RULES AND REGULATIONS
Title 58—RECREATION
PENNSYLVANIA GAMING CONTROL BOARD
[ 58 PA. CODE CHS. 804, 811, 812, 814, 815 AND 818 ]
Interactive Gaming Qualified Gaming Entities; Accounting and Internal Controls; Player Accounts; Compulsive and Problem Gambling Requirements; Self-Excluded Persons; Commencement of Operations; Temporary Regulations
[48 Pa.B. 2631]
[Saturday, May 5, 2018]The Pennsylvania Gaming Control Board (Board), under its specific authority in 4 Pa.C.S. § 13B03(b) (relating to regulations) and the general authority in 4 Pa.C.S. § 1202(b)(30) (relating to general and specific powers), adds rules regarding: eligibility and petition requirements for qualified gaming entities (the specific process by which these entities may be selected for licensure by the Board will be determined at a later date and posted on the Board's web site); requirements for interactive gaming certificate holder's and interactive gaming operator licensee's internal controls; requirements and prohibitions regarding establishing, maintaining and suspending player accounts; rules regarding compulsive and problem gambling; rules regarding the process for an individual to self-exclude from interactive gaming activities in this Commonwealth; and the minimum requirements an interactive gaming certificate holder or interactive gaming operator shall satisfy to begin operations including clarification on the source of gaming skins as well as the appearance of gaming skins.
Purpose of this Temporary Rulemaking
This temporary rulemaking includes rules to ensure the integrity and security of interactive gaming in this Commonwealth.
Explanation of Chapters 804, 811, 812, 814, 815 and 818
Chapter 804 (relating to qualified gaming entity—temporary regulations) addresses what entities qualify as eligible qualified gaming entities and the information these entities shall provide to the Board to obtain interactive gaming certificates not sought by current slot machine licensees.
Chapter 811 (relating to interactive gaming accounting and internal controls—temporary regulations) addresses internal controls that include required reporting, data retention and system logging rules that, along with internal operation structures and player terms and conditions, shall be submitted to and approved by the Bureau of Gaming Operations.
Chapter 812 (relating to interactive gaming player accounts—temporary regulations) addresses specific guidelines relative to how players can establish, fund, limit and close interactive gaming accounts, and rules regarding certificate holder and licensee requirements relative to confirming player identities and maintaining player privacy.
Chapter 814 (relating to compulsive and problem gambling requirements—temporary regulations) addresses requirements for interactive gaming certificate holder and interactive gaming operator compulsive and problem gaming plans, including self-exclusion guidelines.
Chapter 815 (relating to interactive gaming self-excluded persons—temporary regulations) addresses the requirements for interactive gaming certificate holder and interactive gaming operator compulsive and problem gaming plans, including self-exclusion guidelines.
Chapter 818 (relating to interactive gaming commencement of operations—temporary regulations) provides clarification that the Board may authorize interactive gaming certificate holders or interactive gaming operator licensees operating an interactive gaming system on behalf of an interactive gaming certificate holder to deploy interactive gaming skins or interactive gaming web sites, that clearly identify the interactive gaming certificate holder or an entity within the interactive gaming certificate holder's organizational structure, on the display screen visible to players. Furthermore, interactive gaming certificate holders or interactive gaming operator licensees operating an interactive gaming system on behalf of an interactive gaming certificate holder may conduct interactive gaming utilizing players registered in other jurisdictions with which the Commonwealth has entered into a reciprocal agreement permitting interstate interactive gaming.
Affected Parties
An entity that operates interactive gaming in this Commonwealth, and an entity or individual that will interact with or participate in interactive gaming operations in this Commonwealth, will be affected by this temporary rulemaking. This temporary rulemaking provides: eligibility and petition requirements for qualified gaming entities (the specific process by which these entities may be selected for licensure by the Board will be determined at a later date and posted on the Board's web site); requirements for interactive gaming certificate holder's and interactive gaming operator licensee's internal controls; requirements and prohibitions relative to establishing, maintaining and suspending player accounts; rules regarding compulsive and problem gambling; rules regarding the process for an individual to self-exclude from interactive gaming activities in this Commonwealth; and the minimum requirements an interactive gaming certificate holder or interactive gaming operator shall satisfy to begin operations, including clarification on the source of gaming skins as well as the appearance of gaming skins.
Fiscal Impact
Commonwealth
The Board expects that this temporary rulemaking will have minimal fiscal impact on the Board and other Commonwealth agencies. Impact should be confined to the additional personnel and expenses related to implementing these temporary regulations as well as continued oversight of expanded gaming with portions of these costs absorbed by existing Board staff.
Political subdivisions
This temporary rulemaking will not have direct fiscal impact on political subdivisions of this Commonwealth. Host municipalities and counties benefit from the local share funding mandated by the act of January 7, 2010 (P.L. 1, No. 1).
Private sector
This temporary rulemaking includes rules regarding: eligibility and petition requirements for qualified gaming entities (the specific process by which these entities may be selected for licensure by the Board will be determined at a later date and posted on the Board's web site); requirements for interactive gaming certificate holder's and interactive gaming operator licensee's internal controls; requirements and prohibitions relative to establishing, maintaining and suspending player accounts; rules regarding compulsive and problem gambling; rules regarding the process for an individual to self-exclude from interactive gaming activities in this Commonwealth; and the minimum requirements an interactive gaming certificate holder or interactive gaming operator shall satisfy to begin operations including clarification on the source of gaming skins as well as the appearance of gaming skins. It is anticipated that this temporary rulemaking will have an impact on those individuals seeking to operate interactive gaming in this Commonwealth as well as those individuals and entities affiliated with the operation of interactive gaming in this Commonwealth. The fiscal impact to these parties will be offset by revenues collected through the play of interactive games.
