(1) At least 45 days prior to commencing
operations, a Sports Wagering Operator shall submit to the Commission its
proposed system of Internal Controls, consisting of procedures and
administrative and accounting controls, in accordance with
205
CMR 238.02(4). An Operations
Certificate shall not issue until the Operator's Internal Controls are approved
in accordance with
205
CMR 238.02(2).
(2) A system of Internal Controls shall be
organized and formatted as required by the Commission.
(3) The Commission shall refer the proposed
system of Internal Controls submitted in accordance with
205
CMR 238.02(1) to the
Executive Director, who shall review the submission for compliance with M.G.L.
c. 23N and 205 CMR. Upon completion of review, the Executive Director shall, in
writing, either approve the submission or advise the Sports Wagering Operator
of any deficiency, and any corresponding recommendation or required change. The
Executive Director may include any other recommendations or required changes
intended to ensure that a robust system of Internal Controls is implemented by
the Sports Wagering Operator. The Sports Wagering Operator may, by writing to
the Executive Director, either accept a recommendation or required change or
dispute the recommendation or required change. If the Sports Wagering Operator
disputes the recommendation or required change, the Sports Wagering Operator
shall also provide the reason(s) for its dispute. Any such dispute shall be
resolved by the Commission.
(4) The
Commission or the Executive Director may revisit any provision of a Sports
Wagering Operator's Internal Controls at any time and render recommendations
and required changes as necessary. If the Commission or Executive Director
renders any such recommendations and required changes, the Commission or
Executive Director shall provide the Sports Wagering Operator a reasonable
period to implement any such recommendations and required changes. Upon
approval by the Executive Director, the Executive Director shall issue a
written approval to the Sports Wagering Operator, including any associated
conditions.
(5) If a Sports
Wagering Operator seeks to change any provision of its approved Internal
Controls, the Sports Wagering Operator shall submit the proposed change,
including an explanation thereof, and new certifications from its chief legal
and financial officers consistent with
205
CMR 238.02(7)(i) and (j), to
the Commission within 15 days of determining that such a change is necessary.
The Commission shall refer the proposed change to the Executive Director who
shall review the proposal for compliance with
205 CMR
238.00. Changes to the system of Internal Controls
will generally be permitted if the proposed change does not lessen the
applicable administrative, accounting, or physical control the Sports Wagering
Operator has over its operations in the Commonwealth. Upon completion of
review, the Executive Director shall either approve the proposed change or
advise the Sports Wagering Operator in writing as to why the proposal does not
comply with
205 CMR
238.00. The Sports Wagering Operator may appeal the
Executive Director's determination to the Commission, which shall resolve the
dispute. Approved changes shall be maintained as part of the approved Internal
Controls.
(6) A Sports Wagering
Operator shall not implement modifications to Internal Controls until approved
by the Executive Director or the Commission. Until such time, the Sports
Wagering Operator shall continue to implement the most recently approved
Internal Controls; provided, however, that if the Executive Director does not
object to or otherwise respond to the submission in writing within 15 business
days of receipt of the submission, the Sports Wagering Operator may implement
the proposed change subject to further direction by the Executive Director in
accordance with
205
CMR 238.02(4).
(7) The Internal Controls shall, at a
minimum, include the following:
(a)
Administrative controls which include, as their primary objective, policies and
procedures designed to assure that all activities and transactions of the
Sports Wagering Operator are instituted and completed in accordance with
applicable policy or procedure;
(b)
Accounting controls which include, as their primary objective, procedures to
assure that all activities and transactions of the Sports Wagering Operator are
accurately reported and recorded in accordance with generally accepted
accounting principles;
(c)
Reporting controls which include policies and procedures for the timely
furnishing of economic and social impact reports, and standard financial and
statistical reports and information in accordance with 205 CMR, and the
continuing disclosure and reporting obligations of licensees;
(d) For Category 1 Sports Wagering Operators
and Category 2 Sports Wagering Operators, the Internal Controls required for a
gaming establishment as specified in
205 CMR
138.00:
Uniform Standards of Accounting
Procedures and Internal Controls shall apply to a Sports Wagering Area
and Sports Wagering Facility. Where compliance with the provisions of both
205 CMR
138.00 and
205 CMR
238.00 is not possible, a Gaming Licensee or Sports
Wagering Operator shall comply with
205 CMR
138.00 with respect to gaming operations and
205 CMR
238.00 with respect to Sports Wagering Operations and
identify its intent to do so in its written system of Internal Controls;
provided, that:
1. in a Category 2 Sports
Wagering Facility, an individual supervising a surveillance department
monitoring room in accordance with
205
CMR 138.04(2)(a) shall hold
an Occupational License in accordance with
205 CMR
235.00 rather than being licensed as a key gaming
employee in accordance with
205 CMR
134.00: Licensing and Registration of
Employees, Vendors, Junket Enterprises and Representatives, and Labor
Organizations;
2. in a
Category 2 Sports Wagering Facility, the security department internal control
procedures required by
205
CMR 138.14: Internal Control
Procedures for Security Department shall include a requirement that
the facility be protected by security staff at all times, including overnight;
and
3. in a Category 2 Sports
Wagering Facility, the floor plan required by
205
CMR 138.07: Floor Plans
