CSSF Circular 22/817: Application of ESMA Guidelines on MiFID II Appropriateness and Execution-Only Requirements

CIRCULAR CSSF 22/817
1/4
Circular CSSF
22/817
Application of the
Guidelines of the European
Securities and Markets
Authority on certain aspects of the MiFID II appropriateness and execution-only requirements (ESMA35-43- 3006)

CIRCULAR CSSF 22/817
2/4
Circular CSSF 22/817
Re: Application of the Guidelines of the European Securities and Markets Authority on certain aspects of the MiFID II appropriateness and execution-only requirements (ESMA35-43-3006) Ladies and Gentlemen, Purpose of the Circular The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, will apply the Guidelines of the European Securities and Markets Authority on certain aspects of the MiFID II appropriateness and execution-only requirements (ESMA35-43-3006) (the “Guidelines”) from 12 October 2022 onwards. The CSSF will integrate the Guidelines, issued with a view to promoting supervisory convergence in this field at European level, into its administrative practice and regulatory approach. The Guidelines The Guidelines are issued by ESMA in accordance with Article 16(1) of the ESMA Regulation. The purpose of the Guidelines is to clarify the application of certain aspects of the MiFID II appropriateness and execution-only requirements in order to ensure the common, uniform, and consistent application of, respectively, Article 25(3) of MiFID II and of Articles 55 and 56 of the MiFID II Delegated Regulation as well as of Article 25(4) of MiFID II and of Article 57 of the MiFID II Delegated Regulation. The Guidelines are attached to this circular and are available on ESMA’s website (www.esma.europa.eu). Scope of application These guidelines shall apply to investment firms (as defined in Article 4(1)(1) of MiFID II) and credit institutions (as defined in Article 4(1)(27) of MIFID II) when (i) providing investment services (within the meaning of Article 4(1)(2) of MiFID II) other than investment advice and portfolio management or (ii) selling structured deposits, and external alternative investment fund managers (as defined in Article 5(1)(a) of the AIFMD) when providing the service of reception and transmission of orders in relation to financial instruments referred to in
Article 6(4)(b)(iii) of the AIFMD.
Date of application
The Guidelines shall apply from 12 October 2022 onwards.
Luxembourg, 27 June 2022
To all investment firms, credit institutions, and external alternative investment fund managers authorised to provide the service of reception and transmission of orders in relation to financial instruments

CIRCULAR CSSF 22/817
3/4
Yours faithfully,
Claude WAMPACH
Director
Marco ZWICK
Director
Jean-Pierre FABER
Director
Françoise KAUTHEN
Director
Claude MARX
Director General
Annex: ESMA Guidelines on certain aspects of the MiFID II appropriateness and
execution-only requirements

12-04-2022 | ESMA35-43-3006
Guidelines
On certain aspects of the MiFID II appropriateness and execution-only requirements

ESMA PUBLIC USE
ESMA • 201-203 rue de Bercy • CS 80910 • 75589 Paris Cedex 12 • France • Tel. +33 (0) 1 58 36 43 21 • www.esma.europa.eu 12-04-2022 ESMA35-43-3006
Table of Contents
I. Scope .................................................................................................................................. 3
II. Legislative references and definitions ................................................................................ 4
III. Purpose............................................................................................................................... 5
IV. Compliance and reporting obligations ................................................................................ 5
V. Guidelines on certain aspects of the MiFID II appropriateness and execution-only
requirements............................................................................................................................... 6

ESMA PUBLIC USE
I. Scope
Who?

1. These guidelines apply to:
   a. competent authorities; and b. firms.
   What?
2. These guidelines apply in relation to Article 25(3) and (4) of MiFID II and Articles 55 to
   57 of the Delegated Regulation. These guidelines also apply in relation to the organisational requirements of Article 16(2), (5) to (7) MiFID II and Article 21, 72 and 76 of the Delegated Regulation, as well as Articles 24(1), (4) and (5) and 25(1), (5) and (6) of MiFID II, insofar as they relate to the appropriateness assessment. When?
3. These guidelines apply from six months of the date of publication of the guidelines on
   ESMA’s website in all EU official languages.

ESMA PUBLIC USE
II. Legislative references and definitions
Legislative references
ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC1 MiFID II Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU2 Delegated Regulation Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive3 Definitions investment product a financial instrument (within the meaning of Article 4(1)(15) of MiFID II) or a structured deposit (within the meaning of
Article 4(1)(43) of MiFID II).
firms investment firms (as defined in Article 4(1)(1) of MiFID II) and credit institutions (as defined in Article 4(1)(27) of MIFID II) when providing non-advised services, and external alternative investment fund managers (AIFMs) (as defined in
Article 5(1)(a) of the AIFMD4
) when providing the non-core service referred to in Article 6(4)(b)(iii) of the AIFMD). non-advised services (i) investment services (within the meaning of Article 4(1)(2) of MiFID II) other than investment advice and portfolio management; and (ii) the selling of structured deposits.

1 OJ L 331, 15.12.2010, p. 84.
2 OJ L 173, 12.6. 2014, p. 349.
3 OJ L 87, 31.3.2017, p. 1.
4 Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 1.7.2011, p. 1).

