Robo-advisory & suitability-based personalised investment recommendations

Retail investors need advice that fits their situation, but human advice is expensive and often reserved for wealthier clients. Robo-advisers collect a structured client profile, map it to a model portfolio, rebalance automatically and produce the suitability documentation that MiFID II demands. The core is deterministic, rules- and optimisation-based; LLMs are increasingly added on top for explanation, goal planning and service, but not as the decision-maker for the recommendation itself.

Problem & value

• Today: banks, Sparkassen/Volksbanken and pension providers advise through branch or phone conversations with paper or tablet questionnaires. Advice is costly per client, quality varies between advisers, and suitability documentation is labour-intensive. Many small savers get no advice and end up in cash or in unsuitable products.
• AI/automation value: consistent, scalable and documented suitability assessment; low-cost access to diversified portfolios (typically ETF-based); automatic rebalancing and tax-aware order generation; consistent compliance evidence; better explanations for clients.
• Evidence: ESMA and national supervisors (e.g. BaFin) have published guidance and supervisory findings on automated advice, indicating a mature but closely supervised category [1][2]. Fee levels and assets under management differ widely by provider; no single benchmark figure is quoted here.

Variants

• Fully automated robo-advice / digital portfolio management (neobroker, fintech, bank subsidiary): client onboarding online, discretionary management of model portfolios.
• Hybrid advice: the adviser uses the engine as a cockpit; the human stays accountable. Typical in Sparkassen/Volksbanken and private banks.
• Advisor-assist for human advisers: next-best-investment suggestions, meeting preparation, automatic suitability report drafting.
• Pension and retirement planning: goal-based glide paths, occupational and Riester-style products, pension-provider apps.
• Embedded/white-label: investment engine delivered via API to banks, insurers or apps.
• Private use: self-directed investors use planning tools or LLM chat for education; this is not regulated advice unless a licensed provider issues personal recommendations. Related: PERS-001.

How it works

1. onboarding (KYC, appropriateness/knowledge questionnaire, risk & loss capacity, goals, ESG)
2. profile validation (consistency checks, contradiction flags, human review of edge cases)
3. suitability engine (risk class
4. eligible product universe
5. target allocation)
6. portfolio construction (optimisation under constraints: costs, tax, ESG, concentration)
7. recommendation or discretionary mandate + costs & charges disclosure (ex-ante)
8. suitability report on durable medium
9. client consent / order
10. monitoring: drift, life-event triggers, periodic suitability review (at least annual for ongoing advice)
11. rebalancing proposals/orders, reporting, record-keeping

• Profiling: questionnaires must be designed to avoid biased or ambiguous questions; ESMA's suitability guidelines require firms to reconcile contradictory answers and not to steer clients' answers [2].
• Allocation engine: mean-variance, Black-Litterman, risk-parity or simple glide-path models, solved by convex optimisation under constraints; Monte-Carlo simulation for goal success probability. Product selection uses rules (eligible universe, costs, SFDR classification, target market under product governance).
• LLM layer (optional): explains the recommendation, answers questions, summarises the suitability report in plain language, supports advisers with preparation. It reads the engine's output; it does not alter allocations. Outputs are filtered against a compliance guardrail (no performance promises, no product recommendations outside the engine).
• Human-in-the-loop: compliance owns the model and rules; advisers handle edge cases (vulnerable clients, inconsistencies, large amounts); model changes go through change control and testing.

Data preparation

Needed are client questionnaire answers, master data, holdings and cash flows, the product universe with costs, KID/KIID and ESG/SFDR data, market data and tax status. They live in the core banking or custody system, the CRM, advisor Excel files, PDF product documents and paper questionnaires.

Typical gaps: unsigned or outdated questionnaires, inconsistent risk class definitions between advisors, product data from several vendors with differing identifiers (ISIN mapping), missing ESG data, scanned paper files and duplicate client records.

Preparation steps: digitise and re-validate old questionnaires (PREP-006, PREP-008), define one binding scheme for risk classes and objectives (PREP-019), clean client master data (PREP-011), automate product and cost data feeds from data vendors instead of PDFs (PREP-005, DATA-003), and pseudonymise data used for testing (PREP-022). Collect historical advisor decisions as test cases (PREP-018). Typical tools are the bank's data warehouse, ETL tooling and a data-quality framework.

Effort share is medium, about 30 to 40 percent; most of it is regulatory definitions and product data rather than volume. GUIDE-003 gives a check before starting.

