Good question. ICANN does audits where they cherry pick some domains and say "show me what the fuck happened in logs and prove you did the right things". However the audits are every 3 years or so and the domains are just random pickings. So it's up to a registrant that is wronged to file a complaint and then ICANN says something to the registrar and the registrar says something back and they close the case kind of like a residential noise complaint where the cops come out when called. There really aren't any minor punitive actions per se other than revoking accreditation which is major. And you would be correct in assuming that would be rare and ICANN first gives every chance for a registrar to correct the wrong doing. So you could in theory get away for this for years and if and when caught you would just get your act together and fix things up.

Note: I have been dealing with ICANN since the start and they tend to be pretty cool and fair with registrars but they do take complaints seriously and do follow up on them. Creates a ton and a pain of paperwork for registrars so that really is the negative to not complying in a way.