Regulator concedes it ‘does not have sufficient powers to protect the public’