Suitability and Communications

Before a firm can judge whether an investment fits a customer, it has to actually know that customer. Two layers sit underneath every recommendation.

FINRA Rule 2090 (Know Your Customer) requires a firm to use reasonable diligence to learn the essential facts about each customer, who they are, their financial situation, and their objectives, and to keep that information current.

Knowing the customer is what makes a suitable, best-interest recommendation possible. The firm builds an investment profile from a set of factors and weighs any recommendation against that whole picture rather than any single number. The factors that make up the profile are below.

Investment Profile Factors: What You Must Know About Your Customer

Under Reg BI, a firm must have a reasonable basis to believe a recommendation is in the customer's best interest based on their full investment profile:

Reg BI took effect in June 2020 and raised the bar above the old "suitability" standard: a broker-dealer must act in the best interest of a retail customer at the time it makes a recommendation. The rule breaks into four obligations, and the SIE expects all four by name.

1. Disclosure Obligation

Give the customer Form CRS and disclose the material facts about the relationship, the services offered, the fees, and any conflicts of interest, before or at the time of the recommendation.

2. Care Obligation

Use reasonable diligence, care, and skill. The firm weighs the potential risks, rewards, and costs against the customer's profile, considers whether a less costly or less risky alternative would do, and concludes the recommendation is in the customer's best interest, not merely "suitable."

3. Conflict of Interest Obligation

Maintain written policies to identify, disclose, and mitigate or eliminate conflicts, with specific attention to incentive compensation that could push a rep toward recommendations that are not in the customer's interest.

4. Compliance Obligation

Maintain written policies and procedures reasonably designed to achieve compliance with Reg BI as a whole.

One distinction the exam loves: this is not the fiduciary standard. That standard applies to investment advisers under the Advisers Act of 1940; broker-dealers answer to Reg BI.

Form CRS, the Client Relationship Summary, is the disclosure document the Disclosure Obligation centers on.

• It runs a maximum of 2 pages for a standalone broker-dealer (up to 4 pages for a dual-registered firm that is also an investment adviser).
• It is written in plain language, in a question-and-answer format.
• It describes the services offered, the fees and costs, conflicts of interest, the legal standard of conduct, and any disciplinary history, and it links to Investor.gov.

Timing is the testable part. Form CRS goes to a retail investor at the beginning of the relationship (before or at the time of a recommendation), and again when the customer opens a new account, when the firm recommends an account-type change (say, brokerage to advisory), or on request.

Every Reg BI obligation hinges on one trigger: a recommendation. A conversation that never rises to a recommendation does not require Form CRS, the Care Obligation, or the rest. The line between education and recommendation is one of the most-tested, and most-missed, distinctions on the exam.

The test: specific, tailored, call to action

A communication is a recommendation when it is a specific, tailored call to action aimed at a particular customer, something a reasonable person would read as a suggestion to take (or avoid) a specific investment action, shaped to that customer's situation rather than offered as general information. Miss any one of the three (specific, tailored, call to action) and it usually is not a recommendation.

These are recommendations

• "Based on your retirement timeline, you should buy this bond fund."
• A hold recommendation. Telling a customer to keep something they already own counts, "doing nothing" is still advice if you advised it. Students miss this one constantly.
• "Let's convert your brokerage account to a managed advisory account." An account-type-change recommendation triggers Reg BI and a re-delivery of Form CRS.
• "You should roll your 401(k) into an IRA." A rollover recommendation is a Reg BI recommendation.

These are not

• General education: explaining how a Roth IRA differs from a Traditional IRA, or how bond prices move with rates.
• General market commentary: "The Fed raised rates this morning."
• Unsolicited orders: if the customer directs the trade themselves, executing it is not a recommendation.
• Product menus: listing the funds available without steering toward any one of them.

Watch for the trap where a rep calls something education but is really steering one customer toward one action. The label does not matter, that is still a recommendation.

FINRA Rule 2210 sorts every firm communication into three categories, each with its own approval and filing rules. The dividing line between the first two is a head count of retail investors in any 30-day period.

So exactly 25 retail investors is correspondence; it takes 26 or more to make it a retail communication. Whatever the category, the content standards are the same:

• Fair, balanced, and not misleading, with a sound basis for evaluating the facts.
• No projecting future performance and no guaranteeing results.
• Risks disclosed prominently whenever returns are discussed.
• Social-media posts count as communications and follow the same rules.

Do-not-call rules

Cold-calling is hedged with timing and list rules. A firm must keep its own internal do-not-call list, must check the National Do-Not-Call Registry at least every 31 days before cold-calling, and may only call consumers between 8:00 AM and 9:00 PM in the consumer's local time zone.

Exceptions, when a call is still allowed

Even a number on a do-not-call list can be called when there is an existing business relationship (within 18 months of the customer's last transaction, or 3 months of an inquiry), when the customer has given written permission, or when the caller is a tax-exempt nonprofit.

Regulation S-AM

Separately, Reg S-AM gives customers a reasonable chance to opt out of marketing solicitations that are based on information a firm receives from its affiliates.

FINRA's rules are technology-neutral: they apply the same whether a firm relies on human judgment, a spreadsheet, or an AI model. As firms adopt AI, the SIE has begun testing familiar supervision concepts wrapped in an AI scenario.

Regulatory Notice 24-09 made the point explicitly, existing rules already cover AI and generative AI. There are no separate "AI rules." A few principles follow from that:

• Supervision (Rule 3110): a firm's supervisory system has to be reasonably designed for its business, so a firm using AI tools must govern, test, and monitor them.
• Communications: anything an AI produces and sends to customers is still subject to Rule 2210, fair, balanced, not misleading, and reviewed under the same procedures as human-written content.
• Third-party tools: using a vendor's AI does not outsource the compliance obligation; the firm stays responsible for supervising it.
• Recordkeeping: AI-generated business communications must be captured and retained like any other.
• "AI washing": overstating a firm's use of AI (claiming decisions are "AI-powered" when they are not) is an anti-fraud violation, and the SEC has brought cases over it.

AI also widens the cybersecurity threat surface, deepfakes that impersonate staff or clients, synthetic identities used to open fraudulent accounts, and more convincing AI-driven phishing, so firms' security programs have to keep pace.