N.Y. Comp. Codes R. & Regs. tit. 9 § 5317.38

Current through Register Vol. 46, No. 45, November 2, 2024

Section 5317.38 - Voucher validation system requirements

(a) Voucher validation system. A voucher validation system may be integrated entirely into a MCS or exist as an entirely separate system.

(b) Payment by voucher printer. Payment by voucher printer as a method of credit redemption on a gaming device is permissible only when the gaming device is linked to an approved validation system or MCS that allows validation of the printed voucher. Validation information shall come from the validation system or MCS using a secure communication protocol. For support of offline voucher issuance, the gaming device shall be linked to an approved validation system or MCS that allows validation of the printed voucher, but does not have to be in constant communication for the issuance of voucher to be permissible.

(c) Voucher Issuance. The voucher validation system shall be able to communicate the following voucher data to the gaming device to print on the voucher:

(1) gaming facility name and site identifier;

(2) indication of an expiration period from the date of issuance, or the date and time the voucher will expire (24-hour format that is understood by the local date and time format), if applicable;

(3) system date and time (24-hour format that is understood by the local date and time format); and

(4) voucher validation number for the gaming device to generate the validation number.

(d) Algorithm for generating voucher validation numbers or seeds.

(1) System validation. The algorithm or method used by the validation system or MCS to generate the voucher validation number shall guarantee an insignificant percentage of repetitive validation numbers.

(2) Gaming-device-generated validation number (system seed). The validation system shall send a unique seed to the gaming device upon enrolling the gaming device as voucher-printing-capable. The system subsequently may send a new seed to the gaming device after a voucher is printed. The algorithm or methods used to determine the seed shall guarantee an insignificant percentage of repetitive validation numbers.

(e) Algorithm for generating offline voucher authentication identifiers. If supported, the offline authentication identifier shall be of a unique value that is derived by a hash, or other secure encryption method of at least 128 bits, that uniquely will identify the wager instrument, verify that the redeeming system was also the issuing system and validate the amount of the voucher. The following minimum set of input shall be used to create the authentication identifier:

(1) slot machine identifier;

(2) validation number;

(3) voucher amount; and

(4) secure seed, key, etc. provided by the validation system or MCS to the gaming device.

(i) Secure seeds, keys, etc. as assigned shall be sufficiently random. Measures to avoid predictability will be reviewed by the licensed independent testing laboratory pursuant to Part 5318 of this Subchapter on a case-by-case basis.

(ii) The minimum length for any secure seeds, keys, etc. employed by the validation system or MCS shall be chosen from a pool of the variable type specified by the communication protocol used. The pool shall comprise at least 10 to the power of 14 randomly distributed values.

(f) System voucher records.

(1) The validation system shall retrieve the voucher information correctly based on the secure communication protocol implemented and store the voucher information into a database.

(2) The voucher record on the host system shall contain at a minimum the following voucher information:

(i) validation number;

(ii) date and time the gaming device printed the voucher (24-hour format that is understood by the local date and time format);

(iii) type of transaction or other method of differentiating voucher types (assuming multiple voucher types are available);

(iv) numeric value of voucher in dollars and cents;

(v) status of voucher (i.e., valid, unredeemed, pending, void, invalid, redemption in progress, redeemed, etc.);

(vi) date and time the voucher will expire (24-hour format that is understood by the local date and time format or expiration period from date of issuance), if applicable;

(vii) Machine number (or cashier or change booth location number, if voucher creation outside the gaming device is supported) that identifies the location from which the voucher was issued.

(g) System requirements for offline ticketing support. Offline ticketing shall:

(1) support the identification and redemption of offline vouchers through a system provided application;

(2) log all access and operations of users of the application described in paragraph (1) of this subdivision for 14 days through archived data or restoration from backup where maintaining such data on a live database is deemed inappropriate;

(3) the validation system or MCS shall set a maximum expiration length of no more than 30 gaming days for all provided and still-unused validation numbers and seed, key, etc. values;

(4) expired validation numbers and seed, key, etc. values shall be discarded in a way that prevents the re-use of unique combinations of validation numbers and seed, key, etc. values for a sufficient period of time on the system.

(h) Voucher printing during loss of communication with validation system. For validation systems that communicate to a gaming device through an interface board (also called a system machine interface board), if any links between the interface board and the MCS database go down, the interface board shall:

(1) not respond to the validation request from the gaming device and stop voucher printing;

(2) prevent the gaming device from further voucher issuance; and

(3) not read or store any further voucher information generated by the gaming device.

