FINRA Rule 3230
FINRA Rule 3230 governs telemarketing activities by FINRA member firms and their associated persons. The rule prohibits outbound telephone calls during restricted hours, to persons on firm-specific do-not-call lists, and to persons registered on the Federal Trade Commission's national do-not-call registry. It establishes the conditions under which exceptions apply, mandates written procedures and personnel training before any telemarketing program begins, governs caller identification requirements, addresses abandoned calls and prerecorded messages, and prohibits specific forms of billing fraud and credit card laundering in the telemarketing context. Rule 3230 is one of the most operationally detailed rules in the FINRA rulebook — its twenty defined terms and twelve substantive provisions reflect the dense regulatory environment created by the intersection of securities regulation, federal consumer protection law, and FCC telecommunications rules.
Rule 3230 sits within the 3200 responsibilities relating to associated persons subsection of the 3000 series. It was adopted as NASD Rule 2212, effective December 2, 1996, and consolidated into the FINRA rulebook as Rule 3230, effective June 29, 2012, following SEC approval under SR-FINRA-2011-059. The 2012 consolidation incorporated relevant provisions of NYSE Rule 440A — Telephone Solicitation — and added provisions substantially similar to FTC rules prohibiting deceptive and abusive telemarketing practices, as the Telemarketing Consumer Fraud and Abuse Prevention Act of 1994 directed the SEC to require national securities associations to adopt rules at least as protective as the FTC's telemarketing regulations. The rule was most recently amended effective February 4, 2013.
The practical significance of Rule 3230 is broad. Cold-calling — the traditional tool of securities solicitation — is the paradigm case of telemarketing as the rule defines it. Any member firm running a telephone solicitation program, whether to prospect for new accounts or to solicit existing customers about new products, must comply with Rule 3230's full framework. Associated persons who make individual outbound calls to potential customers are equally subject to the rule. The obligations are not delegable — if a member outsources telemarketing to a third party, the member remains responsible for that third party's compliance with every provision of the rule.
The Legislative and Regulatory Framework Behind the Rule
Understanding Rule 3230 requires appreciating the multi-statute environment from which it emerged. Three federal statutes and their implementing rules operate alongside Rule 3230 and are expressly preserved by Supplementary Material .01, which states that the rule does not affect any member's obligation to comply with the Telemarketing and Consumer Fraud and Abuse Prevention Act, the Telephone Consumer Protection Act, and the FCC's telemarketing regulations.
The Telemarketing and Consumer Fraud and Abuse Prevention Act of 1994 directed the FTC to promulgate rules against deceptive telemarketing and directed the SEC to require registered securities associations to adopt substantially similar rules. The FTC's Telemarketing Sales Rule — codified at 16 CFR Part 310 — was the template. The SEC's direction to FINRA to strengthen its telemarketing rule to match FTC protections produced the 2012 amendments that brought Rule 3230 into alignment with current FTC standards, including the abandoned call provisions, the prerecorded message framework, the billing consent requirements, and the credit card laundering prohibition.
The Telephone Consumer Protection Act of 1991, codified at 47 U.S.C. 227, and the FCC's implementing regulations at 47 CFR 64.1200 impose independent restrictions on telephone solicitation, including requirements around autodialed calls and text messages to mobile phones that operate parallel to Rule 3230's outbound call restrictions. Rule 3230(e) explicitly extends the rule's provisions to wireless telephone numbers, which means that cold calls to mobile phones are fully subject to all of Rule 3230's requirements — an expansion from the original rule's residential telephone focus that reflects the near-universal shift from landlines to mobile communications.
The Three Core Prohibitions and Their Exceptions
Rule 3230(a) establishes the three foundational prohibitions on outbound telephone calls. No member or associated person may initiate an outbound call to a residential number before 8 a.m. or after 9 p.m. local time at the called party's location, to any person who has previously stated they do not wish to receive calls from that member, or to any person whose telephone number appears on the FTC's national do-not-call registry.
The time of day restriction contains three exceptions. A call may be placed outside permitted hours if the member has an established business relationship with the called person under the rule's eighteen-month definition, if the person has given prior express invitation or permission to receive calls, or if the person called is a broker or dealer. The broker or dealer exception reflects the rule's primary consumer protection focus — the time restrictions are designed to protect residential consumers, not industry professionals.
The national do-not-call prohibition — Rule 3230(a)(3) — contains three exceptions of greater practical significance. The established business relationship exception permits calls to persons with whom the member has had a financial transaction, a security position, a money balance, or account activity within the previous eighteen months, or for whom the member is the broker-dealer of record within the previous eighteen months, or who have contacted the member to inquire about a product or service within the previous three months. This exception is critical for broker-dealers maintaining ongoing contact with existing clients but carries a significant limitation: a person's explicit request to be placed on the firm's do-not-call list terminates the established business relationship exception for that firm even if the person continues to do business there. The firm cannot rely on the business relationship to override a direct do-not-call request.
