Sports Wagering Operator's System of Internal Controls

(1) At least 45 days prior to commencing operations, a Sports Wagering Operator shall submit to the Commission its proposed system of Internal Controls, consisting of procedures and administrative and accounting controls, in accordance with 205 CMR 238.02(4). An Operations Certificate shall not issue until the Operator's Internal Controls are approved in accordance with 205 CMR 238.02(2). A system of Internal Controls shall be organized and formatted as required by the Commission. The Commission shall refer the proposed system of Internal Controls submitted in accordance with 205 CMR 238.02(1) to the Executive Director, who shall review the submission for compliance with M.G.L. c. 23N and 205 CMR. Upon completion of review, the Executive Director shall, in writing, either approve the submission or advise the Sports Wagering Operator of any deficiency, and any corresponding recommendation or required change. The Executive Director may include any other recommendations or required changes intended to ensure that a robust system of Internal Controls is implemented by the Sports Wagering Operator. The Sports Wagering Operator may, by writing to the Executive Director, either accept a recommendation or required change or dispute the recommendation or required change. If the Sports Wagering Operator disputes the recommendation or required change, the Sports Wagering Operator shall also provide the reason(s) for its dispute. Anysuch dispute shall be resolved bythe Commission. (4) The Commission or the Executive Director may revisit any provision of a Sports Wagering Operator's Internal Controls at any time and render recommendations and required changes as necessary. If the Commission or Executive Director renders any such recommendations and required changes, the Commission or Executive Director shall provide the Sports Wagering Operator a reasonable period to implement any such recommendations and required changes. Upon approval by the Executive Director, the Executive Director shall issue a written approval to the Sports Wagering Operator, including any associated conditions. (5) If a Sports Wagering Operator seeks to change any provision of its approved Internal Controls, the Sports Wagering Operator shall submit the proposed change, including an explanation thereof, and new certifications from its chief legal and financial officers consistent with 205 CMR 238.02(7)(i) and (j), to the Commission within 15 days of determining that such a change is necessary. The Commission shall refer the proposed change to the Executive Director who shall review the proposal for compliance with 205 CMR 238.00. Changes to the system of Internal Controls will generally be permitted if the proposed change does not lessen the applicable administrative, accounting, or physical control the Sports Wagering Operator has over its operations in the Commonwealth. Upon completion of review, the Executive Director shall either approve the proposed change or advise the Sports Wagering Operator in writing as to why the proposal does not comply with 205 CMR 238.00. The Sports Wagering Operator may appeal the Executive Director's determination to the Commission, which shall resolve the dispute. Approved changes shall be maintained as part of the approved Internal Controls. (6) A Sports Wagering Operator shall not implement modifications to Internal Controls until approved by the Executive Director or the Commission. Until such time, the Sports Wagering Operator shall continue to implement the most recently approved Internal Controls; provided, however, that if the Executive Director does not object to or otherwise respond to the submission in writing within 15 business days of receipt of the submission, the Sports Wagering Operator may implement the proposed change subject to further direction by the Executive Director in accordance with 205 CMR 238.02(4). (7) The Internal Controls shall, at a minimum, include the following: (a) Administrative controls which include, as their primary objective, policies and procedures designed to assure that all activities and transactions of the Sports Wagering Operator are instituted and completed in accordance with applicable policy or procedure; (b) Accounting controls which include, as their primary objective, procedures to assure that all activities and transactions of the Sports Wagering Operator are accurately reported and recorded in accordance with generally accepted accounting principles; (c) Reporting controls which include policies and procedures for the timely furnishing of economic and social impact reports, and standard financial and statistical reports and information in accordance with 205 CMR, and the continuing disclosure and reporting obligations of licensees; (d) For Category 1 Sports Wagering Operators and Category 2 Sports Wagering Operators, the Internal Controls required for a gaming establishment as specified in 205 CMR 138.00: Uniform Standards of Accounting Procedures and Internal Controls shall apply to a Sports Wagering Area and Sports Wagering Facility. Where compliance with the provisions of both 205 CMR 138.00 and 205 CMR 238.00 is not possible, a Gaming Licensee or Sports Wagering Operator shall comply with 205 CMR 138.00 with respect to gaming operations and 205 CMR 238.00 with respect to Sports Wagering Operations and identify its intent to do so in its written system of Internal Controls; provided, that: 1. in a Category 2 Sports Wagering Facility, an individual supervising a surveillance department monitoring room in accordance with 205 CMR 138.04(2)(a) shall hold an Occupational License in accordance with 205 CMR 235.00 rather than being licensed as a key gaming employee in accordance with 205 CMR 134.00: Licensing and Registration of Employees, Vendors, Junket Enterprises and Representatives, and Labor Organizations; 2. in a Category 2 Sports Wagering Facility, the security department internal control procedures required by 205 CMR 138.14: Internal Control Procedures for Security Department shall include a requirement that the facility be protected by security staff at all times, including overnight; and 3. in a Category 2 Sports Wagering Facility, the