Regulator brought 19 charges against two subsidiaries, each with a maximum penalty of $1.1m