UK regulations for startup funding communications: FSMA section 21, financial promotion exemptions and investor data

Startup funding can touch company law, financial promotions, regulated activities, advertising, data protection, tax and contract duties. The applicable rules depend on what is offered, who communicates it, the audience and the channel. Calling a round "private" or adding a disclaimer does not settle those questions.

What to take away

Section 21 of the Financial Services and Markets Act 2000 restricts communicating an invitation or inducement to invest unless the sender is authorised or an authorised person approves the content.
The exemptions depend on factswho makes the promotion, who receives it and what it concerns.
Investor lists and data rooms need a defined controller and processor analysis.
HMRC advance assurance covers certain scheme conditions only, not investor eligibility.
One owner should stop release when evidence or authority is missing.

The financial promotion restriction

Under FSMA section 21, a person must not, in the course of business, communicate an invitation or inducement to engage in investment activity. Two cases are outside the restriction: the sender is an authorised person, or an authorised person approves the content for the purposes of the section.

The general prohibition in section 19 of the same Act is separate: it concerns carrying on regulated activities unless you are an authorised person or an exempt person. A startup can fall under section 21 without carrying on a regulated activity itself. Map both questions before any outreach.

Exemptions are fact-specific

The FCA's guidance in PERG 8.14 says the exemptions apply to different types of financial promotion, and that the exemption available may be based on a number of facts. Those facts include the maker, the recipient, the subject matter and the nature of the promotion.

One example is the one-off exemption for promotions other than unsolicited real time promotions. Whether a promotion is one-off depends on the individual circumstances, and the guidance notes that the overriding issue is whether it is, in fact, one-off. A mass email or public post is unlikely to meet that test.

Another route is the self-certified sophisticated investor. Under article 50A of the Financial Promotion Order 2005, such an investor is an individual who has completed and signed a statement within the twelve months ending on the day of the communication. The communication must also carry a statement that it is exempt on that ground.

The Financial Promotion Order 2005 names the main routes. Each has its own conditions, and the sender must hold a reasonable belief about the recipient.

Order article	Exemption	Condition in outline
Article 19	Investment professionals	Made only to recipients believed on reasonable grounds to be investment professionals
Article 48	High net worth individuals	Made to an individual believed on reasonable grounds to be one, with a risk warning
Article 50	Certified sophisticated investors	Made to a certified investor, only for the kind of investment certified
Article 50A	Self-certified sophisticated investors	Signed statement within the previous twelve months

Under article 48 the promotion must carry a warning that reliance on it may expose an individual to a significant risk of losing all of the property or other assets invested. Under article 50 the statement must say that the content has not been approved by an authorised person and that such approval is, unless an exemption applies, required by section 21.

Do not coach recipients into a category. Take advice before you rely on any exemption, and keep the signed statement with the version of the deck you sent. A public social media post inviting anyone to invest in a convertible loan note needs the section 21 analysis before it goes live.

Build the record for each communication

Record the issuer, founders, directors, platform, adviser, introducer, promoter and intended investors. Save the exact deck, email, landing page, social post and event script. A compliance review needs the communication itself, its purpose, audience and distribution method.

Item to record / Why it matters

Sender and legal entity: Authorised, exempt or neither
Approver and date: Section 21 approval covers the final version
Recipient category: Exemptions depend on the recipient
Channel and format: One-to-one email differs from a public post
Version and expiry: A later edit may need fresh approval

If an authorised person is expected to approve a promotion, confirm that it can lawfully do so and has reviewed the final communication. Check the advertising rules for claims and forecasts before release.

Investor data and data rooms

Investor lists, founder details, cap tables and data-room files may contain personal data. Under the UK GDPR, a controller is the body that determines the purposes and means of the processing of personal data, alone or jointly with others, and a processor processes personal data on behalf of the controller.

Work out which role each party holds instead of relying on contract labels. The data protection article maps purpose, lawful basis, access, retention and security. Match data-room permissions to the stage and remove access when the process ends.

Tax schemes and advance assurance

Asking HMRC whether an investment would meet the conditions of a venture capital scheme is called advance assurance. HMRC advance assurance will not tell you whether an investor would meet the conditions of the scheme, and you need separate applications for each proposed investment.

Do not describe advance assurance as a guarantee of relief. See how rounds are timed in EIS advance assurance and compare SEIS and EIS before you tell investors anything about relief.

Company and transaction records

Reconcile ownership, options, convertibles, board authority and statutory filings before issuing securities or signing finance documents. The commercial contracts article lists the records to keep. Document conflicts, related parties, advice and approvals.

Grants may carry conditions on the use of funds, and lender covenants can restrict further borrowing, security or changes in control. Keep evidence and take current advice.

Build a release gate

Assign one owner to collect the perimeter analysis, advertising evidence, tax review, privacy assessment and board approval. The owner should not decide every specialist question, but should stop release when evidence or authority is missing.

Record the date and final version covered by each opinion. Reopen the gate after a material change to audience, risk, forecast, fee, scheme status or contractual term. Keep a correction and withdrawal process. For a live campaign, take advice from an English solicitor, an FCA-perimeter specialist and a tax adviser.

Before you act

Record every participant and save each communication version.
Decide whether section 21 applies to each communication.
Confirm any approver can lawfully approve the final promotion.
Identify controller and processor roles for investor data.
Apply for advance assurance per investment, not once for all.
Reopen the release gate after any material change.

Common questions

What determines which rules apply to a funding communication?

What is offered, who communicates it, the audience and the channel. A review therefore looks at the communication itself, its purpose, audience and distribution method.

What should be checked before an authorised person approves a promotion?

That the approver can lawfully approve it, understands the investment and has seen the final version. Keep the approval and version record; a later edit may need a fresh assessment.

How should personal data in investor lists be handled?

Identify the controller, purpose, lawful basis, access, recipient, retention and security. Remove data-room access when the process ends.