Current through Register Vol. 54, No. 44, November 2, 2024
(a) At
least 90 days prior to commencing interactive gaming under this part, an
interactive gaming certificate holder or interactive gaming operator shall
submit to the Board for approval internal controls for all aspects of
interactive gaming prior to implementation and any time a change is made
thereafter. The internal controls must include detailed procedures for system
security, operations, accounting, and reporting of compulsive and problem
gamblers.
(b) Notwithstanding
subsection (a), the procedures and controls may be implemented by an
interactive gaming certificate holder or interactive gaming operator upon the
filing of the procedures and controls with the Board. Each procedure or control
submission must contain narrative and diagrammatic representations of the
system to be utilized and must include all of the following:
(1) Procedures for reliable accounting
controls, including the standardization of forms and definition of terms to be
utilized in the interactive gaming operations.
(2) Procedures, forms and, when appropriate,
formulas to govern all of the following:
(i)
Calculation of hold percentages.
(ii) Revenue drops.
(iii) Expense and overhead
schedules.
(iv) Complimentary
services.
(v) Cash-equivalent
transactions.
(3) Job
descriptions and the system of personnel and chain of command establishing a
diversity of responsibility among employees engaged in interactive gaming
operations, including employees of an interactive gaming operator, and
identifying primary and secondary management and supervisory positions for
areas of responsibility, salary structure and personnel practices.
(4) Procedures for the registration of
players and establishment of interactive gaming accounts, including a procedure
for authenticating the age, identity and physical address of an applicant for
an interactive gaming account and whether the applicant is a person prohibited
from establishing or maintaining an account under section 13B22 of the act
(relating to establishment of interactive gaming accounts).
(5) Procedures for terminating a registered
player's interactive gaming account and the return of any funds remaining in
the interactive gaming account to the registered player.
(6) Procedures for suspending or terminating
a dormant interactive gaming account and the return of any funds remaining in
the dormant interactive gaming account to the registered player.
(7) Procedures for the logging in and
authentication of a registered player to enable the player to commence
interactive gaming and the logging off of the registered player when the player
has completed play, including a procedure to automatically log a registered
player out of the player's interactive gaming account after a specified period
of inactivity.
(8) Procedures for
the crediting and debiting of a registered player's interactive gaming
account.
(9) Procedures for cashing
checks, receiving electronic negotiable instruments, and redeeming chips,
tokens or other cash equivalents.
(10) Procedures for withdrawing funds from an
interactive gaming account by the registered player.
(11) Procedures for the protection of a
registered player's funds, including the segregation of a registered player's
funds from operating funds of the interactive gaming certificate holder or
interactive gaming operator.
(12)
Procedures for recording transactions pertaining to interactive
gaming.
(13) Procedures for the
security and sharing of personal identifiable information of a registered
player, funds in an interactive gaming account and other information as
required by the Board. The procedures must include the means by which an
interactive gaming certificate holder or interactive gaming operator will
provide notice to a registered player related to the sharing of personal
identifiable information.
(14)
Procedures and security for the calculation and recordation of
revenue.
(15) Procedures for the
security of interactive gaming devices and associated equipment.
(16) Procedures and security standards as to
receipt, handling, and storage of interactive gaming devices and associated
equipment.
(17) Procedures and
security standards to protect the interactive gaming certificate holder's or
interactive gaming operator's interactive gaming skin or interactive gaming web
site and interactive gaming devices and associated equipment from hacking or
tampering by any person.
(18)
Procedures for responding to suspected or actual hacking or tampering with an
interactive gaming certificate holder's or interactive gaming operator's
interactive gaming skin or interactive gaming web site and interactive gaming
devices and associated equipment, including partial or complete suspension of
interactive gaming or the suspension of any or all interactive gaming accounts
when warranted.
(19) Procedures to
verify each registered player's physical location each time a registered player
logs into his interactive gaming account and at appropriate intervals
thereafter as determined by the Board.
(20) Procedures to ensure that the
interactive games are fair and honest and that appropriate measures are in
place to deter, detect and, to the extent possible, prevent cheating, including
collusion and use of cheating devices, including the use of software programs
that make wagers according to algorithms.
(21) Procedures to assist problem and
compulsive gamblers, including procedures intended to prevent a person from
participating in authorized interactive gaming who is otherwise prohibited from
participating in interactive gaming.
