Issuers must implement Bank Secrecy Act compliance programs, conduct customer due diligence, and file suspicious activity reports.