Financial institutions oversee their TSPs and perform due diligence in selecting them, including a review of the TSP's risk management systems and its protection of customer information, and monitor them through service-level reports, audits, third-party reviews, internal control testing results and equivalent evaluations; where a TSP's controls are weak the serviced institutions may have to take remedial action themselves, because the responsibility for managing the risk stays with them, and both TSPs and institutions monitor changes in the laws and guidance that affect the services.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.