ESMA PUBLIC USE
III. Purpose
4. These guidelines are based on Article 16(1) of the ESMA Regulation. The purpose of
these guidelines is to clarify the application of certain aspects of the MiFID II appropriateness and execution-only requirements in order to ensure the common, uniform, and consistent application of, respectively, Article 25(3) of MiFID II and of Articles 55 and 56 of the MiFID II Delegated Regulation as well as of Article 25(4) of MiFID II and of Article 57 of the MiFID II Delegated Regulation.
5. ESMA expects these guidelines to promote greater convergence in the application of,
and supervisory approaches to, the MiFID II appropriateness and execution-only requirements, by emphasising a number of important issues, and thereby enhancing the value of existing standards. By helping to ensure that firms comply with regulatory standards, ESMA anticipates a corresponding strengthening of investor protection.
IV. Compliance and reporting obligations
Status of the guidelines
6. In accordance with Article 16(3) of the ESMA Regulation, competent authorities and
financial market participants must make every effort to comply with these guidelines.
7. Competent authorities to which these guidelines apply should comply by incorporating
them into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at financial market participants. In this case, competent authorities should ensure through their supervision that firms comply with the guidelines. Reporting requirements
8. Within two months of the date of publication of the guidelines on ESMA’s website in all
EU official languages, competent authorities to which these guidelines apply must notify ESMA whether they (i) comply, (ii) do not comply but intend to comply, or (iii) do not comply and do not intend to comply with the guidelines.
9. In case of non-compliance, competent authorities must also notify ESMA within two
months of the date of publication of the guidelines on ESMA’s website in all EU official languages of their reasons for not complying with the guidelines.
10. A template for notification is available on ESMA’s website. Once the template has been
filled in, it shall be transmitted to ESMA.
11. Firms are not required to report whether they comply with these guidelines.

ESMA PUBLIC USE
V. Guidelines on certain aspects of the MiFID II
appropriateness and execution-only requirements INFORMATION TO CLIENTS ABOUT THE PURPOSE OF THE APPROPRIATENESS ASSESSMENT AND ABOUT EXECUTION-ONLY (Article 24(1), 24(4), 24(5), 25(3) and 25(4) of MiFID II) Guideline 1
12. Firms should, in good time before the provision of non-advised services, inform
their clients, by using clear and simple language, about the appropriateness assessment and its purpose which is to enable the firm to act in the client’s best interest.
13. ESMA considers that this should include the following:

• A clear explanation that it is the firm’s responsibility to conduct the assessment, so
  that clients understand the reason why they are asked by the firm to provide certain information and the importance of providing information that is up-to-date, accurate and complete;
• A reminder that it is in the client’s interest to provide accurate and complete answers
  to the questions asked by the firm for the purpose of the appropriateness assessment;
• Information regarding the situations where no assessment will be done (i.e., where
  the client does not provide the information requested or such information is not sufficient to conduct the appropriateness assessment or where services are provided under the execution-only exemption5 ) and the consequences thereof. However, such information should not give the impression that as a default option the client could refrain from submitting his/her information6 ;
• A short explanation of the main differences between advised and non-advised
  investment services taking into account the applicable requirements, to avoid any confusion between the two.

14. In case of an ongoing relationship with the client, firms should not provide the
    abovementioned information before the provision of each non-advised service. In such a case, this information could be provided before the provision of the initial non-advised service and, with respect to the information under the first two bullet points of paragraph

Investment services that only consist of execution or reception and transmission of client orders relating to investment products defined under MiFID II as being ‘non-complex’. 6 See also paragraph 28.

ESMA PUBLIC USE
13, whenever the client is requested to update the information on his/her level of knowledge and experience.
15. It is up to the firms to decide how they will inform their clients about the appropriateness
assessment. The format used to inform clients should however enable firms to keep records of the information provided7 .
16. Firms should avoid stating, or giving the impression, that it is the client who decides on
the appropriateness of the investment service or product, or who establishes which service or product fits his own knowledge and experience. In general, firms should not make any misleading statements to clients in relation to the firms’ obligation to carry out the appropriateness assessment.
17. Provided that all the information given to clients complies with the relevant provisions
(including obligations on the provision of information in durable medium), firms should also carefully consider whether their written disclosures are designed to be effective (e.g., the disclosures are made available directly to clients and are not hidden or incomprehensible). For firms providing online services in particular this may include:

• Emphasising the relevant information (e.g., through the use of design features such
  as pop-up boxes);
• Considering whether some information should be accompanied by interactive text
  (e.g., through the use of design features such as tooltips) or other means to provide additional details to clients who are seeking further information (e.g., through a F.A.Q. section). KNOW YOUR CLIENT AND KNOW YOUR PRODUCT Arrangements necessary to understand clients (Articles 16(2) and 25(3) of MiFID II and Article 55 of the Delegated Regulation) Guideline 2

18. Firms’ policies and procedures should aim to enable firms to collect all
    information necessary to conduct the appropriateness assessment in relation to the specific product types offered or demanded8 .
19. Firms shall establish, implement, and maintain adequate policies and procedures
    (including appropriate tools) to ask the client or potential client to provide information regarding that person’s knowledge and experience in the investment field relevant to the specific type of investment service or product offered or demanded and including, as appropriate, the elements listed in Article 55(1) of the Delegated Regulation.

