Under the SEC Marketing Rule (Rule 206(4)-1), nearly every public page of a registered investment adviser's website is an advertisement, so each page must meet the rule's general prohibitions, and any testimonials, ratings or performance on it need specific disclosures. Two other rules also apply to the site: Rule 204-5 requires your current Form CRS to be posted prominently, and Rule 204-2 requires you to keep a copy of every advertisement for at least five years. This checklist turns those requirements into things a web team can build and test.
We build websites for RIAs and wealth managers in Greenwich and Fairfield County, where prospects often read your site before a first meeting. This isn't legal advice: your chief compliance officer makes the calls, and a well-built site makes them easy to enforce.
What on your website counts as an advertisement?
The rule defines an advertisement in two parts. The first is any direct or indirect communication an adviser makes to more than one person (or to even one person if it includes hypothetical performance) that offers advisory services regarding securities to prospective clients or private fund investors. The second is any testimonial or endorsement the adviser pays for, in cash or otherwise. A public website speaks to everyone, so your homepage, services pages, team bios and promotional articles fall under the first part.
A few things are excluded: extemporaneous, live, oral communications; information in a regulatory filing or notice that is reasonably designed to satisfy those requirements; and one-on-one communications. A one-on-one message that includes hypothetical performance is still an advertisement unless it answers an unsolicited request or goes to a private fund investor. The practical takeaway: assume every public page is an advertisement and make it pass the seven general prohibitions.
No untrue or misleading statements
No untrue material facts, and no omissions that make what you said misleading.
Substantiate every material claim
Only state material facts you can substantiate on demand; "award-winning" needs a file behind it.
No misleading implications
Nothing likely to cause a misleading inference, including imagery and headlines.
Benefits come with risks
Any discussion of potential benefits needs fair and balanced treatment of material risks or limitations.
Specific advice must be fair
References to specific past recommendations must be fair and balanced.
Performance must be fair
Don't include, exclude or pick time periods for performance in a way that isn't fair and balanced.
Nothing otherwise materially misleading
A catch-all that covers design choices, such as a disclosure styled so nobody can read it.
Testimonials and endorsements: put the disclosure next to the quote
A testimonial comes from a current client or investor, and an endorsement comes from anyone else. Either one on your site needs clear and prominent disclosure of three things: whether the person is a current client, whether they were compensated (cash or non-cash), and a brief statement of any material conflicts of interest. The rule also requires disclosure of compensation terms, a reasonable basis for believing the testimonial complies, and written agreements with paid promoters, with some relief for payments of $1,000 or less over 12 months.
"Clear and prominent" is where websites fail. In its December 16, 2025 risk alert on testimonials and third-party ratings, the SEC's Division of Examinations flagged advisers whose disclosures were missing or generic. Law firm summaries of the alert (Alston & Bird and Groom Law Group) note that disclosures available only through a hyperlink, or undercut by font size and color, were cited as problems, and that some advisers had updated their written policies without actually implementing them.
Build it as a component, not free text
A practical approach is to make the testimonial a CMS component with required fields: the quote, the relationship (client or non-client), compensated yes or no, and the conflicts text. The disclosure renders in the same block at readable size, and nothing publishes with an empty field. That closes the gap between a written policy and an implemented one.
Can an RIA website show Google reviews?
Review platforms create a separate problem. The SEC's adopting release attributes third-party content to an adviser through two concepts: adoption (you explicitly or implicitly endorse or approve it after it's published) and entanglement (you involve yourself in preparing it). As Kitces summarized the release, advisers stay out of trouble by not authoring reviews, not selectively deleting negative ones and not altering their content.
Copying a review onto your own site means you chose it, so treat it as a testimonial. The December 2025 alert specifically noted advisers that pulled third-party testimonials onto their websites without disclosing that the reviewers were clients. A "4.9 stars on Google" badge is a third-party rating and needs its own disclosures. If your CCO approves a review feed, show every review unfiltered; otherwise, just link to your profile.
Third-party ratings and awards
Rankings and awards are allowed if you reasonably believe any survey behind them made favorable and unfavorable responses equally easy, and you clearly and prominently disclose the rating's date and period, who created it, and whether you paid anything. The 2025 alert also flagged award logos shown without those disclosures.
Treat every award badge like a testimonial: a component with required fields for issuer, date, period and compensation, rendered beside the logo rather than in a footer.
