N.J. Admin. Code § 13:69D-1.11

Current through Register Vol. 56, No. 21, November 4, 2024

Section 13:69D-1.11 - Casino licensee's organization

(a) Each casino licensee's system of internal controls shall include tables of organization. Each casino licensee shall be permitted, except as otherwise provided in this section and N.J.A.C. 13:69K-1.4, to tailor its organizational structure to meet its own needs, policies or management philosophy. The proposed organizational structure of each casino licensee may be implemented upon the filing of the system of internal controls and shall comply with the criteria listed below, which criteria are designed to maintain the integrity of all casino operations. Each casino licensee's tables of organization shall provide for:

1. A system of personnel and chain of command which permits management and supervisory personnel to be held accountable for actions or omissions within their areas of responsibility;

2. The segregation of incompatible functions so that no employee is in a position both to commit an error or to perpetrate a fraud and to conceal the error or fraud in the normal course of his or her duties;

3. Primary and secondary supervisory positions which permit the authorization or supervision of necessary transactions at all relevant times; and

4. Areas of responsibility which are not so extensive as to be impractical for one person to monitor.

(b) In addition to satisfying the requirements at (a) above, each casino licensee's system of internal controls shall include, at a minimum, the following departments and supervisory positions. Each of the departments and supervisors required or authorized by this section (a "mandatory" department or supervisor) shall cooperate with, yet perform independently of, all other mandatory departments and supervisors of the casino licensee. Mandatory departments and supervisory positions are as follows:

1. A surveillance department supervised by a person referred to in this section as the director of surveillance. The director of surveillance shall be subject to the reporting requirements specified in (c) below. The surveillance department monitoring room shall be supervised by a casino key employee who shall be present in the room at all times or, if not present, be within immediate contact and at a known location on the premises. The surveillance department shall be responsible for, without limitation, the following:

i. The clandestine surveillance of the operation and conduct of the table games and bill changers;

ii. The clandestine surveillance of the operation of the slot machines and bill changers;

iii. The clandestine surveillance of the operation of the casino simulcasting and sports wagering lounge facilities;

iv. The clandestine surveillance of the operation of automated coupon redemption machines, automated gaming voucher machines and automated jackpot payout machines;

v. The clandestine surveillance of the operation of the cashiers' cage and satellite cages;

vi. The audio-video recording of activities in the count rooms;

vii. The detection of cheating, theft, embezzlement, and other illegal activities in the casino, casino simulcasting facility, count rooms, slot booths, and cashiers' cage;

viii. The detection of the presence in the establishment of any person who is required to be excluded pursuant to 5:12-71 or N.J.A.C. 13:69G-1.7, who is self-excluded pursuant to 5:12-71.2, or who may be excluded or ejected pursuant to 5:12-71.1, or of any person who is prohibited from entering a casino or a casino simulcasting facility pursuant to N.J.S.A. 5:12-119a;

ix. The video recording of illegal and unusual activities monitored;

x. Providing timely notification to appropriate supervisors and the Division upon detecting, and also upon commencing video or audio recording of, any person who is engaging in or attempting to engage in, or who is reasonably suspected of cheating, theft, embezzlement, or other illegal activities, including those activities prohibited in Article 9 of the Act;

xi. Providing timely notification to appropriate supervisors and Division upon detecting, and also upon commencing video or audio recording of, any person who is required to be excluded pursuant to 5:12-71, 5:12-71.2 or N.J.A.C. 13:69G-1.7, or who may be excluded or ejected pursuant to 5:12-71.1, or any person who is prohibited from entering a casino or a casino simulcasting facility pursuant to 5:12-119(a);

xii. The communication in writing to the supervisor of the credit department of accurate and verifiable information which may be relevant in determining a patron's credit worthiness;

xiii. The clandestine surveillance of all keno gaming and operations on the casino floor and in the casino simulcasting facility and of any keno booths and satellite keno booths located in public keno areas;

xiv. The clandestine surveillance of equipment used in conjunction with the operation of an electronic account based wagering system pursuant to 13:69E-1.37A and a gaming voucher system pursuant to N.J.A.C. 13:69E-1.55;

xv. The clandestine surveillance of the operation of computer monitoring rooms for multi-casino progressive slot systems;

xvi. The installation, maintenance and repair of CCTV system equipment used by the surveillance department;

xvii. CCTV system access to the Division, to the monitoring room and, if applicable, other locations approved by the Division;

xviii. Any certification required in conjunction with a relocation or reconfiguration of the casino floor to the effect that the responsibilities set forth in (b)1i through xvii above continue to be met; and

xix. The maintenance of a current surveillance submission, as a condition to the commencement and continuation of gaming operations, detailing minimum standards and the manner in which the responsibilities set forth in (b)1i through xvii above shall be met, such submission and any amendments thereto to be approved by the Division upon a determination that it conforms to the requirements of the Act and provides adequate and effective controls over the operations of the surveillance department;

