SEC cannot prosecute criminal charges. What they can do is build a case and hand it over to DoJ/FBI for actual criminal prosecution (which as you said can take years).

The taint of an SEC investigation is enough to scare away most investors from the entity though. Which is really helpful.