General public
This temporary rulemaking will not have direct fiscal impact on the general public.
Paperwork Requirements
Interactive gaming certificate holders, interactive gaming operators, and individuals and entities providing services to those entities in connection with interactive gaming operations will be required to generate and maintain various types of information relative to their interactive gaming operations, including records on player accounts, wagers placed and problem gambling compliance efforts. Interactive gaming certificate holders, interactive gaming operators, and individuals and entities providing services to those entities in connection with interactive gaming operations will also be required to draft, maintain and submit documents related to internal controls and accounting associated with interactive gaming in this Commonwealth.
Effective Date
This temporary rulemaking will become effective upon publication in the Pennsylvania Bulletin and expires 2 years after publication.
Public Comments
While this temporary rulemaking will be effective upon publication, the Board is seeking comments from the public and affected parties as to how these temporary regulations might be improved.
Interested persons are invited to submit written comments, suggestions or objections regarding this temporary rulemaking within 30 days after the date of publication in the Pennsylvania Bulletin to Laura R. Burd, Senior Counsel, Pennsylvania Gaming Control Board, P.O. Box 69060, Harrisburg, PA 17106-9060, Attention: Public Comment on Regulation # 125-215.
Contact Person
The contact person for questions about this temporary rulemaking is Laura R. Burd, Senior Counsel, (717) 346-8300, lburd@pa.gov.
Regulatory Review
Under 4 Pa.C.S. § 13B03, the Board has the authority to promulgate temporary regulations to facilitate the prompt implementation of interactive gaming in this Commonwealth. The temporary regulations adopted by the Board are not subject to sections 201—205 of the act of July 31, 1968 (P.L. 769, No. 240) (45 P.S. §§ 1201—1205), known as the Commonwealth Documents Law, the Regulatory Review Act (71 P.S. §§ 745.1—745.14) and section 204(b) of the Commonwealth Attorneys Act (71 P.S. § 732-204(b)). Under 4 Pa.C.S. § 13B03(c), these temporary regulations expire 2 years after publication in the Pennsylvania Bulletin.
Findings
The Board finds that:
(1) Under 4 Pa.C.S. § 13B03, the temporary regulations are exempt from the requirements of the Regulatory Review Act, sections 201—205 of the Commonwealth Documents Law and section 204(b) of the Commonwealth Attorneys Act.
(2) The adoption of the temporary regulations is necessary and appropriate for the administration and enforcement of 4 Pa.C.S. Part II (relating to the Pennsylvania Race Horse Development and Gaming Act).
Order
The Board, acting under the provisions of 4 Pa.C.S. Part II, orders that:
(1) The regulations of the Board, 58 Pa. Code, are amended by adding temporary §§ 804.1—804.4, 811.1—811.9, 812.1—812.14, 814.1—814.6, 815.1—815.8 and 818.1—818.3 to read as set forth in Annex A.
(2) The temporary regulations will be posted on the Board's web site.
(3) The temporary regulations are subject to amendment as deemed necessary by the Board.
(4) The Chairperson of the Board has certified this order and Annex A and shall deposit them with the Legislative Reference Bureau as required by law.
(5) These temporary regulations are effective upon publication in the Pennsylvania Bulletin and expire on May 5, 2020.
DAVID M. BARASCH,
ChairpersonFiscal Note: 125-215. No fiscal impact; (8) recommends adoption.
Annex A
TITLE 58. RECREATION
PART VII. GAMING CONTROL BOARD
Subpart L. INTERACTIVE GAMING
CHAPTER 804. QUALIFIED GAMING ENTITY—TEMPORARY REGULATIONS Sec.
804.1. Qualified gaming entity license requirements. 804.2. Qualified gaming entity petition requirements. 804.3. Qualified gaming entity application requirements. 804.4. Qualified gaming entity license term and renewal. § 804.1. Qualified gaming entity license requirements.
(a) A qualified gaming entity seeking to offer interactive gaming in this Commonwealth may petition the Board for an interactive gaming certificate if all of the following apply:
(1) At least 120 days after the Board begins accepting petitions to offer interactive gaming in this Commonwealth under the act has passed.
(2) Any category of interactive game, as detailed in § 802.1(b) (relating to interactive gaming certificate requirements), remains available after eligible slot machine licensees failed to petition for authorization to offer that category of interactive game directly or through an interactive gaming operator.
(3) The entity holds a license, in good standing, in any gaming jurisdiction which entitles the entity to conduct casino, table or poker-style games in a physical land-based casino or by means of the Internet, or both.
(b) The Board will approve and post the process for selecting eligible qualified gaming entities, in the event more eligible qualified gaming entities petition for an interactive gaming certificate than there are interactive gaming certificates available, prior to the deadline for entities to petition the Board for any available interactive gaming certificates.
§ 804.2. Qualified gaming entity petition requirements.
(a) A qualified gaming entity petitioner for an interactive gaming certificate shall submit to the Board a petition containing the information required by slot machine licensees seeking an interactive gaming certificate under § 802.2 (relating to interactive gaming certificate petition and standards).
