[50 Pa.B. 7277]
[Saturday, December 26, 2020]

[Continued from previous Web Page]

CHAPTER 1406a. SPORTS WAGERING PRINCIPALS AND KEY, GAMING AND NONGAMING EMPLOYEES

Sec.

1406a.1.	General provisions.
1406a.2.	Sports wagering principals.
1406a.3.	Sports wagering key employees.
1406a.4.	Sports wagering gaming employees.
1406a.5.	Sports wagering nongaming employees.
1406a.6.	Board credentials.
1406a.7.	Emergency and temporary credentials.
1406a.8.	Loss, theft or destruction of credentials.

§ 1406a.1. General provisions.

 (a) An individual seeking a principal license, key employee license, gaming employee occupation permit or nongaming employee registration to participate in sports wagering in this Commonwealth shall apply to the Board as follows:

 (1) Principal and key employee applicants shall submit an original and one copy of a completed Multi-Jurisdictional Personal History Disclosure Form as well as an original and one copy of a completed Principal/Key Employee Form—Pennsylvania Supplement to the Multi-Jurisdictional Personal History Disclosure Form unless otherwise directed by the Board.

 (2) Gaming employee occupation permit applicants and nongaming employee registration applicants shall submit the Gaming Employee or Nongaming Employee Registration Application using the SLOTSLink Electronic Application system.

 (3) All applicants shall submit the nonrefundable application fee posted on the Board's web site.

 (b) In addition to the materials required in subsection (a), an applicant shall comply with the general application requirements in Chapters 421a and 423a (relating to general provisions; and applications; statement of conditions; wagering restrictions).

 (c) The holder of a principal license, key employee license, gaming employee occupation permit or nongaming employee registration shall provide an updated photograph at the request of Board staff.

 (d) An applicant for a gaming employee occupation permit or nongaming employee registration shall be at least 18 years of age.

 (e) After reviewing the application and the results of the applicant's background investigation, the Board may issue a principal license, key employee license, gaming employee occupation permit or nongaming employee registration if the individual has proven that he is a person of good character, honesty and integrity and is eligible and suitable to be licensed as a principal, key employee, gaming employee or nongaming employee.

 (f) All sports wagering certificate holders and sports wagering operators that hire an individual who holds a key employee license, gaming employee occupation permit or registration issued by the Board shall contact the Bureau of Licensing to confirm that the individual's key employee license, gaming employee occupation permit or registration is in good standing prior to allowing the individual to perform work associated with sports wagering in this Commonwealth.

 (g) An individual who holds a principal license, key employee license, gaming employee occupation permit or registration is subject to all of the following wagering restrictions relative to sports wagering:

 (1) An individual who holds a license, permit or registration and is currently employed by or is a principal of a sports wagering certificate holder may not place wagers at the sports wagering certificate holder's retail sports wagering locations.

 (2) If the job duties of the individual who holds a license, permit or registration and is currently employed by or is a principal of a sports wagering certificate holder include sports wagering, the individual may not place wagers through the web site or mobile application offered by or associated with the sports wagering certificate holder.

 (3) The licensed, permitted or registered individual shall wait at least 30 days following the date that the individual is no longer employed by the sports wagering certificate holder in a position that includes sports wagering job duties before the individual may wager at the sports wagering certificate holder's retail sports wagering location or through the web site or mobile application offered by or associated with the sports wagering certificate holder.

 (4) An individual who holds a license, permit or registration and is currently employed by or is a principal of a sports wagering operator may not wager anywhere the sports wagering operator operates a retail sports wagering location or through the web site or mobile application offered by or associated with the sports wagering operator.

 (5) The licensed, permitted or registered individual shall wait at least 30 days following the date that the individual is no longer employed by the sports wagering operator before the individual may wager at the sports wagering operator's retail sports wagering location or through the web site or mobile application offered by or associated with the sports wagering operator.

 (6) An individual whose job duties include sports wagering and who holds a license, permit or registration and is currently employed by or is a principal of a sports wagering manufacturer or sports wagering supplier may not wager at any retail sports wagering location or through the web site or mobile application offered by or associated with the sports wagering certificate holder or sports wagering operator that offers games, services or uses equipment manufactured, supplied, developed or programmed by the sports wagering manufacturer or sports wagering supplier.

§ 1406a.2. Sports wagering gaming principals.

 (a) Principals and principal entities, as defined in §§ 401a.3 and 433a.1 (relating to definitions), shall submit an application for licensure as described in § 1406a.1 (relating to general provisions).

 (b) A principal license and the renewal thereof is valid for 5 years from the date of approval of the application by the Board.

 (c) A renewal application for a principal license shall be filed at least 6 months prior to expiration of the current license.

 (d) A principal license for which a completed renewal application and fee has been received by the Board will continue in effect until acted upon by the Board.

 (e) A principal license issued under this subpart will be only be valid for the licensed or certified entity with which the principal is associated.

§ 1406a.3. Sports wagering key employees.

 (a) Key employees, as defined in §§ 401a.3 and 1401a.2 (relating to definitions), shall submit an application for licensure as described in § 1406a.1 (relating to general provisions).

 (b) A key employee license and the renewal thereof is valid for 5 years from the date of approval of the application by the Board.

 (c) A renewal application for a key employee license shall be filed at least 6 months prior to expiration of the current license.

 (d) A key employee license for which a completed renewal application and fee has been received by the Board will continue in effect until acted upon by the Board.

 (e) A key employee license issued under this subpart will be valid for employment with any licensed or certified entity.

§ 1406a.4. Sports wagering gaming employees.

 (a) Gaming employees, as defined in §§ 401a.3 and 1401a.2 (relating to definitions), shall submit an application for licensure as described in § 1406a.1 (relating to general provisions).

 (b) In addition to the materials required to be submitted under this subpart, gaming employee occupation permit applicants shall submit verification of an offer of employment from a licensed or certified entity.

 (c) A gaming employee occupation permit and the renewal thereof is valid for 5 years from the date of approval of the application by the Board.

 (d) A renewal application for a gaming employee occupation permit shall be filed at least 6 months prior to expiration of the current permit.

 (e) A gaming employee occupation permit for which a completed renewal application and fee has been received by the Board will continue in effect until acted upon by the Board.

 (f) An individual who wishes to receive a gaming employee occupation permit under this subpart may authorize an applicant for or holder of a sports wagering certificate, sports wagering operator license, sports wagering manufacturer license, sports wagering supplier license, or sports wagering gaming service provider certification or registration to file an application on the individual's behalf.

 (g) A gaming employee occupation permit issued under this chapter will be valid for employment with any licensed, certified or registered entity.

§ 1406a.5. Sports wagering nongaming employees.

 (a) Nongaming employees, as defined in § 401a.3 (relating to definitions), shall submit an application for licensure as described in this section.

 (b) In addition to the materials required to be submitted under this subpart, nongaming employee registration applicants shall submit verification of an offer of employment from a licensed or certified entity.

 (c) A nongaming employee registration and the renewal thereof is valid for 5 years from the date of approval of the application by the Board.

 (d) A renewal application for a nongaming employee registration shall be filed at least 6 months prior to expiration of the current registration.

 (e) A nongaming employee registration for which a completed renewal application and fee has been received by the Board will continue in effect until acted upon by the Board.

 (f) An individual who wishes to receive a nongaming employee registration under this subpart may authorize an applicant for or holder of a sports wagering certificate, sports wagering operator license, sports wagering manufacturer license, sports wagering supplier license, or sports wagering gaming service provider certification or registration to file an application on the individual's behalf.

 (g) A nongaming employee registration issued under this chapter will be valid for employment with any licensed, certified or registered entity.

§ 1406a.6. Board credentials.

 The individuals required to be licensed, permitted or registered under this subpart shall obtain a Board credential as described in § 435a.6 (relating to Board credentials) if it is determined by the Bureau of Licensing that a credential is necessary to perform the individual's job functions.

§ 1406a.7. Emergency and temporary credentials.

 The individuals required to be licensed, permitted or registered under this subpart may obtain an emergency or temporary Board credential as described in §§ 435a.7, 435a.8 and 435a.9a (relating to emergency credentials; temporary credentials; and gaming service provider employee temporary access credentials).

§ 1406a.8. Loss, theft or destruction of credentials.

 (a) As soon as possible, but no later than 24 hours following the loss, theft or destruction of a Board credential, emergency credential or temporary credential, the person to whom the credential was issued shall notify the Bureau of Licensing.

 (b) The sports wagering licensee, on behalf of an employee whose Board-issued credential was lost, stolen or destroyed, may request a replacement Board credential by submitting a Request for Duplicate PGCB Credential Form and the fee established by the Board to the Bureau of Licensing.

CHAPTER 1407a. SPORTS WAGERING TESTING AND CONTROLS

Sec.

1407a.1.	Scope.
1407a.2.	Definitions.
1407a.3.	Testing and approval generally.
1407a.4.	Wagering device requirements generally.
1407a.5.	Self-service kiosks and point of sale system requirements.
1407a.6.	Ticket/Voucher requirements.
1407a.7.	Ticket/Voucher redemption requirements.
1407a.8.	Sports wagering interactive system requirements.
1407a.9.	Sports wagering system general requirements.

§ 1407a.1. Scope.

