SMTP for loan companies is a restricted category almost everywhere: Mailgun's acceptable-use policy names payday loans and debt collection as content it generally will not carry, Mailchimp prohibits credit repair and get-out-of-debt offers outright, and SendGrid, Brevo and Klaviyo review lending mail case by case with the right to terminate later. Amazon SES will carry lawful lending mail after review. A dedicated SMTP server removes the provider policy, because there is no shared pool to protect. What it does not remove is CAN-SPAM at up to $53,088 per email, Truth in Lending APR disclosure, the FTC's advance-fee ban on debt relief, or GDPR and FCA rules for UK lenders.
I've moved several lenders and two debt-settlement firms off shared relays after termination notices. The shape of the problem is the same every time.
Which providers accept loan and debt-relief senders
Get it in writing before you pay. "Restricted" in this sector usually means "approved today, paused at the first complaint spike".
| Provider | Payday and short-term loans | Debt relief and credit repair | Mortgage and standard lending | Notes |
|---|---|---|---|---|
| Mailgun | Generally refused | Debt collection refused, relief case by case | Case by case | Named in the acceptable-use policy |
| Mailchimp | Extra scrutiny | Prohibited | Extra scrutiny | Credit repair and get-out-of-debt in the ban list |
| SendGrid | Restricted | Restricted | Restricted | Promotional streams usually declined |
| Brevo | Restricted | Restricted | Review required | Marketing mail often refused |
| Klaviyo | Restricted | Restricted | Restricted | Financial services flagged at signup |
| Amazon SES | Allowed if lawful | Allowed if lawful | Allowed if lawful | Production review, pauses on complaint spikes |
| Dedicated SMTP | Your own policy | Your own policy | Your own policy | Law and receiver rules still apply |
The split matches forex and trading and CBD: servicing mail is tolerated, promotional mail is where the bans land. A payment reminder to an existing borrower is expected. A "get approved in 60 seconds" pitch to a lead list is not.
Why lending is treated as high risk
It has little to do with whether your licence is in order. Licensed lenders get refused for the same reason unlicensed ones do: the category is expensive to host on a shared IP.
FTC enforcement history. The FTC has been suing debt-relief and credit-repair operators since the 1990s for charging fees up front and promising results they could not deliver. The Telemarketing Sales Rule was amended in 2010 specifically to ban advance fees in debt relief. A provider reads that history as legal exposure it cannot police customer by customer, so it restricts the whole sector.
Lead-generation spam. Payday and personal-loan lead networks resell the same consumer's details to a dozen lenders. Each one mails. The consumer, who filled in one form, gets twelve loan offers and reports most of them. Complaint rates on that traffic run 0.5% to 2%, against Gmail's 0.3% hard limit and 0.1% target. Every legitimate lender pays for that history because filters score by category.
Phishing. Fake "your loan is overdue" and "verify your account to release funds" messages are a staple of credit phishing. Receivers see thousands a day, so mail from a lending domain starts with a lower trust score than mail from a bakery.
The three mail streams and why they stay separate
A lender sends three kinds of mail with very different risk, and they belong on separate subdomains and separate IPs.
| Stream | Subdomain | Contains | Risk profile |
|---|---|---|---|
| Servicing | account.yourlender.com | application status, e-sign, payment receipts, statements, rate-change notices | must never pause, legally required |
| Collections | notices.yourlender.com | missed-payment reminders, default notices, hardship options | high complaint risk, regulated content |
| Marketing | offers.yourlender.com | pre-qualified offers, refinance, cross-sell, newsletters | complaint risk, advertising rules apply |
Containment is the whole point. A refinance campaign that draws complaints damages the marketing subdomain and nothing else, so the borrower still gets the statement that Truth in Lending requires you to send. Mixing streams means one bad campaign can stop a legally required notice from arriving, which is a regulatory failure on top of a deliverability one.
Collections deserves its own line because it is the one people forget. Missed-payment mail runs 3 to 5 times the complaint rate of servicing mail, and in the US the Fair Debt Collection Practices Act and Regulation F set rules on frequency and content for third-party collectors. Keep it off the servicing IP, keep the copy plain, and give every message a working opt-out for email specifically.
A 3-IP starter maps cleanly: one IP per stream. Each subdomain gets its own DKIM selector and DMARC record.
Compliance that does not go away with your own server
Dedicated infrastructure removes the shared-pool policy conflict. It does not touch the law, and lending law is specific. This is not legal advice. Get it checked per market.
CAN-SPAM. The FTC's compliance guide sets the rules for every commercial message: accurate headers, a truthful subject line, a physical address, a clear opt-out honoured within 10 business days, and liability that stays with you even when a lead vendor or affiliate does the sending. Each email in violation carries a penalty of up to $53,088.
