Guidelines on certain aspects of the MiFID II suitability requirements

06/11/2018 | ESMA35-43-1163 Guidelines on certain aspects of the MiFID II suitability requirements

2 Table of Contents I. Scope............................................................................................................................. 3 II. Definitions ...................................................................................................................... 3 III. Purpose ...................................................................................................................... 4 IV. Compliance and reporting obligations ......................................................................... 5 V. Guidelines on certain aspects of the MiFID II suitability requirements ............................ 5

3 Scope Who?

1. These guidelines apply to: a. Competent Authorities and b. Firms What?
2. These guidelines apply in relation to the provision of the following investment services listed in Section A of Annex I of Directive 2014/65/EU1 (MiFID II): a. investment advice; b. portfolio management.
3. These guidelines principally address situations where services are provided to retail clients. They should also apply, to the extent they are relevant, when services are provided to professional clients, taking into account the provisions under Article 54(3) of the Commission Delegated Regulation (EU) 2017/5652 (MiFID II Delegated Regulation) and Annex II of MiFID II. When?
4. These guidelines apply as from 60 calendar days after the reporting requirement date referred to in paragraph 13. The previous ESMA guidelines issued under MiFID I3 will cease to apply on the same date. Definitions
5. Unless otherwise specified, terms used in MiFID II and the MiFID II Delegated Regulation have the same meaning in these guidelines.
6. In addition, for the purposes of these guidelines, the following definitions apply:

1 Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.06.2014, p. 349). 2 Commission Delegated Regulation (EU) of 25 April 2016 supplementing Directive 2014/65/EU of the European Parliament and of the Council as regards organisational requirements and operating conditions for investment firms and defined terms for the purposes of that Directive (OJ L 87, 31.03.2017, p.1-83). 3 ESMA/2012/387 - Guidelines on certain aspects of the MiFID suitability requirements.

4  ‘investment product’ means a financial instrument (within the meaning of Article 4(1)(15) of MiFID II) or a structured deposit (within the meaning of Article 4(1)(43) of MiFID II).  ‘firms’ mean firms subject to the requirements set out in paragraph 1 and include investment firms (as defined in Article 4(1)(1) of MiFID II), including credit institutions when providing investment services and activities (within the meaning of Article 4(1)(2) of MiFID II), investment firms and credit institutions (when selling or advising clients in relation to structured deposits), UCITS management companies and external Alternative Investment Fund Managers (AIFMs) (as defined in Article 5(1)(a) of the AIFMD 4 ) when providing the investment services of individual portfolio management or non-core services (within the meaning of Article 6(3)(a) and (b) of the UCITS Directive5 and Article 6(4)(a) and (b) of the AIFMD);  ‘suitability assessment’ means the whole process of collecting information about a client and the subsequent assessment by the firm that a given investment product is suitable for him, based also on the firm’s solid understanding of the products that it can recommend or invest into on behalf of the client.  ‘robo-advice’ means the provision of investment advice or portfolio management services (in whole or in part) through an automated or semi-automated system used as a client-facing tool. 7. These guidelines apply in full to all firms providing the services of investment advice and portfolio management, irrespective of the means of interaction with clients. The application of some guidelines is considered particularly relevant where firms provide ‘robo-advice’ (as defined above for the purposes of these guidelines), due to the limited interaction (or none at all) between clients and firms’ personnel. This is specifically pointed out in the text where relevant. 8. Guidelines do not reflect absolute obligations. For this reason, the word ‘should’ is often used. However, the words ‘shall’, ‘must’ or ‘required to’ are used when describing a MiFID II requirement. Purpose 9. The purpose of these guidelines is to clarify the application of certain aspects of the MiFID II suitability requirements in order to ensure the common, uniform and consistent

4 Directive 2011/61/EU of the European Parliament and of the Council of 8 June 2011 on Alternative Investment Fund Managers and amending Directives 2003/41/EC and 2009/65/EC and Regulations (EC) No 1060/2009 and (EU) No 1095/2010 (OJ L 174, 01.07.2011, p.1-73). 5 Directive 2009/65/EC of the European Parliament and of the Council of 13 July 2009 on the coordination of laws, regulations and administrative provisions relating to undertakings for collective investment in transferable securities (UCITS) (OJ L 302, 17.11.2009, p. 32).

5 application of Article 25(2) of MiFID II and of Articles 54 and 55 of the MiFID II Delegated Regulation. 10. ESMA expects these guidelines to promote greater convergence in the interpretation of, and supervisory approaches to, the MiFID II suitability requirements, by emphasising a number of important issues, and thereby enhancing the value of existing standards. By helping to ensure that firms comply with regulatory standards, ESMA anticipates a corresponding strengthening of investor protection. Compliance and reporting obligations Status of the guidelines 11. This document contains guidelines issued under Article 16 of the ESMA Regulation.6 In accordance with Article 16(3) of the ESMA Regulation, competent authorities and financial market participants shall make every effort to comply with guidelines. 12. Competent authorities to whom these guidelines apply should comply by incorporating them into their national legal and/or supervisory frameworks as appropriate, including where particular guidelines are directed primarily at financial market participants. In this case, competent authorities should ensure through their supervision that financial market participants comply with the guidelines. Reporting requirements 13. Competent authorities to which these guidelines apply must notify ESMA whether they comply or intend to comply with the guidelines as appropriate, stating their reasons for non-compliance where they do not comply or do not intend to comply, within two months of the date of publication of the guidelines on ESMA’s website in all official languages of the EU. 14. Firms are not required to report whether they comply with these guidelines. Guidelines on certain aspects of the MiFID II suitability requirements I.I INFORMATION TO CLIENTS ABOUT THE PURPOSE OF THE SUITABILITY ASSESSMENT Relevant legislation: Article 24(1), 24(4) and 24(5) of MiFID II and Article 54(1), of the MiFID II Delegated Regulation. General guideline 1

6 Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC.

