Private banks could be required to conduct risk assessments on case-by-case basis.