SEC Marketing Rule: Testimonials, Reviews, and Your Site

Every page-one result for this question is a law firm summarizing the regulation. None of them tells you what to put on the page. So you finish reading and still cannot answer the five questions you actually walked in with: can I ask a client for a Google review, does a review I never asked for count, what exact words go next to the quote, can stars run in an ad, and what do I do about the one-star review from a guy who was never a client.

This post answers those five, and four more, straight from Rule 206(4)-1, Rule 204-2, and the SEC Division of Examinations' December 2025 risk alert. Nothing here is paraphrased from someone else's summary. Every rule statement links to the text it came from.

One caveat before you read: we build and market advisory websites, we do not practice law. Take the specifics to your CCO or outside counsel before you ship. What follows is the marketing execution — the part nobody publishes.

What does the SEC Marketing Rule actually count as a testimonial?

A testimonial is any statement by a current client about their experience with you — or any statement by a current client that solicits or refers someone to become your client. That is the definition in Rule 206(4)-1(e)(17). It does not have to be flattering, and it does not have to be on your website.

An endorsement, under (e)(5), is the same kind of statement from a person who is not a current client: a former client, a prospect, your CPA referral partner, a lead-gen firm, a podcast host, a social-media influencer. The rule splits on one question only — was this person a current client when they said it?

Both live inside the definition of an advertisement in (e)(1): a communication you make to more than one person that offers your advisory services. And (e)(1)(ii) adds a second door — any testimonial or endorsement you compensate is an advertisement in itself, whether or not it looks like one. Extemporaneous live oral communications are carved out. Your website is not extemporaneous.

The rule text lives at 17 CFR 275.206(4)-1, and the SEC's Division of Investment Management maintains a running Marketing Compliance FAQ on it — last updated January 15, 2026. Read the primary sources, not a vendor's recap of them. The vendors are two years stale.

Can a financial advisor ask clients for Google reviews?

Yes. Since the Marketing Rule's compliance date of November 4, 2022, an SEC-registered adviser can solicit and use client testimonials — the old blanket ban is gone. What you cannot do is pay for them, steer them, or display them naked.

Three rulebooks bind the ask, not one. The SEC governs how you *display* the review. Google governs how you *collect* it. The FTC governs both. Advisers get in trouble because they read only the first.

Google's Maps content policy is explicit about what merchants may do: solicit or encourage content that represents a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review. In the same prohibited and restricted content policy, Google bans offering payment, discounts, or free goods and services in exchange for a review, bans discouraging negative reviews or selectively soliciting positive ones, and bans pressuring users to leave a review while they are on your premises or asking that a review include specific content.

That last line kills a common advisory-firm habit: the annual-review meeting where the CSA hands over an iPad and stands there. Send the link afterward instead. If you want the mechanics of a GBP that actually converts the search, we cover them in Google Business Profile optimization for service businesses, and the local-search side of an advisory practice sits in our SEO for financial advisors service page.

The December 2025 risk alert records the version that trips advisers: firms handed clients gift cards to write reviews on third-party sites, then had no basis to believe the person disclosed that they were paid. That is a two-regulator violation from one gift card.

Does an unsolicited online review count as a testimonial or an endorsement?

A review you did not solicit and do not use is neither — it is just a review sitting on Google. It becomes a testimonial or an endorsement the moment you put it into an advertisement: your homepage, a slide, a newsletter, a screenshot on LinkedIn.

Which of the two it becomes depends on the author. Current client, it is a testimonial. Anyone else, it is an endorsement. And you have to say which, out loud, on the page.

The SEC's examiners flagged exactly this move. The risk alert describes advisers who lifted current-client testimonials and former-client endorsements from third-party websites onto their own sites without clearly and prominently disclosing that the statements came from current or former clients. Copy-pasting a Google review into a carousel is a regulated act.

Practical consequence for the build: you cannot pipe a live Google reviews widget onto an advisory homepage and walk away. The widget renders a name, stars, and text. It does not render 'this person is a current client of the firm.' A feed you do not control is a feed you cannot disclose on.

What disclosure has to appear with a testimonial, and where on the page?