 To ensure the integrity and security of sports wagering operations in this Commonwealth, the requirements of this chapter apply to all sports wagering certificate holders and sports wagering operators seeking to offer sports wagering to patrons in this Commonwealth. The requirements in this chapter supplement, where not in conflict with and where applicable, existing Board regulations in Subparts E and L (relating to slot machine, table game and associated equipment testing and control; accounting and internal controls; and interactive gaming) applicable to slot machine licensees, interactive gaming certificate holders and interactive gaming operators unless the context clearly indicates otherwise.

§ 1407a.2. Definitions.

 The following words and terms, when used in this chapter, have the following meanings, unless the context clearly indicates otherwise:

 Authentication process—A method used by a system to verify the validity of software. The method requires calculation of an output digest, which is compared to a secure embedded value. The minimum output digest shall be of 128-bit complexity. Software shall be deemed to have been authenticated if the calculated digest equals the secure embedded value.

 Communication technology—The methods used and the components employed to facilitate the transmission of information including transmission and reception systems based on wire, cable, radio, microwave, light, optics or computer data networks.

 Point of sale system—All the hardware, software and communications that comprises a stand-alone or integrated system capable of accepting sports wagers by means of terminals attended to by a cashier and is located at a sports wagering certificate holder's approved locations.

 Self-service kiosks—Unattended self-service booths or self-standing structure with computers, including touch-screen computers, at which a patron can place sports wagers and that dispenses sports wagering tickets/vouchers.

 Sports wagering account—Electronic account that may be established by a patron for the purpose of sports wagering by means of a sports wagering certificate holder's or sports wagering operator's interactive sports wagering web site or interactive sports wagering mobile application under these regulations.

 Sports wagering communication—The transmission of a wager between a point of origin and a point of reception by aid of a communications technology.

 Sports wagering device and associated equipment—A self-service kiosk, point of sale system or other device, including associated equipment, used to accept sports wagering as permitted for use in this Commonwealth by the Board.

 Sports wagering interactive system—All hardware, software and communications that comprise a type of server-based sports wagering system for the purpose of offering authorized interactive or mobile sports wagering in this Commonwealth when authorized by the Board.

 Sports wagering system—All sports wagering devices, equipment, communication technology, software and hardware approved by the Board to conduct sports wagering in this Commonwealth.

 Ticket/Voucher redemption device—Unattended self-service booths or self-standing structures with computers, including touch-screen computers, at which a patron can redeem sports wagering tickets/vouchers and that dispense winnings in the form of cash or cash equivalent.

§ 1407a.3. Testing and approval generally.

 (a) Prior to operating a retail sportsbook or a sportsbook through a web site or mobile application as a form of interactive gaming, all sports wagering devices and software used in conjunction with these operations must be submitted to the Board's Office of Gaming Laboratory Operations for review and testing and be approved by the Board.

 (b) For purposes of this section, sports wagering devices and software that shall be submitted for testing and approval include:

 (1) Self-service kiosks.

 (2) Point of sale systems.

 (3) Ticket/Voucher redemption devices.

 (4) Sports wagering interactive system components, including all hardware, software and associated equipment that comprise a type of server-based sports wagering system for the purpose of offering authorized sports wagering, mobile sports wagering or interactive sports wagering.

 (5) Other related devices or systems as required by the Board.

 (c) The Board shall require the payment of all costs for the testing and approval of sports wagering devices and software used in conjunction with the operation of a retail sportsbook or an interactive or mobile sportsbook as a form of interactive gaming.

 (d) Submissions to the Office of Gaming Laboratory Operations of sports wagering devices and software used in conjunction with the operation of an onsite sportsbook or an online or mobile sportsbook should adhere to the requirements in § 461a.4 (relating to submission for testing and approval) where applicable.

§ 1407a.4. Wagering device requirements generally.

 (a) Wagering device programs shall contain sufficient information to identify the software and revision level of the information stored on the wagering device.

 (b) Wagering devices shall have the ability to authenticate that all critical components being utilized are valid upon installation of the software, each time the software is loaded for use and on demand as required by the Board. Critical components may include wagering information, elements that control the communications with the sports wagering system or other components that are needed to ensure proper operation of the wagering device. In the event of a failed authentication (that is, program mismatch or authentication failure), the wagering device shall cease all wagering operations and display an appropriate error message. The sports wagering system shall have the ability to disable the wagering device upon any unsuccessful authentication.

 (c) Wagering devices shall be capable of performing the following functions:

 (1) Creating wagers.

 (2) Settling wagers.

 (3) Voiding wagers.

 (4) Cancelling wagers.

 (d) Wagering devices that offer in-game wagers shall be capable of the following:

 (1) The accurate and timely update of odds for in-game wagers.

 (2) The ability to notify the patron of any change in odds after placement of a wager is attempted.

 (3) The ability for a patron to confirm the wager after notification of the change in odds.

 (4) The ability to freeze or suspend the offering of wagers, when necessary.

 (e) Wagering devices shall be capable of recording all of the following information for each wager made:

 (1) Description of event.

 (2) Event number.

 (3) Wager selection.

 (4) Type of wager.

 (5) Amount of wager.

 (6) Amount of potential payout.

 (7) Date and time of wager.

 (8) Identity of cashier accepting the wager.

 (9) Unique wager identifier.

 (10) Expiration date of the sports wagering ticket, which shall be no sooner than 1 year from the conclusion of the event in the case of a single wager, or the conclusion of the last event of a multiple wager ticket (that is, parlay or round robin wagers).

 (11) Patron name, if known.

 (12) Date, time, amount and description of the settlement.

 (13) Location of where the wager was placed.

 (14) Identity of the ticket writer settling the wager, if applicable.

 (f) For lost or stolen tickets that are redeemed, a wagering device shall record and maintain the following information:

 (1) Date and time of redemption;

 (2) Employee responsible for redeeming the ticket;

 (3) Name of patron redeeming the ticket;

 (4) Unique ticket identifier;

 (5) Location of the redemption.

 (g) When a sports wager is voided or cancelled, the system shall clearly indicate that the sports wagering ticket is voided or cancelled, render it nonredeemable, and make an entry in the system indicating the void or cancellation and identify the cahier or automated process.

 (h) Wagering devices shall prevent past posting of wagers and the voiding or cancellation of wagers after the outcome of the event is known.

 (i) In the event a patron has a pending sports wager and then is excluded or self-excludes, the wager shall be cancelled and the funds returned to the patron.

 (j) Wagering devices shall have controls in place to review the accuracy and timeliness of any data feeds used to offer or settle wagers. In the event that an incident or error occurs that results in incorrect or loss of communication with data feeds used to offer or redeem wagers, the errors shall be reported in accordance with reporting requirements pursuant to § 1408a.8 (relating to risk management).

§ 1407a.5. Self-service kiosks and point of sale system requirements.

 (a) Self-service kiosks and point of sale devices shall have an identification badge affixed to the exterior of the device by the manufacturer. The identification badge shall not be removable without leaving evidence of tampering. This badge shall include all of the following minimum information:

 (1) The complete name of the manufacturer or some appropriate abbreviation for same.

 (2) A unique serial number.

 (3) The self-service kiosk or point of sale device model number.

 (4) The date of manufacture.

 (b) Self-service kiosks and point of sale devices shall meet all of the following basic hardware requirements:

 (1) Identification for any printed circuit board (PCB) that impacts the integrity of the self-service kiosk or point of sale device shall include all of the following:

 (i) Each PCB shall be clearly identifiable by an alphanumeric identification and, when applicable, a revision number.

 (ii) If track cuts, patch wires or other circuit alterations are introduced to the PCB, then a new revision number shall be assigned.

 (2) If the self-service kiosk or point of sale device contains switches or jumpers, or both, they shall be fully documented for evaluation by the Board's Office of Gaming Laboratory.

 (3) The self-service kiosk or point of sale device shall be designed so that power and data cables into and out of the self-service kiosk or point of sale device can be routed so that they are not accessible to the general public.

 (4) Wired communication ports shall be clearly labeled and must be securely housed within the self-service kiosk or point of sale device to prevent unauthorized access to the ports or their associated cable connectors.

 (b) Self-service kiosks and point of sale devices shall meet all of the following basic power requirements:

 (1) The self-service kiosk and point of sale device shall not be adversely affected, other than resets, by surges or dips of ± 20% of the supply voltage. It is acceptable for the self-service kiosk or point of sale device to reset provided no damage to the equipment or loss or corruption of data is experienced.

 (2) The power supply used in a self-service kiosk or point of sale device must be appropriately fused or protected by circuit breakers. The amperage rating of all fuses and circuit breakers must be clearly stated on or near the fuse or the breaker.

 (3) An on/off switch that controls the electrical current supplied to the self-service kiosk or point of sale device shall be located in a place which is readily accessible within the interior of the self-service kiosk or point of sale device. The on/off positions of the switch shall be clearly labeled.

 (c) Self-service kiosks and point of sale device shall meet all of the following basic security requirements:

 (1) A self-service kiosk or point of sale device shall be robust enough to resist forced entry into any secured doors, areas or compartments. In the event that extreme force is applied to the cabinet materials causing a potential breach in self-service kiosk or point of sale device security, evidence of tampering must be conspicuous. ''Secured areas'' or ''secured compartments'' shall include the external doors such as the main door, cash compartment doors such as a drop box door, peripheral device access areas, or other sensitive access areas of the self-service kiosk or point of sale device.

