Entity

Suitability Assessment

The documented evaluation of whether a product or recommendation is appropriate for a specific client — containing client risk profile, investment objectives, product characteristics, rationale for suitability, and the compliance sign-off that demonstrates best interest was served.

Last updated: February 2026Data current as of: February 2026

Why This Object Matters for AI

AI cannot automate suitability checks or flag inappropriate recommendations without structured assessment data; without it, suitability is a paper exercise completed after the fact rather than a real-time guardrail.

Compliance & Regulatory Reporting Capacity Profile

Typical CMC levels for compliance & regulatory reporting in Financial Services organizations.

Formality
L3
Capture
L3
Structure
L3
Accessibility
L2
Maintenance
L3
Integration
L2

CMC Dimension Scenarios

What each CMC level looks like specifically for Suitability Assessment. Baseline level is highlighted.

L0

Suitability Assessments exist only in the heads of registered representatives. When a client asks why a particular product was recommended, the rep explains verbally. When a Reg BI examination asks for documented basis of recommendation, the branch manager discovers there is no written Suitability Assessment — just the rep's memory and a signed new account form.

None — AI cannot evaluate recommendation appropriateness because no formalized Suitability Assessment exists. There is no machine-readable record of client risk profile, investment objectives, or recommendation rationale.

Create any written Suitability Assessment record — even a standardized paper form that captures client risk tolerance, investment objectives, time horizon, and the rationale for the specific recommendation.

L1

Suitability Assessments are captured as free-text notes in the CRM system or on paper forms scanned to PDF. A rep types 'Client is moderate risk, recommended XYZ fund because it matches her goals' into a notes field. The Suitability Assessment record exists but lacks consistent structure — risk tolerance might be 'moderate,' 'medium,' '3 out of 5,' or 'not too aggressive' depending on who wrote it.

AI could potentially read Suitability Assessment notes, but cannot reliably extract client risk profile parameters, compare them against product characteristics, or validate recommendation logic due to inconsistent terminology.

Standardize the Suitability Assessment with a fixed template containing enumerated fields — risk tolerance scale, investment objective categories, time horizon ranges, liquidity needs, and a structured rationale section.

L2

Suitability Assessments follow a standardized template with consistent fields: client risk tolerance (1-5 scale), investment objective (growth/income/preservation/speculation), time horizon (short/medium/long), liquidity needs, concentration limits, and a structured rationale section. Reps complete the template for each recommendation. The Suitability Assessment is stored as a completed form in the client file, but product characteristics are referenced by name rather than linked to a product database.

AI can extract and compare Suitability Assessment fields across clients, identify patterns in recommendation rationale, and flag assessments where stated risk tolerance conflicts with stated objectives. Product-to-client matching requires manual lookup.

Move the Suitability Assessment from a document-based template to a structured database where each field — risk tolerance, objective, time horizon, product identifier, rationale — is stored as a discrete, queryable value linked to the product master.

L3Current Baseline

Suitability Assessments are stored as structured database records with discrete fields linked to the client master and product master. Each Suitability Assessment links the client's risk profile (formalized as structured attributes) to a specific product's characteristics (risk rating, fee structure, liquidity terms, minimum holding period). The recommendation rationale is captured in a structured format referencing specific Form CRS disclosure items and Reg BI best interest factors. A compliance query can return 'all Suitability Assessments where client risk tolerance is below 3 and the recommended product risk rating exceeds 7.'

AI can perform automated Reg BI suitability screening across all Suitability Assessment records, flag mismatches between client profiles and product risk characteristics, and generate exception reports for supervisory review.

Add formal entity relationships linking each Suitability Assessment to the client's full financial profile, account holdings, prior recommendations, complaint history, and the specific Form CRS and Reg BI disclosure records.

L4

The Suitability Assessment is a schema-driven compliance entity with explicit relationships to the client's complete financial profile — net worth, income, existing holdings, tax status, beneficiary designations — and the product's full characteristics from the product master. Each assessment carries machine-readable references to applicable Reg BI care obligation factors, Form CRS cost disclosures, and reasonably available alternatives that were considered and rejected. An AI agent can ask 'for this Suitability Assessment, what were the three lowest-cost alternatives and why were they not recommended?' and receive a structured, auditable answer.

AI can perform fully automated Reg BI best interest evaluations on each Suitability Assessment, including reasonably available alternatives analysis, cost comparison, and conflict of interest disclosure validation without human pre-screening.

Implement dynamic Suitability Assessment generation — assessments that auto-populate from live client profile data, real-time product characteristics, and current market conditions, requiring only rep validation and rationale.

L5

The Suitability Assessment is a living compliance document that auto-generates from real-time client profile data, current product characteristics, live market conditions, and updated regulatory requirements. When a client's risk profile changes due to a life event, all outstanding Suitability Assessments are re-evaluated automatically. When a product's risk rating changes, affected assessments are flagged. The assessment dynamically references current Reg BI interpretive guidance and SEC staff bulletins. Reps validate and add judgment-based rationale to a pre-populated, continuously current assessment rather than building one from scratch.

Fully autonomous suitability intelligence. AI can generate, validate, and monitor Suitability Assessments across the entire book of business, proactively identifying assessments that have become stale due to changed client circumstances, product characteristics, or regulatory requirements.

Ceiling of the CMC framework for this dimension.

Capabilities That Depend on Suitability Assessment

Other Objects in Compliance & Regulatory Reporting

Related business objects in the same function area.

Regulatory Requirement Register

Entity

The structured inventory of all applicable regulations and their requirements — containing regulation identifiers, jurisdictions, effective dates, compliance obligations, control mappings, and the change tracking that monitors regulatory updates and their impact on the organization.

Regulatory Report Definition

Entity

The specification for each required regulatory filing — containing report template, data field mappings, calculation rules, validation checks, filing frequency, submission deadlines, and the regulator contact information for questions or amendments.

Surveillance Alert

Entity

The structured record of each trade surveillance detection — containing the triggering pattern (spoofing, layering, insider trading), affected trades, implicated employees, investigation status, and the disposition outcome that determines escalation to regulators.

Employee Communications Archive

Entity

The retained repository of all business communications — emails, instant messages, voice recordings, and video transcripts with metadata, retention tags, legal hold status, and the search indices that enable surveillance and e-discovery.

Regulatory Exam Case

Entity

The tracking record for each regulatory examination — containing exam scope, document requests, response status, findings, remediation commitments, and the timeline that ensures all requests are addressed before deadlines.

Privacy Consent Record

Entity

The managed record of each client's privacy preferences and consents — containing consent type, grant/revoke dates, data usage purposes consented to, and the audit trail that demonstrates compliance with GDPR, CCPA, and other privacy regulations.

Compliance Risk Assessment

Decision

The periodic evaluation of compliance risks across business activities — assessing inherent risk, control effectiveness, residual risk, and the prioritization that determines where compliance resources should focus their monitoring and testing efforts.

What Can Your Organization Deploy?

Enter your context profile or request an assessment to see which capabilities your infrastructure supports.