§ 811a.2. Internal controls.
(a) At least 90 days prior to commencing interactive gaming under this part, an interactive gaming certificate holder or interactive gaming operator shall submit to the Board for approval internal controls for all aspects of interactive gaming prior to implementation and any time a change is made thereafter. The internal controls must include detailed procedures for system security, operations, accounting, and reporting of compulsive and problem gamblers.
(b) Notwithstanding subsection (a), the procedures and controls may be implemented by an interactive gaming certificate holder or interactive gaming operator upon the filing of the procedures and controls with the Board. Each procedure or control submission must contain narrative and diagrammatic representations of the system to be utilized and must include all of the following:
(1) Procedures for reliable accounting controls, including the standardization of forms and definition of terms to be utilized in the interactive gaming operations.
(2) Procedures, forms and, when appropriate, formulas to govern all of the following:
(i) Calculation of hold percentages.
(ii) Revenue drops.
(iii) Expense and overhead schedules.
(iv) Complimentary services.
(v) Cash-equivalent transactions.
(3) Job descriptions and the system of personnel and chain of command establishing a diversity of responsibility among employees engaged in interactive gaming operations, including employees of an interactive gaming operator, and identifying primary and secondary management and supervisory positions for areas of responsibility, salary structure and personnel practices.
(4) Procedures for the registration of players and establishment of interactive gaming accounts, including a procedure for authenticating the age, identity and physical address of an applicant for an interactive gaming account and whether the applicant is a person prohibited from establishing or maintaining an account under section 13B22 of the act (relating to establishment of interactive gaming accounts).
(5) Procedures for terminating a registered player’s interactive gaming account and the return of any funds remaining in the interactive gaming account to the registered player.
(6) Procedures for suspending or terminating a dormant interactive gaming account and the return of any funds remaining in the dormant interactive gaming account to the registered player.
(7) Procedures for the logging in and authentication of a registered player to enable the player to commence interactive gaming and the logging off of the registered player when the player has completed play, including a procedure to automatically log a registered player out of the player’s interactive gaming account after a specified period of inactivity.
(8) Procedures for the crediting and debiting of a registered player’s interactive gaming account.
(9) Procedures for cashing checks, receiving electronic negotiable instruments, and redeeming chips, tokens or other cash equivalents.
(10) Procedures for withdrawing funds from an interactive gaming account by the registered player.
(11) Procedures for the protection of a registered player’s funds, including the segregation of a registered player’s funds from operating funds of the interactive gaming certificate holder or interactive gaming operator.
(12) Procedures for recording transactions pertaining to interactive gaming.
(13) Procedures for the security and sharing of personal identifiable information of a registered player, funds in an interactive gaming account and other information as required by the Board. The procedures must include the means by which an interactive gaming certificate holder or interactive gaming operator will provide notice to a registered player related to the sharing of personal identifiable information.
(14) Procedures and security for the calculation and recordation of revenue.
(15) Procedures for the security of interactive gaming devices and associated equipment.
(16) Procedures and security standards as to receipt, handling, and storage of interactive gaming devices and associated equipment.
(17) Procedures and security standards to protect the interactive gaming certificate holder’s or interactive gaming operator’s interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment from hacking or tampering by any person.
(18) Procedures for responding to suspected or actual hacking or tampering with an interactive gaming certificate holder’s or interactive gaming operator’s interactive gaming skin or interactive gaming web site and interactive gaming devices and associated equipment, including partial or complete suspension of interactive gaming or the suspension of any or all interactive gaming accounts when warranted.
(19) Procedures to verify each registered player’s physical location each time a registered player logs into his interactive gaming account and at appropriate intervals thereafter as determined by the Board.
(20) Procedures to ensure that the interactive games are fair and honest and that appropriate measures are in place to deter, detect and, to the extent possible, prevent cheating, including collusion and use of cheating devices, including the use of software programs that make wagers according to algorithms.
(21) Procedures to assist problem and compulsive gamblers, including procedures intended to prevent a person from participating in authorized interactive gaming who is otherwise prohibited from participating in interactive gaming.
