Running the pre-launch marketing compliance checklist and sign-off

The request that exposes a marketing team never arrives while the campaign is live. It arrives a year later, in writing: send us every version of the creative, the dates each version ran, the audiences it reached, the evidence behind the rate you quoted, and the name of the person who approved it. A team with a pack answers in two days. A team without one spends six weeks rebuilding it from Slack threads, ad accounts and a freelancer's hard drive, and the rebuild becomes its own finding, because a firm that cannot show how it approved a promotion has just told its supervisor what its controls are worth.

This lesson covers the governance side: who signs, what evidence is retained and for how long, how launch gating changes when a regulator already has the firm under watch, and what shipping without the pack costs.

Who signs, and what the signature means

Sign-off is an individual, never a department. "Compliance approved it" is not a record. "K. Mensah, Head of Compliance, 14 March, asset SAV-0421-v3" is.

In the UK, the Senior Managers and Certification Regime puts a named senior manager on the hook for the firm's financial promotions controls, and the FCA can act against that person, not only the entity. US banks usually reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → the same place through delegated authority: the board's compliance committee delegates down to a named compliance officer, with a written matrix saying what a brand manager may clear alone and what needs the second signature.

Two rules keep the matrix honest.

• Four eyes, minimum. The person who wrote the claim cannot be the person who clears it. Obvious until a product marketer holds approver rights in the workflow tool and clears their own send at 6pm on a Friday.
• Agency review is not sign-off. Your agency's legal team reading the creative is useful input and nothing else; the regulated firm owns the promotion. The FCA made the boundary concrete in February 2024, when approving a financial promotion on behalf of an unauthorised person became a permission a firm has to apply for rather than something any authorised firm could do as a favour.

When the regulator is already watching

Everything above assumes business as usual. Enhanced supervision changes the shape of the gate.

N26 is the clearest case. In November 2021 BaFin capped the bank at roughly 50,000 new customers per month over anti-money-laundering deficiencies and installed a special monitor to oversee the remediation. The cap ran until 2024. For a marketing team, an onboarding cap inverts the usual incentive: a paid campaign that overperforms is a breach, not a win.

Three things change in the checklist under an order like that:

• A capacity check joins the launch criteria. Forecast applications for the flight, add whatever else is already in market, and show headroom against the cap before spend goes live.
• The gate acquires a reviewer outside the firm. Where a monitor or skilled person is appointed (in the UK, a section 166 review, which the firm pays for), material campaigns get shared before launch and your two-day fast-track becomes a week. Plan launch dates backwards from that, or stop promising them.
• The spend mix moves. Capped acquisition pushes budget into retention, brand and waitlists, which carry their own claim risk but do not consume onboarding capacity.

There is a harder version. A regulator can attach a requirement to a firm's permissions that bars promotion of a product line outright. At that point the sign-off question stops being "is this compliant" and becomes "are we permitted to say anything about this product at all", and the answer belongs to the senior manager, not to the campaign owner.

Building the approval workflow

The goal is a system where legal review is a gate, not a bottleneck. Gates have clear entry criteria, a fixed reviewer and a defined turnaround. Bottlenecks are open-ended email chains.

Stage 1: Intake and self-check

Before anything reaches legal, the marketing owner completes a structured brief: product and channel, every quantified claim, the audience and its targeting parameters, and the disclosures already drafted to the pattern the disclosure lesson sets out.

Log the targeting settings verbatim, including exclusions, with the suppression logic the consumer-protection lesson describes already applied. Reviewers cannot assess an audience they cannot see, and "the platform defaulted to that" is not a defence anyone has ever won with.

Stage 2: Tiered legal review

Not every asset needs the same scrutiny. Route by risk.

• Tier 1 (low): brand awarenessbrand awarenessThe degree to which your target audience recognises or recalls your brand, either prompted or unprompted. It measures how present your brand is in people's minds.View full definition →, no product terms, no numbers. One reviewer, 24-hour service level agreementservice level agreementA formal commitment defining the service level a provider guarantees to a customer, with measurable targets and consequences if they are missed.View full definition → (SLA, the promised turnaround).
• Tier 2 (medium): product mentions with general benefits, no specific rates. Standard review, 2 to 3 days.
• Tier 3 (high): any quantified rate, fee or comparative claim. Full compliance and legal review plus a substantiation file. 5 days.

Add one escalation trigger that overrides the tiering: anything touching a product with a live complaints theme, an open supervisory query or a recent remediation goes to Tier 3 whatever it looks like. That single rule catches the "harmless" social post about the product the regulator is already asking about.

