[51 Pa.B. 5389]
[Saturday, August 28, 2021]

[Continued from previous Web Page]

CHAPTER 811a. INTERACTIVE GAMING ACCOUNTING AND INTERNAL CONTROLS

Sec.

811a.1.	Scope.
811a.2.	Internal controls.
811a.3.	Terms and conditions.
811a.4.	Information to be displayed on web site.
811a.5.	Segregation of bank accounts and reserve requirements.
811a.6.	Interactive gaming certificate holder's or interactive gaming operator's organization.
811a.7.	Mandatory interactive gaming system logging.
811a.8.	Records/data retention requirements.
811a.9.	Required reports; reconciliation.

§ 811a.1. Scope.

 To ensure the integrity and security of interactive gaming operations in this Commonwealth, this chapter applies to all interactive gaming certificate holders or interactive gaming operators seeking to offer interactive gaming to registered players in this Commonwealth.

§ 811a.2. Internal controls.

 (a) At least 90 days prior to commencing interactive gaming under this part, an interactive gaming certificate holder or interactive gaming operator shall submit to the Board for approval internal controls for all aspects of interactive gaming prior to implementation and any time a change is made thereafter. The internal controls must include detailed procedures for system security, operations, accounting, and reporting of compulsive and problem gamblers.

 (b) Notwithstanding subsection (a), the procedures and controls may be implemented by an interactive gaming certificate holder or interactive gaming operator upon the filing of the procedures and controls with the Board. Each procedure or control submission must contain narrative and diagrammatic representations of the system to be utilized and must include all of the following:

 (1) Procedures for reliable accounting controls, including the standardization of forms and definition of terms to be utilized in the interactive gaming operations.

 (2) Procedures, forms and, when appropriate, formulas to govern all of the following:

 (i) Calculation of hold percentages.

 (ii) Revenue drops.

 (iii) Expense and overhead schedules.

 (iv) Complimentary services.

 (v) Cash-equivalent transactions.

 (3) Job descriptions and the system of personnel and chain of command establishing a diversity of responsibility among employees engaged in interactive gaming operations, including employees of an interactive gaming operator, and identifying primary and secondary management and supervisory positions for areas of responsibility, salary structure and personnel practices.

 (4) Procedures for the registration of players and establishment of interactive gaming accounts, including a procedure for authenticating the age, identity and physical address of an applicant for an interactive gaming account and whether the applicant is a person prohibited from establishing or maintaining an account under section 13B22 of the act (relating to establishment of interactive gaming accounts).

 (5) Procedures for terminating a registered player's interactive gaming account and the return of any funds remaining in the interactive gaming account to the registered player.

 (6) Procedures for suspending or terminating a dormant interactive gaming account and the return of any funds remaining in the dormant interactive gaming account to the registered player.

 (7) Procedures for the logging in and authentication of a registered player to enable the player to commence interactive gaming and the logging off of the registered player when the player has completed play, including a procedure to automatically log a registered player out of the player's interactive gaming account after a specified period of inactivity.

 (8) Procedures for the crediting and debiting of a registered player's interactive gaming account.

 (9) Procedures for cashing checks, receiving electronic negotiable instruments, and redeeming chips, tokens or other cash equivalents.

 (10) Procedures for withdrawing funds from an interactive gaming account by the registered player.

 (11) Procedures for the protection of a registered player's funds, including the segregation of a registered player's funds from operating funds of the interactive gaming certificate holder or interactive gaming operator.

 (12) Procedures for recording transactions pertaining to interactive gaming.

 (13) Procedures for the security and sharing of personal identifiable information of a registered player, funds in an interactive gaming account and other information as required by the Board. The procedures must include the means by which an interactive gaming certificate holder or interactive gaming operator will provide notice to a registered player related to the sharing of personal identifiable information.

 (14) Procedures and security for the calculation and recordation of revenue.

 (15) Procedures for the security of interactive gaming devices and associated equipment.

 (16) Procedures and security standards as to receipt, handling, and storage of interactive gaming devices and associated equipment.

 (17) Procedures and security standards to protect the interactive gaming certificate holder's or interactive gaming operator's interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment from hacking or tampering by any person.

 (18) Procedures for responding to suspected or actual hacking or tampering with an interactive gaming certificate holder's or interactive gaming operator's interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment, including partial or complete suspension of interactive gaming or the suspension of any or all interactive gaming accounts when warranted.

 (19) Procedures to verify each registered player's physical location each time a registered player logs into his interactive gaming account and at appropriate intervals thereafter as determined by the Board.

 (20) Procedures to ensure that the interactive games are fair and honest and that appropriate measures are in place to deter, detect and, to the extent possible, prevent cheating, including collusion and use of cheating devices, including the use of software programs that make wagers according to algorithms.

 (21) Procedures to assist problem and compulsive gamblers, including procedures intended to prevent a person from participating in authorized interactive gaming who is otherwise prohibited from participating in interactive gaming.

 (22) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking or tampering with the interactive gaming certificate holder's interactive gaming skin, interactive gaming platform or interactive gaming web site. The procedures must include the process for the reconciliation or repayment of a registered player's interactive gaming account.

 (c) The submission required under subsections (a) and (b) must include a detailed description of the interactive gaming certificate holder's or interactive gaming operator's administrative and accounting procedures related to interactive gaming, including its written system of internal controls. Each written system of internal controls must include all of the following:

 (1) An organizational chart depicting appropriate duties and responsibilities of the key employees involved in interactive gaming.

 (2) A description of the duties and responsibilities of each position shown on the organizational chart.

 (3) The record retention policy of the interactive gaming certificate holder or interactive gaming operator.

 (4) The procedure to be utilized to ensure that money generated from the conduct of interactive gaming is safeguarded and accounted for.

 (5) Procedures to ensure that recorded accountability for assets is compared with actual assets at intervals required by the Board and appropriate action is taken with respect to discrepancies.

 (6) Procedures to be utilized by an employee of an interactive gaming certificate holder or interactive gaming operator in the event of a malfunction of an interactive gaming system or other equipment used in the conduct of interactive gaming.

 (7) Procedures to be utilized by the interactive gaming certificate holder or interactive gaming operator to prevent persons under 21 years of age, self-excluded or involuntary excluded individuals, and players outside this Commonwealth, unless otherwise authorized by an interactive gaming reciprocal agreement, from engaging in interactive gaming.

 (8) Other items the Board may request in writing to be included in the internal controls.

 (d) Prior to authorizing an interactive gaming certificate holder or interactive gaming operator to commence the conduct of interactive gaming, the Board will review the system of internal controls, security protocols and audit protocols submitted under this chapter to determine whether they conform to the requirements of this chapter and whether they provide adequate and effective controls for the conduct of interactive gaming.

 (e) If an interactive gaming certificate holder or interactive gaming operator intends to make a change or amendment to its system of internal controls, it shall submit the change or amendment electronically to the Bureau of Gaming Operations in a manner prescribed by the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator may implement the change or amendment on the 30th calendar day following the filing of a complete submission unless the interactive gaming certificate holder or interactive gaming operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.

 (f) If during the 30-day review period in this chapter, the Bureau of Gaming Operations preliminarily determines that a procedure in a submission contains an insufficiency likely to negatively affect the integrity of interactive gaming or the control of revenue generated from interactive gaming, the Bureau of Gaming Operations, by written notice to the interactive gaming certificate holder or interactive gaming operator, will:

 (1) Specify the nature of the insufficiency and, when possible, an acceptable alternative procedure.

 (2) Direct that the 30-calendar day review period in this chapter is to be tolled and that any internal controls at issue not be implemented until approved under this chapter.

 (g) Examples of submissions that may contain an insufficiency likely to negatively affect the integrity of interactive gaming may include the following:

 (1) Submissions that fail to provide information sufficient to permit the review of interactive gaming activities by the Board, the Bureau, the Department or law enforcement.

 (2) Submissions that fail to provide for the segregation of incompatible functions so that an employee is not in a position to commit an error and perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.

 (3) Submissions that do not include forms or other materials referenced in the submission or required under the act or this part.

 (4) Submissions that would implement operations or accounting procedures not authorized by the act or this part.

