11 Va. Admin. Code § 5-90-130

Current through Register Vol. 41, No. 8, December 2, 2024

Section 11VAC5-90-130 - On-premises mobile casino gaming

A. A facility operator may offer to its players at the facility on-premises mobile casino gaming.

B. The on-premises mobile casino gaming permitted by under this section shall be subject to the provisions of and may be preempted and superseded by any applicable federal law.

C. A facility operator shall locate its primary on-premises mobile casino gaming operation, including facilities, equipment, and personnel who are directly engaged in the conduct of the gaming, within a restricted area of the facility.

D. Backup equipment used on a temporary basis may be located off-site with the approval of the department.

E. The area in a facility used to conduct and support on-premises mobile casino gaming shall:

1. Be arranged in a manner promoting optimum security;

2. Be incorporated into the surveillance system installed in the rest of the facility;

3. Meet the standards set by 11VAC5-90-120, with department staff allowed access to both the system and the signal of the operation;

4. Be designed to permit the department to monitor the mobile gaming operations; and

5. Comply in all respects with the casino gaming law, this chapter, and any department policy or directives.

F. A facility operator shall ensure that only people physically on-premises at the facility are able to place wagers through the facility operator's mobile casino gaming platform, by establishing systems and practices that provide that:

1. All wagers on casino games authorized by the gaming law, this chapter, or any other law, regulation, or condition of the department related to casino gaming shall be initiated, received, and otherwise made on the premises of the facility;

2. Before a facility operator begins its mobile gaming operations, all equipment and software used in conjunction with its operation shall be submitted to an independent testing laboratory approved by the director;

3. A mobile casino gaming platform submitted to an approved independent testing laboratory shall contain:

a. A complete, comprehensive, technically accurate description and explanation of the mobile casino gaming platform;

b. Detailed operating procedures of the mobile casino gaming platform;

c. A description of the risk management framework, including:

(1) User access controls for all facility operator personnel;

(2) Information regarding segregation of duties;

(3) Information regarding automated risk-management procedures;

(4) Information regarding identifying and reporting fraud and suspicious activity;

(5) Controls for ensuring regulatory compliance;

(6) A description of anti-money laundering compliance standards;

(7) A description of all software applications that comprise the system;

(8) A description of all types of wagers available to be offered by the system; and

(9) A description of all types of third-party systems proposed for utilization;

4. Upon request, a facility operator shall promptly provide the director with relevant reports and documentation that shall include, at a minimum:

a. Complete access to all wagers;

b. The ability to query or sort wagering data; and

c. The ability to export wagering data;

5. A facility operator or the supplier providing a facility operator's mobile casino gaming platform shall maintain all transactional wagering data for a period of five years;

6. The rules that apply to wagers placed on a mobile casino gaming platform shall be readily available to a player;

7. At least once every 24 hours, a mobile casino gaming platform shall perform an authentication process on all software used to offer, record, and process wagers to ensure there have been no unauthorized modifications. As part of this authentication process, the mobile casino gaming platform must be able to detect if any system component is determined to be invalid in the event of an authentication failure;

8. In the event of an authentication failure, the facility operator shall notify the director within 24 hours of the failure. The results of all authentication attempts shall be recorded by the mobile casino gaming platform and maintained for a period of 90 days;

9. A facility operator and a supplier providing a facility operator's mobile casino gaming platform shall grant the director access to wagering systems, transactions, and related data as deemed necessary and in the manner required by the director;

10. A mobile casino gaming platform shall provide a process for the director to query and export, in the format required by the director, all mobile casino gaming platform data; and

11. Additional system specifications may be specified by the director through the issuance of technical standards.

G. Geolocation systems.

1. A facility operator shall keep its geolocation systems up to date, including integrating current solutions in real time that can detect the use of remote desktop software, rootkits, virtualization, or any other programs identified by the director as having the ability to circumvent geolocation measures.