A maximum of two vouchers directly after loss of communication is acceptable, in cases where the interface element already has been seeded by the system, so long as the voucher issuance information is sent immediately, when communication is reestablished.

(i) Online voucher redemption. Vouchers can be redeemed at a gaming device, cashier or change booths or other approved validation terminals (kiosks), so long as such locations are enrolled for voucher validation with a validation system.

(1) The validation system shall process voucher redemption correctly according to the secure communication protocol implemented;

(2) The validation system shall update the voucher status on the database during each phase of the redemption process accordingly, so that whenever the voucher status changes, the system updates the database. Upon each status change, the database shall indicate the following information:

(i) date and time of status change;

(ii) voucher status;

(iii) voucher value;

(iv) machine number or source identification from where the voucher information came from.

(j) Offline voucher redemption. If supported, offline vouchers can be redeemed at a cashier or change booth, so long as such locations are enrolled for voucher validation with a validation system.

(1) The validation system at a minimum shall support the identification and redemption of offline vouchers through a system-provided application.

(2) The validation system shall process offline voucher redemption correctly according to the secure communication protocol implemented.

(3) The validation system shall update the voucher status on the database during each phase of the redemption process accordingly. In other words, whenever the voucher status changes, the system shall update the database. Upon each status change, the database shall indicate the following information:

(i) date and time of status change;

(ii) ticket/voucher status;

(iii) ticket/voucher value;

(iv) machine number or source identification from where the voucher information came.

(k) Cashier and change booth operation. All validation terminals shall be user-controlled and password-controlled. When a voucher is presented for redemption, a cashier:

(1) shall scan the bar code via an optical reader or equivalent; or

(2) shall input the voucher validation number manually; and

(3) may print a validation receipt, after the voucher is electronically validated, if applicable.

(l) Validation receipt information. Any validation receipt, at a minimum, shall contain the following printed information:

(1) machine number;

(2) validation number;

(3) date and time paid;

(4) amount; and

(5) cashier or change booth identifier.

(m)Invalid voucher notification. The validation system or MCS shall have the ability to identify the following occurrences and notify the cashier that one of the following conditions exists:

(1) voucher cannot be found on file (e.g., stale date, forgery, etc.);

(2) voucher has already been paid; or

(3) amount of voucher differs from amount on file. This requirement of this paragraph can be met by display of the voucher amount for confirmation by cashier during the redemption process).

(n) Voucher redemption during communication loss. If the online data system temporarily goes down and validation information cannot be sent to the validation system or MCS, an alternate method of payment shall be provided either by the validation system possessing unique features (e.g., validity checking of voucher information in conjunction with local database storage), to identify duplicate vouchers and prevent fraud by reprinting and redeeming a voucher that was previously issued by the gaming device; or use of an approved alternative method as designated by the commission that will accomplish the same. A maximum of two vouchers directly after loss of communication is acceptable, in cases where the interface element has already been seeded by the system, so long as the voucher issuance information is sent immediately, when communication is reestablished. This subdivision does not apply to systems employing an approved offline voucher routine.

(o) Redemption terminals (kiosks). Refer to Part 5316 for technical standards for redemption terminals.

(p) Reporting requirements. The following reports shall be generated at a minimum and reconciled with all validated/redeemed vouchers:

(1) voucher issuance report;

(2) voucher redemption report;

(3) voucher liability report;

(4) voucher drop variance report;

(5) transaction detail report, which shall be available from the validation system that shows all vouchers generated by a gaming device and all vouchers redeemed by the validation terminal or other gaming device; and

(6) cashier report, which shall detail individual vouchers, the sum of the vouchers paid by a cashier or change booth or redemption terminal.

The requirements set forth in paragraphs (2) and (4) of this subdivision shall not apply where two-part vouchers exist for the gaming device wherein the first part is dispensed as an original voucher to the patron and the second part remains attached to the printer mechanism as a copy (on a continuous roll) in such gaming device.

(q) Database and validation component security. Once validation information is stored in the database, such data shall not be altered in any way. The validation system database shall be encrypted or password-protected and shall possess a non-alterable user audit trail to prevent unauthorized access. The normal operation of any device that holds voucher information shall not have any options or method that may compromise voucher information. Any device that holds voucher information in its memory shall not allow removing of the information unless it has first transferred that information to the database or other secured component, or components, of the validation system.

N.Y. Comp. Codes R. & Regs. Tit. 9 § 5317.38

Adopted New York State Register November 16, 2016/Volume XXXVIII, Issue 46, eff. 11/16/2016