Guide · Email and newsletters · BFSI
Email marketing for financial services
Consent, content and deliverability for the newsletters and lifecycle emails of banks, insurers, AMCs, NBFCs and fintechs.
Email marketing for financial services works when three things hold: every address carries a consent record you can produce, every sending domain passes SPF, DKIM and DMARC under the Gmail and Yahoo bulk-sender rules, and every promotional email carries the disclosures your regulator expects. Measure clicks and actions, not opens.
01 · The definition
What is email marketing for financial services?
A lender’s growth team exports every address from its loan-calculator form into the monthly newsletter and presses send. Nobody can say which of those people agreed to marketing, or what they were told. That gap, not the subject line, is where financial email programmes fail.
Email marketing for financial services is the use of opted-in email, meaning newsletters, onboarding and lifecycle sequences, and product messages, by banks, insurers, asset management companies (AMCs), non-banking financial companies (NBFCs) and fintechs. It runs under three rulebooks at once.
- Data protection law decides who you may email.
- Gmail, Yahoo and other mailbox providers decide whether your email reaches the inbox.
- Financial regulators and your compliance team decide what the email may say.
This guide takes them in that order, then covers formats, sequences and measurement. It is for the CRM (customer relationship management) or lifecycle lead at a financial brand. Indian rules come first, with the EU and the US as contrast.
02 · Consent
Which consent rules decide who you may email?
Consent is the first gate. If you cannot show where an address came from and what the person agreed to, nothing later in this guide fixes it.
India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) says consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action”, limited to the data needed for the stated purpose. Withdrawing must be as easy as consenting, and if consent is questioned, the business must prove notice and consent. After a withdrawal, the business must also make its processors stop, your email platform included.
The DPDP Rules, 2025, published in the Gazette in November 2025, say the consent notice must itemise the data, state the specific purpose and give a link to withdraw. That rule comes into force eighteen months after publication, which points to May 2027. Build to it now: a list collected without such a notice will be hard to defend later.
The European Data Protection Board (EDPB), which brings together EU data protection authorities, summarises valid consent under the General Data Protection Regulation (GDPR) as four cumulative tests: freely given, specific, informed and unambiguous. Its April 2026 summary says pre-ticked boxes and silence are not consent, each purpose needs its own consent, and withdrawal must be as easy as giving it.
The US CAN-SPAM Act works on the opt-out. The Federal Trade Commission (FTC) guide asks for accurate headers, honest subject lines, a postal address and opt-outs honoured within 10 business days. As of October 2026 it lists penalties of up to $53,088 per violating email, and says you cannot contract the duty away to a vendor.
| Law | What it asks of your list | What to build |
|---|---|---|
| DPDP Act, 2023 (India) | Free, specific, informed, unconditional and unambiguous consent; easy withdrawal; you carry the proof. | A consent record per address (source, date, purpose, notice version) and one-step withdrawal. |
| GDPR (EU) | Four cumulative tests; no pre-ticked boxes; one consent per purpose; easy withdrawal. | Unticked boxes, one per purpose, and withdrawal where consent was given. |
| CAN-SPAM Act (US) | Accurate headers and subject lines, an ad disclosure, a postal address, opt-outs honoured within 10 business days. | An unsubscribe that needs no login, a postal address in the footer, checks on vendors. |
If you also email customers in the Gulf, check each country’s data protection law, and any financial free zone’s rules, with local counsel before you import a list. This is general guidance, not legal advice; your compliance team decides.
03 · Deliverability
What do Gmail and Yahoo require from bulk senders?
Since February 2024, Gmail and Yahoo have required every sender to authenticate its mail and keep spam complaints low, with stricter rules for bulk senders.
Google treats you as a bulk sender once you send close to 5,000 messages or more to personal Gmail accounts in 24 hours, counting every subdomain of your primary domain. The status is permanent. Since November 2025, Google says non-compliant mail faces temporary and permanent rejections.
Three acronyms carry most of the work. SPF (Sender Policy Framework) lists the servers allowed to send for your domain. DKIM (DomainKeys Identified Mail) adds a signature that lets the receiver check the message came from your domain unaltered. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do with mail that fails those checks, and sends you reports.
