25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.2

Shift. A time period, unless otherwise approved by the tribal gaming 

regulatory authority, not to exceed 24

hours. TGRA needs to determine how a shift is defined.

543.2

SICS (System of Internal Control Standards). An overall operational 

framework for a gaming operation that incorporates principles of 

independence and segregation of function, and is comprised of written 

policies, procedures, and standard practices based on overarching 

regulatory standards specifically designed to create a system of checks and 

balances to safeguard the integrity of a gaming operation and protect its 

assets from unauthorized access, misappropriation, forgery, theft, or fraud.

These are commonly refered to Standard Operating Procedures 

(SOP's) or Policy and Procedures (P&P's)

543.2

TICS. Tribal Internal Control Standards established by the TGRA that are at 

least as stringent as the standards set forth in this part. These are the controls adopted by the TGRA.

543.3(a)

Minimum standards. These are minimum standards and a TGRA may 

establish and implement additional controls that do not conflict with those 

set out in 543.

TGRA's may create controls that are more stringent than the MICS 

however the controls cannot conflict with the MICS.

543.3(b)

TICS. TGRAs must ensure that TICS are established and implemented that 

provide a level of control that equals or exceeds the applicable standards 

set forth in 543.

543.3(b)(1)

Evaluation of existing TICS. Each TGRA must, in accordance with the tribal 

gaming ordinance, determine whether and to what extent their TICS require 

revision to ensure compliance with 543.

543.3(b)(2)

Compliance date. All changes necessary to ensure compliance with this part 

must be promulgated within twelve months of the effective date of this part 

and implemented at the commencement of the next fiscal year.

At the discretion of the TGRA, gaming operations may have an additional six 

months to come into compliance with the TICS. TICS muct be promulgated by October 22, 2013.

543.3(c) 

SICS. Each gaming operation must develop a SICS, as approved by the TGRA, 

to implement the TICS.

543.3(c)(2)

New gaming operations. All gaming operations that commence operations 

after the effective date of this part must comply with this part before 

commencement of operations. 

New gaming operations must comply upon opening (i.e., TICS and 

SICS must be fully compliant with 543 requirements and 

implemented)

§ 543.2 What are the definitions for this part?

§ 543.3 How do tribal governments comply with this part?

1 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.3(d)

Variances. Where referenced throughout this part, the gaming operation 

must set a reasonable threshold, approved by the TGRA, for when a 

variance must be reviewed to determine the cause, and the results of the

review must be documented and maintained.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.3 (e)

Computer applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control 

established by the standards of this part, as approved in writing by the

TGRA, will be acceptable.

TGRA must document and approve any computer application that 

requires alternate documentation and/or procedures.

543.4(a)(1)

(a) Small gaming operations. This part does not apply to small gaming 

operations provided that: (1) The TGRA permits the operation to be exempt 

from this part; The TICS must document any exemptions. 

543.4(a)(2)

(a) Small gaming operations. This part does not apply to small gaming 

operations provided that: (3) The TGRA develops, and the operation 

complies with, alternate procedures that:

THE TGRA must develop alternate procedures if the TGRA determines 

that the small gaming operation is exempt from 543.

543.4(b)(2)

(b) Charitable gaming operations. This part does not apply to charitable 

gaming operations provided that: (2) The TGRA permits the charitable 

organization to be exempt from this part; The TICS must document any exemptions. 

543.4(b)(5)

(b) Charitable gaming operations. This part does not apply to charitable 

gaming operations provided that: (5) The TGRA develops, and the charitable 

gaming operation complies with, alternate procedures.

THE TGRA must develop alternate procedures if the TGRA determines 

that the charitable gaming operation is exempt from 543.

543.5(a)(1)

A TGRA may approve an alternate standard from those required by this part 

if it has determined that the alternate standard will achieve a level of 

security and integrity sufficient to accomplish the purpose of the

standard it is to replace. A gaming operation may implement an alternate 

standard upon TGRA approval subject to the Chair's decision pursuant to 

543.5(b).

Within 30 days of approval by the TGRA, the TGRA must send a 

detailed report to the NIGC Chair for approval.

§ 543.5 How does a gaming operation apply to use an alternate minimum standard from those set forth in this part?

§ 543.4 Does this part apply to small and charitable gaming operations?

2 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543,8(b)(1)

(b) Bingo cards. (1) Physical bingo card inventory controls must address the 

placement of orders, receipt, storage, issuance, removal, and cancellation of 

bingo card inventory to ensure that: (i) The bingo card inventory can be 

accounted for at all times; and (ii) Bingo cards have not been marked, 

altered, or otherwise manipulated.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(b)(4)

(b) Bingo cards. (4) Issuance and returns of inventory.