 (2) The following requirements apply to the self-service kiosk's or point of sale device's external doors:

 (i) External doors shall be manufactured of materials that are suitable for allowing only legitimate access to the inside of the self-service kiosk cabinet or point of sale device. Doors and their associated hinges shall be capable of withstanding determined and unauthorized efforts to gain access to the interior of the self-service kiosk or point of sale device and shall leave conspicuous evidence of tampering if an attempt is made.

 (ii) The seal between the self-service kiosk cabinet or point of sale device and the door of a locked area shall be designed to resist the entry of objects. It shall not be possible to insert an object into the self-service kiosk or point of sale device that disables a door open sensor when the self-service kiosk's or point of sale device's door is fully closed, without leaving conspicuous evidence of tampering.

 (iii) External doors shall be secure and support the installation of locks.

 (iv) Doors that provide access to secure areas of the self-service kiosk or point of sale device shall be monitored by a door access detection system.

 (A) The detection system shall register a door as being open when the door is moved from its fully closed and locked position, provided power is supplied to the self-service kiosk or point of sale device.

 (B) When any door that provides access to a secured area or secured compartment registers as open, the self-service kiosk or point of sale device shall cease wagering operations and display an appropriate error message.

 (d) Self-service kiosks and point of sale devices shall meet all of the following basic critical nonvolatile memory requirements:

 (1) Critical nonvolatile memory shall be used to store all data elements that are considered vital to the continued operation of the self-service kiosk or point of sale device, including self-service kiosk configuration and point of sale device data and state of operations.

 (2) Critical nonvolatile memory shall not store sensitive information outside of self-service kiosk and point of sale device operations; however, critical nonvolatile memory may be maintained by any component of the sports wagering system.

 (3) The self-service kiosk or point of sale device must have a backup or archive capability, which allows the recovery of critical nonvolatile memory should a failure occur.

 (4) Critical nonvolatile memory storage shall be maintained by a methodology that enables errors to be identified. This methodology may involve signatures, check sums, redundant copies, database error checks or other methods approved by the Board.

 (5) Comprehensive checks of critical nonvolatile memory data elements shall be made on startup. Nonvolatile memory that is not critical to self-service kiosk or point of sale device integrity is not required to be checked.

 (6) An unrecoverable corruption of critical nonvolatile memory shall result in an error. Upon detection, the self-service kiosk and point of sale device software shall cease to function. Additionally, the critical nonvolatile memory error shall cause any communication external to the self-service kiosk to cease.

 (e) Self-service kiosk and point of sale device software, after a program interruption, shall recover to the state it was in immediately prior to the interruption occurring. Any communications to an external device shall not begin until the program resumption routine, including any self-test, is completed successfully.

 (f) On a scheduled basis, a sports wagering certificate holder or sports wagering operator shall remove the bill validator boxes in the self-service kiosks.

 (1) The self-service kiosk drop shall be monitored and recorded by surveillance.

 (2) The sports wagering certificate holder or sports wagering operator shall submit the self-service kiosk drop schedule to the Board, with the schedule to include:

 (i) The time that a drop is scheduled to commence.

 (ii) The number and locations of the self-service kiosks in the sports wagering area or on the gaming floor of a licensed facility.

 (g) A security department member and a finance department member shall obtain the keys necessary to perform the self-service kiosk drop and/or currency cassette replacement in accordance with the sports wagering certificate holder or sports wagering operator's key sign-out procedures.

 (1) The security department shall control the keys to the outer door of the self-service kiosks.

 (2) The finance department shall control the keys to the bill validator boxes or currency cassettes, or both.

 (h) A finance department member with no incompatible job functions shall place empty bill validator boxes needed for the self-service kiosk drop into a secured cart which shall be transported in the presence of a member of the security department at all times.

 (i) A sports wagering certificate holder or sports wagering operator shall reconcile the self-service kiosks on a scheduled basis pursuant to internal controls.

 (1) Any variance of $500 or more shall be documented by the accounting department and reported in writing to the Office of Sports Wagering and Bureau of Casino Compliance within 72 hours of the end of the gaming day which the variance was discovered.

 (2) The report shall indicate the cause of the variance and shall contain any documentation required to support the stated explanation.

 (j) A sports wagering certificate holder or sports wagering operator shall include in its internal controls required under § 1408a.3 (relating to internal controls) the set of self-service kiosk key controls and accounting protocols, including the procedures for the drop and count of self-service kiosk funds, and all point of sale devices.

§ 1407a.6. Ticket/Voucher requirements.

 (a) Tickets/vouchers generated by a self-service kiosk or by a point of sale system shall include all of the following general information:

 (1) Name and address of the party issuing the ticket/voucher.

 (2) A barcode or similar symbol or marking, as approved by the Board, corresponding to a unique wager identifier.

 (3) Method of redeeming a winning ticket/voucher by means of mail.

 (4) Identification of the self-service kiosk or cashier at the point of sale device that generated the ticket/voucher.

 (b) Tickets/vouchers generated by a self-service kiosk or by a point of sale system shall include all of the following specific information:

 (1) Amount of ticket/voucher.

 (2) Date, time and location of issuance.

 (3) Unique voucher identifier.

 (4) Expiration date of the ticket.

 (5) Date, time and location of redemption, if applicable based upon the method of redemption.

 (c) Tickets/vouchers generated by a self-service kiosk or by a point of sale system shall be capable of being processed and redeemed if lost, stolen, destroyed or otherwise mutilated.

 (d) Tickets/vouchers generated by a self-service kiosk or by a point of sale system shall be capable of clearly indicating that a ticket/voucher is voided or cancelled and rendered nonredeemable or is expired in the case of a sports wagering ticket when redemption is attempted.

 (e) A sports wagering voucher shall not expire in accordance with the provisions of § 461b.3(a) (relating to gaming vouchers).

 (f) A winning sports wagering ticket may expire, with the expiration date to be no less than 1 year from the conclusion of the event in the case of a single wager, or the conclusion of the last event of a multiple wager ticket (that is, parlay or round robin wagers).

 (g) A sports wagering certificate holder or sports wagering operator shall include in its internal controls required under § 1408a.3 (relating to internal controls):

 (1) The sports wagering ticket expiration policy and procedures that will be implemented, including the procedures for the handling of funds from expired sports wagering tickets and the reporting of those funds for revenue purposes.

 (2) The policies and procedures for paying or writing tickets, or both, that are over the set limits, voiding tickets, issuing corrections to tickets and ticket overrides.

§ 1407a.7. Ticket/Voucher redemption requirements.

 (a) Winning sports wagering tickets/vouchers shall be redeemed by a writer or a self-service kiosk after verifying the validity of the wagering ticket through the sports wagering system. The writer or a self-service kiosk shall cause the sports wagering system to electronically redeem and cancel the wagering ticket upon redemption.

 (b) A patron may redeem by mail a winning sports wagering ticket/voucher to the address provided thereon in accordance with the sports wagering certificate holder's or sports wagering operator's internal controls.

 (c) A patron may redeem a winning sports wagering ticket/voucher issued at a sports wagering certificate holder's main retail sportsbook at any of the sports wagering certificate holder's non-primary sports wagering locations or at sports wagering area of a Category 4 licensed facility, and vice versa.

 (d) Self-service kiosks shall be capable of recognizing payment limitations or payment errors such as bill out jams and insufficient funds. When a payment limitation or error occurs, the self-service kiosk shall be designed to electronically record the payout limitation or error and perform all of the following:

 (1) Reject the transaction.

 (2) Issue an error receipt.

 (3) Issue a replacement sports wagering ticket/voucher.

 (e) When an error receipt is issued from a self-service kiosk, the self-service kiosk or receipt shall advise the patron or employee to see a point of sale cashier for payment. Error receipts shall be designed to include all of the following, at a minimum:

 (1) The time and date.

 (2) Identification of the issuing self-service kiosks.

 (3) Specifies the amount of money that the self-service kiosks failed to dispense.

 (f) When used to redeem sports wagering tickets/vouchers, self-service kiosks shall work in conjunction with an approved sports wagering system and shall be designed to:

 (1) Accurately obtain the unique identification number of the item presented for redemption and cause the information to be accurately and securely relayed to the sports wagering system for the purpose of redemption.

 (2) Issue currency or a sports wagering ticket/voucher, or both, in exchange for the item presented only if the sports wagering system has authorized and recorded the transaction.

 (3) Return a sports wagering ticket/voucher to the patron when it cannot be validated by the sports wagering system or is otherwise unredeemable.

 (g) When used to redeem sports wagering tickets/vouchers, the self-service kiosk or kiosk computer system shall be capable of generating a ''Sports Wagering Ticket/Voucher Redemption Machine Report'' for each gaming day. The report shall include the ticket/voucher's unique identifier, the date and time of redemption and the value of the ticket/voucher.

§ 1407a.8. Sports wagering interactive system requirements.

 (a) Sports wagering platforms must adhere to the requirements in Chapter 809a (relating to interactive gaming platform requirements) of these regulations.

 (b) Sports wagering interactive systems must adhere, where applicable, to the requirements in Chapter 810a (relating to interactive gaming testing and controls) of the Board's regulations.