Rule 206(4)-1(b)(1)(i) requires three things, clearly and prominently, at the time the statement is disseminated: (A) whether the person is a current client (testimonial) or is not (endorsement); (B) whether cash or non-cash compensation was provided; and (C) a brief statement of any material conflicts of interest arising from your relationship with them. Sub-paragraphs (b)(1)(ii) and (iii) add the material terms of any compensation arrangement and a full description of the conflicts.

Now the part every advisory site gets wrong — placement. Quoting the adopting release, the risk alert states that the clear-and-prominent standard requires the disclosures to be included within the testimonial or endorsement, and that using a hyperlink to carry them is not consistent with the standard. It also states that to be clear and prominent, the disclosures must be at least as prominent as the testimonial they attach to. Examiners specifically wrote up disclosures set in a smaller or lighter font than the quote above them.

The FTC lands in the same place from the other direction. 16 CFR 465.1(c)(4) says a disclosure is not clear and conspicuous if the consumer must take any action — clicking a hyperlink, hovering over an icon — to see it. Two regulators, one answer: the words are on the page, in the open, in normal type.

So the testimonial component on your site has a hard shape. Quote. Attribution. Disclosure line, rendered as a sibling element in the same typographic scale as the quote — not a tooltip, not an asterisk, not a modal, not a footer note, not a Terms page. If your CMS testimonial block only accepts a quote, a name, and a headshot, it is non-compliant by construction and no amount of copywriting fixes it. Rebuild the component. That is a website design job, not a compliance memo.

Can you run review stars, ratings, or client quotes in a paid ad?

Technically yes, practically almost never — because a paid ad has nowhere to put the disclosures, and the disclosures are not optional. Ad copy is a communication to more than one person offering advisory services, so it is an advertisement under (e)(1), and every rule above applies inside a 90-character description line.

A star rating pulled from a review platform is a third-party rating under Rule 206(4)-1(c). To display it anywhere you need a reasonable basis for believing the questionnaire or survey behind it is structured to make it equally easy for a participant to provide favorable and unfavorable responses, and is not designed to produce a predetermined result — plus three clear-and-prominent disclosures: the date the rating was given and the period it covers, the identity of the third party that created and tabulated it, and any compensation you provided to obtain or use it.

Fit three clear-and-prominent disclosures into a seller-rating extension. You cannot. That is why the honest answer is architectural, not creative: keep the stars and the quotes on a landing page you control, and let the ad's job be getting the click. The disclosure discipline lives on the page, where there is room for it. We build paid ads this way for regulated clients on purpose — the compliance constraint and the conversion constraint point the same direction, because the landing page converts better anyway.

What do you do about a review you never asked for and cannot delete?

You respond to it, and you leave it up — because both the alternatives are now federal violations. Under 16 CFR 465.7(a), using an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly false public accusation to get a review taken down is an unfair or deceptive act. Under 465.7(b), it is also a violation to imply that the reviews shown on your site represent most or all reviews submitted when you are suppressing them by rating or negative sentiment.

That second clause is the one that catches advisory firms with a home-grown 'client feedback' section. If you display only the four- and five-star submissions and present the section as your reviews, you are misrepresenting. Filtering on neutral criteria applied to every review — defamatory content, personal information, obviously fake — is fine. Filtering on the score is not.

Replying is the leverage you actually have, and it pays. BrightLocal's 2026 Local Consumer Review Survey found 89% of consumers expect business owners to respond to reviews, and 42% say they are unlikely to use a business that never replies. Keep the reply short, human, and non-marketing — the moment it pitches services it starts to look like an advertisement, and the general prohibitions in Rule 206(4)-1(a) attach. Acknowledge, offer to take it offline, stop.

For the operational side — routing, monitoring, response SLAs — compare the tooling in our review management software breakdown.

Which third-party ratings and awards can you display, and under what conditions?

Any third-party rating, provided you clear Rule 206(4)-1(c)'s two gates: the due-diligence gate on how the rating was produced, and three clear-and-prominent disclosures next to it. The December 2025 risk alert catalogues what firms failed, and the failures are boringly specific.

Examiners observed advisers who could not show they had reviewed the questionnaire behind the rating at all — no policy, no copy of the survey, no representation from the rating provider. They observed award logos that did not identify who created and tabulated the rating. They observed ratings listed against a range of years that included a year the adviser did not actually receive the award. They observed advisers who paid the rating provider for logo reprints, for priority placement, for upgraded or enhanced exposure, or for referral links from the provider's site — and disclosed none of it. And they observed the disclosures parked at the bottom of the page, in small type, away from the badge.

