Even if there isn't any federal requirement for an IRB, it probably isn't a bad idea to have some sort of oversight. You don't want someone doing something stupid there. You also need to make sure that there are some safety standards to be followed (autoclaving biohazard waste, or limiting work to BSL-1, for example).
Another example: you don't want someone sequencing a person's genome without approval. (It's probably not as big of a risk here as it would be to a place like 23andme, but they should still probably try to cover themselves).