Pay-to-play cases raise questions about oversight by compliance