Building an investor list - compliantly

A name in a CRM is not permission to pitch a security. It proves that somebody typed an email address into a field and, on a good day, spelled it correctly.

A mailing list counts people. A compliance file accounts for them.

That difference is the whole article. A usable investor record shows where the person came from, what they requested, what the issuer actually knows, what was sent, and which approved offering process permits the next communication. If those facts live in separate inboxes and one partner’s memory, you do not have a list. You have a future reconstruction project.

This is education, not legal or securities advice. The analysis is fact-specific. Qualified securities counsel should approve the process before anyone sends deal material.

The offering path controls the segment

The SEC says every offer and sale of a security, even to one person, must be registered or fit an exemption. The issuer and counsel choose the path from the actual facts.

For a Rule 506(b) offering, general solicitation and advertising are prohibited. A newsletter signup, social follow, business card, or webinar registration does not by itself establish the relationship facts that may support a nonpublic communication process.

Rule 506(c) uses a different gate. The issuer may broadly solicit, but all purchasers must be accredited and the issuer must take reasonable steps to verify that status.

Do not load names into a campaign and ask counsel to bless the export afterward. Select the lawful path, write the audience rule, and configure the system to enforce it. The filter should reflect the memorandum, not the fundraiser’s mood.

One person needs five kinds of proof

Each contact should connect to five separate records:

• Identity and source: legal name, contact details, referral source, source page or event, and date added.
• Communication permission: the exact request or form, consent timestamp, form version, channel preference, and unsubscribe status. Consent to education and eligibility for deal communication are different fields.
• Relationship history: dated calls, meetings, prior business dealings, questions asked, and the operator responsible. “Seems wealthy” is neither a fact nor an evaluation.
• Investor information: only the financial circumstances, experience, sophistication, accreditation support, and suitability-related facts counsel directs you to collect, with source, date, reviewer, refresh date, and restricted access.
• Send history: the exact message version, attachments, sender, audience rule, approval, timestamp, response, and follow-up disposition.

SEC staff says a substantive relationship requires enough information to evaluate, and an actual evaluation of, financial circumstances and sophistication; self-certification alone is not sufficient. That is not an invitation to collect every private fact you can find. Gather only what counsel approves, restrict access, secure it, and follow the approved retention policy.

The useful record is narrow and provable. Amateur surveillance is neither.

Six hundred names enter the records room

Assume a hypothetical operator opens a CRM with 600 rows before a planned 506(b) offering:

Record condition	Count
Duplicates	80
Education opt-in only	250
Known source, but thin relationship notes	160
Dated history and investor information ready for counsel review	110
Total	600

Remove the 80 duplicates and the list has 520 people, not 600. Only 110 have records complete enough for counsel to review. Even those 110 are not automatically approved; the facts, timing, offering, and counsel-approved process still control.

The remaining 410 stay out of deal-specific 506(b) distribution unless counsel approves a lawful path. Some may continue receiving the education they requested. Nothing was lost. The audit merely stopped 410 email addresses from testifying to facts they never contained.

Under a properly structured 506(c) process, broad deal communication may be possible, but every purchaser must still be accredited and the issuer must take reasonable verification steps.

Education cannot wear the deal’s name tag

The familiar pitch uses a subject line that says “market education” while the email names a live property, projected economics, a deadline, and a way to reserve an allocation. Calling the message educational does not change what the body says.

A disclaimer cannot carry a message that contradicts it. Neither can a rushed follow-up. “Reply in 24 hours” invites forwarding, loose promises, inconsistent answers, and undocumented side conversations. Federal antifraud provisions broadly apply even to exempt private funds and advisers. Accuracy follows the claim into calls, webinars, texts, emails, decks, and posts.

Commercial email rules add another layer; they do not replace the securities analysis. The FTC’s CAN-SPAM compliance guide addresses accurate headers and subject lines, a valid postal address, a functioning opt-out mechanism, and honoring opt-outs within 10 business days. Once a person opts out, the suppression record should close every sending path. A locked door is useless if the personal inbox has a side entrance.

Preserve the chain from source to send

Before any distribution, inspect counsel’s communications protocol, the exemption analysis, the offering start-date memo, audience criteria, approval log, and final message package. Export the exact CRM segment and preserve the rule that produced it.

Keep the webform version, consent record, source page, webinar registration copy, email, deck, transcript, text, social post, attachment version, and delivery report. The record should let a reviewer move from recipient to source without asking who remembers the campaign.

For the offering file, reconcile the PPM or offering memorandum, subscription agreement, investor questionnaire, accreditation or sophistication process, verification records where applicable, and state notice instructions. After the first Regulation D sale, compare the filed Form D with the actual issuer, exemption, offering amount, related persons, and sales compensation. The SEC says Form D is due within 15 days after the first sale. It is a notice, not an endorsement.

Open every referral agreement, consultant contract, invoice, and compensation schedule too. The SEC’s broker-dealer registration guide identifies solicitation, negotiation, execution, and transaction-related compensation as factors in broker-status analysis. An introduction fee based on dollars raised does not become harmless because accounting coded it as consulting.

Questions the send log must answer

• Which exemption governs, and where is counsel’s approved communication path?
• How did each recipient enter this segment, and what does the source record prove?
• For 506(b), which relationship facts predate the offering?
• Did a public post, open webinar, forwarded deck, or affiliate message mention the deal?
• Who approved this exact version, audience rule, and follow-up script?
• Are opt-outs suppressed across the CRM, email tool, and personal sending accounts?
• Who may access investor-status records, and when must those records be refreshed or deleted?
• Is anyone compensated according to introductions, commitments, or capital raised?
• Can the send history be reproduced without collecting oral histories from the team?

Pull 25 records now

Freeze deal-specific sends and select 25 names at random. For each one, produce the source, permission record, relationship timeline, current investor-status support, and complete communication history. Mark each required field proved, missing, or stale.

Quarantine every failed record from deal communication and give the exception report to securities counsel. Repair the process before adding names. Five hundred documented records can support careful work. Five thousand mystery names are just an impressive head count outside a courtroom.