Financial firms eager to get in on the robo-advisor revolution might first need to take a deep breath.

Financial technology, or fintech, is transforming the financial services industry, writes BlackRock in “Digital Investment Advice: Robo Advisors Come of Age,” a recently published whitepaper. But there are few best practices for regulators or early adoptees to follow.

That may be because the technology itself is changing so quickly that it is difficult to pace the proliferation of robo-advisors.

“It’s an exciting time because there’s so much innovation and we think we’re still in the early days,” says Bo Lu, one of the paper’s co-authors. “We think that the innovation is going to accelerate, but that has implications for regulators and also for firms trying to keep up with the pace of change.”

Lu is CEO of Future Advisor, a robo-advisor purchased by BlackRock last year that now manages $937 million in client assets.

BlackRock believes the recent and rapid growth of digital advisors requires greater regulatory scrutiny and a more focused analysis of their business models and activities.

BlackRock has identified five areas of concern for digital advice providers and firms considering implementing a robo-advisor: suitability, algorithm design, disclosure standards, trading practices and cybersecurity.

Robo-advisors must be able to make suitable investment recommendations based on their knowledge of a client’s circumstances and goals. Currently, advisors use simple, short questionnaires to determine a person’s investment goals and risk tolerance.

Lu says that advisors must balance the need for more personalized, customized investment approaches with software design limitations — if users are presented with too many questions or too many options prior to investing, they’re unlikely to continue the process,

“It’s not necessary to have a longer and more detailed questionnaire to onboard a client,” Lu says. “It should be a fun experience. Try to get as many people as are interested through the process while making sure you don’t offer anything unsuitable.”

After a client is onboarded, Lu suggested that further customization of their portfolio could be accomplished via a follow-up with a human advisor.

Suitability assessments like questionnaires should be tailored to the clients’ goals and the services offered by the advisor. The simpler the services, the fewer the inputs a robo-advisor would need to design an investment plan.

Digital advisors should also use algorithms designed using generally accepted investment theories, and investment professionals should be closely involved in the development and oversight of algorithms, says Lu.

“We believe that algorithms have to be flexible,” he notes. “The algorithm’s job is to deliver the spark, the investment perspective of a human office or CIO. If they have new insights or new research that alters their perspective, that should be reflected in the algorithm by way of an adjustment. It’s not a machine deciding what to aim for, it’s a machine that reflects a human assumption on market and portfolio behavior.”

Algorithms should also match advisors’ stated investment strategies and analyze investments for a number of factors including performance, transaction costs and management fees. If a third party develops the robo-advisor’s algorithm, the advisory firm should conduct “a robust” due diligence.

Robo-advisors must clearly disclose fees and other forms of compensation prior to the provision of services, as well as any risks clients may incur from investing in a portfolio or a security.

Disclosures should also be clear and easily available to the end client so that they are able to evaluate and compare the performance of a robo-advisor.

Robo-advisors could be a boon to advisors trying to comply with the U.S. Department of Labor’s fiduciary rulemaking, says Lu.

“There are natural things that digital advice providers can help with,” Lu says. “They can record all of the factors that went into a particular portfolio decision for a single client at the time that decision was made by the algorithm and why it made sense, and they can do it in a systematic way. Robo-advisors can be a solution to the disclosure and documentation concerns that the DOL rule has raised.”

Robo-advisors should also have policies and procedures in place concerning their trading practices, including controls to mitigate risks associated with trading and order handling. Those polices should include rules for the bundling of orders, fair allocation of trades to clients and the resolution of trading errors.

“Obviously, for Future Advisor we can leverage BlackRock’s decades of experience in risk, data security and best practices,” Lu says. “We’re also, for the most part, talking about financial institutions already subject to heavy regulation who already have robust cybersecurity practices. Our concerns is that advisors might not be keeping an eye out for this, and there’s no way of knowing how large or robust their technology providers are unless they’re doing the due diligence themselves.

BlackRock says that digital advice providers should also be diligent about data protection and cybersecurity, including controls on who can access client and account data. The firm also recommends that robo-advisors use data encryption and purchase cybersecurity insurance.