Affiliate marketing compliance for financial services: what firms must do
A firm can be liable for what affiliates publish with its referral links. An unauthorised affiliate needs an authorised firm's approval unless an exemption applies, and the FCA expects firms to vet, monitor and drop affiliates who keep breaking the rules.
In short
- The FCA may treat a firm whose referral link appears in an affiliate's post as causing that promotion, and so liable for its compliance, even if the firm did not create it (FG24/1, paragraph 3.19).
- An unauthorised affiliate may communicate a financial promotion only if an authorised firm has approved its content or an exemption applies. Approving content the firm prepared itself needs no approver permission.
- A principal is responsible for what its appointed representatives, including introducer appointed representatives, do in the business it has accepted responsibility for (FSMA section 39(3)).
- Affiliate offers fall under the incentive bans: no account-opening bonuses or fee rebates for retail CFD clients (COBS 22.5.20R), and no cashback or referral bonuses in crypto promotions to retail clients (COBS 4.12A.7R).
- The FCA expects firms to consider how many affiliate partnerships they can viably maintain before adequate monitoring is no longer possible (FG24/1, paragraph 3.22).
- The ASA holds both the business and the affiliate responsible under the CAP Code, even when the affiliate created the ad alone.
Your firm can be liable for what its affiliates post
The FCA describes affiliate marketing as a firm agreeing “to pay commission to a person (who could be an unauthorised person) based on business generated from referrals” (FG24/1, paragraph 3.18). Under section 21(13) of the Financial Services and Markets Act 2000 (FSMA), to communicate a promotion “includes causing a communication to be made”, and the FCA applies that to referral links:
Where an affiliate marketer is communicating a financial promotion containing a firm’s referral link without the firm having developed, created, or controlled the content of that communication, we may still consider that the firm is causing the communication to be made. The firm would be liable for the compliance of that financial promotion.
FG24/1 is guidance and “does not create new obligations for firms” (paragraph 1.12), but it is how the FCA reads the existing rules: “Firms remain responsible for the compliance of every promotion they make or cause to be made” (paragraph 1.6). One affiliate post can make three parties answerable:
| Party | What it answers for |
|---|---|
| The affiliate, if unauthorised | Communicating a promotion that is neither approved nor exempt, a criminal offence (FSMA section 25), and any regulated activity it carries on without being authorised or exempt (section 19) |
| The firm whose product is promoted | Promotions it causes; foreseeable harm it causes through its role in the distribution chain (PRIN 2A.2.9R); what its appointed representatives do in the business it accepted responsibility for (FSMA section 39(3)) |
| The firm that approved the promotion | Confirming compliance, monitoring and withdrawing approval (COBS 4.10.2R). It “would not necessarily be responsible” if an unauthorised entity changes the content and communicates it without permission (FG24/1, paragraph 4.12) |
Which partners count as affiliates
What the contract calls a partner does not decide how the rules treat it. CySEC's circular on affiliates, for example, covers anyone doing the activities it lists, “irrespective of how the CIF chooses to define such person/entity”.
| Partner | What it does | Rules it engages |
|---|---|---|
| Comparison site | Lists and links to products; paid per click, lead or sale, or for a higher listing | Credit broking if it introduces people to lenders (PERG 2.7.7EG). ESMA says a site paid to list a firm above competitors “is not an independent one” (ESMA35-43-3682) |
| Lead generator | Sells enquiries to firms | Credit broking, as above; debt advice firms buying leads have duties under CONC 8.9 |
| Introducer | Refers customers for a fee | Can be an introducer appointed representative (SUP 12.2.8G) |
| Influencer | Posts with a referral link or code | Section 21 approval and ad labelling: see finfluencer rules in the UK |
| Introducing broker, educator or signal provider | Brings clients to a CFD or FX provider, often through courses or trade ideas | Advice or passing on orders needs authorisation or tied agent status; ESMA counts education that steers people to open an account as “a form of marketing” (ESMA Q&A, Sections 3 and 10) |
| Cashback or voucher site | Shares its commission with users | Cashback and fee rebates count as banned incentives in crypto and CFD promotions (see below) |
| Publisher or media partner | Runs your adverts or sponsored articles | Publishers carrying adverts communicate them (PERG 8.6.2G) |
Approval is how an unauthorised affiliate promotes lawfully
An unauthorised affiliate can communicate a promotion only if an authorised person has approved its content, unless an exemption applies (section 21(2)). Handing over your own creative does not do that by itself:
An unauthorised person may wish to pass on a financial promotion made to them by an authorised person. In this case, the fact that the financial promotion was made to them by an authorised person will not be enough for the restriction in section 21 not to apply to them. The authorised person must also both have approved its content and have done so for the purpose of section 21 of the Act.
