MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING 

25 CFR PART 543 

Section Contents

§ 543.1 What does this part cover?

§ 543.2 What are the definitions for this part?

§ 543.3 How do tribal governments comply with this part?

§§ 543.4-543.5 [Reserved]

§ 543.6 Does this part apply to small and charitable gaming operations?

§ 543.7 What are the minimum internal control standards for bingo?

§§ 543.8-543.15 [Reserved]

§ 543.16 What are the minimum internal controls for information technology?

Authority: 25 U.S.C. 2701 et seq. 

Source: 73 FR 60498, Oct. 10, 2008; 74 FR 52139, Oct. 9, 2009. 

§ 543.1 What does this part cover? 

This part, along with §§542.14 through 542.15, 542.17 through 542.18, 542.20 through 542.23, 542.30 through 

542.33, and 542.40 through 542.43 of this chapter establishes the minimum internal control standards for the conduct 

of Class II bingo and other games similar to bingo on Indian lands as described in 25 U.S.C. 2701 et seq. Throughout 

this part the term bingo includes other games similar to bingo.

§ 543.2 What are the definitions for this part? 

The definitions in this section apply to all sections of this part unless otherwise noted.

Accountability. All financial instruments, receivables, and patron deposits constituting the total amount for which the 

bankroll custodian is responsible at a given time. 

Actual bingo win percentage. The percentage calculated by dividing the bingo win by the bingo sales. Can be 

calculated for individual prize schedules or type of player interfaces on a per-day or cumulative basis. 

Agent. An employee or licensed person authorized by the gaming operation, as approved by the tribal gaming 

regulatory authority, designated for certain authorizations, decisions, tasks and actions in the gaming operation. This 

definition is not intended to eliminate nor suggest that appropriate management contracts are not required, where 

applicable, as referenced in 25 U.S.C. 2711. 

Amount in . The total value of all financial instruments and cashless transactions accepted by the Class II gaming 

system. 

Amount out . The total value of all financial instruments and cashless transactions paid by the Class II gaming 

system, plus the total value of manual payments. 

Bingo paper . A consumable physical object that has one or more bingo cards on its face. 

Bingo sales . The value of purchases made by players to participate in bingo. 

Bingo win . The result of bingo sales minus prize payouts. 

Cage . A secure work area within the gaming operation for cashiers which may include a storage area for the gaming 

operation bankroll. 
Cash equivalents . The monetary value that a gaming operation may assign to a document, financial instrument, or 

anything else of representative value other than cash. A cash equivalent includes, but is not limited to, tokens, chips, 

coupons, vouchers, payout slips and tickets, and other items to which a gaming operation has assigned an exchange 

value. 

Cashless system . A system that performs cashless transactions and maintains records of those cashless 

transactions. 

Cashless transaction . A movement of funds electronically from one component to another, often to or from a patron 

deposit account. 

Class II game . A game as described in 25 U.S.C. 2703(7)(A). 

Class II Gaming System . All components, whether or not technologic aids in electronic, computer, mechanical, or 

other technologic form, that function together to aid the play of one or more Class II games including accounting 

functions mandated by part 547 of this chapter. 

Commission . The National Indian Gaming Commission. 

Count . The act of counting and recording the drop and/or other funds. 

Count room . A secured room where the count is performed. 

Coupon . A financial instrument of fixed wagering value, usually paper, that can only be used to acquire non-cashable 

credits through interaction with a voucher system. This does not include instruments such as printed advertising 

material that cannot be validated directly by a voucher system. 

Drop . The total amount of financial instruments removed from financial instrument storage components in Class II 

gaming systems. 

Drop period . The period of time that occurs between sequential drops. 

Electronic funds transfer . A transfer of funds to or from a Class II gaming system through the use of a cashless 

system, which are transfers from an external financial institution. 

Financial instrument . Any tangible item of value tendered in Class II game play including but not limited to bills, 

coins, vouchers, and coupons. 

Financial instrument acceptor . Any component that accepts financial instruments. 

Financial instrument storage component . Any component that stores financial instruments. 

Game software . The operational program or programs that govern the play, display of results, and/or awarding of 

prizes or credits for Class II games. 