(i) Controls must be established for the issuance and return of bingo card 

inventory. Records signed by the issuer and recipient must be created under 

the following events:

(A) Issuance of inventory from storage to a staging area;

(B) Issuance of inventory from a staging area to the cage or sellers;

(C) Return of inventory from a staging area to storage; and

(D) Return of inventory from cage or seller to staging area or storage.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(c)(3)

(c) Bingo card sales. (3) Bingo card sale voids must be processed in 

accordance with the rules of the game and established controls

that must include the following:

(i) Patron refunds;

(ii) Adjustments to bingo card sales to reflect voids;

(iii) Adjustment to bingo card inventory;

(iv) Documentation of the reason for the void; and

(v) Authorization for all voids.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(d)(1)

(d) Draw. (1) Controls must be established and procedures implemented to 

ensure that all eligible objects used in the conduct of the bingo game are 

available to be drawn and have not been damaged or altered. Verification of 

physical objects must be performed by two agents before the start of the 

first bingo game/session. At least one of the verifying agents must be a 

supervisory agent or independent of the bingo games department.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(d)(3)

(d) Draw. (3) Controls must be established and procedures implemented to 

provide a method of recall of the draw, which includes the order and 

identity of the objects drawn, for dispute resolution purposes.

The TGRA must adopt controls as part of their TICS to address this 

section.

§ 543.8 What are the minimum internal control standards for bingo?

3 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(d)(4)

(d) Draw. (4) Verification and display of draw. Controls must be established 

and procedures implemented to ensure that:

(i) The identity of each object drawn is accurately recorded and transmitted 

to the participants. The procedures

must identify the method used to ensure the identity of each object drawn.

(ii) For all games offering a prize payout of $1,200 or more, as the objects 

are drawn, the identity of the objects

are immediately recorded and maintained for a minimum of 24 hours.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(e)(1)

(e) Prize payout.

(1) Controls must be established and procedures implemented for cash or 

cash equivalents that address the

following:

(i) Identification of the agent authorized (by position) to make a payout;

(ii) Predetermined payout authorization levels (by position); and

(iii) Documentation procedures ensuring separate control of the cash 

accountability functions.

The TGRA must adopt controls as part of their TICS to address this 

section. Controls need to identify the authorized agent by position to 

complete the identified tasks.

543,8(e)(2)

(e) Prize payout. (2) Verification of validity.

(i) Controls must be established and procedures implemented to verify that 

the following is valid for the game

in play prior to payment of a winning prize:

(A) Winning card(s);

(B) Objects drawn; and

(C) The previously designated arrangement of numbers or designations on 

such cards, as described in 25 U.S.C.

2703(7)(A).

The TGRA must adopt controls as part of their TICS to address this 

section. 

543,8(e)(5)(i)

(e) Prize payout. (5) Authorization and signatures.

(i) At least two agents must authorize, sign, and witness all manual prize 

payouts above $1,200, or a lower

threshold as authorized by management and approved by the TGRA. The threshold amount needs to be approved by the TGRA.

4 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(e)(5)(ii)

(e) Prize payout. (5) Authorization and signatures. (ii) Manual prize payouts 

above the following threshold (or a lower threshold, as authorized by 

management and approved by TGRA) must require one of the two 

signatures and verifications to be a supervisory or

management employee independent of the operation of Class II Gaming 

System bingo:

(A) $5,000 for a Tier A facility;

(B) $10,000 at a Tier B facility;

(C) $20,000 for a Tier C facility; or

(D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming 

revenues. The threshold amount needs to be approved by the TGRA.

543.8(e)(5)(iii)

(e) Prize payout. (5) Authorization and signatures. (iii) The predetermined 

thresholds, whether set at the MICS level or lower, must be authorized by 

management, approved by the TGRA, documented, and maintained. The threshold amount needs to be approved by the TGRA.

543.8(f)(2)

(f) Cash and cash equivalents. (2) Procedures must be implemented to 

control cash or cash equivalents based on the amount of the transaction.

These procedures must include documentation by shift, session, or other 

relevant time period of the following: (i) Inventory, including a

ny increases or decreases; (ii) Transfers; (iii) Exchanges, including acknowle

dging signatures or initials; and (iv) Resulting variances. Procedures can be included in TICS and/or SICS.

543.8(g)(1)

(g) Technologic aids to the play of bingo. Controls must be established and 

procedures implemented to safeguard the integrity of technologic aids to 

the play of bingo during installations, operations, modifications,

removal and retirements. Such procedures must include the following: (1) 

Shipping and receiving. 

