The CBB will only consider a licensee not having a risk management function, where its investment activities are limited in scale and complexity, and appropriate mitigating controls are in place.