(b) The qualified gaming entity petitioner shall also show, by clear and convincing evidence, all of the following:
(1) It is licensed in good standing in another gaming jurisdiction.
(2) The licensing standards of that other gaming jurisdiction are comprehensive and thorough and provide similar safeguards as those required by the Commonwealth.
(3) The petitioner has the business experience and expertise to operate an interactive gaming system.
(c) In addition to the materials required under subsections (a) and (b), the qualified gaming entity petitioner for an interactive gaming certificate shall show, by clear and convincing evidence, that it has implemented or will implement all of the following:
(1) Interactive gaming that complies in all respects with the requirements of this subpart and regulations promulgated by the Board.
(2) A system of age, identity and location verification protocols designed to block access to individuals under 21 years of age and persons otherwise excluded or prohibited from engaging in interactive gaming in accordance with this subpart, as approved by the Board, has been implemented by the petitioner.
(3) Appropriate data security standards to prevent unauthorized access by any person whose age, identity and location has not been verified or cannot be verified in accordance with the regulations promulgated by the Board.
(4) Appropriate standards to protect the privacy and security of registered players with a reasonable degree of certainty.
(5) A system of internal and accounting controls applicable to interactive gaming, and the security and integrity of all financial transactions in connection with the system, that complies with this chapter and regulations promulgated by the Board.
§ 804.3. Qualified gaming entity application requirements.
(a) If selected under the Board process in § 804.1(b) (relating to qualified gaming entity license requirements), the eligible qualified gaming entity petitioner shall submit all applicable applications for licensure as required by the Bureau of Licensing.
(b) In determining whether an eligible qualified gaming entity petitioner is suitable to be issued a qualified gaming entity interactive gaming certificate under this subpart, the Board will consider all of the following:
(1) The financial fitness, good character, honesty, integrity and responsibility of the petitioner.
(2) If all principals of the petitioner are eligible and suitable under the standards of section 1311.1 of the act (relating to licensing of principals).
(3) The integrity of all financial backers.
(4) The suitability of the petitioner and the principals of the petitioner based on the satisfactory results of all of the following:
(i) The background investigation of the principals.
(ii) A current tax clearance review performed by the Department.
(iii) A current Unemployment Compensation Tax clearance review and a Workers Compensation Tax clearance review performed by the Department of Labor and Industry.
§ 804.4. Qualified gaming entity license term and renewal.
(a) A qualified gaming entity interactive gaming certificate and the renewal thereof is valid for 5 years from the date of approval of the application by the Board.
(b) A renewal application for a qualified gaming entity interactive gaming certificate shall be filed at least 6 months prior to the expiration of the current certificate.
(c) A qualified gaming entity interactive gaming certificate for which a completed renewal application and fee has been received by the Board will continue in effect until acted upon by the Board.
CHAPTER 811. INTERACTIVE GAMING ACCOUNTING AND INTERNAL CONTROLS—TEMPORARY REGULATIONS Sec.
811.1. Scope. 811.2. Internal controls. 811.3. Terms and conditions. 811.4. Information to be displayed on web site. 811.5. Segregation of bank accounts and reserve requirements. 811.6. Interactive gaming certificate holder's or interactive gaming operator licensee's organization. 811.7. Mandatory interactive gaming system logging. 811.8. Records/data retention requirements. 811.9. Required reports; reconciliation. § 811.1. Scope.
To ensure the integrity and security of interactive gaming operations in this Commonwealth, this chapter applies to all interactive gaming certificate holders or interactive gaming operator licensees seeking to offer interactive gaming to patrons in this Commonwealth.
§ 811.2. Internal controls.
(a) At least 90 days prior to commencing interactive gaming under this part, an interactive gaming certificate holder or interactive gaming operator licensee shall submit to the Board for approval internal controls for all aspects of interactive gaming prior to implementation and any time a change is made thereafter. The internal controls must include detailed procedures for system security, operations, accounting, and reporting of compulsive and problem gamblers.
(b) Notwithstanding subsection (a), the procedures and controls may be implemented by an interactive gaming certificate holder or interactive gaming operator licensee upon the filing of the procedures and controls with the Board. Each procedure or control submission must contain narrative and diagrammatic representations of the system to be utilized and must include all of the following:
(1) Procedures for reliable accounting controls, including the standardization of forms and definition of terms to be utilized in the interactive gaming operations.
(2) Procedures, forms and, when appropriate, formulas to govern all of the following:
(i) Calculation of hold percentages.
(ii) Revenue drops.
(iii) Expense and overhead schedules.
(iv) Complimentary services.
(v) Cash-equivalent transactions.
(3) Job descriptions and the system of personnel and chain of command establishing a diversity of responsibility among employees engaged in interactive gaming operations, including employees of an interactive gaming operator, and identifying primary and secondary management and supervisory positions for areas of responsibility, salary structure and personnel practices.
(4) Procedures for the registration of players and establishment of interactive gaming accounts, including a procedure for authenticating the age, identity and physical address of an applicant for an interactive gaming account and whether the applicant is a person prohibited from establishing or maintaining an account under section 13B22 of the act (relating to establishment of interactive gaming accounts).
(5) Procedures for terminating a registered player's interactive gaming account and the return of any funds remaining in the interactive gaming account to the registered player.