Implementation paths

Which path for whom

• Enterprise: B. Suitability logic, product universe and documentation duties are core and regulated, and must integrate with custody, CRM and core banking; build the engine on own rules with cloud components, buying only a licensed advice module where the institution is small.
• Developer: C. Open-source optimisation and portfolio libraries (e.g. PyPortfolioOpt, cvxpy) run self-hosted; client data stays under own control and LLMs, if used, only explain outputs.
• Private: A. Licensed robo-advisors or broker tools are the sensible route for individuals; self-built advice has no regulatory standing.

Path A — Buy (white-label robo platform, for smaller banks and providers)

• Robo-advice platforms/white-label engines: Scalable Capital (DE) and Quirion (DE) run consumer offerings; B2B engines include Fincite (DE), Avaloq (CH), Temenos and FNZ. Verify current availability.
• Compliance tooling: suitability reporting, KID/costs disclosure and archiving from the core-banking or wealth platform.
• Choose A when: you lack a quant team, need a licensed-ready compliance framework and prefer a vendor that has already passed supervisory review. Check: EU hosting, who is the regulated firm, model governance documentation, audit access, exit rights.

Path B — Build on cloud APIs

• Engine: own suitability and allocation service (Python, cvxpy/PyPortfolioOpt, QuantLib for analytics); market and fund data from providers such as Morningstar, LSEG or MSCI (ESG/SFDR data).
• LLM layer: frontier models via EU-region endpoints (Azure OpenAI in EU, Google Vertex AI EU, AWS Bedrock Frankfurt, Anthropic Claude via cloud EU regions, Mistral La Plateforme as EU provider) for explanation and report drafting, with structured outputs and retrieval restricted to the firm's approved content.
• Integration: custody and brokerage via bank APIs or a broker partner; workflow via Camunda or similar; archiving per MiFID record-keeping rules.

Path C — Self-host (open source)

• Optimisation and simulation: cvxpy, PyPortfolioOpt, Riskfolio-Lib, QuantLib, Ray.
• LLM layer: open-weight models (e.g. Mistral Small/Medium class, Qwen3, Llama-class, gpt-oss) served with vLLM for explanations and chat; the allocation engine itself needs only CPU. Add guardrails (e.g. NeMo Guardrails, Llama Guard) for compliant wording.
• Hardware: HW1 for the engine; HW2 to run a ~8–30B quantised model for explanation.
• Suitable when: data-sovereignty requirements (Sparkassen/Volksbanken data centres) outweigh convenience.

Path D — Custom training

Not needed for portfolio construction, where explainable, auditable models are preferred. Fine-tuning is justified for a service LLM trained on the firm's approved wording, for churn/life-event prediction, or for optimising client communication. Data: labelled conversations and outcomes; strict separation from the recommendation engine.

State of the art (2026)

• Deterministic core, generative shell: leading providers keep the suitability and allocation logic rule-based and testable and add LLMs for explanation, goals dialogue and adviser copilots. Free-form LLM recommendations have been shown to be inconsistent, vary with prompt wording and may miss suitability constraints, which is why supervisors stress accountability regardless of the tool [2][3].
• Goal-based planning and personalised direct indexing (tax-loss harvesting, ESG tilts) are more widespread in the US; in the EU adoption is slower due to cost and tax rules.
• ESG preferences have been part of the MiFID II suitability assessment since August 2022, tied to SFDR and EU Taxonomy categories [4].
• Retail Investment Strategy: the EU's retail investment package proposes changes to inducements, value-for-money and advice rules; check current legislative status before design [5].
• Limits and failure modes: questionnaires measure stated, not real, risk tolerance; clients answer inconsistently; model portfolios behave similarly in market stress (herding); LLMs can hallucinate product facts or imply guarantees; capacity-for-loss data is often missing.

Shared resources & combinations

• OPT-010 (institutional portfolio optimisation and trading) shares optimisation libraries and market data pipelines; KNOW-023 supplies research summaries to advisers; LANG-037 provides SFDR/Taxonomy ESG data; LANG-024 reviews marketing and financial promotions; CONV-013 is the conversational front end; PRED-009 and REC-003 share client analytics, but marketing use must be kept apart from suitability logic.
• Shared building blocks: optimisation-solver, guardrails, llm-general, workflow-automation.

Effort, cost & KPIs

• Path A: 3–9 months including compliance sign-off, integration with custody and onboarding; licence fees are typically AUM- or client-based.
• Path B: 9–18 months with a quant, engineering and compliance team; major costs are data licences, validation and supervision.
• Path C: similar to B, plus infrastructure and LLM operations.
• KPIs: onboarding completion, share of clients with documented suitability, profile inconsistency rate, portfolio drift versus target, tracking error, cost ratio, client retention, complaint rate, number of compliance exceptions, explanation quality (human-rated).