Google’s setup guide recommends starting DMARC at a policy of none, reading the reports, then moving gradually to quarantine or reject. Jump straight to reject, and the first sign of a forgotten vendor sending as your domain is that its mail stops arriving.
Every tool that sends as your domain needs its own SPF and DKIM set-up: the CRM, the newsletter platform, system alerts and any agency tool. Transactional messages such as password resets are excluded from Google’s one-click unsubscribe rule, so keep them free of offers.
| Requirement | Gmail (Google) | Yahoo |
|---|---|---|
| Authentication, all senders | SPF or DKIM | SPF or DKIM |
| Authentication, bulk senders | SPF, DKIM and DMARC; the DMARC policy may be none | SPF and DKIM; DMARC at p=none or stricter, and it must pass |
| From domain (bulk) | Must align with the SPF or the DKIM domain | Must align with the SPF or the DKIM domain |
| Unsubscribe (bulk, marketing) | One-click, using the List-Unsubscribe and List-Unsubscribe-Post headers, plus a visible link in the body | One-click List-Unsubscribe header (the RFC 8058 POST method is highly recommended), plus a visible link |
| Time to honour an unsubscribe | Google recommends within 48 hours | Within 2 days |
| Spam complaint rate | Below 0.3% for everyone; bulk senders should aim below 0.1% | Below 0.3% |
| Infrastructure | Valid forward and reverse DNS, a TLS connection, RFC 5322 formatting | Valid forward and reverse DNS, RFC 5321 and 5322 compliance |
Sources: Google email sender guidelines and FAQ; Yahoo Sender Hub best practices; checked 13 October 2026. Yahoo notes its requirements are subject to change.
04 · The scorecard
Is your email programme ready to send?
The Licence to Send scorecard is Yamm Labs’ ten-line check of an email programme before a bulk send. Score each line 0, 1 or 2: 0 means missing, 1 means partial or undocumented, 2 means in place with evidence you could show a reviewer.
| Line | Score 2 when | 0 to 2 |
|---|---|---|
| Gate 1 · Consent | ||
| 1. Consent record | Every address has a source, date, purpose and notice version you can export. | |
| 2. Unbundled opt-in | Marketing consent is a separate, unticked choice, not part of the account terms. | |
| 3. Easy exit | One-click unsubscribe header plus a visible link, honoured within 48 hours in every tool. | |
| Gate 2 · Identity | ||
| 4. Authentication | SPF and DKIM pass for every service that sends as your domain, vendors included. | |
| 5. DMARC | A published DMARC record, aligned From domains, and a named person who reads the reports. | |
| 6. Complaint rate | Spam rate in Google Postmaster Tools stays below 0.1% and has not touched 0.3%. | |
| Gate 3 · Content | ||
| 7. Disclosures | Entity legal name, registration details and product warnings follow compliance’s current template. | |
| 8. Separate streams | Educational newsletters, promotions and service messages go out as separate streams. | |
| Gate 4 · Proof | ||
| 9. Measurement | Reports lead with clicks, replies and completed actions, not opens. | |
| 10. Approval trail | Each send has a named approver and a stored copy of what went out. | |
Score = the sum of the ten lines, out of 20. 17 to 20: send. 12 to 16: send only to recently engaged, consented segments while you fix the gaps. Below 12, or a 0 on line 1 or line 3: pause bulk sends.
Try this: have your CRM lead and your compliance reviewer score it separately, then compare.
05 · Content
Which newsletter formats earn a place in a financial inbox?
Formats that give the reader something usable in two minutes outlast formats that announce the company.
AMCs, brokers, wealth
The market or rate note
One change, what it means for the reader, and what to check in their own account. Outlook language only as compliance approves it.
Insurers, lenders
The explainer
One concept per issue: how a floating rate resets, or what a claim needs. Link to the product page for terms.
Existing customers
The account digest
What changed in the customer’s product or terms, written plainly, with no offer attached.
B2B fintech
The buyer briefing
Rule and product changes your bank or insurer buyers must act on, each sourced and dated.
Agents, distributors
The partner bulletin
Approved material for agents and distributors, each item with its approval reference so nobody forwards an old version.
Everyone
The quarterly recap
What changed in rules, rates or products, linking to explainers you already sent. A re-entry point for lapsed readers.
