The fine is just £500,000, but regulators say it should have been ‘significantly higher’