CSSF Circular 23/835: Application of ESMA Guidelines on MiFID II Suitability Requirements

CIRCULAR CSSF 23/835
1/4
Circular CSSF
23/835
Application of the
Guidelines of the European
Securities and Markets
Authority on certain aspects of the MiFID II suitability requirements

CIRCULAR CSSF 23/835
2/4
Circular CSSF 23/835
Re: Application of the Guidelines of the European Securities and Markets Authority on certain aspects of the MiFID II suitability requirements Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, will apply the Guidelines of the European Securities and Markets Authority (ESMA) on certain aspects of the MiFID II1 suitability requirements (ESMA35-43-3172) (the “Guidelines”) from 3 October 2023 onwards. The CSSF will integrate the Guidelines, issued with a view to promoting supervisory convergence in this field at European level, into its administrative practice and regulatory approach.

1. The Guidelines
   The Guidelines are issued by ESMA in accordance with Article 16(1) of the ESMA Regulation2. The purpose of the Guidelines is to clarify the application of certain aspects of the MiFID II suitability requirements in order to ensure the common, uniform, and consistent application of Article 25(2) of MiFID II3 and of Articles 54 and 55 of the MiFID II Delegated Regulation4. The Guidelines are attached to this circular and are available on ESMA’s website (https://www.esma.europa.eu/sites/default/files/2023-04/ESMA35-43- 3172_Guidelines_on_certain_aspects_of_the_MiFID_II_suitability_requirement s.pdf).
2. Scope of application
   These guidelines shall apply to investment firms (as defined in Article 4(1)(1) of MiFID II5) and credit institutions (as defined in Article 4(1)(27) of MIFID II6) when providing the investment services (within the meaning of Article 4(1)(2) 1 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments, as amended 2 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), as amended 3 Article 37-3(4) of the Law of 5 April 1993 on the financial sector, as amended 4 Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive, as amended 5 Article 1(9) of the Law of 5 April 1993 on the financial sector, as amended 6 Article 1(12) of the Law of 5 April 1993 on the financial sector, as amended Luxembourg, 16 May 2023 To all investment firms, credit institutions, UCITS management companies and external alternative investment fund managers authorised to provide the services of investment advice or portfolio management

CIRCULAR CSSF 23/835
3/4 of MiFID II7) of portfolio management or investment advice, or when selling or advising clients in relation to structured deposits, and to UCITS management companies (as defined in Article 2(1)(b) of the UCITS Directive8,9) and external alternative investment fund managers (as defined in Article 5(1)(a) of AIFMD10,11) when providing the services of individual portfolio management or investment advice referred to in Article 6(3)(a) and (b)(i) of the UCITS Directive12 and Article 6(4)(a) and (b)(i) of AIFMD13 respectively.
3. Date of application
The Guidelines and this circular shall apply from 3 October 2023 onwards. The previous ESMA guidelines on this topic14 will cease to apply on the same date. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General
Annex: ESMA Guidelines on certain aspects of the MiFID II suitability requirements
7 Article 1(30) of the Law of 5 April 1993 on the financial sector, as amended 8 Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities, as amended 9 Management companies incorporated under Luxembourg law and subject to Chapter 15 of the Law of 17 December 2010 relating to undertakings for collective investment, as amended 10 Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers, as amended 11 Article 1(49) of the Law of 12 July 2013 on alternative investment fund managers, as amended 12 Article 101(3)(a) and (b), first indent of the Law of 17 December 2010 relating to undertakings for collective investment, as amended 13 Article 5(4)(a) and b(i) of the Law of 12 July 2013 on alternative investment fund managers, as amended 14 ESMA35-43-1163

03/04/2023
ESMA35-43-3172
23 September 2022 | ESMA35-43-3172
Guidelines on certain aspects of the MiFID II suitability requirements

Table of Contents
I. Scope ......................................................................................................................... 2
II. Legislative references, abbreviations and definitions .................................................. 2
III. Purpose................................................................................................................... 4
IV. Compliance and reporting obligations ..................................................................... 4
V. Guidelines on certain aspects of the MiFID suitability requirements............................ 5

I. Scope
Who?

1. These guidelines apply to:
   a. Competent Authorities and b. Firms
   What?
2. These guidelines apply in relation to Article 25(2) of MiFID II and Articles 54 and 55 of MiFID
   II Delegated Regulation and apply to the provision of the following investment services listed in Section A of Annex I of MiFID II:

• investment advice;
• portfolio management.

3. These guidelines principally address situations where services are provided to retail clients.
   They should also apply, to the extent they are relevant, when services are provided to professional clients, taking into account the provisions under Article 54(3) of the MiFID II Delegated Regulation and Annex II of MiFID II. When?
4. These guidelines apply as from six months from the date of publication of the guidelines on
   ESMA’s website in all EU official languages.
   The previous ESMA guidelines issued under MiFID II1 will cease to apply on the same date.
   II. Legislative references, abbreviations and definitions
   Legislative references
   ESMA Regulation Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC.2 1 ESMA35-43-1163 - - Guidelines on certain aspects of the MiFID II suitability requirements. 2 OJ L 331, 15.12.2010, p. 84.

MiFID II Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU.3 MiFID II Delegated regulation Commission Delegated Regulation (EU) 2017/565 of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive.4 Commission Delegated Regulation 2021/1253 Commission Delegated Regulation (EU) 2021/1253 of 21 April 2021 amending Delegated Regulation (EU) 2017/565 as regards the integration of sustainability factors, risks and preferences into certain organisational requirements and operating conditions for investment firms.5 Definitions Investment product A financial instrument (within the meaning of Article 4(1)(15) of MiFID II) or a structured deposit (within the meaning of
Article 4(1)(43) of MiFID II).
Firms Investment firms (as defined in Article 4(1)(1) of MiFID II) and credit institutions (as defined in Article 4(1)(27) of MIFID II) when providing the investment services of investment advice and portfolio management listed in Section A of Annex I of MiFID II, investment firms and credit institutions (when selling or advising clients in relation to structured deposits), UCITS management companies (as defined in Article 2(1)(b) of UCITS Directive 6 ) and external Alternative Investment Fund Managers (AIFMs) (as defined in Article 5(1)(a) of the AIFMD7 when providing the investment services of individual portfolio management or non-core services (within the meaning of Article 6(3)(a) and (b)(i) of UCITS Directive and
Article 6(4)(a) and (b)(i) of the AIFMD).
Suitability assessment The whole process of collecting information about a client and the subsequent assessment by the firm that a given investment product is suitable for him, based also on the firm’s solid understanding of the products that it can recommend or invest into on behalf of the client. 3 OJ L 173, 12.06.2014, p. 349. 4 OJ L 87, 31.3.2017, p. 1. 5 OJ L 277, 2.8.2021, p. 1. 6 Directive 2009/65/EC 7 Directive 2011/61/EU

Robo-advice The provision of investment advice or portfolio management services (in whole or in part) through an automated or semi￾automated system used as a client-facing tool.
III. Purpose
5. The purpose of these guidelines is to clarify the application of certain aspects of the MiFID
II suitability requirements in order to ensure the common, uniform and consistent application of Article 25(2) of MiFID II and of Articles 54 and 55 of the MiFID II Delegated Regulation.
6. ESMA expects these guidelines to promote greater convergence in the interpretation of,
and supervisory approaches to, the MiFID II suitability requirements, by emphasising a number of important issues, and thereby enhancing the value of existing standards. By helping to ensure that firms comply with regulatory standards, ESMA anticipates a corresponding strengthening of investor protection.
IV. Compliance and reporting obligations
Status of the guidelines
7. This document contains guidelines issued under Article 16 of the ESMA Regulation.8 In
accordance with Article 16(3) of the ESMA Regulation, competent authorities and financial market participants shall make every effort to comply with guidelines.
8. Competent authorities to whom these guidelines apply should comply by incorporating them
into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at financial market participants. In this case, competent authorities should ensure through their supervision that financial market participants comply with the guidelines. Reporting requirements
9. Competent authorities to which these guidelines apply must notify ESMA whether they
comply or intend to comply with the guidelines as appropriate, stating their reasons for non￾compliance where they do not comply or do not intend to comply, within two months of the date of publication of the guidelines on ESMA’s website in all official languages of the EU.
10. Firms are not required to report whether they comply with these guidelines.
8 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC.