Since 7 February 2024, approving for others has needed the FCA's permission, but not for content the firm prepared itself, content prepared by an unauthorised member of its group, or its appointed representative's content for business the firm has accepted responsibility for (S.I. 2023/966, regulation 3). So the simplest model is for the firm to prepare the creative, approve it for section 21 and forbid edits. The firm stays the preparer if the affiliate makes “minor presentational changes to, or repackages, the material” (PERG 8.9.1BG). Content an affiliate writes itself needs an approver with the permission, unless the affiliate is your appointed representative or in your group.
Approval brings duties (COBS 4.10.2R): monitoring the promotion “for as long as the financial promotion is communicated”, quarterly attestations of no material change for promotions the unauthorised person issues, and withdrawal if it stops complying. Approved promotions likely to reach retail clients must show the approver's name and the date of approval (COBS 4.5.2R, as COBS 4.10.7AG explains). See section 21 approval and the gateway.
Introducers who are appointed representatives
An introducer can be an introducer appointed representative (IAR). Its appointment must be limited to effecting introductions to the firm or its group and distributing non-real time financial promotions for their products (SUP 12.5.7R); it cannot advise or arrange deals (SUP 12.2.8G). The principal answers for it:
The principal of an appointed representative is responsible, to the same extent as if he had expressly permitted it, for anything done or omitted by the representative in carrying on the business for which he has accepted responsibility.
Before appointing an IAR, “and on a continuing basis”, the firm must take reasonable care that the person is suitable and that its activities do not result in “undue risk of harm to consumers or market integrity” (SUP 12.4.6R). If those conditions fail, the firm must take immediate steps to put it right or end the contract (SUP 12.6.1R). Since the reforms that took effect on 8 December 2022, the firm's governing body must also approve a yearly self-assessment, which covers IAR arrangements (SUP 12.6A.6R and 12.6A.1G; PS22/11).
Credit brokers and lead generators
A comparison site or lead generator that introduces people who want credit to a lender is carrying on credit broking (PERG 2.7.7EG), a regulated activity. A broker that is not a lender must say so prominently in its promotions (CONC 3.7.7R) and disclose to the customer any fee it charges (CONC 4.4.2R). See consumer credit and BNPL promotion rules.
Firms that buy leads for debt counselling, debt adjusting or credit information services have a rule of their own. Before agreeing to take leads, they must take reasonable steps to ensure that “any of the lead generator's advice, any content of its website and advertising and any of its commercial practices comply with applicable legal requirements” (CONC 8.9.2R). Once they take leads, they must take reasonable steps to ensure the lead generator makes clear to customers any financial interest it has in passing them on and does not pose as a charity or a government body (CONC 8.9.4R).
The Consumer Duty follows the product down the distribution chain
Foreseeable harm may be caused by both act and omission, in a firm’s direct relationship with a retail customer or through its role in the distribution chain even where another firm in that chain also contributes to the harm.
Obligations in the chain are interpreted “in a manner that reflects the firm’s role in that distribution chain and the degree to which it can determine or materially influence retail customer outcomes” (PRIN 2A.1.14G). On unregulated partners, the FCA's Consumer Duty guidance says firms “should consider whether including an unregulated entity in the distribution chain leads to too great a risk of poor outcomes” and, if they go ahead, whether to add “further due diligence or monitoring” (FG22/5, paragraph 2.22). For CFD firms, the FCA said in March 2023 that reviewing their distribution strategy under the Duty “may include reviewing the communications of third parties that market or distribute your products, particularly affiliate marketers, introducers, financial influencers, and agents” (FCA letter).
Affiliate posts must keep to the CFD and crypto rules
The incentive bans bind the firm, so check every offer an affiliate makes for you. A CFD firm “must not offer to a retail client, or provide a retail client with” a monetary or non-monetary incentive when marketing (COBS 22.5.20R), including “the offering of bonuses in relation to the opening of a new account or the offering of rebates on fees (including volume-based rebates)” (COBS 22.5.21G). A firm must not communicate or approve a crypto promotion that offers retail clients an incentive (COBS 4.12A.7R, with narrow exceptions), including “offering bonuses where the client refers another person” and “offering cashback when investing in a restricted mass market investment” (COBS 4.12A.8G).
