It can largely be done in regulation, to the extent the bill permits it. My concern is that proposed section 9.6 talks only about adding procedures for high-risk accounts, rather than having leeway to reduce them for low-risk accounts. The regulations thus far have been extremely prescriptive: they do this in this situation, or for this type of client.
On November 2nd, 2006. See this statement in context.