2. An internal audit department, which may perform functions and fulfill responsibilities for multiple but affiliated casino licensees, supervised by a person, who shall be located in New Jersey, referred to in this section as an audit department executive. The audit department executive shall be subject to the reporting requirements specified in (c) below. The internal audit department shall be responsible for, without limitation, the following:

i. The review and appraisal of the adequacy of internal control;

ii. The compliance with internal control procedures;

iii. The reporting to the Division of instances of noncompliance with the system of internal control;

iv. The reporting to the Division of any material weaknesses in the system of internal control; and

v. The recommendation of procedures to eliminate any material weaknesses in the system of internal control.

3. An information security officer (ISO) responsible for compliance with all IT security related regulations and statutes and licensed as a casino key employee. The ISO may be employed by the casino licensee, or alternatively, by a qualified holding or intermediary company of the casino licensee. The ISO shall report to the audit committee of the board of directors unless otherwise approved by the Division. The ISO shall:

i. Serve as the primary liaison to executive management and the Division for all matters regarding all aspects of information security;

ii. Have responsibility for all aspects of the licensee's investigation and response to IT security related incidents. The ISO shall immediately inform the Division and executive management, including the IT Director, about all incidents concerning:

(1) Unauthorized access to, or disclosure of, critical data or confidential patron data;

(2) Unauthorized system modification by a third party;

(3) Unauthorized destruction of regulated IT assets or data; and

(4) Any attack that compromises the availability or operation of any controlled computer system;

iii. Establish policies and procedures for monitoring employee access and ensuring deactivation of accounts assigned to terminated or suspended employees;

iv. Coordinate the development of a business continuity plan with all of the licensee's business units, continually review the plan to ensure it remains current and compliant with National Institute of Standards and Technology (NIST) standards, and review the results of any test of the plan to ensure it is properly executed;

v. Approve the scope and review the results of any vulnerability scans and penetration tests. Review and approve resulting corrective action plans;

vi. Develop, document, audit, and enforce an information security plan consisting of policies, guidelines, standards, processes, and procedures in accordance with NIST standards. The ISO shall be responsible for continual evaluation of all areas of the plan described by this subsection in order to ensure the plan is responsive to new security threats, laws, or regulations. These areas include:

(1) Risk management. The ISO shall create a risk management framework for all IT systems. In developing this framework, the ISO shall:

(A) Utilize quantitative and qualitative based analysis to identify and rank all IT systems based upon risk;

(B) Document the criteria used to determine risk for each system; and

(C) Establish minimum security standards for all systems based upon risk;

(2) Personnel. The ISO shall be responsible for the:

(A) Evaluation of the licensee's IT staffing levels and recommend any changes needed to ensure protection of the IT infrastructure;

(B) Creation of a standard for the proper segregation of IT job duties, including appropriate levels of account privileges;

(C) Evaluation of compliance with IT job segregation standards; and

(D) Development of IT security training for employees;

(3) Systems and data. The ISO shall ensure the information security plan addresses:

(A) Protection of confidential patron data from unauthorized access;

(B) Creation of required logs, with controls to prevent unauthorized modification; and

(C) Existence of proper controls and documentation for changes and updates and patches to IT systems.

4. An IT department comprised of at a minimum an IT department manager, and, if the licensee offers Internet and mobile gaming, an Internet and mobile games manager, all of whom shall be located in New Jersey and licensed as a casino key employee.

i. The IT department manager shall be responsible for all data, as well as the quality, reliability, and accuracy of all computer systems and software used by the casino licensee in accordance with the framework established by the information security officer. This shall apply to the conduct of casino, sports pool, and casino simulcasting facility operations, whether such data and software are located within or outside the casino hotel facility, including, without limitation, specification of appropriate computer software, hardware, and procedures for security, physical integrity, audit, and maintenance of:

(1) Access codes and other computer security controls used to insure appropriately limited access to computer software and data;

(2) Monitoring logs of user access, security incidents and unusual transactions;

(3) Logs used to document and maintain the details of any hardware and software modifications;