Prescribed warnings apply in full. A CFD firm must not approve, communicate or disseminate a promotion without the warning for the medium, carrying its current loss percentage (COBS 22.5.6R), and crypto promotions carry the warning in COBS 4.12A.11R. See CFD risk warning wording and crypto promotion rules in the UK.
The ASA treats affiliate marketing as advertising
Both the business and the affiliate marketer are responsible under the Code, notwithstanding the fact that the ads may have been created solely by the affiliate without any input from the business themselves.
The advice comes from the CAP Executive and does not bind the ASA, but it reports the ASA's rulings. It adds that “allowing their affiliates to have free rein over the content of ads does not excuse them from the responsibility of ensuring that the advertising is compliant with the CAP Code”. Marketing must be “obviously identifiable as such” (CAP 2.1), and the advice says a disclaimer at the bottom of a post is unlikely to be enough. For promotions the FCA regulates, the ASA's role is narrower: Code rules cover their “non-technical elements”, such as serious or widespread offence and social responsibility (CAP Code, section 14).
What the FCA has said about affiliates and introducers
- Letter to CFD providersNamed affiliate marketers and introducers among three core poor behaviours: “All firms should consider their use of affiliates and must have robust due diligence for their onboarding and ongoing monitoring.”
- Crypto promotions: good and poor practice“Firms should not work with affiliates suspected of operating illegally or engaging in poor conduct.”
- Letter to CFD providersReminded them of their responsibilities “to conduct adequate due diligence and provide oversight, at both onboarding and periodically” of distributors and appointed representatives.
- Enforcement Watch 2After FCA feedback on its Consumer Duty compliance, a CFD trading platform stopped taking introductions from two unauthorised introducers under common control with it, whose training and software “gave investors a false sense of possible returns”.
EU and Cyprus regulators expect the same oversight
MiFID II requires marketing communications “addressed by the investment firm to clients or potential clients” to be fair, clear and not misleading (Article 24(3)). ESMA's 2017 Q&A on CFDs, written for national regulators, covers third parties “also referred to in the industry as introducing brokers or affiliates” and says “it is critical that authorised firms have robust controls in place to ensure the effective oversight of these relationships” (ESMA35-36-794, Section 10). Its poor practices include paying third parties “on the basis of the number of clients introduced, the volume of client trading or the value of client deposits”.
ESMA's December 2023 discussion paper, a consultation rather than guidance, said firms “are and remain responsible for how the selected affiliates communicate about the firm and the financial services” (ESMA35-43-3682, paragraph 64). The EU's Retail Investment Strategy is set to make this law. According to the European Commission's July 2026 request to ESMA, firms using third parties such as finfluencers “must conclude written agreements with those third parties, defining the nature and scope of their promotional activities”, monitor compliance and keep records of all marketing communications, third-party promotions included, for at least five years. The texts were provisionally agreed on 18 December 2025, and the Commission expects the amending directive to apply from July 2029, assuming it is published in January 2027.
In Cyprus, CySEC's Circular C217 (26 June 2017) asks firms to check that affiliates hold any authorisation they need, to prepare their material or pre-approve and monitor it, to use as few affiliates as possible, and to end the relationship, tell clients and report to CySEC when an affiliate acts outside its agreement. See CySEC marketing rules for CFD firms.
A control framework for affiliate programmes
FG24/1's Table 2 gives the FCA's examples of good practice, including an affiliates policy, monitoring affiliates' promotions “on an ongoing basis to ensure they remain compliant for their lifetimes” and controls so that affiliates “only communicate content prepared by the firm” (FG24/1, Table 2).
- Check the partner before you signCheck the Financial Services Register for any status the partner needs, and review its past posts for unapproved promotions, missing warnings and incentives. Ask whether it “may alter their promotions, communicate unapproved promotions, or might carry on regulated activity in breach of the general prohibition” (FG24/1, paragraph 3.21), and avoid affiliates “suspected of operating illegally or engaging in poor conduct” (FCA, 7 September 2023).
- Put the controls in the contractApproved assets only, posted unedited; every account and channel listed; ad labels; no offers of its own; no sub-affiliates without consent; takedown within a set number of hours; access to its content and records; termination for breaches. ESMA counts arrangements “not being documented by way of a formal agreement” as poor practice.
- Keep a library of approved assetsGive each asset an ID, a version, an approval date and a review date. Retire versions when rules or figures change, such as a CFD firm's loss percentage, recalculated every three months (COBS 22.5.6R(4)).
- Give every partner its own tracking linkOne link or code per partner and channel, to approved landing pages only. It ties posts and clients to partners and lets you switch a partner off. Search for your codes and brand too, to find posts by partners you never briefed.
