“Regardless of how the KYC information is documented, it must include, among other things, the client’s personal information, financial information, risk tolerance, and investment objectives. The last two items in particular should be precise enough to allow for an appropriate suitability assessment.”