Current through Register Vol. 54, No.43, October 26, 2024
Section 1408a.3 - Internal controls(a) At least 90 days prior to commencing sports wagering under this subpart, a sports wagering certificate holder or sports wagering operator shall submit to the Board for approval internal controls for all aspects of sports wagering, including retail sportsbooks, interactive sportsbook operations through a web site or mobile application and nonprimary location sportsbook operations, prior to implementation and any time a change is made thereafter. The internal controls shall include detailed procedures for system security, operations, accounting, and other information as required by the Board.(b) Notwithstanding subsection (a), the procedures and controls may be implemented by a sports wagering certificate holder or sports wagering operator upon the filing of the procedures and controls with the Board and written approval to commence operations by the Executive Director. Each procedure or control submission shall contain both narrative and diagrammatic representations of the system to be utilized and shall include the following: (1) Provide for reliable accounting controls, including the standardization of forms and definition of terms to be utilized in the retail sports wagering and interactive or mobile sports wagering operations.(2) Procedures, forms and, where appropriate, details as to the reconciliation of assets and documents contained in the retail sports wagering cashier drawers. These procedures shall provide for the reporting of any overage or shortage.(3) Job descriptions and the system of personnel and chain of command, establishing a diversity of responsibility among employees engaged in sports wagering operations, including employees of a sports wagering operator and identifying primary and secondary management and supervisory positions for areas of responsibility.(4) Procedures for the registration of players and establishment of sports wagering accounts, including a procedure for authenticating the age, identity and physical address of an applicant for a sports wagering account and whether the applicant is a person prohibited from establishing or maintaining an account under applicable laws or regulations. (5) Procedures for terminating a registered player's sports wagering account and the return of any funds remaining in the sports wagering account to the registered player.(6) Procedures for suspending or terminating a dormant sports wagering account and the return of any funds remaining in the dormant sports wagering account to the registered player.(7) Procedures for the logging in and authentication of a registered player to enable the player to commence sports wagering and the logging off of the registered player when the registered player has completed play, including a procedure to automatically log a registered player out of the registered player's sports wagering account after a specified period of inactivity.(8) Procedures for the crediting and debiting of a registered player's sports wagering account.(9) Procedures for cashing checks, receiving electronic negotiable instruments and for redeeming cash equivalents.(10) Procedures for withdrawing funds from a sports wagering account by the registered player.(11) Procedures for the protection of a registered player's funds, including the segregation of a registered player's funds from operating funds of the sports wagering certificate holder or sports wagering operator.(12) Procedures for recording transactions pertaining to sports wagering.(13) Procedures for the security and sharing of personal identifiable information of a registered player, funds in a sports wagering account and other information as required by the Board. The procedures shall include the means by which a sports wagering certificate holder or sports wagering operator will provide notice to a registered player related to the sharing of personal identifiable information.(14) Procedures and security for the calculation and recordation of revenue.(15) Procedures for the security of the sports wagering platform, sports wagering interactive system, sports wagering devices and associated equipment.(16) Procedures and security standards as to receipt, handling and storage of sports wagering devices and associated equipment.(17) Procedures and security standards to protect and respond to suspected or actual hacking or tampering by any person with the sports wagering certificate holder's or sports wagering operator's interactive sports wagering web site, mobile application and sports wagering devices and associated equipment.(18) Procedures to verify each registered player's physical location each time a registered player logs into his or her sports wagering account and at appropriate intervals thereafter as determined by the Board.(19) Procedures and appropriate measures implemented to deter, detect and, to the extent possible, to prevent cheating, including collusion and use of cheating devices, including the use of software programs that make wagers according to algorithms.(20) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking or tampering with the sports wagering certificate holder's or sport wagering operator's interactive sports wagering platform, interactive sports wagering web site or mobile application and sports wagering devices and associated equipment. The procedures shall include the process for the reconciliation or repayment of a registered player's sports wagering account.(21) If any athlete or person who holds a position of authority or influence sufficient to exert influence over the participants in sporting event, as fully described in § 1401a.7(c) (relating to prohibited and restricted sports wagering activities) of this subpart, has less than 10% direct or indirect ownership interest in or control of a sports wagering certificate holder or a sports wagering operator, procedures for the following shall be included: (i) Providing notice to the Board of the identity of the owner, and if known, the ownership interest in the sports wagering certificate holder or sports wagering operator.(ii) Implementing appropriate measures to prevent an athlete or a person from participating in the management or operations of sports wagering activities of a sports wagering certificate holder or a sports wagering operator.(iii) Obtaining a certification from the owner acknowledging that the less than 10% direct or indirect owner is not permitted to be a customer of the sports wagering certificate holder or operator under § 1401a.7(b)(2), not permitted participate in the management or operations of the sports wagering certificate holder or sports wagering operator, and in the instance of an owner of an athletic team, not permitted to engage in sports wagering activity on any team in the league as that in which he has an ownership interest.(c) The submission required under subsections (a) and (b) shall include a detailed description of the sports wagering certificate holder's or sports wagering operator's administrative and accounting procedures related to sports wagering, including its written system of internal controls. Each written system of internal controls shall include: (1) An organizational chart depicting appropriate functions and responsibilities of employees involved in sports wagering.