Verified merchant email data · 50 states + DC · CSV, API, or direct CRM delivery
MCA Email Leads Merchant data · MCA Book a call
Compliance 7 min read

CAN-SPAM Compliance for MCA Brokers

A plain-language walkthrough of what the rules require of an outbound email program.

What CAN-SPAM actually covers

CAN-SPAM governs commercial email in the United States, including business-to-business. It does not require prior consent — which is why cold B2B email is legal — but it imposes firm requirements on how that email is sent, and penalties apply per individual email.

Accurate headers and sender identity

The from name, from address, reply-to, and routing information must identify the actual sender. Sending as a different company, or through obscured routing, is a direct violation regardless of the content.

Non-deceptive subject lines

The subject must reflect the content. "Re: our conversation" to someone you have never spoken to is deceptive. So is implying an approval, an existing account, or a pending application that does not exist.

Identify the message as an advertisement

The message must be identifiable as commercial. This can be handled naturally in the copy rather than with a legal banner, but it must be clear.

A valid physical postal address

Every commercial email needs a genuine physical address for the sender — a street address, a registered agent address, or a registered post office box. A missing address is one of the most common violations in this industry.

A clear, working opt-out

Recipients must be able to opt out easily, the mechanism must work for at least 30 days after sending, and requests must be honored within 10 business days. In practice, process them immediately and globally.

You are responsible for what a vendor sends for you

Hiring an agency does not transfer liability. If a third party sends on your behalf and violates the rules, you can still be held responsible. Ask any vendor how they handle suppression and opt-outs before signing.

State and international rules go further

Several states impose additional requirements, and Canada CASL and EU GDPR are materially stricter — consent-based rather than opt-out-based. If you send outside the US, get specific advice. None of this is legal advice; confirm your program with counsel.

Published 2026-07-08 · MCA Email Leads

Get counts & pricing

Step 1 of 2

You will pick a time on the next screen. No spam, no resale of your information — see our privacy policy.

Next step

Get counts against your lender box

Bring your criteria to the call and we will scope a test pull, confirm coverage, and price it.