Suitability Assessment Redaction with anonym.plus

Finance Solution · Wealth & Asset Management · UK MiFIR / FCA COBS

Suitability redaction is the removal of personal data from the file that evidences an advice decision. FCA COBS 9A sets the suitability obligation for MiFID business and COBS 9 for the rest, requiring the firm to obtain the information it needs on knowledge and experience, financial situation and investment objectives. That file often records health, care needs or vulnerability — special category data under UK GDPR Art. 9(1), processed under a DPA 2018 Sch. 1 Pt 2 condition — and the FCA's FG21/1 guidance on vulnerable customers (February 2021) expects it to be captured. anonym.plus marks each identifier on your device, so the profile stays useful while the person goes.

When this applies

A suitability file records goals, income, capacity for loss and, often, an illness or a caring responsibility that shapes the recommendation. A file reviewer, a past-business review or a training set needs the reasoning, not the client. You trim the identity before it circulates; the retained file stays whole because COBS 9.5 sets how long you must keep it.

How anonym.plus handles it

1. Open the file in anonym.plus on your device.
2. Local OCR reads the scanned fact-find and questionnaire pages.
3. The tool flags name, NI number, income figures and health references.
4. Keep the risk band, capacity-for-loss score and objective codes.
5. Swap or black out the marked items.
6. Save the clean copy locally.

What you need to provide

• The suitability file (PDF, DOCX, or scan).
• An operator (Replace keeps the reasoning readable).
• Optional allow-list for risk bands and objective codes.

PII & financial identifiers detected

Compliance achieved

• FCA COBS 9A (MiFID business) and COBS 9 require the firm to obtain information on knowledge and experience, financial situation and objectives before it recommends; redaction removes the identity, not that reasoning.
• COBS 9.5 sets how long the suitability record must be kept — indefinitely for a pension transfer or opt-out, five years for a life policy or pension contract, three years otherwise. Redact a shared copy; keep the retained file intact.
• Health, care needs and vulnerability captured in a fact-find are special category data under UK GDPR Art. 9(1), needing a condition in DPA 2018 Sch. 1 Pt 2; the FCA's FG21/1 guidance (February 2021) expects such circumstances to be recorded, which makes the file more sensitive, not less.
• A defined-benefit transfer file sits under COBS 19.1, and Pension Schemes Act 2015 s.48 requires advice on safeguarded benefits worth more than £30,000 — those files carry the longest retention of all.

Limitations & cautions

A goal, an income band and an age together can single out one client even with the name gone. Free-text adviser notes carry the richest indirect clues, and the tool cannot judge whether a recommendation was suitable. Read the narrative sections before you circulate the file.