The Laws That Govern Your Marketing Compliance | FFIEC Guidance

What follows isn’t a new regulatory framework. It’s the existing one, applied to social media. Every law listed here already governs an institution’s lending, deposit, advertising, and data practices. Social media doesn’t get an exemption.

Deposit Disclosures: TISA and Regulation DD

Advertise a deposit product on social media, and you’re subject to Regulation DD. That means clear disclosure of fees, annual percentage yield, and interest rate. The format matters less than the substance: a 280-character post still needs to present those terms clearly and conspicuously. Regulation DD and NCUA Part 707 specify what “clear and conspicuous” means, and neither regulation makes an exception for brevity. The character constraint can be a true compliance concern. A caption-length post promoting an account offer may have a more difficult time meeting disclosure standards.

Fair Lending: ECOA and the Fair Housing Act

Your institution can’t use social media to discourage qualified applicants on a prohibited basis. Here is where recent guidance shifts the risk calculus.

The CFPB’s rule adjustment effective July 21, 2026, removed disparate impact liability and narrowed what counts as prohibited discouragement under Regulation B. A post that creates a negative impression in some readers may not, on its own, violate ECOA. Marketing a credit product to one demographic group doesn’t, on its own, amount to discouragement toward another. What does violate ECOA: a statement made with intent to discourage, based on race, color, religion, national origin, or sex.

That shift matters. It means clear oral or written statements that show intent to discourage are now the operative question in fair lending review of your advertising. Financial institutions should be very clear about what intent drove targeting decisions on any paid social campaign promoting credit products. Document that demographic segmentation was based on geography, income, or credit profile, not on protected characteristics. Platforms routinely collect data about users’ race, religion, and national origin. Confirm your loan officers aren’t using it, even inadvertently, in a way that could trigger fair lending exposure. Lenders might also take into account that current administration decisions and corresponding interpretation guidance may look somewhat different if & when there’s a changing of the guard.

Lending Disclosures: TILA and Regulation Z

Any post advertising a credit product must comply with Regulation Z. Regulation Z defines an advertisement broadly: any commercial message promoting consumer credit. Its official guidance confirms the advertising rules apply to messages delivered electronically.

Disclosure requirements vary by credit type: open-end vs. closed-end, student loans, home-secured credit, credit cards. But the standard is consistent across all of them. Required information must be presented clearly and conspicuously, a bar that a caption-length post will struggle to meet if the rate or term is material to the offer. If your institution is advertising rate or terms on social media, audit a sample of posts for trigger term compliance as part of your campaign cycle.

Referral Arrangements: RESPA Section 8

A co-branded post or a joint promotion with a real estate agent can violate RESPA Section 8 without anyone intending it to. RESPA prohibits fee splitting and the exchange of anything of value for settlement service referrals. That “anything of value” is broad, and it includes shared marketing costs. Monitor your loan officers’ social media activity for any sign of referral arrangements or co-marketing with settlement service providers. A post thanking a realtor team publicly for their partnership, or promoting a joint event, can raise Section 8 questions that take time to untangle during examination.

Accuracy and Transparency: UDAAP

An act can violate the prohibition on unfair, deceptive, or abusive practices even if it’s technically compliant with every other applicable law. Unfair, Deceptive, or Abusive Acts or Practices, UDAAP, is fact-specific and broad. A post that overstates a promotional rate, or omits a material condition to make an offer sound better than it is, carries UDAAP exposure regardless of intent. So does a rate that’s quoted accurately in isolation but inconsistently with what your institution quotes elsewhere. Confirm that anything your institution communicates on social media is accurate and consistent with what it discloses on your website, in advertising, and in branch signage.

Gramm-Leach-Bliley Act (GLBA): Title V of the GLBA

Title V of the GLBA sets requirements for privacy and security of consumer information. It applies whenever your institution integrates social media into a customer’s online account experience or takes applications through a social media portal. Your privacy policy disclosures need to reflect that. Many financial institutions outlaw in their policy the ability to collect key information for a loan application on social media. Even outside a formal customer relationship, careless handling of consumer information on social media creates reputation risk independent of any GLBA violation.

---

Ready toreduce your risk?

Multiple laws, one feed to watch.

ActiveComply^® Social flags advertising, disclosure, and potential privacy issues across your institution’s social accounts before an examiner does. See how ActiveComply Social works, or talk to our team.

Request Demo