(a) Small institutions—(1) Risk Categories. Each small insured depository institution shall be assigned to one of the following four Risk Categories based upon the institution’s capital evaluation and supervisory evaluation as defined in this section.