Financial services firms benefit from the regulatory framework provided by the State therefore it's not unreasonable that the State should make some stipulations of its own.

If you steal from PayPal we don't say "they're a private company, they knew the risks" do we?