Minimum Internal Control Standards, 65506-65509 [2018-27651]

Agencies

• DEPARTMENT OF THE INTERIOR
• National Indian Gaming Commission

[Federal Register Volume 83, Number 245 (Friday, December 21, 2018)]
[Rules and Regulations]
[Pages 65506-65509]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-27651]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE INTERIOR

National Indian Gaming Commission

25 CFR Part 543

RIN 3141-AA60


Minimum Internal Control Standards

AGENCY: National Indian Gaming Commission, Interior.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The National Indian Gaming Commission (NIGC) amends its 
minimum internal control standards for Class II gaming under the Indian 
Gaming Regulatory Act to correct an erroneous deletion of the key 
control standards and to make other minor edits and additions for 
clarity.

DATES: Effective Date: January 22, 2019.

FOR FURTHER INFORMATION CONTACT: Jennifer Lawson at (202) 632-7003 or 
by fax (202) 632-7066 (these numbers are not toll free).

SUPPLEMENTARY INFORMATION: 

I. Background

    The Indian Gaming Regulatory Act (IGRA or Act), Public Law 100-497, 
25 U.S.C. 2701 et seq., was signed into law on October 17, 1988. The 
Act established the National Indian Gaming Commission (``NIGC'' or 
``Commission'') and set out a comprehensive framework for the 
regulation of gaming on Indian lands. On January 5, 1999, the NIGC 
published a final rule in the Federal Register called Minimum Internal 
Control Standards. 64 FR 590. The rule added a new part to the 
Commission's regulations establishing Minimum Internal Control 
Standards (MICS) to reduce the risk of loss because of customer or 
employee access to cash and cash equivalents within a casino. The rule 
contains standards and procedures that govern cash handling, 
documentation, game integrity, auditing, surveillance, and variances, 
as well as other areas.
    The Commission recognized from their inception that the MICS would 
require periodic review and updates to keep pace with technology and 
has substantively amended them numerous times, most recently in late 
2013 (78 FR 63873).

II. Development of the Rule

    On September 21, 2012, the Commission concluded nearly two years of 
consultation and drafting with the publication of comprehensive 
amendments, additions, and updates to Part 543, the minimum internal 
control standards (MICS) for Class II gaming operations (77 FR 58708). 
The regulations require tribes to establish controls and implement 
procedures at least as stringent as those described in

[[Page 65507]]

this part to maintain the integrity of the gaming operation. In late 
2013, the Commission published a final rule, adding kiosk drop, count, 
fill, and surveillance standards to Part 543 (78 FR 63873).
    Now, the Commission is finalizing additional revisions, largely 
technical in nature, that are meant to correct earlier editing 
oversights and to better clarify the intent of the provisions. The 
proposed rule was published June 8, 2018 (83 FR 26620), and the comment 
period expired July 9, 2018.

