Self-regulation (especially at the industry level rather than delegating to individual companies) doesn't seem completely broken. Actually it can work quite well. You keep some oversight, and reserve the right for the state regulator to step in if the SRO goes bad. The people who run the SRO have an interest in perpetuating their organization, so they if anything have an incentive to be stricter than the government would. If things do go wrong, the government demands direct oversight. That's what's happening here.
[0] https://en.wikipedia.org/wiki/Self-regulatory_organization