(6) Procedures for suspending or terminating a dormant interactive gaming account and the return of any funds remaining in the dormant interactive gaming account to the registered player.
(7) Procedures for the logging in and authentication of a registered player to enable the player to commence interactive gaming and the logging off of the registered player when the player has completed play, including a procedure to automatically log a registered player out of the player's interactive gaming account after a specified period of inactivity.
(8) Procedures for the crediting and debiting of a registered player's interactive gaming account.
(9) Procedures for cashing checks, receiving electronic negotiable instruments, and redeeming chips, tokens or other cash equivalents.
(10) Procedures for withdrawing funds from an interactive gaming account by the registered player.
(11) Procedures for the protection of a registered player's funds, including the segregation of a registered player's funds from operating funds of the interactive gaming certificate holder.
(12) Procedures for recording transactions pertaining to interactive gaming.
(13) Procedures for the security and sharing of personal identifiable information of a registered player, funds in an interactive gaming account and other information as required by the Board. The procedures must include the means by which an interactive gaming certificate holder or interactive gaming operator will provide notice to a registered player related to the sharing of personal identifiable information. For the purpose of this paragraph, ''personal identifiable information'' means any data or information that can be used, on its own or with other data or information, to identify, contact or otherwise locate a registered player, including a registered player's name, address, date of birth and Social Security number.
(14) Procedures and security for the calculation and recordation of revenue.
(15) Procedures for the security of interactive gaming devices and associated equipment.
(16) Procedures and security standards as to receipt, handling, and storage of interactive gaming devices and associated equipment.
(17) Procedures and security standards to protect the interactive gaming certificate holder's interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment from hacking or tampering by any person.
(18) Procedures for responding to suspected or actual hacking or tampering with an interactive gaming certificate holder's interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment, including partial or complete suspension of interactive gaming or the suspension of any or all interactive gaming accounts when warranted.
(19) Procedures to verify each registered player's physical location each time a registered player logs into his interactive gaming account and at appropriate intervals thereafter as determined by the Board.
(20) Procedures to ensure that the interactive games are fair and honest and that appropriate measures are in place to deter, detect and, to the extent possible, prevent cheating, including collusion, and use of cheating devices, including the use of software programs that make wagers according to algorithms.
(21) Procedures to assist problem and compulsive gamblers, including procedures intended to prevent a person from participating in authorized interactive gaming who is otherwise prohibited from participating in interactive gaming.
(22) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking or tampering with the interactive gaming certificate holder's interactive gaming skin, interactive gaming platform or interactive gaming web site. The procedures must include the process for the reconciliation or repayment of a registered player's interactive gaming account.
(c) The submission required under subsections (a) and (b) must include a detailed description of the interactive gaming certificate holder's or interactive gaming operator licensee's administrative and accounting procedures related to interactive gaming, including its written system of internal controls. Each written system of internal controls must include all of the following:
(1) An organizational chart depicting appropriate duties and responsibilities of employees involved in interactive gaming.
(2) A description of the duties and responsibilities of each position shown on the organizational chart.
(3) The record retention policy of the interactive gaming certificate holder or interactive gaming operator licensee.
(4) The procedure to be utilized to ensure that money generated from the conduct of interactive gaming is safeguarded and accounted for.
(5) Procedures to ensure that recorded accountability for assets is compared with actual assets at intervals required by the Board and appropriate action is taken with respect to discrepancies.
(6) Procedures to be utilized by an employee of an interactive gaming certificate holder or interactive gaming operator licensee in the event of a malfunction of an interactive gaming system or other equipment used in the conduct of interactive gaming.
(7) Procedures to be utilized by the interactive gaming certificate holder or interactive gaming operator licensee to prevent persons under 21 years of age, self-excluded or involuntary excluded individuals, and players outside this Commonwealth, unless otherwise authorized by an interactive gaming reciprocal agreement, from engaging in interactive gaming.
(8) Other items the Board may request in writing to be included in the internal controls.
(d) Prior to authorizing an interactive gaming certificate holder or interactive gaming operator licensee to commence the conduct of interactive gaming, the Board will review the system of internal controls, security protocols and audit protocols submitted under this chapter to determine whether they conform to the requirements of this chapter and whether they provide adequate and effective controls for the conduct of interactive gaming.
(e) If an interactive gaming certificate holder or interactive gaming operator licensee intends to make a change or amendment to its system of internal controls, it shall submit the change or amendment electronically to the Bureau of Gaming Operations in a manner prescribed by the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator licensee may implement the change or amendment on the 30th calendar day following the filing of a complete submission unless the interactive gaming certificate holder or interactive gaming operator licensee receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.
(f) If during the 30-day review period in in this chapter, the Bureau of Gaming Operations preliminarily determines that a procedure in a submission contains an insufficiency likely to negatively affect the integrity of interactive gaming or the control of revenue generated from interactive gaming, the Bureau of Gaming Operations, by written notice to the interactive gaming certificate holder or interactive gaming operator licensee, will:
(1) Specify the nature of the insufficiency and, when possible, an acceptable alternative procedure.
(2) Direct that the 30-calendar day review period in this chapter to be tolled and that any internal controls at issue not be implemented until approved under this chapter.
