Minimum Internal Control Standards

§ 201Purpose

This standard states the minimum internal controls that apply to the offering of a covered product. A person subject to it shall meet or exceed each requirement. Nothing in it limits a requirement imposed by applicable law, and where applicable law imposes a stricter requirement, the stricter requirement governs.

§ 202Application

(a)This standard applies to a covered operator as determined under SBCGS-C.

(b)Where a covered product is offered under the authority of, in the name of, or for the benefit of a licensed organization, this standard applies to that organization as to the requirements identified in subsection (d) and to Part 500 in full.

(c)This standard applies to a host location as to §§ 305, 401, 402, 404, and 406.

(d)The following requirements are allocated as stated, and each named person shall discharge its allocated requirement directly:

(e)A duty allocated by subsection (d) is not discharged by contract with another person. A covered operator or licensed organization may engage another person to perform work in support of a duty, and remains responsible for the duty.

(f)Where two or more persons are covered operators as to the same covered product, each is responsible for each requirement allocated to a covered operator, and compliance by one discharges the obligation of the others as to that requirement only where the compliance is documented and available to each.

§ 203Definitions

Terms defined in SBCGS-C have the same meaning here. In addition:

Assessor means a person meeting § 701 engaged to assess conformity with this standard.

Compliance officer means the individual designated under § 204(b).

Monitoring system means the central system to which covered devices communicate under SBCGS-T Part 850.

Net position means, for a player and a session, the amount committed less the value of awards received.

Player account means a record maintained by a covered operator that identifies a player and to which the player's play, limits, and exclusion status attach.

Session means a continuous period of play at a covered device, beginning when a player commits consideration and ending when the player redeems the balance or when the device has been inactive for three minutes, whichever occurs first.

Basis: Pa. H.B. 2557, § 5102 (2026), definition of session.

Written internal controls means the document required by § 204(c).

§ 204Organizational requirements

(a)A covered operator and a licensed organization shall each maintain an organizational structure in which responsibility for compliance with this standard is assigned to identified individuals and is separated from responsibility for revenue.

(b)Each shall designate a compliance officer, who shall:

(1)be an individual, named in the written internal controls;

(2)have authority to suspend the offering of a covered product, to disable a covered device, and to withdraw a covered device from a host location;

(3)report to the governing body of the person, or to an individual who does not hold revenue responsibility for covered products; and

(4)not be an individual who receives compensation determined by reference to gross gaming revenue from covered products.

(c)Each shall maintain written internal controls stating how it complies with each section of this standard applicable to it. The written internal controls shall identify the individual responsible for each control, the frequency at which each control operates, and the record each control produces. They shall be reviewed at least annually and upon any change to a covered product, a covered device, an allocation agreement, or the law of a jurisdiction in which it operates.

(d)A covered operator shall provide the written internal controls to each licensed organization and each host location with which it deals, and shall provide to each of them the portion of the controls that the recipient is required to perform.

(e)Each shall train each individual whose duties bear on a requirement of this standard before that individual assumes those duties and at least annually thereafter, and shall retain a record of the training.

§ 205Fitness

(a)A covered operator shall not knowingly permit an individual to hold a position of responsibility over a covered product, and a licensed organization shall not knowingly engage a covered operator, where the individual or the operator:

(1)has been convicted of an offense involving gambling, fraud, theft, bribery, money laundering, or the offering of a gaming device without required authorization, within the preceding ten years;

(2)has had a gaming licence, permit, or registration revoked or denied for cause in any jurisdiction within the preceding ten years; or

(3)is a person whose participation would cause the covered operator or the licensed organization to be in breach of applicable law.

(b)A covered operator shall obtain and retain a background check for each individual described in subsection (a) before that individual assumes duties, and shall repeat it at intervals not exceeding three years.

(c)A licensed organization shall obtain from each covered operator with which it deals a written statement identifying every individual holding a beneficial interest of ten percent or more in the operator, and shall retain the statement.

§ 206Protection of funds

(a)A covered operator shall hold funds representing unredeemed player balances, unpaid awards, and amounts allocated to a beneficiary and not yet disbursed, separately from its operating funds, in an account maintained at a federally insured depository institution.