Gaming Equipment . All electronic, electro-mechanical, mechanical or other physical components utilized in the play 

of Class II games. 

Independent . The separation of functions so that the person or process monitoring, reviewing or authorizing the 

controlled transaction(s) is separate from the persons or process performing the controlled transaction(s). 

Inter-tribal prize pool . A fund to which multiple tribes contribute from which prizes are paid to winning players at a 

participating tribal gaming facility and which is administered by one of the participating tribes or a third party, ( e.g. 

progressive prize pools, shared prize pools, etc.). 

Internal audit . The audit function of a gaming operation that is independent of the department subject to the audit. 

Internal audit activities should be conducted in a manner that permits objective evaluation of areas examined. 
Internal auditor . The person(s) who perform an independent audit. Independence is obtained through the 

organizational reporting relationship, as the internal audit department must not report to management of the gaming 

operation. Internal audit personnel may provide audit coverage to more than one operation within a tribe's gaming 

operation holdings. 

Kiosk . A self serve point of sale or other component capable of accepting or dispensing financial instruments and 

may also be capable of initiating cashless transactions of values to or from a patron deposit account or promotional 

account. 

Manual payout . The payment to a player of some or all of a player's accumulated credits ( e.g. short pays, cancelled 

credits, etc.) or an amount owed as a result of a winning event by an agent of the gaming operation. 

MICS . Minimum internal control standards in this part. 

Non-cashable credit . Credits given by an operator to a patron; placed on a Class II gaming system through a 

coupon, cashless transaction, or other approved means; and capable of activating play but not being converted to 

cash. 

Patron deposit account . An account maintained on behalf of a patron, for the purpose of depositing and withdrawing 

cashable funds for the primary purpose of interacting with a gaming activity. 

Patron deposits . The funds placed with a designated cashier by patrons for the patrons' use at a future time. 

PIN . A personal identification number. 

Player interface . Any component(s) of a Class II gaming system, including an electronic or technological aid (not 

limited to terminals, player stations, handhelds, fixed units, etc.) that directly enable(s) player interaction in a Class II 

game. 

Player tracking system . A system typically used by a gaming operation to record the amount of play of an individual 

patron. 

Prize payout . A transaction associated with a winning event. 

Prize schedule . A set of prizes available to players for achieving pre-designated patterns in Class II game(s). 

Progressive prize . A prize that increases by a selectable or predefined amount based on play of a Class II game. 

Promotional account . A file, record, or other data structure that records transactions involving a patron or patrons 

that are not otherwise recorded in a patron deposit account. 

Promotional prize payout . Merchandise or awards given to players by the gaming operation which is based on 

gaming activity. 

Random number generator (RNG) . A software module, hardware component or combination of these designed to 

produce outputs that are effectively random. 

Server . A computer which controls one or more applications or environments. 

Shift . An eight-hour period, unless otherwise approved by the tribal gaming regulatory authority, not to exceed 24 

hours. 

Short pay . The payment of the unpaid balance of an incomplete payout by a player interface. 

Tier A . Gaming operations with annual gross gaming revenues of more than $1 million but not more than $5 million. 

Tier B . Gaming operations with annual gross gaming revenues of more than $5 million but not more than $15 million. 
Tier C . Gaming operations with annual gross gaming revenues of more than $15 million. 

Tribal Gaming Regulatory Authority . The entity authorized by tribal law to regulate gaming conducted pursuant to the 

Indian Gaming Regulatory Act. 

Voucher . A financial instrument of fixed value that can only be used to acquire an equivalent value of cashable 

credits or cash through interaction with a voucher system. 

Voucher System . A component of the Class II gaming system or an external system that securely maintains records 

of vouchers and coupons; validates payment of vouchers and coupons; records successful or failed payments of 

vouchers and coupons; and controls the purging of expired vouchers and coupons. 

§ 543.3 How do tribal governments comply with this part? 