- Monitor at the speed partners postCover partners' social accounts, websites, landing pages and paid ads, and your brand names, hashtags and codes. In the EU, the largest platforms must keep public, searchable repositories of the adverts they show (Digital Services Act, Article 39). Set the cadence by how often a partner posts, the product and the audience, and record what you cannot see, such as closed Telegram groups. The FCA has called an approver's software that flags changes to clients' websites good practice (financial promotions data 2024).
- Act on a breachCapture the post, caption, account, date and URL before it changes. Get it taken down, record the finding and the fix, and check the correction. If you approved it, withdraw approval and tell anyone relying on it (COBS 4.10.2R(2)). End the relationship if non-compliance continues; an appointed representative that no longer meets its appointment conditions must be put right or terminated (SUP 12.6.1R).
- Keep the recordKeep a record of each promotion you communicate or approve: five years for MiFID business, three for most other business (COBS 4.11.1R). Keep a register of partners, sub-affiliates and the clients each introduced: ESMA expects a CFD firm to be able to show “all current marketing materials in circulation at any particular point in time”.
How many affiliates can you monitor?
Firms should consider how they can monitor the marketing actions of their affiliate partners to ensure good customer outcomes, and how many partnerships the firm can viably maintain before adequate monitoring is no longer possible.
The FCA's poor practice list includes “Having many affiliate partnerships combined with inadequate controls and few staff to ensure compliance” (Table 2). Do the arithmetic before recruiting. In a worked example, 200 partners posting three times a week make 600 posts; at five minutes a post, that is 50 hours of review a week before any follow-up. If the hours are not there, cut the number of partners, limit them to approved assets, or add capacity.
An affiliate compliance checklist
- Is every affiliate, introducer and sub-affiliate on a register, with what it does and where it posts?
- Is each one authorised, an appointed representative, or doing nothing that needs either?
- Has an authorised firm approved every promotion an unauthorised partner communicates, showing its name and the date?
- Do partners post current approved assets only, unedited, with the risk warning and an ad label?
- Are bonuses, rebates, cashback and referral rewards kept out of CFD and crypto promotions to retail clients?
- Does each partner have its own tracking link, and who monitors it, how often, with what blind spots?
- When a post breaks the rules, is there evidence, a takedown, a record and a review of the partner?
- Can you show what each partner had live on any given day, and do you have the people to monitor them all?
Connor checks affiliates' and influencers' public accounts on Instagram, TikTok, YouTube, Facebook and X, and LinkedIn company pages, daily. It scores each new post for whether it is about the firm and can review the relevant ones automatically against the rules that apply. It can also find anyone's posts under your hashtags, and Meta ads by anyone that mention you. It does not monitor Discord or Telegram.
Questions people ask
Is a company responsible for what its affiliates post?
It can be. Under FSMA section 21(13), communicating a promotion includes causing it to be made. The FCA's guidance says that where an affiliate's promotion contains a firm's referral link, the FCA may consider the firm to be causing it, and the firm would be liable for its compliance, even if it did not create the content (FG24/1, paragraph 3.19). The ASA also holds both the business and the affiliate responsible under the CAP Code.
Do affiliates need to be FCA authorised?
Not to publish a financial promotion that an authorised firm has approved, or that an exemption covers (FSMA section 21). An affiliate that goes further, for example by advising, arranging deals or introducing people to lenders, may be carrying on a regulated activity, which needs authorisation or an exemption such as appointed representative status (FSMA section 19; FG24/1, paragraph 3.23).
What is an introducer appointed representative?
An appointed representative whose appointment is limited to effecting introductions to the principal firm or its group and distributing non-real time financial promotions for their products or services (SUP 12.2.8G and SUP 12.5.7R). It cannot advise or arrange deals. The principal is responsible for what it does in the business the principal has accepted responsibility for (FSMA section 39(3)).
Can a CFD affiliate offer a sign-up bonus or cashback?
Not to UK retail clients. COBS 22.5.20R bars a CFD firm from offering or providing monetary or non-monetary incentives to retail clients when marketing CFDs, spread bets or rolling spot forex, and COBS 22.5.21G names account-opening bonuses and fee rebates, including volume-based rebates. Lower fees offered to all retail clients are not an incentive.
How often should firms monitor affiliates?
The FCA sets no fixed frequency. FG24/1 lists ongoing monitoring of affiliates' promotions for their lifetimes as good practice. Where a firm approves a promotion issued by an unauthorised person, it must take reasonable steps to monitor it for as long as it is communicated and collect quarterly attestations of no material change (COBS 4.10.2R), and the FCA says attestations alone are not enough (PS23/13, non-Handbook guidance, paragraph 40).