 (h) Whenever a change or amendment has been tolled under this chapter, the interactive gaming certificate holder or interactive gaming operator may submit a revised change or amendment within 30 days of receipt of the written notice from the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator may implement the revised change or amendment upon receipt of written notice of approval from the Board's Executive Director or on the 30th calendar day following the filing of the revision unless the interactive gaming certificate holder or interactive gaming operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.

§ 811a.3. Terms and conditions.

 (a) An interactive gaming certificate holder or interactive gaming operator shall develop terms and conditions for interactive gaming which must be included in the internal controls. The terms and conditions and any changes thereto shall be acknowledged by the player and the acknowledgment must be date and time-stamped by the interactive gaming system.

 (b) The terms and conditions must address all aspects of the interactive gaming operation, including all of the following:

 (1) The name of the party with whom the player is entering into a contractual relationship, including any interactive gaming certificate holder or interactive gaming operator.

 (2) The player's consent to have the interactive gaming certificate holder or interactive gaming operator confirm the player's age and identity.

 (3) Rules and obligations applicable to the player other than rules of the game including all of the following:

 (i) Prohibition from allowing any other person to access or use his interactive gaming account.

 (ii) Prohibition from engaging in interactive gaming activity, unless the player is physically located in this Commonwealth, unless this gaming is authorized by an interactive gaming reciprocal agreement.

 (iii) Consent to the monitoring and recording by the interactive gaming certificate holder, interactive gaming operator or the Board, or all of the above, of any wagering communications and geographic location information.

 (iv) Consent to the jurisdiction of this Commonwealth to resolve any disputes arising out of interactive gaming.

 (v) Prohibition against utilizing automated computerized software or other equivalent mechanism, such as a bot, to engage in play.

 (4) Full explanation of all fees and charges imposed upon a player related to interactive gaming transactions.

 (5) Availability of account statements detailing player account activity.

 (6) Privacy policies, including information access and use of customer data.

 (7) Legal age policy, including a statement that it is a criminal offense to allow a person who is under 21 years of age to participate in interactive gaming and a player who does so must be prohibited from interactive gaming.

 (8) Notification that if the player's interactive gaming account remains dormant for 2 year any funds remaining on deposit and any pending wagers shall be forfeited.

 (9) The player's right to set responsible gaming limits and self-exclude.

 (10) The player's right to suspend his account for no less than 72 hours.

 (11) Actions that will be taken in the event a player becomes disconnected from the interactive gaming system during game play.

 (12) Notice that a malfunction voids all pays.

 (13) Estimated time-period for withdrawal of funds from the interactive gaming account.

 (14) Detailed information to be displayed on a player protection page.

 (15) Method for changing or retrieving a password or other approved access security feature and the ability to choose strong authentication login protection.

 (16) Method for filing a complaint with the interactive gaming certificate holder or interactive gaming operator and method for filing with the Board an unresolved complaint after all reasonable means to resolve the complaint with the interactive gaming certificate holder or interactive gaming operator have been exhausted.

 (17) Method for obtaining a copy of the terms and conditions agreed to when establishing an interactive gaming account.

 (18) Method for the player to obtain account and game history from the interactive gaming certificate holder or interactive gaming operator.

 (19) Notification of Federal prohibitions and restrictions regarding interactive gaming, specifically, any limitations upon interactive gaming in 18 U.S.C.A. § 1084 and the Unlawful Internet Gambling Enforcement Act of 2006 (31 U.S.C.A. §§ 5361—5367). The notice must explicitly state that it is a Federal offense for persons physically located outside of this Commonwealth to engage in interactive wagering through an interactive gaming certificate holder or interactive gaming operator unless explicitly authorized by the Board or an interactive gaming reciprocal agreement.

 (20) Any other information required by the Board.

§ 811a.4. Information to be displayed on web site.

 Interactive gaming certificate holders and interactive gaming operators shall provide for the prominent display of all of the following information on a page which, by virtue of the construction of the web site, authorized players must access before beginning a gambling session:

 (1) The full name of the interactive gaming certificate holder or interactive gaming operator and address from which it carries on business.

 (2) A logo, to be provided by the Board, indicating that the interactive gaming certificate holder or interactive gaming operator on behalf of the interactive gaming certificate holder is authorized to operate interactive gaming in this Commonwealth.

 (3) The interactive gaming certificate holders and interactive gaming operator's license number.

 (4) A statement that persons under 21 years of age are not permitted to engage in interactive gaming.

 (5) A statement that persons located in a jurisdiction where interactive gaming is not legal are not permitted to engage in interactive gaming.

 (6) Active links to all of the following:

 (i) Information explaining how disputes are resolved.

 (ii) A problem gambling web site that is designed to offer information pertaining to responsible gaming.

 (iii) The Board's web site.

 (iv) A web site that allows for an authorized player to choose to be excluded from engaging in interactive gaming.

 (v) A link to the house rules adopted by the interactive gaming certificate holder or interactive gaming operator.

§ 811a.5. Segregation of bank accounts and reserve requirements.

 (a) An interactive gaming certificate holder or interactive gaming operator shall maintain a bank account for player's funds separate from all other operating accounts to ensure the security of funds held in the player's interactive gaming accounts.

 (b) The balance maintained in this account must be greater than or equal to the sum of the daily ending cashable balance of all player interactive gaming accounts, funds on game and pending withdrawals.

 (c) An interactive gaming certificate holder or interactive gaming operator shall have unfettered access to all player interactive gaming account and transaction data to ensure the amount held in its independent account is sufficient. An interactive gaming certificate holder's or interactive gaming operator's chief financial officer shall file a quarterly attestation with the Board, unless otherwise directed by the Board, that the funds have been safeguarded under this section.

§ 811a.6. Interactive gaming certificate holder's or interactive gaming operator's organization.

 (a) An interactive gaming certificate holder's or interactive gaming operator's systems of internal controls must include organization charts depicting segregation of functions and responsibilities and descriptions of the duties and responsibilities for each position shown on each organization chart. Interactive gaming certificate holders and interactive gaming operators are permitted, except as otherwise provided in this section, to tailor organizational structures to meet the needs or policies of a particular management philosophy. An interactive gaming certificate holder's and interactive gaming operator's organization charts must provide for all of the following:

 (1) A system of personnel and chain of command which permits management and supervisory personnel to be held accountable for actions or omissions within their areas of responsibility.

 (2) The segregation of incompatible functions, duties and responsibilities so that an employee is not in a position to commit an error and perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.

 (3) The performance of all functions, duties and responsibilities in accordance with sound financial practices by qualified personnel.

 (4) The areas of responsibility which are not so extensive as to be impractical for an individual to monitor.

 (b) In addition to other positions required as part of an interactive gaming certificate holder's or interactive gaming operator's internal controls, an interactive gaming certificate holder, interactive gaming operator, or other licensed entity involved in the operation of the interactive gaming system as approved by the Board, shall maintain an information technology department supervised by an individual licensed as a key employee who functions, for regulatory purposes, as the information technology director. An interactive gaming certificate holder, interactive gaming operator, or other licensed entity involved in the operation of the interactive gaming system as approved by the Board, shall employ an information technology security officer and an interactive gaming manager, both of whom shall be licensed as a key employee.

 (c) The information technology director shall be responsible for the integrity of all data, and the quality, reliability and accuracy of all computer systems and software used by the interactive gaming certificate holder in the conduct of interactive gaming, whether the data and software are located within or outside the certificate holder's or interactive gaming operator's facility, including, without limitation, specification of appropriate computer software, hardware and procedures for security, physical integrity, audit and maintenance of all of the following:

 (1) Access codes and other computer security controls used to insure appropriately limited access to computer software and data.

 (2) Monitoring logs of user access, security incidents and unusual transactions.

 (3) Logs used to document and maintain the details of any hardware and software modifications.

 (4) Computer tapes, disks or other electronic storage media containing data relevant to interactive gaming operations.

 (5) Computer hardware, communications equipment and software used in the conduct of interactive gaming.

 (d) The information technology security officer, or other position as approved by the Board, shall report to the information technology director and be responsible for all of the following:

 (1) Maintaining access codes and other computer security controls used to insure appropriately limited access to computer software and data.

 (2) Reviewing logs of user access, security incidents and unusual transactions.

 (3) Coordinating the development of the interactive gaming certificate holder's or interactive gaming operator's information security policies, standards and procedures.

