The CBB may, on being provided sufficient evidence of a member's risk management system and internal controls commensurate with its scale of operations and business plan, exempt a Category 1 or Category 2 member from any of the requirements of rules MIR-3.1.2 and MIR-3.1.3.