An Authorised Person must establish and maintain systems and controls that enable it to satisfy itself of the suitability of anyone who acts for it.