The prior express written consent exception requires a signed written agreement — which may be obtained electronically under the E-Sign Act — in which the person agrees to be contacted and provides the telephone number to which calls may be placed. The personal relationship exception allows associated persons to call family members, friends, and acquaintances, recognizing that personal networks are a legitimate and traditional source of business that should not be obstructed by do-not-call machinery designed for commercial cold-calling.
The Safe Harbor for Erroneous Calls
Rule 3230(c) provides a safe harbor that protects a member from liability for a national do-not-call violation if the violation was the result of an error and the member has established and maintains a compliant telemarketing program meeting four standards: written procedures for do-not-call compliance, trained personnel, a maintained list of numbers that may not be contacted, and a process using a version of the national do-not-call registry obtained no more than thirty-one days before any call is made with documented records of that process. The thirty-one day database currency requirement is operationally important — a firm that uses a stale registry version loses safe harbor protection even if all other conditions are met.
The safe harbor exists because managing a large do-not-call compliance program at scale creates a statistical near-certainty that occasional errors will occur despite diligent systems. A firm that has built and implemented a genuinely compliant program should not face the same liability as a firm that has made no compliance effort simply because an error slipped through. The safe harbor preserves the incentive to invest in serious compliance infrastructure.
Mandatory Procedures Before Any Telemarketing Program Begins
Rule 3230(d) requires every member to institute procedures meeting specified minimum standards before engaging in telemarketing at all. The minimum standards are not suggestions — they are prerequisites. A firm that begins a telemarketing program without meeting these standards has violated Rule 3230 regardless of whether any other violation subsequently occurs.
The minimum standards require a written do-not-call policy, trained personnel for all aspects of telemarketing, a system for recording do-not-call requests and adding persons to the firm's list within thirty days of any request, identification of the caller and firm on every outbound call with the purpose of the call disclosed, a defined relationship between the firm-specific do-not-call list and affiliated entities, and maintenance of records of do-not-call requests. The thirty-day maximum response time for honoring do-not-call requests is an upper limit, not a target — firms should aim to honor requests as promptly as operationally possible.
The identification requirement in Rule 3230(d)(4) is particularly consequential for registered representatives. Every outbound call must include the name of the individual caller, the name of the member, an address or telephone number where the member can be reached, and a statement that the purpose of the call is to solicit the purchase of securities or related services. A registered representative who does not identify themselves and their firm on a prospecting call, or who obscures the solicitation purpose of the call, violates Rule 3230(d)(4) directly and may also violate FINRA Rule 2010's standards of commercial honor. The required telephone number cannot be a premium-rate 900 number or any number that charges the called party beyond normal long-distance rates.
The outsourcing provision in Rule 3230(f) deserves particular attention in the compliance context. If a member uses a third party to perform telemarketing services, the member is responsible for ensuring the third party's compliance with all Rule 3230 provisions. This means members must conduct diligence on any telemarketing vendor, contractually require compliance with Rule 3230, and monitor the vendor's practices — a failure of the vendor is a failure of the member.
Caller Identification, Abandoned Calls, and Prerecorded Messages
Rule 3230(g) requires firms engaged in telemarketing to transmit caller identification information — the telephone number and, where available, the member's name — to any caller identification service used by the recipient. Blocking caller ID transmission is expressly prohibited. The telephone number transmitted must permit do-not-call requests during regular business hours, creating a direct feedback channel from the recipient to the member's do-not-call management system.
Rule 3230(j) addresses abandoned calls — the consumer protection problem created by predictive dialers that place more calls than agents can handle, resulting in answered calls where no person is available to speak. A call is abandoned when a person answers and the call is not connected to an associated person within two seconds of the completed greeting. The rule provides a safe harbor allowing up to three percent of answered calls to be abandoned across a calling campaign or successive thirty-day periods, provided the technology allows the phone to ring for at least fifteen seconds before disconnecting unanswered calls, a recorded message states the member's name and callback number when no agent is available, and the member maintains records of compliance. The abandonment rate limit reflects FTC standards and prevents the most aggressive predictive dialing practices while accommodating the operational reality that automated dialing systems routinely generate some mismatch between calls answered and agents available.
Rule 3230(k) governs prerecorded messages — calls that deliver a recorded script rather than a live representative. These are subject to strict prior written consent requirements. A member may deliver a prerecorded message only if the recipient has provided express written agreement specifically authorizing prerecorded calls from that member, obtained after a clear disclosure of the agreement's purpose and without conditioning it on account opening or any purchase. The written consent must include the recipient's telephone number and signature, which may be electronic. The prerecorded message itself must provide the required identification disclosures and offer an automated opt-out mechanism that immediately adds the number to the do-not-call list and disconnects the call.
Billing Consent and Credit Card Laundering Prohibitions
Rules 3230(h), (i), and (l) address fraud-prevention concerns specific to the telemarketing context that are less directly relevant to most traditional securities solicitation but that FINRA incorporated to align Rule 3230 with FTC standards.
