Sports Wagering System Requirements

PURPOSE: This rule establishes standards for sports wagering systems. (1) Each Retail or Mobile licensee shall operate a single sports wagering system through which all sports wagering activity is conducted and recorded. (2) Each Retail or Mobile licensee shall provide the commission remote, read-only, real-time access to the sports wagering system. That access shall include, at a minimum— (A) Complete access to all records of wagers, including canceled, voided, pending, and redeemed wagers; (B) Ability to query or sort wagering data; and (C) Ability to export wagering data in a non-proprietary format. (3) Sports wagering systems that offer in-game wagers shall be capable of the following: (A) The accurate and timely update of odds for in-game wagers; (B) The ability to notify the patron of any change in odds after the placement of a wager is attempted; (C) The ability for the patron to confirm the wager after notification of the change in odds; and (D) The ability to freeze or suspend the offering of wagers, when necessary. (4) The commission may develop and implement a central sports wagering monitoring system for the purpose of compiling all sports wagering activity data from all Retail and Mobile licensees. In such event, each Retail or Mobile licensee shall provide all sports wagering activity data in a format compatible with the central sports wagering monitoring system. (5) All servers used to receive transmissions of requests to place wagers and that transmit confirmation of acceptance of wagers on events placed by patrons shall be physically located in the state of Missouri. Licensees shall provide the commission with the physical location of such servers. Backup servers may be located outside of Missouri, but within the United States. Any data center where a sports wagering system server is housed must be secure and have access controls in place to prevent unauthorized access to the sports wagering system server or other equipment. (6) Each Retail or Mobile licensee shall maintain modern best practices to ensure the security and integrity of the sports wagering system, including but not limited to— (A) Physical security; (B) Access control; (C) Network security; (D) Resistance to manipulation; (E) Redundancy; (F) Error detection; (G) Data backup and recovery; and (H) Encryption. (7) A sports wagering system shall maintain records of all wagers for a period of not less than five (5) years. (8) A sports wagering system shall record at a minimum the following information for each wager: (A) Description of event or contest; (B) Unique identifier for the event or contest; (C) Wager selection; (D) Type of wager; (E) Amount of wager; (F) Odds and amount of potential payout; (G) Date and time of wager; (H) Unique identifier for the wager; (I) Unique identifier of the online sports wagering account or patron, if applicable; (J) Internet protocol address and geolocation information, if the wager is not placed at a retail location; (K) Unique identifier of the kiosk or point of sale device through which the wager was placed, if applicable; (L) The identity of the ticket writer accepting the wager, if applicable; (M) Expiration date of the sports wagering ticket; (N) Date, time, amount, and description of settlement; (O) Unique identifier of the kiosk or point of sale device through which the wager was redeemed, if applicable; (P) Identity of the ticket writer settling the wager, if applicable; (Q) Whether a wager was cancelled and the reason; and (R) Whether a wager was voided and the reason. (9) The sports wagering system shall be capable of generating reports necessary to record gross sports wagering revenue, wagering liability, ticket and voucher redemption, and such other information relating to sports wagering as deemed necessary by the commission. Such reports shall distinguish by type and status where applicable. (10) A sports wagering system shall perform, at least once every twenty-four (24) hours, a self-authentication process on all software used to offer, record, and process wagers to ensure there have been no unauthorized modifications. In the event of an authentication failure, the Retail or Mobile licensee shall immediately notify the commission. The results of all selfauthentication attempts shall be recorded by the system and maintained for a period of not less than one (1) year. (11) Each Retail or Mobile licensee shall have internal controls in place to review the accuracy and timeliness of any data feeds used to offer or settle wagers. In the event that an incident or error occurs that results in a loss of communication with data feeds used to offer or redeem wagers, that error shall be recorded in a log capturing the date and time of the error, the nature of the error and a description of its impact on the system’s performance. That information shall be maintained for a period of not less than one hundred eighty (180) days. (12) If a Retail or Mobile licensee becomes aware of a reproducible error in the sports wagering system that relates to network security, data security, accurate placement of wagers, recording of wagers, or redemption of wagers, or otherwise calls into question the security and integrity of the sports wagering system, the licensee shall notify the commission immediately. The notification shall include— (A) A description of the error; (B) Risks created or imposed by the error; and (C) Efforts being taken by the Retail or Mobile licensee to prevent any impact to the security and integrity of the sports wagering system. (13) If an active sports wagering system ever fails, crashes, or becomes inoperable for any reason, the Retail or Mobile licensee shall notify the commission no later than the end of the following calendar day. AUTHORITY: section 39(g) of Article III, Mo. Const., section 313.004, RSMo 2016, and sections 313.800–313.850, RSMo 2016 and Supp. 2025.* Original rule filed May 14, 2025, effective Nov. 30, 2025. *Original authority: 313.004, RSMo 1993, amended 1994, 2014, and 313.800-313.850, see Revised Statutes of Missouri, 2016 and Supp. 2025.