Performance and hypothetical performance
Performance is where websites get into the most trouble. On September 11, 2023, the SEC charged nine advisers for advertising hypothetical performance to the general public on their websites without the policies and procedures the rule requires. The firms paid $850,000 in combined penalties, and two of them also failed to keep copies of their advertisements. Many advisory firms don't need performance on public pages at all; if yours does, the table below is the minimum.
| What you show | What Rule 206(4)-1 requires | How to build it |
|---|---|---|
| Gross performance | Net performance with at least equal prominence, same period and methodology | One component renders gross and net together; neither can appear alone |
| Portfolio performance (not private funds) | 1-, 5- and 10-year periods (or life of portfolio), ending no earlier than the latest calendar year-end | Data-driven table that blocks publishing if a period is missing or stale |
| Extracted performance | Provide, or offer to provide promptly, the total portfolio's results | Total-portfolio results linked directly beside the figure |
| Related performance | Include all related portfolios unless excluding them doesn't make results materially higher | Compliance sign-off field required before publish |
| Hypothetical performance | Policies ensuring relevance to the audience, plus assumptions, risks and limitations | Kept off public pages unless your CCO approves a gated flow |
| Any performance | No statement that the SEC reviewed or approved it | Editorial checklist item in the CMS |
Where Form CRS goes on an adviser website
Rule 204-5(b)(3) is short and specific: post the current Form CRS "prominently on your website, if you have one, in a location and format that is easily accessible for retail investors." In practice: a clearly labeled link in the navigation or footer of every page, plus one on your contact page, at a stable address such as /form-crs that survives amendments.
Put Form ADV Part 2A and a link to your firm's record on the SEC's Investment Adviser Public Disclosure site in the same place; careful prospects look for both.
Archiving: keep every version of the site for five years
Rule 204-2(a)(11) requires you to keep a copy of each advertisement you disseminate, and Rule 204-2(e)(3) requires you to keep it for at least five years from the end of the fiscal year in which it was last published, with the first two years in an appropriate office. Rule 204-2(a)(16) adds the records needed to substantiate any performance you show. Websites change quietly, so archive automatically.
A code repository alone isn't a good archive, because it stores source files rather than the pages a visitor actually saw. The fix is to capture rendered snapshots of every public page on each deploy, keep the CMS's version history with the approver's name, and send both to your archiving vendor or a storage bucket you control. Then you can show an examiner exactly what any page said on any date.
State-registered advisers and dual registrants
Advisers with less than $100 million in assets under management generally register with the Connecticut Department of Banking instead of the SEC. State advertising rules apply to them rather than the SEC rule, and dual registrants must also satisfy FINRA Rule 2210. If either applies, build the site to the stricter rule set once.
The RIA website checklist
Every public page
Checked against the seven general prohibitions at launch and on every change, with evidence on file for each material claim.
Testimonials and reviews
Client status, compensation and conflicts disclosed beside each quote; no edited or cherry-picked reviews.
Ratings and awards
Issuer, date, period and compensation beside each badge.
Performance
Net beside gross, 1-, 5- and 10-year periods, and no public hypothetical performance without CCO approval.
Form CRS
Linked prominently from every page at a stable URL.
Archive and change control
Snapshots on every deploy kept five years; only approved users can publish.
How we build advisor websites in Greenwich
We design and build websites for financial advisors on the same stack as our other web design work: fast, server-rendered pages, and we can build in the disclosure components and archiving described above from day one. Business websites start at $2,500 on our pricing page. If you also want a client-facing dashboard or document portal, read our guide on whether to build or buy a client portal first; custom software starts at $10,000.
Frequently asked questions
Does the SEC Marketing Rule apply to my RIA's website?
Yes, if your firm is registered with the SEC. Any communication to more than one person that offers your advisory services is an advertisement, and a public website speaks to everyone. Every public page must meet the rule's general prohibitions, and testimonials, third-party ratings or performance need the rule's specific disclosures. State-registered advisers follow state rules instead.
Can I put Google reviews on my RIA website?
Only with care. Google reviews you didn't write, edit or selectively delete are generally not your advertisement. Once you copy selected reviews onto your own site, you have adopted them, so show the client-status, compensation and conflicts disclosures next to each one. A star-rating badge is a third-party rating with its own disclosures. Get your CCO's approval first.
Where should Form CRS appear on an adviser's website?
Rule 204-5 requires SEC-registered advisers with a website to post the current Form CRS prominently, in a location and format easily accessible to retail investors. A clearly labeled link in the main navigation or footer of every page, plus a link on contact and get-started pages, meets that intent. Use a stable URL such as /form-crs so the link keeps working when the document is amended.
How long does an RIA have to keep copies of its website?
Rule 204-2 requires advisers to keep each advertisement for at least five years from the end of the fiscal year in which it was last published, the first two in an appropriate office. Because websites change often, capture rendered snapshots of every public page automatically on each deploy and keep CMS version history showing who approved each change.
Build compliance into the website, not around it
The firms that get marketing-rule findings rarely lacked a policy. Usually the website let someone publish a quote, a badge or a chart without the disclosure the policy called for. When those disclosures are required fields and the archive runs on every deploy, compliance stops depending on everyone remembering.
If you run an advisory firm in Greenwich, Stamford or anywhere in Fairfield County and want a site built this way, send us your current site and we'll come back with a fixed-scope quote within 24 hours.
