Start by naming the rules that cover the firm, because an investment adviser, a CPA firm, and a tax preparer face different limits on asking for, replying to, and displaying reviews. A few lines apply to nearly everyone: the FTC's review rule bars incentives conditioned on a review's sentiment, and Google's review policy also bars offering incentives and selectively asking for positive reviews. The sharpest risk for a financial firm sits in the reply, where a friendly public answer can confirm that someone is a client and disclose information the firm is obliged to protect.
Ratings on Google and other sites can be the first thing a prospect sees about a local CPA or advisor. Reviewers write about their refund, their portfolio, their audit, or their frustration with a missed call, and the owner's instinct is to answer each one warmly and specifically. That instinct is where the trouble starts.
Treat this as review planning for financial, accounting and tax firms, not legal advice. The firm's compliance officer, ethics partner, or counsel decides how each rule applies. Testimonial disclosures for SEC-registered advisers are covered in detail in our page on blogging under the SEC Marketing Rule.
Which rulebook covers the firm
One firm can sit under several of these at once, such as a CPA firm with an affiliated advisory practice. The table is a planning map for the reviewer, not a legal conclusion.
| Firm or role | Rule that bears on reviews | What it touches |
|---|---|---|
| SEC-registered investment adviser | Marketing Rule, 17 CFR 275.206(4)-1, which treats a current client's statement "About the client or investor's experience" with the adviser as a testimonial | Whether quoting, sharing, or replying to a review makes it part of an advertisement, and the disclosures that follow |
| State-registered adviser | The securities rules of each state where it is registered | Ask the reviewer; the rules vary by state |
| Anyone in the business of preparing tax returns | 26 U.S.C. 7216 and its regulations on disclosure or use of tax return information | Replies, and any reuse of a review that reveals a return engagement |
| CPA firm with AICPA members | The AICPA Code's Confidential Client Information Rule (1.700.001), plus state board rules | Replies that reveal anything learned from the client |
| Any business | FTC Rule on Consumer Reviews and Testimonials, 16 CFR Part 465, and Google's user-contributed content policy | Requests, incentives, insider reviews, and suppression |
Ask every client the same way
The FTC rule bars offering compensation or incentives conditioned on a review "expressing a particular sentiment, whether positive or negative," and it requires a clear and conspicuous disclosure when an officer or manager reviews the business, with related limits on testimonials from employees and agents and on soliciting reviews from them or from relatives without disclosure. Its solicitation limits do not reach "Generalized solicitations to purchasers" asking them to share their experiences. Google's policy goes further for its own platform, saying businesses may not "Offer incentives" for reviews or "selectively solicit positive reviews from customers."
The safest request process is dull on purpose: the same message, to every client in a defined group, at a defined point in the engagement. Before any request goes out, a partner can put this to the team: "Who decides which clients get a review request, and is that rule written down?" If the honest answer is that staff ask the clients who seemed happy, the process needs to change before the next tax season. SEC-registered advisers should also ask compliance how the marketing rule treats a request program, since it may shape what the firm can later do with the reviews it receives.
Reply without confirming the relationship
This is the part most specific to financial firms. Section 7216 of the Internal Revenue Code reaches "Any person who is engaged in the business of preparing, or providing services in connection with the preparation of," income tax returns, and its regulations make it a crime to knowingly or recklessly disclose tax return information "for a purpose other than preparing a tax return." The regulations define that information to include "a taxpayer's name, address, or identifying number" furnished in connection with preparing a return. The AICPA Code defines confidential client information as "Any information obtained from the client that is not available to the public." Google's policy adds, "Do not distribute or post personal information without consent."
A reply such as "Thanks, Dana, glad we got your refund to you faster this year" may confirm a return engagement and a detail of it in one line. A thank-you is not a case file, and it should not read like one. Many firms settle on reply patterns that acknowledge the review without confirming anything about the person, and invite a private conversation for complaints. Whether even those patterns fit the firm's obligations is a question for counsel or the ethics partner, settled once and written down.
Show reviews on the firm's own pages with care
When a firm displays reviews on its website, the FTC rule's section on review suppression lists grounds on which a business may leave a review out, such as content that is "Defamatory, harassing, abusive, obscene, vulgar, or sexually explicit," content containing "The personal information or likeness of another individual," a review the business "reasonably believes" is fake, or one "wholly unrelated" to its products or services. Write the firm's grounds down and apply them to every review the same way.
For SEC-registered advisers, a review placed on the firm's site is likely to raise testimonial questions, including the disclosures the rule requires, so compliance sees each one before it goes up. For every firm, keep the reviewer's exact words, and place a review next to the claim it supports rather than in a wall of stars. Our article on the proof your website needs to help buyers choose covers placement more broadly.
Fictional example: a tax and bookkeeping firm in Nevada
A fictional tax and bookkeeping firm in Nevada has two enrolled agents, a bookkeeping team, and a Google profile with steady reviews. The owner has been replying to each one personally, often mentioning the client's business or their return. After a conversation with counsel, the firm adopts a short policy and three reply patterns.
| Situation | Reply pattern | Who approves |
|---|---|---|
| Positive review | Thanks the reviewer for taking the time, with no reference to services, results, or the person's situation | Owner, using approved wording |
| Negative review | Says the firm takes feedback seriously and gives a phone number for anyone who wants to talk privately | Owner, after counsel signed off on the pattern |
| Review that may be fake or unrelated | No public argument; reported through the platform if it appears to break the platform's rules | Owner |
Writing the policy down matters most on the bad nights. The person answering reviews should not have to invent the firm's position at 9 p.m. on a Sunday, so the owner and counsel set it once and the patterns live in the firm's procedures. The same policy covers what the firm's Google Business Profile says and who has access to it.
In Hudson South's process, Authority Asset gathers the firm's approved business knowledge and evidence, including reviews cleared for use and the policy around them. Hudson Twenty-One records how the firm communicates across 21 dimensions, Market Intelligence researches what prospects in the firm's market ask before choosing a firm, and AEO Creation turns those inputs into answer-first content.
See how your reviews and pages compare
On a free 30-minute call, Hudson South walks through the gaps between your firm's site and the competitors prospective clients compare it with.
Get your free competitor analysisSources
- 16 CFR Part 465, Rule on the Use of Consumer Reviews and Testimonials. Electronic Code of Federal Regulations (National Archives). Read 2026-10-16.
- Prohibited & restricted content. Maps User Generated Content Policy Help, Google. Read 2026-10-16.
- 17 CFR 275.206(4)-1, Investment adviser marketing. Electronic Code of Federal Regulations (National Archives). Read 2026-10-16.
- 26 U.S.C. 7216, Disclosure or use of information by preparers of returns. Office of the Law Revision Counsel, U.S. House of Representatives. Read 2026-10-16.
- 26 CFR 301.7216-1, Penalty for disclosure or use of tax return information. Electronic Code of Federal Regulations (National Archives). Read 2026-10-16.
- AICPA Code of Professional Conduct. AICPA. Read 2026-10-16.