V. Guidelines on certain aspects of the MiFID suitability requirements
I.I INFORMATION TO CLIENTS ABOUT THE PURPOSE OF THE SUITABILITY ASSESSMENT AND ITS SCOPE Relevant legislation: Article 24(1), 24(4) and 24(5) of MiFID II and Article 54(1), of the MiFID II Delegated Regulation. General guideline 1
11. Firms should inform their clients clearly and simply about the suitability assessment and
its purpose which is to enable the firm to act in the client’s best interest. This should include a clear explanation that it is the firm’s responsibility to conduct the assessment, so that clients understand the reason why they are asked to provide certain information and the importance that such information is up-to-date, accurate and complete. Such information may be provided in a standardised format. Supporting guidelines
12. Information about the suitability assessment should help clients understand the purpose
of the requirements. It should encourage them to provide up-to-date, accurate and sufficient information about their knowledge, experience, financial situation (including their ability to bear losses), and investment objectives (including their risk tolerance). Firms should highlight to their clients that it is important to gather complete and accurate information so that the firm can recommend suitable products or services to the client. Without this information, firms cannot provide investment advice and portfolio management services to clients.
13. It is up to the firms to decide how they will inform their clients about the suitability
assessment. The format used should however enable controls to check if the information was provided.
14. Firms should avoid stating, or giving the impression, that it is the client who decides on
the suitability of the investment, or that it is the client who establishes which financial instruments fit his own risk profile. For example, firms should avoid indicating to the client that a certain financial instrument is the one that the client chose as being suitable, or requiring the client to confirm that an instrument or service is suitable.
15. Any disclaimers (or other similar types of statements) aimed at limiting the firm’s
responsibility for the suitability assessment would not in any way impact the characterisation of the service provided in practice to clients nor the assessment of the firm’s compliance to the corresponding requirements. For example, when collecting clients’ information required to conduct a suitability assessment (such as their investment horizon/holding period or information related to risk tolerance), firms should not claim that they do not assess the suitability.
16. In order to help clients understanding the concept of “sustainability preferences”
introduced under Article 2(7) of the MiFID II Delegated Regulation and the choices to be

made in this context, firms should explain the terms and the distinctions between the different elements of the definition of sustainability preferences outlined under points (a) to (c) of Article 2(7) and also between these products and products without such sustainability features in a clear manner, avoiding technical language. Firms should also explain terms and concepts used when referring to environmental, social and governance aspects.
17. In order to address potential gaps in clients’ understanding of the services provided
through robo-advice, firms should inform clients, in addition to other required information, on the following:

• a very clear explanation of the exact degree and extent of human involvement and
  if and how the client can ask for human interaction;
• an explanation that the answers clients provide will have a direct impact in
  determining the suitability of the investment decisions recommended or undertaken on their behalf;
• a description of the sources of information used to generate an investment advice
  or to provide the portfolio management service (e.g., if an online questionnaire is used, firms should explain that the responses to the questionnaire may be the sole basis for the robo-advice or whether the firm has access to other client information or accounts);
• an explanation of how and when the client’s information will be updated with regard
  to his situation, personal circumstances, etc.

18. Provided that all the information and reports given to clients shall comply with the
    relevant provisions (including obligations on the provision of information in durable medium), firms should also carefully consider whether their written disclosures are designed to be effective (e.g., the disclosures are made available directly to clients and are not hidden or incomprehensible). For firms providing robo-advice this may in particular include:

• Emphasising the relevant information (e.g., through the use of design features such
  as pop-up boxes);
• Considering whether some information should be accompanied by interactive text
  (e.g., through the use of design features such as tooltips) or other means to provide additional details to clients who are seeking further information (e.g., through F.A.Q.
  section).

I.II KNOW YOUR CLIENT AND KNOW YOUR PRODUCT
Arrangements necessary to understand clients
Relevant legislation: Articles 16(2) and 25(2) of MiFID II, and Articles 54(2) to 54(5) and
Article 55 of the MiFID II Delegated Regulation.
General guideline 2
19. Firms must establish, implement and maintain adequate policies and procedures
(including appropriate tools) to enable them to understand the essential facts and characteristics about their clients. Firms should ensure that the assessment of information collected about their clients is done in a consistent way irrespective of the means used to collect such information. Supporting guidelines
20. Firms’ policies and procedures shall enable them to collect and assess all information
necessary to conduct a suitability assessment for each client, while taking into account the elements developed in guideline 3.
21. For example, firms could use questionnaires (also in a digital format) completed by their
clients or information collected during discussions with them. Firms should ensure that the questions they ask their clients are specific enough, are likely to be understood correctly and that any other method used to collect information is designed to get the information required for a suitability assessment.
22. When designing the questionnaires aiming at collecting information about their clients
for the purpose of a suitability assessment firms should be aware and consider the most common reasons why investors could fail to answer questionnaires correctly. In particular:

• Attention should be given to the clarity, exhaustiveness and comprehensibility of the
  questionnaire, avoiding misleading, confusing, imprecise and excessively technical language;

• The layout should be carefully elaborated and should avoid orienting investors’
  choices (font, line spacing…);

• Presenting questions in batteries (collecting information on a series of items through
  a single question, particularly when assessing knowledge and experience and the risk tolerance) should be avoided;

• Firms should carefully consider the order in which they ask questions in order to
  collect information in an effective manner;

• In order to be able to ensure necessary information is collected, the possibility not
  to reply should generally not be available in questionnaires (particularly when collecting information on the investor’s financial situation).

23. Firms should also take reasonable steps to assess the client’s understanding of
    investment risk as well as the relationship between risk and return on investments, as this is key to enable firms to act in accordance with the client’s best interest when conducting the suitability assessment. When presenting questions in this regard, firms should explain clearly and simply that the purpose of answering them is to help assess clients’ attitude to risk (risk profile), and therefore the types of financial instruments (and risks attached to them) that are suitable for them.
24. Information necessary to conduct a suitability assessment includes different elements
    that may affect, for example, the analysis of the client’s financial situation (including his ability to bear losses) or investment objectives (including his risk tolerance). Examples of such elements are the client’s:

• marital status (especially the client’s legal capacity to commit assets that may belong
  also to his partner);
• family situation (changes in the family situation of a client may impact his financial
  situation e.g. a new child or a child of an age to start university);
• age (which is mostly important to ensure a correct assessment of the investment
  objectives, and in particular the level of financial risk that the investor is willing to take, as well as the holding period/investment horizon, which indicates the willingness to hold an investment for a certain period of time);
• employment situation (the degree of job security or that fact the client is close to
  retirement may impact his financial situation or his investment objectives);
• need for liquidity in certain relevant investments or need to fund a future financial
  commitment (e.g. property purchase, education fees).

25. When determining what information is necessary, firms should keep in mind the impact
    that any significant change regarding that information could have concerning the suitability assessment.
26. The information on the sustainability preferences of the client should include all aspects
    mentioned in the definition of “sustainability preferences” according to Article 2(7) of the MiFID II Delegated Regulation and should be sufficiently granular to allow for a matching of the client’s sustainability preferences with the sustainability-related features of financial instruments. Firms should collect the following information from clients:

• Whether the client has any sustainability preferences (yes/no).

• If the client answers “yes” to the previous question, whether the client has
  sustainability preferences with regard to one or more of points (a), (b) or (c) of the definition according to Article 2(7) MiFID II Delegated Regulation.

• For aspects (a) and (b), the minimum proportion.

• For aspect (c), which principal adverse impacts (PAI) should be considered
  including quantitative or qualitative criteria demonstrating that consideration. Throughout the process, firms should adopt a neutral and unbiased approach as to not influence clients’ answers.