(i) A communication procedure must be established between the supplier, 

the gaming operation, and the TGRA to properly control the shipping and 

receiving of all software and hardware components. Such procedures must

include:

(A) Notification of pending shipments must be provided to the TGRA by the 

gaming operation;

(B) Certification in accordance with 25 CFR part 547;

The TGRA must adopt controls as part of their TICS to address this 

section. 

5 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(g)(1)(i)(C )

(g) Technologic aids to the play of bingo. (1) Shipping and receiving. (i) A 

communication procedure must be established between the supplier, the 

gaming operation, and the TGRA to properly control the shipping and 

receiving of all software and hardware components. Such procedures must

include: (C) Notification from the supplier to the TGRA, or the gaming 

operation as approved by the TGRA, of the shipping date and expected date 

of delivery. The shipping notification must include:

(1) Name and address of the supplier;

(2) Description of shipment;

(3) For player interfaces: a serial number;

(4) For software: software version and description of software;

(5) Method of shipment; and

(6) Expected date of delivery.

The TGRA must adopt controls as part of their TICS to address this 

section. Notification can be given to the gaming operation if 

approved by the TGRA.

543.8(g)(1)(ii)

(g) Technologic aids to the play of bingo. (1) Shipping and receiving. (ii) 

Procedures must be implemented for the exchange of Class II gaming 

system components for maintenance and replacement. Procedures can be included in TICS and/or SICS.

543.8(g)(2)(i)

(g) Technologic aids to the play of bingo. (2) Access credential control 

methods.

(i) Controls must be established to restrict access to the Class II gaming 

system components, as set forth in §

543.20, Information and Technology.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(g)(3)

(g) Technologic aids to the play of bingo. (3) Recordkeeping and audit 

processes. (i) The gaming operation must maintain the following records, as 

applicable, related to installed game servers and player interfaces (A-I) Procedures can be included in TICS and/or SICS.

543.8(g)(4)(i)

(g) Technologic aids to the play of bingo. (4) System software signature 

verification.

(i) Procedures must be implemented for system software verifications. 

These procedures must include comparing signatures generated by the 

verification programs required by 25 CFR 547.8, to the signatures

provided in the independent test laboratory letter for that software version. Procedures can be included in TICS and/or SICS.

6 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(g)(4)(iii)

(g) Technologic aids to the play of bingo. (4) System software signature 

verification. (iii) Procedures must be implemented for investigating and 

resolving any software verification variances. Procedures can be included in TICS or SICS.

543.8(g)(5)

(g) Technologic aids to the play of bingo. (5) Installation testing. (i) Testing 

must be completed during the installation process to verify that the player 

interface has been properly installed. This must include testing of the 

following, as applicable: 

(A) Communication with the Class II gaming system; 

(B) Communication with the accounting system; 

(C) Communication with the player tracking system; 

(D) Currency and vouchers to bill acceptor; 

(E) Voucher printing; 

(F) Meter incrementation; 

(G) Pay table, for verification; 

(H) Player interface denomination, for verification; 

(I) All buttons, to ensure that all are operational and programmed 

appropriately; 

(J) System components, to ensure that they are safely installed at location; 

and 

(K) Locks, to ensure that they are secure and functioning. Procedures can be included in TICS or SICS.

543.8(g)(6)

(g) Technologic aids to the play of bingo. (6)

Display of rules and necessary disclaimers. The TGRA or the operation must

verify that all game rules and disclaimers are displayed at all times or made 

readily available to the player upon request, as required by 25 CFR part 547. Procedures can be included in TICS or SICS.

543.8(g)(7)

(g) Technologic aids to the play of bingo. (7) TGRA approval of all 

technologic aids before they are offered for play.

TGRA must approve all technological aids. Procedures can be included 

in TICS or SICS.

543.8(g)(8)

(g) Technologic aids to the play of bingo. (8) All Class II gaming equipment 

must comply with 25 CFR part 547, Minimum Technical Standards for 

Gaming Equipment Used With the Play of Class II Games; Procedures can be included in TICS or SICS.

543.8(g)(9) (g) Technologic aids to the play of bingo. (9) Dispute resolution. Procedures can be included in TICS or SICS.

7 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(h)(1)

(h) Operations.

(1) Malfunctions. Procedures must be implemented to investigate, 

document and resolve malfunctions. Such procedures must address the 

following:

(i) Determination of the event causing the malfunction;

(ii) Review of relevant records, game recall, reports, logs, surveillance 

records;

(iii) Repair or replacement of the Class II gaming component;

(iv) Verification of the integrity of the Class II gaming component before 

restoring it to operation. Procedures can be included in TICS and/or SICS.

