When we tabled our position paper in 2019, we did mention other options. One was enforceable agreements with institutions. This can work just as well with federally regulated companies.
It would then be possible to issue compliance orders.
I think the question of administrative monetary penalties is on the table. It's interesting, but I think it really would apply more to the corporate side than to federal institutions. Federal institutions are a “take money from Peter to pay Paul” kind of thing.