Smart Suitability: how AI can improve conversion and compliance in investments

Suitability was designed as a mechanism to protect investors and fulfills this role. However, much of its potential remains unexplored: the questionnaire is applied, and the profile is recorded, but the information collected is rarely used in subsequent stages of the relationship.

This observation is not from the market; it is from the regulator. In January 2025, the Securities and Exchange Commission published the Regulatory Outcome Assessment study on the application of CVM Resolution 30, surveying 2,815 investors and comparing it with the regimes in the United States and the European Union. The evaluation recognizes that the questionnaires in the market are close to formal compliance with the rule but notes that evidence does not indicate the use of these questionnaires for the commercial segmentation of clients or for more personalized service.

This article discusses what the regulation requires, why the process has devolved into a stage of friction, and how the same information can support personalized recommendations without compromising compliance.

What is suitability and what does CVM Resolution 30 require?

Suitability is the duty to verify the adequacy of products, services, and operations to the client’s profile before recommending them. In Brazil, this matter is governed by CVM Resolution 30, dated May 11, 2021, effective since June 1 of that year, which revoked Instruction CVM 539/2013 and was subsequently amended by CVM Resolutions 162/2022 and 179/2023.

The regulation imposes three structural obligations and one rule of sequence.

Client Classification

The institution must evaluate and classify the client into pre-established risk profile categories, considering investment objectives, financial situation, and knowledge about the products.

Product Classification

The institution must analyze and classify the product categories with which it operates, identifying the characteristics that may affect their suitability to the client’s profile.

Suitability Verification

The institution must confront the two classifications and identify discrepancies between the assessed profile and the products actually contracted, adopting the necessary measures.

Order Matters

Suitability verification is a pre-contractual obligation. The legality of the recommendation is contingent on prior verification, not on subsequent regularization.

Update Deadlines

CVM Resolution 30 altered the previous profile update regime. Instruction CVM 539 provided a maximum interval of 24 months. The current regulation harmonized the deadline with the frequency of registration updates defined in each institution’s anti-money laundering and terrorist financing prevention policy, as per Instruction CVM 617/2019, observing a maximum interval of five years.

The 24-month deadline remains in the regulation but is applied to another subject: the new analysis and classification of categories of securities must occur within intervals not exceeding this period.

The distinction has practical effects. Several institutions maintain a validity of 24 months for the profile by their own internal policy decision, which is legitimate and often recommended in continuous advisory relationships. What is not correct is presenting this deadline as a requirement of CVM Resolution 30 for the client’s profile.

Discrepancy and Refusal

When a client requests a transaction incompatible with the assessed profile, or when the profile is absent or outdated, the institution must warn them in advance about the discrepancy and its causes. If the client maintains the decision, it is necessary to obtain an express statement that they wish to proceed despite being aware of the inadequacy. The same procedure applies to those who refuse to respond to the questionnaire.

The regulation also provides for exemption cases, including operations conducted with professional investors.

Why has the suitability questionnaire become a point of abandonment in the funnel?

Three factors explain the degradation: the questionnaire was designed to produce regulatory evidence and not useful information, its application occurs at the worst possible moment in the funnel, and the investor does not perceive a counterbalance.

Evidence-Oriented Design, Not Usage-Oriented

The CVM study identified that market questionnaires meet the formal requirements of the regulation, without any evidence of the responses being utilized in client segmentation. This produces a form optimized to demonstrate compliance in audits, with questions written in normative language, generic scales, and no feedback to the respondent.

The effect on perception is measurable. The same study established a Net Promoter Score of -61 for the advisory provided by brokers, indicating a significant level of dissatisfaction. The regulator’s reading is that the market strictly seeks formal compliance with regulations, and the process needs to become more dynamic and educational.

Positioning in the Funnel

The questionnaire is usually applied right after registration and before the first transaction, meaning it is at a point where the user has not yet gained any value from the platform and their willingness to invest effort is minimal. Adding to this is the typical length, between ten and twenty questions, and the absence of indications of progress or estimated time.

