Email Signatures for Regulated Industries: Legal, Medical and Financial
Sector-specific rules for signature disclosures — what solicitors, doctors, financial advisers and their firms actually need to include.
By Editorial Team, Editors, SignatureCraft · Updated 2026-06-30 · 10 min
A practitioner-focused reference on the additional disclosures required in email signatures for regulated professions — SRA, FCA, HIPAA, SEC, GDC and their international counterparts.
The general shape of sector-specific rules
Every regulated profession has a version of the same set of disclosure requirements: identify yourself and your regulated status, identify your firm and its regulator, warn recipients when the communication is protected or confidential, and — for anything that could be construed as advice or promotion — attach the sector-specific warning language. Where the professions differ is in the specific wording, the layout expectations, and the enforcement culture.
This article walks through the practical requirements in the three most-regulated sectors we get questions about: legal, medical and financial services. It focuses on the UK, EU and US positions, because those are the jurisdictions our users ask about most often, but the general shape (regulated status, regulator name, mandatory warning) is broadly consistent across other developed jurisdictions.
Legal: solicitors, barristers and law firms
In the UK, the Solicitors Regulation Authority (SRA) requires practising solicitors and SRA-regulated firms to include specific information in email correspondence. The firm's name and trading style, the address of its main office, the fact that it is authorised and regulated by the SRA, and — critically — its SRA number. Individual solicitors additionally include their name, role, and SRA number in their personal block.
Under the SRA Standards and Regulations (updated 2019 with clarifications in 2023), the signature also needs to include the firm's VAT number if VAT-registered, and — for limited liability partnerships — the LLP registration number and registered office. Failure to include the SRA number is one of the most common minor complaints the SRA receives; it rarely results in enforcement but is a routine finding in supervisory visits.
For barristers in England and Wales, the Bar Standards Board equivalent requires the barrister's name, their chambers, and their status as a self-employed practitioner authorised by the BSB. The confidentiality warning is not a regulatory requirement but is universal in practice, because barristers exchange privileged material by email routinely.
In the US, state bar rules vary but converge on similar requirements: the lawyer's name and firm, the states in which they are admitted, and — for firms with multiple offices — the address of the office responsible for the specific matter. New York and California both have advertising rules that treat lawyer emails as potentially subject to attorney-advertising disclosures, which is why so many US law firm signatures include the 'This may be considered attorney advertising' line.
Medical: doctors, dentists and healthcare providers
In the UK, the General Medical Council requires doctors to identify themselves clearly in professional communications. That includes name, primary qualification, GMC number, and — for consultants — the specialty and the trust or practice. The General Dental Council has a parallel requirement for dentists (GDC number, primary qualification, practice address).
The clinical signature also carries a set of near-universal warnings that are not strictly regulatory but are essentially standard practice: a confidentiality warning appropriate to the sensitivity of medical information, a disclaimer that the email is not a substitute for a consultation, and — for anything discussing specific patients — a warning that misdirected email should be returned to sender and deleted.
In the US, HIPAA is the dominant regime, and its interaction with email signatures is nuanced. HIPAA does not require any specific language in the signature block itself, but it does require covered entities to have reasonable safeguards in place for electronic PHI. In practice, this has produced the standard 'This email may contain protected health information' warning that appears on almost every US healthcare signature. It has no specific regulatory required wording, but its presence is treated as evidence of the required safeguards.
The complication for medical signatures is that they often carry direct dial numbers that go to answering services with clinical implications. The best-practice pattern is to include the number, but immediately below it a line clarifying that email is not monitored for urgent clinical matters and directing urgent contacts to the appropriate emergency route.
Financial services: advisers, brokers and banks
Financial services signature requirements are the strictest and most content-heavy of the three sectors. In the UK, the Financial Conduct Authority (FCA) requires authorised firms to identify their name, address, FCA registration number, and — for firms with a specific permission — the nature of the permission. Individual advisers include their name, role, and if they are individually authorised, their FCA reference number.
For anything that could be construed as a financial promotion — including many everyday email exchanges — the signature or the email itself must carry an approval notice and risk warning. The specific wording depends on the type of promotion, but 'This financial promotion has been approved by [authorised firm]' is the general form. The 2024 changes to FCA financial promotion rules tightened this further, particularly for high-risk investments; a firm sending a client email about a new investment opportunity now needs specific approval language that was optional as recently as 2023.
In the US, SEC-registered investment advisers, broker-dealers, and their associated persons face similar requirements under different regulators. The Investment Adviser Act requires certain communications to include specific disclosures; FINRA rules apply to broker-dealer communications; and both regulators expect the firm's regulatory status to be visible in professional email.
The additional layer that catches firms out is the record-keeping obligation. SEC Rule 17a-4 and FCA SYSC 9 both require financial services firms to retain business communications, including email, for defined periods. Signatures are part of those records. Retroactively 'cleaning up' old signatures for compliance is not straightforward when the signature has already gone out on thousands of emails now sitting in a retention archive.
The practical compliant-signature pattern for regulated professions
The workable pattern across all three sectors is a two-tier signature. The primary block carries the human identity — name, role, direct dial, email — at normal signature weight. The secondary block, in slightly smaller text below, carries the regulatory identification — firm name, address, regulator, registration number, and any sector-specific warning language required by default.
For firms that send both external professional communications (which need the full compliance block) and internal-only email (which does not), the reliable approach is to configure two signatures in the mail client and switch between them consciously. The compliance signature goes out by default; the internal signature is selected for messages that will never leave the firm.
One error we see repeatedly: firms that treat the confidentiality warning as decorative and shrink it to 7-point pale grey. This defeats its legal purpose. Confidentiality warnings only carry weight in evidence when a reasonable recipient would have noticed them. Treat the disclosure block as legally load-bearing text, not as visual filler.
What is changing in 2026 and beyond
Three regulatory shifts to watch. First, the EU's Digital Operational Resilience Act (DORA) came into full effect in January 2025 for financial services firms, and one of its downstream effects is heightened scrutiny of communications compliance, including signatures on outgoing client email. Second, in the UK, the SRA is expected to update its transparency rules in late 2026 with clearer digital communication requirements. Third, in the US, the SEC's ongoing enforcement focus on off-channel communications (WhatsApp, text messages) has produced record fines and is now expanding to look at whether required email disclosures are being routed around by senior staff using non-monitored channels.
None of this changes the underlying rule: if you are in a regulated profession, your signature is a compliance surface, not a design surface. Treat it with the seriousness the regulator expects, and re-audit it once a year against your regulator's current guidance.
Put these tips into practice
The SignatureCraft editorial team writes about email tooling, deliverability and the small design details that quietly shape how professional we look online.