Banks and credit unions can’t rely on their fraud-alert exemption for marketing. The FCC’s exemption for financial institutions covers only messages about fraud, data breaches, and money transfers, and it bars any telemarketing or cross-marketing content. Loan offers, card upgrades, and new-account promotions follow the same TCPA rules as any other seller’s marketing. The good news is that a customer relationship gives a bank real defenses to Do Not Call claims, as long as the marketing stays inside it.
Does the TCPA apply to banks and credit unions?
Yes. The TCPA’s restrictions on autodialed and prerecorded calls apply to “any person within the United States,” under 47 U.S.C. § 227(b)(1), and the statute doesn’t carve out banks. That matters because banks are used to a different federal picture for consumer protection. The FTC’s general authority under 15 U.S.C. § 45(a)(2) excludes “banks, savings and loan institutions” and “Federal credit unions,” but the TCPA is a separate statute enforced by the FCC and by private lawsuits, and its rules reach financial institutions the same way they reach retailers.
What does the financial institution exemption cover?
Only a short list of messages about risk to the customer’s account. The FCC’s rule at 47 C.F.R. § 64.1200(a)(9)(iii) exempts calls and texts by a financial institution that are “strictly limited” to “transactions and events that suggest a risk of fraud or identity theft,” possible security breaches, steps to remedy a breach, and “actions needed to arrange for receipt of pending money transfers.” The same paragraph says these messages “must not include any telemarketing, cross-marketing, solicitation, debt collection, or advertising content.”
The exemption has other conditions too. Messages must go only to the wireless number the customer provided, a bank may send no more than three per event over a three-day period, and the rule requires that opt-out requests be honored “immediately.” The full set of conditions is covered in the post on the financial institution exemption for fraud alerts. For marketing, the takeaway is simple: a fraud alert that adds a line about a new credit card has left the exemption.
Mixed messages are where this goes wrong in practice. Marketing teams like account alerts because customers open them, and it’s tempting to add a short promotion to a message the bank already has permission to send. Once that happens, the message has to qualify on its own as marketing, with whatever consent and Do Not Call protection marketing requires, and the bank can’t fall back on the fact that the alert itself was allowed. A plaintiff’s lawyer reviewing a stack of these messages will treat every one with a promotion as a separate marketing text. The better practice is a written rule that alert templates can’t carry offers, and a review step before any template change goes live.
What consent does a bank need for marketing texts?
It depends on how the messages are sent. Under § 64.1200(a)(2), a call or text that “includes or introduces an advertisement or constitutes telemarketing,” sent to a cell phone using an autodialer or an artificial or prerecorded voice, needs “the prior express written consent of the called party.” That written consent must be a signed agreement authorizing the seller to send marketing messages, and it has to include the phone number. A phone number a customer gave when opening a checking account usually isn’t that agreement.
The autodialer definition limits this rule. Under the same section, an autodialer is equipment with the capacity to store or produce numbers “using a random or sequential number generator,” and most bank texting platforms send to stored lists of customer numbers without generating numbers at all. That doesn’t make marketing texts safe. It means the bigger risk for a typical bank text campaign usually sits in the Do Not Call rules and in state law, not in the autodialer claim. The difference between consent for account messages and consent for marketing is discussed in the post on the scope of TCPA consent.
| Message | Rule that applies | What the bank needs | Common problem |
|---|---|---|---|
| Fraud or breach alert | § 64.1200(a)(9)(iii) exemption | Every condition in the exemption | Adding marketing content |
| Autodialed or prerecorded marketing to a cell phone | § 64.1200(a)(2) | Prior express written consent | Relying on account-opening paperwork |
| Marketing call or text to a Registry number | § 64.1200(c)(2) | Established business relationship or written permission | Former customers outside the time limits |
| Marketing for an affiliate | § 64.1200(f)(5)(ii) | Reasonable customer expectation | Insurance or brokerage affiliates |
Can a bank call its own customers on the Do Not Call Registry?