Sources
38 sources, read on
- FG24/1: finalised guidance on financial promotions on social media (PDF)Guidance · 26 March 2024; paragraphs 1.6, 1.12, 3.18 to 3.23 and 4.12, and Table 2
- Financial Services and Markets Act 2000, section 21Legislation
- Financial Services and Markets Act 2000, section 25Legislation
- Financial Services and Markets Act 2000, section 19Legislation
- PRIN 2A.2.9R: foreseeable harm through the distribution chainRule
- Financial Services and Markets Act 2000, section 39Legislation
- COBS 4.10: approving financial promotionsRule · COBS 4.10.2R and COBS 4.10.7AG
- CySEC Circular C217: use of affiliatesGuidance · 26 June 2017
- ESMA Q&A on CFDs and other speculative products (ESMA35-36-794)Guidance · Sections 3 and 10; a supervisory Q&A aimed at national regulators, last updated 31 March 2017
- PERG 2.7.7EG: credit brokingGuidance
- ESMA discussion paper on MiFID II investor protection topics linked to digitalisation (ESMA35-43-3682)Publication · 14 December 2023; a consultation, not guidance
- CONC 8.9: lead generatorsRule · CONC 8.9.2R and 8.9.4R
- SUP 12: appointed representativesRule · SUP 12.2.8G, 12.4.6R, 12.5.7R, 12.6.1R, 12.6A.1G and 12.6A.6R
- PERG 8.6.2G: persons who communicate a financial promotionGuidance
- PERG 8.9: approving financial promotionsGuidance · PERG 8.9.1BG and 8.9.3G
- Exemptions from Financial Promotion General Requirement Regulations 2023 (S.I. 2023/966), regulation 3Legislation
- PS22/11: improving the appointed representatives regimePublication · Rules took effect on 8 December 2022
- CONC 3.7.7R: credit brokers' statusRule
- CONC 4.4.2R: credit brokers' feesRule
- PRIN 2A.1.14G: firms in the distribution chainGuidance
- FG22/5: non-Handbook guidance on the Consumer Duty (PDF)Guidance · July 2022; paragraph 2.22
- Implementing the Consumer Duty in the CFD portfolio (PDF)Publication · FCA letter, 31 March 2023
- COBS 22.5: CFDs and similar speculative investmentsRule · COBS 22.5.6R, 22.5.20R and 22.5.21G
- COBS 4.12A: promotion of restricted mass market investmentsRule · COBS 4.12A.7R, 4.12A.8G and 4.12A.11R
- Online affiliate marketingGuidance · CAP Executive advice, 22 March 2023; not binding on the ASA
- CAP Code, rule 2.1 and section 14Rule · Advertising Standards Authority
- Our Contracts for Difference (CFD) strategy (PDF)Publication · FCA letter, 1 December 2022
- Firms' preparations to comply with the cryptoasset financial promotions regime: good and poor practicePublication · 7 September 2023
- Our Contracts for Difference (CFD) strategy (PDF)Publication · FCA letter, 13 December 2024
- Enforcement Watch 2Publication · 7 July 2026
- Regulatory Priorities reportsPublication · First published 24 February 2026
- MiFID II, Article 24Legislation
- Request to ESMA for technical advice on the Retail Investment Strategy amendments (PDF)Publication · European Commission, July 2026
- Financial Services RegisterOther · FCA
- Digital Services Act (Regulation (EU) 2022/2065), Article 39Legislation · EUR-Lex may block automated requests; it opens in a browser
- Financial promotions data 2024Publication · 7 February 2025
- COBS 4.11.1R: record keeping for financial promotionsRule
- PS23/13: non-Handbook guidance for firms approving financial promotions (PDF)Guidance · September 2023; paragraph 40
This page explains the rules; it is not legal advice. Rules change: read the provision itself before relying on it. If you find an error, email hi@runconnor.com and we will correct it.
James Zhao
Co-founder, ConnorJames is a co-founder of Connor. After a corporate career at Barclays and KPMG as a software engineer, he built and exited his own software company. He has spent the last three years at the forefront of AI, and the most recent of them building AI-native products and the agent platform behind Connor.
Kashif Rafiq
Co-founder, ConnorKashif is a co-founder of Connor. He spent his career inside two of the most heavily monitored industries there are, investment banking at Goldman Sachs and energy at BP, working on the security and technology systems that keep regulated communications and data under control. He now builds Connor, which checks financial promotions against the rules that apply to them.