6 15. Firms should inform their clients clearly and simply about the suitability assessment and its purpose which is to enable the firm to act in the client’s best interest. This should include a clear explanation that it is the firm’s responsibility to conduct the assessment, so that clients understand the reason why they are asked to provide certain information and the importance that such information is up-to-date, accurate and complete. Such information may be provided in a standardised format. Supporting guidelines 16. Information about the suitability assessment should help clients understand the purpose of the requirements. It should encourage them to provide accurate and sufficient information about their knowledge, experience, financial situation (including their ability to bear losses), and investment objectives (including their risk tolerance). Firms should highlight to their clients that it is important to gather complete and accurate information so that the firm can recommend suitable products or services for the client. Without this information, firms cannot provide investment advice and portfolio management services to clients. 17. It is up to the firms to decide how they will inform their clients about the suitability assessment. The format used should however enable controls to check if the information was provided. 18.Firms should avoid stating, or giving the impression, that it is the client who decides on the suitability of the investment, or that it is the client who establishes which financial instruments fit his own risk profile. For example, firms should avoid indicating to the client that a certain financial instrument is the one that the client chose as being suitable, or requiring the client to confirm that an instrument or service is suitable. 19. Any disclaimers (or other similar types of statements) aimed at limiting the firm’s responsibility for the suitability assessment would not in any way impact the characterisation of the service provided in practice to clients nor the assessment of the firm’s compliance to the corresponding requirements. For example, when collecting clients’ information required to conduct a suitability assessment (such as their investment horizon/holding period or information related to risk tolerance), firms should not claim that they do not assess the suitability. 20. In order to address potential gaps in clients’ understanding of the services provided through robo-advice, firms should inform clients, in addition to other required information, on the following:  a very clear explanation of the exact degree and extent of human involvement and if and how the client can ask for human interaction;  an explanation that the answers clients provide will have a direct impact in determining the suitability of the investment decisions recommended or undertaken on their behalf;

7  a description of the sources of information used to generate an investment advice or to provide the portfolio management service (e.g., if an online questionnaire is used, firms should explain that the responses to the questionnaire may be the sole basis for the robo-advice or whether the firm has access to other client information or accounts);  an explanation of how and when the client’s information will be updated with regard to his situation, personal circumstances, etc. 21. Provided that all the information and reports given to clients shall comply with the relevant provisions (including obligations on the provision of information in durable medium), firms should also carefully consider whether their written disclosures are designed to be effective (e.g., the disclosures are made available directly to clients and are not hidden or incomprehensible). For firms providing robo-advice this may in particular include:  Emphasising the relevant information (e.g., through the use of design features such as pop-up boxes);  Considering whether some information should be accompanied by interactive text (e.g., through the use of design features such as tooltips) or other means to provide additional details to clients who are seeking further information (e.g., through F.A.Q. section). I.II KNOW YOUR CLIENT AND KNOW YOUR PRODUCT Arrangements necessary to understand clients Relevant legislation: Articles 16(2) and 25(2) of MiFID II, and Articles 54(2) to 54(5) and Article 55 of the MiFID II Delegated Regulation. General guideline 2 22. Firms must establish, implement and maintain adequate policies and procedures (including appropriate tools) to enable them to understand the essential facts and characteristics about their clients. Firms should ensure that the assessment of information collected about their clients is done in a consistent way irrespective of the means used to collect such information. Supporting guidelines 23. Firms’ policies and procedures shall enable them to collect and assess all information necessary to conduct a suitability assessment for each client, while taking into account the elements developed in guideline 3. 24. For example firms could use questionnaires (also in a digital format) completed by their clients or information collected during discussions with them. Firms should ensure that

8 the questions they ask their clients are likely to be understood correctly and that any other method used to collect information is designed to get the information required for a suitability assessment. 25. When designing the questionnaires aiming at collecting information about their clients for the purpose of a suitability assessment firms should be aware and consider the most common reasons why investors could fail to answer questionnaires correctly. In particular:  Attention should be given to the clarity, exhaustiveness and comprehensibility of the questionnaire, avoiding misleading, confusing, imprecise and excessively technical language;  The layout should be carefully elaborated and should avoid orienting investors’ choices (font, line spacing…);  Presenting questions in batteries (collecting information on a series of items through a single question, particularly when assessing knowledge and experience and the risk tolerance) should be avoided.  Firms should carefully consider the order in which they ask questions in order to collect information in an effective manner;  In order to be able to ensure necessary information is collected, the possibility not to reply should generally not be available in questionnaires (particularly when collecting information on the investor’s financial situation). 26. Firms should also take reasonable steps to assess the client’s understanding of investment risk as well as the relationship between risk and return on investments, as this is key to enable firms to act in accordance with the client’s best interest when conducting the suitability assessment. When presenting questions in this regard, firms should explain clearly and simply that the purpose of answering them is to help assess clients’ attitude to risk (risk profile), and therefore the types of financial instruments (and risks attached to them) that are suitable for them. 27. Information necessary to conduct a suitability assessment includes different elements that may affect, for example, the analysis of the client’s financial situation (including his ability to bear losses) or investment objectives (including his risk tolerance). Examples of such elements are the client’s:  marital status (especially the client’s legal capacity to commit assets that may belong also to his partner);  family situation (changes in the family situation of a client may impact his financial situation e.g. a new child or a child of an age to start university);

9  age (which is mostly important to ensure a correct assessment of the investment objectives, and in particular the level of financial risk that the investor is willing to take, as well as the holding period/investment horizon, which indicates the willingness to hold an investment for a certain period of time);  employment situation (the degree of job security or that fact the client is close to retirement may impact his financial situation or his investment objectives);  need for liquidity in certain relevant investments or need to fund a future financial commitment (e.g. property purchase, education fees). 28. ESMA considers it would be a good practice for firms to consider non-financial elements when gathering information on the client’s investment objectives, and – beyond the elements listed in paragraph 27 – collect information on the client’s preferences on environmental, social and governance factors. 29. When determining what information is necessary, firms should keep in mind the impact that any significant change regarding that information could have concerning the suitability assessment. 30. Firms should take all reasonable steps to sufficiently assess the understanding by their clients of the main characteristics and the risks related to the product types in the offer of the firm. The adoption by firms of mechanisms to avoid self-assessment and ensure the consistency of the answers provided by the client7 is particularly important for the correct assessment of the client’s knowledge and experience. Information collected by firms about a client’s knowledge and experience should be considered altogether for the overall appraisal of his understanding of the products and of the risks involved in the transactions recommended or in the management of his portfolio. 31. It is also important that firms appraise the client’s understanding of basic financial notions such as investment risk (including concentration risk) and risk-return trade off. To this end, firms should consider using indicative, comprehensible examples of the levels of loss/return that may arise depending on the level of risk taken, and should assess the client’s response to such scenarios. 32. Firms should design their questionnaires so that they are able to gather the necessary information about their client. This may be particularly relevant for firms providing robo￾advice services given the limited human interaction. In order to ensure their compliance with the requirements concerning that assessment, firms should take into account factors such as:  Whether the information collected through the online questionnaire allows the firm to conclude that the advice provided is suitable for their clients on the basis of their

