That's basically the cycle of bloated USG bureaucracy in a nutshell. Don't predictably go after bad actors because there aren't enough enforcement resources to spend prosecuting small operations. Enact many overbearing draconian regulations in response to the continued existence of the bad actors. This creates chilling effects and compliance costs on the good actors. Large institutions benefit from their position becoming more entrenched with paperwork. Repeat.