(22) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking or tampering with the interactive gaming certificate holder’s interactive gaming skin, interactive gaming platform or interactive gaming web site. The procedures must include the process for the reconciliation or repayment of a registered player’s interactive gaming account.
(c) The submission required under subsections (a) and (b) must include a detailed description of the interactive gaming certificate holder’s or interactive gaming operator’s administrative and accounting procedures related to interactive gaming, including its written system of internal controls. Each written system of internal controls must include all of the following:
(1) An organizational chart depicting appropriate duties and responsibilities of the key employees involved in interactive gaming.
(2) A description of the duties and responsibilities of each position shown on the organizational chart.
(3) The record retention policy of the interactive gaming certificate holder or interactive gaming operator.
(4) The procedure to be utilized to ensure that money generated from the conduct of interactive gaming is safeguarded and accounted for.
(5) Procedures to ensure that recorded accountability for assets is compared with actual assets at intervals required by the Board and appropriate action is taken with respect to discrepancies.
(6) Procedures to be utilized by an employee of an interactive gaming certificate holder or interactive gaming operator in the event of a malfunction of an interactive gaming system or other equipment used in the conduct of interactive gaming.
(7) Procedures to be utilized by the interactive gaming certificate holder or interactive gaming operator to prevent persons under 21 years of age, self-excluded or involuntary excluded individuals, and players outside this Commonwealth, unless otherwise authorized by an interactive gaming reciprocal agreement, from engaging in interactive gaming.
(8) Other items the Board may request in writing to be included in the internal controls.
(d) Prior to authorizing an interactive gaming certificate holder or interactive gaming operator to commence the conduct of interactive gaming, the Board will review the system of internal controls, security protocols and audit protocols submitted under this chapter to determine whether they conform to the requirements of this chapter and whether they provide adequate and effective controls for the conduct of interactive gaming.
(e) If an interactive gaming certificate holder or interactive gaming operator intends to make a change or amendment to its system of internal controls, it shall submit the change or amendment electronically to the Bureau of Gaming Operations in a manner prescribed by the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator may implement the change or amendment on the 30th calendar day following the filing of a complete submission unless the interactive gaming certificate holder or interactive gaming operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board’s Executive Director rejecting the change or amendment.
(f) If during the 30-day review period in this chapter, the Bureau of Gaming Operations preliminarily determines that a procedure in a submission contains an insufficiency likely to negatively affect the integrity of interactive gaming or the control of revenue generated from interactive gaming, the Bureau of Gaming Operations, by written notice to the interactive gaming certificate holder or interactive gaming operator, will:
(1) Specify the nature of the insufficiency and, when possible, an acceptable alternative procedure.
(2) Direct that the 30-calendar day review period in this chapter is to be tolled and that any internal controls at issue not be implemented until approved under this chapter.
(g) Examples of submissions that may contain an insufficiency likely to negatively affect the integrity of interactive gaming may include the following:
(1) Submissions that fail to provide information sufficient to permit the review of interactive gaming activities by the Board, the Bureau, the Department or law enforcement.
(2) Submissions that fail to provide for the segregation of incompatible functions so that an employee is not in a position to commit an error and perpetrate a fraud and to conceal the error or fraud in the normal course of the employee’s duties.
(3) Submissions that do not include forms or other materials referenced in the submission or required under the act or this part.
(4) Submissions that would implement operations or accounting procedures not authorized by the act or this part.
(h) Whenever a change or amendment has been tolled under this chapter, the interactive gaming certificate holder or interactive gaming operator may submit a revised change or amendment within 30 days of receipt of the written notice from the Bureau of Gaming Operations. The interactive gaming certificate holder or interactive gaming operator may implement the revised change or amendment upon receipt of written notice of approval from the Board’s Executive Director or on the 30th calendar day following the filing of the revision unless the interactive gaming certificate holder or interactive gaming operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board’s Executive Director rejecting the change or amendment.
No part of the information on this site may be reproduced for profit or sold for profit.
This material has been drawn directly from the official Pennsylvania Code full text database. Due to the limitations of HTML or differences in display capabilities of different browsers, this version may differ slightly from the official printed version.
