[jprete]

As a regulator, you don't penalize the employee; you penalize the company as though it were a wilful violation.

[lumost]

The company is much larger and incentivized to make it look like an employee issue. Unless there are active mechanisms to prevent this, it will be the default outcome.