Stage 3: Substantiation

Evidence goes on file before launch, not after a challenge. "Rated #1" needs the source and its date. "Lower fees than the big banks" needs the comparison, dated, with the peer set named and the pull date recorded, because competitor fees move and your claim quietly stops being true.

The FTC's advertising guidance for businesses is a free, plain-language reference for what substantiation and "clear and conspicuous" require in practice. Bookmark it for the team.

Stage 4: Formal sign-off

Sign-off is a named person accepting accountability, recorded with a timestamp. Verbal approval does not exist. If it is not logged, it did not happen.

A minimal record holds: asset ID and version, reviewer name and role, date, tier, disclosures confirmed, substantiation location, and the expiry date after which the approval lapses.

🎬 [VIDEO: "What is UDAAP? Consumer Protection in Banking" - youtube.com - a concise primer on how regulators judge unfair and deceptive marketing practices]

Records retention: the part everyone forgets

Retention periods vary by regime and change, so confirm them with counsel. As a working practice banks hold marketing records for several years, and communications in MiFID scope in Europe carry a five-year floor.

Design against the reproducibility test: can you show a supervisor what ran, where, to whom and on whose authority, without asking anyone to remember? The pack:

• final creative, every version, with asset IDs
• the sign-off record
• the substantiation file with dated sources
• the distribution log: channels, flight dates, targeting parameters as actually set in the platform, and screenshots of the live placements

The distribution log is what marketers skip and what examiners open first. It closes the gap between what was approved and what reached people.

One more artefact earns its place: a claims register mapping each approved phrase to every surface it appears on. Chime shows why. Chime is a financial technology company rather than a bank, with accounts provided by partner banks, and in 2021 it settled with California's Department of Financial Protection and Innovation and agreed to stop presenting itself as a bank. That is one word, and one word lives in a domain name, app store listings, paid ads, lifecycle emails, help centre articles and partner copy. If your inventory is a folder of PDFs, you cannot answer "where else did we say this?" and remediation stretches over months while the regulator watches you do it.

The launch-day checklist

Approval clears the content. This clears the execution, because errors creep in between sign-off and going live.

1. Version match: the live asset is the approved version, not an earlier draft. Confirm the asset ID.
2. Approval still valid: the sign-off has not passed its expiry date and any quoted rate still matches today's live product rate.
3. Disclosures intact: they survived the export, the resize and the mobile crop.
4. Insurance and licensing marks: deposit insurance signage and any required NMLS ID are present where the rules demand.
5. Targeting locked: platform settings match the approved brief, exclusions included, with suppression lists loaded.
6. Landing page aligned: the destination repeats the same terms. An ad quoting one rate against a page showing another is a live violation from minute one.
7. Kill switch ready: a named owner, reachable, who can pause the campaign within the hour.

Make it a required field before launch, not a suggestion.

Keeping the gate from becoming a wall

Compliance gets blamed for slow launches; the usual culprit is an undefined process. Four moves keep speed.

Pre-approved building blocks. A library of cleared disclosures, cleared benefit phrasings and cleared rate-display templates. Assembling from approved parts beats reviewing from scratch every time.

Published SLAs per tier, so marketing can plan backwards from launch. A known five-day Tier 3 is easier to work with than an unknown wait.

One system of record holding briefs, versions, sign-offs and retention. Email threads lose the audit trail, which is precisely what fails in an examination.

Measure the gate. Track first-pass approval rate, median cycle time by tier and post-launch corrections per quarter. If first-pass approval sits below half, the brief template is wrong, not the reviewers.

The FCA's Consumer Duty is a useful model even outside the UK: the firm carries the burden of showing it acted to deliver good outcomes, and boards have to sign an annual assessment saying so. That assessment is only as good as the files underneath it. The checklist is the evidence.

Key Takeaways

• Sign-off is a named individual with delegated authority and a timestamp, never a department. Four eyes minimum, and agency review never transfers the firm's liability.
• Enhanced supervision rewrites the gate: growth caps make an overperforming campaign a breach, monitors and skilled-person reviews add days to every turnaround, and permission requirements can take a product off the table entirely.
• Route reviews by risk with published SLAs, and add one override: anything attached to a live complaints theme or open supervisory query goes to the highest tier regardless of how small it looks.
• Retain the pack (every creative version, sign-off record, dated substantiation, distribution log with real targeting settings) so you can reproduce what ran, to whom, on whose authority, a year later.
• Keep a claims register mapping approved phrases to surfaces. When one word has to change, the register is the difference between a week of remediation and six months of it.