I'd argue that the person running the company in this case is responsible. Now they may argue that they didn't know - but you can frame the law such that's it'

I'd argue that the person running the company in this case is responsible. Now they may argue that they didn't know - but you can frame the law such that's it's their duty to know and ensure this sort of stuff doesn't happen. cf Sarbanes-Oxley