(g) Examples of submissions that may contain an insufficiency likely to negatively affect the integrity of interactive gaming may include the following:
(1) Submissions that fail to provide information sufficient to permit the review of interactive gaming activities by the Board, the Bureau, the Department or law enforcement.
(2) Submissions that fail to provide for the segregation of incompatible functions so that an employee is not in a position to commit an error and perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.
(3) Submissions that do not include forms or other materials referenced in the submission or required under the act or this part.
(4) Submissions that would implement operations or accounting procedures not authorized by the act or this part.
(h) Whenever a change or amendment has been tolled under this chapter, the interactive gaming certificate holder or interactive gaming operator licensee may submit a revised change or amendment within 30 days of receipt of the written notice from the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator licensee may implement the revised change or amendment upon receipt of written notice of approval from the Board's Executive Director or on the 30th calendar day following the filing of the revision unless the interactive gaming certificate holder or interactive gaming operator licensee receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.
§ 811.3. Terms and conditions.
(a) An interactive gaming certificate holder or interactive gaming operator licensee shall develop terms and conditions for interactive gaming which must be included in the internal controls. The terms and conditions and any changes thereto shall be acknowledged by the player and the acknowledgment must be date and time-stamped by the interactive gaming system.
(b) The terms and conditions must address all aspects of the interactive gaming operation, including all of the following:
(1) The name of the party with whom the player is entering into a contractual relationship, including any interactive gaming certificate holder or interactive gaming operator licensee.
(2) The player's consent to have the interactive gaming certificate holder or interactive gaming operator licensee confirm the player's age and identity.
(3) Rules and obligations applicable to the player other than rules of the game including all of the following:
(i) Prohibition from allowing any other person to access or use his interactive gaming account.
(ii) Prohibition from engaging in interactive gaming activity, unless the player is physically located in this Commonwealth.
(iii) Consent to the monitoring and recording by the interactive gaming certificate holder or the Board, or both, of any wagering communications and geographic location information.
(iv) Consent to the jurisdiction of this Commonwealth to resolve any disputes arising out of interactive gaming.
(v) Prohibition against utilizing automated computerized software or other equivalent mechanism, such as a bot, to engage in play.
(4) Full explanation of all fees and charges imposed upon a player related to interactive gaming transactions.
(5) Availability of account statements detailing player account activity.
(6) Privacy policies, including information access and use of customer data.
(7) Legal age policy, including a statement that it is a criminal offense to allow a person who is under 21 years of age to participate in interactive gaming and a player who does so must be prohibited from interactive gaming.
(8) Notification that if the player's interactive gaming account remains dormant for 1 year any funds remaining on deposit and any pending wagers shall be forfeited.
(9) The player's right to set responsible gaming limits and self-exclude.
(10) The player's right to suspend his account for no less than 72 hours.
(11) Actions that will be taken in the event a player becomes disconnected from the interactive gaming system during game play.
(12) Notice that a malfunction voids all pays.
(13) Estimated time-period for withdrawal of funds from the interactive gaming account.
(14) Detailed information to be displayed on a player protection page.
(15) Method for changing or retrieving a password or other approved access security feature and the ability to choose strong authentication login protection.
(16) Method for filing a complaint with the interactive gaming certificate holder and method for filing with the Board an unresolved complaint after all reasonable means to resolve the complaint with the interactive gaming certificate holder or interactive gaming operator licensee have been exhausted.
(17) Method for obtaining a copy of the terms and conditions agreed to when establishing an interactive gaming account.
(18) Method for the player to obtain account and game history from the interactive gaming certificate holder or interactive gaming operator licensee.
(19) Notification of Federal prohibitions and restrictions regarding interactive gaming, specifically, any limitations upon interactive gaming in 18 U.S.C.A. § 1084 and the Unlawful Internet Gambling Enforcement Act of 2006 (31 U.S.C.A. §§ 5361—5367). The notice must explicitly state that it is a Federal offense for persons physically located outside of this Commonwealth to engage in interactive wagering through an interactive gaming certificate holder or interactive gaming operator licensee unless explicitly authorized by the Board or an interactive gaming reciprocal agreement.
(20) Any other information required by the Board.
§ 811.4. Information to be displayed on web site.
Interactive gaming certificate holders and interactive gaming operator licensees shall provide for the prominent display of all of the following information on a page which, by virtue of the construction of the web site, authorized players must access before beginning a gambling session:
(1) The full name of the interactive gaming certificate holder or interactive gaming operator licensee and address from which it carries on business.
(2) A logo, to be provided by the Board, indicating that the interactive gaming certificate holder or interactive gaming operator licensee on behalf of the interactive gaming certificate holder is authorized to operate interactive gaming in this Commonwealth.
(3) The interactive gaming certificate holders and interactive gaming operator licensee's license number.
(4) A statement that persons under 21 years of age are not permitted to engage in interactive gaming.
(5) A statement that persons located in a jurisdiction where interactive gaming is not legal are not permitted to engage in interactive gaming.
(6) Active links to all of the following:
(i) Information explaining how disputes are resolved.
(ii) A problem gambling web site that is designed to offer information pertaining to responsible gaming.
(iii) The Board's web site.
(iv) A web site that allows for an authorized player to choose to be excluded from engaging in interactive gaming.
(v) A link to the house rules adopted by the interactive gaming certificate holder or interactive gaming operator licensee.
§ 811.5. Segregation of bank accounts and reserve requirements.
