Across regulatory domains, states delegate compliance functions to firms us-
ing a common procedural template—risk assessment, internal controls, mon-
itoring, documentation, disclosure, and remediation—while retaining coercive
enforcement authority. Why do states delegate compliance, and why does del-
egation converge on this format? I argue that delegated compliance solves an
information-production problem in public enforcement. By conditioning penalty
mitigation on risk-adjusted compliance effort and disclosure, regulators induce
firms to generate information for targeted investigations. The compliance tem-
plate recurs as the components collectively facilitate a formal public-private
information-sharing structure. An incomplete-information model shows that
delegation reallocates investigation toward higher-risk compliance histories, ex-
pands the range of enforcement environments where firm-produced information
determines whether investigation occurs, and can make compliance behavior
more revealing of firm risk. Illustrated with U.S. sanctions and export-control
enforcement, the account highlights that procedural compliance has informa-
tional value for public enforcement even when it does not prevent substantive
violations.