rcmt regulatory risk