7 See guideline 4.

10 knowledge and experience, their financial situation and their investment objectives and needs;  Whether the questions in the questionnaire are sufficiently clear and/or whether the questionnaire is designed to provide additional clarification or examples to clients when necessary (e.g., through the use of design features, such as tool-tips or pop￾up boxes);  Whether some human interaction (including remote interaction via emails or mobile phones) is available to clients when responding to the online questionnaire;  Whether steps have been taken to address inconsistent client responses (such as incorporating in the questionnaire design features to alert clients when their responses appear internally inconsistent and suggest them to reconsider such responses; or implementing systems to automatically flag apparently inconsistent information provided by a client for review or follow-up by the firm). Extent of information to be collected from clients (proportionality) Relevant legislation: Article 25(2) of MiFID II, and Articles 54(2) to 54(5) and Article 55 of the MiFID II Delegated Regulation. General guideline 3 33. Before providing investment advice or portfolio management services, firms need to collect all ‘necessary information’8 about the client’s knowledge and experience, financial situation and investment objectives. The extent of ‘necessary’ information may vary and has to take into account the features of the investment advice or portfolio management services to be provided, the type and characteristics of the investment products to be considered and the characteristics of the clients. Supporting guidelines 34. In determining what information is ‘necessary’ firms should consider, in relation to a client’s knowledge and experience, financial situation and investment objectives:  the type of the financial instrument or transaction that the firm may recommend or enter into (including the complexity and level of risk);  the nature and extent of the service that the firm may provide;  the needs and circumstances of the client;

8 ‘Necessary information’ should be understood as meaning the information that firms must collect to comply with the suitability requirements under MiFID II.

11  the type of client. 35. While the extent of the information to be collected may vary, the standard for ensuring that a recommendation or an investment made on the client’s behalf is suitable for the client will always remain the same. MiFID allows firms to collect the level of information proportionate to the products and services they offer, or on which the client requests specific investment advice or portfolio management services. It does not allow firms to lower the level of protection due to clients. 36. For example, when providing access to complex9 or risky10 financial instruments, firms should carefully consider whether they need to collect more in-depth information about the client than they would collect when less complex or risky instruments are at stake. This is so that firms can assess the client’s capacity to understand, and financially bear, the risks associated with such instruments.11 For such complex products ESMA expects firms to carry out a robust assessment amongst others of the client’s knowledge and experience, including, for example, his ability to understand the mechanisms which make the investment product “complex”, whether the client has already traded in such products (for example, derivatives or leverage products), the length of time he has been trading them for, etc. 37. For illiquid financial instruments12, the ‘necessary information’ to be gathered will include information on the length of time for which the client is prepared to hold the investment. As information about a client’s financial situation will always need to be collected, the extent of information to be collected may depend on the type of financial instruments to be recommended or entered into. For example, for illiquid or risky financial instruments, ‘necessary information’ to be collected may include all of the following elements as necessary to ensure whether the client’s financial situation allows him to invest or be invested in such instruments:  the extent of the client’s regular income and total income, whether the income is earned on a permanent or temporary basis, and the source of this income (for example, from employment, retirement income, investment income, rental yields, etc.);  the client’s assets, including liquid assets, investments and real property, which would include what financial investments, personal and investment property, pension funds and any cash deposits, etc. the client may have. The firm should,

9 As defined in MiFID II and taking into account the criteria identified in guideline 7. 10 It is up to each firm to define a priori the level of risk of the financial instruments included in its offer to investors taking into account, where available, possible guidelines issued by competent authorities supervising the firm. 11 In any case, to ensure clients understand the investment risk and potential losses they may bear, the firm should, as far as possible, present these risks in a clear and understandable way, potentially using illustrative examples of the extent of losses in the event of an investment performing poorly. 12 It is up to each firm to define a priori which of the financial instruments included in its offer to investors it considers as being illiquid, taking into account, where available, possible guidelines issued by competent authorities supervising the firm.

12 where relevant, also gather information about conditions, terms, access, loans, guarantees and other restrictions, if applicable, to the above assets that may exist.  the client’s regular financial commitments, which would include what financial commitments the client has made or is planning to make (client’s debits, total amount of indebtedness and other periodic commitments, etc.). 38. In determining the information to be collected, firms should also take into account the nature of the service to be provided. Practically, this means that:  when investment advice is to be provided, firms should collect sufficient information in order to be able to assess the ability of the client to understand the risks and nature of each of the financial instruments that the firm envisages recommending to that client;  when portfolio management is to be provided, as investment decisions are to be made by the firm on behalf of the client, the level of knowledge and experience needed by the client with regard to all the financial instruments that can potentially make up the portfolio may be less detailed than the level that the client should have when an investment advice service is to be provided. Nevertheless, even in such situations, the client should at least understand the overall risks of the portfolio and possess a general understanding of the risks linked to each type of financial instrument that can be included in the portfolio. Firms should gain a very clear understanding and knowledge of the investment profile of the client. 39. Similarly, the extent of the service requested by the client may also impact the level of detail of information collected about the client. For example, firms should collect more information about clients asking for investment advice covering their entire financial portfolio than about clients asking for specific advice on how to invest a given amount of money that represents a relatively small part of their overall portfolio. 40. Firms should also take into account the nature of the client when determining the information to be collected. For example, more in-depth information would usually need to be collected for potentially vulnerable clients (such as older clients could be) or inexperienced ones asking for investment advice or portfolio management services for the first time. Where a firm provides investment advice or portfolio management services to a professional client (who has been correctly classified as such), it is entitled to assume that the client has the necessary level of experience and knowledge, and therefore is not required to obtain information on these aspects. 41. Similarly, where the investment service consists of the provision of investment advice to a ‘per se professional client’13 the firm is entitled to assume that the client is able to financially bear any related investment risks consistent with the investment objectives of