 (4) Coordinating the development of an education and training program on information security and privacy matters for employees and other authorized users.

 (5) Ensuring compliance with all State and Federal information security policies and rules.

 (6) Preparing and maintaining security-related reports and data.

 (7) Working with internal and external audit personnel to ensure all findings are addressed in a timely and effective manner.

 (8) Developing and implementing an Incident Reporting and Response System to address security breaches, policy violations and complaints from external parties.

 (9) Serving as the official contact for information security and data privacy issues, including reporting to law enforcement.

 (10) Developing and implementing an ongoing risk assessment program that targets information security and privacy matters by identifying methods for vulnerability detection and remediation and overseeing the testing of those methods.

 (11) Remaining current with the latest information technology security and privacy legislation, rules, advisories, alerts and vulnerabilities to ensure the interactive gaming certificate holder's or interactive gaming operator's security program and security software is effective.

 (e) The interactive gaming manager shall report to the information technology director, or other department manager as approved by the Board, and be responsible for ensuring the proper operation and integrity of interactive gaming and reviewing all reports of suspicious behavior. The interactive gaming manager shall immediately notify the Bureau upon detecting any person participating in interactive wagering who is:

 (1) Engaging in or attempting to engage in, or who is reasonably suspected of cheating, theft, embezzlement, collusion, money laundering or any other illegal activities.

 (2) A self-excluded person under the act and Board regulations.

 (3) Prohibited by the interactive gaming certificate-holder or interactive gaming operator from interactive gaming.

§ 811a.7. Mandatory interactive gaming system logging.

 (a) An interactive gaming system must employ a mechanism capable of maintaining a separate copy of the information required to be logged under this chapter on a separate and independent logging device capable of being administered by an employee with no incompatible function. If the interactive gaming system can be configured so that any logged data is in a secure transaction file, a separate logging device is not required.

 (b) An interactive gaming system must provide a mechanism for the Board to query and export, in a format required by the Board, all gaming system data.

 (c) An interactive gaming system must electronically log the date and time any interactive gaming account is created or terminated (Account Creation Log).

 (d) An interactive gaming system must maintain all information necessary to recreate player game play and account activity during each player session, including any identity or location verifications, for no less than 10 years.

 (e) Unless otherwise authorized by the Board, when software is installed on or removed from an interactive gaming system, the action must be recorded in a secure electronic log (Software Installation/Removal Log), which must include all of the following:

 (1) The date and time of the action.

 (2) The identification of the software.

 (3) The identity of the person performing the action.

 (f) Unless otherwise authorized by the Board, when a change in the availability of game software is made on a gaming system, the change must be recorded in a secure electronic log (Game Availability Log), which must include all of the following:

 (1) The date and time of the change.

 (2) The identification of the software.

 (3) The identity of the person performing the change.

 (g) Unless otherwise exempted by the Board, an interactive gaming system must record all promotional offers (Promotions Log) issued through the system. The Promotions Log must provide the information necessary to audit compliance with the terms and conditions of current and previous offers.

 (h) Results of all authentication attempts must be retained in an electronic log (Authentication Log) and accessible for 90 days.

 (i) All adjustments to gaming system data made using stored procedures must be recorded in an electronic log (Adjustments Log), which lists all of the following:

 (1) The date and time.

 (2) The identification and user ID of user performing the action.

 (3) A description of the event or action taken.

 (4) The initial and ending values of any data altered as a part of the event or action performed.

§ 811a.8. Records/data retention requirements.

 (a) For the purposes of this section, ''books, records and documents'' means any book, record or document pertaining to, prepared in or generated by the operation of the interactive gaming certificate holder or interactive gaming operator including all forms, reports, accounting records, ledgers, subsidiary records, computer generated data, internal audit records, correspondence and personnel records required to be generated and maintained under this part. This definition applies without regard to the medium through which the record is generated or maintained (for example, paper, magnetic media or encoded disk).

 (b) Original books, records and documents pertaining to the operation of interactive gaming must be:

 (1) Prepared and maintained in a complete, accurate and legible form. Electronic data must be stored in a format that ensures readability, regardless of whether the technology or software that created or maintained it has become obsolete.

 (2) Retained in a secure location by the interactive gaming certificate holder or interactive gaming operator that is equipped with a fire suppression system or at another location approved under subsection (d).

 (3) Made available for inspection by agents of the Board, the Department and the Pennsylvania State Police during all hours of operation.

 (4) Organized and indexed in a manner to provide immediate accessibility to agents of the Board, the Department and the Pennsylvania State Police.

 (5) Destroyed only after expiration of the minimum retention period specified in subsection (c), except that the Board may, upon the written request of an interactive gaming certificate holder or interactive gaming operator and for good cause shown, permit the destruction at an earlier date.

 (c) Original books, records and documents shall be retained by an interactive gaming certificate holder or interactive gaming operator for a minimum of 5 years.

 (d) An interactive gaming certificate holder or interactive gaming operator may request, in writing, that the Board's Executive Director approve an alternative location outside of this Commonwealth to store original books, records and documents. The request must include all of the following:

 (1) A detailed description of the proposed location, including security and fire suppression systems.

 (2) The procedures under which the Board, the Department and the Pennsylvania State Police will be able to gain access to the original books, records and documents retained at the location outside of this Commonwealth.

 (e) An interactive gaming certificate holder or interactive gaming operator may request, in writing, that the Board's Executive Director approve a microfilm, microfiche or other suitable media system for the copying and storage of original books, records and documents. The request must include representations regarding all of the following:

 (1) The processing, preservation and maintenance methods which will be employed to ensure that the books, records and documents are available in a format which makes them readily available for review and copying.

 (2) The inspection and quality control methods which will be employed to ensure that microfilm, microfiche or other media when displayed on a reader/viewer or reproduced on paper exhibits a high degree of legibility and readability.

 (3) The availability of a reader/printer for use by the Board, the Department and the Pennsylvania State Police at the location approved by the Board and the readiness with which the books, records or documents being stored on microfilm, microfiche or other media can be located, read and reproduced.

 (4) The availability of a detailed index of all microfilmed, microfiched or other stored data maintained and arranged in a manner to permit the immediate location of any particular book, record or document.

 (f) Nothing herein shall be construed as relieving an interactive gaming certificate holder or interactive gaming operator from meeting any obligation to prepare or maintain any book, record or document required by any other Federal, State or local governmental body, authority or agency.

§ 811a.9. Required reports; reconciliation.

 (a) An interactive gaming system shall be designed to generate reports as specified by the Board that must include, at a minimum, all of the following:

 (1) The report title.

 (2) The version number of the current system software and report definition.

 (3) The date or time period of activity, or description as of a point in time.

 (4) The date and time the report was generated.

 (5) Page numbering, indicating the current page and total number of pages.

 (6) Subtotals and grand totals as required by the Department.

 (7) A description of any filters applied to the data presented in the document.

 (8) Column and row titles, if applicable.

 (9) The name of the interactive gaming certificate holder or interactive gaming operator.

 (10) A reconciliation of all relevant data contained therein, if applicable.

 (b) All required reports must be generated by the interactive gaming system, even if the period specified contains no data to be presented. The report generated must indicate all required information and contain an indication of ''No Activity'' or similar message if no data appears for the period specified.

 (c) An interactive gaming system must provide a mechanism to export the data generated for any report to a format approved by the Board.

 (d) An interactive gaming system must generate all of the following daily reports, at a minimum, for each gaming day to calculate the taxable revenue:

 (1) A Player Account Summary Report, which must include transaction information for each player account and test account for all of the following categories:

 (i) Beginning balance.

 (ii) Total amount of deposits.

 (iii) Total amount of noncashable bonuses deposited.

 (iv) Total amount of noncashable bonuses wagered by game type (sports, slots and tables).

 (v) Total amount of noncashable bonuses expired.

 (vi) Total amount of transfers to games by game type (sports, slots and tables).

 (vii) Total amount of transfers from games by game type (sports, slots and tables).

 (viii) Total amount of withdrawals.

 (ix) Total amount of funds on game at the beginning of the gaming day (the amount of pending wagers at the end of the prior gaming day).

 (x) Total amount of funds on game at the end of the gaming day (the amount of pending wagers plus funds transferred to a game but not yet wagered).

