Unregulated selling of securities has been a crime for a very long time. There are no ex-post issues at work here.

Is this ex-post facto? Its not like the law is new or that its suddenly illegal, people just weren't sure before if it was violating the law, which is really different from creating a new law.

I also think it's unlikely, but California did at one point revoke a tax exemption and applied that decision retroactively, expecting interest on unpaid taxes that the law at the time said you didn't owe. As I recall, this wasn't considered ex-post-facto simply because being fined for under paying taxes isn't the same thing as convicting someone as a crime, so the rule of law doesn't have to work the same way. You can take any constitutional protection and someone will come up with an argument in their head for why it doesn't apply to things they don't like.

Agency rules are not laws, and thus are not actually subject to the prohibition against ex post facto laws. Notably, if existing laws or rules would already apply to make activities illegal, and the new rules are simply making that explicit, the courts will upheld (criminal) charges based on the new rules.

Importantly, with agency rules, courts can and have looked at the "intent of the law" authorizing the agency's rules to uphold criminal convictions under newer agency rules that were technically within the scope of the rules at the time the acts were committed.

This happens all the time in the tax world; see for example the Bermudan tax loss harvesting scheme that got a lot of people sent to prison even though the schemes were technically within the rules at the time accounting firms started selling them to clients.