13 As set out in Section I of Annex II of MiFID II (‘Categories of client who are considered to be professionals’).

13 that client and therefore is not generally required to obtain information on the financial situation of the client. Such information should be obtained, however, where the client’s investment objectives demand it. For example, where the client is seeking to hedge a risk, the firm will need to have detailed information on that risk in order to be able to propose an effective hedging instrument. 42. Information to be collected will also depend on the needs and circumstances of the client. For example, a firm is likely to need more detailed information about the client’s financial situation where the client’s investment objectives are multiple and/or long-term, than when the client seeks a short-term secure investment. 14 43. Information about a client’s financial situation includes information regarding his investments. This implies that firms are expected to possess information about the client’s financial investments he holds with the firm on an instrument-by-instrument basis. Depending on the scope of advice provided, firms should also encourage clients to disclose details on financial investments they hold with other firms, if possible also on an instrument-by-instrument basis. Reliability of client information Relevant legislation: Article 25(2) of MiFID II, and Articles 54(7), first subparagraph of the MiFID II Delegated Regulation. General guideline 4 44. Firms should take reasonable steps and have appropriate tools to ensure that the information collected about their clients is reliable and consistent, without unduly relying on clients’ self-assessment. Supporting guidelines 45. Clients are expected to provide correct, up-to-date and complete information necessary for the suitability assessment. However, firms need to take reasonable steps to check the reliability, accuracy and consistency of information collected about clients15. Firms remain responsible for ensuring they have the necessary information to conduct a suitability assessment. In this respect, any agreement signed by the client, or disclosure made by the firm, that would aim at limiting the responsibility of the firm with regard to the suitability assessment, would not be considered compliant with the relevant requirements in MiFID II and related Delegated Regulation. 46. Self-assessment should be counterbalanced by objective criteria. For example:

14 There may be situations where the client is unwilling to disclose his full financial situation. For this particular question see Q&As on MiFID II investor protection topics (ESMA35-43-349) 15 When dealing with professional clients, firms should take into account the proportionality principles as referred to in guideline 3, in line with Article 54 (3) of MiFID II Delegated Regulation.

14  instead of asking whether a client understands the notions of risk-return trade off and risk diversification, the firm could present some practical examples of situations that may occur in practice, for example by means of graphs or through positive and negative scenarios;  instead of asking a client whether he feels sufficiently experienced to invest in certain products, the firm could ask the client what types of products the client is familiar with and how recent and frequent his trading experience with them is;  instead of asking whether clients believe they have sufficient funds to invest, the firm could ask clients to provide factual information about their financial situation, e.g. the regular source of income and whether outstanding liabilities exist (such as bank loans or other debts, which may significantly impact the assessment of the client’s ability to financially bear any risks and losses related to the investment);  instead of asking whether a client feels comfortable with taking risk, the firm could ask what level of loss over a given time period the client would be willing to accept, either on the individual investment or on the overall portfolio. 47. When assessing the risk tolerance of their clients through a questionnaire, firms should not only investigate the desirable risk-return characteristics of future investments but they should also take into account the client’s risk perception. To this end, whilst self￾assessment for the risk tolerance should be avoided, explicit questions on the clients’ personal choices in case of risk uncertainty could be presented. Furthermore, firms could for example make use of graphs, specific percentages or concrete figures when asking the client how he would react when the value of his portfolio decreases. 48. Where firms rely on tools to be used by clients as part of the suitability process (such as questionnaires or risk-profiling software), they should ensure that they have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results. For example, risk-profiling software could include some controls of coherence of the replies provided by clients in order to highlight contradictions between different pieces of information collected. 49. Firms should also take reasonable steps to mitigate potential risks associated with the use of such tools. For example, potential risks may arise if clients were encouraged to provide certain answers in order to get access to financial instruments that may not be suitable for them (without correctly reflecting the clients’ real circumstances and needs)16 . 50. In order to ensure the consistency of client information, firms should view the information collected as a whole. Firms should be alert to any relevant contradictions between different pieces of information collected, and contact the client in order to resolve any

16 In this regard, see also paragraph 54 of Guideline 5, which addresses the risk of clients being influenced by firms to change answers previously provided by them, without there being any real modification in their situation.

15 material potential inconsistencies or inaccuracies. Examples of such contradictions are clients who have little knowledge or experience and an aggressive attitude to risk, or who have a prudent risk profile and ambitious investment objectives. 51. Firms should adopt mechanisms to address the risk that clients may tend to overestimate their knowledge and experience, for example by including questions that would help firms assess the overall clients’ understanding about the characteristics and the risks of the different types of financial instruments. Such measures may be particularly important in the case of robo-advice, since the risk of overestimation by clients may result higher when they provide information through an automated (or semi-automated) system, especially in situations where very limited or no human interaction at all between clients and the firm’s employees is foreseen. Updating client information Relevant legislation: Article 25(2) of MiFID II, subparagraph 2 of Article 54(7), and Article 55(3) of the MiFID II Delegated Regulation. General guideline 5 52. Where a firm has an ongoing relationship with the client (such as by providing ongoing advice or portfolio management services), in order to be able to perform the suitability assessment, it should adopt procedures defining: (a) what part of the client information collected should be subject to updating and at which frequency; (b) how the updating should be done and what action should be undertaken by the firm when additional or updated information is received or when the client fails to provide the information requested. Supporting guidelines 53. Firms should regularly review client information to ensure that it does not become manifestly out of date, inaccurate or incomplete. To this end, firms should implement procedures to encourage clients to update the information originally provided where significant changes occur. 54. Frequency of update might vary depending on, for example, clients’ risk profiles and taking into account the type of financial instrument recommended. Based on the information collected about a client under the suitability requirements, a firm will determine the client’s investment risk profile, i.e. what type of investment services or financial instruments can in general be suitable for him taking into account his knowledge and experience, his financial situation (including his ability to bear losses) and his investment objectives (including his risk tolerance). For example, a risk profile giving to the client access to a wider range of riskier products is an element that is likely to require

