In what instance is a CEO not liable for their own crimes? At least in the US, they are still criminally liable for anything they do. If anything is at issue here, I think it's whether it can be proven a crime was committed and who can be proven guilty of it. I think often civil penalties end up being the answer because they're just easier to make stick (AIUI the burden of proof is lower in those cases).