(b)The balance in the account required by subsection (a) shall at all times equal or exceed the sum of unredeemed player balances, awards accrued and unpaid, and amounts allocated to a beneficiary and not yet disbursed. The covered operator shall reconcile the account not less than weekly and shall retain the reconciliation.

(c)A covered operator shall maintain, at each host location, funds sufficient to pay the maximum award available on the covered devices at that location, held on an imprest basis.

(d)A covered operator shall not pledge, encumber, lend, or invest funds held under subsection

(a).

(e)A licensed organization shall maintain amounts received for a charitable purpose in an account separate from any account used for the general operations of the organization, and shall not commingle those amounts with other funds.

§ 207System standards

(a)A covered operator shall not offer a covered product on a covered device that does not conform to SBCGS-T.

(b)A covered operator shall connect each covered device to a monitoring system meeting SBCGS-T Part 850, and shall not offer a covered product on a device that is not so connected.

(c)A covered operator shall configure each covered device so that, where a control required by this standard or by SBCGS-T is unavailable, the device rejects the commitment of consideration rather than accepting it without the control.

(d)A covered operator shall not modify, and shall not permit the modification of, software or configuration affecting outcome, award schedule, a skill element, accounting, or a control required by this standard, except through a process stated in the written internal controls that produces a record of the modification, the individual who made it, the authorization for it, and the certification supporting it.

(e)A covered operator shall reconcile the records of each covered device against the monitoring system not less than daily, and shall investigate and document each variance exceeding the lesser of one percent of the day's gross gaming revenue at the device or one hundred dollars.

§ 208Independent testing

(a)A covered operator shall not offer a covered product on a covered device unless an independent testing laboratory meeting SBCGS-T § 881 has certified that the device conforms to SBCGS-T and has issued a written report.

(b)A covered operator shall obtain a further certification upon any change described in § 207(d) and upon any event requiring reclassification under SBCGS-C § 109(a)(1).

(c)A covered operator shall retain each report and shall produce it on request to a licensed organization, an assessor, and a regulatory authority.

(d)A covered operator shall not represent that a covered device is certified except by reference to a report obtained under this section, identifying the laboratory, the report, the date, and the software identification to which it applies.

§ 301Exclusion program

(a)Availability. A covered operator shall enable a person to enroll in an exclusion program at any time, and shall make enrollment available at each of the following:

(1)at the covered device, without the assistance of an employee;

(2)at the host location, through a form the host location is required to hold; and

(3)remotely, without attending a host location.

(b)Terms. A covered operator shall offer exclusion terms of one year, five years, and lifetime. A person may at any time extend a term. A person may not shorten a term once elected.

(c)Effect. Upon enrollment the covered operator shall, within twenty four hours:

(1)prevent the excluded person from commencing play on any covered device the operator offers, in every jurisdiction in which the operator offers covered products;

(2)cease all direct marketing to the excluded person, and remove the person from every marketing audience, including an audience constructed by an affiliate or an advertising service; and

(3)withdraw any loyalty benefit, promotional credit, or complimentary service.

(d)Payment of accrued awards. A covered operator shall pay an excluded person any award accrued before enrollment and any unredeemed balance held at the time of enrollment. Exclusion shall not be a ground for forfeiting an amount already won.

(e)Enforcement at the device. A covered operator shall enforce an exclusion at the covered device before consideration is accepted, by the identity verification required by § 401. Where a covered device permits limited anonymous play under § 401(d), the operator shall enforce the exclusion by the means available at that device and shall record each instance in which enforcement was not possible.

(f)Enforcement at the location. A host location shall not knowingly permit an excluded person to play a covered device on its premises, and shall hold and enforce the exclusion list provided by the covered operator in the form the operator supplies.

(g)Reinstatement. A covered operator shall not remove a person from an exclusion program automatically at the expiration of the elected term. Removal requires an affirmative application by the person made after the term has expired. For a lifetime exclusion, removal additionally requires that not less than five years have elapsed and that the person has completed a problem gambling awareness program.

(h)Confidentiality. A covered operator and a host location shall hold the identity of an excluded person in confidence and shall use exclusion data only for the purposes of this standard.

