Why is this only a civil SEC investigation? This should also have an FBI / criminal component. Perhaps it is coming later like it did with Theranos and Experian.
The civil SEC case normally comes first because the SEC investigation can have two outcomes, that often come together: civil charges by the SEC and a criminal referral to the Justice Department which then triggers a criminal investigation. But the referral itself is not generally public, and Justice doesn't usually talk a lot about investigations until/unless they file charges.