543.8(h)(2)(i)

(h) Operations. (2) Removal, retirement and/or destruction. Procedures 

must be implemented to retire or remove any or all associated components 

of a Class II gaming system from operation. Procedures must include the 

following:

(i) For player interfaces and components that accept cash or cash 

equivalents:

(A) Coordinate with the drop team to perform a final drop;

(B) Collect final accounting information such as meter readings, drop and 

payouts;

(C) Remove and/or secure any or all associated equipment such as locks, 

card reader, or ticket printer from the

retired or removed component; and

(D) Document removal, retirement, and/or destruction. Procedures can be included in TICS and/or SICS.

543.8(h)(2)(ii)

(h) Operations. (2) Removal, retirement and/or destruction. Procedures 

must be implemented to retire or remove any or all associated components 

of a Class II gaming system from operation. Procedures must include the 

following: (ii) For removal of software components:

(A) Purge and/or return the software to the license holder; and

(B) Document the removal. Procedures can be included in TICS and/or SICS.

8 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(h)(2)(iii)

(h) Operations. (2) Removal, retirement and/or destruction. Procedures 

must be implemented to retire or remove any or all associated components 

of a Class II gaming system from operation. Procedures must include the 

following: (iii) For other related equipment such as blowers, cards, interface 

cards:

(A) Remove and/or secure equipment; and

(B) Document the removal or securing of equipment. Procedures can be included in TICS and/or SICS.

543.8(h)(2)(iv)

(h) Operations. (2) Removal, retirement and/or destruction. Procedures 

must be implemented to retire or remove any or all associated components 

of a Class II gaming system from operation. Procedures must include the 

following: (iv) For all components:

(A) Verify that unique identifiers, and descriptions of removed/retired 

components are recorded as part of the retirement documentation; and

(B) Coordinate with the accounting department to properly retire the 

component in the system records. Procedures can be included in TICS and/or SICS.

543.8(h)(2)(v)

(h) Operations. (2) Removal, retirement and/or destruction. Procedures 

must be implemented to retire or remove any or all associated components 

of a Class II gaming system from operation. Procedures must include the 

following: (v) Where the TGRA authorizes destruction of any Class II gaming 

system components, procedures must be developed to destroy such 

components. Such procedures must include the following:

(A) Methods of destruction;

(B) Witness or surveillance of destruction;

(C) Documentation of all components destroyed; and

(D) Signatures of agent(s) destroying components attesting to destruction. Procedures can be included in TICS or SICS.

9 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.8(i)(1)

(i) Vouchers.

(1) Controls must be established and procedures implemented to:

(i) Verify the authenticity of each voucher redeemed.

(ii) If the voucher is valid, verify that the patron is paid the appropriate 

amount.

(iii) Document the payment of a claim on a voucher that is not physically 

available or a voucher that cannot be validated such as a mutilated, expired, 

lost, or stolen voucher.

(iv) Retain payment documentation for reconciliation purposes.

(v) For manual payment of a voucher of $500 or more, require a supervisory 

employee to verify the validity of the voucher prior to payment.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.8(l)

(l) Variance. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance, including deviations from the 

mathematical expectations required by 25 CFR 547.4, will be reviewed to

determine the cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.9(b)

(b) Pull tab inventory. Controls must be established and procedures 

implemented to ensure that:

(1) Access to pull tabs is restricted to authorized agents;

(2) The pull tab inventory is controlled by agents independent of pull tab 

sales;

(3) Pull tabs exchanged between agents are secured and independently 

controlled;

(4) Increases or decreases to pull tab inventory are recorded, tracked, and 

reconciled; and

(5) Pull tabs are maintained in a secure location, accessible only to 

authorized agents, and with surveillance coverage adequate to identify 

persons accessing the area.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.9(c)(1)

(c) Pull tab sales.

(1) Controls must be established and procedures implemented to record, 

track, and reconcile all pull tab sales and voids.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

§ 543.9 What are the minimum internal control standards for pull tabs?

10 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.9(d)(1)

(d) Winning pull tabs.

(1) Controls must be established and procedures implemented to record, 

track, and reconcile all redeemed pull tabs and pull tab payouts.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.9(d)(3)

(d) Winning pull tabs. (3) Pull tabs that are uniquely identifiable with a 

machine readable code (including, but not limited to a barcode) may be 

redeemed, reconciled, and stored by kiosks without the need for defacing, 

so long as the redeemed pull tabs are secured and destroyed after removal 

from the kiosk in accordance with the procedures approved by the TGRA.

