This article investigates the processes through which regulatory norms generally, and in the context of transnational private regulation (TPR) in particular, become effective. We argue that institutionalization — the embedding of norms within some wider structures which impact upon their distribution, enforcement, and mode of transmission — is generally central to the processes through which regulatory norms are crystallized. We note that, within processes of crystallization of TPR norms, the potential for managing legitimacy has been exploited through the institutionalization of policies, structures, and processes which are responsive to the beliefs, expectations or interests of the relevant legitimacy communities. However, we suggest that the focus of such legitimating strategies on the making of rules and standards exposes weaknesses and limits to the potential of such legitimation attaching to actions which implement such norms through monitoring and enforcement, particularly where such processes are embedded within supply-chain contracts.