A person with sponsored accreditation must not make a consumer data request unless it has a registered sponsor (one that has notified the Accreditor under subrule 5.14(2) and is recorded on the Register), and may make requests only to an accredited data recipient under rule 4.7A or through a registered sponsor acting at its request; it must not engage an OSP to collect CDR data for it, and must not have a CDR representative (each a civil penalty). If it ceases to have any registered sponsor its collection consents expire (use and disclosure consents continue), and after 120 days without one its accreditation is taken to be surrendered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.