(4) Computer tapes, disks, or other electronic storage media containing data relevant to casino operations; and

(5) Computer hardware, communications equipment and software used in the conduct of casino operations;

ii. The Internet and/or mobile gaming manager shall report to the IT department manager, or other department manager as approved by the Division, and be responsible for ensuring the proper operation and integrity of Internet and/or mobile gaming and online sports pools and reviewing all reports of suspicious behavior;

5. A casino games department supervised by a person referred to in this section as a casino manager. The casino games department shall be responsible for the operation and conduct of all authorized games and bill changers in a casino and casino simulcasting facility. A casino licensee may choose, in its discretion, to:

i. Operate and conduct the game of poker separately from all other casino games, in which event the operation and conduct of poker shall be supervised by a casino key employee;

ii. Make the casino games department responsible for the operation and conduct of the simulcast counter;

iii. Make the casino games department responsible for the supervision of slot cashiers in accordance with the provisions of (e) below provided that the casino licensee does not establish an independent slot department pursuant to (b)4v below;

iv. Make the casino games department responsible for the supervision of changepersons;

v. Establish an independent slot department that:

(1) Shall be supervised by a person referred to herein as a slot department manager;

(2) Shall be responsible for the operation of all slot machines and bill changers;

(3) May be responsible for the supervision of slot cashiers in accordance with the provisions of (e) below;

(4) May be responsible for the supervision of changepersons;

(5) May be responsible for the operation and conduct of the game of keno; and

(6) May be responsible for the operation and conduct of the simulcast counter; or

vi. Establish an independent keno department that:

(1) Shall be supervised by a person referred to herein as a keno manager;

(2) Shall be responsible for the operation and conduct of the game of keno; and

(3) May be responsible for the operation and conduct of either the simulcast counter or an independent slot machine cage department established pursuant to (b)7ii below, but not both;

6. A security department supervised by a person referred to in this section as a director of security. The security department shall be responsible for the overall security of the establishment including, without limitation, the following:

i. The enforcement of the law;

ii. The physical safety of patrons in the establishment;

iii. The physical safety of personnel employed by the establishment;

iv. The physical safeguarding of assets transported to and from the casino, casino simulcasting facility, slot, and cashiers' cage departments, and the immediate notification to the Division of any incident that has compromised the safeguarding of such assets;

v. The protection of the patrons' and the establishment's property from illegal activities;

vi. The detainment, for a reasonable period of time, of each individual as to whom there is probable cause to believe has engaged in or is engaging in conduct that violates 5:12-113 through 116, inclusive, 5:12-119 as it relates to underage gambling, or 33:1-81 pursuant to section 103d of P.L. 1977, c. 110 (5:12-103), for the purpose of notifying law enforcement or Division authorities;

vii. The control and maintenance of a system for the issuance of temporary credentials and vendor access credentials;

viii. The recordation of any and all unusual occurrences within the casino, sports wagering lounge, and casino simulcasting facility for which the assignment of a security department employee is made. Each incident, without regard to materiality, shall be assigned a sequential number and shall be recorded in an unalterable format, which shall include:

(1) The assignment number;

(2) The date;

(3) The time;

(4) The nature of the incident;

(5) The person involved in the incident; and

(6) The security department employee assigned;

ix. The communication in writing to the supervisor of the credit department of accurate and verifiable information which may be relevant in determining a patron's credit worthiness;

x. The identification and removal of any person who is required to be excluded pursuant to N.J. S.A. 5:12-71 and 5:12-71.2 or N.J.A.C. 13:69G-1.7, or who may be excluded or ejected pursuant to N.J.S.A. 5:12-71.1, or of any person, other than those who are to be detained pursuant to (b)5vi above, who is prohibited from entering a casino, a sports wagering lounge, or a casino simulcasting facility pursuant to N.J.S.A. 5:12-119.a; and

xi. The performance of all duties and responsibilities in accordance with the procedures and controls pursuant to N.J.A.C. 13:69D-1.3(a)3;