2. At least every 90 days, the integrity of the geolocation system shall be reviewed by the facility operator to ensure that the system detects and mitigates existing and emerging location fraud risks.

3. In order to prevent unauthorized placement of a wager by an individual on the premises of the facility, the mobile casino gaming platform must utilize a geofencing system to reasonably detect the physical location of an individual attempting to access the mobile casino gaming platform and place a wager and to monitor and block unauthorized attempts to place a wager when an individual is not within the permitted area inside the facility.

4. The geofencing system must ensure that an individual is located within the permitted area inside the facility when placing a wager and must be equipped to dynamically monitor the individual's location and block unauthorized attempts to place a wager when an individual is not within the permitted area inside the facility.

5. The director may issue additional geolocation requirements in the form of technical standards.

H. Player accounts and limitations.

1. A facility operator may offer on-premises mobile casino gaming only to an individual who has established an account and uses such account to place wagers as follows:

a. Any wager shall be placed directly with the facility operator by the account holder;

b. The facility operator shall verify the account holder's physical presence on site at the facility at the time of wagering;

c. The account holder shall provide the facility operator with the correct authentication information for access to the player account; and

d. A facility operator shall disable a player account after three failed login attempts and require multi-factor authentication to recover or reset a password or user name.

2. A facility operator may not allow a player to establish more than one user name or more than one player account per mobile casino gaming platform.

3. A facility operator shall take commercially and technologically reasonable measures to verify a player's identity and shall use such information to enforce the provisions of this section.

4. A facility operator shall implement procedures to terminate all accounts of any player who establishes or seeks to establish more than one user name or more than one account whether directly or by use of another individual as proxy; although such procedures may allow a player who establishes or seeks to establish more than one user name or more than one account to retain one account, provided that the facility operator investigates and makes a good faith determination that the player's conduct was not intended to commit fraud or otherwise evade the requirements of the gaming law, this chapter, or any other law, regulation, or condition of the department related to casino gaming.

5. A facility operator shall not allow a player to use a proxy server for the purpose of misrepresenting the player's location in order to engage in on-premises mobile casino gaming.

6. A facility operator shall take commercially and technologically reasonable measures to prevent one player from acting as a proxy for another, including use of geolocation technologies to prevent simultaneous logins to a single account from geographically inconsistent locations.

7. A facility operator may not accept a wager in an amount more than the funds on deposit in the player's account.

8. A mobile casino gaming platform shall employ a mechanism that can detect and prevent any player-initiated wagering or withdrawal activity that would result in a negative balance of a player account.

I. If an on-premises mobile casino gaming player account is inactive or dormant for five years:

1. The facility operator shall attempt to contact the account holder by mail, phone, and electronic mail;

2. If the account holder does not respond to the facility operator, the facility operator shall close the account; and

3. Any funds remaining in the account at the time of closing shall be paid 50% to the facility operator and 50% to the Commonwealth's general fund.

A facility operator shall ensure that account holders are made aware of the provisions of this subsection prior to opening a mobile gaming player account.

J. Responsible gaming.

1. In addition to the requirements for responsible casino gaming established in 11VAC5-90-100, a facility operator that offers on-premises casino gaming shall:

a. Cause the words "If you or someone you know has a gambling problem and wants help, call 1-800-GAMBLER," or other comparable language approved by the department, which shall include the words "gambling problem" and "call 1-800-GAMBLER," to be displayed prominently at log-on and log-off times to any person visiting or logged onto the on-premises mobile casino gaming; and

b. Prominently publish a responsible gambling logo in a manner approved by the director and shall direct a player to the facility operator's responsible gambling page;

c. Provide a mechanism by which an account holder may establish the following controls on wagering activity through the individual's player account:

(1) A limit on the amount of money deposited within a specified period of time and the length of time the account holder will be unable to participate in gaming if the holder reaches the established deposit limit; and

(2) A temporary suspension of gaming through the account for any number of hours or days.

