Supplier’s License Criteria

PURPOSE: This rule establishes criteria for a supplier’s license. (1) The commission may issue a supplier’s license if it determines on the basis of all the facts before it that the applicant meets the criteria contained in Chapter 313, RSMo. (2) In making the required determinations, the commission may consider the following factors and indices, among others: (A) The integrity of the applicant and any personnel to have duties or responsibilities for the applicant. This determination shall include consideration of: 1. Any criminal record including any federal, state, county, city violations to include ordinance violation(s) of any individual; 2. The involvement in litigation over business practices by the applicant or any individuals or entities affiliated with the applicant; 3. The involvement in proceedings in which unfair labor practices, discrimination or regulation of gambling was an issue; and 4. Failure to satisfy any judgments, orders or decrees of any court; (B) The types and variety of gaming equipment or supplies which the applicant may offer; (C) The quality, availability, practicality or legality of the gaming equipment or supplies to be offered; (D) Financial ability to operate its business successfully, including: 1. Ownership and control structure; 2. Current financial conditions; 3. Sources of equity and debt funds, amounts, terms and conditions, and certainty of commitment; 4. Provisions for cost overruns, nonreceipt of expected equity or debt funds, failure to achieve projected revenues or other financial adversity; and 5. Feasibility of financial plan; (E) The status of governmental actions required by the applicant’s gaming equipment or supplies to be offered, including required governmental approvals for development, ownership and operation; (F) Management ability of the applicant including: 1. Qualifications of managers, consultants and other contractors to operate a supplier company; 2. Plans for marketing, promotion and advertising; 3. Plan for training personnel; and 4. Equal employment and affirmative action plan; (G) Compliance with applicable statutes, rules, charters and ordinances; (H) The impact of the business proposed to be conducted in Missouri including: 1. The economic impact; A. The employment created; B. The purchases of goods and services, including Missouri goods and services; C. Public and private investment; D. Taxes generated; and 2. Social impact; (I) The extent of any public support or opposition; (J) Effects on competition, including the number, nature and products offered of other supplier licensees or applicants; (K) The failure to disclose information called for in the application process or the false statement of information called for in the application process; and (L) Any just cause. (3) Any supplier licensee shall maintain a log of all written, electronic, or otherwise documented complaints received relating to gaming products and services provided and shall provide the log and supporting documentation to the commission upon request. The log shall be provided to the commission with the renewal application. The complaint log and supporting documentation shall be a closed record pursuant to section 313.847, RSMo unless otherwise determined by the commission. (4) An independent testing laboratory (ITL) applying for or currently holding a supplier license is subject to compliance with all other requirements of this rule in addition to the following criteria: (A) The ITL shall test, evaluate, conduct math analyses, verify, certify, and/or render opinions as directed by the commission on— 1. Table games, including electronic and dealer assisted electronic table games; 2. Electronic gaming devices and payglass; 3. Random number generators; 4. Progressive gaming devices and controllers; 5. Wide area progressive systems and associated equipment; 6. Online monitoring and control systems; 7. Ticket validation systems; 8. Wireless devices and systems; 9. Cashless, promotional, and bonusing systems; 10. Redemption kiosks; 11. All gaming related peripherals, software, and systems; 12. Electronic bingo devices, software, and systems; 13. Shuffling devices; and 14. Other gaming devices and associated equipment (hereinafter referred to as “gaming equipment”) for compliance with Missouri laws, regulations, minimum internal control standards, adopted technical standards, and requirements as codified or otherwise set forth; (B) No test laboratory or its owners, officers, directors, managers, consultants, employees, or any other position deemed by the director shall— 1. Own any interest in or be employed by: A. A Class A licensee; or B. A Class B licensee; or C. A Level I occupational licensee; or D. A Level II occupational licensee; or E. A supplier licensee other than the test laboratory for whom the person is an officer, director, manager, consultant, or employee. 