The NBFC-AA must have a Citizen's Charter that explicitly guarantees protection of customers' rights, and may not part with any information it acquires from or on behalf of a customer without the customer's explicit consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.