Suitability Reports Under Consumer Duty: COBS Says Say It, PRIN Says Be Understood

There are two questions a compliance file can answer about a suitability report, and most firms only ask the first one.

The first is whether the document contains what the rules require. That is a checklist exercise, it is objectively answerable, and the industry has got rather good at it. The second is whether the client understood it. That one has been a regulatory obligation since July 2023, and it is not answerable by looking at the document at all.

The gap between those two questions is where the suitability report sits now, and it is wider than the volume of template paragraphs in circulation would suggest.

COBS Says Less Than You Think

Start with what the content rule actually requires, because the answer surprises people who have been working from a template.

For MiFID business, the rule is COBS 9A.3.2. Where a firm provides investment advice to a retail client, it must, before the transaction is concluded, provide a suitability report in a durable medium:

“specifying the advice given and how that advice meets the preferences, objectives and other characteristics of the client”

That is the content requirement. One clause. Specify the advice, and explain how it fits what you know about the client.

The longer list that most suitability report templates are built around is COBS 9.4.7, and it applies to the business in COBS 9.4 rather than to MiFID investment advice. It requires the report, at least, to specify the client’s demands and needs on the basis of information obtained from them, explain why the firm concluded the recommended transaction is suitable, explain any possible disadvantages of the transaction, and, for a life policy, include a personalised recommendation explaining why that particular policy would best meet the demands and needs.

Both are short. Neither asks for forty pages.

COBS 9.4.8 then adds the instruction most templates ignore outright: a firm “must ensure the details are modulated according to the complexity of the transaction or the proposed contract of insurance and the type of client”. Modulated. The regulator is explicitly telling firms that the right length varies, and a document whose length is fixed by the template rather than by the transaction is not following that rule in either direction.

The Timing Rules Are Not One Rule

Firms running both MiFID and non-MiFID business have two timing obligations and frequently apply one.

For MiFID investment advice, the report goes out before the transaction is concluded. There is one exception, in COBS 9A.3.2(3), for distance communication that prevents prior delivery, and it is conditional on both of the following being true: the client has consented to receiving the report without undue delay after conclusion, and the firm has given the client the option of delaying the transaction in order to receive the report in advance.

Read that second condition again. The exception requires the firm to have offered to slow down. A firm that routinely issues reports after execution because the process works better that way, without ever having put that choice to the client, is not inside the exception.

Under COBS 9.4.4, the timing depends on the product:

Business	When the report must be provided
Life policy	Before the contract is concluded
Personal or stakeholder pension that is not a life policy	No later than the fourteenth day after the contract is concluded, where COBS 15 requires notification of the right to cancel
Pension transfer or pension conversion	In good time before the transaction is effected
Any other case	When or as soon as possible after the transaction is effected or executed

A pension transfer also needs a one page summary at the front of the report under COBS 9.4.2A, except where the only safeguarded benefit involved is a guaranteed annuity rate. That one page requirement is worth noting for a different reason, which is that it is the FCA telling firms, in a rule, that the substance of a recommendation should be readable in a page.

What Consumer Duty Added

The content rules were not amended. What changed is that a second, independent obligation now applies to the same document.

PRIN 2A.5.3R requires a firm to support retail customer understanding so that its communications:

• “meet the information needs of retail customers”
• “are likely to be understood by retail customers”
• “equip retail customers to make decisions that are effective, timely and properly informed”

and to communicate information “in a way which is clear, fair and not misleading”.

The second limb is the one that changes the work. Likely to be understood is not a disclosure test. It does not ask whether the information was present. It asks whether the recipient was likely to take it in.

PRIN 2A.5.4R tells you whose comprehension counts: for a product-specific communication, the firm should consider the target market for that product. So the question is not whether a suitability report is understandable in the abstract, but whether it is likely to be understood by the clients it is written for. A report pitched at a sophisticated investor and sent to a recently bereaved spouse has a problem that no amount of accuracy fixes.

