How Best to Regulate Systemic Risk?