The DFSA, Suitability and Thematic Reviews: What firms can do now

In its November 2025 Dear SEO letter, the DFSA announced that it would be undertaking thematic reviews on the issues of Suitability, Fund Platforms and Brokerage: Oversight of Trading Environment.

The letter also highlighted the growing significance of thematic reviews for the regulator:

“With the high levels of growth we continue to see across all sectors, Thematic Reviews are becoming an increasingly important tool in our supervisory toolkit to identify risks and share good practice across multiple firms and/or sectors.”

In relation to suitability specifically, the letter stated:

“Ensuring firms have adequate suitability frameworks in place has been, and will continue to be, a key priority for us. … This Review will help us to better understand firms’ level of compliance with the suitability requirements, as well any challenges in this area.”

It also confirmed that the review would focus on both the design of suitability-related systems and controls and their operation in practice.

So, what should firms expect of the review, and what can they do now?

In terms of methodology, such reviews typically involve two stages:

1. Survey
2. Review and visits

It’s the combination of these two stages which makes this type of review so valuable for regulators. Although we don’t know the exact details of the suitability review, the Conflicts of Interest Thematic Review, which the DFSA published in January, illustrates this:

Stage 1: 710 firms were asked to complete a survey, which included 32 questions across 8 topic areas.

The key benefit of this stage of the review for the DFSA is the scale, as it allows the regulator to gather data from literally hundreds of firms. However, it’s also important to note that, by asking questions on a range of different aspects of a topic, the DFSA can get a more rounded picture of overall compliance.

Stage 2: A sample of 25 firms was selected for the second stage, which comprised a desk-based review, followed by on-site visits.

In the review findings, the DFSA stated that the sample was chosen based on both survey responses and existing data relating to risk and compliance.

This second stage allows the DFSA to do a ‘deep-dive’ into the smaller number of firms in the sample. This can involve detailed reviews of policies and procedures, as well as other documentation such as training material, management information and board minutes.

The findings of both review stages are then typically published, with the DFSA articulating the good practice it has identified, as well as areas for improvement.

The first stage of the suitability review is underway, and relevant firms have received the survey. As expected, the questions combine both breadth, covering a range of topics, and depth, digging into more detail where the regulator is seeking a more granular picture.

How should firms respond to the review?

The first point is that any firm which is asked to complete the survey should do so. This may seem obvious, but the Conflict of Interest review indicated that 3% of firms (approximately 21 firms) failed to do so.

The second point is that firms must be open and honest in their survey responses. Not only is this a fundamental requirement of the DFSA regulatory regime (specifically Principle 10 – “An Authorised Firm must deal with Regulators in an open and co-operative manner”) but also eliminates the risk of a firm having to justify incomplete or inaccurate answers if it is subsequently selected as part of the smaller review sample.

Yet pro-active firms will want to do more than simply complete the survey and wait for the publication of the review findings. Not only has the DFSA clearly stated that suitability continues to be a high regulatory priority, but it has also emphasised that it is concerned with both the design and practical operation of firm’s policies and procedures.

This provides a clear prompt for firms to conduct a full internal review of their suitability framework, both in terms of what is documented (its design) and how that translates into day-to-day activity (its practical operation).

Furthermore, firms should seek to think holistically about the process, reviewing it on an ‘end-to-end’ basis which considers not only the firm’s interactions with its clients, but also the training that is provided to relevant staff, the monitoring that is undertaken by the second and third line functions and the governance arrangements (including management information and evidence of engagement and challenge by senior managers).

A firm which conducts such a review, and undertakes remedial action to rectify any shortcomings which are identified, will have a sound basis to be confident that it is meeting the DFSA’s expectations and will hopefully find much to recognise when, in due course, the regulator publishes its ‘good practice’ findings.

For more information on how we can help you embed a comprehensive understanding of the DFSA’s expectations within your firm, get in touch.

Alternatively, see our range of DFSA-focused compliance training here.

Nigel specialises in training boards, senior executives and other staff on the impact of regulation and regulatory change.

He is a CFA Charterholder and Chartered Fellow of the CISI, with over 20 years' of industry experience.

With a background in compliance in private banking and wealth management, Nigel has a particular interest in effective corporate governance and the management of compliance and regulatory risk. His interests also include issues relating to ESG and climate risk, conduct and culture (including non-financial misconduct), and all aspects of financial crime prevention, as well as the impact of fintech on compliance and regulation.

Recent assignments have included briefing multiple boards and executive teams on the Consumer Duty, delivering compliance and ethics training for senior managers and front-office staff and creating a user-friendly risk and compliance handbook for a major bank.