Annual risk management reviews definitely favor large incumbents. Large incumbents have the ability to hire and maintain compliance teams. That burden is definitely a barrier to entry to new competitors (though not an insurmountable one).

The shutdown mechanism would have existed anyway and a "risk management review" sounds exactly like the sort of toothless policy that's supposed to make people feel better without actually putting any limits or enforcement on the industry