There are, and will continue to be, suspicions regarding the timing of a Department of Justice lawsuit against Standard & Poor's Rating Services announced this week. With another debt ceiling debate and sequestration cuts in our near future, now might be a good time, some are saying, for an attack on the firm that had the audacity to downgrade the U.S. government's credit rating in 2011.

The timing of the civil suit, the first federal enforcement action against a credit rating agency over bond ratings, also raises the question of why it took so long. Regardless of why the Justice Department chose this week to strike, it certainly seems long overdue. Could, perhaps, the persistent failure of regulators to reign in ratings agencies have necessitated a move guaranteed to grab headlines and, at least, give the appearance of diligence?

For many years, ratings agencies have skated past any real culpability for their actions. Plenty lament that no bankers went to jail during the financial crisis, but, then again, neither did anyone from the rating agencies that helped facilitate the mortgage market collapse. Perhaps owing to the complexity of the services they offer, populist pitchforks have never been as harshly tilted toward the ratings giants—S&P, Moody's, and Fitch Ratings—as they have been toward other financial institutions.

The Justice Department action was brought under the Financial Institutions Reform, Recovery, and Enforcement Act of 1989, which allows it to seek civil penalties equal to the losses suffered by federally insured financial institutions. It claims to have identified more than $5 billion in such losses that resulted from financial instruments rated by S&P between March and October 2007. The lawsuit focuses on what it says were egregiously generous, and equally improper, ratings for roughly 40 collateralized debt obligations (CDOs).

S&P's rebuttal, articulated in a press release, accuses the Justice Department is singling it out “for not predicting the full magnitude of housing downturn, despite the failure of virtually everyone to do so.” A cornerstone of its defense is that “every CDO cited by the Justice Department also independently received the same rating from another rating agency.” It did, at least, “take extensive rating actions in 2007—ahead of other ratings agencies,” with more collateral or other protections required to support AAA ratings on CDOs. “With 20/20 hindsight, these strong actions proved insufficient—but they demonstrate that the Justice Department would be wrong in contending that S&P ratings were motivated by commercial considerations and not issued in good faith,” it says.

Don't expect much public sympathy for S&P, or its industry peers, given their role in the financial crisis. However, regulators also share some of the blame. Reforming the industry and leveling the playing field would take bold action, something they have repeatedly failed to pursue. Even though the Dodd-Frank Act devoted plenty of ink to the problem, the biggest result was to create the SEC's new Office of Credit Ratings, an overseer that has been very quiet since its director was named last summer. Congress voted against more sweeping changes, such as one proposed by Sen. Al Franken (D-Minn.) to create a self-regulatory organization for the industry and a randomized assignment process for investment ratings.

A Senate report in April 2011 found that more than 90 percent of the AAA ratings given by rating agencies to mortgage-backed securities in 2006 and 2007 were later proven to be ill-advised once they defaulted or were downgraded to junk status. That same year, an SEC examination of credit rating agencies documented conflicts of interest and a greater focus on maximized revenue than quality analysis. The Commission, however, chose not  to name any of the firms it found to be deficient. A follow-up report, this past November, also avoided a “name and shame” approach, instead treating the Dodd-Frank-mandated study as merely a catalog of anonymous offenses.

Setting aside the intricacies of CDOs and other exotic instruments, the underlying problem with credit rating agencies is actually simple and straightforward. Many, especially the largest, have an “issuer-pay compensation model.” They make money by charging a fee from those offering the very securities they are asked to rate and need to be competitive by proving to issuers they will be a better choice, with more favorable results, than competitors. Even the alternative, a subscriber pay compensation model where investors purchase the right to access a pool of credit ratings, are rife with potential conflicts of interest, according to SEC reports. Conflicts of interest allegations are a big part of the government's case against S&P, which has countered by citing internal policies that separate analytic and commercial activities and ban analysts from participating in fee negotiations.

There is a Catch-22 to attacking these conflicts through rulemaking. Increased competition should mean more accurate, less compromised ratings for investors and market participants. More regulation, however, runs the risk of reducing competition and giving an even freer rein to the biggest firms.

The deck is already stacked against smaller firms and new ones looking to enter the marketplace. The largest credit rating agencies have economies of scale and can better afford needed technology and legal, compliance, marketing, and support staff. Being around longer gives them an edge when developing historically based statistical models. They are already intertwined, perhaps inseparably, with the world's financial institutions. According to the SEC, Fitch, Moody's, and S&P account for over 99 percent of all outstanding ratings for government, municipal, and sovereign securities.

So yes, regulating these agencies is a tough task, which is why enforcement could become preferable to rulemaking as officials try to "catch up."

Monday's lawsuit comes nearly five years after the challenged CDO ratings were issued, and many months after a Wells Notice in September 2011 first hinted at the action against S&P now made official. It also, however, comes mere days after the SEC announced that the Egan-Jones Ratings Company agreed to settle conflict-of-interest charges and accusations it made “willful and material misstatements and omissions” when registering to become a Nationally Recognized Statistical Rating Organization. The SEC's order bars that firm, for at least 18 months, from rating asset-backed and government securities issuers.

With two major acts of unprecedented enforcement activity against credit-rating agencies within a few days of each other, the big question is who's next, and when? Other firms would be wise to prepare for some long-delayed financial crisis fallout.