compliance lessons learned from 2017 enforcement