The structure of regulatory compliance depends on something more essential than policy guidance or industry codes of conduct. It depends on the legal structures that define what is permissible, what is forbidden, and what penalties follow from non-compliance. These structures are not fixed documents