Back when the Financial Crisis Inquiry Commission was doing its work, I would check in periodically with someone who worked there to find out how it was going.

"Good news!" my source would joke. "We got the guy who caused it."

That is the way I felt last week when the Securities and Exchange Commission announced that it had, well, agreed to a measly $285 million settlement with Citigroup over the bank having misled its own customers in selling an investment it created out of mortgage securities as the housing market was beginning its collapse.

In addition, the S.E.C. accused one person -- a low-level banker. Hooray, we finally got the guy who caused the financial crisis! The Occupy Wall Street protestors can now go home.

After years of lengthy investigations into collateralized debt obligations, the mortgage securities at the heart of the financial crisis, the only individuals the S.E.C. has brought civil actions against for involvement in those transactions are half a dozen small-timers. But compared with the Justice Department, the S.E.C. is the second coming of Eliot Ness. No major investment banker has been brought up on criminal charges stemming from the financial crisis.

To understand why that is so pathetic and -- worse -- corrupting, we need to briefly review what went on in C.D.O.'s in the years before the crisis. By 2006, legions of Wall Street bankers had turned C.D.O.'s into vehicles for their own personal enrichment, at the expense of their customers.

These bankers brought in savvy (and cynical) investors to buy pieces of the deals that they could not sell. These investors bet against the deals. Worse, they skewed the deals by exercising influence over what securities went into the C.D.O.'s, and they pushed for the worst possible stuff to be included.

The investment banks did not disclose any of this to the investors on the other side of the deals, or if they did, they slipped a vague, legalistic disclosure sentence into the middle of hundreds of pages of dense documentation. In the case brought last week, Citigroup was selling the deal, called Class V Funding III, while its own traders were filling it up with garbage and betting against it.

By the S.E.C.'s own investigations of and settlements with Goldman Sachs, JPMorgan Chase and Citigroup, and by reporting like my ProPublica work with Jake Bernstein and earlystories by The Wall Street Journal, we know that these breaches were anything but isolated. This was the Wall Street business model. (Goldman, JPMorgan and Citigroup were all able to settle without admitting or denying anything, which, of course, is part of the problem.)

Neither the Citigroup settlement nor any of the others come close to matching the profits and bonuses that these banks generated in making these deals. And low-level bankers did not, and could not, act alone. They were not rogues, hiding things from their bosses.

Last week's S.E.C. complaint makes clear that the low-level Citigroup banker that it sued, Brian H. Stoker, had multiple conversations with his superiors about the details of Class V. At one point, Mr. Stoker's boss pressed him to make sure that their group got "credit" for the profits on the short that was made by another group at the bank.

Pause, and think about that. The boss was looking for credit, but as far as the S.E.C. was concerned, he got no blame.

The S.E.C. did not respond to a request for comment, so we are left to wonder what explains its failure to reckon adequately with the pervasive problems. Contrary to expectations, the embattled and oft-assailed agency has done almost everything right with structured finance investigations, taking aim at abuses related to C.D.O.'s and other complex deals.

The S.E.C. has also devoted adequate resources to the issue. It put together a special task force on structured finance, sending the proper signal of the agency's priorities both internally and externally. The task force is staffed by bright people, an invigorating mix of young go-getters and experienced hands. Those people have understood for years what was wrong with the C.D.O. business on Wall Street.

O.K., so what is it? Risk aversion.

Based on the major cases the S.E.C. has brought, a pattern has emerged. It is making one settlement per firm and concentrating on only the safest, most airtight cases. The agency's yardstick seems to be, who wrote the stupidest e-mail? Mr. Stoker of Citigroup wrote an incriminating e-mail that recommended keeping one crucial participant in the dark. Goldman's Fabrice Tourre, the other functionary the agency has sued, wrote dumb things to his girlfriend.

But the S.E.C is not the G-mail G-man. It is the securities police. Imprudent e-mailing is not the only way to commit securities fraud.

Maybe the agency hopes that private litigation will take up the slack. It cannot investigate and wring a prosecution or settlement out of every corrupt deal. Instead, it has long aimed to plant a flag and let private litigants take care of the rest.

But private litigation has failed. One problem is that the defrauded institutions often committed their own sins. In a monstrous daisy chain, C.D.O.'s bought pieces of other C.D.O.'s. These investments were run by management companies. They might have been the victim in one C.D.O., but complicit in the predations of another.

Other victims, like large financial institutions and money managers, do not want to sue because it could reveal their own compromised behavior. Or they would be revealing to customers that they had simply been taken by other, smarter bankers. You cannot very well convince people that you are a good steward of their money if you are simultaneously complaining that the Wall Street sharpies fleeced you.

And private litigation has changed in the last decade and a half. The Private Securities Litigation Reform Act of 1995, which was meant to make class-action lawsuits harder to bring, has had a spillover effect beyond those cases, according to plaintiffs' lawyers. Courts have raised the bar for securities fraud cases, even where the act does not apply. The rules color how judges look at financial disputes.

So the S.E.C. has the wrong approach.

This is a matter of will and leadership. Its chairwoman, Mary L. Schapiro, while deserving credit for pushing investigations of structured investments, is sending the signal that she does not want to lose. Her agency is meekly willing to get token settlements when the situation calls for Old Testament justice.

Someday, the S.E.C. will have to go up against a top executive who has resources to fight, and who was too sophisticated to put anything rash in writing. This seems to be our fate: our bankers took reckless risks, but our regulators take none.

Clarification (11/09):A sentence in this story referred incompletely to actions taken against individuals. It has been updated to show that the agency has sued four other people in addition to the two bankers originally referred to in that sentence.