Sanctions enforcement has changed. Regulators now ask a tougher question: should firms have detected the risk before the breach happened?