If a kiosk is used for redeeming pulltabs and the kiosk is not capable 

of defacing them, the TGRA must adopt controls as part of their TICS 

to address this section. Procedures can be included in TICS and/or 

SICS.

543.9(d)(4)

(d) Winning pull tabs. (4) At least two agents must document and verify all 

prize payouts above $600, or lower threshold as authorized

by management and approved by the TGRA. (ii) The predetermined 

threshold must be authorized by management, approved by the TGRA, 

documented, and maintained.

Threshold needs to be approved by the TGRA and can be included in 

TICS or SICS.

543.9(h)

(h) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.10(c)(2)

(c) Playing cards. (2) Used playing cards that are not to be re-used must be 

properly cancelled and removed from service to prevent re-use. The 

removal and cancellation procedure requires TGRA review and approval.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.10(h)

(h) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

§ 543.10 What are the minimum internal control standards for card games?

11 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.12(b)

(b) Gaming promotions. The rules of the gaming promotion must be 

displayed or made readily available to

patron upon request. Gaming promotions rules require TGRA approval and 

must include the following:

(1) The rules of play;

(2) The nature and value of the associated prize(s) or cash award(s);

(3) Any restrictions or limitations on participant eligibility;

(4) The date(s), time(s), and location(s) for the associated promotional 

activity or activities;

(5) Any other restrictions or limitations, including any related to the claim of 

prizes or cash awards;

(6) The announcement date(s), time(s), and location(s) for the winning entry 

or entries; and

(7) Rules governing promotions offered across multiple gaming operations, 

third party sponsored promotions, and joint promotions involving third 

parties.

The TGRA must adopt controls as part of their TICS to address this 

section.

543.12(d)

(d) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.13(b)

(b) Complimentary services or items. Controls must be established and 

procedures implemented for complimentary services or items that address 

the following:

(1) Agents authorized to approve the issuance of complimentary services or 

items, including levels of authorization; (2) Limits and conditions on the 

approval and issuance of complimentary services or items; (3) Making and 

documenting changes to conditions or limits on the approval and issuance 

of complimentary services or items;

The TGRA must adopt controls as part of their TICS to address this 

section.

§ 543.12 What are the minimum internal control standards for gaming promotions and player tracking systems?

§ 543.13 What are the minimum internal control standards for complimentary services or items?

12 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.13(b)(4)

(b) Complimentary services or items. Controls must be established and 

procedures implemented for complimentary services or items that address 

the following: (4) Documenting and recording the authorization, issuance, 

and redemption of complimentary services or items, including cash and noncash gifts;

(i) Records must include the following for all complimentary items and 

services equal to or exceeding an amount established by the gaming 

operation and approved by the TGRA:

(A) Name of patron who received the complimentary service or item;

(B) Name(s) of issuer(s) of the complimentary service or item;

(C) The actual cash value of the complimentary service or item;

(D) The type of complimentary service or item (i.e., food, beverage); and

(E) Date the complimentary service or item was issued.

Threshold needs to be approved by the TGRA and can be included in 

TICS or SICS.

543.13(c )

(c) Complimentary services and items records must be summarized and 

reviewed for proper authorization and compliance with established 

authorization thresholds. (1) A detailed reporting of complimentary services 

or items transactions that meet an established threshold approved by the 

TGRA must be prepared at least monthly.

Threshold needs to be approved by the TGRA and can be included in 

TICS or SICS.

543.13(d)

(d) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.14(d)

(d) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

§ 543.14 What are the minimum internal control standards for patron deposit accounts and cashless systems?

13 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.15(b)(1)

(b) Establishment of lines of credit policy.

(1) If a gaming operation extends lines of credit, controls must be 

established and procedures implemented to safeguard the assets of the 

gaming operation. Such controls must include a lines of credit policy 

including the following:

(i) A process for the patron to apply for, modify, and/or re-establish lines of 

credit, to include required documentation and credit line limit; (ii) 

Authorization levels of credit issuer(s); (iii) Identification of agents 

authorized to issue lines of credit; (iv) A process for verifying an applicant's 

credit worthiness; (v) A system for recording patron information; (vi) A 

process for issuing lines of credit to; (viii) A policy governing increases and 

decreases to a patron's lines of credit account balances; and (ix) A policy 

governing write-offs and settlements.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.15(c) 

(c) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.17(b)

(b) Count room access. Controls must be established and procedures 

implemented to limit physical access to the count room to count team 

agents, designated staff, and other authorized persons. Such controls must 

include the following: 

(1) Count team agents may not exit or enter the count room during the 

count except for emergencies or scheduled breaks.