Rule 3230(h) prohibits disclosing or receiving, for consideration, unencrypted consumer account numbers for use in telemarketing. The prohibition covers not only fully visible account numbers but also encrypted information accompanied by a decryption key — functional access to the account number is what the rule prohibits, not merely the format in which the number is transmitted. An exception applies when billing information is shared to process a payment in a telemarketing transaction that has already been completed.
Rule 3230(i) requires express informed consent from the customer for any billing in a telemarketing transaction, with enhanced requirements for transactions involving preacquired account information — situations where the telemarketer already has the customer's account number from a prior relationship — combined with a free-to-pay conversion feature. In those cases the customer must provide at least the last four digits of the account to be charged, provide express agreement to that charge, and the entire transaction must be audio recorded.
Rule 3230(l) prohibits credit card laundering — presenting credit card sales drafts generated by a telemarketing transaction that did not actually occur between the cardholder and the member, or using merchant relationships to gain unauthorized access to the credit card system. These provisions are directed at organized fraud schemes that exploit telemarketing infrastructure to process fraudulent charges.
The Established Business Relationship and Do-Not-Call List Interaction
One of the most frequently litigated aspects of Rule 3230 in the FINRA FAQ guidance is the relationship between the established business relationship exception and a person's firm-specific do-not-call request. The rule's design on this point is intentional and firm: a person's explicit request to the member not to call them terminates the established business relationship exception to the national do-not-call registry for that member. The firm cannot argue that because the customer has ongoing securities positions, or is still receiving account statements, the existing business relationship justifies continued calls over the customer's explicit objection.
The firm-specific do-not-call list and the national do-not-call registry operate somewhat differently in terms of affiliation scope. A person's firm-specific do-not-call request applies to the member that received the request and does not automatically extend to affiliated entities unless the consumer would reasonably expect them to be included given who called and what was advertised. Conversely, a person's established business relationship with a member does not extend to affiliates and does not extend from affiliates to the member. Each entity in a corporate family must separately evaluate its relationship with each called person.
Supervision and Written Supervisory Procedures
Rule 3230 sits within the supervisory framework of FINRA Rule 3110. Member firms engaged in telemarketing must have written supervisory procedures that specifically address every operative provision of Rule 3230 — the time of day restrictions, the firm-specific do-not-call list maintenance process, the national registry access and currency procedures, the personnel training program, the caller identification transmission requirements, the abandoned call monitoring system, any prerecorded message consent management, and the outsourced telemarketing vendor oversight process. The supervisory control testing required by FINRA Rule 3120 should include periodic testing of the telemarketing compliance program, including sampling of call records, do-not-call list management, and the currency of registry versions used.
Where firms employ Rule 3170's taping procedures for registered persons, those recordings serve as a secondary compliance resource for Rule 3230 supervision — recorded calls can be reviewed not only for sales practice compliance but also for time of day compliance, caller identification compliance, and the accuracy of required disclosures.
Examination Relevance and Key Takeaways
FINRA Rule 3230 is tested on the Series 7 General Securities Representative examination in the context of prohibited practices, customer protection requirements, and the conduct obligations of registered representatives making outbound calls. The Series 24 General Securities Principal and Series 9 and Series 10 General Securities Sales Supervisor examinations test Rule 3230 in greater depth, covering the supervisory procedures requirements, the do-not-call list management obligations, and the outsourcing responsibility framework. Series 4 Registered Options Principal candidates encounter Rule 3230 as part of the broader conduct rules applicable to registered representatives they supervise.
The key points to retain are these: FINRA Rule 3230 governs telemarketing — any plan, program, or campaign involving at least one outbound telephone call — by members and their associated persons, and extends fully to calls made to wireless telephone numbers; the three core prohibitions bar outbound calls before 8 a.m. or after 9 p.m. local time, calls to any person who has requested no further calls, and calls to numbers on the FTC national do-not-call registry; three exceptions to the national registry prohibition are available — the established business relationship exception covering persons with account activity or inquiry within the prior eighteen or three months, prior express written consent, and a personal relationship of the calling associated person — but an explicit do-not-call request terminates the established business relationship exception even for ongoing customers; a safe harbor from national registry violations is available where a violation resulted from error and the firm maintains written procedures, trained personnel, a maintained list, and a registry no more than thirty-one days old; before any telemarketing begins, firms must have written do-not-call policies, trained personnel, a system to record and honor requests within thirty days, and must identify the caller, the firm, a contact number, and the solicitation purpose on every call; caller identification information must be transmitted and may never be blocked; abandoned calls — those not connected to a live person within two seconds of the answered greeting — may not exceed three percent of answered calls with a safe harbor for compliant programs; prerecorded messages require prior express written consent specific to that member; members remain responsible for third-party telemarketing vendor compliance in all respects; and Supplementary Material .01 preserves the independent obligation to comply with the Telemarketing and Consumer Fraud and Abuse Prevention Act, the Telephone Consumer Protection Act, and FCC telemarketing regulations alongside Rule 3230.
