The airline is responsible, and the Captain represents the airline
To clear this up a bit:
The PIC is responsible for "the safe conduct of the flight", including all its phases. The airline is responsible towards all authorities for adherence to applicable rules and legislation, and needs to demonstrate that there are adequate processes in place to ensure full compliance. For procedures (or lack thereof) that reach beyond the scope of a single flight, it is the postholders of an airline (CEO, head of Flight Ops, Maintenance, etc.) who are criminally responsible.
In a commercial operation security screening (and passenger declaration) is in place to ensure there are no items posing a threat to flight safety in checked baggage. Unless actually aware of a breach, the PIC may reasonably assume that the procedures are working - just like you may reasonably assume a load-sheet or wx report is accurate if supplied by flight ops. You will only be accountable if you knowingly operate a flight with an unsafe condition (which obviously was not the case with Pan Am). The case against the Embraer pilots in Brazil hinged on them switching off TCAS, thus KNOWINGLY creating an unsafe condition which directly contributed to the accident. Of course whether intentionally or not may be argued, but the fact remains they did.
With private operations the PIC is directly responsible for everything. Again, in a criminal case any act must be either willful and knowing to be prosecutable, or be a direct result of gross negligence (i.e. lack of customary and expectable attention and oversight). I would say if crossing the Atlantic 3x with 20+ suitcases and one only passenger, with Dominica as the departure point, it is a rather weak defence that they had no clue...