§ 1407a.9. Sports wagering system general requirements.

 (a) A sports wagering system shall, at least once every 24 hours, perform a self-authentication process on all software used to offer, record and process wagers to ensure there have been no unauthorized modifications. In the event of an authentication failure, at a minimum, the sports wagering system shall immediately notify the certificate holder's or operator's sports wagering manager and the Board within 24 hours. The results of all self-authentication attempts shall be recorded by the system and maintained for a period of not less than 90 days.

 (b) The sports wagering certificate holder or sports wagering operator operating the sports wagering system shall provide to the Board real time in-person administrative access and remote access to wagering transaction and related data as deemed necessary in a manner approved by the Board. A sports wagering certificate holder or sports wagering operator shall include in its internal controls required under § 1408a.3 (relating to internal controls) the policies and procedures that will be implemented regarding real time in-person administrative read-only access and remote read-only access to the sports wagering system by the Board.

 (c) A sports wagering system shall be capable of preventing any sports wager in excess of $10,000 or making a payout in excess of $10,000 until authorized by the sports wagering manager. A sports wagering certificate holder or sports wagering operator shall include in its internal controls required under § 1408a.3 the policies and procedures that will be implemented regarding those wagers and payouts.

CHAPTER 1408a. SPORTS WAGERING ACCOUNTING AND INTERNAL CONTROLS

Sec.

1408a.1.	Scope.
1408a.2.	Definitions.
1408a.3.	Internal controls.
1408a.4.	Terms and conditions.
1408a.5.	Information to be displayed/provided.
1408a.6.	Segregation of bank accounts.
1408a.7.	Sports wagering certificate holder's or sports wagering operator's organization.
1408a.8.	Risk management.
1408a.9.	Integrity monitoring.
1408a.10.	Mandatory logging.
1408a.11.	Records/data retention requirements.
1408a.12.	Required reports.
1408a.13.	Accounting controls for the sports wagering area.
1408a.14.	Sports wagering accounts.

§ 1408a.1. Scope.

 To ensure the integrity and security of sports wagering operations in this Commonwealth, the requirements of this chapter apply to all sports wagering certificate holders and sports wagering operators seeking to offer sports wagering to patrons in this Commonwealth. The requirements in this chapter supplement, where not in conflict with and where applicable, existing Board regulations in Subpart E (relating to slot machine, table game and associated equipment testing and control; accounting and internal controls), Chapter 465a (relating to accounting and internal controls) and Subpart L (relating to interactive gaming) applicable to slot machine licensees, interactive gaming certificate holders and interactive gaming operators unless the context clearly indicates otherwise.

§ 1408a.2. Definitions.

 The following words and terms, when used in this chapter, have the following meanings, unless the context clearly indicates otherwise:

 Integrity monitoring—Monitoring of sports wagering to identify suspicious wagering activity or unusual wagering activity to then report the activities to required parties.

 Personal identifiable information—Any data or information that can be used, on its own or with other data or information, to identify, contact or otherwise locate a player or registered player, including a player's or registered player's name, address, date of birth and social security number.

 Risk management—Processes and tools that sports wagering certificate holders or sports wagering operators use to manage the risk and liabilities associated with sports wagering.

 Sports wagering device and associated equipment—Self-service kiosk, point of sale system or other device, including associated equipment, used to accept sports wagering as permitted for use in this Commonwealth by the Board.

 Sports wagering system—Sports wagering devices, equipment, communication technology, software and hardware approved by the Board to conduct sports wagering in this Commonwealth.

 Suspicious wagering activity—Unusual wagering activity that cannot be explained and is indicative of match fixing, the manipulation of an event, misuse of inside information or other prohibited activity.

 Unusual wagering activity—Abnormal wagering activity exhibited by patrons and deemed by the sports wagering certificate holder or sports wagering operator as a potential indicator of suspicious activity which may include the size of a patron's wager or increased wagering volume on a particular event or wager type.

§ 1408a.3. Internal controls.

 (a) At least 90 days prior to commencing sports wagering under this subpart, a sports wagering certificate holder or sports wagering operator shall submit to the Board for approval internal controls for all aspects of sports wagering, including retail sportsbooks, interactive sportsbook operations through a web site or mobile application and nonprimary location sportsbook operations, prior to implementation and any time a change is made thereafter. The internal controls shall include detailed procedures for system security, operations, accounting, and other information as required by the Board.

 (b) Notwithstanding subsection (a), the procedures and controls may be implemented by a sports wagering certificate holder or sports wagering operator upon the filing of the procedures and controls with the Board and written approval to commence operations by the Executive Director. Each procedure or control submission shall contain both narrative and diagrammatic representations of the system to be utilized and shall include the following:

 (1) Provide for reliable accounting controls, including the standardization of forms and definition of terms to be utilized in the retail sports wagering and interactive or mobile sports wagering operations.

 (2) Procedures, forms and, where appropriate, details as to the reconciliation of assets and documents contained in the retail sports wagering cashier drawers. These procedures shall provide for the reporting of any overage or shortage.

 (3) Job descriptions and the system of personnel and chain of command, establishing a diversity of responsibility among employees engaged in sports wagering operations, including employees of a sports wagering operator and identifying primary and secondary management and supervisory positions for areas of responsibility.

 (4) Procedures for the registration of players and establishment of sports wagering accounts, including a procedure for authenticating the age, identity and physical address of an applicant for a sports wagering account and whether the applicant is a person prohibited from establishing or maintaining an account under applicable laws or regulations.

 (5) Procedures for terminating a registered player's sports wagering account and the return of any funds remaining in the sports wagering account to the registered player.

 (6) Procedures for suspending or terminating a dormant sports wagering account and the return of any funds remaining in the dormant sports wagering account to the registered player.

 (7) Procedures for the logging in and authentication of a registered player to enable the player to commence sports wagering and the logging off of the registered player when the registered player has completed play, including a procedure to automatically log a registered player out of the registered player's sports wagering account after a specified period of inactivity.

 (8) Procedures for the crediting and debiting of a registered player's sports wagering account.

 (9) Procedures for cashing checks, receiving electronic negotiable instruments and for redeeming cash equivalents.

 (10) Procedures for withdrawing funds from a sports wagering account by the registered player.

 (11) Procedures for the protection of a registered player's funds, including the segregation of a registered player's funds from operating funds of the sports wagering certificate holder or sports wagering operator.

 (12) Procedures for recording transactions pertaining to sports wagering.

 (13) Procedures for the security and sharing of personal identifiable information of a registered player, funds in a sports wagering account and other information as required by the Board. The procedures shall include the means by which a sports wagering certificate holder or sports wagering operator will provide notice to a registered player related to the sharing of personal identifiable information.

 (14) Procedures and security for the calculation and recordation of revenue.

 (15) Procedures for the security of the sports wagering platform, sports wagering interactive system, sports wagering devices and associated equipment.

 (16) Procedures and security standards as to receipt, handling and storage of sports wagering devices and associated equipment.

 (17) Procedures and security standards to protect and respond to suspected or actual hacking or tampering by any person with the sports wagering certificate holder's or sports wagering operator's interactive sports wagering web site, mobile application and sports wagering devices and associated equipment.

 (18) Procedures to verify each registered player's physical location each time a registered player logs into his or her sports wagering account and at appropriate intervals thereafter as determined by the Board.

 (19) Procedures and appropriate measures implemented to deter, detect and, to the extent possible, to prevent cheating, including collusion and use of cheating devices, including the use of software programs that make wagers according to algorithms.

 (20) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking or tampering with the sports wagering certificate holder's or sport wagering operator's interactive sports wagering platform, interactive sports wagering web site or mobile application and sports wagering devices and associated equipment. The procedures shall include the process for the reconciliation or repayment of a registered player's sports wagering account.

 (21) If any athlete or person who holds a position of authority or influence sufficient to exert influence over the participants in an athletic event, as fully described in § 1401a.7(c) (relating to prohibited and restricted sports wagering activities) of this subpart, has less than 10% direct or indirect ownership interest in or control of a sports wagering certificate holder or a sports wagering operator, procedures for the following shall be included:

 (i) Providing notice to the Board of the identity of the owner, and if known, the ownership interest in the sports wagering certificate holder or sports wagering operator.

 (ii) Implementing appropriate measures to prevent an athlete or a person from participating in the management or operations of sports wagering activities of a sports wagering certificate holder or a sports wagering operator.

 (iii) Obtaining a certification from the owner acknowledging that the owner is not permitted to be a customer of the sports wagering certificate or operator under § 1401.7a(b)(2), not permitted participate in the management or operations of the sports wagering certificate holder or sports wagering operator, and not permitted to engage in sports wagering activity on any team in the league as that in which he has an ownership interest.

 (c) The submission required under subsections (a) and (b) shall include a detailed description of the sports wagering certificate holder's or sports wagering operator's administrative and accounting procedures related to sports wagering, including its written system of internal controls. Each written system of internal controls shall include:

 (1) An organizational chart depicting appropriate functions and responsibilities of employees involved in sports wagering.

 (2) A description of the duties and responsibilities of each position shown on the organizational chart.

 (3) The record retention policy of the sports wagering certificate holder or sports wagering operator.

 (4) The procedure to be utilized to ensure that money generated from the conduct of sports wagering is safeguarded and accounted for.

