Risk Tolerance and Risk Capacity Are Different Assessments

Risk tolerance considers how much investment risk a client is willing to accept.

Risk capacity considers how much risk the client can financially afford to take.

CIRO’s guidance is clear: both must be assessed, and the client’s overall risk profile should reflect the more conservative of the two.

That distinction can materially change the outcome.

A client may be comfortable with significant market fluctuations but still have limited capacity to absorb losses because of near-term cash needs, limited liquid assets, significant liabilities, borrowing, or the size of the proposed account relative to their broader financial position.

The compliance question is therefore not whether both concepts appear somewhere on the KYC form. It is whether the dealer has a clear method for assessing them separately and can explain how the final risk profile was determined.

CIRO Is Seeing Gaps in Practice

CIRO identifies several recurring deficiencies in examinations:

• no documented process for assessing risk capacity;

• insufficient financial information being collected;

• inadequate documentation showing how risk capacity was determined; and

• no clear method for ensuring that the overall risk profile reflects the more conservative of risk capacity and risk tolerance.

Those findings matter because they point directly to the evidence a dealer may need to produce during a compliance review.

A completed KYC form is not necessarily enough. If the underlying financial information is too broad, the methodology is unclear, or the rationale for the assessment cannot be reconstructed, the control may be difficult to defend.

Financial Information Has to Support the Assessment

CIRO expects dealers to collect financial information detailed enough to support meaningful suitability assessments.

Depending on the client and the products offered, that may include annual income, liquidity needs, financial assets, net worth, liabilities and whether the client is using leverage or borrowing to invest. CIRO also notes that investments and liabilities held outside the dealer may need to be considered where relevant.

The level of detail should reflect the nature of the dealer’s business and product shelf. Firms offering products involving greater complexity, leverage, concentration risk or limited liquidity may require more detailed information.

CIRO also cautions against using financial ranges that are so broad that they do not support a meaningful assessment.

The question is straightforward:

Does the information collected actually allow the firm to determine whether the client can absorb the potential loss?

Net Worth Alone May Not Tell the Full Story

One of the more useful aspects of the bulletin is its treatment of liquidity.

A client may have significant net worth and still have limited capacity to absorb losses if much of that wealth is not readily accessible or if substantial cash needs are expected in the near term.

CIRO’s examples include planned expenditures, emergency reserves, and the extent to which a client may need access to the proposed account. Liquidity considerations can affect both the client’s time horizon and the assessment of risk capacity.

That means firms need to look beyond the headline net-worth figure.

How much of the client’s financial position is actually liquid? What portion of their total net worth does the account represent? Are there known expenses or obligations that could require access to the funds?

Those details can materially change the assessment.

The Methodology Needs to Be Clear and Repeatable

CIRO expects dealers to have a clear and consistent method for assessing risk capacity.

The assessment should use relevant KYC information and produce a defined result that can be compared directly with the client’s risk tolerance. The methodology should be documented in the dealer’s policies and procedures and applied consistently.

That consistency matters.

Two similar clients should not receive materially different assessments simply because different Approved Persons approached the exercise differently.

Professional judgment will remain part of risk profiling, but firms need enough structure around that judgment to demonstrate that the process is fair, consistent and supportable.

Algorithms and Overrides Create Their Own Control Questions

CIRO also addresses the use of algorithmic tools in determining risk capacity.

Where an algorithm is used, the dealer should retain the logic of the tool and preserve the relevant inputs and outputs in the client record.

If an Approved Person is permitted to adjust the result using professional judgment, CIRO expects the rationale for that adjustment to be documented and the override to be subject to supervisory review.

The issue extends beyond KYC.

Any process that allows professional judgment to override a standardized result needs a clear record of why the override occurred and who reviewed it.

Without that record, the firm may know what result was ultimately selected but struggle to explain how it got there.

What Compliance Teams Should Test Now

The bulletin gives compliance teams a useful basis for testing whether their current KYC process is operating as intended.

Rather than beginning with another policy review, firms should consider selecting a sample of actual client files and asking:

• Are risk tolerance and risk capacity recorded as separate assessments?

• Is the financial information sufficiently detailed for the products and services being offered?

• Can the firm explain how risk capacity was determined?

• Does the final risk profile reflect the more conservative assessment?

• Are liquidity needs and time horizon properly reflected?

• Where professional judgment overrides a standard result, is the rationale documented and supervised?

• If an algorithmic tool is used, can the firm reproduce the inputs, output, and underlying logic?

This kind of file testing usually tells a compliance team more than reading the policy in isolation.

A policy may describe the process correctly. The files show whether the process is actually being followed.

What the Guidance Signals

CIRO describes this bulletin as the first in a series intended to help dealers and Approved Persons meet their CFR obligations.

The rules themselves have not changed. CIRO is providing more detail on how firms may operationalize those requirements and what acceptable practices can look like in different circumstances. Dealers remain free to use other approaches that suit their business model, products and clients, provided they can demonstrate compliance.

For compliance teams, the value of the bulletin is practical.

Take the examples CIRO has provided and test them against a sample of current client files.

If the firm cannot reconstruct how risk capacity was assessed, why the final risk profile was selected, or who approved an override, the gap is already visible.