(a) Compliance based upon tier. [Reserved]

(b) Determination of tier. [Reserved] 

(c) Tribal internal control standards. Within six months of October 10, 2008, each tribal gaming regulatory authority 

must, in accordance with the tribal gaming ordinance, establish or ensure that tribal internal control standards are 

established and implemented that must: 

(1) Provide a level of control that equals or exceeds those set forth in this part; and 

(2) Contain standards to identify, detect and deter money laundering in furtherance of a criminal enterprise, terrorism, 

tax evasion or other unlawful activity. The standards should be designed to facilitate the keeping of records and the 

filing of reports with the appropriate federal regulatory and law enforcement authorities. 

(3) Establish a deadline, no later than October 13, 2010, by which a gaming operation must come into compliance 

with the tribal internal control standards. However, the tribal gaming regulatory authority may extend the deadline by 

six months if written notice citing justification is provided to the Commission no later than two weeks before the 

deadline. 

(d) Gaming operations. Each gaming operation must develop and implement an internal control system that, at a 

minimum, complies with the tribal internal control standards. 

(1) Existing gaming operations. All gaming operations that are operating on or before November 10, 2008, must 

comply with this part within the time requirements established in paragraph (c) of this section. In the interim, such 

operations must continue to comply with existing tribal internal control standards. 

(2) New gaming operations. All gaming operations that commence operations after April 10, 2009, must comply with 

this part before commencement of operations. 

(e) Submission to Commission. Tribal regulations promulgated pursuant to this part are not required to be submitted 

to the Commission pursuant to Sec. 522.3(b) of this chapter. 

(f) CPA testing. (1) An independent certified public accountant (CPA) must be engaged to perform “Agreed-Upon 

Procedures” to verify that the gaming operation is in compliance with the minimum internal control standards (MICS) 

set forth in this part or a tribally approved variance thereto that has received Commission concurrence. The CPA 

must report each event and procedure discovered by or brought to the CPA's attention that the CPA believes does 

not satisfy the minimum standards or tribally approved variance that has received Commission concurrence. The 

“Agreed-Upon Procedures” may be performed in conjunction with the annual audit. The tribe must submit two copies 

of the report to the Commission within 120 days of the gaming operation's fiscal year end. In performing the 

compliance audit, the CPA must use the Statements on Standards for Attestation Engagements No. 10 at Sections 

101 (“Attest Engagements”) and 201 (“Agreed-Upon Procedures Engagements”) (collectively “SSAE's”), July 12, 

2007, American Institute of Certified Public Accountants Inc, (AICPA). SSAE No. 10 at Sections 101 and 201 are 

incorporated by reference into this section with the approval of the Director of the Federal Register under 5 U.S.C. 

552(a) and 1 CFR part 51. To enforce any edition other than that specified in this section, the Commission must 

publish notice of change in theFederal Registerand the material must be available to the public. You may obtain a 

copy from the American Institute of Certified Public Accountants, 220 Leigh Farm Rd., Durham, NC 27707, 1–888–
777–7077, at http://www.aicpa.org . You may inspect a copy at the National Indian Gaming Commission, 1441 L 

Street, NW., Suite 9100, Washington, DC 20005, 202–632–7003. All approved material is available for inspection at 

the National Archives and Records Administration (NARA). For information on the availability of this material at 

NARA, call 202–741–6030 or go to 

http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html . The CPA must perform the 

“Agreed-Upon Procedures” in accordance with the following: 

(i) As a prerequisite to the evaluation of the gaming operation's internal control systems, it is recommended that the 

CPA obtain and review an organization chart depicting segregation of functions and responsibilities, a description of 

the duties and responsibilities of each position shown on the organization chart, and an accurate, detailed narrative 

description of the gaming operation's procedures in effect that demonstrate compliance. 

(ii) Complete the CPA NIGC MICS Compliance checklists or other comparable testing procedures. The checklists 

should measure compliance on a sampling basis by performing inspections, observations and substantive testing. 

The CPA must complete separate checklists for bingo and information technology. All questions on each applicable 

checklist should be completed. Work-paper references are suggested for all “no” responses for the results obtained 

during testing (unless a note in the “W/P Ref” can explain the exception). 

