I'd be fine with letting the company get to choose between a sufficiently large fine, and board level executives who encouraged the behavior going to jail for real durations of time.

They can pick one of three choices: Don't be evil. Pay more than they made. Go to jail for the same duration of time as having stolen Option 2's money, and not the scapegoats, people actually in charge.