Regulatory bodies need to take into consideration size, age, and frequency of violation by the regulated in terms of exacting punishment on new entrants.
For instance; BigFin fintech company gets caught violating Anti-Money Laundering regulations. Big fine.
SmallFin fintech gets caught: slap on the wrist, thou shalt make a remediation plan, and here are the milestones you have to meet.
SmallFin continues doing business, but is on the regulators radar.
SmallFin caught again? Fine.
Now. Let's say SmallFin dissolves, but the key players move and incorporate as YetAnotherSmallFin (different Corp, mostly same people). Get caught? Regulators should look at the people who have been dinged before, and should know better, and regulation should be less forgiving based on that.
The fact is, a great deal gets hidden under "the Corporate Veil" that probably shouldn't be so easily divested from by those looking to abuse the system.
A regulator should by and large be a constructive guiding hand; not just ssmern as something to be worked around in the process of finding new and interesting ways to do shady things.
The catch here is you need to be able to attract high quality people to run the regulator, and I really have no solution for that.