Under the Uniform Securities Act, a party who is harmed through, say, a fraudulent offer of securities, may file a civil action if it is filed within 2 years of discovery or 3 years from the event, whichever comes first. Therefore, if the party has known about the illegal nature of the sale for more than 2 years, it is too late to sue. Or, if the sale took place more than 3 years ago, it is also too late to take civil action.
Not many criminal cases arise out of state securities law, but those that do must be filed by the State within 5 years of occurrence, which is how it works for most crimes other than homicide/manslaughter and a few others.