(a) An interactive gaming certificate holder or interactive gaming operator licensee shall maintain a Pennsylvania bank account for player's funds separate from all other operating accounts to ensure the security of funds held in the player's interactive gaming accounts.
(b) The balance maintained in this account must be greater than or equal to the sum of the daily ending cashable balance of all player interactive gaming accounts, funds on game and pending withdrawals.
(c) An interactive gaming certificate holder or interactive gaming operator licensee shall have unfettered access to all player interactive gaming account and transaction data to ensure the amount held in its independent account is sufficient. An interactive gaming certificate holder's or interactive gaming operator licensee's chief financial officer shall file a monthly attestation with the Board, unless otherwise directed by the Board, that the funds have been safeguarded under this section.
§ 811.6. Interactive gaming certificate holder's or interactive gaming operator licensee's organization.
(a) An interactive gaming certificate holder's or interactive gaming operator licensee's systems of internal controls must include organization charts depicting segregation of functions and responsibilities and descriptions of the duties and responsibilities for each position shown on each organization chart. Interactive gaming certificate holders and interactive gaming operator licensees are permitted, except as otherwise provided in this section, to tailor organizational structures to meet the needs or policies of a particular management philosophy. An interactive gaming certificate holder's and interactive gaming operator licensee's organization charts must provide for all of the following:
(1) A system of personnel and chain of command which permits management and supervisory personnel to be held accountable for actions or omissions within their areas of responsibility.
(2) The segregation of incompatible functions, duties and responsibilities so that an employee is not in a position to commit an error and perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.
(3) The performance of all functions, duties and responsibilities in accordance with sound financial practices by qualified personnel.
(4) The areas of responsibility which are not so extensive as to be impractical for an individual to monitor.
(b) In addition to other positions required as part of an interactive gaming certificate holder's or interactive gaming operator licensee's internal controls, an interactive gaming certificate holder or interactive gaming operator licensee shall maintain an information technology department supervised by an individual licensed as a key employee who functions, for regulatory purposes, as the information technology director. An interactive gaming certificate holder or interactive gaming operator shall employ an information technology security officer and an interactive gaming manager, both of whom shall be licensed as a key employee.
(c) The information technology director shall be responsible for the integrity of all data, and the quality, reliability and accuracy of all computer systems and software used by the interactive gaming certificate holder in the conduct of interactive gaming, whether the data and software are located within or outside the certificate holder's or interactive gaming operator licensee's facility, including, without limitation, specification of appropriate computer software, hardware and procedures for security, physical integrity, audit and maintenance of all of the following:
(1) Access codes and other computer security controls used to insure appropriately limited access to computer software and data.
(2) Monitoring logs of user access, security incidents and unusual transactions.
(3) Logs used to document and maintain the details of any hardware and software modifications.
(4) Computer tapes, disks or other electronic storage media containing data relevant to interactive gaming operations.
(5) Computer hardware, communications equipment and software used in the conduct of interactive gaming.
(d) The information technology security officer shall report to the information technology director and be responsible for all of the following:
(1) Maintaining access codes and other computer security controls used to insure appropriately limited access to computer software and data.
(2) Reviewing logs of user access, security incidents and unusual transactions.
(3) Coordinating the development of the interactive gaming certificate holder's information security policies, standards and procedures.
(4) Coordinating the development of an education and training program on information security and privacy matters for employees and other authorized users.
(5) Ensuring compliance with all State and Federal information security policies and rules.
(6) Preparing and maintaining security-related reports and data.
(7) Working with internal and external audit personnel to ensure all findings are addressed in a timely and effective manner.
(8) Developing and implementing an Incident Reporting and Response System to address security breaches, policy violations and complaints from external parties.
(9) Serving as the official contact for information security and data privacy issues, including reporting to law enforcement.
(10) Developing and implementing an ongoing risk assessment program that targets information security and privacy matters by identifying methods for vulnerability detection and remediation and overseeing the testing of those methods.
(11) Remaining current with the latest information technology security and privacy legislation, rules, advisories, alerts and vulnerabilities to ensure the interactive gaming certificate holder's security program and security software is effective.
(e) The interactive gaming manager shall report to the information technology director, or other department manager as approved by the Board, and be responsible for ensuring the proper operation and integrity of interactive gaming and reviewing all reports of suspicious behavior. The interactive gaming manager shall immediately notify the Bureau upon detecting any person participating in interactive wagering who is:
(1) Engaging in or attempting to engage in, or who is reasonably suspected of cheating, theft, embezzlement, collusion, money laundering or any other illegal activities.
(2) A self-excluded person under the act and Board regulations.
(3) Prohibited by the interactive gaming certificate holder or interactive gaming operator licensee from interactive gaming.
§ 811.7. Mandatory interactive gaming system logging.
(a) An interactive gaming system must employ a mechanism capable of maintaining a separate copy of the information required to be logged under this chapter on a separate and independent logging device capable of being administered by an employee with no incompatible function. If the interactive gaming system can be configured so that any logged data is in a secure transaction file, a separate logging device is not required.
(b) An interactive gaming system must provide a mechanism for the Board to query and export, in a format required by the Board, all gaming system data.
(c) An interactive gaming system must electronically log the date and time any interactive gaming account is created or terminated (Account Creation Log).
(d) An interactive gaming system must maintain all information necessary to recreate player game play and account activity during each player session, including any identity or location verifications, for no less than 10 years.