2. This regulation shall not preclude ITLs from contracting directly with suppliers or gaming companies to produce test reports that are in turn used to show evidence of regulatory compliance; (C) No Class A, Class B, supplier, or occupational licensee shall own an interest in or be employed by an ITL performing services relating to the conduct or regulation of gaming in Missouri unless such person is required to be licensed as a key person or occupational licensee in conjunction with an ITL’s licensing as a supplier. No person may be a key person or employed by more than one (1) ITL licensed by a jurisdiction within the United States; (D) The ITL shall make available upon the commission’s request the background investigations conducted on each of its employees pursuant to 11 CSR 45-10.090; (E) The ITL shall verify compliance with all requirements to the sole satisfaction of the commission; (F) All testing and certification of gaming equipment performed for or on behalf of the commission shall be conducted at the ITL’s place(s) of business. ITLs shall maintain current International Organization for Standardization (ISO) (17020/17025) certification and accreditation. Upon request, the ITL shall supply the commission all ISO required internal controls, policies and procedures; (G) The ITL shall not subcontract any testing or certification of gaming equipment performed for or on behalf of the commission; (H) The commission shall, at all times, have immediate and unfettered access to the ITL’s place(s) of business. Should it be determined necessary by the commission, the ITL shall reimburse the commission for all reasonable and necessary expenses incurred by its agents: 1. To travel to the site to inspect the operations and certification process of gaming equipment; 2. To inspect each of the ITL’s place(s) where testing for the commission is conducted to ensure the integrity of work is maintained; 3. To investigate issues as determined by the commission; and 4. For such reasons as the commission deems appropriate; (I) All reports, documentation, and material developed or acquired by the ITL while conducting work for or on behalf of the commission shall become the joint property of the commission and the ITL. Upon expiration or revocation of its license, certified copies of all documents, data, reports, and accomplishments prepared, furnished, or completed by the ITL for or on behalf of the commission shall be delivered to the commission within forty-five (45) calendar days and shall remain the joint property of the commission and the ITL. In addition, the ITL shall provide access to any equipment or materials used while conducting work for or on behalf of the commission for a period of one hundred twenty (120) days after the expiration or revocation of its license. 1. Reports, documentation, conversation, discussions, forensic evaluations, and material prepared, including program(s) or source code developed as a result of work performed for or on behalf of the commission, are proprietary and confidential and shall not be used or marketed by the ITL or released to the public without the prior written consent of the commission. 2. The ITL shall employ data redundancy that permits a complete and prompt recovery of all information and documentation retained by the ITL in the event of any malfunction and shall utilize environmental controls such as uninterruptible power supplies, fireproofing materials, and waterproofing materials to protect critical hardware and software from natural disasters. 3. The ITL shall maintain an electronic repository of approved and revoked software for all gaming equipment submitted for testing for the Missouri jurisdiction. Such electronic repository shall utilize tools which support hash-based message authentication code using Secure Hash Algorithm 1 (HMAC-SHA1) seeding and SHA1 hashing. The repository of critical program storage media (CPSM) shall be secure and have restricted access. The primary electronic repository shall reside at the ITL’s place of business and shall be equipped with environmental controls such as fireproofing materials and waterproofing materials to protect software from natural disasters. 4. All documents, data, reports, and correspondence prepared, furnished, or completed by the ITL for or on behalf of the commission shall be retained until its disposal is approved in writing by the commission; (J) Upon the ITL’s certification of gaming equipment, a unique identification code or signature acceptable to and approved by the commission shall be assigned to each CPSM as defined by 11 CSR 45-1.090 using a commission approved tool which possesses the ability to export results. The assigned identification code or signature and the means for generating such code or signature shall be included in all documents, reports, and databases as determined by the commission. 1. The ITL shall provide the commission with step-by-step verification procedures for each tool, device, or mechanism used to assign the unique identification codes or signatures. 2. The ITL shall provide to the commission, at no charge, in quantities determined by the commission, any verification tool, device, or mechanism that is required for commission agents to verify the code or signature of any approved CPSM. The ITL may charge the supplier for expenses associated with such verification tools. 3. The ITL must support the verification tools, devices, or mechanisms and replace, repair, update, or upgrade them as deemed necessary by the commission. The ITL may charge the supplier for expenses associated with such verification tools. 