Run an independent compliance management system covering all operations, with unrestricted access to records, prompt escalation of material non-compliance to the compliance officer, adequate competence and resources, and a risk-based testing and monitoring programme using key performance and risk indicators; the compliance officer administers it and notifies VARA and other authorities of material non-compliance. Detailed compliance policies must cover licence conditions, record keeping, business practices, AML/CFT and dealing rules, and complaint handling by staff not involved in the matter; the system is kept current, compliance staff are fit and proper, and activities elsewhere follow local law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.