Seems like a pretty generous settlement, doesn't it? He just had to give back the money. The "permanent officer-and-director bar" is there to prevent him from continuing to defraud people, but he really didn't have to pay an actual fine at all.
The SEC does not itself have the power to engage in criminal prosecutions; it refers cases to the justice department (or other law enforcement agencies) for prosecution. That's why you always see these sort of consent decrees ("here's some money and I promise not to do it again") from the SEC.
This guy is going to jail (err, is already in jail) but it's not the SEC's job to put him there.
I want them to know they'll lose everything they gained if they're caught. I don't want them coming up with ever more clever and socially destructive ways to avoid being caught because of harsh penalties.