(22) Procedures to govern emergencies,
including suspected or actual cyber-attacks, hacking or tampering with the
interactive gaming certificate holder's interactive gaming skin, interactive
gaming platform or interactive gaming web site. The procedures must include the
process for the reconciliation or repayment of a registered player's
interactive gaming account.
(c) The submission required under subsections
(a) and (b) must include a detailed description of the interactive gaming
certificate holder's or interactive gaming operator's administrative and
accounting procedures related to interactive gaming, including its written
system of internal controls. Each written system of internal controls must
include all of the following:
(1) An
organizational chart depicting appropriate duties and responsibilities of the
key employees involved in interactive gaming.
(2) A description of the duties and
responsibilities of each position shown on the organizational chart.
(3) The record retention policy of the
interactive gaming certificate holder or interactive gaming operator.
(4) The procedure to be utilized to ensure
that money generated from the conduct of interactive gaming is safeguarded and
accounted for.
(5) Procedures to
ensure that recorded accountability for assets is compared with actual assets
at intervals required by the Board and appropriate action is taken with respect
to discrepancies.
(6) Procedures to
be utilized by an employee of an interactive gaming certificate holder or
interactive gaming operator in the event of a malfunction of an interactive
gaming system or other equipment used in the conduct of interactive
gaming.
(7) Procedures to be
utilized by the interactive gaming certificate holder or interactive gaming
operator to prevent persons under 21 years of age, self-excluded or involuntary
excluded individuals, and players outside this Commonwealth, unless otherwise
authorized by an interactive gaming reciprocal agreement, from engaging in
interactive gaming.
(8) Other items
the Board may request in writing to be included in the internal
controls.
(d) Prior to
authorizing an interactive gaming certificate holder or interactive gaming
operator to commence the conduct of interactive gaming, the Board will review
the system of internal controls, security protocols and audit protocols
submitted under this chapter to determine whether they conform to the
requirements of this chapter and whether they provide adequate and effective
controls for the conduct of interactive gaming.
(e) If an interactive gaming certificate
holder or interactive gaming operator intends to make a change or amendment to
its system of internal controls, it shall submit the change or amendment
electronically to the Bureau of Gaming Operations in a manner prescribed by the
Bureau of Gaming Operations. The interactive gaming certificate holder or
interactive gaming operator may implement the change or amendment on the 30th
calendar day following the filing of a complete submission unless the
interactive gaming certificate holder or interactive gaming operator receives
written notice tolling the change or amendment in accordance with this chapter
or written notice from the Board's Executive Director rejecting the change or
amendment.
(f) If during the 30-day
review period in this chapter, the Bureau of Gaming Operations preliminarily
determines that a procedure in a submission contains an insufficiency likely to
negatively affect the integrity of interactive gaming or the control of revenue
generated from interactive gaming, the Bureau of Gaming Operations, by written
notice to the interactive gaming certificate holder or interactive gaming
operator, will:
(1) Specify the nature of the
insufficiency and, when possible, an acceptable alternative
procedure.
(2) Direct that the
30-calendar day review period in this chapter is to be tolled and that any
internal controls at issue not be implemented until approved under this
chapter.
(g) Examples of
submissions that may contain an insufficiency likely to negatively affect the
integrity of interactive gaming may include the following:
(1) Submissions that fail to provide
information sufficient to permit the review of interactive gaming activities by
the Board, the Bureau, the Department or law enforcement.
(2) Submissions that fail to provide for the
segregation of incompatible functions so that an employee is not in a position
to commit an error and perpetrate a fraud and to conceal the error or fraud in
the normal course of the employee's duties.
(3) Submissions that do not include forms or
other materials referenced in the submission or required under the act or this
part.
(4) Submissions that would
implement operations or accounting procedures not authorized by the act or this
part.
(h) Whenever a
change or amendment has been tolled under this chapter, the interactive gaming
certificate holder or interactive gaming operator may submit a revised change
or amendment within 30 days of receipt of the written notice from the Bureau of
Gaming Operations. The interactive gaming certificate holder or interactive
gaming operator may implement the revised change or amendment upon receipt of
written notice of approval from the Board's Executive Director or on the 30th
calendar day following the filing of the revision unless the interactive gaming
certificate holder or interactive gaming operator receives written notice
tolling the change or amendment in accordance with this chapter or written
notice from the Board's Executive Director rejecting the change or
amendment.
