Suitability report: what it must contain and what to keep

A suitability report under the FCA Handbook specifies the advice given and how it meets the client's preferences, objectives and other characteristics, and the firm must hand it over before the transaction is concluded. COBS 9A.3.3R, last updated by the FCA on 23 October 2025, asks the report to outline how the recommendation fits the investment term, the client's knowledge and experience, and their attitude to risk and capacity for loss. The same rule asks the firm to say whether the recommendation is likely to need a periodic review, and to draw the client's attention to it. For an insurance-based investment product, COBS 9A.3.3AR calls the document a suitability statement, and COBS 9A.3.2R(2)(b) adds the client's demands and needs. These rules transpose MiFID II and the Insurance Distribution Directive (IDD): the FCA notes under COBS 9A.3 cite article 25(6) of MiFID and articles 20 and 30 of the IDD.

When the firm provides a service with periodic suitability assessments, COBS 9A.3.3R(4) lets reports after the first one cover only what changed in the services, the instruments or the client's circumstances.

For every recommendation to a retail client, COBS 9A.4.2AR asks a MiFID firm to keep "the time and date on which the investment advice was provided", "the financial instrument that was recommended" and "the suitability report provided to the client". You can keep each item as a field or a file on the client's record. The rule, in its wording of 23 October 2025, also asks for a record of compliance with COBS 9A.2 and 9A.3 "in respect of each assessment of suitability it undertakes". It adds a record that the firm told each client whether a periodic assessment will follow. For insurance-based investment products, COBS 9A.4.4R adds the result of the assessment and "any change to the client's risk tolerance" (COBS 9A.4).

The minimum time a firm keeps suitability records depends on the business the advice falls under.

In a CRM, each client needs one record that holds the facts behind the advice, the reports that prove it and the next review date. In Standards, the compliance officer declares those fields on the client object, and the advisers then record each piece of advice and each review date against them.

Standards builds the list of clients whose review date has passed as a view filtered on review dates before today, and recalculates it each time someone opens it (a view filtered on a date). The report pack holds the files on the client record, and each file carries the properties you declare, such as a kind and a date (a pack of files with its own properties).

Each time a colleague or an agent changes a client record, Standards keeps the author, the date and the previous value, which is how a firm shows a change of risk tolerance after the fact. Agents in Standards read the PDFs and scans filed on a record and carry their details into its fields. In Manual mode, the agent asks for your approval before each change to your data. In Auto, the default mode, it makes changes without asking and the history keeps each previous value. By default, in both modes, a deletion waits for a person's approval, and an email an agent sends always does, whoever it is addressed to. Roles set, object by object, whether a person reads, edits or also deletes, so a paraplanner given a custom role can read every advice record while only advisers may change one (roles and permissions).

The wealth advisers page shows the same client record across the rest of an advice firm's work, and the guide to centralising client data shows how to gather that record in one place.

A firm that provides a periodic suitability assessment must review the suitability of its recommendations at least once a year, under COBS 9A.3.9R for MiFID business and COBS 9A.3.10R for insurance-based investment products. The same rules ask for more frequent reviews where the client's risk profile or the type of instrument recommended calls for it, so one client can carry a six-month cycle while another stays annual. COBS 9A.3.8R obliges the firm to disclose "the frequency and extent of the periodic suitability assessment and where relevant, the conditions that trigger that assessment". COBS 9A.3.6R asks it to tell the client, in good time before the advice, whether a periodic assessment will follow. Between reviews, COBS 9A.2.10R asks a firm with an ongoing relationship to keep "adequate and up-to-date information about that client".

In Standards, the frequency and the next review date are two fields on the client record. A routine can run each Monday on a schedule (routine triggers), find the clients whose review falls due within the month, and put the client's adviser in the client's "review owner" field, which notifies the person it names. Once the review is done, the adviser empties the field and moves the review date, so the next cycle notifies her again.

In Standards, a fictional eight-adviser firm in Leeds keeps each suitability report on the client's record. When an adviser recommends a stocks and shares ISA, she creates an advice record with the date, the time and the product, then files the signed suitability report in the pack. The report says an annual review applies, so she sets the next review date a year out. Eleven months later, the Monday routine puts her name in the client's review owner field, which notifies her; if nobody acts, the client joins the overdue list the day after the date passes. At the review the client says they now accept less risk. The adviser changes the risk tolerance field, empties the review owner field and moves the review date a year on; the history keeps each previous value with her name and the date. For MiFID business such as this ISA, SYSC 9.1.2-AR, on the medium records are kept in, asks that the contents of a record before any amendment can be easily ascertained.