It’s the one question about the 2008 financial crisis that people still ask me more than any other: Why have regulators done so little to rein in the credit rating agencies? Other institutions that contributed to the mortgage debacle have submitted to new rules and compliance requirements, but Moody’s Investors Service and Standard & Poor’s and their peers remained relatively untouched.

The status quo is especially baffling because the Dodd-Frank financial reform law actually directed the Securities and Exchange Commission to regulate these firms more closely. So why have they been left to operate pretty much as in the past?

First, a little reminder. The rating agencies grade all kinds of securities — from simple corporate debt to collateralized debt obligations. The grades, which run from AAA to D, are supposed to reflect the creditworthiness of the security and offer a guide to investors. During the housing boom, however, the firms slapped high grades on complex mortgage securities that were filled with garbage. The ratings abetted Wall Street’s corrupt mortgage machine and did enormous damage to investors in those securities, which inevitably failed. The reverberations were felt in the economy as a whole.

In the scrutiny after the financial crisis, it became clear that not only were the ratings inflated, but also that the business model of the rating agencies contained a troubling conflict of interest: The rating agencies are paid by the very issuers whose securities they are rating.