Keep education and promotion apart. Under the common advertisement code that the Securities and Exchange Board of India (SEBI) notified in October 2026, which applies from April 2027, educational communication does not count as an advertisement if branding is minimal and incidental and there is no promotional call to action. Build the habit now: an educational issue with a product pitch at the bottom is a promotion.
New guides on formats, lists and sequences go up on our email desk. Read every post on the Email and Newsletter Marketing desk.
06 · Lifecycle
How should onboarding and lifecycle sequences run?
A sequence is a set of emails triggered by what the customer does, not by your campaign calendar.
-
Confirm and record.
Send a confirmation the moment someone opts in and store the consent record with it. A confirmation click (double opt-in) also filters out typos.
-
Set expectations in the welcome.
Say which company is writing, what you will send, how often, and how to leave. In a group, name the entity that holds the consent.
-
Separate service from marketing.
KYC (know your customer) reminders, statements and alerts go in a service stream with no offers. Marketing goes in its own stream with its own unsubscribe.
-
Onboard to first use, not to the next product.
The first emails should help the customer finish set-up and use what they bought. Cross-sell later, with consent for that purpose.
-
Offer a preference centre.
Let people choose topics and frequency, or pause. Google says other options should not replace one-click unsubscribe, so keep both.
-
Re-permission the dormant.
For addresses with no clicks over a period you set, send one re-permission email and remove those who do not respond.
-
Honour exits everywhere.
Sync unsubscribes to every tool within 48 hours, and make your vendors stop processing too, as the DPDP Act requires.
07 · Disclosures
Where do disclaimers go in a financial email?
Treat any email that promotes a product as an advertisement for review purposes, and put its disclosures in the body as live text, close to the claim they qualify.
Indian regulators set the content. SEBI’s mutual fund advertisement code sits today in the Fifth Schedule of the SEBI (Mutual Funds) Regulations, 2026; from April 2027 its common advertisement code, notified in October 2026, requires that ads by specified SEBI-regulated entities carry the entity’s name, registration number and logo plus SEBI’s disclaimers, with SMS and push notifications allowed to link to full disclosures. Insurers answer to the Insurance Regulatory and Development Authority of India (IRDAI), and banks and NBFCs to the Reserve Bank of India (RBI), each with its own expectations of what a promotion must state. For regulator-by-regulator questions, see our BFSI marketing compliance FAQ.
- Live text, not an image. Blocked images and screen readers lose any disclosure set inside a banner.
- Next to the claim. A rate, return or cover figure carries its qualifier in the same block, not only in the footer.
- An entity line in every footer. Legal name, registration details, postal address, and why the reader is getting the email.
- One versioned template. The disclosure block carries a version number, so the approval record shows which text went out.
- The subject line is part of the ad. CAN-SPAM requires it to reflect the content, and it is the line most people read.
Ask compliance for the current disclosure text per product instead of copying it from an old campaign; SEBI has notified a common advertisement code that applies from April 2027, so the required wording will change.
08 · Measurement
How do you measure email after Apple Mail Privacy Protection?
Stop reporting open rate as a measure of reading. Apple says Mail Privacy Protection downloads remote content in the background by default, whether or not the person engages with the email, and masks the reader’s IP address, so the pixel that counts an open fires for those readers either way.
A hypothetical worked example
Take a hypothetical newsletter sent to 50,000 people, of whom 20,000 read mail in Apple Mail with protection switched on. If those 20,000 all register as opens and 6,000 of the other 30,000 open, the dashboard shows 26,000 opens, a 52% open rate.
The opens you can actually observe are 6,000 out of 30,000, or 20%. The lesson is easy to miss: as more of your list moves to protected mail apps, the reported open rate rises even if reading falls.
| Metric | Formula | What it shows |
|---|---|---|
| Click rate | Unique clickers ÷ delivered | Interest you can tie to a person |
| Action rate | Completed actions (KYC done, systematic investment plan started, demo booked) ÷ delivered | Whether the email moved the business |
| Unsubscribe rate | Unsubscribes ÷ delivered | Fatigue, or a broken promise in the welcome |
| Spam rate | As reported in Google Postmaster Tools | Deliverability risk against the 0.3% limit |
| Hard bounce rate | Hard bounces ÷ sent | List quality and how the list was built |
09 · The internal meeting
What to tell your CFO and your compliance team
Two notes you can paste into an email. Fill in the brackets.
