Suitability and the DLT test

Before an investor can hold security tokens, Securitize needs two things on top of the verification:

the suitability: the investor’s profile — experience, finances, risk profile, experience per asset class — and your attestation that the investor reviewed Securitize’s documents. Every investor needs it.
the DLT test: a knowledge test about distributed ledger technology. Only investors whose address is in the European Economic Area take it.

Both are required to whitelist a wallet. Neither depends on the verification: you can send them in any investor status, for individuals and entities alike, and for an investor you have limited access to.

POST /investors/{investorId}/suitability   send the suitability, complete, in one call
GET  /investors/{investorId}/suitability   its status and verdict
POST /investors/{investorId}/suitability/compact   an individual's compact suitability, in one call
GET  /investors/{investorId}/suitability/compact   its status and verdict
POST /investors/{investorId}/dlt-test      one attempt at the DLT test
GET  /investors/{investorId}/dlt-test      whether it applies, attempts, verdict

The suitability

Collect the answers from the investor in your own flow, then send them in one call. Every field, its values and their meaning are in the API reference.

curl -X POST "$BASE/investors/$INVESTOR_ID/suitability" -H "Authorization: Bearer $ACCESS_TOKEN" -H "content-type: application/json" -d @suitability.json

{ "status": "completed", "verificationStatus": "verified" }

Read verificationStatus. status only says the questionnaire is completed; verificationStatus is Securitize’s verdict, the one whitelisting requires. Treat any value other than verified as “not verified”. It is sent once and cannot be changed. The first complete suitability is final, whether you, another partner or the investor on Securitize sent it. A later call stores nothing and answers 200 with the current state. An invalid body answers 400 listing every field to fix, and stores nothing.

The verdict

For an individual, the answers decide the verdict in the same response, with the full suitability and the compact one alike:

`verificationStatus`	When	What to do
`verified`	The investment approach is aggressive growth, the investor could bear a loss of more than 30%, accepts that the securities may be illiquid, and is neither a licensed securities professional nor affiliated with a securities firm	Nothing more. Once the investor’s own `status` is `verified`, their Securitize Markets brokerage account is approved too
`rejected`	The investment approach is not aggressive growth, the investor could bear a loss of up to 30% only, or does not accept that the securities may be illiquid, whatever the other answers	Tell the investor: “Based on your answers, a Securitize Markets brokerage account is not available to you at this time.”
`processing`	The answers above qualify, but the investor is a licensed securities professional or affiliated with a securities firm	Wait. Securitize’s compliance team reviews the account and may contact the investor; the suitability webhook announces its decision

Securitize can change which answers lead to each verdict: act on the verificationStatus you receive, not on the answers you sent. An entity’s suitability reads verified at once.

{ "status": "completed", "verificationStatus": "rejected" }

A verdict under review or not approved. While the full suitability is not complete and the investor’s verdict is processing or rejected — from a compact suitability, or set by Securitize’s compliance team — the call answers 422 with details.reason: suitability_under_review or suitability_not_approved, and stores nothing. There is nothing to resend; the webhook announces the next decision.

The declarations

The three declarations must be true. Sending them is your attestation that the investor:

was given, and reviewed, the current Securitize Markets, LLC Subscriber Agreement, as Securitize supplied it to you;
was given, and reviewed, the current Securitize Markets, LLC Form CRS (Customer Relationship Summary), as Securitize supplied it to you;
confirmed the four affirmations listed on affirmationsConfirmed in the API reference.

Securitize supplies these documents to you under your agreement; they are not served by this API. Show them in your flow before you send the suitability. GET …/suitability returns your answers too, when you sent them.

The compact suitability

A shorter suitability for individuals: the part of the investor profile that a Securitize Markets brokerage account for stocks and ‘40 Act funds requires. Its fields are a subset of the full suitability’s, with the same names and values — the risk profile, the industry questions, income, occupation, equities experience and the same declarations — and fields outside that set are ignored. isPoliticallyExposedPerson is optional here, unlike in the full suitability. Every field is in the API reference.

curl -X POST "$BASE/investors/$INVESTOR_ID/suitability/compact" -H "Authorization: Bearer $ACCESS_TOKEN" -H "content-type: application/json" -d @compact-suitability.json

{ "status": "completed", "verificationStatus": "verified" }

Individuals only. An entity answers 422 with details.reason: investor_type_not_supported: send it the full suitability. The investor’s own status does not need to be verified yet.
The verdict is decided as for the full suitability (The verdict), in the same response.
Decided once. Once the verdict is verified, or the full suitability is complete, a call stores nothing and answers 200 with the current state. While the verdict is processing or rejected, a call answers 422 with details.reason: suitability_under_review or suitability_not_approved.
Toward the full suitability. While the verdict is verified, the investor can complete the full suitability later, through the API or on Securitize.

GET …/suitability/compact answers the same verificationStatus as GET …/suitability, with status: completed once the investor has a verdict or a complete full suitability (after a compact suitability, GET …/suitability still reads not_started), and your answers in the compact shape while they are the ones you sent, compact or full: once the investor completes or edits them on Securitize, they are not returned.

The DLT test

Eight multiple-choice questions about distributed ledger technology. The questions and their options are on each field of the API reference: show them to the investor in that order, and send the letter of the option they chose (a to d). Who takes it. Investors whose address is in the European Economic Area (the EU countries plus Iceland, Liechtenstein and Norway): the residential address of an individual, the registered address of an entity. GET …/dlt-test tells you with required. For anyone else, an attempt answers 422 and counts nothing.

curl -X POST "$BASE/investors/$INVESTOR_ID/dlt-test" -H "Authorization: Bearer $ACCESS_TOKEN" -H "content-type: application/json" -d @dlt-attempt.json

{ "status": "failed", "required": true, "attemptsUsed": 1, "attemptsRemaining": 2, "verificationStatus": "none" }

All eight answers must be correct to pass. The response never says which were wrong.
Three attempts per investor, then locked. Attempts are shared with every partner and with the investor’s own attempts on Securitize. After the third failed attempt the test is locked and cannot be retaken through the API: further attempts answer 422 with details.reason: dlt_test_locked. Contact Securitize.
An invalid body (400) does not use an attempt. Once passed, further attempts change nothing.

verificationStatus on the DLT test is the investor’s EU suitability: verified once the test is passed and the suitability is complete, in either order.

`status`	Meaning
`not_started`	No attempt yet
`failed`	The last attempt failed; `attemptsRemaining` says how many are left
`passed`	Passed
`locked`	Three attempts failed. It cannot be retaken through the API

Securitize’s compliance team can change either verdict after a review. Suitability webhooks tell you every time a verificationStatus changes, whoever changed it.

In sandbox

The suitability behaves as in production. For the DLT test you can exercise failed attempts and the lock, on a fresh investor with an address in the EEA each time. To test with an investor that has passed, ask Securitize for one.

Get started

Guides

Concepts

Help

API reference