 (xi) Win or loss, calculated as the ending funds on games less the beginning funds on game.

 (xii) Ending balance.

 (xiii) Any other information that may be required by the Board.

 (2) A Wagering Summary Report, which must include all of the following by authorized game and poker variation, as applicable:

 (i) Total amounts wagered.

 (ii) Total amounts won.

 (iii) Total tournament entry or participation fees.

 (iv) Rake or vigorish.

 (v) Total amounts of guaranteed funds paid to players.

 (vi) Total amounts due to or from an interactive gaming network.

 (vii) Win or loss calculated as the net of the total amounts wagered and total amounts won plus tournament entry fees, rake or vigorish, guaranteed funds and amounts due to or from an interactive gaming network.

 (viii) Any other information that may be required by the Board.

 (3) A noncashable Promotional Account Balance Report, which must include the ending noncashable promotional balance in each player account.

 (e) An interactive gaming network must generate the following daily reports for each participating interactive gaming certificate holder or interactive gaming operator, at a minimum, for each gaming day to reconcile the daily gross interactive gaming revenue:

 (1) A System Player Account Summary Report, which must include all of the following transaction information for each player account:

 (i) Player identification number.

 (ii) Total amount of transfers to games.

 (iii) Total amount of transfers from games.

 (iv) Win or loss statistics.

 (v) Total amount of rake.

 (vi) Total amount of entry fees.

 (2) A System Wagering Summary Report, which must include all of the following game activity by authorized game or poker variation:

 (i) Total amounts wagered.

 (ii) Total amounts won.

 (iii) Total tournament entry or participation fees.

 (iv) Rake or vigorish.

 (v) Total amounts of guaranteed funds paid to players.

 (vi) Win or loss statistics, calculated as the net of the total amounts wagered and total amounts won plus tournament entry fees, rake or vigorish, and guaranteed funds.

 (f) An interactive gaming certificate holder or interactive gaming operator must utilize the Wagering Summary Report to calculate interactive gross gaming revenue on a daily basis for reporting purposes. In addition, the certificate holder or operator shall do all of the following:

 (1) Prepare a Variance Report documenting the win/loss amounts from the Player Account Report and Wagering Summary Report.

 (2) Calculate the variance between the two amounts.

 (3) Document the reason for the variance.

 (4) Report a manual adjustment to increase revenue by the amount of the variance whenever the total of the Player Account Summary Report is greater than the total of the Wagering Summary Report, unless the reason for the variance as documented above is sufficient to support a determination that revenue was properly reported.

 (g) Instead of subsection (f), an interactive gaming certificate holder or interactive gaming operator may accumulate the daily Variance Report information on a monthly Variance Report in a manner described in the interactive gaming certificate holder's or interactive gaming operator's internal controls.

 (h) An interactive gaming system must generate, on a daily basis commencing 2 years after the creation of the first interactive gaming account, a Dormant Account Report, which must list all player accounts including the Pending Wager Account Report that have not had activity for 2 years. The report must include all of the following:

 (1) The player name and account number.

 (2) The date of the last transaction.

 (3) The account balance.

 (i) Voids of completed wagering transactions may not occur without Board approval.

 (j) An interactive gaming system must generate a Performance Report, which compares the theoretical return to player (RTP) to the actual RTP of each game offered by a gaming system. The report must also provide the total number of rounds of play for each game and shall be generated and reviewed monthly by the interactive gaming certificate holder or interactive gaming operator to evaluate the performance of all games offered to the public. The Performance Report must include the data required by this subsection from the first day interactive gaming was offered to the date of the report.

 (k) An interactive gaming system must generate a Player Account Adjustments Report, which shall be reviewed on a daily basis by either the interactive gaming certificate holder or interactive gaming operator to evaluate the legitimacy of player account adjustments. If the daily review is performed by the interactive gaming operator, the interactive gaming certificate holder or interactive gaming operator shall conduct a weekly review of the Player Account Adjustment Reports. Unless otherwise authorized by the Board, the report must, at a minimum, include all of the following:

 (1) The player's name.

 (2) An account number.

 (3) The date and time of the adjustment.

 (4) The person who performed the adjustment.

 (5) The reason for the adjustment.

 (6) The amount of the adjustment.

 (l) An interactive gaming system must generate a report on a weekly basis identifying potential compulsive and problem gamblers, including those players who self-report. The interactive gaming certificate holder or interactive gaming operator shall review the report and document any action taken.

 (m) An interactive gaming system must be capable of generating a Pending Transaction Account Report, which must include and separately itemize all pending transactions for each player account, including funds on game and deposits and withdrawals not yet cleared.

 (n) An interactive gaming certificate holder or interactive gaming operator shall develop internal controls for performing a daily reconciliation of gross interactive gaming revenue, including a daily reconciliation of the Player Account Summary Report to the Wagering Summary Report, a reconciliation of the Wagering Summary Report to each remote game server, a reconciliation of sports wagering system reports to the wagering Summary Report, and at least a quarterly calculation of the balance required to be maintained pursuant to § 811a.5 (relating to segregation of bank accounts and reserve requirements).

 (i) Each report shall be accurate to reconcile and balance on a daily basis.

 (ii) Variances shall be investigated and reported to the Board, which must include the amount, cause and remediation plan for corrective action.

CHAPTER 812a. INTERACTIVE GAMING
PLAYER ACCOUNTS

Sec.

812a.1.	Definitions.
812a.2.	Player account registration.
812a.3.	Account security.
812a.4.	Single account requirement.
812a.5.	Account terms and conditions disclosures.
812a.6.	Self-exclusion list.
812a.7.	Player funding of accounts.
812a.8.	Player loyalty programs.
812a.9.	Player account controls.
812a.10.	Player withdrawals.
812a.11.	Player account statements.
812a.12.	Suspended accounts.
812a.13.	Dormant accounts.
812a.14.	Use of player data.

§ 812a.1. Definitions.

 The following words and terms, when used in this chapter, have the following meanings, unless the context clearly indicates otherwise:

 Electronic identifier—A unique identifier, such as a username or account number, other than personal identifying information (for example, a Social Security number), used to identify a player.

 Player session—A player session consists of all activities and communications performed by an authorized registered player and the interactive gaming system between the time the registered player logs in to the interactive gaming system and the time the registered player logs out or is logged out of the interactive gaming system.

 Strong authentication—A method that is intrinsically stringent enough to ensure the security of the system it protects by withstanding any attacks it is likely to encounter by combining at least two mutually-independent factors so that the compromise of one method should not lead to the compromise of the second and includes one nonreusable element, which cannot easily be reproduced or stolen from the Internet, to verify the identity of a registered player.

§ 812a.2. Player account registration.

 (a) Prior to engaging in interactive gaming, a player shall establish an interactive gaming account.

 (b) To establish an interactive gaming account, the player shall provide all of the following information:

 (1) The player's legal name.

 (2) The player's date of birth.

 (3) The entire or last four digits of the player's Social Security number, if voluntarily provided, or equivalent for a foreign player such as a passport or taxpayer identification number.

 (4) The player's address.

 (5) The player's e-mail address.

 (6) The player's telephone number.

 (7) Any other information collected from the player to verify his identity.

 (c) An interactive gaming certificate holder or interactive gaming operator shall create and maintain an electronic player file containing the information the player submitted to establish the player account.

 (d) The electronic player file created by an interactive gaming certificate holder or interactive gaming operator must encrypt the information in an electronic player file.

 (i) As part of the annual security audit required under § 809a.6(d)(3), the independent third party shall verify that the information included contained in the electronic player files maintained by the interactive gaming certificate holder or interactive gaming operator is properly encrypted.

 (e) The interactive gaming certificate holder or interactive gaming operator shall verify the player's identity and record the document number of the government-issued credential examined, or other methodology for remote, multisourced authentication, which may include third-party and governmental databases, as approved by the Board.

 (f) The interactive gaming certificate holder or interactive gaming operator shall verify that the player is of the legal age of 21 years of age, not self-excluded or otherwise prohibited from participation in interactive gaming.

 (g) The interactive gaming certificate holder or interactive gaming operator shall require the player to affirm that the information provided to the interactive gaming certificate holder is accurate.

