Separate policy-making, supervisory, advisory and review functions from operations; separate sales, dealing, accounting, settlement and safekeeping of virtual assets; and keep compliance and internal audit independent of operations, with the compliance officer and head of internal audit reporting directly to the Board.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.