(iii) The CPA must perform, at a minimum, the following procedures in conjunction with the completion of the 

checklists: 

(A) At least one unannounced observation of each of the following: financial instrument acceptor drop and count. For 

purposes of these procedures, “unannounced” means that no officers, directors, or employees are given advance 

information regarding the dates or times of such observations. The independent accountant should make 

arrangements with the gaming operation and tribal gaming regulatory authority to ensure proper identification of the 

CPA's personnel and to provide for their prompt access to the count rooms. The checklists should provide for drop 

and count observations. The count room should not be entered until the count is in process and the CPA should not 

leave the room until the monies have been counted and verified to the count sheet by the CPA and accepted into 

accountability. 

(B) Observations of the gaming operation's agents as they perform their duties. 

(C) Interviews with the gaming operation's agents who perform the relevant procedures. 

(D) Compliance testing of various documents relevant to the procedures. The scope of such testing should be 

indicated on the checklist where applicable. 

(E) For new gaming operations that have been in operation for three months or less at the end of their business year, 

performance of this regulation, this section, is not required for the partial period. 

(2) Alternatively, at the discretion of the tribe, the tribe may engage an independent CPA to perform the testing, 

observations and procedures reflected in paragraphs (f)(1)(i), (ii), and (iii) of this section utilizing the tribal internal 

control standards adopted by the tribal gaming regulatory authority or tribally approved variance that has received 

Commission concurrence. Accordingly, the CPA will verify compliance by the gaming operation with the tribal internal 

control standards. Should the tribe elect this alternative, as a prerequisite, the CPA will perform the following: 

(i) The CPA must compare the tribal internal control standards to the MICS to ascertain whether the criteria set forth 

in the MICS or Commission approved variances are adequately addressed. 

(ii) The CPA may utilize personnel of the tribal gaming regulatory authority to cross-reference the tribal internal 

control standards to the MICS, provided the CPA performs a review of the tribal gaming regulatory authority 

personnel's work and assumes complete responsibility for the proper completion of the work product. 

(iii) The CPA must report each procedure discovered by or brought to the CPA's attention that the CPA believes does 

not satisfy paragraph (f)(2)(i) of this section. 

(3) Reliance on Internal Auditors. (i) The CPA may rely on the work of an internal auditor, to the extent allowed by the 

professional standards, for the performance of the recommended procedures specified in paragraphs (f)(1)(iii)(B), 

(C), and (D) of this section, and for the completion of the checklists as they relate to the procedures covered therein. 
(ii) Agreed-upon procedures are to be performed by the CPA to determine that the internal audit procedures 

performed for a past 12-month period (includes two six month periods) encompassing a portion or all of the most 

recent business year has been properly completed. The CPA will apply the following agreed-upon procedures to the 

gaming operation's written assertion: 

(A) Obtain internal audit department work-papers completed for a 12-month period (includes two six month periods) 

encompassing a portion or all of the most recent business year and determine whether the CPA NIGC MICS 

Compliance Checklists or other comparable testing procedures were included in the internal audit work-papers and 

all steps described in the checklists were initialed or signed by an internal audit representative. 

(B) For the internal audit work-papers obtained in paragraph (f)(3)(ii)(A) of this section, on a sample basis, re-perform 

the procedures included in CPA NIGC MICS Compliance Checklists or other comparable testing procedures 

prepared by internal audit and determine if all instances of noncompliance noted in the sample were documented as 

such by internal audit. The CPA NIGC MICS Compliance Checklists or other comparable testing procedures for the 

applicable Drop and Count procedures are not included in the sample re-performance of procedures because the 

CPA is required to perform the drop and count observations as required under paragraph (f)(1)(iii)(A) of this section of 

the agreed-upon procedures. The CPA's sample should comprise a minimum of three percent of the procedures 

required in each CPA NIGC MICS Compliance Checklist or other comparable testing procedures for the bingo 

department and five percent for the other departments completed by internal audit in compliance with the internal 

audit MICS. The re-performance of procedures is performed as follows: 

( 1 ) For inquiries, the CPA should either speak with the same individual or an individual of the same job position as 

the internal auditor did for the procedure indicated in the CPA checklist. 

( 2 ) For observations, the CPA should observe the same process as the internal auditor did for the procedure as 

indicated in their checklist. 