floor plan required by 205 CMR 138.07: Floor Plans shall depict adequate space for law enforcement officers; for the Bureau and Sports Wagering Division; and for designated agents for the purposes of 205 CMR 133.00 and 233.00; (e) Access controls which include, as their primary objective, the safeguarding of the Operator's assets, including but not limited to, organizational safeguards, such as segregation of duties between incompatible functions, and physical safeguards, such as restricted access to assets and routine security devices such as cameras and locking doors. Such access controls shall be consistent with the requirements in 205 CMR 141.00: Surveillance of the Gaming Establishment regarding surveillance of gaming establishments; (f) An infrastructure and data security plan which employs technical security controls as described in 205 CMR 243.01: Standards for Sports Wagering Equipment; (g) A plan to ensure compliance with 205 CMR 240.00: Adjusted Gross Sports Wagering and Adjusted Gross Fantasy Wagering Receipts Tax Remittance and Reporting with respect to tax remittance and reporting; (h) All applicable policies and procedures required pursuant to 205 CMR 238.04 through 238.72 and procedures and practices specified in 205 CMR 243.00: Standards for Sports Wagering Equipment; (i) A certification by the Sports Wagering Operator's chief legal officer that the submitted Internal Controls conform to M.G.L. c. 23N, 205 CMR 238.01, and any applicable regulations referenced therein; (j) A certification by the Sports Wagering Operator's chief financial officer that the submitted Internal Controls provide adequate and effective controls, establish a consistent overall system of internal procedures and administrative and accounting controls, and conform to generally accepted accounting principles and 205 CMR; (k) A plan to ensure compliance with the Operator's House Rules, including House Rules that comply with 205 CMR 243.00: Sports Wagering Equipment. (l) A plan, as required by 205 CMR 257.00: Data Privacy, to safeguard Confidential Information and Personally Identifiable Information and to ensure compliance with the requirements of 205 CMR 257.00, M.G.L. c. 93H, M.G.L. c. 93I, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and any other applicable law, regulation or order of a governmental body regarding data privacy and security; and (m) A description of the Operator's use of computerized algorithms, automated decision-making, machine learning, artificial intelligence, or any similar system, which shall include, at a minimum a description of permissible and impermissible uses of such practices and capabilities, the purposes for which they are used and the types of input and output data and an accounting of the source of each, and a description of how the Operator may use such systems to minimize risky play behavior. (8) If the Sports Wagering Operator intends to utilize any new technology not identified in its initial Internal Controls proposal, it shall submit the changes to its system of Internal Controls to incorporate the use of any such new technology to the Commission, which shall refer the proposed change to the Executive Director who shall review the proposal in accordance with 205 CMR 238.02(4). (9) (a) If a Sports Wagering Operator seeks to incorporate a provision in its Internal Controls that is not permitted under 205 CMR 238.00, or to exclude a provision required by 205 CMR 238.00, it may petition the Executive Director for permission to do so by including, in its Internal Controls filing, its proposal or petition to change a provision of the Internal Controls in accordance with 238.02(5), along with a citation to the applicable provision of 205 CMR 238.00 and a written explanation as to why the exemption is appropriate. The Executive Director may allow the exemption upon a finding that the proposal is at least equivalent to the exemption, identifying the provision of 205 CMR 238.00 from which an exemption was granted and providing the general reason for granting the exemption. (b) In the event that a Sports Wagering Operator is temporarily unable to abide by a provision of its Internal Controls, the Bureau may, upon written request by the Sports Wagering Operator, grant a limited temporary exemption from a provision of the Sports Wagering Operator's Internal Controls, provided that: 1. such exemption shall not to exceed 48 hours; 2. the provision relates to the operation of Sports Wagering; and 3. the exemption is supported by good cause showing that the health, safety or welfare of the public or the integrity of Sports Wagering will not be adversely impacted by the exemption. Where the circumstances warrant, such an exemption maybe renewedbythe Bureau for one additional 48-hour period. All such requests and determinations shall be documented and submitted to the Executive Director for review as promptly as possible. (10) The Commission and the Bureau may take any steps necessary to investigate and enforce a Sports Wagering Operator's Internal Controls for compliance with 205 CMR 238.00. The Sports Wagering Operator shall, through either independent or internal auditors, periodically compare its approved system of Internal Controls, as written, to the system actually in place and operating for the purpose of identifying areas of noncompliance, if any, so as to take immediate corrective action. The Commission or its designee may perform any inspection necessary in order to determine conformance with the approved Internal Controls. (12) The Sports Wagering Operator shall maintain in its records a complete set of its system of Internal Controls in effect at that time. (13) The Sports Wagering Operator shall submit all filings and records required pursuant to 205 CMR 238.00 electronically to the Commission, unless otherwise directed by the Commission. (14) To the extent a third-party is involved in or provides any of the Internal Controls required pursuant to 205 CMR 238.00, the Sports Wagering Operator's Internal Controls shall document the roles and responsibilities of the third-party and shall include procedures to evaluate the adequacy of and monitor compliance with the third-party's system of Internal Controls.