III. Review of Public Comments

    NIGC received the following comments in response to the proposed 
rule:
    Comment: One commenter recommended requiring an inventory under 
Sec.  543.10(e) if a table is open going into the next gaming day.
    Response: The standard requires a count at the end of each shift 
and the Commission notes that the majority of operations have shifts 
that coincide with their gaming days. Tribes have the option of 
requiring an additional count where a shift crosses over from one 
gaming day to the next.
    Comment: One commenter argued that it is too burdensome to require 
a supervisor to count the table inventory in Sec.  543.10(e).
    Response: Since its inception, Sec.  543.10(e) has required a 
supervisor to count the table inventory. The rule now also requires a 
supervisor to count the main card room bank.
    Comment: One commenter believed that the amendments eliminated 
kiosks from Sec.  543.17(j).
    Response: The kiosk provisions remain in the regulations and can be 
found at Sec. Sec.  543.17(i) (Kiosk count standards) and (j)(9): 
``Controls must be established and procedures implemented to safeguard 
the use, access, and security of keys for kiosks.''
    Comment: Two commenters expressed concern that Sec.  543.17(j)(4), 
which requires the key holder to be independent of those conducting the 
drop, would prevent those responsible for drops from having access to 
the keys necessary to conduct them. One commenter specifically 
identified the need for security personnel's assistance in emergency 
drops as problematic under these regulations because the security 
department holds the keys.
    Response: The term ``custody'' seems to have been confused with 
physical use of the key. Typically, security personnel are not used as 
drop agents: they only accompany the drop team as they remove Financial 
Instrument Storage Components. Occasionally, operations allow card 
tables to be dropped by a security agent and the shift supervisor.
    Custody involves more than just physical custody (i.e., stored in 
security room or other area controlled by security), and includes 
logical custody (i.e., I.T. controls of lock box). Additionally, the 
complete inventory records for the keys should be kept with accounting 
department.
    A separation of duties must be established for granting or limiting 
access to the keys, custody of the keys, and recordkeeping duties for 
the keys. Each operation is unique and, to maintain independence, 
security should either be precluded from acting as drop team agents or 
have limited control over the keys.
    Comment: One commenter requested clarification on Sec.  
543.17(j)(7), particularly whether it is intended to address emergency 
drop situations requiring immediate access.
    Response: The standard is meant to address emergency drop 
situations. Use of the keys outside the scheduled time for use includes 
an emergency drop. Other times can include, but are not limited to, 
inventory or replacement. The standard is intended to ensure security 
of the box contents and require proper authorization to issue of keys 
outside of the scheduled count.
    Comment: One commenter asked whether Sec.  543.17(j)(8) applies to 
manually-controlled key boxes, electronic boxes, or both, and whether 
removal of the player interface drop and count will need to meet 
requirements set forth for regularly scheduled drop and count (e.g. 
Sec.  543.17(e)(4)) in addition to these requirements.
    Response: The standard applies to computerized, electronic, and 
alternative key systems. A manual key system does not have an override 
key. In the event of power loss or other issue, the emergency manual 
keys allow access to the key box. These keys should be secured by other 
means and only accessed in an emergency.
    The removal of a financial instrument can occur during a regularly 
scheduled drop or an emergency drop. Standards are provided for each 
situation and the operation should determine which are appropriate to 
follow based on the circumstances.
    Comment: One Commenter asked whether Sec.  543.17(j)(8)(i) also 
applies to financial instrument storage components and drop boxes.
    Response: It does not. The standard applies to emergency manual 
keys. The standard later states at Sec.  543.17(j)(8)(iii) that if the 
player interface drop and count keys are not accessed, then only two 
agents are required: Those are the keys used for the financial 
instrument storage components and drop boxes.
    Comment: One commenter expressed a general concern that overly 
burdensome key controls lead to delay, customer frustration and 
inefficiency of the gaming operation and noted the need for balance 
between security and functionality.
    Response: The Commission agrees and believes it has done its best 
to strike a proper balance between protection of tribal assets and 
efficiency. These standards are consistent with those of other 
jurisdictions, but also allow some flexibility. Tribes and operation 
management must establish controls and implement procedures to best fit 
their needs and manage risks specific to their operations.
    Comment: One commenter believes Sec.  543.17(j)(6) is in conflict 
with Sec.  543.17(d)(4) and the entire key control process needs 
further clarification.
    Response: Without further discussion, it is unclear what conflict 
the commenter sees. The Commission believes the provisions can be read 
harmoniously. Section 543.17(j)(6) restricts access to drop box release 
keys to the count team and authorized agents.
    Section 543.17(j)(7) requires anyone using the keys outside of the 
scheduled drop and count time to be authorized--thereby becoming an 
authorized agent under (j)(6))--and documented. This allows for an 
emergency drop to be conducted by authorized agents so the drop team 
does not need to be called.
    Section 543.17 (d)(4) requires drop boxes to be removed only at the 
time previously designated by the gaming operation and reported to the 
TGRA, but it specifically allows for emergency drops, which require 
surveillance and TGRA to be notified.

IV. Regulatory Matters

Regulatory Flexibility Act

    The rule will not have a significant impact on a substantial number 
of small entities as defined under the Regulatory Flexibility Act, 5 
U.S.C. 601, et seq. Moreover, Indian Tribes are not considered to be 
small entities for the purposes of the Regulatory Flexibility Act.

Small Business Regulatory Enforcement Fairness Act

    The rule is not a major rule under 5 U.S.C. 804(2), the Small 
Business Regulatory Enforcement Fairness Act. The rule does not have an 
effect on the economy of $100 million or more. The rule will not cause 
a major increase in costs or prices for consumers, individual 
industries, Federal, State,

[[Page 65508]]

local government agencies or geographic regions, nor will the proposed 
rule have a significant adverse effect on competition, employment, 
investment, productivity, innovation, or the ability of the 
enterprises, to compete with foreign based enterprises.

Unfunded Mandate Reform Act

    The Commission, as an independent regulatory agency, is exempt from 
compliance with the Unfunded Mandates Reform Act, 2 U.S.C. 1502(1); 2 
U.S.C. 658(1).

Takings

    In accordance with Executive Order 12630, the Commission has 
determined that the rule does not have significant takings 
implications. A takings implication assessment is not required.

