You reach out to an agency (generally CFTC and/or SEC). An attorney from that agency eventually contacts your attorney. You have a conversation. You hear nothing back, so you reach out again. A different attorney reaches back out again months later and you rehash the same conversation again. Repeat for years. Best case scenario it goes nowhere and you do voluntary third party audit/compliance/monitoring to demonstrate good faith. Worst case scenario despite any good faith you get a notice because you were already on their radar and the newest attorney smelled blood instead of just wanting to talk again.