SW Supplier Standards

PURPOSE: This rule establishes the standards for SW Supplier licensees. (1) An SW Supplier licensee who does not manufacture the sports wagering equipment, systems, or supplies that it sells must notify the commission of the specific components being sold by the SW Supplier that it does not manufacture, and must purchase said items from a licensed SW Supplier as directed by the commission if regulatory oversight is necessary for the integrity of sports wagering. (2) An SW Supplier licensee shall maintain a log of all complaints received relating to sports wagering products and services provided and shall provide the log and supporting documentation to the commission upon request. (3) Licensed independent testing laboratories (ITLs) shall not participate in the development of any products they are testing and certifying to maintain their independence. Other than to perform an evaluation for regulatory compliance, ITLs shall not participate, consult, or otherwise be involved in the design, development, programming, or manufacturing of any sports wagering equipment, sports wagering system, or any component thereof or modification thereto. (4) No ITL or its owners, officers, directors, managers, consultants, employees, or any other position deemed by the commission shall own any interest in any Retail, Mobile, Official League Data Provider, or SW Supplier licensee other than the ITL for whom the person is an officer, director, manager, consultant, or employee. (5) No Retail, Mobile, Official League Data Provider, SW Supplier, or SW Occupational licensee or key person of such licensee shall own any interest in or be employed by an ITL performing services relating to the conduct or regulation of sports wagering in Missouri unless such person is an SW Occupational licensee or a key person of the ITL. (6) The ITL shall not subcontract any testing or certification of sports wagering equipment or systems performed for or on behalf of the commission. (7) The ITL shall maintain an electronic repository of all software for sports wagering equipment or systems submitted for testing for the state of Missouri. Such electronic repository shall utilize tools which support, at a minimum, hash-based message authentication code Secure Hash Algorithm 1 (HMACSHA1) and SHA1 hashing. The repository of critical components shall be secure and have restricted access. The primary electronic repository shall reside at the ITL’s place of business and shall be equipped with environmental controls to protect hardware and software. (8) Upon the ITL’s certification of sports wagering equipment or systems, a unique identification code or signature acceptable to and approved by the commission shall be assigned to each critical component as defined in 11 CSR 45-20 using a tool, device, mechanism, or other methodology which possesses the ability to export results. The assigned identification code or signature and the means for generating such code or signature shall be included on all certification letters, documents, reports, and databases as determined by the commission. (A) The ITL shall provide the commission with step-by-step verification procedures for each tool, device, mechanism, or other methodology used to assign the unique identification codes or signatures. (B) The ITL shall provide to the commission, at no charge, any verification tool, device, or mechanism that is required for commission agents to verify the code or signature of any certified critical component for the state of Missouri. (C) The ITL shall support the verification tools, devices, or mechanisms and replace, repair, update, or upgrade them as deemed necessary by the commission to ensure the integrity of sports wagering. (9) The ITL shall develop and maintain a database of all sports wagering equipment or systems certified by the ITL for the state of Missouri. (A) The ITL shall maintain a quality assurance mechanism to ensure uniform data and data entry processes. (B) The database and report(s) must be current as of the end of the previous business day and accessible by the commission. (10) The ITL shall provide, free of charge to the commission, technical and regulatory compliance support. In instances where the ITL providing the support is also conducting the testing, the time allocated for support shall be considered part of the testing process and the ITL may bill the licensee for the cost of the technical support. In instances where the ITL providing the support is not conducting the testing, the commission may require the licensee to reimburse the ITL at the rate the ITL charges licensees for such support. (11) The ITL shall draft and maintain test scripts to address Missouri statutes, regulations, and technical standards for testing a specific sports wagering device or system. In addition, the ITL shall create specific testing procedures (test cases) that shall be used to assess compliance with the applicable test scripts. All sports wagering equipment and systems shall be tested in accordance with said test scripts and test cases. Each test script shall have a unique version number and be submitted to the commission. The ITL shall list the specific test script(s) and version(s) used during compliance testing on any issued certification letters. The ITL shall modify the test scripts and test cases to adapt to new technology, rule changes, or as directed by the commission. Anytime a Missouri test script is revised, a copy with the effective date shall be forwarded to the commission within seven (7) calendar days. (12) The ITL shall report to the commission, within forty-eight (48) hours, any known ITL testing deficiency or failure to properly perform testing against any Missouri standard that has been identified for any sports wagering equipment or system that is currently certified for the state of Missouri. The ITL shall perform an investigation and report the findings to the commission within seven (7) calendar days of the ITL being apprised of the deficiency. (13) The ITL shall conduct forensic evaluations or analyses on sports wagering equipment and systems as directed by the commission if there is concern with the integrity of the equipment or system. A final forensic report shall be drafted and provided to the commission outlining all testing performed, the cause of the problem, and the outcome of the investigation, if specifically identified. (14) The ITL shall maintain copies of the results of any International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17020/17025 or similar standard audits or reviews and shall forward a copy of the results to the commission within fifteen (15) calendar days of when they become available to the ITL. AUTHORITY: section 39(g) of Article III, Mo. Const., section 313.004, RSMo 2016, and sections 313.800–313.850, RSMo 2016 and Supp. 2025.* Original rule filed May 14, 2025, effective Nov. 30, 2025. *Original authority: 313.004, RSMo 1993, amended 1994, 2014, and 313.800-313.850, see Revised Statutes of Missouri, 2016 and Supp. 2025.