To supplement what Richard said, it's actually a two-tiered penalty system. There's one if you're actually the business using it. That's a significant monetary penalty. There's also a very significant penalty if you're actually a producer, promoter, and purveyor of these instruments.
The intent of the legislation is to get it out of the system, not to catch people with it. That's why I think the two-tiered approach works well. If you're providing it, there's a much harsher penalty than if you're a business caught with it.