(i)Interoperability. A covered operator shall honor an exclusion recorded in any statewide or multi-operator exclusion program applicable to it, and shall support transmission of an exclusion it records to such a program. Where a jurisdiction operates an exclusion program for casino gaming, video gaming terminals, or sports wagering, and the program does not by its terms reach covered products, the covered operator shall nonetheless honor an exclusion recorded in that program.

Basis: Ohio Admin. Code 3772-12-03 and 3772-12-04; Pa. H.B. 2557, § 5305 (2026).

§ 302Financial and time limits

(a)A covered operator shall enable a player to set, before the first commitment of consideration in a session, a limit on net position for the day.

(b)A covered operator shall apply a default limit on net position for the day, applicable where the player sets none, of not more than two hundred fifty dollars.

Basis: Pa. H.B. 2557, § 5304(c) (2026).

(c)A player may reduce a limit during a session. A player may not increase a limit during a session. An increase takes effect only after the period of the existing limit has expired and the player has reaffirmed the increase after that expiry.

(d)Where a covered operator maintains a player account, the operator shall additionally enable the player to set, at durations of twenty four hours, seven days, and one month, a limit on the amount committed and a limit on net position, and a limit on session time on a daily basis.

(e)A covered operator shall enforce each limit at the covered device before consideration is accepted, and shall inform the player which limit caused a rejection.

(f)Where a player has set limits of differing durations, the most restrictive applicable limit governs.

(g)A covered operator shall enable a player to suspend play for a period of not less than seventy two hours, and subsections (c) and (d) of § 301 apply during the suspension.

§ 303Session conduct

(a)A covered device shall not permit a player to commit consideration for a further play within five seconds of the commencement of the preceding play.

(b)A covered device shall suspend play for not less than thirty seconds after fifteen minutes of continuous play in a session, and shall display during the suspension the elapsed session time, the amount committed in the session, the value of awards received in the session, and the net position for the session.

Basis: Pa. H.B. 2557, § 5304(a) and (b) (2026).

(c)A covered device shall display continuously, while a session is in progress, the elapsed session time, the amount committed in the session, the value of awards received in the session, and the net position for the session.

(d)A covered device shall not accept a credit card, a debit card, or an instrument drawn on a line of credit as consideration.

(e)A covered operator shall not extend credit to a player, and shall not permit a host location to do so, for the purpose of play on a covered device.

(f)A covered operator shall not offer, and a host location shall not provide, complimentary alcohol conditioned on play of a covered device.

§ 304Disclosure

(a)Manner. A disclosure required by this section shall be presented on the covered device in text legible at the position from which the device is played, shall be available to the player before the player commits consideration, and shall remain accessible during play through a control identified on the primary display.

(b)Content required for every covered product. A covered operator shall disclose:

(1)the rules of play;

(2)the cost of a play and the maximum amount that may be committed on a single play;

(3)the schedule of awards and the maximum award available on a single play;

(4)the theoretical return to player expressed as a percentage of the amount committed, stated to one decimal place, for the configuration in operation;

(5)that the product may result in the loss of the amount committed;

(6)the identity of the covered operator and a means of making a complaint under § 306; and

(7)the statement and telephone number required by § 305(c).

(c)Content required for a skill-represented product. In addition, a covered operator offering a skill-represented product shall disclose:

(1)the return at optimal skill and the return at absent skill, each expressed as a percentage of the amount committed and stated to one decimal place, presented together and with equal prominence;

(2)the skill influence range;

(3)how each skill element is reached and what the player must do to complete it; and

(4)the median elapsed time required by a proficient player to complete each skill element, and the incremental value returned for completing it.

(d)Nominal skill products. A covered operator shall not make a skill representation as to a nominal skill product as determined under SBCGS-C § 106(g)(2). A covered operator offering a product that has been classified as a nominal skill product shall, within thirty days of that classification, withdraw every skill representation identified in the classification record or cease to offer the product.

(e)Provisional classification. Where a product is a provisional demonstrated skill product under SBCGS-C § 106(g)(3), the covered operator shall state in the disclosure that the skill realization rate has not yet been determined.

(f)Prohibited statements. A covered operator, a licensed organization, and a host location shall not state or imply:

(1)that the outcome of a play depends on skill to a degree greater than the skill influence range supports;

(2)that a player can improve the return by any means other than the skill elements disclosed under subsection (c);

(3)that the product is not gambling, is exempt from gambling law, or has been approved or endorsed by a regulatory authority, unless the statement identifies the authority and the approval and is accurate; or

(4)that a play supports a charitable purpose, except in conformity with Part 500.

