Why is private self-regulation embraced in modern business governance when it is both costly and promises no good compliance outcomes? Conventional explanations cannot simultaneously explain why regulators and firms embrace the private compliance regime. I use a game-theoretic model to demonstrate that corporate compliance programs partially separate risky firms from non-risky counterparts, reducing the need for frequent regulatory investigations to obtain firm-level information. I also show that risky firms sometimes partake in costly private compliance with probabilistic regulatory investigation and large non-compliance leniency. This theoretical model accounts for two prominent features in the design of private self-regulation in economic sanction enforcement: the risk-based approach and lenient financial penalty based on private compliance efforts.