Cold email is the highest-leverage channel in merchant cash advance — but it is also the most regulated thing most MCA shops do without realizing it. The moment you send a commercial message to a merchant who never asked to hear from you, you are subject to the CAN-SPAM Act, the U.S. federal law that governs commercial email. Most brokers have heard the name. Far fewer can name the rules, and fewer still can prove their campaigns follow all of them.
The good news: CAN-SPAM is not a vague, do-your-best standard. It is a short, concrete list of requirements. If you meet them, your cold outreach is on solid legal footing. If you miss them, the penalties are assessed per email — which at MCA volume gets expensive fast. This checklist walks all seven requirements, explains what each one actually means for an MCA campaign, and shows where the right infrastructure makes compliance automatic instead of a thing you hope you remembered.
One note before we start: this is a plain-English overview, not legal advice. CAN-SPAM is federal law, individual states layer on their own email and privacy rules, and your situation may have wrinkles this post can't cover. Before you launch a campaign, run your setup past qualified counsel.
1. Use accurate 'From,' 'To,' and routing information
The first rule is the simplest and the one spammers break most: your header information has to tell the truth. The 'From,' 'To,' 'Reply-To,' and the routing data that identifies the originating domain and sending server must accurately identify the person or business that initiated the message. You cannot spoof a header, forge a sending domain, or disguise who is really behind the email.
For MCA cold email this matters more than it looks, because deliverability tactics and compliance can collide if you're careless. It is completely legal — and standard practice — to send cold outreach from a dedicated 'cousin' domain rather than your primary operational domain, so that a blacklist hit never kills your real business email. What is not legal is making that domain pretend to be someone it isn't. The sending identity has to genuinely trace back to you. Done right, cousin domains protect your reputation and stay fully CAN-SPAM compliant, because the header still honestly identifies the sender.
2. Don't use deceptive subject lines
Your subject line has to reflect the actual content of the message. A subject that implies a pre-existing relationship that doesn't exist ("Re: our call yesterday" to a merchant you've never spoken to), a fake reply or forward prefix, or a claim the body doesn't support is a CAN-SPAM violation on its own.
This is where aggressive MCA marketers get themselves into trouble. Subject lines like "Your funds are approved" or "Re: your application" sent to cold merchants who never applied are deceptive by definition. They may juice open rates for a week, but they invite spam complaints — and in MCA, the most spam-complained-about industry there is, complaints are the fastest way to torch your sending reputation and end up legally exposed at the same time. Honest, curiosity-driven subject lines ("Are you open to seeing some rates?") convert better over time and keep you clean.
3. Identify the message as an advertisement
If your email is commercial — and a cold pitch for funding clearly is — CAN-SPAM requires that you disclose it as an advertisement or solicitation. The law gives you latitude on how you do this: it doesn't have to be a giant 'AD' stamp at the top. It does have to be clear and conspicuous somewhere in the message that the email is an ad.
In practice, a soft, personal-feeling cold email can still satisfy this easily. A short line near the footer noting that the message is a commercial solicitation, alongside your physical address and unsubscribe link, does the job without making the email feel like a billboard. The disclosure and the personal tone are not in conflict — plenty of compliant cold email reads like a quick note and still includes the required ad identification down at the bottom.
4. Include a valid physical postal address
Every commercial email must contain your valid physical postal address. This can be your current street address, a registered P.O. box, or a private mailbox registered with a commercial mail receiving agency. It cannot be fake, and it cannot be omitted — a missing or invalid address is one of the most common CAN-SPAM violations, precisely because it feels like a small detail.
It isn't a small detail. The address requirement is a transparency rule: recipients (and regulators) must be able to see who is really behind the message and where they can be reached. For an MCA shop sending tens of thousands of emails a day across many sending domains, the address has to be present on every single message, not just the first one in a sequence. This is exactly the kind of requirement that's easy to forget on email number 40,000 — and exactly why it should be enforced by your sending system, not your memory.
5. Give recipients a clear, conspicuous way to opt out
Every commercial email must include a clear and conspicuous explanation of how the recipient can stop receiving email from you. The opt-out mechanism has to be obvious, has to actually work, and has to stay functional for at least 30 days after you send the message. A reply-to-unsubscribe instruction or a visible unsubscribe link both qualify — what doesn't qualify is a buried, broken, or hard-to-find opt-out.
CAN-SPAM also limits what you can demand in exchange for opting out. You cannot charge a fee, require the recipient to give you more than an email address and their opt-out preferences, or make them log into an account or navigate multiple pages to unsubscribe. The cleanest approach is one-click unsubscribe — and as of the Google and Yahoo sender requirements that took effect in 2024, one-click unsubscribe is effectively mandatory for bulk senders anyway. Meeting the modern deliverability standard and meeting CAN-SPAM's opt-out rule now point to the same solution.
- The opt-out must be clear, conspicuous, and genuinely functional.
- It must keep working for at least 30 days after the email is sent.
- You can't charge a fee or require anything beyond an email address and opt-out preferences.
- You can't force the recipient through a login or a multi-step process to unsubscribe.
6. Honor opt-out requests within 10 business days
Once a merchant opts out, you have 10 business days to stop sending them commercial email — and then you have to keep honoring it indefinitely. An opt-out isn't a one-time pause; it's a permanent instruction. You also can't sell, transfer, or hand off that person's email address to anyone else for marketing once they've opted out (narrow exceptions aside, like a provider helping you comply).
At MCA scale this is an operations problem disguised as a legal one. When you're sending across hundreds of domains and inboxes, an opt-out submitted to one sending identity has to suppress that merchant everywhere — across every domain, every campaign, and every future monthly nurture set. Doing that by hand is how merchants who unsubscribed keep getting emailed, which generates exactly the spam complaints that destroy deliverability. A centralized suppression list that every sender checks before it sends is the only reliable way to honor opt-outs at volume.
7. Monitor what others do on your behalf — you're still liable
The last rule is the one MCA brokers most often misunderstand: outsourcing the sending does not outsource the liability. Under CAN-SPAM, both the company whose product is being promoted and the company actually sending the email can be held legally responsible. You cannot hire a marketer, hand over your list, and treat compliance as entirely their problem — if your offer is in the email, you have skin in the game.
That cuts two ways. It means you have to vet whoever emails on your behalf and make sure their practices are clean. It also means you should insist on a provider that treats compliance as a built-in feature rather than an afterthought — one that can show you exactly how headers, addresses, opt-outs, and suppression are handled. The right partner makes this rule a non-issue because compliance is wired into the infrastructure, not bolted on per campaign.
Why per-email penalties make this checklist worth your time
CAN-SPAM penalties are assessed per email, not per campaign. A single non-compliant blast to thousands of merchants is potentially thousands of separate violations, and the statutory maximum per violation runs into five figures. The math is unforgiving precisely because MCA email is a volume game — the same scale that makes cold email so effective is the scale that multiplies any compliance mistake.
This is the whole reason MCA Rocket builds compliance in by default rather than leaving it to chance. Every message goes out with a real, valid physical postal address and a clear one-click unsubscribe, honest sender identification, and ad disclosure. Opt-outs are captured into a centralized suppression list and honored automatically across every domain and inbox, so a merchant who unsubscribes once is suppressed everywhere — well inside the 10-business-day window. You bring the leads you already own; the platform handles the parts of the law that are easy to get wrong at scale. Pair that with proper authentication and our 90%+ inbox guarantee, and you get outreach that's both deliverable and defensible. (Still: this is an overview, not legal advice — confirm your specifics with qualified counsel before you launch.)