The result is well-known in any funnel instrumentation: the stage disproportionately concentrates abandonment compared to its weight in the process.

Perceived Absence of Counterbalance

The investor answers a set of questions about income, assets, objectives, and loss tolerance, receiving in return a label of three categories. They receive no explanation on how the label was established, nor recommendations derived from it, nor any noticeable change in the subsequent experience. The perception that filling out the questionnaire serves the institution rather than themselves aligns with what the process delivers.

Among the recommendations from the CVM study is precisely the express prohibition of commercial interference in the assessment of risk profiles, alongside the utilization of information sharing within open finance and the creation of utilities to centralize profile registrations.

Does the investor’s declared profile correspond to their real behavior?

Often not, and the regulator’s study provides direct evidence of this. The question matters because the profile is the restriction that governs everything that follows: it defines the set of offerable products, conditions the legality of the recommendation, and serves as a parameter in any dispute. It is also the only relevant input in the process that the institution accepts as truth without verification, as registration data is compared with external databases and transactions are recorded, while risk tolerance enters the system exactly as the client declared it. 

When this declaration does not correspond to the real investor, the error propagates in two directions of asymmetric consequences: a profile that is more conservative than the person actually is blocks compatible products and silently suppresses revenue, without generating complaints, because no one contests an offer they did not receive; a more aggressive profile produces allocations incompatible with the actual ability to bear losses, and this shows up in indicators, in the form of losses and litigation.

Self-Assessment of Risk Tolerance is Unreliable

The answer to a hypothetical question about enduring a 20% drop is given in a neutral emotional condition. The actual behavior in the face of a real drop is another phenomenon. Behavioral finance literature is consistent regarding this divergence, which manifests in both directions: some declare themselves aggressive but withdraw during the first correction, while others declare themselves conservative but maintain volatile positions without discomfort.

The Questionnaire is Susceptible to Induction

When access to certain products depends on categorization, there is an incentive to respond in a way that expands access. Market experts point to cases where investors are led to respond in a certain way to achieve more aggressive profiles, which shifts the misalignment from the questionnaire to the portfolio.

The Profile is Treated as a Stable Attribute

Income, family composition, horizon, and objectives change. A profile assessed once and reviewed every five years describes a person who may no longer exist.

What Observed Behavior Reveals

The behavioral signals that an institution already possesses are often more informative than the declared responses:

The recurrence of misalignment alerts is the most direct signal. When a client repeatedly acknowledges risk in order to operate outside their profile, the most likely hypothesis is not that they are systematically making mistakes, but that the recorded profile is outdated or inaccurately determined. This sets up a double exposure for the institution: the formal record is in order, but the substantive protection that the regulation intends to ensure is not functioning.

How can AI transform suitability into personalized recommendation?

The natural temptation is to treat Artificial Intelligence as a way to make the questionnaire smarter. The greater gain, however, lies not in accurately assessing the profile but in utilizing what has already been assessed. The information exists and remains stagnant between the moment of registration and the next review. But the starting point is architectural: separating the compliance layer from the personalization layer.

The Compliance Layer Defines the Eligible Set

The assessed profile, the classification of products, and the rules of CVM Resolution 30 determine which categories can be recommended to that client. This layer is deterministic, auditable, and not subject to commercial optimization. A product outside the eligible set is not recommended, regardless of any signs of propensity.

The Personalization Layer Orders What is Already Eligible

Within the permitted set, models determine relevance, timing, and presentation style, considering declared objectives, observed behavior, life cycle, and context.

This separation resolves the most common objection to the use of AI in investment recommendations. The model does not decide what is appropriate; it only determines what is relevant among the options that the compliance policy has already authorized. Suitability remains under explicit rules.

Applications with Demonstrable Returns

Progressive Profile Assessment

Instead of a single form applied before the first transaction, the profile is built in steps, starting with the minimum necessary set to release the lower-risk categories and deepening as the client progresses to products requiring greater qualification. Friction begins to be charged at the moment when a clear counterbalance exists.

