Especially in regards to expensive numbers, some critics go so far and say they got an "employment ban". They are not soft at all. But obviously they can only react.
They could just do the same thing the FCC does: threaten the providers with revoking their licenses unless they get their KYC in order and do spam detection & prevention.
They're fining ~20 companies per year for spam and have shut down a few numbers and stopped billing on a few foreign premium numbers. Other than that: nothing. They're simply ignoring the companies that are complicit.
If they're not the right organization to enforce rules, that's fine, let's create one that does and hasn't been closely embedded within the industry for the past decades.
Especially in regards to expensive numbers, some critics go so far and say they got an "employment ban". They are not soft at all. But obviously they can only react.