(2) Surveillance must be notified whenever count room agents exit or enter 

the count room during the count.

(3) The count team policy, at a minimum, must address the transportation 

of extraneous items such as personal belongings, tool boxes, beverage 

containers, etc., into or out of the count room.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

§ 543.17 What are the minimum internal control standards for drop and count?

§ 543.15 What are the minimum internal control standards for lines of credit?

14 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.17(c)

(c) Count team. Controls must be established and procedures implemented 

to ensure security of the count and the count room to prevent unauthorized 

access, misappropriation of funds, forgery, theft, or fraud. Such controls 

must include the following:

(1) For Tier A and B operations, all counts must be performed by at least 

two agents. For Tier C operations, all counts must be performed by at least 

three agents.

(2) For Tier A and B operations, at no time during the count can there be 

fewer than two count team agents in the count room until the drop 

proceeds have been accepted into cage/vault accountability. For Tier C 

operations, at no time during the count can there be fewer than three count 

team agents in the count room until the drop proceeds have been accepted 

into cage/vault accountability.

(3) For Tier A and B operations, count team agents must be rotated on a 

routine basis such that the count team is not consistently the same two 

agents more than four days per week. This standard does not apply to 

gaming operations that utilize a count team of more than two agents. For 

Tier C operations, count team agents must be rotated on a routine basis 

such that the count team is not consistently the same three agents more 

than four days per week. This standard does not apply to gaming operations 

that utilize a count team of more than three agents.

(4) Functions performed by count team agents must be rotated on a routine 

basis.

(5) Count team agents must be independent of the department being 

counted. A cage/vault agent may be used if they are not the sole recorder of 

the count and do not participate in the transfer of drop proceeds to the 

cage/vault. An accounting agent may be used if there is an independent 

audit of all count documentation.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.17(d)

(d) Card game drop standards. Controls must be established and procedures 

implemented to ensure security of the drop process. Such controls must 

include the following (1-8):

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

15 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.17(d)(5)

(d) Card game drop standards. Controls must be established and procedures 

implemented to ensure security of the drop process. Such controls must 

include the following: (5) All drop boxes may be removed only at the time 

previously designated by the gaming operation and reported to the TGRA. If 

an emergency drop is required, surveillance must be notified before the 

drop is conducted and the TGRA must be informed within a timeframe 

approved by the TGRA.

 It is recommended that drop time is included in SICS. TGRA needs to 

establish notification timeframe for emergency drops in TICS.

543.17(f)(10)

(f) Card game count standards. (10) Procedures must be implemented to 

ensure that any corrections to the count documentation are permanent and 

identifiable, and that the original, corrected information remains legible. 

Corrections must be verified by two count team agents. Procedures can be included in TICS and/or SICS.

543.17(g)(12)

(g) Player interface financial instrument count standards. (12) Procedures 

must be implemented to ensure that any corrections to the count 

documentation are permanent, identifiable and the original, corrected 

information remains legible. Corrections must be verified by two count 

team agents. Procedures can be included in TICS and/or SICS.

16 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.17(h)

(h) Collecting currency cassettes and financial instrument storage 

components from kiosks. Controls must be established and procedures 

implemented to ensure that currency cassettes and financial instrument 

storage components are securely removed from kiosks. Such controls must 

include the following:

(1) Surveillance must be notified prior to the financial instrument storage 

components or currency cassettes being accessed in a kiosk.

(2) At least two agents must be involved in the collection of currency 

cassettes and/or financial instrument storage components from kiosks and 

at least one agent should be independent of kiosk accountability.

(3) Currency cassettes and financial instrument storage components must 

be secured in a manner that restricts access to only authorized agents.

(4) Redeemed vouchers and pulltabs (if applicable) collected from the kiosk 

must be secured and delivered to the appropriate department (cage or 

accounting) for reconciliation.

(5) Controls must be established and procedures implemented to ensure 

that currency cassettes contain the correct denominations and have been 

properly installed.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.17(i)(5)

(i) Kiosk count standards. (5) Procedures must be implemented to ensure 

that any corrections to the count documentation are permanent, 

identifiable, and the original, corrected information remains legible. 

Corrections must be verified by two agents. Procedures can be included in TICS and/or SICS.

543.17(h/j)

(h/j) Controlled keys. Controls must be established and procedures 

implemented to safeguard the use, access, and

security of keys in accordance with the following:

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.17(j)

(j) Controlled keys. Controls must be established and procedures 

implemented to safeguard the use, access, and security of keys for kiosks.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.17(k)

(k) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.18(b)

(1) If checks are cashed at the cage, the controls must provide for security 

and integrity.

