The potential administrative penalties would be in addition to the massive theft case that cost the company more than $20 million.