 (5) Procedures to ensure that recorded accountability for assets is compared with actual assets at intervals required by the Board and appropriate action is taken with respect to discrepancies.

 (6) Procedures to be utilized by an employee of a sports wagering certificate holder or sports wagering operator in the event of a malfunction of a sports wagering certificate holder's interactive sports wagering platform, interactive sports wagering web site or mobile application and sports wagering devices and associated equipment used in the conduct of sports wagering.

 (7) Procedures to be utilized by the sports wagering certificate holder or sports wagering operator to prevent persons under 21 years of age, self-excluded or involuntary excluded individuals, individuals who are prohibited from wagering in accordance with § 1401a.8 (relating to persons prohibited from engaging in sports wagering activities) and players outside this Commonwealth from engaging in sports wagering.

 (8) Other items the Board may request in writing to be included in the internal controls.

 (d) Prior to authorizing a sports wagering certificate holder or sports wagering operator to commence the conduct of sports wagering, the Board shall review and approve the system of internal controls, security protocols and audit protocols submitted under this chapter to determine whether they conform to the requirements of this chapter and whether they provide adequate and effective controls for the conduct of sports wagering.

 (e) If a sports wagering certificate holder or sports wagering operator intends to make a change or amendment to its system of internal controls, it shall submit the change or amendment electronically to the Bureau of Gaming Operations, in a manner prescribed by the Bureau of Gaming Operations. The sports wagering certificate holder or sports wagering operator may implement the change or amendment on the 30th calendar day following the filing of a complete submission unless the sports wagering certificate holder or sports wagering operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.

 (f) If during the 30-day review period in this chapter, the Bureau of Gaming Operations preliminarily determines that a procedure in a submission contains an insufficiency likely to negatively affect the integrity of sports wagering or the control of revenue generated from sports wagering, the Bureau of Gaming Operations, by written notice to the sports wagering certificate holder or sports wagering operator, will:

 (1) Specify the nature of the insufficiency and, when possible, an acceptable alternative procedure.

 (2) Direct that the 30-calendar day review period in this chapter to be tolled and that any internal controls at issue not be implemented until approved under this chapter.

 (g) Examples of submissions that may contain an insufficiency likely to negatively affect the integrity of sports wagering may include any of the following:

 (1) Submissions that fail to provide information sufficient to permit the review of sports wagering activities by the Board.

 (2) Submissions that fail to provide for the segregation of incompatible functions so that no employee is in a position to both commit an error or perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.

 (3) Submissions that do not include forms or other materials referenced in the submission or required under the act or this subpart.

 (4) Submissions that would implement operations or accounting procedures not authorized by the act or this subpart.

 (h) Whenever a change or amendment has been tolled under this chapter, the sports wagering certificate holder or sports wagering operator may submit a revised change or amendment within 30 days of receipt of the written notice from the Bureau of Gaming Operations. The sports wagering certificate holder or sports wagering operator may implement the revised change or amendment upon receipt of written notice of approval from the Board's Executive Director or on the 30th calendar day following the filing of the revision unless the sports wagering certificate holder or sports wagering operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.

 (i) A sports wagering certificate holder or sports wagering operator shall submit to the Board for approval a Catalog of Events and Wagers, which shall include a description of the events and wagers intended to be offered and shall include the following:

 (1) Sport.

 (2) Competition or league.

 (3) Governing body.

 (4) Games or matches.

 (5) Description of the type of events that it intends to accept wagers on as well as the type of wagers it intends to accept.

 (j) A sports wagering certificate holder or sports wagering operator shall submit for approval any revision to the Catalog of Events and Wagers at least 72 hours in advance of implementation of these changes. A sports wagering certificate holder or sports wagering operator must maintain a catalog of all prior and current events and the types of wagers it offered on the events.

 (k) The Board reserves the right to prohibit the acceptance of wagers and may order the cancellation or discontinuation of wagering, and require refunds on any event which may have an impact on the public or the integrity of sports wagering operations.

 (l) A sports wagering certificate holder or sports wagering operator shall only accept wagers on sporting events for which:

 (1) The outcome can be verified.

 (2) The outcome can be generated by a reliable and independent process.

 (3) The outcome is not affected by any wagers placed.

 (4) The event is conducted in conformity with all applicable laws or regulations.

 (m) A sports wagering certificate holder or sports wagering operator shall not unilaterally rescind or cancel any wager made pursuant to this chapter without prior approval of the Board.

 (n) The available wagers, including the event number, odds and a brief description of the event, shall be displayed to the public, the sports wagering certificate holder or sports wagering operator's closed circuit television system, interactive sports wagering web site and mobile application.

 (o) Winning sports wagering tickets shall be redeemed through the sports wagering system, and a ticket writer or self-service kiosk shall cause the winning ticket to be cancelled in the sports wagering system upon redemption.

§ 1408a.4. Terms and conditions.

 (a) A sports wagering certificate holder or sports wagering operator shall develop terms and conditions for sports wagering which shall be included in the internal controls. The terms and conditions and any changes thereto must be acknowledged by the player and the acknowledgment must be date and time-stamped by the sports wagering system.

 (b) The terms and conditions must address all aspects of the sports wagering operation, including all of the following:

 (1) Name of the party or parties with whom the player is entering into a contractual relationship, including any sports wagering certificate holder or sports wagering operator.

 (2) Player's consent to have the sports wagering certificate holder or sports wagering operator confirm the player's age, identity and, for purposes of interactive sports wagering, location.

 (3) Rules and obligations applicable to the player other than rules of sports wagering including all of the following:

 (i) Prohibition from allowing any other person to access or use his or her sports wagering account.

 (ii) Prohibition from engaging in sports wagering activity, unless the player is physically located in this Commonwealth.

 (iii) Consent to the monitoring and recording by the sports wagering certificate holder, the sports wagering operator or the Board, or both, of any wagering communications and geographic location information.

 (iv) Consent to the jurisdiction of this Commonwealth to resolve any disputes arising out of sports wagering.

 (v) Prohibition against utilizing automated computerized software or other equivalent mechanism to engage in sports wagering.

 (4) Full explanation of fees and charges imposed upon a player related to sports wagering transactions.

 (5) Availability of account statements detailing sports wagering account activity.

 (6) Privacy policies, including information access and use of customer data.

 (7) Legal age policy, including a statement that it is a criminal offense to allow a person who is under 21 years of age to participate in sports wagering and a player who does so shall be prohibited from participating in sports wagering.

 (8) Notification that if the player's sports wagering account remains dormant for a period of 2 years any funds remaining on deposit and any pending wagers may be forfeited under applicable State and Federal laws.

 (9) Player's right to set responsible gaming limits and self-exclude.

 (10) Player's right to suspend his or her sports wagering account for a period of no less than 72 hours.

 (11) Actions that will be taken in the event a player becomes disconnected from the sports wagering system during active betting.

 (12) Notice that a malfunction voids all transactions.

 (13) Estimated time-period for withdrawal of funds from the sports wagering account.

 (14) Detailed information regarding compulsive and problem gaming and self-exclusion to be displayed on a player protection page.

 (15) Method for changing or retrieving a password or other approved access security feature and the ability to choose ''strong authentication'' log in protection.

 (16) Method for filing a complaint with the sports wagering certificate holder or sports wagering operator and method for filing with the Board an unresolved complaint after all reasonable means to resolve the complaint with the sports wagering certificate holder or sports wagering operator have been exhausted.

 (17) Method for obtaining a copy of the terms and conditions agreed to when establishing a sports wagering account.

 (18) Method for the player to obtain account and wagering history from the sports wagering certificate holder or sports wagering operator.

 (19) Notification of Federal prohibitions and restrictions regarding sports wagering activity, specifically, any limitations upon sports wagering activity as set forth in The Wire Act (18 U.S.C.A. §§ 1081—1084) and the Unlawful Internet Gaming Enforcement Act (31 U.S.C.A. §§ 5361—5367). The notice shall explicitly state that it is a Federal offense for persons physically located outside of this Commonwealth to engage in sports wagering activity through a sports wagering certificate holder or sports wagering operator, unless explicitly authorized by State or Federal law.

 (20) Any other information as required by the Board.

§ 1408a.5. Information to be displayed/provided.

 A sports wagering certificate holder or sports wagering operator shall provide for the prominent display of the following information at the certificate holder's retail sportsbook and on a page which, by virtue of the construction of the web site or mobile application, registered players must access before beginning a sports wagering session:

 (a) The full name of the sports wagering certificate holder and, as applicable, the sports wagering operator and address from which it carries on business.

 (b) A logo, to be provided by the Board for display on the certificate holder's or licensee's online sportsbook, indicating that the sports wagering certificate holder, and as applicable, the sports wagering operator on behalf of the sports wagering certificate holder, is authorized to operate sports wagering in this Commonwealth.

 (c) The license number of the sports wagering certificate holder, and as applicable, the sports wagering operator.

 (d) A statement that persons under 21 years of age are not permitted to engage in sports wagering.

 (e) Readily available information at the certificate holder's retail sportsbook or active links on the sports wagering certificate holder's or sports wagering operator's sports wagering web site or mobile application that contains all of the following:

 (1) Information explaining how disputes are resolved.

 (2) Problem gaming information that is designed to offer information pertaining to responsible gaming.