The TGRA must adopt controls as part of their TICS to address this 

section

§ 543.18 What are the minimum internal control standards for the cage, vault, kiosk, cash and cash equivalents?

17 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.18(d)(4)

(d) Kiosks. 

(4) The TGRA or the gaming operation, subject to the approval of the TGRA, 

must develop and implement physical security controls over the kiosks. 

Controls should address the following: forced entry, evidence of any entry, 

and protection of circuit boards containing programs.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.18(d)(5)

(d) Kiosks. 

(5) With regard to cashless systems, the TGRA or the gaming operation, 

subject to the approval of the TGRA, must develop and implement 

procedures to ensure that communications between the kiosk and system 

are secure and functioning.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.18(f)(2)

(f) Promotional payments, drawings, and giveaway programs. The following 

procedures must apply to any payment resulting from a promotional 

payment, drawing, or giveaway program disbursed by the cage department 

or any other department. This section does not apply to payouts for card 

game promotional pots and/or pools. (2) Payments above $600 (or lesser 

amount as approved by TGRA) must be documented at the time of the 

payment, and documentation must include the following:

TGRA can establish a different threshold. Threshold can be included in 

the TICS and/or SICS.

543.18(g)

(g) Chip(s) and token(s). Controls must be established and procedures 

implemented to ensure accountability of chip and token inventory.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.18(h)

(h) Vouchers.

(1) Controls must be established and procedures implemented to:

(i) Verify the authenticity of each voucher redeemed.

(ii) If the voucher is valid, verify that the patron is paid the appropriate 

amount.

(iii) Document the payment of a claim on a voucher that is not physically 

available or a voucher that cannot be validated such as a mutilated, expired, 

lost, or stolen voucher.

(iv) Retain payment documentation for reconciliation purposes.

(v) For manual payment of a voucher of $500 or more, require a supervisory 

employee to verify the validity of the voucher prior to payment.

The TGRA must adopt controls as part of their TICS to address this 

section. 

18 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.18(i)

(i) Cage and vault access. Controls must be established and procedures 

implemented to:

(1) Restrict physical access to the cage to cage agents, designated staff, and 

other authorized persons; and

(2) Limit transportation of extraneous items such as personal belongings, 

tool boxes, beverage containers, etc., into and out of the cage.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.18(j)

(j) Variances. The operation must establish, as approved by the TGRA, the 

threshold level at which a variance must be reviewed to determine the 

cause. Any such review must be documented.

Variance thresholds need to be approved by the TGRA and can be 

included in TICS or SICS.

543.20(a)(1)

(a) Supervision.

(1) Controls must identify the supervisory agent in the department or area 

responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.20(a)(3)

(a) Supervision. 

(3) Controls must ensure that duties are adequately segregated and 

monitored to detect procedural errors and to prevent the concealment of 

fraud.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.20(c)

(c) Class II gaming systems' logical and physical controls. Controls must be 

established and procedures implemented to ensure adequate:

(1) Control of physical and logical access to the information technology 

environment, including accounting, voucher, cashless and player tracking 

systems, among others used in conjunction with Class II gaming;

(2) Physical and logical protection of storage media and its contents, 

including recovery procedures;

(3) Access credential control methods;

(4) Record keeping and audit processes; and

(5) Departmental independence, including, but not limited to, means to 

restrict agents that have access to information technology from having 

access to financial instruments.

The TGRA must adopt controls as part of their TICS to address this 

section. 

§ 543.20 What are the minimum internal control standards for information technology and information technology data?

19 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.20(d)(3) 

(d) Physical security. (3) Access to the systems' secured physical location 

must be restricted to agents in accordance with established policies and 

procedures, which must include maintaining and updating a record of 

agents granted access privileges. 

Procedures must be adopted to address this section. Procedures can 

be included in TICS and/or SICS.

543.20(e)

(e) Logical security.

(1) Controls must be established and procedures implemented to protect all 

systems and to ensure that access to the following is restricted and secured:

(i) Systems' software and application programs;

(ii) Data associated with Class II gaming; and

(iii) Communications facilities, systems, and information transmissions 

associated with Class II gaming systems.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.20(f)(3)(ii)

(f) User controls. (3) Access credentials such as passwords, PINs, or cards 

must be controlled as follows: (ii) Access credentials must be changed at an 

established interval approved by the TGRA.

The TGRA must establish the timeframe for when access credentials 

are changed. i.e. credentials must be changed at minimum every 90 

days.

