8. Can lenders define their own risk controls?