§ 305Problem gambling program

(a)A covered operator shall maintain a written problem gambling program stating the measures it takes to identify and respond to indications of harm, the training given to employees of covered operators and host locations, the materials made available to players, and the funding it provides.

(b)A covered operator shall fund problem gambling prevention and treatment in an amount not less than three percent of gross gaming revenue from covered products, paid to a governmental program in the jurisdiction where one exists and otherwise to an independent organization providing problem gambling services in that jurisdiction. Payment shall be made not less than quarterly, and the amount and recipient shall be reported under § 602.

Basis: Pa. H.B. 2557, § 5501 (2026), which directs not less than three percent of gross terminal revenue to the Compulsive and Problem Gambling Treatment Fund.

(c)A host location shall display, in the area in which covered devices are placed, a sign stating that help for a gambling problem is available and giving the toll-free telephone number of the problem gambling service in the jurisdiction, and a sign stating the minimum age required by § 401.

(d)A covered operator shall make available at each host location printed materials on problem gambling, in the form the jurisdiction prescribes where it prescribes one.

(e)A host location shall ensure that at least one individual who has completed the training required by § 204(e) is present on the premises during every period in which a covered device is available for play.

(f)A covered operator shall not permit a person who appears visibly intoxicated to commence play on a covered device, and a host location shall not permit such a person to do so on its premises.

§ 306Complaints and disputes

(a)A covered operator shall maintain a procedure by which a player may make a complaint, including a complaint about the operation of a covered device, the amount of an award, a refusal to pay an award, or the conduct of a host location.

(b)The procedure shall be available at the covered device without the assistance of an employee and shall not require the player to attend the host location.

(c)A covered operator shall acknowledge a complaint within three business days and shall resolve it within thirty days, and shall state in writing to the player the outcome and the reasons for it.

(d)A covered operator shall preserve the game recall data required by SBCGS-T § 861 for the plays to which a complaint relates until the complaint is resolved and for two years thereafter.

(e)A covered operator shall maintain a register of complaints stating the date, the covered device, the subject, the outcome, and the elapsed time to resolution, and shall report the register under § 602.

(f)A covered operator shall not condition payment of an award on the player waiving a right, or on the player refraining from making a complaint to a regulatory authority.

§ 307Advertising and promotion

(a)A covered operator, a licensed organization, and a host location shall not advertise or promote a covered product in a manner that:

(1)targets or is likely to appeal to a person below the minimum age stated in § 401;

(2)is presented in, on, or adjacent to a school, a place of worship, a treatment facility, or a facility providing services to persons in financial hardship;

(3)represents play as a solution to financial difficulty, as a source of income, or as a means of social or personal success;

(4)states or implies a rate of winning that the award schedule does not support; or

(5)makes a skill representation contrary to § 304(d) or (f).

(b)Advertising for a covered product shall state the toll-free telephone number of the problem gambling service in the jurisdiction.

(c)A covered operator shall not offer a promotion that is conditioned on a level of play, on continued play, or on recovery of a prior loss.

(d)A covered operator shall not make a payment to a host location that is determined by reference to the number of players introduced or to the losses of an identified player.

§ 401Age and identity verification

(a)A covered operator shall not permit a person below twenty one years of age to play a covered product, and shall not permit a person to play a covered product without first verifying age.

(b)Verification shall be performed at the covered device before consideration is accepted, by one of the following:

(1)reading a government issued identification document and confirming its validity;

(2)authentication to a player account established by a process that verified the holder's identity and age against an independent data source; or

(3)a method the jurisdiction has approved for the verification of age at a gaming device.

Basis: Pa. H.B. 2557, § 5303 (2026).

(c)A covered operator shall re-verify a player account holder's identity at intervals not exceeding three years and upon any change to the name, address, or payment instrument on the account.

(d)Limited anonymous play. Where a jurisdiction permits play without verification of identity, a covered operator may permit it only where all of the following are true, and the operator shall record each session conducted under this subsection:

(1)age has been verified under subsection (b) notwithstanding that identity is not recorded;

(2)the amount that may be committed in the session does not exceed fifty dollars;

(3)the exclusion enforcement required by § 301(e) is performed to the extent the available identification permits; and

(4)the aggregate of sessions conducted under this subsection at a covered device does not exceed twenty percent of sessions at that device in a calendar quarter.