27. To achieve this, firms could choose the following approach:

• Firms could collect information on the sustainability preferences of the client
  which would refer to one or more of the aspects expressed through points (a) to (c) of Article 2(7) of the MiFID II Delegated Regulation. This aspect could be assessed through closed-ended yes/no-questions.
• Firms could also collect information on whether the client’s sustainability
  preferences with regard to points (b) and (c), if any, have a focus on either environmental, social or governance sustainability factors or a combination of them or whether the client does not have such a focus.
• Where the client expresses preferences in terms of the “minimum proportion” as
  mentioned in points (a) and (b), firms could collect this information not in terms of an exact percentage but by minimum percentages. These percentages should be presented in a neutral way to the client and should be sufficiently granular. Firms could, for example, assist the customer to identify the minimum proportion by approximating the minimum proportion by standardised minimum proportions, such as “minimum 20%, minimum 25%, minimum 30%, etc.”.
• In case the client wishes to include a financial instrument that considers PAI, the
  information collected should cover the qualitative or quantitative elements of PAI mentioned under c). Firms could test the client’s preferences and appetite for PAI integration with regard to the families of PAI indicators as whole, based on a possible focus of the client on environmental, social or governance aspects, using the categories presented in the SFDR RTS9 (instead of an approach based on each PAI indicator) such as emissions, energy performance, water & waste, etc. An evaluation could then be initiated for each category that is important/key for the client or not. This qualitative evaluation could be based on the approaches in 9 COMMISSION DELEGATED REGULATION (EU) 2022/1288

which products consider PAI (e.g., exclusion strategies / controversies policies / voting and engagement policies). In case the client wishes to include a financial instrument that considers PAI, firms could also ask the client if there are specific economic activities that, on the basis of relevant PAIs, it wishes to exclude from its investments (for example, specific economic activities that are considered as significantly harmful under the EU taxonomy framework and/or that are opposed to the environmental and ethical views held by the client and that are linked to certain principal adverse impacts on sustainability factors).
28. Firms should have policies and instructions for their client-facing staff in place for
situations where clients answer that they do have sustainability preferences but do not state a preference with regard to any of the specific aspects mentioned under points (a) to (c) of Article 2(7) of the MiFID II Delegated Regulation or with regard to a minimum proportion. For example, the firm could consider any of the aspects under points (a) to (c) of Article 2(7) of the Delegated Regulation. Where firms make use of this approach, they should explain it and inform the client about the sustainability features of the investment product(s) recommended or on which the firm will invest on behalf of the client and document in the suitability report10 the client’s choice not to further specify the sustainability preferences. Firms should ensure that similar arrangements are in place when firms provide robo-advice services given the limited human interaction.
29. When providing portfolio management or investment advice with a portfolio approach
firms should collect information on the client’s sustainability preferences with the same granularity as set out in paragraphs 26 and 27 above. Firms should also ask the client which part/percentage of the portfolio (if any) the client wants to be invested in products meeting the client’s sustainability preferences. Where firms work with model portfolios that combine some or all of the criteria listed under paragraph 26 above, these model portfolios should allow for a granular assessment of the client’s preferences and should not be translated into a questionnaire that pushes the client into a certain combination of the criteria that would not meet the client’s sustainability preferences.
30. Firms should take all reasonable steps to sufficiently assess the understanding by their
clients of the main characteristics and the risks related to the product types in the offer of the firm. The adoption by firms of mechanisms to avoid self-assessment and ensure the consistency of the answers provided by the client12 is particularly important for the correct assessment of the client’s knowledge and experience. Information collected by firms about a client’s knowledge and experience should be considered altogether for the overall appraisal of his understanding of the products and of the risks involved in the transactions recommended or in the management of his portfolio. 10 "Suitability report is the "statement of suitability" referred to in Article 25 of MIFID II". 11 This paragraph should be read in conjunction with paragraph. 87 of the guidelines. 12 See guideline 4.

31. It is also important that firms appraise the client’s understanding of basic financial notions
    such as investment risk (including concentration risk) and risk-return trade off. To this end, firms should consider using indicative, comprehensible examples of the levels of loss/return that may arise depending on the level of risk taken and should assess the client’s response to such scenarios.
32. Firms should design their questionnaires so that they are able to gather the necessary
    information about their client. This may be particularly relevant for firms providing robo￾advice services given the limited human interaction. In order to ensure their compliance with the requirements concerning that assessment, firms should take into account factors such as:

• Whether the information collected through the online questionnaire allows the firm
  to conclude that the advice provided is suitable for their clients on the basis of their knowledge and experience, their financial situation and their investment objectives and needs;
• Whether the questions in the questionnaire are sufficiently clear and/or whether the
  questionnaire is designed to provide additional clarification or examples to clients when necessary (e.g., through the use of design features, such as tool-tips or pop￾up boxes);
• Whether some human interaction (including remote interaction via emails or mobile
  phones) is available to clients when responding to the online questionnaire;
• Whether steps have been taken to address inconsistent client responses (such as
  incorporating in the questionnaire design features to alert clients when their responses appear internally inconsistent and suggest them to reconsider such responses; or implementing systems to automatically flag apparently inconsistent information provided by a client for review or follow-up by the firm). Extent of information to be collected from clients (proportionality) Relevant legislation: Article 25(2) of MiFID II, and Articles 54(2) to 54(5) and Article 55 of the MiFID II Delegated Regulation. General guideline 3

33. Before providing investment advice or portfolio management services, firms need to
    collect all ‘necessary information’ 13 about the client’s knowledge and experience, financial situation and investment objectives. The extent of ‘necessary’ information may vary and has to take into account the features of the investment advice or portfolio 13 ‘Necessary information’ should be understood as meaning the information that firms must collect to comply with the suitability requirements under MiFID II.

management services to be provided, the type and characteristics of the investment products to be considered and the characteristics of the clients. Supporting guidelines
34. In determining what information is ‘necessary’ firms should consider, in relation to a
client’s knowledge and experience, financial situation and investment objectives:

• the type of the financial instrument or transaction that the firm may recommend or
  enter into (including the complexity and level of risk);
• the nature and extent of the service that the firm may provide;
• the needs and circumstances of the client;
• the type of client.

35. While the extent of the information to be collected may vary, the standard for ensuring
    that a recommendation or an investment made on the client’s behalf is suitable for the client will always remain the same. MiFID allows firms to collect the level of information proportionate to the products and services they offer, or on which the client requests specific investment advice or portfolio management services. It does not allow firms to lower the level of protection due to clients.
36. For example, when providing access to complex14 or risky15 financial instruments, firms
    should carefully consider whether they need to collect more in-depth information about the client than they would collect when less complex or risky instruments are at stake. This is so that firms can assess the client’s capacity to understand, and financially bear, the risks associated with such instruments. 16 For such complex products ESMA expects firms to carry out a robust assessment amongst others of the client’s knowledge and experience, including, for example, his ability to understand the mechanisms which make the investment product “complex”, whether the client has already traded in such products (for example, derivatives or leverage products), the length of time he has been trading them for, etc.
37. For illiquid financial instruments17, the ‘necessary information’ to be gathered will include
    information on the length of time for which the client is prepared to hold the investment. As information about a client’s financial situation will always need to be collected, the extent of information to be collected may depend on the type of financial instruments to be recommended or entered into. For example, for illiquid or risky financial instruments, 14 As defined in MiFID II and taking into account the criteria identified in guideline 7. 15 It is up to each firm to define a priori the level of risk of the financial instruments included in its offer to investors taking into account, where available, possible guidelines issued by competent authorities supervising the firm. 16 In any case, to ensure clients understand the investment risk and potential losses they may bear, the firm should, as far as possible, present these risks in a clear and understandable way, potentially using illustrative examples of the extent of losses in the event of an investment performing poorly. 17 It is up to each firm to define a priori which of the financial instruments included in its offer to investors it considers as being illiquid, taking into account, where available, possible guidelines issued by competent authorities supervising the firm.