 (h) The interactive gaming certificate holder or interactive gaming operator shall record the player's acceptance of the interactive gaming certificate holder's terms and conditions to participate in interactive gaming.

 (i) The interactive gaming certificate holder or interactive gaming operator shall record the player's acknowledgement that the legal age for interactive gaming is 21 years of age and that he is prohibited from allowing any other person to access or use his interactive gaming account.

 (j) The interactive gaming certificate holder or interactive gaming operator shall record the player's acknowledgement that any violations of the interactive gaming regulations are subject to the penalties provided in the act and may result in criminal prosecution under 18 Pa.C.S. (relating to Crimes Code).

 (k) The interactive gaming certificate holder or interactive gaming operator shall require the player to establish a password or other access security feature as approved by the Board and advise the player of the ability to utilize strong authentication login protection.

 (l) The interactive gaming certificate holder or interactive gaming operator shall notify the player of the establishment of the account by e-mail or first class mail.

§ 812a.3. Account security.

 (a) An interactive gaming system must utilize sufficient security to ensure player access is appropriately limited to the registered account holder. Unless otherwise authorized by the Board, security measures must include, at a minimum, all of the following:

 (1) A username.

 (2) A password of sufficient length and complexity to ensure its effectiveness.

 (3) Upon account creation, the option for users to choose strong authentication login protection.

 (4) When a player logs into his registered interactive gaming account, the system must display the date and time of the player's previous log on.

 (5) An option to permit a player to elect to receive an electronic notification to the player's registered e-mail address, cellular phone or other device each time an interactive gaming account is accessed.

 (6) The interactive gaming system must require a player to re-enter his username and password after 15 minutes of user inactivity.

 (b) An interactive gaming certificate holder or interactive gaming operator may not permit the creation of anonymous interactive gaming accounts or accounts using fictitious names. A registered player may, while engaged in interactive gaming, represent himself using a screen name other than his actual name.

 (c) An interactive gaming system must provide an account statement with account details to a player on demand, either displayed on the interactive gaming web site or mobile app or available for immediate download, which must include information as required under this chapter.

 (d) An interactive gaming system must utilize sufficient security to ensure third-party access to player accounts is limited as follows:

 (1) Network shared drives containing application files and data for interactive gaming system must be secured so that only authorized personnel may gain access.

 (2) Login accounts and passwords required to administer network and other equipment are secured so that only authorized Information Technology (IT) personnel from the interactive gaming certificate holder or interactive gaming operator may gain access to these devices.

 (3) Remote access by vendor personnel to any component of the interactive gaming system is allowed for purposes of support or updates and is enabled only when approved by authorized IT personnel employed by the technology provider.

 (e) Interactive gaming certificate holders and interactive gaming operators may utilize third-party vendors to verify player information so long as those vendors are licensed by the Board when required and the agreements related to the provided services is submitted to the Board.

§ 812a.4. Single account requirement.

 (a) A player shall have only one interactive gaming account for each interactive gaming certificate holder or interactive gaming operator. Each interactive gaming account must be nontransferable, unique to the player who establishes the account, and distinct from any other account number that the player may have established with the interactive gaming certificate holder or interactive gaming operator for noninteractive gaming activity.

 (b) Each registered player account shall be treated independently and players may not be permitted to transfer funds between accounts held with different interactive gaming certificate holders or interactive gaming operators. Registered players are prohibited from transferring funds to an account held by another player.

 (c) To ensure compliance with this subpart, interactive gaming certificate holders and interactive gaming operators shall:

 (1) Record and maintain the physical location of the registered player while logged in to the interactive gaming account.

 (2) Ensure that a registered player does not occupy more than one position at a game at any given time unless otherwise approved by the Board to permit a registered player to occupy more than one position at a game at any given time.

§ 812a.5. Account terms and conditions disclosures.

 (a) During the registration process the player shall agree to the terms and conditions which govern the relationship between the interactive gaming certificate holder or interactive gaming operator and the player. The terms and conditions must include a privacy policy which governs the protection and use of the player's data.

 (b) The terms and conditions provided to players by interactive gaming certificate holders and interactive gaming operators shall be submitted to the Bureau of Gaming Operations for review. The terms and conditions must contain, at minimum, all of the following:

 (1) The name and address of the interactive gaming certificate holder or interactive gaming operator.

 (2) A statement that the interactive gaming certificate holder or interactive gaming operator is licensed and regulated by the Board for the purposes of operating and offering interactive gaming services in this Commonwealth.

 (3) A requirement that the player acknowledges that he has read the terms and conditions and agrees to be bound by them.

 (4) A requirement that the player will comply with all applicable laws, statutes and regulations.

 (5) A statement that no individual under 21 years of age may participate in interactive gaming and that it is a criminal offense to allow a person who is not legally of age to participate in interactive gaming in this Commonwealth.

 (6) A statement that the player consents to verification of registration information including name, address, date of birth, Social Security number, passport identification (for non-United States residents) and any other identification information required to confirm age and identity.

 (7) A statement that the player consents to verification of his location for the duration of play of interactive games.

 (8) A statement that players have the right to set responsible gaming limits and to self-exclude from interactive gaming.

 (9) A dispute resolution policy including notifying players of their right to file a complaint with the Board.

 (10) A player disconnection policy.

 (11) Any other information that may be required by the Board.

§ 812a.6. Self-exclusion list.

 (a) All interactive gaming certificate holders and interactive gaming operators shall have a link on its interactive gaming web site to the self-exclusion page of the Board web site.

 (b) Any player seeking to self-exclude from interactive gaming shall follow the procedures in the Board's regulations.

§ 812a.7. Player funding of accounts.

 (a) A player's interactive gaming account may be funded through the use of all of the following:

 (1) Cash deposits made directly with the interactive gaming certificate holder or interactive gaming operator.

 (2) Personal checks, cashier's checks, wire transfer and money order deposits made directly or mailed to the interactive gaming certificate holder or interactive gaming operator.

 (3) A player's credit card or debit card, including prepaid cards.

 (4) A player's deposit of cash, gaming vouchers or gaming chips at a cashiering location approved by the Board.

 (5) A player's reloadable prepaid card, which has been verified as being issued to the player and is nontransferable.

 (6) Cash complimentaries, promotional credits or bonus credits.

 (7) Winnings.

 (8) Automated clearing house (ACH) transfer, provided that the interactive gaming certificate holder or interactive gaming operator has security measures and controls to prevent ACH fraud. A failed ACH deposit attempt may not be considered fraudulent if the player has successfully deposited funds through an ACH transfer on a previous occasion with no outstanding chargebacks. If the interactive gaming certificate holder or interactive gaming operator suspects fraud after multiple failed ACH deposit attempts, the interactive gaming certificate holder or interactive gaming operator may temporarily freeze or suspend the player's account to investigate and, if the interactive gaming certificate holder or interactive gaming operator determines that fraud has occurred, suspend the player's account.

 (9) Adjustments made by the interactive gaming certificate holder or interactive gaming operator following the resolution of disputes provided there is documented notification to the player.

 (10) Any other means as approved by the Board.

 (b) An interactive gaming certificate holder or interactive gaming operator shall neither extend credit to a player nor allow the deposit of funds into an interactive gaming account that are derived from the extension of credit by affiliates or agents of the interactive gaming certificate holder or interactive gaming operator.

 (c) A player's interactive gaming account may not have a negative account balance as a result of the placement of any wager in the interactive gaming system.

 (d) Player account balances must be updated after each game cycle to ensure that sufficient funds are available for any future real money games the player may choose to play.

 (e) Interactive gaming certificate holders or interactive gaming operators shall not accept or facilitate a wager:

 (1) On any interactive game not approved by the Board for play in this Commonwealth.

 (2) On any interactive game which the certificate holder or operator knows or reasonably should know is not between individuals.

 (3) On any interactive game which the certificate holder or operator knows or reasonably should know is made by a person who has elected to temporarily suspend his or her interactive gaming account and the period of temporary suspension has not expired.

 (4) On any interactive game which the certificate holder or operator knows or reasonably should know is made by a person on the interactive gaming self-exclusion list or the Board's involuntary exclusion list as it pertains to interactive gaming.

 (5) From a person who the interactive gaming certificate holder or interactive gaming operator knows or reasonably should know is placing the wager in violation of State or Federal law.