Often, because of the established business relationship. A “telephone solicitation” under § 64.1200(f)(15) doesn’t include a call or message “To any person with whom the caller has an established business relationship.” The relationship is based on a purchase or transaction “within the eighteen (18) months immediately preceding the date of the telephone call,” or an inquiry or application within the three months before it.
There are two limits banks trip over. A customer’s request not to be called by that bank ends the relationship for telemarketing purposes “even if the subscriber continues to do business with the seller,” under § 64.1200(f)(5)(i). That means a long-time depositor who once asked to stop getting sales calls can’t be called again on the strength of the account. The second limit is time, since former customers and lapsed applicants fall outside the windows, and campaign lists built from old core-system data can sweep them in. The internal request side is covered in the post on internal do-not-call policies.
Can a bank’s affiliates market to its customers?
Not automatically. The rule at § 64.1200(f)(5)(ii) says a customer’s relationship “does not extend to affiliated entities unless the subscriber would reasonably expect them to be included given the nature and type of goods or services offered by the affiliate and the identity of the affiliate.” A bank holding company with insurance, brokerage, or mortgage affiliates should treat this as a real question, not a formality.
The safer course is to assume an affiliate with a different name and a different product line can’t call Registry numbers on the bank’s relationship. If the customer would see the affiliate as part of the bank, with the same brand and a related product, the argument is stronger. Either way, it’s better to decide before a campaign launches, since the answer depends on facts a plaintiff will dispute. When a bank faces a Do Not Call class claim over an affiliate campaign, defending TCPA class actions in California usually starts with the branding and product facts, because the reasonable-expectation test depends on what the customer saw.
What a bank should gather after a TCPA demand
- Preserve call and text logs, texting-platform and dialer data, and consent records for the numbers involved, under a litigation hold, including account-opening and online-banking enrollment records.
- Pull the opt-out and internal do-not-call logs with dates, because a single stop request can end the established business relationship.
- Pull the National Do Not Call Registry scrub records and the Registry version dates used for the campaign.
- Collect vendor and affiliate contracts and the message scripts, along with any prerecorded or AI-voice files.
- Talk to a lawyer before responding to the demand, contacting the customer, or offering a credit or fee waiver to settle.
Questions about bank and credit union TCPA compliance
Is a low-balance alert a marketing text?
Usually not, if it only reports the balance. An account alert the customer signed up for is informational. The risk comes from adding offers, such as overdraft protection or a credit line, to the alert. Once the message promotes a product, it’s telemarketing content, and the rules for marketing apply. Keeping alerts and marketing in separate message streams makes the line easier to defend.
Does the FTC’s Telemarketing Sales Rule apply to banks?
The FTC’s general authority under 15 U.S.C. § 45(a)(2) excludes banks and federal credit unions. That exclusion doesn’t help with the TCPA. The FCC’s TCPA rules and private TCPA lawsuits apply to banks and credit unions directly. A bank that hires an outside telemarketer should also check which rules apply to that vendor.
Can a credit union text members about a loan promotion?
Yes, if the consent and the membership support it. If the text reaches a member’s cell phone through an autodialer or prerecorded voice, it needs prior express written consent. If the member’s number is on the Registry, the established business relationship or a signed agreement has to cover the text. A member’s earlier request to stop marketing ends the relationship for that purpose, even though the membership continues.
Do state laws add rules for bank marketing texts?
They can. Several states have their own telemarketing and texting laws, each with its own definitions and exemptions, and those don’t always line up with the federal rules. A bank marketing across state lines should check the laws of the states where its customers live, not only the state where it’s chartered, before assuming a federal exemption carries over.
Defending a bank against TCPA claims
If your bank or credit union has been sued over marketing calls or texts, the consent records and the dates of each customer’s last transaction usually decide whether the established business relationship holds. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving cross-marketing texts to account holders. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The statutes are the Telephone Consumer Protection Act at 47 U.S.C. § 227 and the Federal Trade Commission Act at 15 U.S.C. § 45. The FCC’s rules are at 47 C.F.R. § 64.1200.
This post is general information about the Telephone Consumer Protection Act and related laws as of April 13, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.