Relying solely on VASP licenses and superficial compliance policies isn’t enough.