I agree with what Mr. DeRose said, but very simply, enforcement and compliance go hand in hand, and to convince companies that they need to comply, it's not just saying we've got a law. You need to actually be able to engage them, and if the administrator, the agency, doesn't engage, which is what the problem is in the sanctions area, then it's a vacuum. Large public companies with deep compliance cultures, like Canadian banks, just walk away. They don't want to touch it. They will not go anywhere near Iran, even though the sanctions have been fundamentally eased, essentially.
On the other hand, you have a lot of very compliant but ignorant companies, and they see that there's no enforcement. They see they don't have the resources, especially SMEs. They see an opportunity in the oil and gas services sector—not the big producers; I'm talking about the service guys, which are often smaller companies—and off they go. Unfortunately, off they go in a very ill-informed way, and part of the reason is that there's no guidance. So it's not a chicken-and-egg issue; the compliance needs to go with resources and engagement.
I like to talk about engagement more than I talk about enforcement or regulation.