‘necessary information’ to be collected may include all of the following elements as necessary to ensure whether the client’s financial situation allows him to invest or be invested in such instruments:

• the extent of the client’s regular income and total income, whether the income is
  earned on a permanent or temporary basis, and the source of this income (for example, from employment, retirement income, investment income, rental yields, etc.);
• the client’s assets, including liquid assets, investments and real property, which
  would include what financial investments, personal and investment property, pension funds and any cash deposits, etc. the client may have. The firm should, where relevant, also gather information about conditions, terms, access, loans, guarantees and other restrictions, if applicable, to the above assets that may exist.
• the client’s regular financial commitments, which would include what financial
  commitments the client has made or is planning to make (client’s debits, total amount of indebtedness and other periodic commitments, etc.).

38. In determining the information to be collected, firms should also take into account the
    nature of the service to be provided. Practically, this means that:

• when investment advice is to be provided, firms should collect sufficient information
  in order to be able to assess the ability of the client to understand the risks and nature of each of the financial instruments that the firm envisages recommending to that client;
• when portfolio management is to be provided, as investment decisions are to be
  made by the firm on behalf of the client, the level of knowledge and experience needed by the client with regard to all the financial instruments that can potentially make up the portfolio may be less detailed than the level that the client should have when an investment advice service is to be provided. Nevertheless, even in such situations, the client should at least understand the overall risks of the portfolio and possess a general understanding of the risks linked to each type of financial instrument that can be included in the portfolio. Firms should gain a very clear understanding and knowledge of the investment profile of the client.

39. Similarly, the extent of the service requested by the client may also impact the level of
    detail of information collected about the client. For example, firms should collect more information about clients asking for investment advice covering their entire financial portfolio than about clients asking for specific advice on how to invest a given amount of money that represents a relatively small part of their overall portfolio.
40. Firms should also take into account the nature of the client when determining the
    information to be collected. For example, more in-depth information would usually need to be collected for potentially vulnerable clients (such as older clients could be) or inexperienced ones asking for investment advice or portfolio management services for

the first time. Where a firm provides investment advice or portfolio management services to a professional client (who has been correctly classified as such), it is entitled to assume that the client has the necessary level of experience and knowledge, and therefore is not required to obtain information on these aspects.
41. Similarly, where the investment service consists of the provision of investment advice to
a ‘per se professional client’18 the firm is entitled to assume that the client is able to financially bear any related investment risks consistent with the investment objectives of that client and therefore is not generally required to obtain information on the financial situation of the client. Such information should be obtained, however, where the client’s investment objectives demand it. For example, where the client is seeking to hedge a risk, the firm will need to have detailed information on that risk in order to be able to propose an effective hedging instrument.
42. Information to be collected will also depend on the needs and circumstances of the client.
For example, a firm is likely to need more detailed information about the client’s financial situation where the client’s investment objectives are multiple and/or long-term, than when the client seeks a short-term secure investment. 19
43. Information about a client’s financial situation includes information regarding his
investments. This implies that firms are expected to possess information about the client’s financial investments he holds with the firm on an instrument-by-instrument basis. Depending on the scope of advice provided, firms should also encourage clients to disclose details on financial investments they hold with other firms, if possible also on an instrument-by-instrument basis. Reliability of client information Relevant legislation: Article 25(2) of MiFID II, and Articles 54(7), first subparagraph of the MiFID II Delegated Regulation. General guideline 4
44. Firms should take reasonable steps and have appropriate tools to ensure that the
information collected about their clients is reliable and consistent, without unduly relying on clients’ self-assessment. Supporting guidelines
45. Clients are expected to provide correct, up-to-date and complete information necessary
for the suitability assessment. However, firms need to take reasonable steps to check the reliability, accuracy and consistency of information collected about clients20. Firms 18 As set out in Section I of Annex II of MiFID II (‘Categories of client who are considered to be professionals’). 19 There may be situations where the client is unwilling to disclose his full financial situation. For this particular question see Q&As on MiFID II investor protection topics (ESMA35-43-349) 20 When dealing with professional clients, firms should take into account the proportionality principles as referred to in guideline 3, in line with Article 54 (3) of MiFID II Delegated Regulation.

remain responsible for ensuring they have the necessary information to conduct a suitability assessment. In this respect, any agreement signed by the client, or disclosure made by the firm, that would aim at limiting the responsibility of the firm with regard to the suitability assessment, would not be considered compliant with the relevant requirements in MiFID II and related Delegated Regulation.
46. Self-assessment should be counterbalanced by objective criteria. For example:

• instead of asking whether a client understands the notions of risk-return trade-off
  and risk diversification, the firm should present some practical examples of situations that may occur in practice, for example by means of graphs or through positive and negative scenarios which are based on reasonable assumptions;
• Instead of asking whether a client has sufficient knowledge about the main
  characteristics and risks of specific types of investment products, the firm should for instance ask questions aimed at assessing the client’s real knowledge about the specific types of investment products, for example by asking the client multiple choice questions to which the client should provide the right answer;
• instead of asking a client whether he feels sufficiently experienced to invest in certain
  products, the firm should ask the client what types of products the client is familiar with and how recent and frequent his trading experience with them is;
• instead of asking whether clients believe they have sufficient funds to invest, the firm
  should ask clients to provide factual information about their financial situation, e.g. the regular source of income and whether outstanding liabilities exist (such as bank loans or other debts, which may significantly impact the assessment of the client’s ability to financially bear any risks and losses related to the investment);
• instead of asking whether a client feels comfortable with taking risk, the firm should
  ask what level of loss over a given time period the client would be willing to accept, either on the individual investment or on the overall portfolio.

47. In assessing a client’s knowledge and experience, a firm should also avoid using overly
    broad questions with a yes/no type of answer and or a very broad tick-the-box self￾assessment approach (for example, firms should avoid submitting a list of investment products to the client and asking him/her to indicate which products s/he understands). Where firms pre-fill answers based on the client’s transactions history with that firm (e.g., through another investment service), they should ensure that only fully objective, pertinent, and reliable information is used and that the client is given the opportunity to review and, if necessary, correct and/or complete each of the pre-filled answers to ensure the accuracy of any pre-populated information. Firms should also refrain from predicting clients’ experience based on assumptions.
48. When assessing the risk tolerance of their clients through a questionnaire, firms should
    not only investigate the desirable risk-return characteristics of future investments but they should also take into account the client’s risk perception. To this end, whilst self-

assessment for the risk tolerance should be avoided, explicit questions on the clients’ personal choices in case of risk uncertainty could be presented. Furthermore, firms could for example make use of graphs, specific percentages or concrete figures when asking the client how he would react when the value of his portfolio decreases.
49. Where firms rely on tools to be used by clients as part of the suitability process (such as
questionnaires or risk-profiling software), they should ensure that they have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results. For example, risk-profiling software could include some controls of coherence of the replies provided by clients in order to highlight contradictions between different pieces of information collected.
50. Firms should also take reasonable steps to mitigate potential risks associated with the
use of such tools. For example, potential risks may arise if clients were encouraged to provide certain answers in order to get access to financial instruments that may not be suitable for them (without correctly reflecting the clients’ real circumstances and needs)21.
51. In order to ensure the consistency of client information, firms should view the information
collected as a whole. Firms should be alert to any relevant contradictions between different pieces of information collected, and contact the client in order to resolve any material potential inconsistencies or inaccuracies. Examples of such contradictions are clients who have little knowledge or experience and an aggressive attitude to risk, or who have a prudent risk profile and ambitious investment objectives.
52. Firms should adopt mechanisms to address the risk that clients may tend to overestimate
their knowledge and experience, for example by including questions that would help firms assess the overall clients’ understanding about the characteristics and the risks of the different types of financial instruments. Such measures may be particularly important in the case of robo-advice, since the risk of overestimation by clients may result higher when they provide information through an automated (or semi-automated) system, especially in situations where very limited or no human interaction at all between clients and the firm’s employees is foreseen. 21 In this regard, see also paragraph 54 of Guideline 5, which addresses the risk of clients being influenced by firms to change answers previously provided by them, without there being any real modification in their situation.

