# Suitability and risk disclosures

> Establish customer classification, appropriateness and suitability assessments, product governance, disclosure timing, consent evidence, and risk-based trading controls.

Disclosure tells a customer what a product does. Suitability determines whether a recommendation or
managed decision fits that customer. Appropriateness assesses whether a customer understands the risks
of a product they selected themselves. Do not collapse these distinct controls into one checkbox.

## Decision framework

| Service | Minimum control | Outcome |
| --- | --- | --- |
| Execution-only, plain product | Customer classification, product disclosure, knowledge/experience where required | allow, warn, or restrict |
| Complex or illiquid product | Appropriateness assessment and enhanced risk acknowledgement | allow, warn, or block under local rule |
| Personal recommendation | Full suitability assessment | documented recommendation or decline |
| Discretionary/managed service | Mandate, objectives, capacity for loss, portfolio suitability, ongoing review | approved strategy and limits |

<Callout type="info" title="Warning is not always permission">
  Some regimes permit an execution-only warning; others require the firm to block an unsuitable or
  inappropriate transaction. Configure the rule per product, service, customer class, and jurisdiction.
</Callout>

## Customer profile

Capture enough information to support the decision:

- Retail, professional, eligible counterparty, or locally applicable customer class.
- Investment objective, horizon, liquidity needs, and expected trade frequency.
- Income, assets, liabilities, emergency reserves, and capacity to bear loss.
- Knowledge and experience by instrument type, not a generic “experienced” flag.
- Risk tolerance, concentration, currency exposure, and tax constraints.
- Vulnerability, accessibility, language, and assisted-decision needs where applicable.

Reassess on material change and at a risk-based interval. A stale profile must not silently authorise a
new recommendation.

## Product governance

| Product factor | Example control |
| --- | --- |
| Complexity | Product taxonomy and knowledge test |
| Liquidity | Holding-period warning and exit constraints |
| Volatility / loss | Capacity-for-loss and concentration limits |
| Currency | Local-price and USD-wallet FX disclosure |
| Valuation | Delayed-data warning and `asOf` presentation |
| Settlement | Execution versus custody settlement timeline |
| Counterparty / issuer | Credit, custody, and insolvency risk disclosure |
| Private market | Eligibility, transfer restrictions, valuation uncertainty, and long lock-up |

## Disclosure stack

Present information when it can affect the decision, not only in a footer after submission:

1. **Before account opening:** service scope, entities, custody model, conflicts, fees, complaints, and data use.
2. **Before product access:** product risks, target market, eligibility, liquidity, currency, and loss scenarios.
3. **At quote:** delayed timestamp, estimated price, FX, fees, expiry, and non-guaranteed execution.
4. **Before order:** side, quantity/cash value, instrument, venue, order type, time in force, total estimate, and acknowledgement.
5. **After order:** immutable receipt, status, cancellation rules, execution confirmation, settlement, and final charges.

The quote is valid for 60 seconds, but its underlying price observation may be delayed. Display both
`quoteExpiresAt` and price `asOf`; they answer different questions.

## Evidence and controls

- Version every questionnaire, scoring rule, disclosure, translation, and product classification.
- Record inputs, result, warnings, overrides, approver, timestamp, and customer acknowledgement.
- Require reasoned approval for overrides and monitor override frequency by adviser/product.
- Keep marketing balanced with risks; do not imply guaranteed liquidity, returns, or capital protection.
- Test comprehension and accessibility on low-bandwidth mobile devices and supported languages.
- Monitor concentrations, repeated warnings, vulnerable customers, and sales outside the target market.

## Reference standards

- [IOSCO suitability requirements for complex financial products](https://www.iosco.org/library/pubdocs/pdf/ioscopd400.pdf)
- [IOSCO Committee on Regulation of Market Intermediaries](https://www.iosco.org/about/?subsection=display_committee&cmtid=14)