Civil Justice Reform

    In accordance with Executive Order 12988, the Commission has 
determined that the rule does not unduly burden the judicial system and 
meets the requirements of sections 3(a) and 3(b)(2) of the Order.

National Environmental Policy Act

    The Commission has determined that the rule does not constitute a 
major federal action significantly affecting the quality of the human 
environment and that no detailed statement is required pursuant to the 
National Environmental Policy Act of 1969, 42 U.S.C. 4321, et seq.

Paperwork Reduction Act

    The information collection requirements contained in this rule were 
previously approved by the Office of Management and Budget as required 
by 44 U.S.C. 3501, et seq., and assigned OMB Control Number 3141-0009. 
The OMB control number expires on November 30, 2018.

Tribal Consultation

    The National Indian Gaming Commission is committed to fulfilling 
its tribal consultation obligations--whether directed by statute or 
administrative action such as Executive Order (E.O.) 13175 
(Consultation and Coordination with Indian Tribal Governments)--by 
adhering to the consultation framework described in its Consultation 
Policy published July 15, 2013. The NIGC's consultation policy 
specifies that it will consult with tribes on Commission Action with 
Tribal Implications, which is defined as: Any Commission regulation, 
rulemaking, policy, guidance, legislative proposal, or operational 
activity that may have a substantial direct effect on an Indian tribe 
on matters including, but not limited to the ability of an Indian tribe 
to regulate its Indian gaming; an Indian tribe's formal relationship 
with the Commission; or the consideration of the Commission's trust 
responsibilities to Indian tribes.
    The key control language proposed here is the most substantive of 
all the changes and was the subject of extensive consultation in 2012 
(77 FR 58708). The language has not changed since initially adopted. It 
was inadvertently written over with the addition of kiosk controls in 
2013, and this rule is to include the controls back into the 
regulations. The remaining changes are all technical in nature, 
correcting numbering and adding minor clarifications.

List of Subjects in 25 CFR Part 543

    Accounting, Administrative practice and procedure, Gambling, 
Indian--Indian lands, Reporting and recordkeeping requirements.

    For the reasons discussed in the Preamble, the Commission amends 25 
CFR part 543 as follows:

PART 543--MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING

0
1. The authority citation for part 543 continues to read as follows:

    Authority: 25 U.S.C. 2702(2), 2706(b)(1-4), 2706(b)(10).


0
2. Amend Sec.  543.10 by revising paragraph (e) to read as follows:


Sec.  543.10  What are the minimum internal control standards for card 
games?

* * * * *
    (e) Standards for reconciliation of card room bank. Two agents--one 
of whom must be a supervisory agent--must independently count the main 
card room bank and table inventory at the end of each shift and record 
the following information:
    (1) Date;
    (2) Shift;
    (3) Table number (if applicable);
    (4) Amount by denomination;
    (5) Amount in total; and
    (6) Signatures of both agents.
* * * * *

0
3. Amend Sec.  543.17 by revising paragraphs (d), (i)(4)(i), and (j) to 
read as follows:


Sec.  543.17  What are the minimum internal control standards for drop 
and count?

* * * * *
    (d) Card game drop standards. Controls must be established and 
procedures implemented to ensure security of the drop process. Such 
controls must include the following:
    (1) Surveillance must be notified when the drop is to begin so that 
surveillance may monitor the activities.
    (2) At least two agents must be involved in the removal of the drop 
box, at least one of whom is independent of the card games department.
    (3) Once the drop is started, it must continue until finished.
    (4) All drop boxes may be removed only at the time previously 
designated by the gaming operation and reported to the TGRA. If an 
emergency drop is required, surveillance must be notified before the 
drop is conducted and the TGRA must be informed within a timeframe 
approved by the TGRA.
    (5) At the end of each shift:
    (i) All locked card game drop boxes must be removed from the tables 
by an agent independent of the card game shift being dropped;
    (ii) For any tables opened during the shift, a separate drop box 
must be placed on each table, or a gaming operation may utilize a 
single drop box with separate openings and compartments for each shift; 
and
    (iii) Card game drop boxes must be transported directly to the 
count room or other equivalently secure area by a minimum of two 
agents, at least one of whom is independent of the card game shift 
being dropped, until the count takes place.
    (6) All tables that were not open during a shift and therefore not 
part of the drop must be documented.
    (7) All card game drop boxes must be posted with a number 
corresponding to a permanent number on the gaming table and marked to 
indicate game, table number, and shift, if applicable.
* * * * *
    (i) * * *
    (4) * * *
    (i) The count of each box must be recorded in ink or other 
permanent form of recordation.
* * * * *
    (j) Controlled keys. Controls must be established and procedures 
implemented to safeguard the use, access, and security of keys in 
accordance with the following:
    (1) Each of the following requires a separate and unique key lock 
or alternative secure access method:
    (i) Drop cabinet;
    (ii) Drop box release;
    (iii) Drop box content; and
    (iv) Storage racks and carts used for the drop.
    (2) Access to and return of keys or equivalents must be documented 
with the date, time, and signature or other