(e)A host location shall not permit a person below twenty one years of age to enter an area in which covered devices are placed.

§ 402Placement

(a)A covered operator and a licensed organization shall not place a covered device, and a host location shall not permit a covered device to be placed, except on premises where:

(1)access to the area in which the device is placed is controlled so that a person below twenty one years of age cannot enter it; and

(2)an individual meeting § 305(e) is present during every period in which the device is available for play.

(b)A covered device shall not be placed on the premises of a school, a place of worship other than in an area to which subsection (a) applies, a facility providing treatment for substance use or gambling disorder, a facility providing services to persons experiencing homelessness or financial hardship, or a facility whose principal business is cashing checks or making short term consumer loans.

(c)A covered operator shall maintain a record of the location of every covered device it offers, including the address, the type of premises, the number of devices, and the date of placement and removal.

(d)A covered operator shall report annually under § 602 the number of covered devices it operates in each census tract in which it operates, and the gross gaming revenue derived from those devices.

Basis: Statement of the Governor of Virginia on the veto of S.B. 661, April 10, 2026.

(e)A covered operator shall comply with any restriction on the number or placement of covered devices imposed by the jurisdiction or by the political subdivision in which the host location is situated.

§ 403Prohibited persons and conduct

(a)A covered operator shall not permit the following persons to play a covered product it offers:

(1)an individual who holds a position of responsibility over that covered product, or who is employed by the covered operator in a role bearing on the outcome, the accounting, or a control required by this standard;

(2)an individual employed by the host location at which the covered device is placed, during a period in which that individual is on duty;

(3)an officer or director of the licensed organization for whose benefit the product is offered; and

(4)an individual who has access to information about the configuration of a covered device that is not disclosed to players and that bears on the value returned.

(b)A covered operator shall maintain a list of persons excluded under subsection (a) and shall enforce it by the means used to enforce § 301.

(c)A covered operator shall not permit a person to play a covered product using information about the state of a covered device that is not available to players generally, and shall record and report under § 603 each instance it detects.

(d)A covered operator shall not offer a covered product in which the value returned to a player, the difficulty of a skill element, or the availability of an award is varied by reference to the identity of the player, the player's prior play, or the player's demonstrated skill.

Basis: Ohio Rev. Code § 2915.01(UU)(2)(a); Ohio Admin. Code 3772-50-24 app. A; GLI-11 v3.0 § 4.20.6.

§ 404Cash handling, redemption, and security

(a)A covered device shall not dispense cash. An award shall be delivered by a ticket, voucher, or electronic record redeemable at a redemption terminal or a staffed station.

(b)A covered operator and a host location shall ensure that every payment of an award is made through a redemption terminal, a staffed cashier station, or a verified electronic transfer. An employee shall not make an unrecorded cash payment from a covered device or from a general register.

(c)A host location shall maintain a secure area for the handling of funds associated with covered devices, with controlled access, a means of raising an alarm accessible to employees, and continuous surveillance coverage.

(d)Cash held for the payment of awards shall be maintained on an imprest basis in an amount sufficient to meet anticipated awards, and funds in excess of that amount shall be transferred to secure storage.

(e)The counting of proceeds from covered devices shall be performed in a designated area not accessible to the public, by not fewer than two individuals, and shall produce a record signed by each of them.

(f)A covered operator shall collect proceeds from a covered device on a schedule stated in the written internal controls and not less often than monthly, and shall reconcile the amount collected against the monitoring system on the day of collection.

Basis: Pa. H.B. 2557, § 5309 (2026); 25 C.F.R. §§ 543.17, 543.18.

§ 405Anti-money laundering

(a)A covered operator shall maintain a written program reasonably designed to prevent the use of covered products to launder money or to evade a reporting requirement, proportionate to the volume and the cash intensity of its operations.

(b)The program shall provide for:

(1)identification of a player who commits or redeems an aggregate exceeding three thousand dollars in a gaming day at covered devices the operator offers;

(2)aggregation of transactions across covered devices and host locations under common operation, where the monitoring system permits it;

(3)detection and reporting of structuring, including redemption in amounts calculated to remain below a reporting threshold;

(4)reporting to the authority designated by applicable law; and

(5)retention of records for five years.