7 While taking into account Guideline 11.
8 While taking into account Guideline 3.

ESMA PUBLIC USE
20. To that end, firms’ policies and procedures should ensure that they do not abstain from
asking information or discourage clients or potential clients in any way from providing information on their knowledge and experience.
21. It is up to firms to determine the means for asking the client to provide information on his
knowledge and experience. They could use questionnaires (also in a digital format) completed by their clients or information collected during discussions with them to conduct the appropriateness assessment. In such cases, firms should ensure that the questions they ask their clients are specific enough and are likely to be understood correctly and that any other method used to collect information, such as the use of transaction data on certain types of products from an existing client to assess his experience, is designed to obtain the necessary information about the client’s level of knowledge and experience. This is particularly important when firms are collecting the information through an online channel without any human interaction.
22. When designing the questionnaires aiming at collecting information about their clients
for the purpose of an appropriateness assessment firms should be aware and consider the most common reasons why investors could fail to answer questionnaires correctly. In particular:

• Attention should be given to the clarity, exhaustiveness, and comprehensibility of
  the questionnaire, avoiding misleading, confusing, imprecise, and excessively technical language (e.g., abbreviations);
• Firms should give careful consideration to the layout and format of questionnaires
  and should avoid orienting investors’ choices (e.g., font, line spacing…);
• Collecting information on a series of items through a single question should be
  avoided;
• Firms should carefully consider the order in which they ask questions in order to
  collect information in an effective manner;
• In order to prevent a client from guessing and thus providing unreliable information,
  the client should be able to reply that s/he does not know how to answer the question.

23. Firms should have procedures and mechanisms in place to limit the risk of circumventing
    the requirements, making sure that the information collected adequately reflects the client’s level of knowledge and experience. For example, firms could: consider limiting the number of times clients can answer the questionnaire(s) within a certain period of time, work with different sets of questionnaires when a client requests to retake the questionnaire and/or use a cooling-off period. Where such measures are imposed, a client could still be allowed to proceed with the transaction, provided that a warning is issued in case of transactions in relation to which the client does not have sufficient

ESMA PUBLIC USE knowledge and experience9
. Firms could also implement other controls to ensure that a client cannot repeat the questionnaire several times to “test” what kind of answers are needed to get the desired outcome.
24. As it is the responsibility of the firm to aim for collecting the relevant information from
clients, firms should take all reasonable steps to sufficiently assess their clients’ understanding of the main characteristics and the risks related to the specific types of investment products offered by the firm or at least to the product types in which the client has an interest. This includes an understanding of the relationship between risk and return on investments, for example by using questionnaires with multiple choice questions aimed at assessing the client’s real knowledge about the specific types of investment products.
25. In assessing the knowledge of the client, firms should put in place mechanisms to ensure
clients are not being asked to complete a self-assessment. Addressing the risk that clients may tend to overestimate their knowledge and ensuring the consistency of the answers provided by the client10 are particularly important for the correct assessment of the client’s knowledge. Firms should, in particular, avoid using yes or no questions and/or a tick-the-box self-assessment approach when asking the client whether s/he has sufficient knowledge about the main characteristics and risks of specific types of investment products (for example, firms should avoid submitting a list of investment products to the client and asking him to indicate which products s/he understands). Self￾assessment should be counterbalanced by objective criteria. For example:

• Instead of asking whether a client understands the notions of risk-return trade-off of
  specific types of investment products, the firm should for instance question clients on some practical examples of situations that may occur in practice, for example by means of graphs or through positive and negative scenarios which are based on reasonable assumptions;
• Instead of asking a client whether s/he has sufficient knowledge about the main
  characteristics and risks of specific types of investment products, the firm should for instance ask questions aimed at assessing the client’s real knowledge about the specific types of investment products, for example by asking the client multiple choice questions to which the client should provide the right answer;

26. In assessing a client’s experience, a firm should also avoid using overly broad questions
    with a yes/no type of answer and or a very broad tick-the-box approach. Instead of asking a client whether s/he feels sufficiently experienced to invest in certain products, the firm should for instance ask the client what specific types of investment products the client is familiar with and how recent and frequent his/her trading experience with them is.

9 See guideline 9.
10 See guideline 4.

ESMA PUBLIC USE
27. In case of online services, firms should design their questionnaires taking into account
factors such as:

• Whether the questions are sufficiently clear and/or whether the questionnaire is
  designed to provide additional clarification or examples to clients when necessary (e.g., through the use of design features, such as tool-tips or pop-up boxes);
• Whether some human interaction/support (including remote interaction via emails or
  mobile phones) is available to clients when responding to the online questionnaire;
• Whether steps have been taken to address inconsistent client responses (such as
  incorporating in the questionnaire design features to alert clients when their responses appear internally inconsistent and suggesting they reconsider such responses; or implementing systems to automatically flag apparently inconsistent information provided by a client for review or follow-up by the firm).

28. Firms should refrain from providing the client with a warning that they are not in a position
    to determine whether the envisaged investment service or product is appropriate for them without previously asking the client for information about his/her knowledge and experience. Firms should also abstain from emphasising that the client could proceed without such an assessment. In these situations, such a warning should only be issued when the outcome of the appropriateness assessment cannot be determined because the client has not responded to all or part of the questions.11
29. Where firms pre-fill answers based on the client’s transactions history with that firm (e.g.,
    through another investment service), they should ensure that only fully objective, pertinent, and reliable information is used and that the client is given the opportunity to review and, if necessary, correct and/or complete each of the pre-filled answers to ensure the accuracy of any pre-populated information. Firms should also refrain from predicting clients’ experience based on assumptions.
30. For the purpose of the appropriateness assessment, firms should only take into account
    the information on the client’s knowledge and experience. Firms should avoid giving the perception to clients that information collected other than that which relates to a client’s knowledge and experience, in particular with regard to the client’s financial situation and investment objectives that may be collected for other purposes (e.g., in the context of product governance or in the context of advised services to the same client), is taken into account when conducting the appropriateness assessment.