Truth in Lending in advertising. Regulation Z applies to email as much as to a billboard. Any rate you state has to be an APR, labelled as such. Trigger terms such as the amount of a payment, the number of payments or a finance charge pull the full set of disclosures into the same message. "0% for 6 months" in a subject line with the real 29.9% APR behind a link is the pattern that draws enforcement.
FTC Telemarketing Sales Rule for debt relief. The FTC's debt relief services guide bans charging any fee until at least one debt has been renegotiated with a written creditor agreement and the customer has made a payment toward it. Required disclosures cover fees, a realistic timeline, how much the customer must save before settlements begin, and the credit damage and lawsuit risk of stopping payments. An email that promises "cut your debt in half" without those disclosures is the example the FTC uses.
TCPA and state rules. The TCPA covers calls and texts, not email, but state laws fill the gap. Several states require licensing for any marketing of consumer loans to their residents, and state credit-repair statutes often require a written contract and a three-day cancellation right. Suppress by state where you are not licensed.
GDPR, PECR and FCA for UK and EU lenders. Consent for marketing, proof of it, and a financial promotion regime that requires representative APR examples and risk warnings in the promotion itself. A loan application does not imply consent to refinance offers.
No purchased lists. Bought lending leads break consent law in the UK and EU and generate the complaint rate that got the category restricted in the US. They also get dedicated IPs blocklisted inside a week. What is actually allowed with purchased lists covers the detail. Own infrastructure removes the provider, not the receiver.
Suppression. Unsubscribes, closed accounts, state exclusions, bankruptcy filings and cease-communication requests must feed every stream, including collections.
What it costs at 100K and 500K a month
Prices as of this writing, ex tax, from the vendors' own pricing pages. The policy column matters more than the price column in this sector.
| Provider | 100,000/month | 500,000/month | Dedicated IP | Policy status |
|---|---|---|---|---|
| Amazon SES | about $10 | about $50 | $24.95 per IP add-on | allowed if lawful, review, pauses on spikes |
| Mailgun (Scale) | $90 | roughly $530 with overage | higher tiers | payday and collections generally refused |
| SendGrid | $35 to $90 | $400 to $700 | high tier | restricted, case by case |
| Dedicated server | $549 one-time plus $40 to $80 hosting | same server, add IPs above 25K/day | 3 included | your own policy |
SES is the cheapest bill and a workable choice for a lender with in-house deliverability staff. The cost is that an automated review can pause servicing mail on the day statements go out. Mailgun is fair value at 100K if they take you, and stops being so at 500K. SendGrid is the one most likely to approve a servicing-only account and decline the marketing stream.
The dedicated server pays back against SendGrid and Mailgun inside a year at 500K and inside 4 to 6 months at higher volumes. Against SES it never pays back on price alone; you buy it for the policy certainty and the dedicated reputation. Full breakdown in cost to send 500,000 emails per month and plans on pricing.
Deliverability specifics for lending
DMARC at p=reject is close to mandatory. A lending domain at p=none lets a criminal send a perfect fake overdue-payment notice from your exact From address, and Gmail will deliver it. Only reject asks receivers to drop the forgery. Start at none, read the aggregate reports for two to four weeks, move to quarantine, then reject. The path is in DMARC none vs quarantine vs reject.
Drop "guaranteed approval" and its cousins. "Guaranteed approval", "no credit check", "bad credit OK", "instant cash" and "debt forgiveness" trip two things at once. They are the phrases the FTC cites as deceptive when the small print says otherwise, and they are the phrases spam filters learned from a decade of payday spam. Write the real terms: "decisions in one business day for applicants who meet our criteria" is less exciting and lands in the inbox.
Keep complaints under 0.1%. Google's bulk sender guidance sets 0.3% as the hard limit and 0.1% as the target. Treat 0.1% as the ceiling for marketing and 0.02% for servicing. Lenders drift over the line by mailing declined applicants with alternative offers. Segment by application outcome and stop mailing declines after 30 days.
Plain-text links on your own domain. Shortened links and third-party tracking domains are phishing signals in a category receivers already distrust. Use a tracking subdomain you control and put the full URL in the text.
Warm up for 4 to 8 weeks. New IPs start cold whatever your history elsewhere. Start with servicing mail to active borrowers, ramp roughly 30% every two days per IP, then add collections, then marketing. A 4xx deferral rate climbing past 5% means slow down.
What to do after a termination
- Export the same day. Suppression list, unsubscribes, bounce log, complaint reports, DKIM keys. Access usually closes within 48 hours, and the opt-out list is your CAN-SPAM record.
