Regulatory risk and enforcement