11 While taking into account guideline 9.

ESMA PUBLIC USE
Extent of information to be collected from clients (proportionality) (Article 25(3) of MiFID II and Article 55 of the Delegated Regulation) Guideline 3
31. In determining the extent of the information to be asked about the client’s or
potential client’s knowledge and experience, firms should take into account the type and characteristics of the investment products or services to be considered (i.e., the level of complexity and risk of the investment products or services) and the nature of the client.
32. In accordance with Article 25(3) of MiFID II, before providing non-advised services for
which an appropriateness assessment is required, firms shall ask the client or potential client to provide information regarding their knowledge and experience in the investment field relevant to the specific type of investment service or product offered or demanded so as to enable the firm to assess whether the investment service or product envisaged is appropriate for the client.
33. Firms should ensure that they ask for information that takes into account the type and
characteristics of the investment products or services that are considered (i.e., level of complexity and risk of the investment products or services) and the nature of the client.
34. In particular, in order to ensure that they are able to carry out the appropriateness
assessment to the same standard regardless of the investment product or investment service considered, when providing access to more complex or risky investment products, firms should carefully consider whether they need to ask more in-depth information about the client’s knowledge and experience than they would ask when less complex or risky investment products are at stake. This should enable firms to, on the basis of the answers provided, assess the client’s capacity to understand the risks associated with such instruments. For such investment products with a high level of complexity or risk (for example, derivatives or leveraged products), firms should carry out, on the basis of the answers provided, a reliable assessment of the client’s knowledge and experience, including, for example, his/her ability to understand the mechanisms which make the investment product “more complex or risky”, whether the client has already traded in such products, the length of time s/he has been trading them for, etc.
35. Depending on the level of complexity of the investment products involved, the firm should
assess the client’s knowledge and experience more specifically than solely on the basis of the type to which the product belongs (e.g., subordinated debt instead of bonds in general).
36. When the firm intends to provide a non-advised service that has specific features, the
firm should also, before such service is provided, conduct an appropriateness assessment relating to such specific features. This would for instance be relevant where a bundle of services or products is envisaged, for which, as required per Article 25(3) of

ESMA PUBLIC USE
MiFID II, the firm shall consider whether the overall bundled package is appropriate. For example, if a firm intends to provide both execution services and the ancillary service of granting loans allowing the client to carry out the transaction, this bundle of services will have different risks than each of the components considered in isolation. To take these differences into account when conducting the appropriateness assessment, it should not only relate to the envisaged investment products, but also to the ancillary service of granting loans and to the risks resulting from the combination of both. Another example would be a firm that enables clients to open a short position by selling an investment product. In this context, the firm should specifically assess whether the client has the necessary knowledge and experience to understand the risks involved in short positions.
37. It is reminded that according to Article 56(1), second subparagraph of the MiFID II
Delegated Regulation, a firm shall be entitled to assume that a professional client has the necessary experience and knowledge in order to understand the risks involved in relation to those particular investment services or transactions, or types of transaction or investment product, for which the client is classified as a professional client. Reliability of client information (Article 25(3) of MiFID II and Article 55(3) of the Delegated Regulation) Guideline 4
38. Firms should take reasonable steps and have appropriate tools to ensure that the
information provided by their clients is reliable and consistent, without unduly relying on clients’ self-assessment.
39. If the information collected is not sufficiently reliable and consistent, this would amount
to not having received sufficient information to conduct the appropriateness assessment and firms shall issue a warning to the client in accordance with the third subparagraph of Article 25(3) of MiFID II.
40. Firms should take reasonable steps to check the reliability, accuracy and consistency of
information collected about clients and not merely rely on the fact that clients are expected to provide correct, up-to-date, and complete information as is necessary for the appropriateness assessment. Such steps could, for example, include asking the client for further clarification where the information collected on his/her knowledge and experience shows that s/he has more knowledge about complex bonds than about plain vanilla bonds.
41. Firms’ policies and procedures should aim at assessing the quality and effectiveness of
the means used to collect information on the knowledge and experience of clients or potential clients. Where firms rely on tools to be used by clients as part of the appropriateness process (such as online questionnaires or software assessing whether an investment product is appropriate or if a warning should instead be issued, i.e., “profiling software”), they should ensure that they have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results. Firms should

ESMA PUBLIC USE include consistency controls on the replies provided by clients in questionnaires in order to highlight contradictions between different pieces of information collected.
42. In order to ensure the consistency of client information, firms should view the information
collected as a whole. Firms should be alert to any relevant contradictions between different pieces of information collected in order to resolve any relevant potential inconsistencies or inaccuracies. Firms should ensure that the assessment of information collected about their clients is done in a consistent way irrespective of the means used to collect such information. Relying on up-to-date client information (Articles 16(2) and 25(3) of MiFID II and Article 55(3) of the MiFID II Delegated Regulation) Guideline 5
43. When firms rely on previously collected information on clients’ knowledge and
experience, firms should establish procedures defining the frequency of updating such information in order to ensure that the information remains up to date and is accurate and complete for the purpose of the appropriateness assessment.
44. For the purposes of the appropriateness assessment, firms could either collect
information on a client’s knowledge and experience each time before an investment product is offered or demanded ( in case of one-off transactions) or rely on previously collected information, provided that it is up to date.
45. ESMA acknowledges that the issue of updating information in the context of the
appropriateness assessment has a different nature than for the suitability assessment, because the information on a client’s knowledge and experience will tend to be less volatile than other elements of the suitability assessment, and knowledge and experience generally increases overtime. Therefore, the frequency for updating information on clients could be lower under the appropriateness regime than under the suitability regime. Firms should develop a policy to assess knowledge and experience on a more regular basis with regard to groups of clients that are deemed more vulnerable.
46. The appropriateness assessment should be performed on the basis of reliable
information about the client’s knowledge and experience. Firms should implement procedures aimed at having at their disposal up-to-date information about the client’s knowledge and experience anytime a product is offered or demanded, for example by asking clients with whom the firm has an ongoing relationship to inform the firm regularly of any change or update regarding the information originally provided. Firms should also have adequate procedures to deal with situations where the client does not answer to their questions regarding changes or updates of the information provided initially.
47. Information could be updated, for example, by sending a questionnaire to clients or
providing clients with the client information available to the firm and requesting confirmation that it remains accurate, complete, and up to date. If in such a