People & change

Involve management (strategy, liability), the head of advisory as process owner, advisors and portfolio managers, compliance and legal (MiFID II suitability, product governance, supervisory expectations), IT and IT security, the DPO, and the works council. Data owners for client and product data join early. Clients are affected by the output and need clear explanations.

Works council: depends, but likely yes in practice. Advisors' work processes change (section 90(1) no. 3 BetrVG), and tools that log advisor activity or quality are suited to monitor behaviour (section 87(1) no. 6, BAG: objective suitability suffices). An expert on AI may be engaged under section 80(3). Public-sector institutions involve the staff council.

Data protection: financial profiles are sensitive; a DPIA (Art. 35 GDPR) is likely because of systematic evaluation of persons, AVV with each processor, and DPO involvement from the start. The AI Act classification needs a documented assessment, see GUIDE-014.

AI literacy: support advisors and compliance staff with training on model limits and explanation of recommendations (Art. 4 AI Act, GUIDE-006).

Pilot with a small advisor group or a single product line, run in parallel to human advice, and keep the advisor or compliance function able to review and override every recommendation. Typical concerns are job loss and liability; address them by positioning the tool as support with a documented audit trail. See GUIDE-004, GUIDE-008 and GUIDE-009.

Risks, regulation & compliance

• MiFID II: suitability assessment, ex-ante costs disclosure, product governance, record-keeping and the ESMA suitability guidelines apply; for fully automated advice firms remain responsible and ESMA addresses automated tools explicitly [1][2]. German firms follow WpHG and BaFin supervision.
• EU AI Act: investment advice is not listed in Annex III, so robo-advice is generally not high-risk by itself; however, creditworthiness assessment (Annex III 5(b)) is high-risk, and insurance risk pricing for life and health also falls under Annex III. A chat or explanation layer triggers Art. 50 transparency (tell clients they interact with AI) and Art. 4 AI literacy applies. Prohibited practices (Art. 5) include manipulative techniques or exploiting vulnerabilities of age or financial situation, so engagement nudging towards high-cost products must be avoided. Classification depends on scope; obtain legal review [6]. Deadlines for high-risk obligations may shift under EU simplification proposals, so check current dates.
• GDPR: financial data, goals and vulnerability indicators are personal data; Art. 22 applies to solely automated decisions with significant effects, so offer human review and explanation; DPIA likely required; avoid special-category inference (e.g. health) [7].
• DORA: ICT risk, third-party provider (cloud and LLM vendor) oversight and incident reporting for financial entities.
• Risks & mitigations: unsuitable advice (conservative fallbacks, outlier review), conflicts of interest (no hidden steering to in-house products), model risk (validation, versioning, back-testing), LLM misstatements (templated disclosures, guardrails, logging), vulnerable clients (escalation to humans).

Getting started

1. Decide the service model (advice vs. discretionary management vs. execution-only with appropriateness test) with compliance; it determines the obligations.
2. Document the target market, product universe and the questionnaire; test it for consistency with real clients.
3. Pilot a vendor engine (Path A) or build the allocation engine with simple, explainable rules before adding any LLM.
4. Add the LLM layer read-only for explanation; log all outputs and test against a compliance prompt set.
5. Run a supervised pilot with a limited client group, review suitability reports sampled by compliance, then scale.

Sources

1. ESMA — MiFID II interactive single rulebook — https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mifid-ii
2. ESMA — Guidelines on certain aspects of the MiFID II suitability requirements (ESMA35-43-3172) — https://www.esma.europa.eu/document/guidelines-certain-aspects-mifid-ii-suitability-requirements-0
3. BaFin — German financial supervisor (search "robo-advice") — https://www.bafin.de/EN/Homepage/homepage_node.html
4. European Commission — Sustainable finance: SFDR and sustainability preferences in MiFID II — https://finance.ec.europa.eu/sustainable-finance_en
5. European Commission — Retail investment strategy — https://finance.ec.europa.eu/publications/retail-investment-strategy_en
6. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj
7. Regulation (EU) 2016/679 (GDPR) — https://eur-lex.europa.eu/eli/reg/2016/679/oj
8. Directive 2014/65/EU (MiFID II) — https://eur-lex.europa.eu/eli/dir/2014/65/oj
9. cvxpy — https://github.com/cvxpy/cvxpy
10. PyPortfolioOpt — https://github.com/robertmartin8/PyPortfolioOpt