Updating client information
Relevant legislation: Article 25(2) of MiFID II, subparagraph 2 of Article 54(7), and
Article 55(3) of the MiFID II Delegated Regulation.
General guideline 5
53. Where a firm has an ongoing relationship with the client (such as by providing ongoing
advice or portfolio management services), in order to be able to perform the suitability assessment, it should adopt procedures defining:
(a) what part of the client information collected should be subject to updating and at which frequency; (b) how the updating should be done and what action should be undertaken by the firm when additional or updated information is received or when the client fails to provide the information requested. Supporting guidelines
54. Firms should regularly review client information to ensure that it does not become
manifestly out of date, inaccurate or incomplete. To this end, firms should implement procedures to encourage clients to update the information originally provided where significant changes occur.
55. Frequency of update might vary depending on, for example, clients’ risk profiles and
taking into account the type of financial instrument recommended. Based on the information collected about a client under the suitability requirements, a firm will determine the client’s investment risk profile, i.e. what type of investment services or financial instruments can in general be suitable for him taking into account his knowledge and experience, his financial situation (including his ability to bear losses) and his investment objectives (including his risk tolerance). For example, a risk profile giving to the client access to a wider range of riskier products is an element that is likely to require more frequent updating. Certain events might also trigger an updating process; this could be so, for example, for clients reaching the age of retirement.
56. Updating could, for example, be carried out during periodic meetings with clients or by
sending an updating questionnaire to clients. Relevant actions might include changing the client’s profile based on the updated information collected.
57. With regard to the sustainability preferences of a client, this information should be
updated - for ongoing relationships – at the latest through the next regular update of client information following the entry-into-application of Commission Delegated Regulation 2021/1253. Clients should be provided the opportunity to have their profile updated immediately if they wish so. Where the client does not request the immediate update of its profile, and during the period preceding the acquisition from the firm of the information on the client’s sustainability preferences, the client will be considered as

“sustainability-neutral” and therefore, in line with paragraph 85, the client could be recommended products both with and without sustainability-related features".
58. It is also important that firms adopt measures to mitigate the risk of inducing the client to
update his own profile so as to make appear as suitable a certain investment product that would otherwise be unsuitable for him, without there being a real modification in the client’s situation22. As an example of a good practice to address this type of risk, firms could adopt procedures to verify, before or after transactions are made, whether a client’s profile has been updated too frequently or only after a short period from last modification (especially if this change has occurred in the immediate days preceding a recommended investment). Such situations would therefore be escalated or reported to the relevant control function. These policies and procedures are particularly important in situations where there is a heightened risk that the interest of the firm may come into conflict with the best interests of its clients, e.g. in self-placement situations or where the firm receives inducements for the distribution of a product. Another relevant factor to consider in this context is also the type of interaction that occurs with the client (e.g. face-to-face vs through an automated system) 23.
59. Firms should inform the client when the additional information provided results in a
change of his profile, whether it becomes more risky (and therefore, potentially, a wider range of riskier and more complex products may result suitable for him, with the potential to incur in higher losses) or vice-versa more conservative (and therefore, potentially, a more restricted range of products may as a result be suitable for him). Client information for legal entities or groups Relevant legislation: Article 25(2)of MiFID II and Article 54(6) of the MiFID II Delegated Regulation. General guideline 6
60. Firms must have a policy defining on an ex ante basis, how to conduct the suitability
assessment in situations where a client is a legal person or a group of two or more natural persons or where one or more natural persons are represented by another natural person. This policy should specify, for each of those situations, the procedure and criteria that should be followed in order to comply with the MiFID II suitability requirements. The firm should, clearly, inform ex-ante those of its clients that are legal entities, groups of persons or natural persons represented by another natural person about who should be subject to the suitability assessment, how the suitability assessment will be done in practice and the possible impact this could have for the relevant clients, in accordance with the existing policy. 22 Also relevant in this context are measures adopted to ensure the reliability of clients’ information as detailed under guideline 4, paragraph 44. 23 In this regard, also see the clarifications already provided by ESMA in the Q&As on MiFID II investor protection topics (Ref:
ESMA35-43-349 – Question on ‘Transactions on unsuitable products’).

Supporting guidelines
61. Firms should consider whether the applicable national legal framework provides specific
indications that should be taken into account for the purpose of conducting the suitability assessment (this could be the case, for instance, where the appointment of a legal representative is required by law: e.g. for underage or incapacitated persons or for a legal person).
62. The policy should make a clear distinction between situations where a representative is
foreseen under applicable national law, as it can be the case for example for legal persons, and situations where no representative is foreseen, and it should focus on this latter situations. Where the policy foresees agreements between clients, they should be made aware clearly and in written form about the effects that such agreements may have regarding the protection of their respective interests. Steps taken by the firm in accordance with its policy should be appropriately documented to enable ex-post controls. Situations where a representative is foreseen under applicable national law
63. Subparagraph 2 of Article 54(6) of the MiFID II Delegated Regulation defines how the
suitability assessment should be done with regard to situations where the client is a natural person represented by another natural person or is a legal person having requested treatment as a professional client. It seems reasonable that the same approach could apply to all legal persons, regardless of the fact that they may have requested to be treated as professionals or not.
64. Firms should ensure that their procedures adequately incorporate this article in their
organisation, which would imply amongst others that they verify that the representative is indeed – according to relevant national law – authorised to carry out transactions on behalf of the underlying client. Situations where no representative is foreseen under applicable national law
65. Where the client is a group of two or more natural persons and no representative is
foreseen under applicable national law, the firm’s policy should identify from whom necessary information will be collected and how the suitability assessment will be done. Clients should be properly informed about the firm’s approach (as decided in the firm’s policy) and the impact of this approach on the way the suitability assessment is done in practice.
66. Approaches such as the following could possibly be considered by firms:
(a) they could choose to invite the group of two or more natural persons to designate a representative; or, (b) they could consider collecting information about each individual client and assessing the suitability for each individual client.

Inviting the group of two or more natural persons to designate a representative
67. If the group of two or more natural persons agrees to designate a representative, the
same approach as the one described in subparagraph 2 of Article 54(6) of the MiFID II Delegated Regulation could be followed: the knowledge and experience shall be that of the representative, while the financial situation and the investment objectives would be those of the underlying client(s). Such designation should be made in written form as well as according to and in compliance with the applicable national law, and recorded by the relevant firm. The clients - part of the group - should be clearly informed, in written form, about the impact that an agreement amongst clients could have on the protection of their respective interests.
68. The firm’s policy could however require the underlying client(s) to agree on their
investment objectives.
69. If the parties involved have difficulties in deciding the person/s from whom the information
on knowledge and experience should be collected, the basis on which the financial situation should be determined for the purpose of the suitability assessment or on defining their investment objectives, the firm should adopt the most prudent approach by taking into account, accordingly, the information on the person with the least knowledge and experience, the weakest financial situation or the most conservative investment objectives. Alternatively, the firm’s policy may also specify that it will not be able to provide investment advice or portfolio management services in such a situation. Firms should at least be prudent whenever there is a significant difference in the level of knowledge and experience or in the financial situation of the different clients part of the group, or when the investment advice or portfolio management services may include leveraged financial instruments or contingent liability transactions that pose a risk of significant losses that could exceed the initial investment of the group of clients and should clearly document the approach chosen. Collecting information about each individual client and assessing the suitability for each individual client
70. When a firm decides to collect information and assess suitability for each individual client
part of the group, if there are significant differences between the characteristics of those
individual clients (for example, if the firm would classify them under different investment profiles), the question arises about how to ensure the consistency of the investment advice or portfolio management services provided with regard to the assets or portfolio of that group of clients. In such a situation, a financial instrument may be suitable for one client part of the group but not for another one. The firm’s policy should clearly specify how it will deal with such situations. Here again, the firm should adopt the most prudent approach by taking into account the information on the client part of the group with the least knowledge and experience, the weakest financial situation or the most conservative investment objectives. Alternatively, the firm’s policy may also specify that it will not be able to provide investment advice or portfolio management services in such a situation. In this context, it should be noted that collecting information on all the clients part of the group and considering, for the purposes of the assessment, an average profile of the

