If they did this closed source he probably wouldn't get jailed, and instead the company would have gotten fined. But open source makes things easy to trace so you just jail the person who wrote the code.
While they do get blamed, the Netherlands doesn't seem to care all that much. They seem very selective with how they react to supposed money laundering
https://www.reuters.com/article/us-ing-groep-settlement-mone...
https://www.dw.com/en/how-ing-bank-in-poland-helped-russians...
> ING’s Chief Executive Ralph Hamers said no individual at the bank was found to be responsible for the failures
Closed source means it is easy to hide whose fault it was, and then all you can do is fine the company since you can't arrest everyone. This is also why companies are so keen on deleting old message logs etc, to avoid leaders going to prison.