A client is not liable for entries resulting from unauthorised access, a compromised identification code or operations made without consent or by error if the client reports in writing within 90 days of the entry, save for gross error, gross negligence or bad faith (Article 46). On a report, the institution must investigate and inform the client in writing of the result, carrying the burden of proving the contrary of the client's claim; where the case is confirmed it must, at no charge to the client, execute the unexecuted operation promptly under its own responsibility, take measures to protect the account, correct any error or unlawful entry, and compensate the losses charged to the account (Article 47).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.