Recertify and audit immediately. Then once safe, hold individual meetings and address as a disciplinary issue.
Your immediate pressing problem is that right now you have important team members and projects being handled uncertified , and they have been for a while. Depending on the industry that could be anything from humiliation to death of the business to criminal action. So we need to safeguard the business first.
Citing "irregularities", generic "issues", handwaving due to covid, or any other reason, retest and recertify everyone - involved or not.
Also audit work done since the cheating, for any disclosure or quality issue. That could be expensive but its essential for liability coverage, since the mere fact of non certification may mean liability if you can't show the work is okay.
Those two steps, means that you are now valid to work, and that if any issue comes out you now have damage control. At worst "yes there were lapses in certification, but the employees concerned were immediately recertified and their interim few months work rechecked." That should safeguard the business and its reputation, against the worst outcomes.
Once that is done, call the people involved in one by one, with the ringleaders first. Tell them exactly what you know, so its on their employment records as gross breach of contract. Tell them that the matter has now been fixed, the company lost X amount over it, or Y per person involved. Offer them an ultimatum/deal:
- The company clearly is horrified and disappointed, and has been defrauded. They may not realise it was a criminal act as well as a firing offence. Point out it was,and that it threatens their career, what were they thinking!. (Which is what that is: the staff faked qualification status via cheated exams, to keep employment, which they didn't have. That's fraud.)
- Clearly people are now qualified again. So we can carry on, and we hope life will continue. We need our team, most of our team want to stay not go.
- But the matter cannot be left unaddressed. Coverups usually come out (by rumour if no other way). They put everyone's jobs at risk. There will be a gross misconduct record on employee files. The company is not presently intending criminal action but may need to if it recurs. And of course those involved will forgo financially, to make clear the seriousness of the matter(bonuses, foregone pay, whatever). Alternatively they may accept leaving without pay or notice.
- ideally fire some ringleaders if you can afford to. Or "glass ceiling" them if not. They'll get the hint at next years annual review, but by then, too late.
- state explicitly that this will close the books provided nothing else happens.
The aim of this is to keep the bulk of your team, but establish/impress the seriousness, and that your company is not a soft touch over it. Grumbling and resentment but most will understand it's fair, and be grateful it wasn't worse.
By doing it this way round, you remove the threat of up-front resignation/blackmail/"over a barrel". Your team are now recertified so they are invested in continuing paid work. The minority you lose won't fatally harm operations. They can be replaced.
If you aren't a jerk, after a while you'll be humming along again.
To be clear, this is ruthless but pragmatic. The question explicitly asks how to "punish the act" without harming the business. I take "punish" to mean "make a strong impression" and address the misconduct, not "be a vindictive jerk".
As described, the choice facing your team members at the 1 on 1 disciplinary meetings will be, they have their jobs and certifications back. They are told there will be penalties (lost income, gross misconduct on file). If they stay, they lose money (but know its "really" fair), but guaranteed to keep their job and income, are certified, and subject is closed. If they decline and leave, they have no job, and have to also worry what their next employer will be told - can they even get another job? Will they lose their ability to work in the industry?
Its for that reason I believe that despite grumbles they'll stay. They've already invested their time in recertification,and are still working. Their cheating is known and yet unexpectedly they have a path to recover from it, which is generous and unusual. The grumbles will be diluted over time because they'll mostly know its fair and also want it to stay closed. And that's the importance of genuinely welcoming them back and not being a jerk, to further dilute any remaining resentment.