2. A facility operator shall institute and prominently publish procedures for players to implement the restrictions provided in this subsection, including:

a. Opportunities to self-exclude from or to set deposit limits, to set limits on the player's total gaming activity, or to limit participation to wagers below an established limit;

b. Options to set pop-up warnings concerning mobile casino gaming activity: and

c. Options to implement limits and timeouts (e.g., cooling off periods of at least 72 hours), where players have the option to adjust self-imposed limits to make the limits more restrictive as often as the players like but shall not have the option to make limits less restrictive until the prior restriction has expired.

3. A facility operator shall not send gaming-related electronic mail to an account holder when the player has suspended the account for at least 72 hours.

4. A facility operator shall provide a mechanism by which an account holder may change these controls, but when the player's account is suspended, the account holder may not change gaming controls until the suspension expires.

5. During a period of suspension, an account holder shall have access to the account and be permitted to withdraw funds from the account.

K. A facility operator's website or mobile application shall contain, at a minimum, the following:

1. A clear statement of the facility operator's commitment to responsible gaming and problem gambling prevention;

2. A mechanism for a player to take note of the passage of time;

3. The ability to initiate a "cooling off" period such as breaks in play and avoidance of excessive play;

4. Practices and procedures on the site that do not reinforce myths and misconceptions about gambling;

5. Information about the website's terms and conditions is readily accessible;

6. Promotional or free games do not mislead players;

7. Notification to players of age-verification procedures;

8. Access to credit is prohibited;

9. Fund transfers and automatic deposits are prohibited or restricted; and

10. Games display credits and spending as cash.

L. At least 60 days before on-premises mobile casino gaming operations are to commence, a facility operator shall submit its internal controls for those operations to the department for review and written approval. The internal controls shall be integrated into the internal controls required by 11VAC5-90-110 and shall address, at a minimum:

1. Administrative controls;

2. Recordkeeping and record retention;

3. Accounting controls;

4. Segregation of functions, duties, and responsibilities;

5. Security;

6. Surveillance;

7. Reports; and

8. Such other subject matters that the department may require.

M. Gross receipts from on-premises mobile casino gaming shall be included in a facility operator's adjusted gross receipts and subject to taxation pursuant to the provisions of §§ 58.1-4124 and 58.1-4125 of the Code of Virginia.

N. Prohibited conduct.

1. The provisions of this subsection are in addition to any criminal proceeding that may be brought against a person for a violation of the prohibited conduct described in this subsection.

2. A person may not offer on-premises mobile casino gaming in violation of the casino gaming law, this chapter, or any other law, regulation, or condition of the department related to casino gaming.

3. A person may not knowingly tamper with software, computers, or other equipment used to conduct on-premises mobile casino gaming to alter the odds or the payout of a game or disable the game from operating according to the rules of the game as approved by the department.

4. The permit of an employee of a facility operator who violates subdivision 3 of this subsection shall be revoked and the employee shall be subject to such further penalty as the department deems appropriate.

5. The license of a facility operator that violates subdivision 3 of this subsection shall be suspended for a period determined by the department and the facility operator shall be subject to such further penalty as the department deems appropriate.

6. A person may not knowingly offer or allow to be offered any on-premises mobile casino game that has been tampered with in a way that affects the odds or the payout of a game or disables the game from operating according to the rules of the game as approved by the department.

7. The permit of an employee of the facility operator who violates subdivision 6 of this subsection shall be suspended for a period of at least 30 days.

8. The license of a facility operator that violates subdivision 6 of this subsection shall be suspended for a period of at least 30 days.

11 Va. Admin. Code § 5-90-130

Derived from Virginia Register Volume 37, Issue 16, eff. 3/11/2021; Amended, Virginia Register Volume 38, Issue 13, eff. 3/16/2022.

Statutory Authority: §§ 58.1-4101 and 58.1-4102 of the Code of Virginia.