Financial Recovery Technologies
Financial Recovery Technologies markets to institutional investors across three regions and eight regulated jurisdictions. Digital Authority Partners audited its Pardot and Salesforce setup, mapped six regulatory frameworks against what those systems do today, and wrote the compliance playbook FRT now builds against.
Financial Recovery Technologies helps institutional investors recover money from securities class actions. The firm files claims, tracks global settlements, and monitors regulatory change for banks, asset managers, and fund administrators across the Americas, Europe, and Asia Pacific.
Project Summary
Financial Recovery Technologies asked Digital Authority Partners to find out whether its email program could stand up to GDPR, CAN-SPAM, CASL, and the financial rules that govern its industry. The audit covered 637 Pardot lists, 135 forms, the Salesforce fields behind them, and the privacy policies on the public site. Digital Authority Partners returned a mapped view of six regulatory frameworks, seven region-specific opt-in and unsubscribe workflows, a four-template form standard, and a governance plan naming who controls each compliance field.
The Challenge
List Sprawl 637 Lists, One Ever Archived
FRT's Pardot account held 637 lists and 137 of them ran live. Teams built new dynamic lists for single campaigns and almost nothing retired, so targeting rules contradicted each other and no one owned them.
Consent Records Two GDPR Builds, Neither Went Live
FRT built region-aware consent forms in 2018 and again in 2024. Both sets stayed unpublished, so marketing to EMEA contacts stopped rather than run without a defensible opt-in trail.
Field Access Sales Could Edit Opt-Out Status
Salesforce let representatives change unsubscribe, opt-in, and preference fields directly. Territory moves and lead routing ran through the same field that records a recipient's legal opt-out.
Form Library 135 Forms, Seven In Real Use
Only seven Pardot forms drew more than 100 views and 74 drew none. Each live form carried its own consent wording, which made one standard hard to apply and harder to prove.
How We Helped Financial Recovery Technologies
A Regulatory Map Across Three Regions
Digital Authority Partners built one reference covering every email law that touches FRT’s markets, written for marketers rather than lawyers.
- Mapped GDPR, CAN-SPAM, CASL, FINRA, SEC, and PCI-DSS against FRT's current setup
- Compared opt-in rules, opt-out deadlines, and retention periods across eight jurisdictions
- Flagged where EMEA, APAC, and AMERS rules diverge on consent and timing
- Marked each requirement as met or open so FRT could read its position at a glance
- Set retention by data type, from 24-month lead records to seven-year financial archives
Consent Separated From Business Logic
The audit split compliance opt-outs from business exclusions so one field stops carrying two jobs.
- Specified a marketing eligibility field for sales and territory decisions
- Removed sales access to opt-in, unsubscribe, and preference center fields
- Redirected every dynamic list to target on eligibility instead of suppression
- Wrote the routing process for opt-out requests that arrive as email replies
- Defined the consent metadata to capture at submission, covering timestamp, source, and method
Form and Preference Center Standards
FRT needed a small set of forms it can defend in an audit, plus a preference page that reduces unsubscribes instead of inviting them.
- Cut a 135-form library down to four approved templates
- Specified unchecked consent boxes, value proposition copy, and privacy policy links
- Set double opt-in for EMEA with a confirmation email and a reminder sequence
- Reversed the preference center so contacts arrive enrolled and uncheck what they skip
- Tied preference selections to list logic so choices change what sends
Governance and Third-Party Data Rules
The last piece covered what no platform setting fixes, meaning who may do what and what happens to purchased contacts.
- Blocked outreach to EMEA and Canadian contacts sourced without express consent
- Required vendor, consent status, and expiry tags on every imported record
- Set a 12-month ceiling on unengaged third-party contacts
- Specified five monitoring reports covering opt-in, unsubscribe, retention, and security
- Listed the privacy policy and cookie consent gaps for FRT's counsel to close
What We Achieved
The audit covers GDPR, CAN-SPAM, CASL, FINRA, SEC, and PCI-DSS in one document, each tied to what FRT already does and what still needs work. Marketing and compliance now argue from the same page instead of two.
Every list in the account went through review, including the 137 running live and the 69 sitting active but unused. The plan takes FRT to a core set of rules-based lists with named owners and a sunsetting policy.
Form-by-form review sorted the library into keep, rebuild, and retire. Four approved templates now cover newsletter signup, contact, resource download, and event registration, each with consent wording FRT can defend.
Opt-in and unsubscribe flows now exist in writing for the EU, APAC, the United States, Canada, and Brazil. Each one names its trigger, field updates, timing rule, and fail-safe, so an operations team can build it as written.
