General Standards

The following controls are required for Licensees offering Interactive Sports Gaming: (1) A Licensee shall receive approval from the Council of its Internal Control Standards for all aspects of Sports Gaming Systems prior to commencing operations. The Internal Control Standards shall be submitted to the Council as part of the License Application, and shall be approved by the Council prior to when the Licensee begins conducting Interactive Sports Gaming. A Licensee shall also receive prior approval from the Council for any change made to its Internal Control Standards, except for those changes which are grammatical corrections or related to formatting. (2) The following list of items includes procedures and controls that must be a part of each Licensee’s Internal Control Standards: MINIMUM INTERNAL CONTROLS CHAPTER 1350-03 (a) Safeguarding assets and revenues, including maintaining reliable records relating to accounts, transactions, profits and losses, operations, and events; (b) Safeguarding Sports Gaming Accounts; (c) Requirements for internal and independent audits of Licensee; (d) User access controls for all Interactive Sports Gaming personnel; (e) Segregation of duties among all Interactive Sports Gaming personnel; (f) Automated and manual risk management procedures; (g) Procedures for identifying and reporting fraud, Cheating, and Suspicious or Unusual Wagering Activity; (h) Procedures for identifying and preventing Minors from engaging in Interactive Sports Gaming; (i) Procedures to prevent wagering by Prohibited Participants; (j) Description of AML compliance standards; (k) Description of all types of Wagers available to be offered by the Sports Gaming System; (l) Description of all integrated third-party systems; (m) Description of all hardware and software applications that comprise the Sports Gaming System; (n) Description and sources of data and information feeds and services, including, but not limited to, official data, odds and line monitoring services, integrity monitoring services, and risk management support; (o) Controls ensuring regulatory compliance; (p) A monitoring system utilizing software to identify irregularities in volume or odds and swings that could signal Suspicious Wagering Activities that should require further investigation; (q) Suspicious Wagers over any threshold set by the Licensee; and (r) Description of the method to prevent past posting (i.e., a Wager made outside of the Wager period). (3) Changes to Sports Gaming Systems (a) A Licensee shall maintain a change management log listing changes to its Sports Gaming System. A Licensee shall submit the log to the Executive Director or designee, in a format specified by the Executive Director or designee, on the 15th day following the close of each calendar quarter. The log shall list: 1. Date and time of change; MINIMUM INTERNAL CONTROLS CHAPTER 1350-03 2. A description and reason for the change, including each required control program component affected. If the component being changed is a hardware component, include its physical location; 3. The name or other user ID of the individual responsible for authorizing and/or conducting the change; 4. The Council approval date, if applicable; 5. The level of the change (Level 1, 2, 3, or 4); and 6. The recording of the new digital signature for any change to a regulated control program component. (b) Classification of changes: 1. Level 1 – No Impact: This change has no impact to regulated components of the Sports Gaming System. A Licensee shall submit Level 1 changes to the Executive Director or designee within a timeframe agreed upon by the Executive Director or designee and the Licensee shall also report Level 1 changes as part of the quarterly change management log submission. Level 1 changes do not require Council approval before implementation. 2. Level 2 – Low Impact: This change has a low impact on the integrity of the Sports Gaming System, including hardware component changes. A Licensee shall report Level 2 changes to the Executive Director or designee at least three (3) business days prior to implementation. Prior to the expiration of those three (3) business days, the Executive Director or designee will review the proposed Level 2 changes and may send the Licensee written approval to implement the proposed Level 2 changes, request more information, request a pause in implementation, or inform the Licensee that a change should be designated and resubmitted as a Level 3 change in the discretion of the Executive Director or designee. If the Licensee receives written approval to implement the proposed Level 2 changes prior to the expiration of the three (3) business days, or if the Licensee does not receive a response from the Executive Director or designee within the three (3) business days, the Licensee may move forward with implementation of the Level 2 changes. 3. Level 3 – High Impact: This change has a high impact on regulated components of the Sports Gaming System. A Licensee shall submit a request for approval of Level 3 changes to the Executive Director or designee and shall implement Level 3 changes only after receiving written approval from the Executive Director or designee. Within five (5) business days after receiving the submission, the Executive Director or designee will review the proposed Level 3 change and approve the proposed Level 3 changes, request more information about the proposed Level 3 changes, or require recertification of the proposed Level 3 changes by an Independent Testing Laboratory within a timeframe agreed to by the Executive Director or designee and the Licensee. If the Licensee does not receive a response from the Executive Director or designee within five (5) business days, the Licensee may move forward with implementation of the Level 3 changes. 4. Level 4 – Emergency: When an unanticipated incident occurs that causes a disruption in the collection, accuracy, integrity, or availability of the Sports Betting System, a Licensee may execute a Level 2 or Level 3 change immediately without review by or approval from the Executive Director or designee. A Licensee shall provide notice of the emergency change to the Executive Director or designee as soon as possible. A Licensee shall document the emergency change in its change MINIMUM INTERNAL CONTROLS CHAPTER 1350-03 management log. A Licensee shall notify the Executive Director or designee of the resolution within two (2) business days of resuming normal operations. (c) If the proposed change to the Sports Gaming System relates to functionality impacting Sports Gaming Account management, identify verification, or Voluntary Self-Exclusion, the individual submitting the change must certify, in a form and manner required by the Council, that the change will not impact the compliance of the Operator or Vendor with the provisions of the Sports Gaming Act and these Rules related to Self-Excluded Individuals, Prohibited Participants, and Minors.