( 3 ) For document testing, the CPA should look at the same original document as tested by the internal auditor for 

the procedure as indicated in their checklist. The CPA need only retest the minimum sample size required in the 

checklist. 

(C) The CPA is to investigate and document any differences between their re-performance results and the internal 

audit results. 

(D) Documentation must be maintained for five years by the CPA indicating the procedures re-performed along with 

the results. 

(E) When performing the procedures for paragraph (f)(3)(ii)(B) of this section in subsequent years, the CPA must 

select a different sample so that the CPA will re-perform substantially all of the procedures after several years. 

(F) Additional procedures performed at the request of the Commission, the tribal gaming regulatory authority or 

management should be included in the Agreed-Upon Procedures report transmitted to the Commission. 

(4) Report Format. The NIGC has concluded that the performance of these procedures is an attestation engagement 

in which the CPA applies such Agreed-Upon Procedures to the gaming operation's assertion that it is in compliance 

with the MICS and, if applicable under paragraph (f)(2) of this section, the tribal internal control standards and 

approved variances, provide a level of control that equals or exceeds that of the MICS. Accordingly, the Statements 

on Standards for Attestation Engagements (SSAE's), specifically SSAE 10, at Sections 101 and 201 are applicable. 

SSAE 10 provides current, pertinent guidance regarding agreed-upon procedure engagements, and the sample 

report formats included within those standards should be used, as appropriate, in the preparation of the CPA's 

agreed-upon procedures report. If future revisions are made to this standard or new SSAE's are adopted that are 

applicable to this type of engagement, the CPA is to comply with any revised professional standards in issuing their 

agreed upon procedures report. The Commission will provide an example report and letter formats upon request that 

may be used and contain all of the information discussed below. The report must describe all instances of procedural 

noncompliance (regardless of materiality) with the MICS or approved variations, and all instances where the tribal 

gaming regulatory authority's regulations do not comply with the MICS. When describing the agreed-upon procedures 

performed, the CPA should also indicate whether procedures performed by other individuals were utilized to 

substitute for the procedures required to be performed by the CPA. For each instance of noncompliance noted in the 

CPA's agreed-upon procedures report, the following information must be included: The citation of the applicable 

MICS for which the instance of noncompliance was noted; a narrative description of the noncompliance, including the 

number of exceptions and sample size tested. 
(5) Report Submission Requirements. (i) The CPA must prepare a report of the findings for the tribe and 

management. The tribe must submit two copies of the report to the Commission no later than 120 days after the 

gaming operation's business year end. This report should be provided in addition to any other reports required to be 

submitted to the Commission. 

(ii) The CPA should maintain the work-papers supporting the report for a minimum of five years. Digital storage is 

acceptable. The Commission may request access to these work-papers, through the tribe. 

(6) CPA NIGC MICS Compliance Checklists. In connection with the CPA testing pursuant to this section and as 

referenced therein, the Commission will provide CPA MICS Compliance Checklists upon request. 

(g) Enforcement of Commission Minimum Internal Control Standards. 

(1) Each tribal gaming regulatory authority is required to establish and implement internal control standards pursuant 

to paragraph (c) of this section. Each gaming operation is then required, pursuant to paragraph (d) of this section, to 

develop and implement an internal control system that complies with the tribal internal control standards. Failure to do 

so may subject the tribal operator of the gaming operation, or the management contractor, to penalties under 25 

U.S.C. 2713. 

(2) Recognizing that tribes are the primary regulator of their gaming operation(s), enforcement action by the 

Commission will not be initiated under this part without first informing the tribe and tribal gaming regulatory authority 

of deficiencies in the internal controls of its gaming operation and allowing a reasonable period of time to address 

such deficiencies. Such prior notice and opportunity for corrective action is not required where the threat to the 

integrity of the gaming operation is immediate and severe. 

§§ 543.4-543.5 [Reserved] 

§ 543.6 Does this part apply to small and charitable gaming operations?

