A Requirement Most Advisers Think They've Already Satisfied
Almost every advisory practice has some version of a risk-profiling questionnaire. Almost every one of them, when we review it during a compliance audit, is missing at least one element SEBI's framework specifically requires beyond simply asking a client to fill in a form.
The Core Requirement: Before Advice, Not Alongside It
Risk profiling must be completed before any advice is given to a client — this sequencing is explicit under Regulations 16-17 of the IA Regulations, and it's not satisfied by a risk profile completed simultaneously with, or shortly after, the first piece of advice. If advice preceded a completed, consented risk profile, the sequencing itself is a compliance gap regardless of how thorough the eventual profile turns out to be.
What a Compliant Risk Profile Actually Needs to Capture
Beyond generic risk-tolerance questions, a genuinely compliant risk profile needs to reflect the client-provided information covering their financial situation, investment objectives, time horizon, and risk appetite in enough depth that subsequent advice can be demonstrably matched against it — not just a generic "conservative/moderate/aggressive" self-selection with no supporting detail.
The Consent Requirement Most Practices Miss
Completing the questionnaire isn't the final step — SEBI specifically requires obtaining the client's consent on the completed risk profile, via registered email or a physical document, confirming the client agrees the profile accurately reflects their situation. This consent step, distinct from simply having them fill in the form, is one of the most commonly missing pieces we find during compliance reviews.
Why the "Free Trial" Prohibition Connects Directly to This Requirement
SEBI's explicit ban on offering any form of free trial to prospective clients (see our companion article on this specific prohibition) exists precisely because a free trial would otherwise create pressure to give advice before completing proper risk profiling — the two requirements are designed to work together, closing off an obvious workaround.
What Happens When Risk Profiling Documentation Is Incomplete
At the annual compliance audit stage (see our article on audit preparation), incomplete or undocumented risk profiling is one of the most frequently cited findings — not because advisers are skipping the exercise entirely, but because the documentation trail (the completed profile, the client's consent, and a demonstrable link between the profile and the specific advice subsequently given) isn't maintained to the standard an audit actually tests for.
Refreshing Risk Profiles Over Time
A risk profile completed at onboarding can become stale as a client's circumstances change — a significant life event, a change in financial position, or simply the passage of enough time that the original profile no longer reflects reality. While the specific refresh frequency should be built into your own practice's SOP, maintaining a periodic review discipline (rather than treating the risk profile as a one-time onboarding artefact) is both good practice and a stronger position to be in if ever questioned on a specific piece of advice.
Building a Risk Profiling Process That Holds Up to Audit
We help IAs design and document a risk-profiling process — questionnaire design, consent capture, and the link between profile and advice — that satisfies SEBI's requirements in substance, not just in the sense of having a form on file.
Want your current risk-profiling process reviewed against what an actual compliance audit will test for? Talk to Anuj Desai & Associates.
This article is for general informational purposes and does not constitute regulatory advice specific to any adviser's compliance processes.