Where an Annex II risk assessment is needed, the company must run a system for traceability (or chain of custody) that yields detailed information on extraction, trade, processing and export, kept five years with records of payments linked to Annex II risks; seek contractual rights to the data from immediate suppliers (material description, ownership and corporate structure with officers and affiliations, routes, import and export documents) and, for suppliers not assessed under RMAP, taxes and royalties, payments to officials and to security forces or armed groups, mine of origin, quantities and methods, consolidation points and all upstream intermediaries; share due diligence information with downstream purchasers and mandated auditors; avoid cash or document it through banks; support EITI where applicable; and then continue through Steps 2B to 5.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.