The company must operate a traceability or chain-of-custody system good enough to identify upstream actors for the red flag review and keep the information at least five years. It must collect: for minerals, the form and type (including by-products), stated origin, mining type (ASM or LSM and whether LSM buys from others), available quantities and dates, and countries of transit (sealed) and transport or handling (unsealed); for immediate suppliers and known upstream actors, name, address and business type, countries of shareholdings, countries of origin and transit over the past year, their CAHRA determinations, and beneficial owners screened against sanctions lists (RMI thresholds between 5 and 25 percent depending on material and risk); for by-products, the point of separation; and for precious group metals, seek direct engagement with legitimate ASM producers. Precious group metal processors must also give each input and output a unique reference and use tamper-proof security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.