 (3) Board's contact information.

 (4) Information that allows for a patron to choose to be excluded from engaging in sports wagering.

 (5) Comprehensive house rules governing wagering transactions with patrons. The house rules must be immediately available to patrons at a licensed facility's retail and interactive or mobile application sportsbooks, and must be included in a sports wagering certificate holder's or sports wagering operator's internal controls required under § 1408a.3 (relating to internal controls). The rules must include all of the following:

 (i) Method for calculation and payment of winning wagers.

 (ii) Description of the process for handling incorrectly posted events, odds, wagers or results.

 (iii) Effect of schedule changes.

 (iv) Method of notifying patrons of odds or proposition changes.

 (v) Acceptance of wagers at other than posted terms.

 (vi) Expiration of any winning ticket.

 (vii) Method of contacting the operator for questions and complaints.

 (viii) Description of person prohibited from engaging in sports wagering.

 (ix) A statement regarding the policy and methods for limiting the maximum amount that a patron can win on any particular wager; however, the policy will not preclude a patron from collecting a payout in excess of the purported amount if the system allows the patron to place a valid wager that pays more than the stated maximum amount.

 (x) Methods of funding a sports wager.

§ 1408a.6. Segregation of bank accounts.

 (a) A sports wagering certificate holder or sports wagering operator shall maintain a domestic bank account for player's funds separate from all other operating accounts to ensure the security of funds held in the player's sports wagering accounts.

 (b) The balance maintained in this account shall be greater than or equal to the sum of the daily ending cashable balance of all player sports wagering accounts and unpaid wagers.

 (c) A sports wagering certificate holder or sports wagering operator shall have unfettered access to all player sports wagering account and transaction data to ensure the amount of funds held in its independent account is sufficient. A sports wagering certificate holder's or sports wagering operator's Chief Financial Officer shall file a quarterly attestation with the Board, unless otherwise directed by the Board, that the funds have been safeguarded under this section.

§ 1408a.7. Sports wagering certificate holder's or sports wagering operator's organization.

 (a) A sports wagering certificate holder's or sports wagering operator's systems of internal controls must include organization charts depicting segregation of functions and responsibilities and descriptions of the duties and responsibilities for each position shown on each organization chart. Sports wagering certificate holder or sports wagering operator shall be permitted, except as otherwise provided in this section, to tailor organizational structures to meet the needs or policies of a particular management philosophy. A sports wagering certificate holder's or sports wagering operator's organization charts must provide for:

 (1) A system of personnel and chain of command which permits management and supervisory personnel to be held accountable for actions or omissions within their areas of responsibility.

 (2) The segregation of incompatible functions, duties and responsibilities so that no employee is in a position to both commit an error or perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.

 (3) The performance of all functions, duties and responsibilities in accordance with sound financial practices by qualified personnel.

 (4) The areas of responsibility which are not so extensive as to be impractical for an individual to monitor.

 (b) In addition to other positions required as part of a sports wagering certificate holder's or sports wagering operator's internal controls, a sports wagering certificate holder or sports wagering operator must maintain an information technology department supervised by an individual and licensed as a key employee who functions, for regulatory purposes, as the information technology director. A sports wagering certificate holder or sports wagering operator shall employ an information technology security officer and, if the certificate holder or licensee offers interactive or mobile sports wagering, an interactive gaming manager, both of whom shall be licensed as a key employee.

 (c) The information technology director shall be responsible for the integrity of all data, the quality, reliability and accuracy of all computer systems and software used by the sports wagering certificate holder or sports wagering operator in the conduct of sports wagering activities, whether the data and software are located within or outside the certificate holder's or operator's facility, including, without limitation, specification of appropriate computer software, hardware, and procedures for security, physical integrity, audit and maintenance of:

 (1) Access codes and other computer security controls used to insure appropriately limited access to computer software and data.

 (2) Monitoring logs of user access, security incidents and unusual transactions.

 (3) Logs used to document and maintain the details of any hardware and software modifications.

 (4) Computer tapes, disks or other electronic storage media containing data relevant to sports wagering operations.

 (5) Computer hardware, communications equipment and software used in the conduct of sports wagering.

 (d) The information technology security officer shall report to the information technology director and be responsible for:

 (1) Maintaining access codes and other computer security controls used to insure appropriately limited access to computer software and data.

 (2) Reviewing logs of user access, security incidents and unusual transactions.

 (3) Coordinating the development of the sports wagering certificate holder's or sports wagering operator's information security policies, standards and procedures.

 (4) Coordinating the development of an education and training program on information security and privacy matters for employees and other authorized users.

 (5) Ensuring compliance with all State and Federal information security policies and rules.

 (6) Preparing and maintaining security-related reports and data.

 (7) Working with internal and external audit personnel to ensure all findings are addressed in a timely and effective manner.

 (8) Developing and implementing an Incident Reporting and Response System to address security breaches, policy violations and complaints from external parties.

 (9) Serving as the official contact for information security and data privacy issues, including reporting to law enforcement.

 (10) Developing and implementing an ongoing risk assessment program that targets information security and privacy matters by identifying methods for vulnerability detection and remediation and overseeing the testing of those methods.

 (11) Remaining current with the latest information technology security and privacy legislation, rules, advisories, alerts, and vulnerabilities to ensure the sports wagering certificate holder's security program and security software is effective.

 (e) The interactive gaming manager shall report to the information technology director, or other department manager as approved by the Board, and be responsible for ensuring the proper operation and integrity of interactive or mobile sports wagering and reviewing all reports of suspicious behavior. The interactive gaming manager shall immediately notify the Bureau upon detecting any person participating in interactive or mobile sports wagering who is:

 (1) Engaging in or attempting to engage in, or who is reasonably suspected of cheating, theft, embezzlement, collusion, money laundering or any other illegal activities.

 (2) A self-excluded person.

 (3) A person that is prohibited by the sports wagering certificate holder or sports wagering operator from sports wagering.

§ 1408a.8. Risk management.

 (a) A sports wagering certificate holder or sports wagering operator must implement risk management procedures. These procedures may be provided in-house or by an independent third party.

 (b) A sports wagering certificate holder's or sports wagering operator's internal controls must contain a description of its risk management framework including all of the following:

 (1) Automated and manual risk management procedures.

 (2) User access controls for all sportsbook personnel.

 (3) Information regarding segregation of duties.

 (4) Information regarding fraud detection.

 (5) Controls ensuring regulatory compliance.

 (6) Description of anti-money laundering compliance standards.

 (7) Description of all software applications that comprise the sports wagering system.

 (8) Description of all types of wagers available to be offered by the sports wagering system.

 (9) Description of all integrated third-party systems.

 (10) Description of the policies and procedures to be followed in the event that an error occurs in the offering of an event or wager, including cancellation of the wagers placed due to error, which shall be subject to Board approval.

 (11) Any other information required by the Board.

 (c) A sports wagering certificate holder or sports wagering operator shall file with the Office of Sports Wagering, in a manner and form developed by the Board, a report of any error that occurs in offering an event or wager or if an unapproved event or wager is offered to the public.

 (1) Reports shall be filed no later than 5 calendar days after a sports wagering certificate holder or sports wagering operator initially detects or discovers facts that constitute the basis of filing a report.

 (2) In situations involving activity that requires immediate attention, a sports wagering certificate holder or sports wagering operator shall immediately notify the Office of Sports Wagering in addition to the timely filing of a report.

 (d) A sports wagering certificate holder or sports wagering operator shall maintain a copy of any report filed with the Board and the original or business record equivalent of any supporting documentation for a period of 5 years from the date the report was filed.

 (1) Supporting documentation shall be identified and maintained by a sports wagering certificate holder or sports wagering operator as such, and shall be deemed to have been filed with the report.

 (2) A sports wagering certificate holder or sports wagering operator shall make all supporting documentation available to the Board upon request.

§ 1408a.9. Integrity monitoring.

 (a) A sports wagering certificate holder or sports wagering operator must implement integrity monitoring procedures. These procedures may be provided in-house or by an independent third party.

 (b) A sports wagering certificate holder or sports wagering operator must share information in timely manner of unusual wagering activity or other suspicious wagering activity regarding sports wagering in this Commonwealth with:

 (1) Other sports wagering certificate holders or sports wagering operators.

 (2) The Board.

 (c) A sports wagering certificate holder or sports wagering operator must submit a yearly report to the Board detailing its integrity monitoring services and summarizing any unusual wagering activity or other suspicious wagering activity notifications issued during that time period.

 (d) A sports wagering certificate holder or sports wagering operator receiving a report of unusual wagering activity or suspicious wagering activity is permitted to suspend wagering on events related to the report and may only cancel related wagers under procedures previously approved by the Board.

 (e) A sports wagering certificate holder or sports wagering operator must provide the Board with remote access to its integrity monitoring system which shall provide at a minimum:

 (1) Reports of unusual wagering activity.

 (2) If the activity was determined to be suspicious.

 (3) The actions taken by the sports wagering certificate holder or sports wagering operator.

 (f) A sports wagering certificate holder or sports wagering operator shall file with the Office of Sports Wagering, in a manner and form developed by the Board, a report of any unusual wagering activity or suspicious wagering activity.

 (1) Reports shall be filed no later than 5 calendar days after a sports wagering certificate holder or sports wagering operator initially detects or discovers facts that constitute the basis of filing a report.