(2) A description of the duties and responsibilities of each position shown on the organizational chart.(3) The record retention policy of the sports wagering certificate holder or sports wagering operator.(4) The procedure to be utilized to ensure that money generated from the conduct of sports wagering is safeguarded and accounted for.(5) Procedures to ensure that recorded accountability for assets is compared with actual assets at intervals required by the Board and appropriate action is taken with respect to discrepancies.(6) Procedures to be utilized by an employee of a sports wagering certificate holder or sports wagering operator in the event of a malfunction of a sports wagering certificate holder's interactive sports wagering platform, interactive sports wagering web site or mobile application and sports wagering devices and associated equipment used in the conduct of sports wagering.(7) Procedures to be utilized by the sports wagering certificate holder or sports wagering operator to prevent persons under 21 years of age, self-excluded or involuntary excluded individuals, individuals who are prohibited from wagering in accordance with § 1401a.8 (relating to persons prohibited from engaging in sports wagering activities) and players outside this Commonwealth from engaging in sports wagering.(8) Other items the Board may request in writing to be included in the internal controls.(d) Prior to authorizing a sports wagering certificate holder or sports wagering operator to commence the conduct of sports wagering, the Board shall review and approve the system of internal controls, security protocols and audit protocols submitted under this chapter to determine whether they conform to the requirements of this chapter and whether they provide adequate and effective controls for the conduct of sports wagering.(e) If a sports wagering certificate holder or sports wagering operator intends to make a change or amendment to its system of internal controls, it shall submit the change or amendment electronically to the Bureau of Gaming Operations, in a manner prescribed by the Bureau of Gaming Operations. The sports wagering certificate holder or sports wagering operator may implement the change or amendment on the 30th calendar day following the filing of a complete submission unless the sports wagering certificate holder or sports wagering operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.(f) If during the 30-day review period in this chapter, the Bureau of Gaming Operations preliminarily determines that a procedure in a submission contains an insufficiency likely to negatively affect the integrity of sports wagering or the control of revenue generated from sports wagering, the Bureau of Gaming Operations, by written notice to the sports wagering certificate holder or sports wagering operator, will: (1) Specify the nature of the insufficiency and, when possible, an acceptable alternative procedure.(2) Direct that the 30-calendar day review period in this chapter to be tolled and that any internal controls at issue not be implemented until approved under this chapter.(g) Examples of submissions that may contain an insufficiency likely to negatively affect the integrity of sports wagering may include any of the following: (1) Submissions that fail to provide information sufficient to permit the review of sports wagering activities by the Board.(2) Submissions that fail to provide for the segregation of incompatible functions so that no employee is in a position to both commit an error or perpetrate a fraud and to conceal the error or fraud in the normal course of the employee's duties.(3) Submissions that do not include forms or other materials referenced in the submission or required under the act or this subpart.(4) Submissions that would implement operations or accounting procedures not authorized by the act or this subpart.(h) Whenever a change or amendment has been tolled under this chapter, the sports wagering certificate holder or sports wagering operator may submit a revised change or amendment within 30 days of receipt of the written notice from the Bureau of Gaming Operations. The sports wagering certificate holder or sports wagering operator may implement the revised change or amendment upon receipt of written notice of approval from the Board's Executive Director or on the 30th calendar day following the filing of the revision unless the sports wagering certificate holder or sports wagering operator receives written notice tolling the change or amendment in accordance with this chapter or written notice from the Board's Executive Director rejecting the change or amendment.(i) A sports wagering certificate holder or sports wagering operator shall submit to the Board for approval a Catalog of Events and Wagers, which shall include a description of the events and wagers intended to be offered and shall include the following: (2) Competition or league.(5) Description of the type of events that it intends to accept wagers on as well as the type of wagers it intends to accept.(j) A sports wagering certificate holder or sports wagering operator shall submit for approval any revision to the Catalog of Events and Wagers at least 72 hours in advance of implementation of these changes. A sports wagering certificate holder or sports wagering operator must maintain a catalog of all prior and current events and the types of wagers it offered on the events.(k) The Board reserves the right to prohibit the acceptance of wagers and may order the cancellation or discontinuation of wagering, and require refunds on any event which may have an impact on the public or the integrity of sports wagering operations.(l) A sports wagering certificate holder or sports wagering operator shall only accept wagers on sporting events for which: (1) The outcome can be verified.(2) The outcome can be generated by a reliable and independent process.(3) The outcome is not affected by any wagers placed.(4) The event is conducted in conformity with all applicable laws or regulations.(m) A sports wagering certificate holder or sports wagering operator shall not unilaterally rescind or cancel any wager made under this chapter without prior approval of the Board.(n) The available wagers, including the event number, odds and a brief description of the event, shall be displayed to the public, the sports wagering certificate holder or sports wagering operator's closed circuit television system, interactive sports wagering web site and mobile application.(o) Winning sports wagering tickets shall be redeemed through the sports wagering system, and a ticket writer or self-service kiosk shall cause the winning ticket to be reflected as claimed or redeemed in the sports wagering system upon redemption. This section cited in 58 Pa. Code §1407.5 (relating to self-service kiosks and point of sale system requirements); 58 Pa. Code § 1407a.6 (relating to ticket/voucher requirements); 58 Pa. Code § 1407a.9 (relating to sports wagering system general requirements); 58 Pa. Code § 1408a.5 (relating to information to be displayed/provided); and 58 Pa. Code § 1409a.2 (relating to sports wagering contests, tournaments, pools or other organized events).