Including a shutdown mechanism and doing an annual risk management review favors large incumbents?

Annual risk management reviews definitely favor large incumbents. Large incumbents have the ability to hire and maintain compliance teams. That burden is definitely a barrier to entry to new competitors (though not an insurmountable one).

The shutdown mechanism would have existed anyway and a "risk management review" sounds exactly like the sort of toothless policy that's supposed to make people feel better without actually putting any limits or enforcement on the industry