 (6) From any licensed individual who is not permitted to participate in interactive gaming by virtue of his position with an interactive gaming certificate holder, interactive gaming operator or other affiliated entity.

 (f) All adjustments to interactive gaming accounts for amounts of $500 or under shall be periodically reviewed by supervisory personnel as set forth in the interactive gaming certificate holder's or interactive gaming operator's internal controls. All other adjustments shall be authorized by supervisory personnel prior to being entered.

§ 812a.8. Player loyalty programs.

 If player loyalty programs are supported by an interactive gaming system, all of the following must apply:

 (1) Redemption of registered player loyalty points earned must be by a secure transaction that automatically debits the points balance for the value of the prize redeemed.

 (2) All registered player loyalty database transactions are to be recorded by the interactive gaming system. If the player loyalty program is provided by an external service provider, the interactive gaming system must be capable of securely communicating with that service.

 (3) The interactive gaming system must make readily accessible to the registered player all terms and conditions governing each available promotional or bonus feature.

 (4) The terms and conditions must be clear and unambiguous, especially when bonuses or promotions are limited to certain tables or nontournament play, or when other specific conditions apply.

§ 812a.9. Player account controls.

 (a) A player session is started when a player logs in to the interactive gaming system.

 (1) A player must be provided with the electronic identifier created by the interactive gaming certificate holder or interactive gaming operator, if applicable, and a password to start a session.

 (2) The interactive gaming system must allow players to change their passwords.

 (3) When a player has forgotten his password or PIN, the interactive gaming system must provide a secure process for the reauthentication of the player and the retrieval or resetting, or both, of the password or PIN. Processes for dealing with lost player user IDs or passwords must be clearly described to the player.

 (4) When a player logs in to the interactive gaming system, the date and time of his prior player session must be displayed.

 (5) Each player session must have a unique identifier assigned by the interactive gaming system which distinguishes the current session from previous and future sessions.

 (b) During a peer-to-peer game, the software must permit a player to set an away from computer status (that is, self-imposed session inactivity). This functionality must be fully described in the help screens or applicable terms and conditions.

 (1) The away from computer status must disallow all play and also cause the player's turn to be automatically skipped during any round of play which takes place while this status is active.

 (2) If a player sets an away from computer status during the middle of a round of play, he automatically forfeits play for that round (for example, for a round of poker, the software must automatically fold the player's hand during the next round of betting).

 (3) If a player performs any game action within the game window while in an away from computer status, the status must be removed and the player will be enrolled into the next round of play. Nongame sensitive actions, such as accessing the help menu from the game window do not require this status to be removed.

 (4) If action has not been taken by the player within the time period specified in the help screens or the terms and conditions, or both, the player must be automatically placed into the away from computer status.

 (5) If a player has been in the away from computer status for over 30 minutes, the player must be automatically logged out of the game or player account, or both.

 (c) Interactive gaming systems must employ a mechanism that detects session inactivity and terminates a player session when applicable.

 (1) If the interactive gaming system fails to receive a response from the interactive gaming device within 30 minutes, whether the player has been in away from computer mode or not, the interactive gaming system must implement a user inactivity timeout and terminate the player session.

 (2) If a player session is terminated due to player inactivity timeout, the interactive gaming device must display to the player the player session termination (that is, the user inactivity timeout) upon the player's next attempted action on the interactive gaming system.

 (3) Further game play is not permitted until the interactive gaming system and the interactive gaming device establish a new session.

 (d) A player session ends when:

 (1) The player notifies the interactive gaming system that the session is finished (for example, logs out).

 (2) A session inactivity timeout is reached.

 (3) The interactive gaming system terminates the session.

 (i) When the interactive gaming system terminates a player session, a record must be written to an audit file that includes the termination reason.

 (ii) The interactive gaming system must attempt to send a session finished message to the interactive gaming device each time a session is terminated by the interactive gaming system.

 (e) The Board's Responsible Gaming logo linking to a responsible gaming page shall be placed at the top of the interactive gaming web site. The responsible gaming page must contain, at a minimum, all of the following:

 (1) Information about potential risks associated with gambling and where to get help for a gambling problem.

 (2) A list of the responsible gaming measures that can be invoked by the player, such as player session time limits and bet limits, and an option to enable the player to invoke those measures.

 (3) Mechanisms which detect unauthorized use of the player's account, such as observing the Last Log in Time Display, the IP address of the last login and reviewing financial account information.

 (4) A link to the terms and conditions that the player agreed to be bound to by entering and playing on the site.

 (5) A link to the applicable privacy policy.

 (6) A link to Board's web site.

 (f) All links to player protection services (for example, self-exclusion and other player-imposed limits) provided by third parties are to be tested by the interactive gaming certificate holder or interactive gaming operator periodically as required by the Board. Game play may not occur when links used to supply information on player protection services are not displayed or are not operational. When the link to player protection services is no longer available, the interactive gaming certificate holder or interactive gaming operator shall provide an alternative support service.

 (g) Players must be provided with a clear mechanism to impose self-limitations for gaming parameters including deposits, wagers, losses and player session durations as required by the Board. The self-limitation mechanism must provide all of the following functionality:

 (1) Any decrease to self-limitations for gaming must be effective no later than the player's next login. Any increase to these limits must become effective only after the time-period of the previous limit has expired and the player reaffirms the requested increase.

 (i) For example, a player sets a $1,000 monthly deposit limit on the 1st day of the month. The player may not increase this limit to more than $1,000 until the 1st day of the following month. The same player may decrease the limit to less than $1,000 at any point, and shall be effective at the player's next login.

 (2) A deposit limit as determined by the player must be offered on a daily, weekly and monthly basis, and must specify the maximum amount of money a player may deposit into his interactive gaming account during the designated period of time.

 (3) A spend limit as determined by the player must be offered on a daily, weekly and monthly basis, and must specify the maximum amount of player deposits that may be put at risk during a designated period of time.

 (4) A single wager limit as determined by the player must be offered and must specify the maximum amount of any single wager a player may put at risk in a single wager in an interactive game.

 (i) This single wager limit is not applicable for peer-to-peer poker games offered by interactive gaming certificate holders or operators.

 (ii) Notwithstanding the provisions of paragraph (1), a requested increase in the player's single wager limit (that is, from $50 to $100) shall not take effect for 24 hours after the request is made.

 (5) A time-based limit as determined by the player must be offered on a daily basis and must specify the maximum amount of time that a player may spend playing on an interactive gaming system, provided that if the time-based limit is reached a player will be permitted to complete any round of play, or active or prepaid tournament.

 (6) A table limit as determined by the player must be offered and must specify the maximum amount a registered player may bring to a peer-to-peer interactive gaming table.

 (7) The self-limitations set by a player may not override any system imposed limitations or contradict information within the game rules.

 (h) The interactive gaming system must be capable of applying system-imposed limits as required by the terms and conditions agreed to by the player upon registration and as required by the Board. System-imposed limits must adhere to all of the following:

 (1) Players must be notified in advance of any system-imposed limits and their effective dates.

 (2) Once updated, system-imposed limits must be consistent with what is disclosed to the player.

 (3) Upon receiving any system-limitation request, the interactive gaming system must ensure that all specified limits are correctly implemented immediately or at a specified time (that is, next login, next day, and the like) that was clearly indicated to the player.

 (4) In cases when system-imposed limitation values (for example, deposit, wager, loss and player session duration) are greater than self-imposed player limit values, the system-imposed limitations must take priority.

 (i) Players must be provided with an easy and obvious mechanism to temporarily suspend his or her interactive gaming account. The temporary suspension mechanism must provide all of the following functionality:

 (1) The player must be provided with the option to temporarily suspended his or her interactive gaming account for a specified period of time as defined in the terms and conditions, or indefinitely.

 (2) In the case of temporary suspension, the interactive gaming system must ensure that:

 (i) Immediately upon processing the temporary suspension, new bets or deposits are not accepted from that player until the temporary suspension has expired.

 (ii) During the temporary suspension period, the player is not prevented from withdrawing any or all of his account balance, provided that the interactive gaming system acknowledges that the funds have cleared.

 (iii) In the case of indefinite temporary suspension, the interactive gaming system must ensure that:

 (A) The player is paid in full for his account balance, provided that the interactive gaming system acknowledges that the funds have cleared.