(c)A covered operator shall not permit a player to redeem a ticket or voucher issued by a covered device other than at a redemption point associated with the host location at which the device is placed, except through a process stated in the written internal controls that records the identity of the redeeming person.

Basis: 31 C.F.R. pt. 1021.

§ 406Surveillance and incident response

(a)A host location shall maintain surveillance coverage of the area in which covered devices are placed, of the redemption point, and of the area in which proceeds are counted, and shall retain recordings for not less than thirty days.

(b)A covered operator shall maintain the ability to disable a covered device remotely and shall disable a device upon becoming aware of:

(1)a failure of a control required by this standard or by SBCGS-T;

(2)a variance under § 207(e) that is not resolved within two business days;

(3)evidence of tampering; or

(4)a direction from a regulatory authority.

(c)A covered operator shall investigate each incident described in subsection (b), shall document the investigation, and shall report under § 603.

§ 501Application

(a)This Part applies where a charitable representation is made as to a covered product, as determined under SBCGS-C § 107(b).

(b)Where no charitable representation is made, this Part does not apply, and § 304(f)(4) prohibits the representation.

(c)A covered operator, a licensed organization, and a host location are each responsible for the requirements of this Part allocated to it by § 202(d), and the licensed organization is responsible for each requirement in this Part in full.

§ 502Charitable yield

(a)A licensed organization shall compute charitable yield in accordance with SBCGS-C § 107(d) for each calendar quarter, for the covered products offered under its authority or in its name.

(b)The computation shall state, for the quarter:

(1)the amount committed;

(2)the value of awards to players;

(3)gross gaming revenue;

(4)each amount deducted from gross gaming revenue, identified by recipient and by category, including amounts to the covered operator, the distributor, the manufacturer, the host location, and each affiliate of any of them, amounts applied to devices and to communications and monitoring, taxes and fees, and the general operating costs of the organization;

(5)the amount applied to a charitable purpose, identified by beneficiary; and

(6)charitable yield expressed as a percentage of gross gaming revenue.

(c)The computation shall additionally state any measure of charitable share that applicable law requires, computed as that law requires, presented alongside charitable yield and separately labelled.

(d)Floor. Where a charitable representation is made, charitable yield shall be not less than twenty five percent for the four most recent completed quarters taken together.

(e)Where charitable yield falls below the floor in subsection (d), the licensed organization shall, within sixty days, either bring yield above the floor or withdraw every charitable representation as to the covered product and notify the covered operator and the host location to do the same.

(f)A covered operator shall provide to the licensed organization, within twenty days after the end of each quarter, every figure within subsection (b) that lies within the operator's records, in a form permitting the organization to perform the computation.

§ 503Disclosure of charitable yield

(a)A covered operator shall display on the covered device, in the manner required by § 304(a):

(1)the name of the licensed organization and of each beneficiary;

(2)the charitable yield for the four most recent completed quarters, expressed as a percentage and stated to one decimal place; and

(3)the statement that of each dollar committed by players, a stated amount was applied to a charitable purpose, computed from charitable yield and gross gaming revenue for the same period and stated in cents.

(b)The disclosure shall be updated within thirty days after the computation under § 502 is completed for a quarter.

(c)Where charitable yield has not yet been computed for four completed quarters, the disclosure shall state the period for which it has been computed, and shall state that a full period is not yet available.

(d)A licensed organization shall make available, on request and at no charge, the computation under § 502(b) for each of the eight most recent completed quarters.

§ 504Allocation agreements

(a)The allocation of proceeds from a covered product among a covered operator, a distributor, a host location, and a licensed organization shall be stated in a written agreement executed before the first covered device is placed.

(b)The agreement shall state:

(1)each party and each affiliate of a party that receives value under it;

(2)the basis on which each amount is computed, expressed as a percentage of gross gaming revenue or as a stated sum, and not by reference to a measure computed after undisclosed deductions;

(3)every charge to be borne by the licensed organization, including device lease, service, communications, monitoring, and financing;

(4)the term, and the right of the licensed organization to terminate on notice of not more than ninety days where charitable yield falls below the floor in § 502(d); and

(5)the obligation of the covered operator under § 502(f).

