The MiFID II suitability assessment, explained

A MiFID II suitability assessment is the process a firm must complete before giving investment advice or managing a portfolio. The firm collects information about the client’s knowledge and experience, financial situation and investment objectives, then recommends only products and services that suit that client. The obligation sits in Article 25(2) of MiFID II and is detailed in Articles 54 and 55 of Delegated Regulation (EU) 2017/565. ESMA’s guidelines on suitability (ESMA35-43-3172, applicable since 3 October 2023) set out how supervisors expect firms to do it.

When the suitability assessment applies

The suitability assessment applies to two investment services:

• Investment advice, meaning a personal recommendation to a client about transactions in financial instruments, whether on request or at the firm’s initiative.
• Portfolio management, meaning managing a client’s portfolio on a discretionary basis under a mandate.

It applies whether the advice is given face to face, over the phone or through an automated (“robo-advice”) tool. Using an online tool does not reduce the firm’s responsibility for the assessment.

For services that don’t involve advice or discretionary management, such as executing orders or receiving and transmitting them, the lighter appropriateness test applies instead.

What the firm must find out

Article 25(2) requires three categories of information. Article 54 of the Delegated Regulation then says the firm must have a reasonable basis to conclude that a specific recommendation or portfolio decision:

1. meets the client’s investment objectives, including their risk tolerance and any sustainability preferences;
2. is such that the client is financially able to bear any related investment risks, consistent with those objectives; and
3. is such that the client has the necessary knowledge and experience to understand the risks involved.

Knowledge and experience

Article 55 lists what this covers. It includes the types of service, transaction and financial instrument the client is familiar with, and the nature, volume and frequency of their past transactions and the period over which they were made. It also includes the client’s level of education and profession, or relevant former profession. Firms must not discourage clients from providing this information.

Financial situation, including ability to bear losses

Article 54(4) lists the source and extent of the client’s regular income, their assets (including liquid assets, investments and real property) and their regular financial commitments. The ability to bear losses has to be assessed separately. It is a different question from how much risk the client says they are willing to take.

Investment objectives, including risk tolerance

Article 54(5) lists the length of time the client wants to hold the investment, their preferences about risk-taking, their risk profile and the purposes of the investment. Since August 2022 it also includes their sustainability preferences, which have their own guide.

Making sure the information is reliable

Firms are entitled to rely on what clients tell them, unless they know or ought to know it is manifestly out of date, inaccurate or incomplete. Article 54(7) and the ESMA guidelines still expect firms to take active steps to make the information reliable:

• Explain why you are asking. Tell the client what the assessment is for and that it is in their interest to answer accurately and completely.
• Avoid self-assessment. Don’t ask “Do you understand bonds?”. Ask questions that test understanding, such as how a bond’s price moves when interest rates rise.
• Design questions carefully. Avoid leading questions, jargon and pre-selected answers, and don’t make it obvious which answer unlocks a product.
• Check for consistency. Flag contradictions, such as a short investment horizon combined with an objective of long-term growth, or a stated high risk tolerance alongside a wish never to see a loss.
• Watch for repeated attempts. If a client keeps changing answers until they reach a particular outcome, the firm should notice and act on it.
• Validate your tools. Risk-profiling questionnaires and scoring methodologies must be fit for purpose and regularly reviewed.

Keeping client information up to date

Where there is an ongoing relationship, as in portfolio management or ongoing advice, firms need policies to keep client information adequate and up to date. Where the firm has told the client it will assess suitability periodically, it must do so at least annually (Article 54(13)). It should do so more often for higher-risk profiles or more complex instruments.

Every update should be stored alongside the previous version. A supervisor may ask which risk profile applied on the date of a specific recommendation, and “the current one” is not an acceptable answer.

Matching clients to products

Knowing the client is only half the assessment. Firms also need to understand the products they recommend (know your product), including their costs, complexity and risks. They then need a robust process to match the two. In particular:

• When a firm considers equivalent products, it must take cost and complexity into account and be able to justify recommending a costlier or more complex option.
• When advice involves switching from one investment to another, the firm must collect information about the client’s existing investments and the recommended new ones. It must then analyse the expected costs and benefits of the switch (Article 54(11)), so it can show the benefits outweigh the costs.
• If none of the firm’s products or services is suitable, it must not recommend anything and must not trade for the client.

Clients that are companies, groups or represented persons

When the client is a legal entity, a group of two or more people, or someone represented by another person, the firm needs a documented policy on whose information it uses. Usually that means the representative’s knowledge and experience, and the underlying client’s financial situation and objectives. Article 54(6) and the ESMA guidelines cover this. Joint accounts and family-office structures make this a common source of findings.

Common supervisory findings

ESMA’s common supervisory actions and national supervisors repeatedly find the same weaknesses:

• Questionnaires that rely on self-assessment and can’t evidence real understanding.
• Scoring models that offset ability to bear losses against risk tolerance.
• No consistency checks, so contradictory answers go unnoticed.
• Client profiles that are years out of date for clients in ongoing relationships.
• Switching recommendations with no documented cost-benefit analysis.
• No record of which version of a questionnaire the client completed.

How Tervan handles the suitability assessment

Tervan ships a MiFID II baseline question set covering every category above. Your compliance team can adapt it without a software release. Each question can carry scoring and branching rules that compliance reads and approves before publishing. Every published version is frozen, so each answer is stored with the exact wording the client saw.

Answers are saved as the client goes, whether the advisor leads the meeting or the client answers ahead on their phone. They feed straight into the statement of suitability, and into the audit trail that record-keeping requires.

Frequently asked questions

When is a MiFID II suitability assessment required?

Whenever a firm provides investment advice or portfolio management. For other services, such as executing or transmitting orders, the lighter appropriateness test applies instead, unless the execution-only exemption is available.

What information must a suitability questionnaire collect?

Information about the client's knowledge and experience, their financial situation including their ability to bear losses, and their investment objectives including risk tolerance and sustainability preferences. The extent of information depends on the client, the service and the products involved.

Can a client self-assess their knowledge and risk tolerance?

Not on its own. ESMA's guidelines say firms should not rely unduly on self-assessment and should use questions that test what the client actually knows and how they actually behave, with checks for inconsistent answers.

How often must the suitability assessment be updated?

Firms with an ongoing relationship need policies to keep client information adequate and up to date. Where a firm has told the client it will assess suitability periodically, it must do so at least annually.

Does the suitability assessment apply to professional clients?

Yes, with some simplifications. A firm may assume a professional client has the knowledge and experience for the products and services for which they are classified as professional, and, for per se professional clients receiving advice, that they can bear the related investment risks.

This guide is general information about EU rules, not legal advice. National implementation and your regulator's guidance can add requirements. Check the primary sources linked above before relying on it.