Pre-Filling with Existing Data

Registration information, AML/CFT data, and, with consent, open finance data reduce the number of necessary questions. The CVM study points to open finance as an avenue for improvement in this direction.

Detection of Discrepancies Between Profile and Behavior

Models comparing the declared profile and observed behavior identify clients whose records likely do not match reality, triggering targeted reviews instead of mass re-registration.

Adaptive Language in the Questionnaire

The same question can be formulated differently according to the respondent’s background. Concrete scenarios with monetary values tend to produce more accurate responses than abstract tolerance scales.

Explanation of the Recommendation

A language model can translate the logic of the recommendation for the client, indicating why a particular product is compatible with the assessed profile. This directly addresses the absence of perceived counterbalance.

Evidence in a Regulated Environment

The feasibility of this arrangement has already been demonstrated in a closely related context. One of the largest private pension insurance companies in Brazil operated with a predictive model that accurately identified only 9% of clients likely to transfer funds to another institution, a figure insufficient to support any commercial action. Objective structured a platform with six AI models in production, including one for the propensity to contract additional coverages, one for recommending funds for reinvestment, and one for natural language processing applied to contact center transcripts, capable of detecting signs of portability intent during the call itself.

Predictive accuracy rose from 9% to 39%, assets under management grew fourfold, and incremental revenue exceeded R$ 342 million in the first year. Data governance was treated as a structural condition from the outset, not as a subsequent layer, operating on anonymized data at all stages to ensure compliance with LGPD.

Two aspects are transferable to suitability. The first is that the signals that produced the gain came from observable behavior, not from information declared by the client. The second is that the models were delivered as consumable applications directly by commercial and relationship teams, without mediation from the data area at each request, which is essential for personalization to reach the point of contact rather than remain in reports.

Compliance Limits That Apply Now

Brazil still lacks a specific legal framework for artificial intelligence. Bill 2,338/2023 was approved by the Senate in December 2024 and remains under consideration in the Chamber of Deputies, with projected consolidation of the Executive’s project that establishes the National Artificial Intelligence System. The National Data Protection Authority included artificial intelligence among the priority supervisory axes for the 2026-2027 biennium.

The absence of specific legislation does not mean the absence of applicable regulations. Article 20 of LGPD guarantees the holder the right to request a review of decisions made solely based on automated processing that affect their interests. In investment recommendations, this implies three project requirements: recording the factors that produced each recommendation, the ability to explain it in understandable language, and an accessible human review path for the client.

These add to the regulator’s recommendation against commercial interference in assessing the profile. A model trained to maximize conversion that influences the client’s risk classification contradicts the purpose of the regulation, even if it produces formally compatible output.

What Metrics Show That Suitability is Generating Conversion and Compliance?

Usual monitoring is limited to coverage of assessed profiles, an indicator that responds to audits and provides no information about effectiveness. An appropriate dashboard combines four dimensions.

Process Efficiency

Quality of Assessment

Commercial Effect

Compliance and Satisfaction

Two cross-readings concentrate the value of the dashboard. The first relates the questionnaire completion rate to the frequency of misalignment alerts: a short process that produces profiles that no one respects has not resolved the problem, it has merely shifted it. The second relates post-assessment conversion with complaints of inadequacy, delineating the boundary between legitimate personalization and commercial inducement.

Final Considerations

Suitability occupies an unusual position among regulated processes: it is simultaneously a compliance obligation, a critical conversion point, and the only structured capture of the client’s goals and restrictions that most institutions perform.

Treating it solely in the first dimension explains the result pointed out by the regulator. The information exists, is recorded, meets audit requirements, and produces neither effective protection nor commercial value.

Objective works on building decision systems in regulated environments, integrating software engineering, data, and artificial intelligence for financial institutions and capital markets, focusing on data-driven personalization, compliance automation, and modernization of critical platforms. Talk to a specialist.

Frequently Asked Questions about the Topic