Guides for loan officers

CAN-SPAM Basics: Staying Legal When You Email Your List

By Travis · October 9, 2026 · 4 min read

Email marketing is one of the most regulated forms of marketing in the country, and most loan officers have never read the actual rules. That's understandable. The rules sound intimidating, and lawyers are expensive.

Here's the good news: for a typical loan officer emailing their own database, compliance is straightforward. This article covers the basics so you know where the lines are. One important note before we start: this is general information, not legal advice. If you have a specific compliance question, talk to an attorney.

What the law covers

The federal CAN-SPAM Act sets the rules for commercial email. That's email whose primary purpose is advertising or promoting a product or service. Your monthly newsletter to your database, which promotes you as a lender, generally falls in this category.

Note what the law doesn't require: prior permission. CAN-SPAM is an opt-out law, not an opt-in law. You don't need someone's written consent to email them. But you do need to give them a working way to opt out, and you need to honor it. That's the trade the law makes, and it's a fair one.

The seven requirements

The FTC lays out seven main requirements for commercial email. Here they are in plain English:

• Don't use false or misleading header information. Your "From," "To," and routing details must accurately identify who's sending the email.
• Don't write deceptive subject lines. The subject has to reflect what's actually in the message. No bait and switch.
• Identify the message as an ad, where applicable. If it's advertising, that needs to be clear. Most legitimate business newsletters satisfy this naturally through their content and branding.
• Include your valid physical postal address. Every commercial email needs it. Your office address works fine.
• Give recipients a clear way to opt out. Every email has to explain how to stop getting future emails from you.
• Honor opt-out requests promptly. Once someone opts out, you have ten business days to stop emailing them. You can't charge them, demand extra information, or make them jump through hoops to unsubscribe.
• You're responsible even if someone else sends for you. If you hire a company to handle your email marketing, the law still holds you accountable for what they send on your behalf. Choose vendors carefully.

That's the whole framework. None of it is exotic. It's mostly about honesty and giving people control.

Habits that make compliance automatic

You don't need to think about CAN-SPAM every time you hit send. You need systems that handle it for you.

First, send through a real email platform or CRM, not your personal inbox. Every legitimate platform includes unsubscribe links and opt-out handling automatically. If you're manually managing unsubscribes in a spreadsheet, you're one busy week away from a violation.

Second, put your office address in your email footer and leave it there. Set it once in your template and never think about it again.

Third, never buy email lists. CAN-SPAM doesn't explicitly ban purchased lists, but emailing strangers who never asked to hear from you generates complaints, and complaints are what get senders in trouble. Your own database of past clients, prospects, and referral partners is the only list you need.

What about past clients?

A common question: do the rules apply when emailing people you've done business with? Yes. The requirements above apply to commercial email regardless of your relationship with the recipient. Having closed their loan doesn't exempt the message.

That said, emailing your own past clients is the lowest-risk email marketing there is. They know you, they expect to hear from you, and they rarely complain. The rules still apply, but they're easy to follow when the relationship is real.

When in doubt, be conservative

The loan officers who run into trouble with email compliance are almost never the ones sending a thoughtful monthly newsletter to their own database. They're the ones blasting purchased lists, hiding unsubscribe links, or misleading people about who's emailing them.

Stay on the right side by default: honest subject lines, your real name, your real address, an easy way out. Do that consistently and compliance takes care of itself.

And remember the note from the top: this is general information to help you understand the basics, not legal advice for your specific situation. When something feels like a gray area, that's what attorneys are for.

I recommend sending through a platform that handles unsubscribes automatically, so the legal side stays boring while you focus on the business it brings in.

← All guides