As a prudential regulator, we have a general responsibility when it comes to overseeing financial institutions and making sure that they're engaging in sound risk management practices. What we do, then, instead of issuing regulations that have the force of law, is articulate for them our expectations of them, which we then supervise them against.
When we issue, for example, a reporting protocol, which we have in place, more often than not the case is that financial institutions comply with it, because if they don't, we may consider that as part of our ongoing supervisory oversight of them.