Is Cold Email Legal for Merchant Cash Advance? A Plain-English CAN-SPAM Guide for MCA Brokers

Let's settle the headline before anything else. Sending an unsolicited commercial email to a business prospect you've never spoken to is legal in the United States. There is no federal law that says a recipient must have agreed to hear from you before you can send a first email. The law that governs the practice — the CAN-SPAM Act of 2003 — is not an anti-cold-email law. It's an anti-deception law.

This trips people up because "CAN-SPAM" sounds like a ban. It isn't. The name is shorthand for "Controlling the Assault of Non-Solicited Pornography And Marketing." The Act doesn't prohibit commercial or unsolicited email; it sets the conditions under which you're allowed to send it. Meet the conditions and your cold campaign is compliant — even if the recipient never asked to be contacted.

That's the crucial distinction for MCA brokers. The question isn't "am I allowed to cold email merchants?" You are. The real question is "am I sending the way the law requires?" That's a checklist, not a prohibition — and it's a checklist a professional operation can follow on every single send.

CAN-SPAM is the US federal statute, enforced primarily by the Federal Trade Commission (FTC), that governs commercial email. It applies broadly — to virtually any email whose primary purpose is to advertise or promote a product or service, including B2B messages. So yes, your MCA outreach is covered. The good news is that being "covered" simply means there's a clear set of rules to follow, not that you're forbidden from sending.

Just as important is what CAN-SPAM is not. It is not an opt-in regime. Several countries require affirmative consent before any marketing email — the EU under GDPR and the ePrivacy rules, Canada under CASL. The US deliberately chose a different model: you may send without prior consent, but you must send transparently and must stop when asked. If you're emailing US-based businesses, that permissive model is the one that applies.

It's also worth knowing the law preempts most state anti-spam statutes, which keeps the core rules consistent across the country. There are narrow exceptions — a few states preserve claims for outright falsity or fraud — but for honest, compliant B2B email, the federal framework is the one that matters in practice.

Compliance comes down to a handful of concrete requirements. None of them are exotic, and none of them stop you from sending cold — they just keep you honest. Here's the full set, in plain English.

Two requirements in that list deserve a closer look, because they're where well-meaning brokers most often slip — and they're exactly the parts a serious provider handles for you.

Here's the part that turns compliance from a checkbox into a business decision. CAN-SPAM penalties are assessed per email, not per campaign. Each separate message that violates the Act counts as a separate violation, and the maximum civil penalty is adjusted for inflation each year. As of 2026 that figure stands at up to roughly $53,088 per offending email.

Read that again with MCA volume in mind. A program might send tens of thousands of messages a day. If those sends are non-compliant, you're not looking at one fine — you're looking at a penalty multiplied across every email that went out wrong. Aggravated violations (like harvesting addresses or using automated dictionary attacks to generate them) can add further liability on top.

This is the strongest argument for not winging it. The penalty math is brutal precisely because it scales with volume — which means the higher your send volume, the more it matters that every message is built correctly. It's also why "I'll just spin up a tool and blast a list" is a genuinely risky way for an MCA shop to operate. The right move is to run high volume through infrastructure and people who treat compliance as a feature, not an afterthought.

CAN-SPAM singles out two practices as aggravated violations, and both are worth understanding because they separate legitimate cold email from genuine spam. The first is address harvesting — scraping email addresses off websites and public pages that carry a notice prohibiting it. The second is dictionary attacks — using software to generate addresses by combining names, letters, and numbers at random. Both are off the table.

The practical takeaway for MCA brokers is about your list. Legitimate cold email works from real business contacts — merchants who genuinely exist, gathered through legitimate means. It does not work from machine-generated garbage or scraped lists pulled in defiance of a site's terms. At MCA Rocket we don't sell or supply lead data — sourcing leads is the client's responsibility — but we do expect those leads to be real, valid business contacts, because clean, legitimately gathered lists are the foundation of both compliance and deliverability.

There's a nice alignment here: the same hygiene that keeps you legal also keeps you in the inbox. Mailbox providers punish the exact behaviors the law discourages. Stay clean and you win on both fronts.

A lot of the fear around cold email is borrowed from a different channel. Texting and robo-calling are governed by the Telephone Consumer Protection Act (TCPA), which is genuinely strict and consent-based. Sending marketing texts (SMS blasting) to merchants who haven't opted in is a fast way to land in real legal trouble — the TCPA carries its own steep per-message statutory damages and a thriving plaintiffs' bar to enforce them.

This is precisely why MCA shops that try SMS blasting get burned and shut down. It's also why people wrongly assume email must be just as restricted. It isn't. Email is governed by CAN-SPAM, not the TCPA, and CAN-SPAM does not require prior consent. Cold email to a business is permitted; cold SMS to a non-opted-in number generally is not. Different channel, different statute, different answer.

So when a broker tells us "I heard cold outreach is illegal," they're usually thinking of texting — and they're not entirely wrong about that channel. For email, the picture is the opposite: it's the one high-volume outreach channel where US law gives you room to operate, as long as you operate honestly.

Knowing the rules is one thing; running tens of thousands of compliant sends a day is another. A done-for-you program should make compliance structural — something the system enforces, not something you have to remember on every email. That's how we built MCA Rocket.

Compliance is wired into the infrastructure itself. Every message carries a valid physical postal address and a truthful sender identity. Opt-outs are captured and honored, and suppressed addresses are kept out of future sends across every domain and account. Sending is spread across our own pool of warmed domains, IPs, and inboxes with account rotation — any sender not performing is quarantined — which keeps both deliverability and compliance clean at scale. And because we never sell or share your leads, your data stays yours, kept private indefinitely.

The result is the thing brokers actually want: cold email that's both legal and effective. You bring real, valid business leads; the system markets to them honestly, reaches the inbox with a 90%+ inbox guarantee, and returns full applications with bank statements — without ever putting your name on a non-compliant blast. Over 5+ years, $1.3B+ funded, and 180K+ applications, that's the standard we've held to: handle millions of leads, the right way, every time.