4. All equipment, procedures, software or other intellectual property developed, or owned and protected by United States patents, copyrights, or trademark laws in conjunction with the unique identification signature process shall be closed record under section 313.847, RSMo, provided such information is mutually agreed upon between the commission and the ITL and labeled as proprietary; (K) The ITL shall provide, in a commission approved format: 1. A verification manual, including tables and color photographs, of recommended critical components to be verified and sealed; 2. Flow charts and diagrams of each system and its associated hardware and software approved by the ITL on behalf of the commission, depicting the interrelationship of system components, identifying components which are recommended to be field tested and verified by commission agents; and 3. The supplier of the equipment to be verified shall be responsible for all expenses associated with providing the verification manuals and diagrams. Failure of the supplier to pay the necessary expenses shall in no way release the ITL from providing to the commission current documentation; (L) The ITL shall develop and maintain a database, acceptable to the commission, of all gaming equipment certified by the ITL for the state of Missouri. 1. The ITL shall maintain a quality assurance mechanism to ensure uniform data and data entry processes. 2. The database and report(s) must be current as of the end of the previous business day, and in a commission approved format; (M) Should the ITL be informed of any situation or incident involving the integrity of any gaming equipment presently approved for Missouri, the ITL shall notify the commission of the incident within forty-eight (48) hours of being apprised of the situation or incident. The notification shall be in a format approved by the commission; (N) The ITL shall directly invoice the licensee, manufacturer, entity, or individual for whom the testing services were provided; (O) The ITL shall annually, or as changes occur, provide documentation to the commission of all possible billable hourly rates for services offered, including nights, weekend, or holiday rates. Documentation shall include discounted rates that may be offered; (P) The ITL shall not receive any bonus, or other compensation from any licensee, manufacturer, entity, or individual(s) above the provided billable hourly rates provided to the commission for services provided; (Q) The ITL shall, upon request, provide the commission a summary report of all invoices to licensees, manufacturers, entities, or individuals. The report shall include for each submission the item submitted— 1. The date on which the submission was received in the laboratory; 2. The date rejected, withdrawn, or certified; 3. The invoice number; 4. Invoice date; 5. Name of licensee, manufacturer, entity, or individual for whom the services were rendered; 6. Billable hours; 7. Hourly rates; and 8. Invoice total; (R) The ITL shall possess and maintain all online computerized monitoring systems approved by the commission which are utilized in Missouri licensed gaming establishments. Such online computerized data monitoring systems shall be used in the interoperability testing; (S) The ITL shall provide, free of charge to the commission, technical and regulatory compliance support. The ITL shall provide responses and follow-up as directed by the MGC. In instances where the ITL providing the support is also conducting the testing for the device, the time allocated for support shall be considered part of the testing process and the ITL may bill the manufacturer for the cost of the technical support. In instances where the ITL providing the support is not conducting the testing for the device, the commission may require the manufacturer of the device to reimburse the ITL at the rate the ITL charges manufacturers for such support; (T) The ITL shall, as required by the commission, perform on-site field testing or inspections of gaming equipment. During these visits, the ITL personnel shall— 1. Not socialize with gaming operators’ or manufacturers’ staff; 2. Furnish all necessary material and equipment to perform the required services; 3. Be competent and properly trained personnel in accordance with testing standards, Missouri laws, regulations, and minimum internal control standards; 4. Invoice for actual and reasonable travel and travel-related expenses consistent with ordinary and prudent business practices given the circumstances of the travel required for the project. The commission shall not be liable for reimbursement for such travel and travel-related expenses. The licensee, for whom the onsite inspection occurred, shall be responsible for the payment of travel and related travel expenses; 5. Obtain a Missouri Level II occupational license prior to performing any actions on the gaming floor; 6. Not consume alcohol while performing in their official capacity at the Class B licensee’s property; and 7. Not participate in gambling activities while performing in their official capacity at the Class B licensee’s property; (U) The ITL shall provide, free of charge to the commission, additional consulting services for commission personnel on an as needed basis. Such additional services at a minimum shall include, but not be limited to: 1. Providing consultation to the commission and assisting the commission in drafting rules and procedures regarding the establishment of uniform operating procedures