 (B) All player accounts must be closed or deactivated.

 (j) The interactive gaming system must provide a clear mechanism to advise the player of the right to make a complaint against the interactive gaming certificate holder, interactive gaming operator or another player (that is, when collusion is suspected or when a player is disruptive or abusive).

§ 812a.10. Player withdrawals.

 (a) An interactive gaming certificate holder or interactive gaming operator shall establish protocols for players to withdraw funds, whether an interactive gaming account is open or closed.

 (b) An interactive gaming certificate holder or interactive gaming operator shall prevent unauthorized withdrawals from an interactive gaming account.

 (c) Funds may be withdrawn from a player's interactive gaming account for all of the following:

 (1) The funding of game play.

 (2) A cash-out at the cashier's cage upon player's request.

 (3) A cash-out through the issuance of a check from the interactive gaming certificate holder or interactive gaming operator.

 (4) A cash-out transfer to a player's reloadable prepaid cash card, which has been verified as being issued to the player and is nontransferable.

 (5) Adjustments made by the interactive gaming certificate holder or interactive gaming operator following the resolution of disputes provided there is documented notification to the player.

 (6) Cash-out transfers directly to the player's individual account with a bank or other financial institution (banking account) provided that the interactive gaming certificate holder or interactive gaming operator verifies the validity of the account with the financial institution.

 (7) Any other means approved by the Board.

 (d) An interactive gaming certificate holder or interactive gaming operator may not permit a player to transfer funds to another player.

§ 812a.11. Player account statements.

 (a) At the request of a player, interactive gaming systems must provide an interactive gaming account statement which must include detailed account activity for at least the 6 months preceding the request. In addition, an interactive gaming system must, upon request, be capable of providing a summary statement of all player activity during the past year. Information to be provided on the summary statement must include, at a minimum, all of the following:

 (1) Deposits to the interactive gaming account.

 (2) Withdrawals from the interactive gaming account.

 (3) Win or loss statistics.

 (4) Beginning and ending account balances.

 (5) Self-imposed responsible gaming limit history, if applicable.

 (b) Account statements must be either displayed on the interactive gaming web site or mobile app or available for immediate download, or if requested by the player, sent to the player's registered address (e-mail or first class) for the time period specified.

§ 812a.12. Suspended accounts.

 (a) Interactive gaming systems must employ a mechanism to place an interactive gaming account in a suspended mode:

 (1) When requested by the player for a specified period of time, which may not be less than 72 hours.

 (2) When required by the Board.

 (3) When initiated by an interactive gaming certificate holder or interactive gaming operator that has evidence to indicate any of the following:

 (i) Illegal activity.

 (ii) A negative player account balance.

 (iii) A violation of the terms of service has taken place on an authorized registered player's interactive gaming account.

 (b) When an interactive gaming account is in a suspended mode, the interactive gaming certificate holder or interactive gaming operator may not remove funds from the account without prior approval from the Board. In addition, the interactive gaming system must do all of the following:

 (1) Prevent the player from engaging in interactive gaming.

 (2) Prevent the player from depositing funds.

 (3) Prevent the player from withdrawing funds from his interactive gaming account, unless the suspended mode was initiated by the player.

 (4) Prevent the player from making changes to his interactive gaming account.

 (5) Prevent the removal of the interactive gaming account from the interactive gaming system.

 (6) Prominently display to the authorized player that the account is in a suspended mode, the restrictions placed on the account and any further course of action needed to remove the suspended mode.

 (c) An interactive gaming certificate holder or interactive gaming operator shall notify the player by mail (first class or e-mail) whenever his interactive gaming account has been closed or placed in a suspended mode. The notification must include the restrictions placed on the account and any further course of action needed to remove the restriction.

 (d) A suspended account may be restored:

 (1) Upon expiration of the time period established by the player.

 (2) When permission is granted by the Board.

 (3) When the interactive gaming certificate holder or interactive gaming operator has lifted the suspended status.

§ 812a.13. Dormant accounts.

 (a) An interactive gaming account will be deemed dormant if there is no activity (logins, game play, withdrawals, contacts with customer service) for 2 years.

 (b) Interactive gaming certificate holders and interactive gaming operators shall provide notification to the player at the player's registered address (physical or electronic) if the player's interactive gaming account remains dormant for 1 year.

 (c) Funds remaining on deposit in an interactive gaming account which is dormant and for which the player has not requested payment must be abandoned 60 days after the notice in subsection (b) is provided. Interactive gaming certificate holders and interactive gaming operators shall report abandoned funds from dormant accounts in accordance with rules and regulations on abandoned and unclaimed property set forth by the Pennsylvania Treasury, Bureau of Abandoned and Unclaimed Property.

§ 812a.14. Use of player data.

 (a) An interactive gaming certificate holder, interactive gaming operator, or an employee or other person engaged in duties related to the conduct of interactive gaming may not disclose information about the name of a player, or other identifying information.

 (b) Interactive gaming certificate holders or interactive gaming operators with employees who have direct contact with players by phone, e-mail, electronic chat or other means shall implement training for those employees, at the start of their employment and at regular intervals thereafter, addressing recognition of the nature and symptoms of problem gambling behavior and how to assist players in obtaining information regarding help for a gambling problem and self-exclusion program.

CHAPTER 813a. INTERACTIVE GAMING ADVERTISEMENTS, PROMOTIONS AND TOURNAMENTS

Sec.

813a.1.	Definitions.
813a.2.	Advertising.
813a.3.	Promotions.
813a.4.	Interactive gaming tournaments.
813a.5.	Record retention and reports.

§ 813a.1. Definitions.

 The following words and terms, when used in this chapter, have the following meanings, unless the context clearly indicates otherwise:

 Celebrity player—A well-known or professional interactive gaming player who is under agreement with an interactive gaming certificate holder or interactive gaming operator whereby the interactive gaming certificate holder or interactive gaming operator pays the celebrity player a fixed sum to engage in interactive gaming with the certificate holder's or operator's players as an advertising or promotional enticement to its customers.

 Promotion—An event conducted by an interactive gaming certificate holder or an interactive gaming operator that provides or offers registered or prospective players cash, credits, merchandise, coupons, players club credits, or points, bonuses or anything else of value to entice the player to wager with the interactive gaming certificate holder or interactive gaming operator.

 Restricted interactive gaming credit—Interactive gaming funds that cannot be cashed out by the player until the wagering requirements or other restrictions associated with those funds are met in accordance with disclosed terms and conditions.

§ 813a.2. Advertising.

 (a) Interactive gaming certificate holders and interactive gaming operators shall comply with § 501a.7 (relating to advertising).

 (b) All interactive gaming advertisements exclusively directed to residents of this Commonwealth shall be co-branded, clearly and prominently displaying the name or logo, or both of the interactive gaming certificate holder and interactive gaming operator in equal size and quality, including but not limited to:

 (i) Television or radio advertisements relating to the availability of interactive gaming or sports wagering in this Commonwealth.

 (ii) Direct mail pieces, e-mails, or text messages sent to residents of this Commonwealth.

 (iii) Billboards located in this Commonwealth.

 (iv) Newspaper, magazine and other print publications that are based in this Commonwealth, including online editions of these publications.

 (c) Advertising utilized by interactive gaming certificate holders and interactive gaming operators may not:

 (1) Consist of indecent or offensive graphics or audio, or both.

 (2) Obscure the game play area or obstruct a game in progress.

 (3) Contain content that contradicts the game rules or terms and conditions.

 (4) Specifically target players which have been excluded from play.

 (d) Interactive gaming certificate holders and interactive gaming operators may utilize celebrity or other players to participate in peer-to-peer games for advertising or publicity purposes provided:

 (1) The interactive gaming certificate holder or an interactive gaming operator clearly identifies the celebrity player to the players.

 (2) The interactive gaming certificate holder or an interactive gaming operator does not realize a profit beyond the rake for hosting the celebrity player.

 (3) The interactive gaming certificate holder or an interactive gaming operator shall include winnings by the celebrity player in its gross gaming revenue if the certificate holder or licensee does not permit the celebrity player to retain these funds.

