An agile team is building a fintech application. Regulatory compliance requirements are unclear and evolving. The project manager wants to ensure risks are managed iteratively. Which actions are appropriate? (Select TWO)

Include a 'risk census' or review as part of every retrospective.

Create a detailed risk management plan before starting the first sprint.

Assign all compliance risks to the legal department to manage.

Add risk-reduction activities (spikes) to the backlog to clarify requirements.

Wait until the 'Hardening Sprint' to address compliance risks.

Freeze the code base until regulations are finalized.