The laws have gotten increasingly vague, and enforcement increasingly discretionary, so you never know which rule (if any) will be applied to what action. As such, no one can guarantee that any action is 'legal', so the risk team will always say there is a 1-10% chance of being fined/prosecuted.
These enforcement actions have become an unavoidable cost of doing business.
We want a world where people "deserve" the things they have/can-do; but I don't think we will ever get close to that (we sure can try tho)
It happens the same way in an individual level; the "wolf of wall street" (Jordan Belfortm) did a lot of illegal things; but despite being found guilty and forced to pay fines he is still better off for having done them (~10M offshore money and book/movie money among others).
Heck, it even happens in social interactions, for example kissing a random woman in the street without asking can give someone jail time (sexual harassment and what not) but if he is lucky she may fall for that; they may even get married later on.
I lead a department at a medium sized global business. I recently approached our internal counsel and external specialists about day to day legal issues my team encounters. I wanted to know: Can, Can't, Should, Shouldn't. All I got was a statistical probability of getting in trouble and a summary that stated do whatever, the chances of getting caught and the chances of that even mattering are nil. Better off doing what makes you most effective, even if that entails breaking the law.
When you look at it clinically it makes sense. Quite the slippery slope.
Is it really so much that the current environment rewards companies that take regulatory risks, or that regulatory risks are so pervasive you can't do business without them?
There is some risk of harm of bad dealing at almost every level, but we try to pay attention to the people with the most financial power because they have the greatest ability to do harm. And of course the more incentive there is to subvert the laws. Probably any simple view of this issue is wrong.
The financial instruments have become so complicated that I think the laws need to be vague to ensure that there is power to do something if an investigation happens.
At the same time there is complaints about how complicated the tax codes have become.
These enforcement actions have become an unavoidable cost of doing business.