 (2) In situations involving activity that requires immediate attention, a sports wagering certificate holder or sports wagering operator shall immediately notify the Office of Sports Wagering in addition to the timely filing of a report.

 (g) A sports wagering certificate holder or sports wagering operator shall maintain a copy of any report filed with the Board and the original or business record equivalent of any supporting documentation for a period of 5 years from the date the report was filed.

 (1) Supporting documentation shall be identified and maintained by a sports wagering certificate holder or sports wagering operator as such, and shall be deemed to have been filed with the report.

 (2) A sports wagering certificate holder or sports wagering operator shall make all supporting documentation available to the Board upon request.

§ 1408a.10. Mandatory logging.

 A sports wagering certificate holder's or sports wagering operator's sports wagering system must comply with the mandatory logging requirements in Subpart L (relating to interactive gaming) of the Board's regulations.

§ 1408a.11. Records/data retention requirements.

 A sports wagering certificate holder's or sports wagering operator's sports wagering system must comply with the record/data retention requirements in Chapter 465a (relating to accounting and internal controls) and Subpart L (relating to interactive gaming) of the Board's regulations.

§ 1408a.12. Required reports.

 Nothing in this section shall be interpreted to prohibit an onsite sportsbook from accepting anonymous sports wagers at self-service kiosks or point of sale terminals. These wagers should be included in the required reports detailed in this section and identified as ''anonymous player'' or a similar identifier.

 (a) A sports wagering certificate holder's or sports wagering operator's sports wagering system must comply with the reporting requirements in Subpart L (relating to interactive gaming) of the Board's regulations as it pertains to interactive sports wagering through a web site or mobile application.

 (b) A sports wagering certificate holder or sports wagering operator must generate reports specific to its sports wagering operations as specified by the Board that shall include, at a minimum:

 (1) The report title.

 (2) The date or time period of activity, or description ''as of'' a point in time.

 (3) The date and time the report was generated.

 (4) Page numbering, indicating the current page and total number of pages.

 (5) Subtotals and grand totals as required by the Board.

 (6) A description of any filters applied to the data presented in the document.

 (7) Column and row titles, if applicable.

 (8) The name of the sports wagering certificate holder or sports wagering operator.

 (c) All required reports shall be generated by the sports wagering certificate holder or sports wagering operator, even if the period specified contains no data to be presented. The report generated shall indicate all required information and contain an indication of ''No Activity'' or similar message if no data appears for the period specified.

 (d) The sports wagering certificate holder or sports wagering operator shall provide a mechanism to export the data generated for any report to a format approved by the Board and as often as required by the Board.

 (e) For retail sports wagering operations, a sports wagering system shall generate, at a minimum, all of the following daily reports:

 (1) A ''Sports Wagering Intake Summary Report'' which shall include:

 (i) Tickets sold.

 (ii) Tickets paid.

 (iii) Tickets voided.

 (iv) Each ticket cancelled.

 (v) Sports wagering voucher issued.

 (vi) Sports wagering voucher redeemed.

 (vii) Over or short amount to writer's drawer.

 (viii) Grand total of each transaction type for all writers.

 (2) A ''Sports Wagering Results Summary Report'' which shall include for each event type (that is, NFL, NHL, MLB, NCCA by sports, parlay, and the like):

 (i) Ticket sales.

 (ii) Tickets paid.

 (iii) Tickets voided

 (iv) Tickets cancelled.

 (v) Expired tickets.

 (vi) Net sports wagering gross revenue.

 (vii) Grand total of each transaction type for all events.

 (3) A ''Sports Wagering Ticket Expiration Detail Report'' which shall include:

 (i) Ticket identification number.

 (ii) Date and time of issuance.

 (iii) Event.

 (iv) Wager description.

 (v) Bet amount.

 (vi) Payout amount.

 (4) A ''Sports Wagering Voided Ticket Report'' which shall include:

 (i) Ticket number.

 (ii) Date and time of issuance.

 (iii) Event.

 (iv) Wager description.

 (v) Bet amount.

 (vi) Writer name or identification number.

 (vii) Reason for void.

 (5) A ''Sports Wagering Cancelled Ticket Report'' which shall include all of the following:

 (i) Ticket number.

 (ii) Date and time of issuance.

 (iii) Event.

 (iv) Wager description.

 (v) Bet amount.

 (vi) Reason for cancelation.

 (6) A ''Sports Wagering Ticket Liability Report'' which shall include all of the following:

 (i) Ticket number.

 (ii) Date and time of issuance.

 (iii) Event.

 (iv) Wager description.

 (v) Amount.

 (vi) Status (pending or complete).

 (7) A ''Sports Wagering Voucher Liability Report'' which shall include all of the following:

 (i) Voucher number.

 (ii) Date and time of issuance.

 (iii) Amount.

 (f) The Sports Wagering Results Summary Report shall be reconciled with the Sports Wagering Intake Summary Report, and any discrepancy shall be reported to the Board.

 (g) For retail sports wagering and interactive or mobile sports wagering, a sports wagering system shall generate, at a minimum, all of the following daily reports:

 (1) A ''Sports Wagering Detail Report'' which shall include all of the following:

 (i) Transaction time.

 (ii) Patron account identifier, for interactive or mobile sports wagering.

 (iii) Wager identification number.

 (iv) Event type.

 (v) Wager description.

 (vi) Event date.

 (vii) Wager placed amount.

 (viii) Wager paid amount.

 (ix) Voided wager amount.

 (x) Cancelled wager amount.

 (xi) Resettled wager adjustment amount.

 (xii) Transaction impact on sports wagering revenue.

 (2) A ''Sports Wagering Voided Wager Report'' which shall include all of the following:

 (i) Transaction time.

 (ii) Patron account identifier, for interactive or mobile sports wagering.

 (iii) Ticket wager identification number.

 (iv) Date and time of issuance.

 (v) Time of void.

 (vi) Event type.

 (vii) Wager description.

 (viii) Event date.

 (ix) Wager amount.

 (x) Cashier employee name or identification number.

 (xi) Reason for void.

 (3) A ''Sports Wagering Cancelled Wager Report'' which shall include all of the following:

 (i) Transaction time.

 (ii) Patron account identifier, for interactive or mobile sports wagering.

 (iii) Ticket wager identification number.

 (iv) Date and time of issuance.

 (v) Event type.

 (vi) Wager description.

 (vii) Event date.

 (viii) Wager amount.

 (ix) Reason for cancellation.

 (4) A ''Sports Wagering Resettlement Report'' which shall include all of the following:

 (i) Patron account identifier, for interactive or mobile sports wagering.

 (ii) Wager identification number.

 (iii) Event type.

 (iv) Wager description.

 (v) Date and time of initial settlement.

 (vi) Date and time of resettlement.

 (vii) Unsettled amount.

 (viii) Resettlement amount.

 (ix) Net adjustment.

 (h) For retail sports wagering and interactive or mobile sports wagering, a sports wagering system shall generate on a monthly basis on the last day of each calendar month a ''Retail Sports Wagering Liability Report'' and an ''Interactive or Mobile Sports Wagering Liability Report'' which shall include all of the following:

 (1) Date generated.

 (2) Patron account identifier, for interactive or mobile sports wagering.

 (3) Wager identification number.

 (4) Event type.

 (5) Wager description.

 (6) Date and time of issuance.

 (7) Event date.

 (8) Amount.

 (9) Status (that is, pending or complete).

§ 1408a.13. Accounting controls for the sports wagering area.

 (a) The assets for which each ticket writer is responsible shall be maintained on an imprest basis. A ticket writer shall not permit any other person to access his or her imprest inventory.

 (b) A ticket writer shall begin a shift with an imprest amount of currency and coin to be known as the ''sports wagering inventory.'' No funds shall be added to or removed from the sports wagering inventory during the shift, except:

 (1) In collection of sports wagering wagers.

 (2) To make change for a patron buying a sports wagering ticket.

 (3) In collection for the issuance of sports wagering vouchers.

 (4) In payment of winning or properly cancelled or refunded sports wagering tickets.

 (5) In payment of sports wagering vouchers.

 (6) In exchanges with the cage, a satellite cage or sports wagering area vault supported by proper documentation, which documentation shall be sufficient for accounting reconciliation purposes.

 (c) A ''sports wagering count sheet'' shall be completed and signed by the sports wagering shift supervisor, and the following information, at a minimum, shall be recorded thereon at the commencement of shift:

 (1) The date, time and shift of preparation.

 (2) The denomination of currency of coin in the sports wagering inventory issued to the ticket writer.

 (3) The total amount of each denomination in the sports wagering inventory issued to the ticket writer.

 (4) The sports wagering window number to which the ticket writer has been assigned.

 (5) The signature of the sports wagering shift supervisor.

 (d) A ticket writer assigned to a ticket window shall count and verify the sports wagering inventory in an area out of view of the public, and shall agree the count to the sports wagering count sheet. The ticket writer shall sign the count sheet attesting to the accuracy of the information recorded thereon. The sports wagering inventory shall be placed in the ticket writer's drawer and transported directly to the appropriate sports wagering area window by the ticket writer.