 (a) Small gaming operations. This part does not apply to small gaming operations provided that:

(1) The tribal gaming regulatory authority permits the operation to be exempt from this part; 

(2) The annual gross gaming revenue of the operation does not exceed $2 million; and 

(3) The tribal gaming regulatory authority develops and the operation complies with alternate procedures that: 

(i) Protect the integrity of games offered; 

(ii) Safeguard the assets used in connection with the operation; and 

(iii) Create, prepare and maintain records in accordance with Generally Accepted Accounting Principles. 

(b) Charitable gaming operations. This part does not apply to charitable gaming operations provided that: 

(1) All proceeds are for the benefit of a charitable organization; 

(2) The tribal gaming regulatory authority permits the charitable organization to be exempt from this part; 

(3) The charitable gaming operation is operated wholly by the charitable organization's agents; 

(4) The annual gross gaming revenue of the charitable operation does not exceed $2 million; and 

(5) The tribal gaming regulatory authority develops and the charitable gaming operation complies with alternate 

procedures that: 

(i) Protect the integrity of the games offered; 
(ii) Safeguard the assets used in connection with the gaming operation; and 

(iii) Create, prepare and maintain records in accordance with Generally Accepted Accounting Principles. For more 

information please see www.fasb.gov or www.fasb.org . 

(c) Independent operators. Nothing in this section exempts gaming operations conducted by independent operators 

for the benefit of a charitable organization. 

§ 543.7 What are the minimum internal control standards for bingo? 

(a) Bingo Cards—(1) Inventory of bingo paper. (i) The bingo paper inventory must be controlled so as to assure the 

integrity of the bingo paper being used as follows:

(A) When received, bingo paper must be inventoried and secured by an authorized agent(s) independent of bingo 

sales; 

(B) The issue of bingo paper to the cashiers must be documented and signed for by the authorized agent(s) 

responsible for inventory control and a cashier. The bingo control log must include the series number of the bingo 

paper; 

(C) The bingo control log must be utilized by the gaming operation to verify the integrity of the bingo paper being 

used; and 

(D) Once each month, an authorized agent(s) independent of both bingo paper sales and bingo paper inventory 

control must verify the accuracy of the ending balance in the bingo control log by reconciling it with the bingo paper 

inventory. 

(ii) Paragraph (a)(1) of this section does not apply where no physical inventory is applicable. 

(2) Bingo sales. (i) There must be an accurate accounting of all bingo sales. 

(ii) All bingo sales records must include the following information: 

(A) Date; 

(B) Time; 

(C) Shift or session; 

(D) Sales transaction identifiers, which may be the unique card identifier(s) sold or when electronic bingo card faces 

are sold, the unique identifiers of the card faces sold; 

(E) Quantity of bingo cards sold; 

(F) Dollar amount of bingo sales; 

(G) Signature, initials, or identification of the agent or device who conducted the bingo sales; and 

(H) When bingo sales are recorded manually, total sales are verified by an authorized agent independent of the bingo 

sales being verified and the signature, initials, or identification of the authorized agent who verified the bingo sales is 

recorded. 

(iii) No person shall have unrestricted access to modify bingo sales records. 

(iv) An authorized agent independent of the seller must perform the following standards for each seller at the end of 

each session: 

(A) Reconcile the documented total dollar amount of cards sold to the documented quantity of cards sold; 
(B) Note any variances; and 

(C) Appropriately investigate any noted variances with the results of the follow-up documented. 

(3) Voiding bingo cards. (i) Procedures must be established and implemented to prevent the voiding of card sales 

after the start of the calling of the game for which the bingo card was sold. Cards may not be voided after the start of 

a game for which the card was sold. 

(ii) When a bingo card must be voided the following controls must apply as relevant: 

(A) A non-electronic bingo card must be marked void; and 

(B) The authorization of the void, by an authorized agent independent of the original sale transaction (supervisor 

recommended), must be recorded either by signature on the bingo card or by electronically associating the void 

authorization to the sale transaction of the voided bingo card. 

(4) Reissue of previously sold bingo cards. When one or more previously sold bingo cards need to be reissued, the 

following controls must apply: the original sale of the bingo cards must be verified; and the reissue of the bingo cards 

must be documented, including the identity of the agent authorizing reissuance. 

