The definition of what constitutes criminality is defined by statute law which is enacted (written into the statute book) by our political representatives.
Statute law is then interpreted by the judiciary when trying actual cases in a court of law. This is 'case law' which sets precedents for trials that come thereafter.
What constitutes criminality is pretty fluid these days. In recent history some major financial institutions have been clearly shown to have broken the law. They were never prosecuted. Our governments simply changed the law retrospectively to accomodate the banks and make their malpractice legal after the fact.