The problem to solve
Marketing compliance fails when it is a review step. Creative arrives finished, legal says no, the deadline is missed, and the next campaign routes around the process. Within two quarters the function is a bottleneck everyone avoids.
It succeeds when it is a set of defaults: the compliant option is the easiest one, the rules are embedded where decisions are made, and review is reserved for genuinely novel material. That is a design problem rather than a policy problem, and this lesson is about the design.
Tiered sign-off
Not everything needs the same scrutiny, and treating it as though it does is what creates the bottleneck.
Tier zero: pre-cleared. Material assembled entirely from the approved claims library, in an approved template, for an approved audience. No review. This should cover the large majority of output by volume.
Tier one: light review. Standard formats with new copy, reviewed against a checklist by a trained marketer rather than by legal. Turnaround measured in hours.
Tier two: compliance review. New creative concepts, new offer structures, new channels, anything involving people or characters, and anything in a market entered within the last year.
Tier three: legal and external. Novel mechanics, anything testing the boundary of a rule, anything likely to attract a complaint, and anything in a market where the regulator has recently commented.
The tiers only work if tier zero is genuinely large. If the library is thin, everything becomes tier one and the model collapses. Investment in the library is investment in throughput.
The claims library
The single highest-return artefact in marketing compliance.
It holds pre-cleared headline language, offer descriptions per promotion type, mandatory messaging in each required format, brand asset usage rules, and the prohibited word list with the compliant alternative alongside each entry.
Three properties make it work. It is per market, because a phrase cleared in one jurisdiction may not be cleared in another. It is versioned, so you can tell what was approved when, which matters when a ruling arrives about material published months ago. And it is maintained, with an owner and a review cycle, because bonus terms change and yesterday's approved copy becomes today's inaccurate claim.
Give affiliates and influencers access to the relevant subset. Much non-compliant third-party copy exists because nobody supplied compliant copy.
Substantiation, held in advance
Codes generally require the advertiser to hold evidence for objective claims before publication. In the UK, rule 3.7 of the CAP Code says marketers must hold documentary evidence to prove objective claims before distributing or submitting a marketing communication for publication, and the ASA may treat a claim as misleading without it. Assembling it afterwards is too late.
A simple discipline: any campaign making a factual claim carries a substantiation note filed with the creative, stating the claim, the evidence, its source and its date. Claims about being the biggest, fastest, best-rated, or offering the most of anything all need this, and so do figures about odds, payouts and prices. The ASA generally reads an unqualified "number 1" claim as a best-selling claim that needs evidence covering the whole market.
The test to apply: if a regulator asked tomorrow for the evidence behind this claim, could someone produce it in an hour without contacting the agency?
Monitoring your own output
Many operators review before publication and never look again. Several failure modes only appear afterwards.
Live offers drifting from their terms. A promotion whose terms were updated while the creative stayed the same.
Stale creative in market. Programmatic and affiliate placements running long after a campaign ended.
Mandatory messaging lost in adaptation. A creative resized or reformatted for a new placement, with the warning cropped.
Organic social output that never passed through any process, even though in the UK the advertising code has covered some content on a company's own social media channels since 2011.
A monthly sweep of what is actually live, as opposed to what was approved, catches all four. Record it.
Handling a complaint or a ruling
When a complaint arrives, the response is a significant part of the outcome and it is frequently rushed.
Acknowledge and respond within the stated timeframe: the ASA, for example, expects a written reply within seven working days, or five for cases involving harm or offence, and an advertiser that does not reply promptly can be found in breach on that ground alone. Preserve the material exactly as published, with placement data, before anything is changed. Assemble the substantiation and the approval record. Respond substantively: explain the audience, the placement, the controls applied and the evidence held. Do not lead with intention, because intention is not the test: the ASA considers the likely interpretation of a claim rather than the marketer's intention.
If a ruling goes against you, do three things beyond compliance with it. Remove or amend across every placement including affiliates, not just the one complained about: the ASA holds both the brand and the affiliate responsible for affiliate ads, even where the affiliate created them alone, and in Britain the Gambling Commission's social responsibility code provision 1.1.2 makes licensees responsible for the actions of third parties they contract with. Record what the ruling said about the standard, and update the claims library so the same language cannot be reused. And circulate it internally with a short note on what changes, because the same team will otherwise produce the same material again.
Metrics that show the function works
Activity metrics are as useless here as anywhere. Creative reviewed, approvals issued and training delivered describe effort.
Better measures:
Proportion of output cleared at tier zero. Rising means the library is doing its job and throughput is improving.
Time from brief to approval, by tier. The number that determines whether the business routes around you.
Complaints and rulings, with trend and category. Category matters more than count, because a repeated category is a control gap.
Affiliate breaches found by your own monitoring versus found by someone else. If external parties find more than you do, your monitoring is not working.
Suppression test results. Pass or fail, by channel and by brand, with dates.
Live-output sweep findings. How much of what is in market was not what was approved.
Percentage of markets with a current rules summary. Regulatory change makes this decay silently.
Regulatory change, which decays everything else
Advertising rules move frequently, often with a short implementation window. CAP's stricter test on the appeal of gambling ads to under-18s, for example, was announced in April 2022 and took effect on 1 October 2022. A function without a change process will be compliant with last year's rules.
The minimum viable version: a named owner per market; a source list covering the regulator, the advertising body and local counsel; a triage step assessing each change for materiality; and a route into the work queue with the deadline attached. Where a change requires a platform or product change, it needs to outrank commercial work, because the deadline is external.
The higher-value version watches consultations rather than only decisions, which turns a few months of notice into a year or more: CAP's consultation on those under-18s rules opened in October 2020, two years before they took effect.
What good looks like
An operator with a working marketing compliance function can show, in an afternoon:
A current rules summary per market, written as operational guidance. A versioned claims library, with most output drawing from it. A tiered sign-off model with recorded turnaround times. Substantiation notes filed against factual claims. Dated suppression test results across every channel and brand. An affiliate monitoring log with breaches, actions and at least one termination. A monthly live-output sweep. A complaints and rulings log with the resulting library changes recorded against each. And a regulatory change log showing what moved and what was done.
None of that is exotic, and the list is short enough to audit yourself against this week. The operators that struggle are not the ones that lack a policy. They are the ones where the policy exists and none of those nine artefacts do.