The regulator may only approve an application if satisfied the individual is a fit and proper person to perform the function, having regard (among other things) to honesty, integrity and reputation, competence and capability, and financial soundness, per s 61; a firm's own fitness and propriety assessment underpins what it puts to the regulator and underpins its own certification decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.