 (e) At the conclusion of a ticket writer's shift, the ticket writer's drawer and its contents shall be transported to an area out of view of the public, where the ticket writer shall perform a blind count of the contents of the drawer and record the following information, at a minimum, on the sports wagering count sheet:

 (1) The date, time and shift of preparation.

 (2) The denomination of cash or cash equivalents in the drawer.

 (3) The total amount of each denomination of cash or cash equivalents in the drawer.

 (4) The signature of the ticket writer.

 (f) A sports wagering supervisor, or above, shall compare the ticket writer net for the shift generated by the terminal and if it agrees with the sports wagering count sheet total plus the sports wagering inventory, shall agree the count to the sports wagering count sheet and shall sign the sports wagering count sheet attesting to the accuracy.

 (g) If the sports wagering window net for the shift as generated by the system does not agree with the sports wagering count sheet total plus the sports wagering inventory, the sports wagering supervisor, or above, shall record any overage or shortage. If the count does not agree, the ticket writer and the sports wagering supervisor, or above, shall attempt to determine the cause of the discrepancy with the count.

 (h) If the discrepancy cannot be resolved by the ticket writer and sports wagering supervisor, or above, the discrepancy shall be reported in writing to the sports wagering manager or department supervisor in charge at the time. Any discrepancy in excess of $500 shall be reported to the Office of Sports Wagering and Bureau of Casino Compliance, with a report that shall include the following:

 (1) Date.

 (2) Shift.

 (3) Name of the ticket writer.

 (4) Name of the sports wagering supervisor, or above.

 (5) Window number.

 (6) Amount of the discrepancy.

§ 1408a.14. Sports wagering accounts.

 A sports wagering certificate holder's or sports wagering operator's sports wagering system shall comply with the player account requirements in Subpart L (relating to interactive gaming) of the Board's regulations as it pertains to sports wagering accounts used by a patron to participate in interactive or mobile sports wagering.

CHAPTER 1409a. SPORTS WAGERING ADVERTISEMENTS, PROMOTIONS AND TOURNAMENTS

Sec.

1409a.1.	General requirements.
1409a.2.	Sports wagering contests, tournaments, pools or other organized events.

§ 1409a.1. General requirements.

 A sports wagering certificate holder or sports wagering operator must comply with the advertisement and promotions requirements of Subparts C—E, I and L regarding its retail and interactive or mobile sportsbooks, including those provisions that require sports wagering certificate holders or sports wagering operators to submit all information to the Board as required by Subparts C—E, I and L.

§ 1409a.2. Sports wagering contests, tournaments, pools or other organized events.

 (a) A sports wagering certificate holder or sports wagering operator may offer a sports wagering contest, tournament, pool or other organized event in which a player purchases entry and engages in competitive play against other players, subject to the following:

 (1) Prior to offering a sports wagering contest, tournament, pool or other organized event, a sports wagering certificate holder or sports wagering operator shall file with the Office of Sports Wagering Operations for approval the terms and conditions of the contest, tournament, pool or other organized event at least 5 business days prior to the start of the contest, tournament, pool or other organized event.

 (2) The terms and conditions for the contest, tournament, pool or other organized contest shall not be altered by the sports wagering certificate holder or sports wagering operator after approval by the Office of Sports Wagering Operation without seeking an additional approval, and shall include, at a minimum, all of the following:

 (i) A description of the sports wagering contest, tournament, pool or other organized event.

 (ii) The dates and times in which the sports wagering contest, tournament, pool or other organized event will be conducted.

 (iii) Rules concerning sports wagering contest, tournament, pool or other organized event play and participation.

 (iv) Participation eligibility requirements, including all of the following:

 (A) The minimum and maximum number of participants.

 (B) Entry fees charged.

 (C) The monetary amount and description of the prizes to be awarded.

 (v) All conditions registered players shall meet to qualify for entry into, and advancement though, a sports wagering contest, tournament, pool or other organized event.

 (vi) Funding source amounts comprising the prize pool (for example, the sports wagering entry fees).

 (vii) Prize structure on payouts.

 (viii) Methodology for determining winners of the sports wagering contest, tournament, pool or other organized event.

 (ix) Any other information required by the Board.

 (3) The terms and conditions for all sports wagering contests, tournaments, pools or other organized events shall be posted on the interactive sports wagering web site or mobile application or, if applicable, in the sports wagering area of a retail sports book, and shall be stated in a clear and concise manner using plain language.

 (4) The terms and conditions of each sports wagering contest, tournament, pool or other organized event must be readily accessible to players on the interactive sports wagering web site or mobile application and remain available for review by players until the completion of the sports wagering contest, tournament, pool or other organized event.

 (5) A sports wagering contest, tournament, pool or other organized event may not accept real money from any source nor pay out real money in any way during a contest, tournament, pool or other organized event, and must utilize contest, tournament, pool or other organized event specific points or credits which do not have cash value.

 (b) Entry fees collected, less cash prizes paid, are to be included in the calculation of gross sports wagering revenue. In determining the amount to be included in the event that cash prizes paid out to players exceed entry fees collected, the sports wagering certificate holder or sports wagering operator shall be deemed to have paid the fees for the players.

 (c) After completion of a sports wagering contest, tournament, pool or other organized event, the results shall be made available on the interactive sports wagering web site or mobile application or, if applicable, in the sports wagering area of a retail sportsbook, for the players to review. Subsequent to posting, the results shall be recorded and be made available upon request, with the recording including all of the following:

 (1) The name of the sports wagering contest, tournament, pool or other organized event.

 (2) Date or dates of the sports wagering contest, tournament, pool or other organized event.

 (3) Total number of entries.

 (4) Total amount of entry fees collected.

 (5) Total prize pool.

 (6) Amounts paid for each winning category.

 (d) A sports wagering certificate holder or sports wagering operator licensee shall discontinue, as expeditiously as possible, a sports wagering contest, tournament, pool or other organized event upon receipt of written notice from the Board's Executive Director that it has been determined that the conduct of a sports wagering contest, tournament, pool or other organized event could adversely impact the public or the integrity of gaming.

 (e) A sports wagering contest, tournament, pool or other organized event may only be comprised of sporting events and wagers contained in the sports wagering certificate holder or sports wagering operator's approved Catalog of Events and Wagers under § 1408a.3(i) (relating to internal controls).

 (f) All software and sports wagering devices and associated equipment used in conjunction with sports wagering contests, tournaments, pools or other organized events are subject to requirements set forth in § 1407a.3 (relating to testing and approval generally).

 (g) Sports wagering contests, tournaments, pools or other organized events that do not require payment of an entry fee by a player are not subject to approval by the Office of Sports Wagering, but shall be considered a promotion and submitted as a notification to the Office of Sports Wagering under § 813a.3 (relating to promotions).

 (h) When conducting a sports wagering contest, tournament, pool or other organized event, a sports wagering certificate holder or sports wagering operator shall comply with the provisions of § 811a.9 (relating to required reports; reconciliation). In addition to the reports contained therein, the sports wagering certificate holder or sports wagering operator shall maintain and make available to the Board upon request the following information for sports wagering contests, tournaments, pools or other organized events:

 (1) Name of the sports wagering contest, tournament, pool or other organized event.

 (2) Start date of the sports wagering contest, tournament, pool or other organized event.

 (3) End date of the sports wagering contest, tournament, pool or other organized event.

 (4) Total number of entrants.

 (5) Total number of entries.

 (6) Total amount of entry fees.

 (7) Fees collected.

 (8) Total prize pool.

 (9) Patron's wagering selections.

 (10) Contest, tournament, pool or other organized event results.

 (11) Amounts paid for each winning category.

 (i) A sports wagering certificate holder or sports wagering operator licensee shall maintain records related to the conduct of sports wagering contests, tournaments, pools or other organized events in accordance with § 465a.6(c) (relating to retention, storage and destruction of books, records and documents) which shall be made available to Board staff and the Department upon request.

CHAPTER 1410a. SPORTS WAGERING COMPULSIVE AND PROBLEM GAMBLING REQUIREMENTS

Sec.

1410a.1.

General requirements.

§ 1410a.1. General requirements.

 (a) A sports wagering certificate holder or sports wagering operator must comply with the compulsive and problem gambling provisions of Subparts I and L (relating to compulsive and problem gambling; and interactive gaming) regarding its retail and interactive or mobile sportsbooks.

 (b) A sports wagering certificate holder or sports wagering operator shall amend its current compulsive gaming plans, programs, and the like to include sports wagering activities.

CHAPTER 1411a. SPORTS WAGERING SELF-EXCLUDED PERSONS

Sec.

1411a.1.

General requirements.

§ 1411a.1. General requirements.

 (a) A sports wagering certificate holder or sports wagering operator must comply with the self-exclusion provisions of Subparts I and L (relating to compulsive and problem gambling; and interactive gaming)regarding its retail and interactive or mobile sportsbooks.

 (b) A sports wagering certificate holder or sports wagering operator shall amend its current self-exclusion plans, programs, and the like to include sports wagering activities.

[Pa.B. Doc. No. 20-1808. Filed for public inspection December 24, 2020, 9:00 a.m.]

---

No part of the information on this site may be reproduced for profit or sold for profit.

This material has been drawn directly from the official Pennsylvania Bulletin full text database. Due to the limitations of HTML or differences in display capabilities of different browsers, this version may differ slightly from the official printed version.

---