7. A casino accounting department supervised by a person referred to in this section as a controller. The controller shall be responsible for all casino, sports wagering lounge, and casino simulcasting facility accounting control functions including, without limitation, the preparation and control of records and data, the control of stored data, the control of unused forms, the accounting for, and comparison of, operational data and forms, and the control and supervision of the cashiers' cage, any satellite cages, the soft count room, and the hard count room. The soft count room and hard count room shall each be supervised by a casino key employee, who shall be responsible for the supervision of the soft count or hard count in accordance with N.J.A.C. 13:69D-1.33 and 1.43, respectively. A casino licensee that operates more than one casino room within its casino hotel facility may be required to maintain a separate main cage in each casino room. A casino key employee referred to in this chapter as a cage manager shall supervise the main cage and any satellite cages within the casino room. The cage manager shall report to the controller and shall be responsible for the control and supervision of cage and slot cashiers, casino clerks, and the cage functions set forth in N.J.A. C. 13:69D-1.14 and 1.15. If a casino licensee elects to operate one or more satellite cages, each satellite cage shall be supervised by a casino cage supervisor who shall report to a cage manager. A casino licensee may choose, in its discretion, as to each cashier's cage in its casino hotel facility, to:

i. Separate the cashiers' cage into independent operations for table games and slot machines. If a casino licensee elects to operate a separate table games cage and slot machine cage:

(1) The provisions of 13:69D-1.14(i) shall not apply (that is, the casino licensee shall be required to have a master coin bank);

(2) Each independent cage operation shall be supervised by a cage manager and each cage manager shall report to the controller;

(3) The cage manager for the independent slot machine cage shall be responsible for the supervision of the master coin bank, slot cashiers and coin impressment personnel; and

(4) The cage manager for the independent table games cage shall be responsible for all cashiers' cage functions not included in (b)6i(3) above;

ii. Operate an independent slot machine cage as a separate department. If an independent slot machine cage is operated as a separate department:

(1) The slot machine cage department shall comply with the provisions of (b)6i(1) and (3) above;

(2) The cage manager of the slot machine cage department shall report to a casino key employee;

(3) The slot machine cage department may be responsible for the supervision of changepersons; and

(4) The slot machine cage department may be responsible for the operation and conduct of either the simulcast counter or the game of keno, but not both;

iii. The Internet and/or mobile gaming manager shall report to the IT department manager, or other department manager as approved by the Division, and be responsible for ensuring the proper operation and integrity of Internet and/or mobile gaming and reviewing all reports of suspicious behavior;

iv. Make the casino accounting department responsible for the operation and conduct of the simulcast counter. An entity operating a sports wagering lounge on behalf of a casino or race track shall have an accounting department supervised by a casino key employee that shall be responsible for the accounting control functions enumerated in this subsection as approved by the Division; and

8. An independent sports pool department for the sports lounge that shall be supervised by a casino key employee referred to in this section as a sports lounge manager who:

i. Shall be responsible for the operation and conduct of the sports wagering lounge;

ii. May be responsible for the operation and conduct of the simulcast counter; and

iii. Shall ensure at least one key employee is present in the sports lounge whenever sports pool wagering is conducted.

(c) The supervisors of the surveillance and internal audit departments required by (b) above shall comply with the following reporting requirements:

1. Each supervisor shall report directly to the chief gaming executive of the casino licensee regarding administrative matters and daily operations; provided, however, a casino licensee may allow each of these supervisors to report directly to a management executive of the licensee other than the chief gaming executive if that executive reports directly to the chief gaming executive.

2. Each supervisor shall report directly to one of the following persons or entities regarding matters of policy, purpose, responsibility, and authority. The hiring, termination, and salary of each supervisor shall also be controlled by one of the following persons or entities:

i. The independent audit committee of the casino licensee's board of directors;

ii. The independent audit committee of the board of directors of any holding company of the casino licensee which has absolute authority to direct the operations of the casino licensee;

iii. The senior surveillance or internal audit executive of any holding company included in (c)2ii above if such executive reports directly to the independent audit committee of the board of directors of the holding company; or

iv. For casino licensees or holding companies which are not corporate entities, the non-corporate equivalent of any of the persons or entities listed in (c)2i through iii above.

3. For purposes of this subsection, the independent audit committee shall be comprised of three or more members; provided, however, that the independent audit committee may be comprised of less than three members upon a showing of good cause to the Division.

4. Each applicant for a casino license shall prepare a charter for its independent audit committee, which complies with the Act and all rules promulgated thereunder. Such charter shall be submitted to the Division for approval at least 30 days before gaming operations are to commence, unless otherwise directed by the Division. Casino licensees must notify the Division of any material change to the charter not less than five days in advance of implementing any such change. The initial submission of the independent audit committee charter and notices concerning material changes shall be addressed to the Intake Unit, attention Casino Licensing Bureau, of the Division at its address set forth in N.J.A.C. 13:69-3.5(a) or submitted electronically to entitydocs@njdge.org.

(d) The casino licensee's personnel shall be trained in all internal and accounting control practices and procedures relevant to each employee's individual function.