16 more frequent updating. Certain events might also trigger an updating process; this could be so, for example, for clients reaching the age of retirement. 55. Updating could, for example, be carried out during periodic meetings with clients or by sending an updating questionnaire to clients. Relevant actions might include changing the client’s profile based on the updated information collected. 56. It is also important that firms adopt measures to mitigate the risk of inducing the client to update his own profile so as to make appear as suitable a certain investment product that would otherwise be unsuitable for him, without there being a real modification in the client’s situation17. As an example of a good practice to address this type of risk, firms could adopt procedures to verify, before or after transactions are made, whether a client’s profile has been updated too frequently or only after a short period from last modification (especially if this change has occurred in the immediate days preceding a recommended investment). Such situations would therefore be escalated or reported to the relevant control function. These policies and procedures are particularly important in situations where there is a heightened risk that the interest of the firm may come into conflict with the best interests of its clients, e.g. in self-placement situations or where the firm receives inducements for the distribution of a product. Another relevant factor to consider in this context is also the type of interaction that occurs with the client (e.g. face-to-face vs through an automated system) 18 . 57. Firms should inform the client when the additional information provided results in a change of his profile, whether it becomes more risky (and therefore, potentially, a wider range of riskier and more complex products may result suitable for him, with the potential to incur in higher losses) or vice-versa more conservative (and therefore, potentially, a more restricted range of products may as a result be suitable for him). Client information for legal entities or groups Relevant legislation: Article 25(2)of MiFID II and Article 54(6) of the MiFID II Delegated Regulation. General guideline 6 58. Firms must have a policy defining on an ex ante basis, how to conduct the suitability assessment in situations where a client is a legal person or a group of two or more natural persons or where one or more natural persons are represented by another natural person. This policy should specify, for each of those situations, the procedure and criteria that should be followed in order to comply with the MiFID II suitability requirements. The

17 Also relevant in this context are measures adopted to ensure the reliability of clients’ information as detailed under guideline 4, paragraph 44. 18 In this regard, also see the clarifications already provided by ESMA in the Q&As on MiFID II investor protection topics (Ref: ESMA35-43-349 – Question on ‘Transactions on unsuitable products’).

17 firm should, clearly, inform ex-ante those of its clients that are legal entities, groups of persons or natural persons represented by another natural person about who should be subject to the suitability assessment, how the suitability assessment will be done in practice and the possible impact this could have for the relevant clients, in accordance with the existing policy. Supporting guidelines 59. Firms should consider whether the applicable national legal framework provides specific indications that should be taken into account for the purpose of conducting the suitability assessment (this could be the case, for instance, where the appointment of a legal representative is required by law: e.g. for underage or incapacitated persons or for a legal person). 60. The policy should make a clear distinction between situations where a representative is foreseen under applicable national law, as it can be the case for example for legal persons, and situations where no representative is foreseen, and it should focus on this latter situations. Where the policy foresees agreements between clients, they should be made aware clearly and in written form about the effects that such agreements may have regarding the protection of their respective interests. Steps taken by the firm in accordance with its policy should be appropriately documented to enable ex-post controls. Situations where a representative is foreseen under applicable national law 61. Subparagraph 2 of Article 54(6) of the MiFID II Delegated Regulation defines how the suitability assessment should be done with regard to situations where the client is a natural person represented by another natural person or is a legal person having requested treatment as a professional client. It seems reasonable that the same approach could apply to all legal persons, regardless of the fact that they may have requested to be treated as professionals or not. 62. Firms should ensure that their procedures adequately incorporate this article in their organisation, which would imply amongst others that they verify that the representative is indeed – according to relevant national law – authorised to carry out transactions on behalf of the underlying client. Situations where no representative is foreseen under applicable national law 63. Where the client is a group of two or more natural persons and no representative is foreseen under applicable national law, the firm’s policy should identify from whom necessary information will be collected and how the suitability assessment will be done. Clients should be properly informed about the firm’s approach (as decided in the firm’s policy) and the impact of this approach on the way the suitability assessment is done in practice.

18 64. Approaches such as the following could possibly be considered by firms: (a) they could choose to invite the group of two or more natural persons to designate a representative; or, (b) they could consider collecting information about each individual client and assessing the suitability for each individual client. Inviting the group of two or more natural persons to designate a representative 65. If the group of two or more natural persons agrees to designate a representative, the same approach as the one described in subparagraph 2 of Article 54(6) of the MiFID II Delegated Regulation could be followed: the knowledge and experience shall be that of the representative, while the financial situation and the investment objectives would be those of the underlying client(s). Such designation should be made in written form as well as according to and in compliance with the applicable national law, and recorded by the relevant firm. The clients - part of the group - should be clearly informed, in written form, about the impact that an agreement amongst clients could have on the protection of their respective interests. 66. The firm’s policy could however require the underlying client(s) to agree on their investment objectives. 67. If the parties involved have difficulties in deciding the person/s from whom the information on knowledge and experience should be collected, the basis on which the financial situation should be determined for the purpose of the suitability assessment or on defining their investment objectives, the firm should adopt the most prudent approach by taking into account, accordingly, the information on the person with the least knowledge and experience, the weakest financial situation or the most conservative investment objectives. Alternatively, the firm’s policy may also specify that it will not be able to provide investment advice or portfolio management services in such a situation. Firms should at least be prudent whenever there is a significant difference in the level of knowledge and experience or in the financial situation of the different clients part of the group, or when the investment advice or portfolio management services may include leveraged financial instruments or contingent liability transactions that pose a risk of significant losses that could exceed the initial investment of the group of clients and should clearly document the approach chosen. Collecting information about each individual client and assessing the suitability for each individual client 68. When a firm decides to collect information and assess suitability for each individual client part of the group, if there are significant differences between the characteristics of those individual clients (for example, if the firm would classify them under different investment profiles), the question arises about how to ensure the consistency of the investment advice or portfolio management services provided with regard to the assets or portfolio

19 of that group of clients. In such a situation, a financial instrument may be suitable for one client part of the group but not for another one. The firm’s policy should clearly specify how it will deal with such situations. Here again, the firm should adopt the most prudent approach by taking into account the information on the client part of the group with the least knowledge and experience, the weakest financial situation or the most conservative investment objectives. Alternatively, the firm’s policy may also specify that it will not be able to provide investment advice or portfolio management services in such a situation. In this context, it should be noted that collecting information on all the clients part of the group and considering, for the purposes of the assessment, an average profile of the level of knowledge and competence of all of them, would unlikely be compliant with the MiFID II overarching principle of acting in the clients’ best interests. Arrangements necessary to understand investment products Relevant legislation: Articles 16(2) and 25(2) of MiFID II, and Article 54(9) of the MiFID II Delegated Regulation. General guideline 7 69. Firms should ensure that the policies and procedures implemented to understand the characteristics, nature and features (including costs and risks) of investment products allow them to recommend suitable investments, or invest into suitable products on behalf of their clients. Supporting guidelines 70. Firms should adopt robust and objective procedures, methodologies and tools that allow them to appropriately consider the different characteristics and relevant risk factors (such as credit risk, market risk, liquidity risk19, …) of each investment product they may recommend or invest in on behalf of clients. This should include taking into consideration the firm’s analysis conducted for the purposes of product governance obligations20. In this context, firms should carefully assess how certain products could behave under certain circumstances (e.g. convertible bonds or other debt instruments subject to the Bank Recovery and Resolution Directive21 which may, for example, change their nature into shares). 71. Considering the level of ‘complexity’ of products is particularly important, and this should be matched with a client’s information (in particular regarding their knowledge and

