Item number two on our list—the ability of major financial intermediaries to conceal risk taking—threatened the global financial system in 2008. The largest intermediaries in the world are highly interconnected: they can topple like dominoes when the failure of one renders its counterparties (and its counterparties’ counterparties) insolvent or even just illiquid. While clients and regulators have an incentive to monitor their own counterparties to prevent such a collapse, monitoring doesn’t work when intermediaries use complex instruments (like over-the-counter derivatives) to conceal their risk taking.

The classic example in the crisis of 2007-2009 was AIG, an insurer that had concentrated risk in an opaque fashion by selling nearly half a trillion dollars of insurance against losses on real estate-related loans. Had the Federal Reserve not lent over $90 billion to AIG to meet its surging obligations in September 2008, the firm’s failure—coming just days after the collapse of Lehman—could have brought many of the largest global intermediaries down. (Following the 2010 Dodd-Frank Act, the Fed no longer has the authority to lend, even in an emergency, to an individual nonbank like AIG.)

Now, we are fans of what has been called “atomistic finance.” That is, the ability to separate payment streams and risk into its most fundamental pieces. The associated practices can clearly improve efficiency, allowing risk to go to those who are most able to bear it, making us all better off. But atomistic finance has a dark side. With the ability to sell risk easily and cheaply comes the ability to accumulate it in almost arbitrarily large amounts. And, as we discovered much to our collective chagrin, not only could individuals and institutions take on massive risk, they could hide the fact that they were doing it in plain sight—within the confines of the law.

The third item on our list—the Rube Goldberg regulatory framework that is (fortunately) unique to the United States—makes it extraordinarily difficult, if not impossible, for anyone to view the financial system as a whole and to detect its vulnerabilities. As the Volcker Alliance recently put it, “The system for regulating financial institutions in the United States is highly fragmented, outdated, and ineffective. A multitude of federal agencies, self-regulatory organizations, and state authorities share oversight of the financial system under a framework riddled with regulatory gaps, loopholes, and inefficiencies.”

Imagine if, instead of the Federal Aviation Administration, we had a range of federal and state agencies and industry associations governing air transport, and that we divided their areas of activity and supervision based on the legal form of the firms that provided the transportation services, rather than on the functions that the firms perform. In such a world, owners of private jets might file their flight plans with one agency, while commercial carriers would file their flight plans with another that didn’t even speak to the first. Would you really want to fly in such a world? (Financial regulation is even worse than that, as firms can change their legal form in order to select the regulator they view as least rigorous.)

Now, we don’t suffer from any illusion that regulators—even in a streamlined framework—would be able to stay ahead of financial innovators, who have a powerful profit incentive to find the next big thing (whatever the risk to the system). But authorities need not fall as far behind as they did in the years before the financial crisis.

So, whether or not you’ve seen The Big Short, if you’re disturbed by the tragedies resulting from the financial crisis, you should be asking where we now stand on all three fronts: (1) on ensuring adequacy of capital and liquidity for banks and shadow banks; (2) on increasing the transparency and reducing the concentration of intermediaries’ risk-taking; and (3) on streamlining our regulatory structure.

The good news is that on (1) and (2) we’ve made progress, but making the financial system safe requires that we do much more. And, on (3), we’ve done virtually nothing.

Bank capital requirements have risen substantially since the crisis (see, for example, here). But we believe standards should be much higher—at least double the current level (see here). With regard to liquidity requirements, there are now (or soon will be) common standards—the liquidity coverage and net stable funding ratios—that apply to internationally active banks. But there remain fragilities in key funding markets—like the markets for repo and securities lending—that have not been sufficiently addressed. And there are new sources of concern about liquidity risk—such as the expanded reliance on exchange-traded funds (ETFs) and mutual funds that hold relatively illiquid assets like corporate bonds and emerging market debt.

In addressing risk concentration and concealment, the most important progress has been in requiring central clearing for straight-vanilla derivatives. A single clearing party, like an exchange, has both the ability and incentive to monitor its counterparties for the kind of risk concentration that made AIG infamous, and to charge an appropriate risk premium. To see our point, consider the case of Amaranth Advisors. Today, even well-informed financial market observers are unlikely to recall this case. But in September 2006, this U.S.-based hedge fund specializing in trading energy futures lost roughly $6 billion of its $9 billion in assets under management and was liquidated. Fortunately, because futures contracts are traded on an exchange and centrally cleared, Amaranth had posted significant margin, so most people could afford to watch with bemused detachment.

The challenge today, and one of the biggest sources of systemic risk remaining, arises from the fact that trillions of dollars of customized derivatives are still arranged over the counter (OTC). The most recent BIS statistics for the first half of 2015 show the gross notional amount of OTC derivatives outstanding at $550 trillion. Granted, this is down from a peak of $711 trillion in 2013 (probably as a result of the multilateral netting that has come with the increase in central clearing of interest rate swaps), but the potential for unobserved risk concentration clearly remains. (For a discussion of central clearing, see here.)

Finally, perhaps the greatest outrage is Congress’s failure to streamline the U.S. regulatory system. This inaction has nothing to do with financial efficiency, fairness or safety. It is all about power. In some cases, congressional committees retain the powers (and the sources of campaign funding) that are associated with control over specific federal agencies and their regulatees. In others, like insurance, it is the states who guard their authority. And, of course, in many instances, the regulatees welcome a complex system full of loopholes, turf conflict and competition among regulators that allows the industry to conceal efforts to bend and shape the rules themselves.

To say that this is a scandal that makes the system less safe is to dramatically understate the case.

Now, we could go on. There are plenty of other problems that policymakers have ignored and are allowing to fester (how about the government-sponsored enterprises?). But we focused on our top three: the need for financial intermediaries to have more capital and liquid assets; the need to improve the ability of both financial market participants and authorities to assess and control risk concentrations through a combination of central clearing and better information collection; and the need to simplify the structure and organization of the U.S. regulatory system itself.

Only if people learn how far the financial system remains from these ideals, only if they understand that the scandal is almost always what is legal, will there be much chance of making the next crisis less severe. Hopefully, by focusing popular attention, The Big Short can make a difference.