[[Page 65509]]

unique identifier of the agent accessing or returning the key(s).
    (i) For Tier A and B operations, at least two (2) drop team agents 
are required to be present to access and return keys. For Tier C 
operations, at least three (3) drop team agents are required to be 
present to access and return keys.
    (ii) For Tier A and B operations, at least two (2) count team 
agents are required to be present at the time count room and other 
count keys are issued for the count. For Tier C operations, at least 
three (two for card game drop box keys in operations with three tables 
or fewer) count team agents are required to be present at the time 
count room and other count keys are issued for the count.
    (3) Documentation of all keys, including duplicates, must be 
maintained, including:
    (i) Unique identifier for each individual key;
    (ii) Key storage location;
    (iii) Number of keys made, duplicated, and destroyed; and
    (iv) Authorization and access.
    (4) Custody of all keys involved in the drop and count must be 
maintained by a department independent of the count and the drop agents 
as well as those departments being dropped and counted.
    (5) Other than the count team, no agent may have access to the drop 
box content keys while in possession of storage rack keys and/or 
release keys.
    (6) Other than the count team, only agents authorized to remove 
drop boxes are allowed access to drop box release keys.
    (7) Any use of keys at times other than the scheduled drop and 
count must be properly authorized and documented.
    (8) Emergency manual keys, such as an override key, for 
computerized, electronic, and alternative key systems must be 
maintained in accordance with the following:
    (i) Access to the emergency manual key(s) used to access the box 
containing the player interface drop and count keys requires the 
physical involvement of at least three agents from separate 
departments, including management. The date, time, and reason for 
access, must be documented with the signatures of all participating 
persons signing out/in the emergency manual key(s);
    (ii) The custody of the emergency manual keys requires the presence 
of two agents from separate departments from the time of their issuance 
until the time of their return; and
    (iii) Routine physical maintenance that requires access to the 
emergency manual key(s), and does not involve accessing the player 
interface drop and count keys, only requires the presence of two agents 
from separate departments. The date, time, and reason for access must 
be documented with the signatures of all participating agents signing 
out/in the emergency manual key(s).
    (9) Controls must be established and procedures implemented to 
safeguard the use, access, and security of keys for kiosks.
* * * * *

0
4. Amend Sec.  543.18 by revising paragraph (d)(6)(v) to read as 
follows:


Sec.  543.18   What are the minimum internal control standards for the 
cage, vault, kiosk, cash and cash equivalents?

* * * * *
    (d) * * *
    (6) * * *
    (v) Dollar amount per financial instrument redeemed;
* * * * *

0
5. Amend Sec.  543.23 by revising paragraph (c)(1)(viii) to read as 
follows:


Sec.  543.23  What are the minimum internal control standards for audit 
and accounting?

* * * * *
    (c) * * *
    (1) * * *
    (viii) Drop and count standards, including supervision, count room 
access, count team, card game drop standards, player interface and 
financial instrument drop standards, card game count standards, player 
interface financial instrument count standards, collecting currency 
cassettes and financial instrument storage components from kiosks, 
kiosk count standards, and controlled keys;
* * * * *

0
6. Amend Sec.  543.24 by revising paragraphs (a) and (d)(5) to read as 
follows:


Sec.  543.24  What are the minimum internal control standards for 
auditing revenue?

    (a) Supervision. Supervision must be provided as needed for revenue 
audit by an agent(s) with authority equal to or greater than those 
being supervised.
* * * * *
    (d) * * *
    (5) Complimentary services or items. At least monthly, review the 
reports required in Sec.  543.13(c). These reports must be made 
available to those entities authorized by the TGRA or by tribal law or 
ordinance.
* * * * *

    Washington, DC.

    Dated: December 12, 2018.
Jonodev O. Chaudhuri,
Chairman.
    Dated: December 12, 2018.
Kathryn Isom-Clause,
Vice Chair.
    Dated: December 17, 2018.
E. Sequoyah Simermeyer,
Associate Commissioner.
[FR Doc. 2018-27651 Filed 12-20-18; 8:45 am]
 BILLING CODE 7565-01-P