level of knowledge and competence of all of them, would unlikely be compliant with the MiFID II overarching principle of acting in the clients’ best interests. Arrangements necessary to understand investment products Relevant legislation: Articles 16(2) and 25(2) of MiFID II, and Article 54(9) of the MiFID II Delegated Regulation. General guideline 7
71. Firms should ensure that the policies and procedures implemented to understand the
characteristics, nature and features (including costs and risks) of investment products allow them to recommend suitable investments, or invest into suitable products on behalf of their clients. Supporting guidelines
72. Firms should adopt robust and objective procedures, methodologies and tools that allow
them to appropriately consider the different characteristics, including sustainability factors, and relevant risk factors (such as credit risk, market risk, liquidity risk24, …) of each investment product they may recommend or invest in on behalf of clients. This should include taking into consideration the firm’s analysis conducted for the purposes of product governance obligations25. In this context, firms should carefully assess how certain products could behave under certain circumstances (e.g. convertible bonds or other debt instruments subject to the Bank Recovery and Resolution Directive26 which may, for example, change their nature into shares). Considering the level of ‘complexity’ of products is particularly important, and this should be matched with a client’s information (in particular regarding their knowledge and experience). Although complexity is a relative term, which depends on several factors, firms should also take into account the criteria and principles identified in MiFID II, when defining and appropriately graduating the level of complexity to be attributed to products for the purposes of the assessment of suitability.
73. When considering the sustainability factors of products in view of the subsequent
matching with the client’s sustainability preferences, firms could, for example, rank and group the financial instruments included in the range of products they offer in terms of: i) the proportion invested in economic activities that qualify as environmentally sustainable (as defined in Article 2, point (1), of Taxonomy Regulation); ii) the proportion of sustainable investments (as defined in Article 2, point (17), of SFDR); iii) the 24 It is particularly important that the liquidity risk identified is not balanced out with other risk indicators (such as, for example, those adopted for the assessment of credit/counterparty risk and market risk). This is because the liquidity features of products should be compared with information on the client’s willingness to hold the investment for a certain length of time, i.e. the so called ‘holding period’. 25 In particular, MiFID II requires firms (under subparagraph 2 of Article 24(2)) to ‘understand the financial instruments they offer or recommend’ in order to be able to comply with their obligation to ensure the compatibility between products offered or recommended and the related target market of end clients. 26 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 190–348).

consideration of principal adverse impacts and other environmental, social and governance sustainability features. Such grouping should also be consistent with the firm’s analysis conducted for the purposes of product governance obligations. Firms are reminded that a grouping of financial instruments for the purpose of the suitability assessment cannot replace the collection of information from clients as described in paragraphs 26 and 27 above.
74. Firms should adopt procedures to ensure that the information used to understand and
correctly classify investment products included in their product offer is reliable, accurate, consistent and up-to-date. When adopting such procedures, firms should take into account the different characteristics and nature of the products considered (for example, more complex products with particular features may require more detailed processes and firms should not solely relying on one data provider in order to understand and classify investment products but should check and challenge such data or compare data provided by multiple sources of information).
75. In addition, firms should review the information used so as to be able to reflect any
relevant changes that may impact the product’s classification. This is particularly important, taking into account the continuing evolution and growing speed of financial markets. I.III MATCHING CLIENTS WITH SUITABLE PRODUCTS Arrangements necessary to ensure the suitability of an investment Relevant legislation: Article 16(2) and 25(2) of MiFID II and Article 21 of the MiFID II Delegated Regulation. General guideline 8
76. In order to match clients with suitable investments, firms should establish policies and
procedures to ensure that they consistently take into account:

• all available information about the client necessary to assess whether an investment
  is suitable, including the client’s current portfolio of investments (and asset allocation within that portfolio);
• all material characteristics of the investments considered in the suitability
  assessment, including all relevant risks and any direct or indirect costs to the client.27 27 See Articles 50 and 51 of MiFID II Delegated Regulation regarding the obligation to inform clients about costs.

Supporting guidelines
77. Firms are reminded that the suitability assessment is not limited to recommendations to
buy a financial instrument. Every recommendation must be suitable, whether it is, for example, a recommendation to buy, hold or sell an instrument, or not to do so28.
78. Firms that rely on tools in the suitability assessment process (such as model portfolios,
asset allocation software or a risk-profiling tool for potential investments), should have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results.
79. In this regard, the tools should be designed so that they take account of all the relevant
specificities of each client or investment product. For example, tools that classify clients or investment products broadly would not be fit for purpose.
80. A firm should establish policies and procedures which enable it to ensure inter alia that:

• the advice and portfolio management services provided to the client take account of
  an appropriate degree of risk diversification;
• the client has an adequate understanding of the relationship between risk and return,
  i.e. of the necessarily low remuneration of risk free assets, of the incidence of time horizon on this relationship and of the impact of costs on his investments;
• the financial situation of the client can finance the investments and the client can
  bear any possible losses resulting from the investments;
• any personal recommendation or transaction entered into in the course of providing
  an investment advice or portfolio management service, where an illiquid product is involved, takes into account the length of time for which the client is prepared to hold the investment; and
• any conflicts of interest are prevented from adversely affecting the quality of the
  suitability assessment.

81. Sustainability preferences should only be addressed once the suitability has been
    assessed in accordance with the criteria of knowledge and experience, financial situation and other investment objectives. Once the range of suitable products has been identified following this assessment, in a second step the product or, with regard to portfolio management or investment advice with a portfolio approach, an investment strategy that fulfils the client’s sustainability preferences should be identified.
82. Where a firm intends to recommend a product that does not meet the initial sustainability
    preferences of the client in the context of investment advice as referred to in Recital 8 of 28 See recital 87 of MiFID II Delegated Regulation as well as paragraph 31 of section IV of CESR, Understanding the definition of advice under MiFID, question and answers, 19 April 2010, CESR/10-293.

Commission Delegated Regulation 2021/1253, it can only do so once the client has adapted his/her sustainability preferences. The firm’s explanation regarding the reason to resort to such possibility as well as the client’s decision should be documented in the suitability report. Firms are reminded that this possibility only refers to the sustainability preferences and that with regard to the other criteria of the suitability assessment, the product has to meet the client profile and otherwise shall not be recommended as stated in Article 54(10) of the MiFID II Delegated Regulation.
83. Where a client adapts the sustainability preferences, this adaption should only refer to
the investment advice in question and not to the client’s profile in general. In case of investment advice, the adaptation should also be documented in the suitability report and be subject to the regular monitoring procedures. After the client has expressed the intention to adapt its preferences, and not before, the firm could disclose to the client information about its offering of products with sustainability features.
84. In case of portfolio management, the client’s sustainability preferences, including the
minimum proportion that shall be invested in investments with sustainability features, need to be collected and assessed when agreeing on the mandate and the investment strategy. If the firm cannot meet those preferences, it should discuss this with the client when agreeing on the mandate in which the investment strategy is defined and ask the client if he/she would like to adapt his/her preferences. The decision of the client should be recorded in the mandate. When providing investment advice with a portfolio approach, firms should assess the client’s sustainability preferences including the minimum proportion when conducting the initial suitability assessment. Then the firm should monitor whether those preferences are still met or not at portfolio level and issue appropriate recommendations as the case may be. In case of portfolio management or investment advice with a portfolio approach, if the client adapts the sustainability preferences after the initial suitability assessment, firms should evaluate the impact of this change and whether this triggers a rebalancing of the portfolio.
85. Where a client does not answer the question whether it has sustainability preferences or
answers “no”, the firm may consider this client as “sustainability-neutral” and recommend products both with and without sustainability-related features.
86. When making a decision on the methodology to be adopted to conduct the suitability
assessment, the firm should also take into account the type and characteristics of the services provided and, more in general, its business model. For example, where a firm manages a portfolio or advises a client with regard to his portfolio, it should adopt a methodology that would allow it to conduct a suitability assessment based on the consideration of the client’s portfolio as a whole.
87. When conducting a suitability assessment, a firm providing the service of portfolio
management should, on the one hand, assess - in accordance with the second bullet