ESMA PUBLIC USE questionnaire, firms use pre-filled answers based on the client’s transactions history with that firm, firms should ensure that only fully objective, pertinent, and reliable information is used to pre-fill those answers and that the client has the possibility to review and, if necessary, correct each of the pre-filled answers and complete them. Relevant actions following updating might include changing the client’s level of knowledge and experience based on the updated information collected.
48. In order to avoid relying on client information that is incomplete, inaccurate, or out of
date, firms should have arrangements in place to ensure that they ask the client to update the information on his/her knowledge and/or experience upon becoming aware of a relevant change that could affect his/her level of knowledge and/or experience.
49. Firms should adopt measures to mitigate the risk of inducing the client to update his/her
level of knowledge or experience so as to make a certain investment product appear appropriate that would otherwise be inappropriate for him, without there being a real modification in the client’s level of knowledge and experience. An example of a good practice to address this type of risk is the adoption of procedures to verify, before or after transactions are made, whether a client’s profile has been updated too frequently or only after a short period of time from the last modification. Such situations would therefore be escalated or reported to the relevant control function. These policies and procedures are particularly important in situations where there is a heightened conflict of interest risk, e.g., in self-placement situations or where the firm receives inducements for the distribution of an investment product. Another relevant factor to consider in this context is the type of interaction that occurs with the client (e.g., face-to-face or through automated assessment). Client information for legal entities or groups (Articles 16(2) and 25(3) of MiFID II) Guideline 6
50. Firms should have a policy defining on an ex-ante basis how to conduct the
appropriateness assessment in situations where a client is a legal person or a group of two or more natural persons or where one or more natural persons are represented by another natural person. Such a policy should be drafted in accordance with the general guideline 6 and supporting guidelines enshrined in ESMA Guidelines on certain aspects of the MiFID II suitability requirements12 .
51. This implies, amongst others, that such a policy should make a clear distinction between
situations where a representative is foreseen under applicable national law, as it can be the case for example for legal persons, and situations where no representative is foreseen, and it should focus on this latter situation. Where the policy allows clients to agree to designate a representative, they should be made aware clearly and in written

12 ESMA Guidelines on certain aspects of the MiFID II suitability requirements (Ref: ESMA35-43-1163).

ESMA PUBLIC USE form about the effects that such agreements may have regarding the protection of their respective interests. Steps taken by the firm in accordance with its policy should be appropriately documented to enable ex-post controls.
52. Where a representative is foreseen under applicable national law or is designated,
information about knowledge and experience should be collected from that representative and the appropriateness assessment should be done with regards to that representative.
53. If the group of two or more natural persons involved have difficulties in deciding the
person(s) with regard to whom the information on knowledge and experience should be assessed, the firm should adopt the most prudent approach by taking into account the information on the person with the least knowledge and experience. Firms should in such cases at least be prudent whenever there is a significant difference in the level of knowledge and experience of the different clients part of the group, or when the intended transaction may include leveraged investment products or contingent liability transactions that pose a risk of significant losses that could exceed the initial investment of the group of clients and should clearly document the approach chosen.
54. When a firm decides to ask information to assess the appropriateness for each individual
client part of the group, the firm’s policy should clearly specify how it will deal with those situations where there are significant differences between the level of knowledge and/or experience of those individual clients. Here again, the firm should adopt the most prudent approach by taking into account the information on the client part of the group with the least knowledge and experience. Alternatively, the firm’s policy may also specify that it will not be able to assess the appropriateness in such a situation. In this context, it should be noted that collecting information on all the clients part of the group and considering, for the purposes of the assessment, an average profile of the level of knowledge and experience of all of them, would unlikely be compliant with the MiFID II overarching principle of acting in the clients’ best interests. Arrangements necessary to understand investment products (Articles 16(2) and 25(3) of MiFID II) Guideline 7
55. Firms should ensure that policies and procedures are implemented to understand
the characteristics, nature, and features of investment products in order to allow them to assess if such products are appropriate to their clients.
56. For that purpose, firms should adopt reliable and objective procedures and tools that
allow them to appropriately and in a proportionate manner consider the different characteristics and relevant risk factors (such as credit risk, market risk, liquidity risk) of the investment products offered or demanded. This should include taking into consideration the firm’s analysis conducted for the purposes of product governance