shall depict adequate space for law enforcement officers; for the Bureau and
Sports Wagering Division; and for designated agents for the purposes of
205 CMR
133.00 and
233.00;
(e) Access controls which include, as their
primary objective, the safeguarding of the Operator's assets, including but not
limited to, organizational safeguards, such as segregation of duties between
incompatible functions, and physical safeguards, such as restricted access to
assets and routine security devices such as cameras and locking doors. Such
access controls shall be consistent with the requirements in
205 CMR
141.00: Surveillance of the Gaming
Establishment regarding surveillance of gaming
establishments;
(f) An
infrastructure and data security plan which employs technical security controls
as described in
205
CMR 243.01: Standards for Sports
Wagering Equipment;
(g) A
plan to ensure compliance with
205 CMR
240.00: Adjusted Gross Sports Wagering and
Adjusted Gross Fantasy Wagering Receipts Tax Remittance and Reporting
with respect to tax remittance and reporting;
(h) All applicable policies and procedures
required pursuant to
205
CMR 238.04 through
238.72 and procedures and
practices specified in
205 CMR
243.00: Standards for Sports Wagering
Equipment;
(i) A
certification by the Sports Wagering Operator's chief legal officer that the
submitted Internal Controls conform to M.G.L. c. 23N,
205
CMR 238.01, and any applicable regulations
referenced therein;
(j) A
certification by the Sports Wagering Operator's chief financial officer that
the submitted Internal Controls provide adequate and effective controls,
establish a consistent overall system of internal procedures and administrative
and accounting controls, and conform to generally accepted accounting
principles and 205 CMR;
(k) A plan
to ensure compliance with the Operator's House Rules, including House Rules
that comply with
205 CMR
243.00: Sports Wagering
Equipment.
(l) A plan, as
required by
205 CMR
257.00: Data Privacy, to safeguard
Confidential Information and Personally Identifiable Information and to ensure
compliance with the requirements of
205 CMR
257.00, M.G.L. c. 93H, M.G.L. c. 93I,
201 CMR
17.00: Standards for the Protection of
Personal Information of Residents of the Commonwealth, and any other
applicable law, regulation or order of a governmental body regarding data
privacy and security; and
(m) A
description of the Operator's use of computerized algorithms, automated
decision-making, machine learning, artificial intelligence, or any similar
system, which shall include, at a minimum a description of permissible and
impermissible uses of such practices and capabilities, the purposes for which
they are used and the types of input and output data and an accounting of the
source of each, and a description of how the Operator may use such systems to
minimize risky play behavior.
(8) If the Sports Wagering Operator intends
to utilize any new technology not identified in its initial Internal Controls
proposal, it shall submit the changes to its system of Internal Controls to
incorporate the use of any such new technology to the Commission, which shall
refer the proposed change to the Executive Director who shall review the
proposal in accordance with
205
CMR 238.02(4).
(9)
(a) If
a Sports Wagering Operator seeks to incorporate a provision in its Internal
Controls that is not permitted under
205 CMR
238.00, or to exclude a provision required by
205 CMR
238.00, it may petition the Executive Director for
permission to do so by including, in its Internal Controls filing, its proposal
or petition to change a provision of the Internal Controls in accordance with
238.02(5), along with a citation to the applicable provision of
205 CMR
238.00 and a written explanation as to why the
exemption is appropriate. The Executive Director may allow the exemption upon a
finding that the proposal is at least equivalent to the exemption, identifying
the provision of
205 CMR
238.00 from which an exemption was granted and
providing the general reason for granting the exemption.
(b) In the event that a Sports Wagering
Operator is temporarily unable to abide by a provision of its Internal
Controls, the Bureau may, upon written request by the Sports Wagering Operator,
grant a limited temporary exemption from a provision of the Sports Wagering
Operator's Internal Controls, provided that:
1. such exemption shall not to exceed 48
hours;
2. the provision relates to
the operation of Sports Wagering; and
3. the exemption is supported by good cause
showing that the health, safety or welfare of the public or the integrity of
Sports Wagering will not be adversely impacted by the exemption. Where the
circumstances warrant, such an exemption may be renewed by the Bureau for one
additional 48-hour period. All such requests and determinations shall be
documented and submitted to the Executive Director for review as promptly as
possible.
(10)
The Commission and the Bureau may take any steps necessary to investigate and
enforce a Sports Wagering Operator's Internal Controls for compliance with
205 CMR
238.00. The Sports Wagering Operator shall, through
either independent or internal auditors, periodically compare its approved
system of Internal Controls, as written, to the system actually in place and
operating for the purpose of identifying areas of noncompliance, if any, so as
to take immediate corrective action.
(11) The Commission or its designee may
perform any inspection necessary in order to determine conformance with the
approved Internal Controls.
(12)
The Sports Wagering Operator shall maintain in its records a complete set of
its system of Internal Controls in effect at that time.
(13) The Sports Wagering Operator shall
submit all filings and records required pursuant to
205 CMR
238.00 electronically to the Commission, unless
otherwise directed by the Commission.
(14) To the extent a third-party is involved
in or provides any of the Internal Controls required pursuant to
205 CMR
238.00, the Sports Wagering Operator's Internal
Controls shall document the roles and responsibilities of the third-party and
shall include procedures to evaluate the adequacy of and monitor compliance
with the third-party's system of Internal Controls.
