risk regulator