The application rule at PRIN 2A.5.1R is also broader than people assume. It covers all communications throughout a firm’s interactions with retail customers, before, during and after any sale, in any channel, verbal, visual or written. The suitability report is squarely inside it, and so is the conversation in which you explain it.

Where the Two Regimes Pull in Opposite Directions

This is the practical tension, and it is real rather than theoretical.

COBS rewards inclusion. Every paragraph added is one more thing the file can point to if the recommendation is later challenged. The incentive runs towards length, because length looks like diligence and short documents feel exposed.

PRIN 2A.5 penalises exactly that. A document long enough that nobody reads it is, by definition, not likely to be understood, and it does not equip anybody to make a properly informed decision. The defensive paragraph that protects the firm reduces the probability the client absorbs the recommendation.

Both rules apply at once. Which means the firm has to make an editorial judgement, document that it made one, and be able to say why it landed where it did. That is a different compliance artefact from a template sign-off.

Three places where the judgement usually needs revisiting:

Where the disadvantages live. COBS 9.4.7(3) requires an explanation of any possible disadvantages. If that explanation sits on page 28 under a generic risk heading, it satisfies COBS and is hard to defend under PRIN 2A.5.3R(1)(c), because a disadvantage a client did not find did not equip them to decide anything.

Standard risk wording. Boilerplate is efficient and it is the easiest thing in the file to show was not written with this client’s comprehension in mind. The more of the report is standard text, the weaker the firm’s position on the consumer understanding outcome.

The summary. The FCA already mandates a one page summary for pension transfers. Nothing stops a firm using the same discipline everywhere, and it is the single cheapest way to evidence that it thought about whether the recommendation was findable.

Discretionary and Ongoing Service Are Handled Differently

Firms running portfolios should not be looking at the one-off report rules at all.

COBS 9A.3.2(4) provides that where a firm provides a portfolio management service, or has informed the client that it will carry out periodic assessment of suitability, the periodic report provided under COBS 16A.2.1R must contain an updated statement. The obligation becomes a recurring one attached to reporting rather than a document produced at outset.

There is also a narrow exclusion at COBS 9.4.3(1): the obligation to provide a suitability report does not apply where a firm, acting as investment manager for a retail client, makes a personal recommendation relating to a regulated collective investment scheme.

Our pieces on Consumer Duty for discretionary fund managers and ongoing DFM oversight cover how that recurring obligation is evidenced in practice, and ongoing advice services and CP26/10 covers the direction of travel on what an ongoing service has to deliver.

What to Test Against Your Own Files

A short exercise that produces more than a template review.

1. Take five recent reports and find the recommendation. How far in is it, and is it a sentence or a conclusion assembled from three sections? If a reviewer has to hunt, so did the client.
2. Measure the standard text. What proportion of each report is identical across all five? That number is your exposure on PRIN 2A.5.3R(1)(b), and it is usually higher than anybody expects.
3. Check the timing against the right rule. Separate MiFID advice from COBS 9.4 business and confirm each is on its own clock. If MiFID reports go out post-execution, confirm the COBS 9A.3.2(3) conditions were actually met, including the offer to delay.
4. Ask what evidence you hold that the client understood. Not that the report was sent. That it landed. For most firms the honest answer is the review meeting, which makes the quality of that meeting part of the compliance record rather than a service nicety. How to structure client review meetings that add real value is the practical side of that.
5. Decide who owns the editorial judgement. Somebody has to be accountable for the trade between completeness and comprehension. If nobody is, the template owns it, and the template was written to satisfy COBS alone.

The Position Worth Taking

The forty page suitability report is not a safe default any more. It was a rational response to a regime that measured disclosure, and the regime now measures something else as well.

The firms that will come out of this best are the ones that shorten the document, move the recommendation and the disadvantages to the front, keep the detailed reasoning as an appendix for the file, and record why they made those choices for this client group. That is more work than adding a paragraph, and it is the work the rules now ask for.

Automating the drafting does not resolve any of it, incidentally. A tool that generates a longer, more consistent report faster has improved throughput on the COBS question and done nothing for the PRIN one. Where AI actually saves advisers time goes into which parts of the process genuinely benefit.