(c)A licensed organization shall not enter an agreement under which the amount it receives is determined by a party's discretion, or is stated only after deductions that the agreement does not enumerate.

(d)A covered operator shall provide the agreement to a regulatory authority and to an assessor on request, and shall not designate its terms confidential as against either.

§ 505Expenses and related party transactions

(a)An amount charged to a covered product shall be reasonable in relation to the value of the goods or services supplied, and shall be supported by an invoice or equivalent record identifying the supplier and the basis of the charge.

(b)A licensed organization shall not, and a covered operator shall not cause a licensed organization to, pay an amount to a person who is an officer, director, employee, or member of the organization, or to an affiliate of such a person, in connection with a covered product, except:

(1)compensation for services actually rendered, at a rate not exceeding the rate that would be paid to an unrelated person, approved in advance by the governing body of the organization with the interested person abstaining; and

(2)reimbursement of a documented expense.

(c)A licensed organization shall maintain a register of transactions within subsection (b) and shall report the register under § 602.

(d)A covered operator shall disclose to a licensed organization, before the agreement under § 504 is executed, every relationship between the operator or an affiliate and any officer, director, employee, or member of the organization.

§ 506Use of proceeds and beneficiary reporting

(a)A licensed organization shall apply amounts within SBCGS-C § 107(d)(1) to a charitable purpose within twelve months after the end of the quarter in which they arose, or shall hold them in the account required by § 206(e) subject to a written plan stating the purpose and the date of application.

(b)A licensed organization shall maintain a record of each disbursement, stating the beneficiary, the amount, the date, and the purpose.

(c)A licensed organization shall not apply amounts within SBCGS-C § 107(d)(1) to:

(1)a payment to a covered operator, a distributor, a manufacturer, a host location, or an affiliate of any of them;

(2)a cost of acquiring, leasing, servicing, monitoring, or financing a covered device; or

(3)a political contribution, or a payment to a person for the purpose of influencing legislation or regulation relating to covered products.

(d)A licensed organization shall report annually under § 602 the total applied to a charitable purpose, the beneficiaries, and the charitable yield for each quarter of the year.

§ 601Records

(a)A covered operator shall create and retain records sufficient to reconstruct, for each covered device:

(1)each play, including the date, time, amount committed, outcome, value returned, and whether a skill element was available and whether it was engaged to completion;

(2)each session, including its start, its end, and the net position at its end;

(3)each commitment of consideration rejected by a control required by this standard, and the control that caused the rejection;

(4)each award and each redemption;

(5)each collection of proceeds and each reconciliation under § 207(e); and

(6)each change within § 207(d), and each certification under § 208.

(b)A licensed organization shall create and retain records sufficient to reconstruct each computation under § 502(b), each disbursement under § 506(b), each agreement under § 504, and each transaction under § 505(b).

(c)A record required by this section shall be retained for not less than five years, in a form that permits it to be produced in a machine readable format on request.

(d)A record shall be maintained so that it cannot be altered without the alteration being detectable, and each alteration shall record the individual who made it and the reason.

Basis: 25 C.F.R. § 543.23; Minn. R. 7864.0235.

§ 602Periodic reporting

(a)A covered operator shall report quarterly, to each licensed organization for whose benefit it offers a covered product and to a regulatory authority where one requires it:

(1)the amount committed, the value of awards, and gross gaming revenue, by covered device and in total;

(2)the actual return to player for each covered product, compared with the theoretical return disclosed under § 304(b)(4);

(3)for each skill-represented product, the skill realization rate for the period and the cumulative rate for the current measurement period under SBCGS-C § 106(f);

(4)the number of enrollments in the exclusion program, the number of attempted plays blocked by an exclusion, and the number of sessions in which enforcement was not possible under § 301(e);

(5)the number of sessions in which a limit under § 302 caused a rejection;

(6)the complaint register under § 306(e);

(7)the problem gambling funding paid under § 305(b) and the recipient; and

(8)the number of sessions conducted under § 401(d).

(b)A covered operator shall report annually the placement data required by § 402(d).

(c)A licensed organization shall report quarterly the computation under § 502(b) and annually the information required by § 506(d) and the register required by § 505(c).

