It depends. SOX compliance, if they were, actually literally does say the CFO and other officers who signed off on their accounting are liable. That’s the point of SOX. Synapse itself likely wasn’t unless it was preparing for IPO but their banking partners might be.

Their primary partner Evolve bank is not, but it is held to legal standards by the FDIC and other banking regulators and their lack of controls is probably where you might see executive management facing criminal challenges.

However everyone involved could face civil penalties.

If history had been different it’s likely this event would have turned up regulatory scrutiny on fintech precisely for these reasons - a privately held fintech can basically just fuck around and pretend to be a bank leveraging a poorly managed licensed partner holding the risk and abscond through incompetence with everyone’s money and no one suffer a consequence other than the customers. Sadly I don’t expect this to change in the next four years and there’s every reason to believe accountability will get worse as existing regulations and enforcement are potentially gutted. So caveat emptor is likely the law of the land until something so huge happens it can’t be ignored.