The “London Whale” is far from the financial crime of the century, but it may well be the financial blunder of the decade. Crimes and blunders are, of course, different, but the slow and inconsistent response by JPMorgan Chase & Co. to its discovery that traders in its London office were hiding their losses has placed the behavior of several JPMorgan officers on the ambiguous seam between a negligent blunder and more culpable fraud.

This frames an obvious question: Does the U.S. Securities and Exchange Commission’s settlement with JPMorgan deal adequately with this misbehavior? After ignoring Lehman Brothers and other inviting cases, is the SEC finally deciding to become tougher?

The short answer is that there are some signs of progress by the SEC, but equally much evidence that the old status quo still governs at the SEC, as discussed below:

Use of a cease-and-desist proceeding. Despite the size and significance of the JPMorgan case, the SEC did not file it in federal court or seek an injunction. Rather, it brought a cease-and-desist proceeding under Section 21C of the Securities Exchange Act. Why? This procedure allowed the SEC to avoid judicial oversight. Possibly, the Enforcement Division is still traumatized by Judge Jed Rakoff’s criticism of it in his SEC v. Bank of America and SEC v. Citigroup Global Markets decisions. Also some district courts are clearly taking a more active role in overseeing SEC enforcement actions. In seeking mandamus of Rakoff’s refusal to approve the Citigroup settlement, the SEC insisted upon its need for an injunction, but by forgoing any injunction in JPMorgan, it has undercut its position.

Record  penalties — imposed on the victims. The sole “victims” of the London Whale (and JPMorgan’s inadequate internal controls) were its own shareholders, who suffered a more than $6 billion loss. This is not the more typical case where the loss falls on third parties. Imposing a near record $920 million in fines on JPMorgan thus compounds the loss to its shareholders. Of course, one can argue that high penalties imposed on shareholders incentivize them to monitor management more closely and demand better controls. But that argument is equivalent to advocating punishing those who experience a burglary for their negligence in suffering a burglary on the rationale that this will motivate them to take greater precautions. A record fine does allow the SEC to celebrate a much needed victory — but at the cost of subordinating the best interests of investors to those of the commission.

The SEC acknowledged this dilemma by placing its $200 million of the penalties in a “fair funds” account under Section 304 of the Sarbanes-Oxley Act, which amount will be available for redistribution to victims. Still, that is less than 25 percent of the total fine, and it will likely only go to those few shareholders who become class members in a securities class action (as only a class action provides an effective mechanism for distribution of the funds).

The absence of individual defendants. The obvious problems with punishing victims argue for focusing SEC enforcement on individual defendants (at least in cases where shareholders are the victims). Here, the JPMorgan settlement follows the persistent pattern that has prevailed since Lehman: The SEC cannot seem to hold anyone accountable in a financial institution higher than the office boy. The two traders named in this case are only slightly senior to Fabrice (the “Fabulous Fab”) Tourre in the Goldman Sachs case.

Moreover, there is a special quirk in this case: The SEC’s order discusses the role of JPMorgan’s senior management at length, but never mentions their names, referring to them only by title. Much as the Victorians would never publicly mention sex, the SEC seems similarly reluctant to do anything as uncouth as embarrass a senior bank executive.

Although the SEC’s investigation is purportedly still continuing, anti-fraud charges seem unlikely in light of how the SEC has styled its case. The SEC’s co-director of enforcement announced that “JPMorgan’s senior management broke a cardinal rule of corporate governance” by not informing its Audit Committee and keeping them “in the dark about the extent of these problems.” But only fraud, and not bad corporate governance, can support penalties or private causes of action.

The new transparency. In fairness, the JPMorgan settlement is markedly different from past practice in important respects. First, it provides a detailed narrative with a blow-by-blow factual account of events within JPMorgan, as it gradually awoke to the fact that its London traders were deceiving it. When Rakoff refused to approve the SEC’s settlement with Bank of America back in 2009, his chief objection was the lack of disclosure about what had actually happened. Here, in contrast to many SEC settlements that just state legal conclusions, the JPMorgan order supplies a supporting factual basis that tells you who knew what and when. This is real progress if we believe that transparency is the core value that the SEC should be fostering. Gradually and grudgingly, the SEC seems to be recognizing that Rakoff was right and that sunlight could actually be a useful disinfectant.

Admissions. The SEC also succeeded in doing what it had long said was impossible: forcing a major defendant to admit the factual allegations in its complaint. To be sure, these admissions were well crafted to minimize any collateral consequences and provide little benefit to the plaintiffs in pending class actions against JPMorgan. No private cause of action exists under the statutory sections and rules found by the SEC to have been violated. Nor does the settlement even hint of scienter on the defendant’s part. Still, it is not the SEC’s job to do the heavy lifting for the plaintiffs bar.

Nonetheless, it is surprising that the SEC framed its case to pivot on the failure of JPMorgan’s management to advise its Audit Committee of their internal control deficiencies. Frankly, the Audit Committee could have done little that senior management had not already done, and no loss was proximately caused by this omission. Thus, it was the perfect “sin” for JPMorgan to admit.

Arguably, the SEC could have instead alleged that JPMorgan, and some officers, made reckless statements to the market when it filed its Form 8-K on April 13, 2012, and/or its Form 10-Q for the first quarter on May 10, 2012. That Form 10-Q found that JPMorgan’s internal controls “were effective,” even though red flags were already flying. The SEC could have charged JPMorgan officers under Section 17(a)(2) or (a)(3) of the Securities Act of 1933 and avoided any need to show scienter. But this disclosure-violation theory might have made JPMorgan’s lawyers uncomfortable because all it left for plaintiffs was to prove scienter.

Hence, the Section 13(a) theory that the SEC chose, which placed at center stage the failure to inform the Audit Committee, was likely preferable from JPMorgan’s perspective. The bottom line is that the SEC is alleging not those facts that it can prove, but those that it can settle.

“Clawbacks.” If an anti-fraud cause of action seemed either unpromising or unacceptable to the defendant, what else could the SEC have done? Here, like Sherlock Holmes’ dog that did not bark in the night, it is extraordinary that the SEC has not discussed “clawbacks.” Under Section 10D of the Securities Exchange Act (which was only recently added by the Dodd-Frank Act), clawbacks of incentive compensation are mandated if an issuer “is required to prepare an accounting restatement due to the material noncompliance of the issuer with any financial reporting requirements under the securities laws.”

“Material noncompliance” is exactly what happened here, and, in such event, Section 10D focuses on whether any current or former executive officer received any excess incentive compensation “during the 3-year period preceding the date on which the issuer is required to prepare an accounting restatement, based on erroneous data, in excess of what would have been paid to the executive officer.” Given that (1) clawbacks are becoming increasingly common, (2) JPMorgan did declare an accounting restatement in 2012 and (3) JPMorgan imposed severe clawbacks of roughly $100 million on all supervisory personnel in its London chief investment office, a similar approach on this side of the Atlantic might have been appropriate.

Even if fraud cannot be shown, the SEC could have asked for clawbacks — but did not. It was easier just to load the penalties onto the shareholders.

John C. Coffee Jr. is the Adolf A. Berle Professor of Law at Columbia Law School, where he is the director of its Center on Corporate Governance. A specialist in securities law, class actions and white -collar crime, he has testified frequently before Congress on those issues.  This post was originally published by the National Law Journal on October 7, 2013.