If anything positive has come of the past two years, it’s that the crisis exposed huge gaps in our financial regulatory framework and clearly showed that investors require greater protections. In response, the Investor Protection Act (IPA) of 2009 was introduced and recently passed in the House Financial Services Committee.

Key provisions of the bill include beefing up the enforcement authority of the Securities and Exchange Commission (SEC), the many weaknesses of which were exposed in the wake of the Bernard Madoff scandal; imposing fiduciary duty on those in the securities industry who act in an advisory role, including broker-dealers; giving the SEC the authority to nullify mandatory arbitration clauses in customer contracts; and closing some of the numerous loopholes in existing investor protection legislation.

Although most would agree that it shouldn’t have taken a financial crisis to bring about these changes, the majority of Americans probably don’t realize the true cost of reform. And it’s not a cost in terms of dollars and cents, but in terms of other protections that might evaporate in exchange for these concessions.

Recall the Enron scandal that roiled the markets and led to the passage of the Sarbanes-Oxley Act in 2002. The legislation essentially closed loopholes and tightened enforcement, requiring public companies and their auditors to ensure that internal controls implemented to prevent fraud actually worked.

But the meat and potatoes of that law, Section 404, which required companies to report on the effectiveness of their internal controls, has yet to be fully implemented over seven years later. Under the guise of protecting smaller companies, firms with market caps of less than $75 million have been exempted repeatedly from compliance.

An amendment to the IPA will effectively make that exemption permanent and may ultimately allow companies with market caps of less than $250 million to ignore the Section 404 requirements.

These exemptions might have been palatable if the legislative largesse ended there, but there’s another bill in the works, the Resolution Authority for Large, Interconnected Financial Companies Act of 2009, which encourages the Federal Deposit Insurance Corp (FDIC) to make loans to failed institutions, purchase their debt and assume or guarantee their bonds–among a number of other measures.

This piece of regulatory magic could permanently codify the Treasury Department’s Troubled Asset Relief Program (TARP) and would require the FDIC and other regulators to aid failing financials rather than work them out through seizure and asset sales. If the proposed legislation passes, too-big-to-fail would become a permanent fact of life, setting the stage for a continuous string of bailouts for banks that took on too much risk.

An improved regulatory system is all well and good, but it should do more than just pay lip service to investor protection.