If you paid a directory for placement and then display its badge, you have a compensated third-party rating and you say so, next to the badge, in the same type size. There is no version of this where the fee stays quiet. Trust signals only work when they survive scrutiny anyway — we make that argument for every industry in trust signals that actually convert.

What has to go in your books and records if you use reviews in marketing?

Rule 204-2(a)(15) adds three records the moment you use a testimonial, an endorsement, or a rating: a record of the (b)(1)(ii) and (iii) disclosures if they are not inside the advertisement itself; documentation substantiating your reasonable basis for believing the testimonial or endorsement complies with the Marketing Rule and that any third-party rating clears (c)(1); and a list of the partners, officers, directors, employees, and affiliates you are relying on the (b)(4)(ii) exemption for.

On top of that, 204-2(a)(11)(i)(A) requires a copy of each advertisement you disseminate, and (a)(11)(ii) requires a copy of any questionnaire or survey used to prepare a third-party rating in your ads, if you obtained one. Retention under 204-2(e)(3)(i) is five years, the first two in an appropriate office, running from the end of the fiscal year in which you last disseminated it.

Translate that into web terms and it is uncomfortable: your website is an advertisement, so every version of your testimonial section is a record. A firm that redesigns its homepage twice a year and keeps no archive has destroyed records without noticing. The fix is cheap — version the marketing site in git, capture a full-page render of every page containing a testimonial or badge on each deploy, and store the renders with the deploy hash. That is an afternoon of pipeline work, and it is the difference between an exam finding and a folder.

How do you build review velocity without breaking the rule?

Ask every client at the same trigger point, offer nothing, script nothing, and never look at the answer before deciding whether to ask. The only gate that survives all three rulebooks is timing — never sentiment.

Sentiment gating is dead three times over. Google prohibits merchants from discouraging negative reviews or selectively soliciting positive ones. 16 CFR 465.4 makes it an unfair or deceptive act to give compensation or incentives in exchange for, or conditioned on, reviews expressing a particular sentiment. And 465.5 makes an officer's or manager's own review a violation unless the material relationship is disclosed clearly and conspicuously — which also means the 'ask the team to leave us five stars' Slack message is a rule problem, not a growth hack.

Then there is the de minimis trap, and it is the most expensive misunderstanding in this whole post. Rule 206(4)-1(e)(2) defines de minimis compensation as $1,000 or less to a person for a testimonial or endorsement during the preceding 12 months — not per payment. The risk alert describes advisers who paid a promoter under $1,000 each time, totalled more than $1,000 across the year, and lost the exemption they thought they had. Your refer-a-friend program is an endorsement program with a running 12-month meter on every participant.

And the exemption is narrower than people think anyway. Under (b)(4)(i), uncompensated or de minimis testimonials and endorsements are excused from the written-agreement requirement and the disqualification check. They are not excused from the (b)(1) disclosures. Free does not mean silent.

• Ask at a fixed trigger — the annual review wrap-up, the plan delivery — applied to every client, not the happy ones
• Send the link by email or text after the meeting, never on a device you are holding out to them
• Offer nothing: no gift card, no fee credit, no charitable donation, no entry into a drawing
• Never suggest what the review should say, never ask for a staff member's name to be included
• Keep the refer-a-friend meter: total compensation per person, rolling 12 months, against the $1,000 line
• Disclose current-client status and any compensation inside every testimonial you republish

Velocity matters more than lifetime count, which is convenient, because compliant asking is slow and steady by design. BrightLocal's 2026 survey found 74% of consumers only care about reviews written in the last three months, and 47% will not use a business with fewer than 20 reviews. A firm adding two compliant reviews a month beats a firm with a 2019 pile of 60. Pair that with the rest of the acquisition stack in our lead generation playbook for financial advisors.

If your advisory site is running a testimonial carousel with the disclosure behind a link, a badge with no tabulator named, or a feedback wall that only shows the good ones, that is three findings sitting on your homepage right now. We rebuild advisory sites so the compliance shape and the conversion shape are the same shape — start at SEO for financial advisors, or send us the URL and get my free audit.