19 It is particularly important that the liquidity risk identified is not balanced out with other risk indicators (such as, for example, those adopted for the assessment of credit/counterparty risk and market risk). This is because the liquidity features of products should be compared with information on the client’s willingness to hold the investment for a certain length of time, i.e. the so called ‘holding period’. 20 In particular, MiFID II requires firms (under subparagraph 2 of Article 24(2)) to ‘understand the financial instruments they offer or recommend’ in order to be able to comply with their obligation to ensure the compatibility between products offered or recommended and the related target market of end clients. 21 Directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms and amending Council Directive 82/891/EEC, and Directives 2001/24/EC, 2002/47/EC, 2004/25/EC, 2005/56/EC, 2007/36/EC, 2011/35/EU, 2012/30/EU and 2013/36/EU, and Regulations (EU) No 1093/2010 and (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 190–348).

20 experience). Although complexity is a relative term, which depends on several factors, firms should also take into account the criteria and principles identified in MiFID II, when defining and appropriately graduating the level of complexity to be attributed to products for the purposes of the assessment of suitability. 72. Firms should adopt procedures to ensure that the information used to understand and correctly classify investment products included in their product offer is reliable, accurate, consistent and up-to-date. When adopting such procedures, firms should take into account the different characteristics and nature of the products considered (for example, more complex products with particular features may require more detailed processes and firms should not solely relying on one data provider in order to understand and classify investment products but should check and challenge such data or compare data provided by multiple sources of information). 73. In addition, firms should review the information used so as to be able to reflect any relevant changes that may impact the product’s classification. This is particularly important, taking into account the continuing evolution and growing speed of financial markets. I.I MATCHING CLIENTS WITH SUITABLE PRODUCTS Arrangements necessary to ensure the suitability of an investment Relevant legislation: Article 16(2) and 25(2) of MiFID II and Article 21 of the MiFID II Delegated Regulation. General guideline 8 74. In order to match clients with suitable investments, firms should establish policies and procedures to ensure that they consistently take into account:  all available information about the client necessary to assess whether an investment is suitable, including the client’s current portfolio of investments (and asset allocation within that portfolio);  all material characteristics of the investments considered in the suitability assessment, including all relevant risks and any direct or indirect costs to the client.22 Supporting guidelines

22 See Articles 50 and 51 of MiFID II Delegated Regulation regarding the obligation to inform clients about costs.

21 75. Firms are reminded that the suitability assessment is not limited to recommendations to buy a financial instrument. Every recommendation must be suitable, whether it is, for example, a recommendation to buy, hold or sell an instrument, or not to do so23 . 76. Firms that rely on tools in the suitability assessment process (such as model portfolios, asset allocation software or a risk-profiling tool for potential investments), should have appropriate systems and controls to ensure that the tools are fit for purpose and produce satisfactory results. 77. In this regard, the tools should be designed so that they take account of all the relevant specificities of each client or investment product. For example, tools that classify clients or investment products broadly would not be fit for purpose. 78. A firm should establish policies and procedures which enable it to ensure inter alia that:  the advice and portfolio management services provided to the client take account of an appropriate degree of risk diversification;  the client has an adequate understanding of the relationship between risk and return, i.e. of the necessarily low remuneration of risk free assets, of the incidence of time horizon on this relationship and of the impact of costs on his investments;  the financial situation of the client can finance the investments and the client can bear any possible losses resulting from the investments;  any personal recommendation or transaction entered into in the course of providing an investment advice or portfolio management service, where an illiquid product is involved, takes into account the length of time for which the client is prepared to hold the investment; and  any conflicts of interest are prevented from adversely affecting the quality of the suitability assessment. 79. When making a decision on the methodology to be adopted to conduct the suitability assessment, the firm should also take into account the type and characteristics of the services provided and, more in general, its business model. For example, where a firm manages a portfolio or advises a client with regard to his portfolio, it should adopt a methodology that would allow it to conduct a suitability assessment based on the consideration of the client’s portfolio as a whole. 80. When conducting a suitability assessment, a firm providing the service of portfolio management should, on the one hand, assess - in accordance with paragraph 38 of these guidelines - the knowledge and experience of the client regarding each type of

23 See recital 87 of MiFID II Delegated Regulation as well as paragraph 31 of section IV of CESR, Understanding the definition of advice under MiFID, question and answers, 19 April 2010, CESR/10-293.

22 financial instrument that could be included in his portfolio, and the types of risks involved in the management of his portfolio. Depending on the level of complexity of the financial instruments involved, the firm should assess the client’s knowledge and experience more specifically than solely on the basis of the type to which the instrument belongs (e.g. subordinated debt instead of bonds in general). On the other hand, with regard to the client’s financial situation and investment objectives, the suitability assessment about the impact of the instrument(s) and transaction(s) can be done at the level of the client’s portfolio as a whole. In practice, if the portfolio management agreement defines in sufficient details the investment strategy that is suitable for the client with regard to the suitability criteria defined by MiFID II and that will be followed by the firm, the assessment of the suitability of the investment decisions could be done against the investment strategy as defined in the portfolio management agreement and the portfolio of the client as a whole should reflect this agreed investment strategy. When a firm conducts a suitability assessment based on the consideration of the client’s portfolio as a whole within the service of investment advice, this means that, on the one hand, the level of knowledge and experience of the client should be assessed regarding each investment product and risks involved in the related transaction. On the other hand, with regard to the client’s financial situation and investment objectives, the suitability assessment about the impact of the product and transaction can be done at the level of the client’s portfolio. 81. When a firm conducts a suitability assessment based on the consideration of the client’s portfolio as a whole, it should ensure an appropriate degree of diversification within the client’s portfolio, taking into account the client’s portfolio exposure to the different financial risks (geographical exposure, currency exposure, asset class exposure, etc.). In cases where, for example, from the firm’s perspective, the size of a client’s portfolio is too small to allow for an effective diversification in terms of credit risk, the firm could consider directing those clients towards types of investments that are ‘secured’ or per se diversified (such as, for example, a diversified investment fund). Firms should be especially prudent regarding credit risk: exposure of the client’s portfolio to one single issuer or to issuers part of the same group should be particularly considered. This is because, if a client’s portfolio is concentrated in products issued by one single entity (or entities of the same group), in case of default of that entity, the client may lose up to his entire investment. When operating through so called self-placement models, firms are reminded of ESMA’s 2016 Statement on BRRD24 according to which “they should avoid an excessive concentration of investments in financial instruments subject to the resolution regime issued by the firm itself or by entities of the same group”. Therefore, in addition to the methodologies to be implemented for the assessment of products credit risk (see guideline 7), firms should also adopt ad hoc measures and procedures to ensure that concentration with regard to credit risk is effectively identified,

