Abundant CCO lessons found in $40 million enforcement settlement