(e) Unless otherwise authorized by the Board, when software is installed on or removed from an interactive gaming system, the action must be recorded in a secure electronic log (Software Installation/Removal Log), which must include all of the following:
(1) The date and time of the action.
(2) The identification of the software.
(3) The identity of the person performing the action.
(f) Unless otherwise authorized by the Board, when a change in the availability of game software is made on a gaming system, the change must be recorded in a secure electronic log (Game Availability Log), which must include all of the following:
(1) The date and time of the change.
(2) The identification of the software.
(3) The identity of the person performing the change.
(g) Unless otherwise exempted by the Board, an interactive gaming system must record all promotional offers (Promotions Log) issued through the system. The Promotions Log must provide the information necessary to audit compliance with the terms and conditions of current and previous offers.
(h) Results of all authentication attempts must be retained in an electronic log (Authentication Log) and accessible for 90 days.
(i) All adjustments to gaming system data made using stored procedures must be recorded in an electronic log (Adjustments Log), which lists all of the following:
(1) The date and time.
(2) The identification and user ID of user performing the action.
(3) A description of the event or action taken.
(4) The initial and ending values of any data altered as a part of the event or action performed.
§ 811.8. Records/data retention requirements.
(a) For the purposes of this section, ''books, records and documents'' means any book, record or document pertaining to, prepared in or generated by the operation of the interactive gaming certificate holder or interactive gaming operator licensee including all forms, reports, accounting records, ledgers, subsidiary records, computer generated data, internal audit records, correspondence and personnel records required to be generated and maintained under this part. This definition applies without regard to the medium through which the record is generated or maintained (for example, paper, magnetic media or encoded disk).
(b) Original books, records and documents pertaining to the operation of interactive gaming must be:
(1) Prepared and maintained in a complete, accurate and legible form. Electronic data must be stored in a format that ensures readability, regardless of whether the technology or software that created or maintained it has become obsolete.
(2) Retained in a secure location by the interactive gaming certificate holder or interactive gaming operator licensee that is equipped with a fire suppression system or at another location approved under subsection (d).
(3) Made available for inspection by agents of the Board, the Department and the Pennsylvania State Police during all hours of operation.
(4) Organized and indexed in a manner to provide immediate accessibility to agents of the Board, the Department and the Pennsylvania State Police.
(5) Destroyed only after expiration of the minimum retention period specified in subsection (c), except that the Board may, upon the written request of an interactive gaming certificate holder or interactive gaming operator licensee and for good cause shown, permit the destruction at an earlier date.
(c) Original books, records and documents shall be retained by an interactive gaming certificate holder or interactive gaming operator licensee for a minimum of 5 years.
(d) An interactive gaming certificate holder or interactive gaming operator licensee may request, in writing, that the Board's Executive Director approve an alternative location outside of this Commonwealth to store original books, records and documents. The request must include all of the following:
(1) A detailed description of the proposed location, including security and fire suppression systems.
(2) The procedures under which the Board, the Department and the Pennsylvania State Police will be able to gain access to the original books, records and documents retained at the location outside of this Commonwealth.
(e) An interactive gaming certificate holder or interactive gaming operator licensee may request, in writing, that the Board's Executive Director approve a microfilm, microfiche or other suitable media system for the copying and storage of original books, records and documents. The request must include representations regarding all of the following:
(1) The processing, preservation and maintenance methods which will be employed to ensure that the books, records and documents are available in a format which makes them readily available for review and copying.
(2) The inspection and quality control methods which will be employed to ensure that microfilm, microfiche or other media when displayed on a reader/viewer or reproduced on paper exhibits a high degree of legibility and readability.
(3) The availability of a reader/printer for use by the Board, the Department and the Pennsylvania State Police at the location approved by the Board and the readiness with which the books, records or documents being stored on microfilm, microfiche or other media can be located, read and reproduced.
(4) The availability of a detailed index of all microfilmed, microfiched or other stored data maintained and arranged in a manner to permit the immediate location of any particular book, record or document.
(f) Nothing herein shall be construed as relieving an interactive gaming certificate holder or interactive gaming operator licensee from meeting any obligation to prepare or maintain any book, record or document required by any other Federal, State or local governmental body, authority or agency.
§ 811.9. Required reports; reconciliation.
(a) An interactive gaming system shall be designed to generate reports as specified by the Board that must include, at a minimum, all of the following:
(1) The report title.
(2) The version number of the current system software and report definition.
(3) The date or time period of activity, or description as of a point in time.
(4) The date and time the report was generated.
(5) Page numbering, indicating the current page and total number of pages.
(6) Subtotals and grand totals as required by the Department.
(7) A description of any filters applied to the data presented in the document.
(8) Column and row titles, if applicable.
(9) The name of the interactive gaming certificate holder.
(b) All required reports must be generated by the interactive gaming system, even if the period specified contains no data to be presented. The report generated must indicate all required information and contain an indication of ''No Activity'' or similar message if no data appears for the period specified.
(c) An interactive gaming system must provide a mechanism to export the data generated for any report to a format approved by the Board.
(d) An interactive gaming system must generate all of the following daily reports, at a minimum, for each gaming day to calculate the taxable revenue:
(1) A Player Account Summary Report, which must include transaction information for each player on account for all of the following categories:
(i) Beginning balance.
(ii) Total amount of deposits.