(d)A report under this section shall be retained for five years and shall be produced to an assessor on request.

§ 603Incident reporting

(a)A covered operator shall report each of the following to a regulatory authority where one requires it, to each affected licensed organization, and to its own governing body, within seventy two hours of becoming aware of it:

(1)a failure of a control required by this standard or by SBCGS-T affecting more than one covered device or persisting for more than twenty four hours;

(2)an unauthorized change within § 207(d);

(3)evidence of tampering with a covered device or with the monitoring system;

(4)a variance under § 207(e) exceeding one thousand dollars or not resolved within five business days;

(5)an instance in which a person below twenty one years of age played a covered device;

(6)an instance in which an excluded person played a covered device;

(7)unauthorized access to player data or to exclusion data; and

(8)a determination that a covered product has become a nominal skill product.

(b)The report shall state what occurred, when, which covered devices and which players were affected, what has been done, and what will be done.

§ 604Audit

(a)A covered operator and a licensed organization shall each maintain an internal audit function, or engage an independent person to perform one, that tests conformity with each section of this standard applicable to it at least annually.

(b)A covered operator with gross gaming revenue from covered products exceeding five million dollars in a calendar year shall obtain, for that year, an examination by an independent public accountant of:

(1)the reconciliation of covered device records to the monitoring system;

(2)the computation of gross gaming revenue;

(3)the segregation of funds under § 206; and

(4)the computation of charitable yield under § 502, where Part 500 applies.

(c)A licensed organization shall obtain annually, from an independent person, a report on the computation under § 502(b) and on conformity with §§ 504 through 506.

(d)An audit report under this section shall be provided to the governing body of the person audited, retained for five years, and produced to an assessor and to a regulatory authority on request.

(e)A person audited shall document, for each finding, the remedial action taken and the date, and shall report unremediated findings in the next report under § 602.

§ 701Assessors

(a)An assessment of conformity with this standard shall be performed by a person that:

(1)is independent of the person assessed, of every affiliate of that person, and of every manufacturer of a covered device used by that person;

(2)has not, within the preceding two years, provided to the person assessed a service relating to the design, operation, or promotion of a covered product;

(3)is not compensated by reference to the outcome of the assessment; and

(4)employs individuals with demonstrated competence in gaming device technical standards, in gaming internal controls, and in the accounting of charitable gaming proceeds.

(b)An assessor shall retain its working papers for five years and shall produce them to a regulatory authority on request.

§ 702Assessment

(a)An assessment shall cover each section of this standard applicable to the person assessed, and shall state for each section whether the person conforms, does not conform, or conforms subject to an identified deficiency.

(b)An assessment shall include:

(1)examination of the written internal controls against the requirements of this standard;

(2)testing of the operation of controls at a sample of covered devices and host locations sufficient to support the conclusion, with the sample and its basis stated;

(3)examination of each certification obtained under § 208;

(4)recomputation of charitable yield for at least one quarter, where Part 500 applies; and

(5)inspection of the classification record required by SBCGS-C § 108, and verification that it has been reviewed as required by SBCGS-C § 109.

(c)An assessment shall be performed before a person first represents conformity with this standard, and annually thereafter.

§ 703Certification

(a)A person may represent that it conforms to this standard only where an assessment under § 702 states that it conforms, or that it conforms subject to identified deficiencies each of which has been remediated.

(b)A representation of conformity shall identify the version of this standard, the assessor, the date of the assessment, the covered products and the jurisdictions covered by it, and any section as to which conformity was not assessed.

(c)A representation of conformity is not a representation that a covered product is lawful, and shall not be presented as one.

(d)A person shall withdraw a representation of conformity within thirty days of becoming aware that it no longer conforms, and shall notify each licensed organization and each host location with which it deals.

§ 704Enforcement by an adopting authority

(a)An authority adopting this standard may provide for:

(1)the disabling of a covered device that does not conform;

(2)a civil penalty for each violation and for each day a violation continues;

(3)an order to cease conduct or to implement a control;

(4)suspension or revocation of an authorization to offer a covered product; and

(5)the withdrawal of a representation of conformity.

(b)This standard states requirements. It does not itself create a private right of action, and an adopting authority determines what remedies attach.