24 See ‘MiFID practices for firms selling financial instruments subject to the BRRD resolution regime’ (ESMA/2016/902).

23 controlled and mitigated (for example, the identification of ex ante thresholds could be encompassed)25 . 82. In order to ensure the consistency of the suitability assessment conducted through automated tools (even if the interaction with clients does not occur through automated systems), firms should regularly monitor and test the algorithms that underpin the suitability of the transactions recommended or undertaken on behalf of clients. When defining such algorithms, firms should take into account the nature and characteristics of the products included in their offer to clients. In particular, firms should at least:  establish an appropriate system-design documentation that clearly sets out the purpose, scope and design of the algorithms. Decision trees or decision rules should form part of this documentation, where relevant;  have a documented test strategy that explains the scope of testing of algorithms. This should include test plans, test cases, test results, defect resolution (if relevant), and final test results;  have in place appropriate policies and procedures for managing any changes to an algorithm, including monitoring and keeping records of any such changes. This includes having security arrangements in place to monitor and prevent unauthorised access to the algorithm;  review and update algorithms to ensure that they reflect any relevant changes (e.g. market changes and changes in the applicable law) that may affect their effectiveness;  have in place policies and procedures enabling to detect any error within the algorithm and deal with it appropriately, including, for example, suspending the provision of advice if that error is likely to result in an unsuitable advice and/or a breach of relevant law/regulation;  have in place adequate resources, including human and technological resources, to monitor and supervise the performance of algorithms through an adequate and timely review of the advice provided; and  have in place an appropriate internal sign-off process to ensure that the steps above have been followed. Costs and complexity of equivalent products

25 To this end, in line with the mentioned ESMA’s Statement, firms should also take into account the specific features of the securities offered (including their risk features and the circumstances of the issuer) as well as clients’ financial situation, including their ability to bear losses, and their investment objectives, including their risk profile.

24 Relevant legislation: Article 25(2) of MiFID II and Article 54(9) of the MiFID II Delegated Regulation. General guideline 9 83. Suitability policies and procedures should ensure that, before a firm makes a decision on the investment product(s) that will be recommended, or invested in the portfolio managed on behalf of the client, a thorough assessment of the possible investment alternatives is undertaken, taking into account products’ cost and complexity. Supporting guidelines 84. Firms should have a process in place, taking into account the nature of the service, the business model and the kind of products that are provided, to assess products available that are ‘equivalent’ to each other in terms of ability to meet the client’s needs and circumstances, such as financial instruments with similar target markets and similar risk￾return profile. 85. When considering the cost factor, firms should take into account all costs and charges covered by the relevant provisions under Article 24(4) of MiFID II and the related MiFID II Delegated Regulation provisions. As for the complexity, firms should refer to the criteria identified in the above guideline 7. For firms with a restricted range of products, or those recommending one type of product, where the assessment of ‘equivalent’ products could be limited, it is important that clients are made fully aware of such circumstances. In this context, it is particularly important that clients are provided appropriate information on how restricted the range of products offered is, pursuant to Article 24(4)(a)(ii) of MiFID II26 . 86. Where a firm uses common portfolio strategies or model investment propositions that apply to different clients with the same investment profile (as determined by the firm), the assessment of cost and complexity for 'equivalent’ products could be done on a higher level, centrally, (for example within an investment committee or any other committee defining common portfolio strategies or model investment propositions) although a firm will still need to ensure that the selected investment products are suitable and meet their clients’ profile on a client-by-client basis. 87. Firms should be able to justify those situations where a more costly or complex product is chosen or recommended over an equivalent product, taking into account that for the selection process of products in the context of investment advice or portfolio management further criteria can also be considered (for example: the portfolio’s diversification, liquidity, or risk level). Firms should document and keep records about these decisions, as these decisions should deserve specific attention from control functions within the firm. The respective documentation should be subject to internal

26 In accordance with MiFID II, firms are therefore not expected to consider the whole universe of possible investment options existing in the market in order to comply with the requirement under Article 54(9) of MiFID II Delegated Regulation.

25 reviews. When providing investment advice firms could, for specific well-defined reasons, also decide to inform the client about the decision to choose the more costly and complex financial instrument. Costs and benefits of switching investments Relevant legislation: Articles 16(2) and 25(2) of MiFID II and Article 54(11) of the MiFID II Delegated Regulation. General guideline 10 88. Firms should have adequate policies and procedures in place to ensure that an analysis of the costs and benefits of a switch is undertaken such that firms are reasonably able to demonstrate that the expected benefits of switching are greater than the costs. Firms should also establish appropriate controls to avoid any circumvention of the relevant MiFID II requirements. Supporting guidelines 89. For the purpose of this guideline, investment decisions such as rebalancing a portfolio under management, in the case of a “passive strategy” to replicate an index (as agreed with the client) would normally not be considered as a switch. For the avoidance of doubt, any transaction without maintaining these thresholds would be considered as a switch. For per se professional clients, the cost benefit analysis may be carried out on investment strategy level. 90. Firms should take all necessary information into account, so as to be able to conduct a cost-benefit analysis of the switch, i.e. an assessment of the advantages and disadvantages of the new investment(s) considered. When considering the cost dimension, firms should take into account all costs and charges covered by the relevant provisions under Article 24(4) of MiFID II and the related MiFID II Delegated Regulation provisions. In this context, both monetary and non-monetary factors of costs and benefits could be relevant. These may include, for example:  the expected net return of the proposed alternative transaction (which also considers any possible up-front cost to be paid by the client(s)) vs the expected net return of the existing investment (that should also consider any exit cost which the client(s) might incur to divest from the product already in his/their portfolio);  a change in the client’s circumstances and needs, which may be the reason for considering the switch, e.g. the need for liquidity in the short term as a consequence of an unexpected and unplanned family event;  a change in the products’ features and/or market circumstances, which may be a reason for considering a switch in the client(s) portfolio(s), e.g. if a product becomes illiquid due to market trends;