(iii) Total amount of noncashable bonuses deposited.
(iv) Total amount of noncashable bonuses wagered.
(v) Total amount of noncashable bonuses expired.
(vi) Total amount of transfers to games.
(vii) Total amount of transfers from games.
(viii) Total amount of withdrawals.
(ix) Total amount of funds on game at the beginning of the gaming day (the amount of pending wagers at the end of the prior gaming day).
(x) Total amount of funds on game at the end of the gaming day (the amount of pending wagers plus funds transferred to a game but not yet wagered).
(xi) Win or loss, calculated as the amount of transfers from games and beginning funds on game less the amount of transfers to games and ending funds on game.
(xii) Ending balance.
(2) A Wagering Summary Report, which must include all of the following by authorized game and poker variation, as applicable:
(i) Total amounts wagered.
(ii) Total amounts won.
(iii) Total tournament entry or participation fees.
(iv) Rake or vigorish.
(v) Total amounts of guaranteed funds paid to players.
(vi) Total amounts due to or from an interactive gaming network.
(vii) Win or loss calculated as the net of the total amounts wagered and total amounts won plus tournament entry fees, rake or vigorish, guaranteed funds, and amounts due to or from an interactive gaming system.
(3) A noncashable Promotional Account Balance Report, which must include the ending noncashable promotional balance in each player account.
(e) An interactive gaming system must generate the following daily reports for each participating interactive gaming certificate holder, at a minimum, for each gaming day to reconcile the daily gross interactive gaming revenue:
(1) A System Player Account Summary Report, which must include all of the following transaction information for each player account:
(i) Player identification number.
(ii) Total amount of transfers to games.
(iii) Total amount of transfers from games.
(iv) Win or loss statistics.
(v) Total amount of rake.
(vi) Total amount of entry fees.
(2) A System Wagering Summary Report, which must include all of the following game activity by authorized game or poker variation:
(i) Total amounts wagered.
(ii) Total amounts won.
(iii) Total tournament entry or participation fees.
(iv) Rake or vigorish.
(v) Total amounts of guaranteed funds paid to players.
(vi) Win or loss statistics, calculated as the net of the total amounts wagered and total amounts won plus tournament entry fees, rake or vigorish, and guaranteed funds.
(f) An interactive gaming certificate holder must utilize the Wagering Summary Report to calculate interactive gross gaming revenue on a daily basis for reporting purposes. In addition, the certificate holder shall do all of the following:
(1) Prepare a Variance Report documenting the win/loss amounts from the Player Account Report and Wagering Summary Report.
(2) Calculate the variance between the two amounts.
(3) Document the reason for the variance.
(4) Report a manual adjustment to increase revenue by the amount of the variance whenever the total of the Player Account Summary Report is greater than the total of the Wagering Summary Report, unless the reason for the variance as documented above is sufficient to support a determination that revenue was properly reported.
(g) Instead of subsection (f), an interactive gaming certificate holder or interactive gaming operator licensee may accumulate the daily Variance Report information on a monthly Variance Report in a manner described in the interactive gaming certificate holder's internal controls.
(h) An interactive gaming system must generate, on a daily basis commencing 1 year after the creation of the first interactive gaming account, a Dormant Account Report, which must list all player accounts including the Pending Wager Account Report that have not had activity for 1 year. The report must include all of the following:
(1) The player name and account number.
(2) The date of the last transaction.
(3) The account balance.
(i) Voids of completed wagering transactions may not occur without Board approval.
(j) An interactive gaming system must generate a Performance Report, which compares the theoretical return to player (RTP) to the actual RTP of each game offered by a gaming system. The report must also provide the total number of rounds of play for each game and shall be generated and reviewed monthly by the interactive gaming certificate holder to evaluate the performance of all games offered to the public. The Performance Report must include the data required by this subsection from the first day interactive gaming was offered to the date of the report.
(k) An interactive gaming system must generate a Player Account Adjustments Report, which shall be reviewed on a daily basis by either the interactive gaming certificate holder or interactive gaming operator licensee to evaluate the legitimacy of player account adjustments. If the daily review is performed by the interactive gaming operator, the interactive gaming certificate holder or interactive gaming operator licensee shall conduct a weekly review of the Player Account Adjustment Reports. Unless otherwise authorized by the Board, the report must, at a minimum, include all of the following:
(1) The player's name.
(2) An account number.
(3) The date and time of the adjustment.
(4) The person who performed the adjustment.
(5) The reason for the adjustment.
(6) The amount of the adjustment.
(l) An interactive gaming system must generate a report on a weekly basis identifying potential compulsive and problem gamblers, including those players who self-report. The interactive gaming certificate holder shall review the report and document any action taken.
(m) An interactive gaming system must be capable of generating a Pending Transaction Account Report, which must include and separately itemize all pending transactions for each player account, including funds on game and deposits and withdrawals not yet cleared.
(n) In accordance with internal controls, an interactive gaming certificate holder or interactive gaming operator licensee shall periodically submit to the Board a copy of the bank statement that reflects the balance of the restricted account maintained to protect player funds required under this part.
[Continued on next Web Page]
No part of the information on this site may be reproduced for profit or sold for profit.This material has been drawn directly from the official Pennsylvania Bulletin full text database. Due to the limitations of HTML or differences in display capabilities of different browsers, this version may differ slightly from the official printed version.