 (e) An interactive gaming certificate holder or an interactive gaming operator that contracts with a celebrity player to advertise or promote its services may fund the celebrity player's interactive gaming account in full or in part. The certificate holder or licensee may also pay the celebrity player a one-time or flat fee for his services.

 (f) A celebrity player engaged in interactive gaming in this Commonwealth under an agreement with an interactive gaming certificate holder or an interactive gaming operator for advertising or promotional purposes may or may not utilize his own funds to wager.

§ 813a.3. Promotions.

 (a) An interactive gaming certificate holder or interactive gaming operator shall notify and provide to the Board, at least 5 days prior to implementing a promotion, terms and conditions of each promotion. The terms and conditions must include, at a minimum, all of the following:

 (1) A description of what is being offered as part of the promotion.

 (2) The dates and times that the promotion is being conducted.

 (3) The persons who are eligible to participate in the promotion.

 (4) The required action to receive whatever is being offered as part of the promotion.

 (5) The procedure to claim or redeem the promotional offer, if applicable.

 (6) Registration procedures.

 (7) Limitations on participation.

 (8) Wagering requirements and limitations by type of game.

 (9) The order in which funds are used for wagering.

 (10) Eligible games.

 (11) Any restrictions on the withdrawal of funds.

 (12) Rules regarding cancellation.

 (13) The statement ''If you or someone you know has a gambling problem, help is available. Call 1-800-GAMBLER.''

 (14) Any other information the Board may require.

 (b) An interactive gaming certificate holder or an interactive gaming operator shall designate one employee responsible for providing promotions to the Board. The designated employee shall provide a signed attestation with the submitted promotion indicating the employee has reviewed the promotion for compliance with Board regulations. The designated employee shall serve as the point of contact between a certificate holder or a licensee and the Board on all submitted promotions.

 (c) An interactive gaming certificate holder or interactive gaming operator shall be responsible for providing the terms and conditions of promotions and the conduct of all promotions offered directly or indirectly by a third-party vendor or marketing affiliate on behalf of the interactive gaming certificate holder or an interactive gaming operator.

 (d) The terms and conditions of all promotions communicated to players must be posted on the interactive gaming certificate holder's home webpage as well as any skins the interactive gaming certificate holder operates or an interactive gaming operator operates on behalf of an interactive gaming certificate holder. The terms and conditions must be stated in a clear and conspicuous manner using plain language and be readily accessible and available for review for the duration of the promotion (even after player accepts a promotion).

 (e) An interactive gaming certificate holder or interactive gaming operator shall provide a clear and conspicuous method for a player to cancel his participation in a promotion that utilizes restricted interactive gaming credits. Upon request for cancellation, the interactive gaming certificate holder or interactive gaming operator shall inform the player of the amount of unrestricted funds that will be returned upon cancellation and the value of restricted funds that will be removed from the player's interactive gaming account. If the player elects to proceed with cancellation, unrestricted funds remaining in a player's interactive gaming account must be returned in accordance with the terms and conditions.

 (f) An interactive gaming certificate holder or interactive gaming operator may not, once a player has met the terms of a promotion, cap or limit winnings earned while participating in the promotion.

 (g) An interactive gaming certificate holder or an interactive gaming operator may be required to discontinue, as expeditiously as possible, the use of a particular promotion upon receipt of written notice from the Board that the Board has determined that the use of the particular promotion in, or with respect to, this Commonwealth could adversely impact the public or the integrity of gaming.

 (h) An interactive gaming certificate holder or interactive gaming operator may not offer or conduct a promotion which violates any Federal, State or local law.

 (i) An interactive gaming certificate holder or an interactive gaming operator shall develop and submit to the Board, as part of the submission required as part of the certificate holder's or licensee's internal controls, procedures governing the conduct of all promotions to be offered by an interactive gaming certificate holder or interactive gaming operator.

§ 813a.4. Interactive gaming tournaments.

 (a) An organized event that permits a player to purchase or be awarded the opportunity to engage in competitive play against other players (that is, a tournament) may be permitted providing all of the following:

 (1) Prior to conducting an interactive gaming tournament, an interactive gaming certificate holder or an interactive gaming operator shall file for approval of the terms and conditions of each interactive gaming tournament type with the Bureau of Gaming Operations as part of the certificate holder's or licensee's internal controls. The terms and conditions shall be followed and include, at a minimum, all of the following:

 (i) Game type (for example, Hold 'Em Poker).

 (ii) Rules concerning tournament play and participation.

 (iii) All conditions registered players shall meet to qualify for entry into, and advancement through, the tournament.

 (iv) Any conditions concerning late arrivals or complete tournament no-shows and how auto-blind posting or initial entry purchase, or both, is handled.

 (v) Funding source amounts comprising the prize pool (for example, buy-ins, re-buys or add-ons).

 (vi) Prize structure on payout.

 (vii) Methodology for determining win.

 (viii) Any other information as the Board may require.

 (2) While enabled for tournament play, a game may not accept real money from any source, nor pay out real money in any way, and must utilize tournament specific credits, points or chips which do not have cash value.

 (b) The terms and conditions of all interactive gaming tournaments communicated to players shall be posted on the interactive gaming web site and stated in a clear and conspicuous manner using plain language. The terms and conditions of each interactive gaming tournament must be readily accessible and remain available for review by the player until the interactive gaming tournament is complete.

 (c) An interactive gaming certificate holder or an interactive gaming operator may be required to discontinue, as expeditiously as possible, an interactive gaming tournament upon receipt of written notice from the Board's Executive Director that the Board's Executive Director has determined that the conduct of an interactive gaming tournament could adversely impact the public or the integrity of gaming.

 (d) An interactive gaming certificate holder or an interactive gaming operator shall submit a notice of intent to conduct an interactive gaming tournament at least 5 business days prior to the start of the tournament. The notice shall be submitted electronically to the Bureau of Gaming Operations using the Internal Controls and Table Games Submission Form, which is posted on the Board's web site, and must include all of the following:

 (1) The type of game to be played.

 (2) The dates and times the tournament will be conducted.

 (3) Participation eligibility requirements including all of the following:

 (i) Who is eligible to participate.

 (ii) The minimum and maximum number of participants.

 (iii) Entry fees charged.

 (4) The monetary amount or description of the prizes to be awarded.

 (5) Any other information as the Board may require.

 (e) Submission of a proposed schedule may not require the interactive gaming certificate holder or interactive gaming operator to conduct all tournaments in the schedule.

 (f) An interactive gaming certificate holder or interactive gaming operator may seek to amend or modify the schedule at any time by filing a written request with the Board's Executive Director.

 (g) An interactive gaming certificate holder or interactive gaming operator shall maintain records related to the conduct of interactive gaming tournaments in accordance with § 465a.6(c) (relating to retention, storage and destruction of books, records and documents). These records shall be made available to Board staff and the Department upon request and must include all of the following:

 (1) A full accounting of gross interactive gaming revenue for each tournament including cash received as entry fees and the total of cash or cash equivalents paid out to registered players.

 (2) The names and addresses of all prize winners and the prize each winner was awarded.

§ 813a.5. Record retention and reports.

 (a) Unless otherwise approved by the Board, a record of all bonus and promotional wagering offers related to interactive gaming shall be maintained in an electronic file that is readily available to the Board. All bonus and promotional wagering offers must be stated in clear and unambiguous terms and be readily accessible by the registered player.

 (b) Unless otherwise exempted by the Board, a gaming system must record all promotional offers (Promotions Log) issued through the system. The log must provide the information necessary to audit compliance with the terms and conditions of current and previous offers.

 (c) An interactive gaming system must be able to provide a Promotional Account Summary Report (or similarly named report) on demand for any player loyalty promotions or bonuses, or both, that are redeemable for cash, monetary game play credits or merchandise. The report must contain, at a minimum, all of the following information:

 (1) Beginning balance for promotion type.

 (2) Total amount of awards by promotion type.

 (3) Total amount used by promotion type.

 (4) Total amount expired by promotion type.

 (5) Total adjustment amount by promotion type.

 (6) Ending balance by promotion type.

[Continued on next Web Page]

---

No part of the information on this site may be reproduced for profit or sold for profit.

This material has been drawn directly from the official Pennsylvania Bulletin full text database. Due to the limitations of HTML or differences in display capabilities of different browsers, this version may differ slightly from the official printed version.

---