Who do you arrest and how do you prove them culpable? The CEO? Often the CEO doesn't know the details at the very bottom, they set general strategy and are so far removed from the day-to-day it's impossible for them to know of malfeasance. VPs? They may have ordered it or devised the strategy, but it's hard to prove who exactly ordered it, how far they knew it was illegal, and if their intended instructions were for the illegal things to happen and it wasn't just overzealous interpretation by those below them. The people processing the claims of who should be repossesed? They literally just check boxes, fill in forms, and shoot of emails based off of processes set from above. The reposessors? From as far as they know, the reposessions are lawful reposessions.

This is like all that idiotic talk with the GFC of "well why was no one jailed!?!". Who should be jailed, for what crime, and how on earth do you prove it to a suffient degree to convict?

This isn't to say there isn't an issue here - there clearly is, and there's plenty of scope to discuss designated legally responsibility on distinct persons within a company. Many institutions do have compliance officers that are actually consideres personally culpable for breaches of law/regulations over set responsibilities, probably to an insufficient degree to prevent abuses like this from happening.

But this is also why fines like this are so large. They involve penalty for ill-gotten gains, interest on the value of those gains over the time period the issue was occuring, and punitive penalties for allowing the breach to occur in the first place. It helps to create a culture where there's a disincentive to cheat and break the law/regulations in order to meet targets, because the consequences for the institution are severe and it's intended to ensure extra scrutiny from above from the people that should be responsible and accountable for these actions.