Use this as an operating checklist—not as a legal opinion that your organization is compliant.
Official statute: BPC §18975