26  benefits to the client’s portfolio stemming from the switch, such as (i) an increase in the portfolio diversification (by geographical area, type of instrument, type of issuer, etc.); (ii) an increased alignment of the portfolio’s risk profile with the client’s risk objectives; (iii) an increase in the portfolio’s liquidity; or (iv) a decrease of the overall credit risk of the portfolio; 91. When providing investment advice, a clear explanation of the reasons why the benefits of the recommended switch are greater than its costs should be included in the suitability report the firm has to provide to the retail client before the transaction is made. 92. Firms should also adopt systems and controls to monitor the risk of circumventing the obligation to assess costs and benefits of recommended switch, for example in situations where an advice to sell a product is followed by an advice to buy another product at a later stage (e.g. days later), but the two transactions were in fact strictly related from the beginning. 93. Where a firm uses common portfolio strategies or model investment propositions that apply to different clients with the same investment profile (as determined by the firm), the costs/benefits analysis of a switch could be done on a higher level than at the level of each individual client or each individual transaction. More especially, when a switch is decided centrally, for example within an investment committee or any other committee defining common portfolio strategies or model investment propositions, the costs/benefits analysis could be done at the level of that committee. If such a switch is decided centrally, the costs/benefits analysis done at that level would usually be applicable to all comparable client portfolios without making an assessment for each individual client. In such a situation also, the firm could determine, at the level of the relevant committee, the reason why a switch decided will not be performed for certain clients. Although the costs/benefits analysis could be done at a higher level in such situations, the firm should nevertheless have appropriate controls in place to check that there are no particular characteristics of certain clients that might require a more discrete level of analysis. 94. Where a portfolio manager has agreed a more bespoke mandate and investment strategy with a client due to the client’s specific investment needs, a cost-benefit analysis of the switch at client-level should be more appropriate, in contrast to the above.27 95. Notwithstanding the above, if a portfolio manager considers that the composition or parameters of a portfolio should be changed in a way that is not permitted by the mandate agreed with the client (e.g. from an equities-focused to a fixed income-focused strategy), the portfolio manager should discuss this with the client and review or conduct a new suitability assessment to agree a new mandate. I.II OTHER RELATED REQUIREMENTS

27 For relationships with professional clients see paragraph 89.

27 Qualifications of firm staff Relevant legislation: Articles 16(2), 25(1) and 25(9) of MiFID II and Article 21(1)(d) of MiFID II Delegated Regulation. General guideline 11 96. Firms are required to ensure that staff involved in material aspects of the suitability process have an adequate level of skills, knowledge and expertise. Supporting guidelines 97. Staff must understand the role they play in the suitability assessment process and possess the skills, knowledge and expertise necessary, including sufficient knowledge of the relevant regulatory requirements and procedures, to discharge their responsibilities. 98. Staff giving investment advice or information about financial instruments, structured deposits, investment services or ancillary services to clients on behalf of the firm (including when providing portfolio management) must possess the necessary knowledge and competence required under Article 25(1) of MiFID II (and specified further in ESMA Guidelines for the assessment of knowledge and competence28), including with regard to the suitability assessment. 99. Other staff that does not directly face clients (and therefore is not subject to the new provisions mentioned in paragraph 97) but is involved in the suitability assessment in any other way must still possess the necessary skills, knowledge and expertise required depending on their particular role in the suitability process 29 . This may regard, for example, setting up the questionnaires, defining algorithms governing the assessment of suitability or other aspects necessary to conduct the suitability assessment and controlling compliance with the suitability requirements. 100. Where relevant, when employing automated tools (including hybrid tools), investment firms should ensure that their staff involved in the activities related to the definition of these tools: (a) have an appropriate understanding of the technology and algorithms used to provide digital advice (particularly they are able to understand the rationale, risks and rules behind the algorithms underpinning the digital advice); and

28 Ref: ESMA71-1154262120-153 EN (rev). ESMA/2015/1886 29 ESMA notes that some Member States require certification of staff providing investment advice and/or portfolio management, or equivalent systems, to ensure a proper level of knowledge and expertise of staff involved in material aspects of the suitability process.

28 (b) are able to understand and review the digital/automated advice generated by the algorithms. Record-keeping Relevant legislation: Articles 16(6), 25(5) and 25(6) of MiFID II, and Articles 72, 73, 74 and 75 of the MiFID II Delegated Regulation. General guideline 12 101. Firms should at least: (a) maintain adequate recording and retention arrangements to ensure orderly and transparent record-keeping regarding the suitability assessment, including the collection of information from the client, any investment advice provided and all investments (and disinvestments) made following the suitability assessment made, and the related suitability reports provided to the client; (b) ensure that record-keeping arrangements are designed to enable the detection of failures regarding the suitability assessment (such as mis-selling); (c) ensure that records kept, including the suitability reports provided to clients, are accessible for the relevant persons in the firm, and for competent authorities; (d) have adequate processes to mitigate any shortcomings or limitations of the record￾keeping arrangements. Supporting guidelines 102. Record-keeping arrangements adopted by firms must be designed to enable firms to track ex-post why an (dis)investment was made and why an investment advice was given even when the advice didn’t result in an actual (dis)investment. This could be important in the event of a dispute between a client and the firm. It is also important for control purposes - for example, any failures in record-keeping may hamper a competent authority’s assessment of the quality of a firm’s suitability process, and may weaken the ability of management to identify risks of mis-selling. 103. Therefore, a firm is required to record all relevant information about the suitability assessment, such as information about the client (including how that information is used and interpreted to define the client’s risk profile), and information about financial instruments recommended to the client or purchased on the client’s behalf, as well as the suitability report provided to clients. Those records should include:  any changes made by the firm regarding the suitability assessment, in particular any change to the client’s investment risk profile;

29  the types of financial instruments that fit that profile and the rationale for such an assessment, as well as any changes and the reasons for them. 104. Firms should understand the additional risks that could affect the provision of investment services through online/digital tools such as malicious cyber activity and should have in place arrangements able to mitigate those risks.30

30 Firms should consider such risks not only in relation to the provisions stated in the guideline, but also as part of a firm’s wider obligations under Article 16(4) of MiFID II to take reasonable steps to ensure continuity and regularity in the performance of investment service and activities, and corresponding delegated act requirements linked to this.