ESMA PUBLIC USE obligations 13 . In this context, firms should carefully assess how certain investment products could behave under different circumstances (e.g., convertible bonds which may, for example, change their nature into shares).
57. Considering the level of ‘complexity’ of products is particularly important, and this should
be matched with the client’s information on knowledge and experience. Although complexity is a relative term, which depends on several factors, firms should – further to the assessment of products as complex or non-complex as required for the distinction between services that require an appropriateness assessment and those that do not - also take into account the criteria and principles identified in MiFID II, when defining and appropriately graduating the level of complexity to be attributed to investment products for the purposes of the appropriateness assessment.
58. Firms should adopt procedures to ensure that the information used to correctly classify
investment products included in their product offer is sufficiently reliable, accurate, consistent, and up to date. Such procedures should take into account the different characteristics and nature of the investment products considered. In addition, firms should review the information used so as to be able to reflect any relevant changes that may impact the investment product’s classification. This is particularly important taking into account the continuing evolution and growing speed of financial markets.
59. When categorising investment products for the purpose of the appropriateness
assessment, firms should use a sufficient level of granularity to ensure that only investment products with sufficiently comparable characteristics and risk features are grouped together and client’s experience and knowledge is being assessed on such characteristics and risks. Firms should consider multiple key factors for the categorisation (such as, for instance, optionality elements (in case of derivatives, or products with embedded derivatives); financial leverage; eligibility to bail-in; subordination clauses; observability of the underlying (e.g. the use of unfamiliar or opaque indices); guarantees of principal repayment or capital protection clauses; liquidity of the product (i.e. tradability on trading venues, bid-ask spread, selling restrictions, exit charges); and the currency denomination of the investment product).

13 In particular, MiFID II requires firms (under the second subparagraph of Article 24(2)) to ‘understand the financial instruments they offer or recommend’ in order to be able to comply with their obligation to ensure the compatibility between products offered or recommended and the related target market of end clients.

ESMA PUBLIC USE
MATCHING CLIENTS WITH APPROPRIATE PRODUCTS
Arrangements necessary to ensure a consistent appropriateness assessment (Articles 16(2) and 25(3) of MiFID II and Articles 21 and 56(1) of the Delegated Regulation) Guideline 8
60. In order to assess whether an investment service or product envisaged is
appropriate for the client, firms should establish policies and procedures to ensure that they consistently take into account:

• all information obtained about the client’s knowledge and experience
  necessary to assess whether an investment product is appropriate;
• all relevant characteristics and risks of the investment products considered in
  the appropriateness assessment.
  Firms should establish policies and procedures enabling them to issue a clear and not misleading warning in case they consider that the investment service or product is not appropriate for the client or potential client.

61. A sale of an investment product that amounts to a disinvestment by the client should not
    trigger the necessity for firms to conduct an appropriateness assessment.
62. Firms that rely on automated tools when conducting an appropriateness assessment
    should have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results when matching the client’s and investment product’s characteristics.
63. In this regard, the tools should be designed so that they take account of all the relevant
    specificities of each client or investment product. For example, tools that classify clients (according to their level of knowledge and experience) or investment products too broadly would not be fit for purpose.
64. Firms should clearly define and document the applicable methodology used to determine
    the outcome of the appropriateness assessment. Where a firm uses a defined scoring system to grade and assess appropriateness, the methodology, metrics, and formula used should be clear, unambiguous, and documented.
65. When assessing – in the course of conducting an appropriateness assessment – a
    client’s understanding of the main characteristics and risks of the specific types of investment products offered or demanded, a firm should consider the information that it has collected about the client’s knowledge and experience altogether for the overall appraisal of his/her understanding of the investment products and of the risks involved in the envisaged transactions.

ESMA PUBLIC USE
66. Relevant staff should have sufficient and unambiguous guidelines as to how to perform
the appropriateness assessment, to ensure they do not have undue discretion when performing this assessment and to be in a capacity to justify their decision ex-post. Firms should ensure that tools and procedures adopted for the appropriateness assessment are designed in such a way that a client would not match with types of investment products for which the client’s experience and/or knowledge has not been assessed or for which the client has not shown a sufficient level of knowledge and/or experience, and that a proper warning is issued accordingly.
67. In order to ensure the consistency of the appropriateness assessment conducted
through automated tools (even if the interaction with clients does not occur through automated systems), algorithms that determine the appropriateness of investment products offered or demanded should be properly documented and regularly monitored and tested. When defining such algorithms, firms should take into account the nature and characteristics of the investment products included in their offer to clients. In particular, firms should at least:

• establish an appropriate system-design documentation that clearly sets out the
  purpose, scope, and design of the algorithms. Decision trees or decision rules should form part of this documentation, where relevant;
• have a documented test strategy that explains the scope of testing of algorithms.
  This should include test plans, test cases, test results, defect resolution (if relevant), and final test results;
• have in place appropriate policies and procedures for managing any changes to an
  algorithm, including monitoring, and keeping records of any such changes. This includes having security arrangements in place to monitor and prevent unauthorised access to the algorithm;
• review and update algorithms to ensure that they reflect any relevant changes (e.g.,
  market changes and changes in the applicable law) that may affect their effectiveness;
• have in place policies and procedures enabling to detect any error within the
  algorithm and deal with it appropriately, including, for example, suspending the provision of services if that error is likely to result in an inappropriate transaction and/or a breach of relevant law/regulation;
• have in place adequate resources, including human and technological resources, to
  monitor and supervise the performance of algorithms through an adequate and timely review of the services provided; and
• have in place an appropriate internal sign-off process to ensure that the steps above
  have been followed.

