Pennsylvania Consolidated & Unconsolidated Statutes
Chapter 13B - Interactive Gaming
Section 13B32 - Internal, administrative and accounting controls

(a) Submissions to board.--Notwithstanding any provision of this part, each slot machine licensee who holds or has applied for an interactive gaming certificate in accordance with this chapter shall submit a description of its system of internal procedures and administrative and accounting controls for interactive gaming to the board, including provisions that provide for real-time monitoring, recordation or storage of all interactive games and a description of any changes to its procedures and controls. The submission shall be made at least 90 days before interactive gaming is to commence or at least 90 days before any change in those procedures or controls is to take effect, unless otherwise directed by the board.
(b) Filing.--Notwithstanding subsection (a), the procedures and controls may be implemented by an interactive gaming certificate holder upon the filing of the procedures and controls with the board. Each procedure or control submission shall contain both narrative and diagrammatic representations of the system to be utilized and shall include but need not be limited to:
(1) Accounting controls, including the standardization of forms and definition of terms to be utilized in the interactive gaming operations.
(2) Procedures, forms and, where appropriate, formulas to govern the following:
(i) calculation of hold percentages;
(ii) revenue drops;
(iii) expense and overhead schedules;
(iv) complimentary services; and
(v) cash-equivalent transactions.
(3) Job descriptions and the system of personnel and chain of command, establishing a diversity of responsibility among employees engaged in interactive gaming operations, including employees of an interactive gaming operator, and identifying primary and secondary management and supervisory positions for areas of responsibility, salary structure and personnel practices.
(4) Procedures for the registration of players and establishment of interactive gaming accounts, including a procedure for authenticating the age, identity and physical address of an applicant for an interactive gaming account and whether the applicant is a person prohibited from establishing or maintaining an account under section 13B22 (relating to establishment of interactive gaming accounts).
(5) Procedures for terminating a registered player's interactive gaming account and the return of any funds remaining in the interactive gaming account to the registered player.
(6) Procedures for suspending or terminating a dormant interactive gaming account and the return of any funds remaining in the dormant interactive gaming account to the registered player.
(7) Procedures for the logging in and authentication of a registered player in order to enable the player to commence interactive gaming and the logging off of the registered player when the player has completed play, including a procedure to automatically log a registered player out of the player's interactive gaming account after a specified period of inactivity.
(8) Procedures for the crediting and debiting of a registered player's interactive gaming account.
(9) Procedures for cashing checks, receiving electronic negotiable instruments and for redeeming chips, tokens or other cash equivalents.
(10) Procedures for withdrawing funds from an interactive gaming account by the registered player.
(11) Procedures for the protection of a registered player's funds, including the segregation of a registered player's funds from operating funds of the interactive gaming certificate holder.
(12) Procedures for recording transactions pertaining to interactive gaming.
(13) Procedures for the security and sharing of personally identifiable information of a registered player, funds in an interactive gaming account and other information as required by the board. The procedures shall include the means by which an interactive gaming certificate holder or interactive gaming operator will provide notice to a registered player related to the sharing of personally identifiable information. For the purpose of this paragraph, "personally identifiable information" shall mean any data or information that can be used, on its own or with other data or information, to identify, contact or otherwise locate a registered player, including a registered player's name, address, date of birth and Social Security number.
(14) Procedures and security for the calculation and recordation of revenue.
(15) Procedures for the security of interactive gaming devices and associated equipment.
(16) Procedures and security standards as to receipt, handling and storage of interactive gaming devices and associated equipment.
(17) Procedures and security standards to protect the interactive gaming certificate holder's interactive gaming skin or interactive gaming website and interactive gaming devices and associated equipment from hacking or tampering by any person.
(18) Procedures for responding to suspected or actual hacking or tampering with an interactive gaming certificate holder's interactive gaming skin or interactive gaming website and interactive gaming devices and associated equipment, including partial or complete suspension of interactive gaming or the suspension of any or all interactive gaming accounts when warranted.
(19) Procedures to verify each registered player's physical location each time a registered player logs into his or her interactive gaming account and at appropriate intervals thereafter as determined by the board.
(20) Procedures to ensure that the interactive games are fair and honest and that appropriate measures are in place to deter, detect and, to the extent possible, to prevent cheating, including collusion, and use of cheating devices, including the use of software programs that make wagers according to algorithms.
(21) Procedures to assist problem and compulsive gamblers, including procedures intended to prevent a person from participating in authorized interactive gaming in accordance with sections 1514 (relating to regulation requiring exclusion, ejection or denial of access of certain persons), 1515 (relating to repeat offenders excludable from licensed gaming facility) and 1516 (relating to list of persons self excluded from gaming activities).
(22) Procedures to govern emergencies, including suspected or actual cyber attacks, hacking or tampering with the interactive gaming certificate holder's interactive gaming skin, interactive gaming platform or interactive gaming website. The procedures shall include the process for the reconciliation or repayment of a registered player's interactive gaming account.
(c) Review of submissions.--
(1) The board shall review each submission required by subsections (a) and (b) and shall determine whether the submission conforms to the requirements of this chapter and regulations promulgated by the board and whether the system submitted provides adequate and effective controls for interactive gaming of the interactive gaming certificate holder making the submission.
(2) If the board determines that the submission is not sufficient, it shall specify the insufficiencies in writing to the interactive gaming certificate holder, who shall make appropriate alterations to ensure compliance with the requirements of this chapter and regulations of the board. When the board determines a submission to be adequate in all respects, it shall notify the interactive gaming certificate holder.
(3) Except as otherwise provided in subsection (a) or an emergency situation threatening the integrity of the interactive gaming platform, no interactive gaming certificate holder, interactive gaming operator or other person shall commence or alter interactive gaming operations unless and until the system of procedures, controls and alternations is submitted to and approved by the board.

Cross References. Section 13B32 is referred to in section 13B29 of this title.