While the regulator has no proof that the security will behave as it thinks, the regulator cannot wait till the risks occur, for it may be too late. The broader point is that a lot of regulatory action stems from the regulator exercising sound judgment based on years of experience. In doing so, it fills in the gaps in laws, contracts, and even regulations.
Not everything the regulator does can be proven in a court of law. Courts do not interfere in the specific decisions of a corporate board – using the business judgment rule, they do not second guess business decisions, and only pull up boards when there is a violation of the legal process of arriving at a decision.