(e) A casino licensee may choose to make the slot department responsible for the supervision of slot cashiers provided the casino licensee complies with either of the provisions below:

1. A slot cashier shall be prohibited from participating in any transaction that involves the acceptance, issuance, recordation or accounting of assets that affect the determination of gross revenue; or

2. Slot department operations shall be conducted as follows:

i. The casino licensee shall utilize a computerized slot monitoring system that, at a minimum, automatically records the slot machine asset number, date, time, and dollar amount whenever a hand-paid jackpot or hopper fill takes place;

ii. Each slot machine on the casino floor shall be connected electronically to the computerized slot monitoring system and each jackpot payout slip and hopper fill slip shall be computer generated pursuant to 13:69D-1.40 and 1.41, respectively;

iii. The security features of the computerized slot monitoring system shall, at a minimum, prohibit the deletion, creation or modification of any information required by (e)2i above, unless a permanent record is created that sets forth:

(1) The original information;

(2) Any modification to the original information;

(3) The identity of the employee making the modification; and

(4) If applicable, the identity of each employee authorizing the modification;

iv. The computerized slot monitoring system shall be capable of generating a daily report that contains, at a minimum, the information required by (e)2i and iii above, which report shall be used by the casino accounting department to verify the number and dollar amount of hand-paid jackpots and hopper fills and shall only be available to the casino accounting department until such verifications have been completed;

v. Any modification of $ 100.00 or more to the original amount recorded on a computerized jackpot payout slip or hopper fill slip shall be authorized by two employees of the department that is responsible for the operation of the casino licensee's slot machines and bill changers, and at least one of the two employees shall be in a position of equal or greater authority than the individual who initially requested the jackpot payout slip or hopper fill;

vi. The master coin bank and coin impressment personnel of the casino licensee shall be supervised by the casino accounting department; and

vii. The internal controls of the casino licensee shall specify the manner in which the department that is responsible for the operation of the casino licensee's slot machines and bill changers shall interact with the computerized slot monitoring system including, without limitation, access to system menus, the establishment of slot machine profile parameters, and the ability of the department to access, delete, create or modify information contained in the slot monitoring system.

(f) A casino licensee may designate and assign more than one person to serve jointly as the manager of a department within the licensed facility. Each person serving as a joint manager of a department within the licensed facility shall be individually and jointly accountable and responsible for the operations of that department.

(g) Each department required or permitted by this section shall be supervised at all times by at least one casino key employee.

(h) In the event of a vacancy in the chief executive officer position, the chief gaming executive position required by N.J.A.C. 13:69D-1.1, the equal opportunity officer position required by N.J.A.C. 13:69K-1.4 or in any department supervisor position required or permitted by this section:

1. The casino licensee shall notify the Division no later than five days from the date of the vacancy. Such notice shall be in writing and shall indicate, without limitation, the following information:

i. The vacant position;

ii. The date on which the position became vacant; and

iii. The date on which it is anticipated that the vacancy will be filled on a permanent basis;

2. The casino licensee shall designate a person to assume the duties and responsibilities of the vacant position no later than 30 days from the date of vacancy. Such person may assume the duties and responsibilities of the vacant position on a temporary basis, provided that:

i. Such person does not function as the department supervisor for any department required by this section;

ii. Such person's areas of responsibility will not be so extensive as to be impractical for one person to monitor;

iii. The chief executive officer or the chief legal officer of the licensee shall assume the responsibilities of the equal opportunity officer until such position is filled on a permanent basis; and

iv. Such position shall be filled on a permanent basis within 120 days of the original date of vacancy;

3. Within five days of filling any vacancy pursuant to (h)2 above, the casino licensee shall notify the Division thereof. Such notices shall be in writing and shall indicate, without limitation, the following:

i. The position;

ii. The name of the person designated;

iii. The date that the vacancy was filled; and

iv. An indication of whether the position has been filled on a temporary or permanent basis; and

4. All notices required by this subsection shall be directed to the Division.

N.J. Admin. Code § 13:69D-1.11

Amended by 46 N.J.R. 1817(c), effective 8/18/2014.

Amended by 50 N.J.R. 215(a), effective 1/2/2018

Amended by 50 N.J.R. 617(a), effective 1/16/2018

Amended by 50 N.J.R. 1652(a), effective 7/16/2018

Amended by 51 N.J.R. 1514(b), effective 10/7/2019

Amended by 56 N.J.R. 1182(b), effective 7/1/2024