For the CFO
Cost, metric, test, stop rule
Cost: the platform plus set-up of authentication and a consent store, [amount]. Metric: completed actions, such as [accounts funded], per thousand delivered emails, not opens. Test: one quarter, consented and authenticated lists only. Stop rule: we pause any stream whose spam rate reaches 0.3% in Google Postmaster Tools, Gmail’s published limit.
For compliance
Claims, disclosures, approver, record
The emails claim only what is on our approved claims list for [product]. Each carries the current disclosure text as live text beside the claim and in the footer, with the entity’s legal name. [Named reviewer] approves each send. Consent records, notice versions and sent copies are kept in [system] for [period].
This is general guidance, not legal advice; your compliance team decides.
10 · Limits
When is email the wrong choice?
Email is the wrong channel when it cannot meet the first gate, or when the message needs a different kind of attention.
- You cannot show consent. A bought or scraped list fails the first gate. Rebuild through re-permission or a fresh opt-in.
- The message must be seen in minutes. Fraud alerts and payment confirmations belong in the channels your security and operations teams specify, with email as the record.
- The disclosure is longer than the pitch. Send readers to an approved product page and keep the email to education.
- Nobody owns the replies. Customers reply to newsletters with account questions. Monitor the reply-to address or do not send.
- The list belongs to a partner. If the consent names only the partner, the partner sends, not you.
11 · Answers
Frequently asked questions
Do I need consent to send marketing emails to customers in India?
Where consent is your basis for processing, the DPDP Act, 2023 requires it to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. Keep a record of the notice and the consent, because the Act puts the burden of proof on the business. This is general guidance, not legal advice.
What are the Gmail and Yahoo bulk sender rules?
Since February 2024, both require bulk senders to use SPF and DKIM, publish a DMARC policy (none is acceptable), align the From domain, offer one-click unsubscribe, honour unsubscribes within about two days and keep spam complaints below 0.3%. The Google bulk threshold is close to 5,000 messages a day to personal Gmail accounts.
Do transactional emails from a bank need an unsubscribe link?
Google excludes transactional messages, such as password resets and confirmations, from its one-click unsubscribe requirement. Keep them free of offers. Once a service email carries a promotion, treat it as marketing, with consent, an unsubscribe and the disclosures that go with it.
Is open rate still a useful email metric for financial brands?
Not as a measure of reading. Apple says Mail Privacy Protection downloads email content in the background by default, whether or not the reader engages, so opens from those readers say little. Report clicks, completed actions, unsubscribes and spam complaints, and use opens only to spot sudden deliverability drops.
Where should disclaimers sit in a financial services email?
In the body as live text, next to the claim they qualify, with the legal name and registration details of the entity in the footer. Images can be blocked, so never set disclosures inside a picture. Use the text your compliance team currently approves for each product, and keep a copy of what was sent.
How often should a bank or fintech send a newsletter?
As often as you can send something useful and get it approved on time. State the frequency in the welcome email, let readers reduce it in a preference centre, and watch unsubscribes and spam complaints after each change.
Sources
All opened and checked on 13 October 2026.
- Google: Email sender guidelines
- Google: Email sender guidelines FAQ
- Google Workspace: Set up DMARC
- Yahoo Sender Hub: Sender best practices
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: Digital Personal Data Protection Rules, 2025
- EDPB: Consent under GDPR (April 2026)
- FTC: CAN-SPAM Act compliance guide
- Apple: Mail Privacy Protection and privacy
- SEBI: (Intermediaries) (Second Amendment) Regulations, 2026, Common Advertisement Code (Gazette, 9 October 2026)
Related: Email and Newsletter Marketing desk · BFSI marketing compliance FAQ · Free fintech brand audit · Fintech branding agency in India · All question hubs
Your inbox is a brand surface
Score your brand in ten minutes.
The free Fintech Brand Audit rates your brand on eight dimensions, including trust signals and compliance-readiness, and shows the three weakest to fix first.