ESMA PUBLIC USE
Effectiveness of warnings
(Article 25(3) of MiFID II and Article 56(2) of the Delegated Regulation) Guideline 9
68. To ensure its effectiveness, the warning issued by firms in case no or insufficient
information is provided by the client on his/her knowledge or experience, or in case the assessment of such information shows that the investment service or product offered or demanded is not appropriate for the client, must be prominent, clear, and not misleading.
69. Firms should take reasonable steps to make sure the warnings they issue to clients are
correctly received and understood as such. To this end, warnings should be prominent. This could be done for example by using a different colour for the warning message from the rest of the information provided or, if the order is placed over the telephone, by explaining the warning and its impact to the client while answering any questions from the client to ensure that the client has correctly received and understood the warning.
70. The warnings issued by firms should clearly state the reason for warning the client: either
that no information was provided by the client or that the information collected is insufficient and that the firm therefore is not in a position to determine the appropriateness of the envisaged transaction, or that the assessment of the information provided by the client shows that the envisaged transaction is inappropriate for the client. For example, ambiguous messages stating that the product is appropriate for “basic/intermediate/expert clients” should be avoided. Similarly, firms should avoid issuing warnings containing imprecise language (e.g., stating that the product or service “may not be appropriate” for the client), as they are unlikely to make the client sufficiently aware of the risks of proceeding with the transaction. Firms should also avoid overly long warnings that obscure the key message that the client does not have or did not demonstrate having the necessary knowledge and experience for the investment service or product.
71. Firms should not downplay the importance of warnings and should not encourage the
client to ignore them (e.g., during telephone conversations or in language used in the warning).
72. Firms should avoid the use of messages in the warnings that could encourage the client
to proceed with the transaction, to re-take the appropriateness assessment or to request an upgrade to professional client. For example, firms could implement a process that the client needs to confirm that s/he is aware of the information provided in the warning before s/he can proceed with the transaction.
73. If a client who does not have the necessary knowledge and experience is offered
educational tools, webinars, or ‘demo’ trading platforms with the aim of improving his/her knowledge, the firm should, subsequently, determine that the client has the necessary knowledge regarding the envisaged investment service or product by conducting another

ESMA PUBLIC USE appropriateness assessment focused on his/her level of knowledge. Such educational tools should not be structured in such a way that they specifically aim to improve the client’s ability to provide correct answers to a predefined set of questions as this may lead to a circumvention of the firm’s obligation to assess the client’s knowledge and experience of the investment products offered or demanded.
74. Where firms’ policies and procedures provide for the possibility to accept their clients’
requests to proceed with the transaction after a warning has been issued, firms should evaluate the overall effectiveness of the warnings issued on an ex-post basis, for instance, by assessing the ratio of warnings that were followed by a transaction to the total of all warnings issued and should make adjustments to their relevant policies and procedures where necessary.
75. Additionally, by way of good practice, firms could have policies and procedures
identifying any conditions and criteria under which a client’s request to proceed with a transaction after having received a warning could be accepted or not. For example, a firm could take into account situations where there is a heightened risk of conflicts of interest because the firm is selling its own investment products (or investment products issued by entities of the same group) or actively marketing investment products from within the firm’s range. Another factor that could be considered is a high level of complexity or risk of products offered or demanded. OTHER RELATED REQUIREMENTS Qualifications of firm staff (Articles 16(2) and 25(3) of MiFID II and Article 21(1)(d) of the Delegated Regulation) Guideline 10
76. Staff involved in the appropriateness assessment should understand the role they
play in this assessment and have an adequate level of skills, knowledge, and expertise, including sufficient knowledge of the relevant regulatory requirements and procedures in order to discharge their responsibilities. To that end, firms should regularly train their staff.
77. ESMA emphasises that staff giving information about investment products, investment
services or ancillary services to clients on behalf of the firm must possess the necessary knowledge and competence required under Article 25(1) of MiFID II (and specified further in ESMA Guidelines for the assessment of knowledge and competence14), including with regard to the appropriateness assessment.
78. Firms should also ensure that other staff that do not directly face clients but are involved
in the appropriateness assessment in any other way should still possess the necessary

14 ESMA Guidelines for the assessment of knowledge and competence (Ref: ESMA71-1154262120-153 EN (rev)). ESMA/2015/1886

ESMA PUBLIC USE skills, knowledge and expertise required depending on their particular role in the appropriateness process. This may regard, for example, setting up the questionnaires, defining algorithms governing the assessment or other aspects necessary to conduct the appropriateness assessment and controlling compliance with the appropriateness requirements.
79. Where relevant, when employing automated tools (including hybrid tools), firms should
ensure that their staff involved in the activities related to the development of these tools:

• have an appropriate understanding of the technology and algorithms used to
  conduct an automated assessment (particularly, staff should be able to understand the rationale, risks and rules behind the algorithms underpinning the automated assessment); and
• are able to understand and review the automated assessment generated by the
  algorithms.
  Record-keeping
  (Articles 16(6), 16(7), 25(5) and 25(6) of MiFID II and Articles 56(2) and 72 and 76 of the Delegated Regulation) Guideline 11

80. As part of their obligation to maintain records of the appropriateness assessment
    referred to in Article 56(2) of the MiFID II Delegated Regulation, firms should at least:

• maintain adequate recording and retention arrangements to ensure orderly
  and transparent record-keeping regarding the appropriateness assessment, including the collection of information from the client and the non-advised service provided;
• ensure that record-keeping arrangements are designed to enable the
  detection of failures regarding the appropriateness assessment;
• ensure that records kept are accessible for the relevant persons in the firm
  and for competent authorities;
• have adequate processes to mitigate any shortcomings or limitations of the
  record-keeping arrangements.

