SEC can only levy civil penalties, criminal (aka jail) is another matter. Which they are happy to refer to the relevant prosecutor, it just isn’t their job at that point.