"It is dutyholder's job to manage risk, not the regulator's"