Licensees must satisfy the CBB that their controllers are suitable and pose no undue risks to the licensee.