543.20(f)(4)

(f) User controls. (4) Lost or compromised access credentials must be 

deactivated, secured or destroyed within an established time period 

approved by the TGRA.

The TGRA needs to establish time period for lost or compromised 

access credentials. i.e. Lost or compromised access credentials need 

to be deactivated, secured or destroyed within 72 hours from time of 

being lost or compromised.

543,20(f)(5)

(f) User controls. (5) Access credentials of terminated users must be 

deactivated within an established time period approved by the TGRA.

The TGRA needs to establish time period for terminated users. i.e. 

Terminated user access credentials need to be deactivated within 72 

hours from termination.

543.20(g)(1)

(g) Installations and/or modifications.

(1) Only TGRA authorized or approved systems and modifications may be 

installed. TGRA must approve all systems and system modifications.

543.20(i)(1)

(i) Incident monitoring and reporting. (1) Procedures must be implemented 

for responding to, monitoring, investigating, resolving, documenting, and 

reporting security incidents associated with information technology 

systems. 

Procedures must be adopted to address this section. Procedures can 

be included in TICS and/or SICS.

543.20(i)(2)

(i) Incident monitoring and reporting. (2) All security incidents must be 

responded to within an established time period approved by the TGRA and 

formally documented.

TGRA must establish time period that security incidents must be 

responded to.

20 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.20(j)(2)

(j) Data backups. (2) Controls must include recovery procedures, including, 

but not limited to, the following:

(i) Data backup restoration;

(ii) Program restoration; and

(iii) Redundant or backup hardware restoration.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.20(l)

(l) Verifying downloads. Following download of any Class II gaming system 

software, the Class II gaming system must verify the downloaded software 

using a software signature verification method. Using any method it deems 

appropriate, the TGRA must confirm the verification. 

It is recommended that TGRA specify in procedures what method(s) it 

deems appropriate and document its confirmation of the verification.

543.21(b)

(b) Surveillance equipment and control room(s). Controls must be 

established and procedures implemented that include the following: (1-11) 

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.21(c) 

(c) Additional surveillance requirements.With regard to the following 

functions, controls must also include (1-5).

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.21(d)

(d) Reporting requirements. TGRA-approved procedures must be 

implemented for reporting suspected crimes and suspicious activity.

The TGRA must adopt controls as part of their TICS to address this 

section. Procedures can be included in TICS and/or SICS.

543.21(e)

(e) Recording retention. Controls must be established and procedures 

implemented that include the following:

(1) All recordings required by this section must be retained for a minimum 

of seven days; and

(2) Suspected crimes, suspicious activity, or detentions by security agents 

discovered within the initial retention period must be copied and retained 

for a time period, not less than one year.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.23(b)

(b) Accounting. Controls must be established and procedures implemented 

to safeguard assets and ensure each gaming operation: 

(1) Prepares accurate, complete, legible, and permanent records of all 

transactions pertaining to gaming revenue and activities for operational 

accountability.

(2) Prepares general accounting records on a double-entry system of 

accounting, maintaining detailed, supporting, subsidiary records, and 

performs the following activities: (i-xii)

The TGRA must adopt controls as part of their TICS to address this 

section. 

§ 543.23 What are the minimum internal control standards for audit and accounting?

§ 543.21 What are the minimum internal control standards for surveillance?

21 of 22
25 CFR 543

Identified areas that require additional action.

Citation Langauge Comments

543.23(c)

(c) Internal audit. Controls must be established and procedures 

implemented to ensure that:

(1) Internal auditor(s) perform audits of each department of a gaming 

operation, at least annually, to review compliance with TICS, SICS, and these 

MICS, which include at least the following areas: (i-xi)

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.24(d) 

(d) Controls must be established and procedures implemented to audit of 

each of the following operational areas: 

(1) Bingo. 

(2) Pull tabs. 

(3) Card games. 

(4) Gaming promotions and player tracking. 

(5) Complimentary services or items. 

(6) Patron deposit accounts. 

(7) Lines of credit. 

(8) Drop and count. 

(9) Cage, vault, cash, and cash equivalents. 

(10) Inventory.

The TGRA must adopt controls as part of their TICS to address this 

section. 

543.24(d)(5)

(d) Controls must be established and procedures implemented to audit of 

each of the following operational areas: (5) Complimentary services or 

items. At least monthly, review the reports required in § 543.13(d). These 

reports must be made available to those entities authorized by the TGRA or 

by tribal law or ordinance.

Authorization for the reports may be included in tribal law or 

ordinance. The TICS should establish the entities authorized to receive 

the reports as authorized by the TGRA.

§ 543.24 What are the minimum internal control standards for auditing revenue?

22 of 22