Vulnerabilities in non-banks leave door open to ‘shocks’, says G20 watchdog