- Find the cause. Complaint rate over 0.1%, bounces over 5%, or the category itself. The notice names one, the stats confirm it.
- Check domain reputation. Google Postmaster Tools. A Low or Bad domain follows you to the next provider.
- Clean before moving. Drop hard bounces, anyone with no engagement in 12 months, and every lead you cannot trace to a form the consumer filled in. Typically removes 20 to 30% of a list.
- Rebuild on dedicated IPs. Fresh subdomains for the three streams, SPF, DKIM, DMARC at
p=none, matching PTR. - Load suppressions before the first send. Not after.
- Warm up from servicing mail. It has the highest engagement and the lowest complaint rate.
- Do not open a replacement account. Providers link by domain, payment method and pattern. The second closure poisons every later appeal.
The mistake I see most is step 4. A bought lead file that got a Mailgun account closed will get dedicated IPs onto Spamhaus just as fast.
How BulkEmailSetup helps
We build dedicated SMTP infrastructure for senders in restricted categories: your own server, your own IPs, full SPF/DKIM/DMARC/PTR configuration, MTA tuning, bounce handling and a warm-up plan, with servicing, collections and marketing streams separated onto their own subdomains and IPs from day one. No shared pool means no acceptable-use team weighing your loan book against other customers. Meeting CAN-SPAM, Truth in Lending, the Telemarketing Sales Rule and GDPR in your markets remains yours.
Basic starts at $549 one-time, covering 1 SMTP server, 3 dedicated IPs, 25,000 emails/day and unlimited contacts. Higher tiers scale to 15 IPs and 200,000 emails/day. See pricing.
Frequently asked questions
Which SMTP providers allow loan and debt-relief companies?
Confirm in writing before paying, because policies change. Mailgun's acceptable-use policy names payday loans and debt collection as content it generally will not carry, Mailchimp prohibits credit repair and get-out-of-debt offers and puts mortgages and loans under extra scrutiny, and SendGrid, Brevo and Klaviyo review the category case by case. Amazon SES permits lawful lending mail after a production-access review. A dedicated SMTP server has no shared pool to protect, so the only policy that applies is the law in your markets.
Why do email providers ban payday loan and debt-relief mail?
Three reasons. The FTC has spent two decades suing debt-relief and credit-repair firms for advance fees and false promises, so the category carries legal exposure the provider does not want. Lead-generation networks in lending have a long record of mailing bought lists, which pushes complaint rates to 0.5% and above against a Gmail target of 0.1%. And lenders are among the most impersonated brands in phishing, so receivers already distrust the category.
What compliance rules apply to loan company email marketing?
CAN-SPAM applies to every promotional message, with penalties of up to $53,088 per email. Truth in Lending requires that any advertised rate be an APR and that trigger terms such as a monthly payment bring the full disclosure with them. Debt-relief firms fall under the FTC Telemarketing Sales Rule, which bans fees before a debt is actually settled. UK lenders sit under the FCA's financial promotion rules and GDPR consent requirements. None of these change when you switch providers.
Can a loan company send email to a purchased lead list?
Not safely. Purchased lists break GDPR and PECR outright for UK and EU recipients, and in the US they generate the complaint rates that get accounts closed and IPs blocklisted within a week. Bought lending leads are also a magnet for phishing reports because recipients did not expect a loan offer. A lead a consumer submitted to you directly, with a timestamp and source, is the only kind worth mailing.
What does it cost to send 100,000 loan servicing and marketing emails a month?
Roughly $10 a month on Amazon SES, about $90 a month on a Mailgun Scale plan if they accept you, $35 to $90 on SendGrid if they accept you, or a dedicated server at $549 one-time plus $40 to $80 a month hosting. At 500,000 a month the dedicated server is cheaper than everything except SES within the first year, and it is the only option where no provider can pause your payment reminders.
Does a lender need DMARC at p=reject?
Yes, in practice. Loan brands are impersonated constantly, and a domain at p=none lets a criminal send a fake overdue-payment notice from your exact address with a link to a fake login. Reject is the only policy that asks Gmail and Microsoft to drop those forgeries. Start at p=none, read the reports for two to four weeks, move to quarantine, then reject.
What should a lender do after Mailgun or Mailchimp terminates the account?
Export suppression lists, unsubscribes and bounce logs the same day, because those are your CAN-SPAM opt-out record and access closes within about 48 hours. Check Google Postmaster Tools for your domain reputation before moving anywhere. Then rebuild on dedicated IPs with servicing, collections and marketing on separate subdomains, and warm up over 4 to 8 weeks starting with servicing mail.