for gaming equipment testing; 2. Providing training to commission employees on gaming equipment testing, new technology, and auditing procedures; (V) The ITL shall draft and maintain gaming equipment test scripts to address Missouri statutes, regulations, minimum internal control standards, and adopted technical standards for testing a specific device. In addition, the ITL shall create specific testing procedures (test cases) that shall be used to assess compliance with the applicable test scripts. All gaming equipment shall be tested in accordance with said test scripts and test cases. Each test script shall have a unique version number. The ITL shall modify the test scripts and test cases to adapt to new technology, rule changes, or as directed by the commission. Anytime a Missouri test script is revised, a copy with the effective date shall be forwarded to the commission. The ITL and commission will conduct an annual review of the test scripts and the ITL shall modify them as necessary. All documents, procedures or other intellectual property employed by an ITL in conjunction with the development of Missouri test case(s) shall be deemed to be proprietary information and a closed record under section 313.847, RSMo, unless otherwise determined by the commission; (W) The ITL shall conduct forensic evaluations or analyses on gaming equipment (whether legal or illegal) as directed by the commission. A final forensic report must be drafted outlining all testing performed, the cause of the problem, and the outcome of the investigation, if specifically identified, and shall remain a closed record under section 313.847, RSMo, unless otherwise determined by the commission; (X) The ITL shall employ a staff of fulltime skilled professionals of such number to afford a separation of responsibilities that provides independent work product verification and fulfills the requirements stated herein to the satisfaction of the commission. The ITL shall, at a minimum, employ personnel in the disciplines of mathematics, engineering (mechanical, electrical, and software), systems and communication protocol, compliance and quality assurance, and field inspections; (Y) The ITL shall provide all services using competent personnel who are properly trained in Missouri test scripts and test cases before performing work for or on behalf of the commission. All training shall be documented and such documentation shall be available upon request; (Z) The ITL shall be subject to commission audits, the costs for which shall be borne by the ITL; (AA) The ITL shall maintain all commercial test equipment in accordance with manufacturer’s specifications and recommendations, and shall provide the commission with evidence of such upon request; (BB) If an ITL hires an individual who was previously employed by, or performed any work for any licensee, the ITL shall not permit that individual to inspect, test, or certify any gaming equipment produced by the licensee for use in Missouri, for a period of one (1) year from the individual’s date of termination from the licensee; (CC) Other than to perform evaluation for regulatory compliance, ITLs shall not participate, consult, or otherwise be involved in the design, development, programming, or manufacturing of any game, gaming equipment, cashless wagering system or any component thereof, or online monitoring system or any component thereof or modification thereto; (DD) All test cases conducted and the results of those procedures shall be documented by the ITL. Such documentation shall be made available to the commission upon request; (EE) The ITL shall maintain copies of the results of any International Organization of Standardization/International Electrotechnical Commission (ISO/IEC) 17025 audits or reviews and shall forward a copy of the results to the commission within fifteen (15) days of when they become available to the ITL; (FF) All source code and binary images tested by the ITL shall be maintained and provided to the commission upon request; (GG) The ITL shall provide the commission with all forensic procedures and utilities for electronic gaming devices currently in operation in Missouri; and (HH) The ITL shall report to the commission, within forty-eight (48) hours, any known ITL test script deficiency or failure to properly perform testing against any Missouri standard that has been identified for any hardware or software that is currently certified for the Missouri jurisdiction. The ITL shall perform an investigation and report the findings to the commission within seven (7) days of the ITL being apprised of the deficiency. (5) The commission may also consider any other information which the applicant discloses and which is relevant or helpful to a proper determination by commission and any information disclosed during the background investigation. AUTHORITY: section 313.004, RSMo 2000, and sections 313.805 and 313.807, RSMo Supp. 2013.* Emergency rule filed Feb. 3, 1995, effective Feb. 13, 1995, expired June 12, 1995. Original rule filed Feb. 3, 1995, effective Aug. 30, 1995. Amended: Filed Dec. 3, 2007, effective May 30, 2008. Amended: Filed Jan. 30, 2014, effective Sept. 30, 2014. *Original authority: 313.004, RSMo 1993, amended 1994; 313.805, RSMo 1991, amended 1993, 1994, 2000, 2008, 2010; and 313.807, RSMo 1991, amended 1992, 2000, 2012.