point of paragraph 38 of these guidelines - the knowledge and experience of the client regarding each type of financial instrument that could be included in his portfolio, and the types of risks involved in the management of his portfolio. Depending on the level of complexity of the financial instruments involved, the firm should assess the client’s knowledge and experience more specifically than solely on the basis of the type to which the instrument belongs (e.g. subordinated debt instead of bonds in general). On the other hand, with regard to the client’s financial situation and investment objectives, the suitability assessment about the impact of the instrument(s) and transaction(s) can be done at the level of the client’s portfolio as a whole. In practice, if the portfolio management agreement defines in sufficient details the investment strategy that is suitable for the client with regard to the suitability criteria defined by MiFID II and that will be followed by the firm, the assessment of the suitability of the investment decisions could be done against the investment strategy as defined in the portfolio management agreement and the portfolio of the client as a whole should reflect this agreed investment strategy. When a firm conducts a suitability assessment based on the consideration of the client’s portfolio as a whole within the service of investment advice, this means that, on the one hand, the level of knowledge and experience of the client should be assessed regarding each investment product and risks involved in the related transaction. On the other hand, with regard to the client’s financial situation and investment objectives, the suitability assessment about the impact of the product and transaction can be done at the level of the client’s portfolio.
88. When a firm conducts a suitability assessment based on the consideration of the client’s
portfolio as a whole it could assess suitability as regards the sustainability preferences, for example, by applying those preferences (including the minimum proportion that shall be invested in investments with sustainability features29) on average at the level of the portfolio as a whole or at the level of the part/percentage of the portfolio the client wants to be invested in products with sustainability features30.
89. When a firm conducts a suitability assessment based on the consideration of the client’s
portfolio as a whole, it should ensure an appropriate degree of diversification within the client’s portfolio, taking into account the client’s portfolio exposure to the different financial risks (geographical exposure, currency exposure, asset class exposure, etc.). In cases where, for example, from the firm’s perspective, the size of a client’s portfolio is too small to allow for an effective diversification in terms of credit risk, the firm could consider directing those clients towards types of investments that are ‘secured’ or per se diversified (such as, for example, a diversified investment fund). Firms should be especially prudent regarding credit risk: exposure of the client’s portfolio to one single issuer or to issuers part of the same group should be particularly considered. This is because, if a client’s portfolio is concentrated in products issued by 29 See paragraph 26 of the guidelines. 30 See paragraph 29 of the guidelines.

one single entity (or entities of the same group), in case of default of that entity, the client may lose up to his entire investment. When operating through so called self-placement models, firms are reminded of ESMA’s 2016 Statement on BRRD31 according to which “they should avoid an excessive concentration of investments in financial instruments subject to the resolution regime issued by the firm itself or by entities of the same group”. Therefore, in addition to the methodologies to be implemented for the assessment of products credit risk (see guideline 7), firms should also adopt ad hoc measures and procedures to ensure that concentration with regard to credit risk is effectively identified, controlled and mitigated (for example, the identification of ex ante thresholds could be encompassed)32.
90. In order to ensure the consistency of the suitability assessment conducted through
automated tools (even if the interaction with clients does not occur through automated systems), firms should regularly monitor and test the algorithms that underpin the suitability of the transactions recommended or undertaken on behalf of clients. When defining such algorithms, firms should take into account the nature and characteristics of the products included in their offer to clients. In particular, firms should at least:

• establish an appropriate system-design documentation that clearly sets out the
  purpose, scope and design of the algorithms. Decision trees or decision rules should form part of this documentation, where relevant;

• have a documented test strategy that explains the scope of testing of algorithms.
  This should include test plans, test cases, test results, defect resolution (if relevant), and final test results;

• have in place appropriate policies and procedures for managing any changes to an
  algorithm, including monitoring and keeping records of any such changes. This includes having security arrangements in place to monitor and prevent unauthorised access to the algorithm;

• review and update algorithms to ensure that they reflect any relevant changes (e.g.
  market changes and changes in the applicable law) that may affect their effectiveness;

• have in place policies and procedures enabling to detect any error within the
  algorithm and deal with it appropriately, including, for example, suspending the provision of advice if that error is likely to result in an unsuitable advice and/or a breach of relevant law/regulation; 31 See ‘MiFID practices for firms selling financial instruments subject to the BRRD resolution regime’ (ESMA/2016/902). 32 To this end, in line with the mentioned ESMA’s Statement, firms should also take into account the specific features of the securities offered (including their risk features and the circumstances of the issuer) as well as clients’ financial situation, including their ability to bear losses, and their investment objectives, including their risk profile.

• have in place adequate resources, including human and technological resources, to
  monitor and supervise the performance of algorithms through an adequate and timely review of the advice provided; and

• have in place an appropriate internal sign-off process to ensure that the steps above
  have been followed.
  Costs and complexity of equivalent products
  Relevant legislation: Article 25(2) of MiFID II and Article 54(9) of the MiFID II Delegated Regulation. General guideline 9

91. Suitability policies and procedures should ensure that, before a firm makes a decision
    on the investment product(s) that will be recommended, or invested in the portfolio managed on behalf of the client, a thorough assessment of the possible investment alternatives is undertaken, taking into account products’ cost and complexity. Supporting guidelines
92. Firms should have a process in place, taking into account the nature of the service, the
    business model and the kind of products that are provided, to assess products available that are ‘equivalent’ to each other in terms of ability to meet the client’s needs and circumstances, such as financial instruments with similar target markets and similar risk￾return profile.
93. When considering the cost factor, firms should take into account all costs and charges
    covered by the relevant provisions under Article 24(4) of MiFID II and the related MiFID II Delegated Regulation provisions. As for the complexity, firms should refer to the criteria identified in the above guideline 7. For firms with a restricted range of products, or those recommending one type of product, where the assessment of ‘equivalent’ products could be limited, it is important that clients are made fully aware of such circumstances. In this context, it is particularly important that clients are provided appropriate information on how restricted the range of products offered is, pursuant to Article 24(4)(a)(ii) of MiFID II33.
94. Where a firm uses common portfolio strategies or model investment propositions that
    apply to different clients with the same investment profile (as determined by the firm), the assessment of cost and complexity for 'equivalent’ products could be done on a higher level, centrally, (for example within an investment committee or any other committee defining common portfolio strategies or model investment propositions) although a firm 33 In accordance with MiFID II, firms are therefore not expected to consider the whole universe of possible investment options existing in the market in order to comply with the requirement under Article 54(9) of MiFID II Delegated Regulation.

will still need to ensure that the selected investment products are suitable and meet their clients’ profile on a client-by-client basis.
95. Firms should be able to justify those situations where a more costly or complex product
is chosen or recommended over an equivalent product, taking into account that for the selection process of products in the context of investment advice or portfolio management further criteria can also be considered (for example: the portfolio’s diversification, liquidity, or risk level). Firms should document and keep records about these decisions, as these decisions should deserve specific attention from control functions within the firm. The respective documentation should be subject to internal reviews. When providing investment advice firms could, for specific well-defined reasons, also decide to inform the client about the decision to choose the more costly and complex financial instrument. Costs and benefits of switching investments Relevant legislation: Articles 16(2) and 25(2) of MiFID II and Article 54(11) and (12) of the MiFID II Delegated Regulation. General guideline 10
96. Firms should have adequate policies and procedures in place to ensure that an analysis
of the costs and benefits of a switch is undertaken such that firms are reasonably able to demonstrate that the expected benefits of switching are greater than the costs. Firms should also establish appropriate controls to avoid any circumvention of the relevant MiFID II requirements. Supporting guidelines
97. For the purpose of this guideline, investment decisions such as rebalancing a portfolio
under management, in the case of a “passive strategy” to replicate an index (as agreed with the client) would normally not be considered as a switch. For the avoidance of doubt, any transaction without maintaining these thresholds would be considered as a switch. For per se professional clients, the cost benefit analysis may be carried out on investment strategy level.
98. Firms should take all necessary information into account, so as to be able to conduct a
cost-benefit analysis of the switch, i.e. an assessment of the advantages and disadvantages of the new investment(s) considered. When considering the cost dimension, firms should take into account all costs and charges covered by the relevant provisions under Article 24(4) of MiFID II and the related MiFID II Delegated Regulation provisions. In this context, both monetary and non-monetary factors of costs and benefits could be relevant. These may include, for example:

• the expected net return of the proposed alternative transaction (which also considers
  any possible up-front cost to be paid by the client(s)) vs the expected net return of

the existing investment (that should also consider any exit cost which the client(s) might incur to divest from the product already in his/their portfolio);

• a change in the client’s circumstances and needs, which may be the reason for
  considering the switch, e.g. the need for liquidity in the short term as a consequence of an unexpected and unplanned family event;
• a change in the products’ features and/or market circumstances, which may be a
  reason for considering a switch in the client(s) portfolio(s), e.g. if a product becomes illiquid due to market trends;
• benefits to the client’s portfolio stemming from the switch, such as (i) an increase in
  the portfolio diversification (by geographical area, type of instrument, type of issuer, etc.); (ii) an increased alignment of the portfolio’s risk profile with the client’s risk objectives; (iii) an increase in the portfolio’s liquidity; or (iv) a decrease of the overall credit risk of the portfolio;

99. When providing investment advice, a clear explanation of whether or not the benefits of
    the recommended switch are greater than its costs should be included in the suitability report the firm has to provide to the retail client before the transaction is made.

100. Firms should also adopt systems and controls to monitor the risk of circumventing the
     obligation to assess costs and benefits of recommended switch, for example in situations where an advice to sell a product is followed by an advice to buy another product at a later stage (e.g. days later), but the two transactions were in fact strictly related from the beginning.

101. Where a firm uses common portfolio strategies or model investment propositions that
     apply to different clients with the same investment profile (as determined by the firm), the costs/benefits analysis of a switch could be done on a higher level than at the level of each individual client or each individual transaction. More especially, when a switch is decided centrally, for example within an investment committee or any other committee defining common portfolio strategies or model investment propositions, the costs/benefits analysis could be done at the level of that committee. If such a switch is decided centrally, the costs/benefits analysis done at that level would usually be applicable to all comparable client portfolios without making an assessment for each individual client. In such a situation also, the firm could determine, at the level of the relevant committee, the reason why a switch decided will not be performed for certain clients. Although the costs/benefits analysis could be done at a higher level in such situations, the firm should nevertheless have appropriate controls in place to check that there are no particular characteristics of certain clients that might require a more discrete level of analysis.

102. Where a portfolio manager has agreed a more bespoke mandate and investment
     strategy with a client due to the client’s specific investment needs, a cost-benefit analysis of the switch at client-level should be more appropriate, in contrast to the above.34

103. Notwithstanding the above, if a portfolio manager considers that the composition or
     parameters of a portfolio should be changed in a way that is not permitted by the mandate agreed with the client (e.g. from an equities-focused to a fixed income-focused strategy), the portfolio manager should discuss this with the client and review or conduct a new suitability assessment to agree a new mandate. I.IV OTHER RELATED REQUIREMENTS Qualifications of firm staff Relevant legislation: Articles 16(2), 25(1) and 25(9) of MiFID II and Article 21(1)(d) of MiFID II Delegated Regulation. General guideline 11

104. Firms are required to ensure that staff involved in material aspects of the suitability
     process have an adequate level of skills, knowledge and expertise.
     Supporting guidelines

105. Staff must understand the role they play in the suitability assessment process and
     possess the skills, knowledge and expertise necessary, including sufficient knowledge of the relevant regulatory requirements and procedures, to discharge their responsibilities.

106. Staff must possess the necessary knowledge and competence required under Article
     25(1) of MiFID II (and specified further in ESMA Guidelines for the assessment of knowledge and competence35), including with regard to the suitability assessment. Staff should also have the necessary knowledge and competence with regard to the criteria of the sustainability preferences as specified in Article 2(7) of the MiFID II Delegated Regulation and be able to explain to clients the different aspects in non-technical terms. To that effect, firms should give staff appropriate training.

107. Other staff that does not directly face clients but is involved in the suitability assessment
     in any other way must still possess the necessary skills, knowledge and expertise required depending on their particular role in the suitability process36. This may regard, for example, setting up the questionnaires, defining algorithms governing the 34 For relationships with professional clients see paragraph 89. 35 Ref: ESMA71-1154262120-153 EN (rev). ESMA/2015/1886 36 ESMA notes that some Member States require certification of staff providing investment advice and/or portfolio management, or equivalent systems, to ensure a proper level of knowledge and expertise of staff involved in material aspects of the suitability process.

assessment of suitability or other aspects necessary to conduct the suitability assessment and controlling compliance with the suitability requirements.
108. Where relevant, when employing automated tools (including hybrid tools), investment
firms should ensure that their staff involved in the activities related to the definition of these tools:
(a) have an appropriate understanding of the technology and algorithms used to provide digital advice (particularly they are able to understand the rationale, risks and rules behind the algorithms underpinning the digital advice); and (b) are able to understand and review the digital/automated advice generated by the algorithms. Record-keeping Relevant legislation: Articles 16(6), 25(5) and 25(6) of MiFID II, and Articles 72, 73, 74 and 75 of the MiFID II Delegated Regulation. General guideline 12
109. Firms should at least:
(a) maintain adequate recording and retention arrangements to ensure orderly and transparent record-keeping regarding the suitability assessment, including the collection of information from the client, any investment advice provided and all investments (and disinvestments) made following the suitability assessment made, and the related suitability reports provided to the client; (b) ensure that record-keeping arrangements are designed to enable the detection of failures regarding the suitability assessment (such as mis-selling); (c) ensure that records kept, including the suitability reports provided to clients, are accessible for the relevant persons in the firm, and for competent authorities; (d) have adequate processes to mitigate any shortcomings or limitations of the record￾keeping arrangements. Supporting guidelines
110. Record-keeping arrangements adopted by firms must be designed to enable firms to
track ex-post why an (dis)investment was made and why an investment advice was given even when the advice didn’t result in an actual (dis)investment. This could be important in the event of a dispute between a client and the firm. It is also important for control purposes - for example, any failures in record-keeping may hamper a competent authority’s assessment of the quality of a firm’s suitability process, and may weaken the ability of management to identify risks of mis-selling.

111. Therefore, a firm is required to record all relevant information about the suitability
     assessment, such as information about the client (including how that information is used and interpreted to define the client’s risk profile), and information about financial instruments recommended to the client or purchased on the client’s behalf, as well as the suitability report provided to clients. Those records should include:

• any changes made by the firm regarding the suitability assessment, in particular any
  change to the client’s investment risk profile;
• the types of financial instruments that fit that profile and the rationale for such an
  assessment, as well as any changes and the reasons for them;
• the situations where a client’s sustainability preferences are adapted in accordance
  with Article 54(10) of the MiFID II Delegated Regulation, including a clear explanation of the reasons for such adaptation.

112. Firms should understand the additional risks that could affect the provision of investment
     services through online/digital tools such as malicious cyber activity and should have in place arrangements able to mitigate those risks.37 37 Firms should consider such risks not only in relation to the provisions stated in the guideline, but also as part of a firm’s wider obligations under Article 16(4) of MiFID II to take reasonable steps to ensure continuity and regularity in the performance of investment service and activities, and corresponding delegated act requirements linked to this.

CIRCULAR CSSF 23/835
/
Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1 - direction@cssf.lu www.cssf.lu