression under the deception standard.
- Partner approval. Where the contract requires it, the item goes to the sponsor bank for review, and the bank's comments and approval are recorded.
- Approval record. The approved version is stored with the reviewer's name, the date, the checklist, any changes required, and the approval of the partner bank where applicable.
- Publication control. Only approved versions are published. Changes to approved content, including changes to rates or offer terms, go back through review.
- Periodic re-review. Published content is re-reviewed on a schedule and when rates, fees, products or rules change, and expired offers are withdrawn.
- Complaints feedback. Consumer complaints that cite confusion about an advertisement are routed back to the review function.
Record retention
Regulation Z requires a creditor to retain evidence of compliance for two years after the date disclosures are required to be made or action is required to be taken (12 CFR 1026.25(a)). Regulation DD requires a depository institution to retain evidence of compliance for a minimum of two years (12 CFR 1030.9(c)). Both allow the supervising agency to require longer retention. For advertising, evidence of compliance means the approved version of each advertisement, the dates it ran, the channels used, and the review record. Sponsor-bank agreements and state law may impose longer periods. Testing whether the review process actually operated follows the method in the reference on control testing methods.
Primary sources
- 12 CFR 1026.16: Regulation Z advertising rules for open-end credit, including triggering terms, promotional rates and deferred interest.
- 12 CFR 1026.24: Regulation Z advertising rules for closed-end credit, including trigger terms and required disclosures.
- 12 CFR 1026.25: Regulation Z record retention: evidence of compliance kept for two years.
- 12 CFR 1030.8 and 1030.9: Regulation DD advertising rules for deposit accounts, and two-year record retention.
- 12 CFR 328.102: FDIC prohibition on misrepresentation of insured status, including non-bank disclosure requirements.
- FDIC final rule, 91 FR 3801 (January 29, 2026): Amends digital and ATM signage requirements (12 CFR 328.4 and 328.5); effective March 2, 2026, compliance by April 1, 2027.
- FDIC, FIL-65-2023: FDIC Official Signs and Advertising Requirements, False Advertising, Misrepresentation of Insured Status, and Misuse of the FDIC's Name or Logo: The December 2023 final rule that adopted the current Part 328.
- 15 U.S.C. 45: FTC Act section 5: prohibition of unfair or deceptive acts or practices.
- FTC Policy Statement on Deception (1983): The FTC's standard for deceptive representations and omissions.
- 12 U.S.C. 5531 and 5536: Consumer Financial Protection Act prohibition of unfair, deceptive or abusive acts or practices.
- CFPB, Unfair, Deceptive, or Abusive Acts or Practices (UDAAPs) examination procedures: The CFPB's procedures for evaluating unfair, deceptive and abusive acts or practices, including advertising.
- Interagency Guidance on Third-Party Relationships: Risk Management (June 2023): OCC, Federal Reserve and FDIC guidance on bank oversight of third parties, 88 FR 37920.