81. Record-keeping arrangements adopted by firms should be designed to enable firms to
    track ex-post:

• the result of the appropriateness assessment including its rationale, i.e. a clear and
  straightforward link between the client information gathered and assessed and the outcome of the assessment;

ESMA PUBLIC USE

• any warning issued by the firm where the investment service or product was
  assessed as potentially inappropriate for the client, or where the client did not provide sufficient information to enable the firm to undertake an appropriateness assessment (irrespective of whether the client asked to proceed with the transaction or not);
• whether the client asked to proceed with the transaction despite the warning; and
• whether the firm accepted the client's request to proceed with the transaction in
  accordance with the related procedures adopted.

82. Therefore, a firm should record all relevant information about the appropriateness
    assessment, such as information about the client (including how that information is used and interpreted to define the client’s knowledge and experience profile), and information about investment products offered to the client. Those records should include:

• any updates to the information provided in the context of the appropriateness
  assessment, in particular any change to the client’s knowledge and experience profile;
• the types of investment products that fit that profile and the rationale for such an
  assessment, as well as any changes and the reasons for them.

83. Firms should have in place arrangements enabling them to understand and mitigate the
    additional risks that could affect the provision of investment services through online or digital tools such as malicious cyber activity.15
84. Record-keeping arrangements adopted by firms may vary depending on the distribution
    channel used to provide non-advised services. For instance, firms should:

• where services are provided online, develop IT tools to track and store the
  information;
• where services are provided by telephone, adopt appropriate arrangements to
  ensure that the firm is able to link any warning issued by it with a possible transaction made by the client who decides to proceed despite that warning;
• where services are provided face-to-face, collect and record all relevant forms and
  documents used in the appropriateness process, in particular those signed by the client and/or the firm’s staff.

15 Firms should consider such risks not only in relation to the provisions stated in the guideline, but also as part of a firm’s wider obligations under Article 16(4) of MiFID II to take reasonable steps to ensure continuity and regularity in the performance of investment service and activities, and corresponding delegated act requirements linked to this.

ESMA PUBLIC USE
Determining situations where the appropriateness assessment is required (Articles 16(2), 25(3) and 25(4) of MiFID II and Article 57 of the Delegated Regulation) Guideline 12
85. Firms should adopt appropriate arrangements to ensure that they are able to
determine situations where an appropriateness assessment needs to be performed and avoid performing one in situations where a suitability assessment needs to be performed.
86. Firms should have procedures and controls in place regarding the interaction between
sales staff and clients to guide and record16 the interaction and ensure that there is a clear distinction between advised and non-advised transactions on the one hand, and, on the other, between transactions falling within the execution-only exemption and other non-advised transactions.
87. Firms should have in place policies and procedures to ensure that the conditions
provided in Article 25(4) MiFID II for providing an “execution-only service” where an appropriateness assessment is not conducted are being met.17
88. Firms should design, implement, and update policies and processes to identify which of
their investment products may be regarded as “complex” and “non-complex” for the purposes of the appropriateness requirements. Unless they have been assessed against and have met all the criteria of Article 57 of the MiFID II Delegated Regulation, ‘other non-complex financial instruments’ as referred to in Article 25(4)(a)(vi) of MiFID II should be categorised as complex.
89. Firms’ policies and processes should ensure that the investment products expressly
excluded from the list of non-complex instruments of Article 25(4)(a)(i-v) of MiFID II are in any case not assessed against the criteria set out in Article 57 of the MiFID II Delegated Regulation to potentially be categorised as non-complex investment products for the purposes of the appropriateness assessment.
90. Firms should be able to trace whether a client has submitted his/her order in response
to a personalised communication from or on behalf of the firm. In such cases, the firm should disqualify the transaction for the purposes of the “execution-only” exemption.

16 While taking into account guideline 11.
17 This does not prevent firms from carrying out an appropriateness assessment for all kinds of products, complex and non￾complex.

ESMA PUBLIC USE
Controls
(Articles 16(2), the second subparagraph of 16(5) and 25(3) of MiFID II and 76 of the Delegated Regulation) Guideline 13
91. Firms should have appropriate monitoring arrangements and controls in place to
ensure compliance with the appropriateness requirements.
92. When firms rely on automated systems or tools in the appropriateness assessment
process (e.g., client-profiling tools based on knowledge and experience, automatic warnings, or controls on complexity of investment products), these systems or tools should be fit for purpose and should be monitored periodically. Firms should keep records of this monitoring.
93. When making use of automated controls in the context of the appropriateness
assessment, firms should ensure that the automated controls cannot be circumvented19 and should periodically monitor the correct functioning of these automated controls. Firms should have appropriate policies and procedures in place to detect IT issues at an early stage.
94. In the context of the appropriateness assessment, firms should pay particular attention
to the complexity of investment products. For example, databases with complexity codes used for the appropriateness assessment tools should be reviewed on a regular basis and should be kept up to date.
95. When the appropriateness assessment is done through face-to-face meetings or by
telephone, in which case a human intervention exists, firms should include written records from face-to-face meetings or telephone recordings in their regular control processes to monitor whether sales staff comply with their duties in the context of the appropriateness assessment. Firms should monitor these written records or telephone recordings as part of their control procedures.
96. Firms should monitor matters such as the ratio of warnings that were followed by a
transaction to the total of all warnings issued in order to evaluate the overall effectiveness of the warnings issued.

18 See also guideline 11
19 Exceptions should be reserved for specific circumstances set in the firm’s procedures and with specific hierarchical authorisation.

CIRCULAR CSSF 22/817
/
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - direction@cssf.lu www.cssf.lu