(b) Draw—(1) Verification and display. (i) Procedures must be established and implemented to ensure the identity of 

each object drawn is accurately recorded and transmitted to the participants. The procedures must identify the 

method used to ensure the identity of each object drawn. 

(ii) For all games offering a prize payout of $1,200 or more, as the objects are drawn, the identity of the objects must 

be immediately recorded and maintained for a minimum of 24 hours. 

(iii) Controls must be present to assure that all objects eligible for the draw are available to be drawn prior to the next 

draw. 

(c) Manual Payouts and Short Pays. (1) Procedures must be established and implemented to prevent unauthorized 

access or fraudulent transactions using manual payout documents, including: 

(i) Payout documents must be controlled and completed in a manner that is intended to prevent a custodian of funds 

from altering the dollar amount on all parts of the payout document subsequent to the manual payout and 

misappropriating the funds. 

(ii) Payout documents must be controlled and completed in a manner that deters any one individual from initiating and 

producing a fraudulent payout document, obtaining the funds, forging signatures on the payout document, routing all 

parts of the document, and misappropriating the funds. Recommended procedures of this standard include but are 

not limited to the following: 

(A) Funds are issued either to a second verifier of the manual payout ( i.e. , someone other than the agents who 

generated/requested the payout) or to two agents concurrently ( i.e. , the generator/requestor of the document and 

the verifier of the manual payout). Both witness the manual payout; or 

(B) The routing of one part of the completed document is under the physical control ( e.g. , dropped in a locked box) 

of an agent other than the agent that obtained/issued the funds and the agent that obtained/issued the funds must not 

be able to place the document in the locked box. 

(iii) Segregation of responsibilities. The functions of sales and prize payout verification must be segregated, if 

performed manually. Agents who sell bingo cards on the floor must not verify bingo cards for prize payouts with bingo 

cards in their possession of the same type as the bingo card being verified for the game. Floor clerks who sell bingo 

cards on the floor are permitted to announce the identifiers of winning bingo cards. 

(iv) Validation. Procedures must be established and implemented to determine the validity of the claim prior to the 

payment of a prize ( i.e. , bingo card was sold for the game played, not voided, etc.) by at least two persons. 

(v) Verification. Procedures must be established and implemented to ensure that at least two persons verify the 

winning pattern has been achieved on the winning card prior to the payment of a prize. 
(vi) Authorization and signatures. (A) A Class II gaming system may substitute as one authorization/signature 

verifying, validating or authorizing a winning card of less than $1,200 or other manual payout. Where a Class II 

gaming system substitutes as an authorization/signature, the manual payout is subject to the limitations provided in 

this section. 

(B) For manual prize payouts of $1,200 or more and less than a predetermined amount not to exceed $50,000, at 

least two agents must authorize, sign and witness the manual prize payout. 

( 1 ) Manual prize payouts over a predetermined amount not to exceed $50,000 must require one of the two 

signatures and verifications to be a supervisory or management employee independent of the operation of bingo. 

( 2 ) This predetermined amount, not to exceed $50,000, must be authorized by management, approved by the tribal 

gaming regulatory authority, documented, and maintained. 

(2) Documentation, including: 

(i) Manual payouts and short-pays exceeding $10 must be documented on a two-part form, of which a restricted 

system record can be considered one part of the form, and documentation must include the following information: 

(A) Date and time; 

(B) Player interface identifier or game identifier; 

(C) Dollar amount paid (both alpha and numeric) or description of personal property awarded, including fair market 

value. Alpha is optional if another unalterable method is used for evidencing the amount paid; 

(D) Type of manual payout ( e.g. , prize payout, external bonus payout, short pay, etc.); 

(E) Game outcome ( e.g. , patterns, symbols, bingo card identifier/description, etc.) for manual prize payouts, external 

bonus description, reason for short pay, etc.; 

(F) Preprinted or concurrently printed sequential manual payout identifier; and 

(G) Signatures or other authorizations, as required by this part. 

(ii) For short-pays of $10 or less, the documentation (single-part form or log is acceptable) must include the following 

information: 

(A) Date and time; 

(B) Player interface number; 

(C) Dollar amount paid (both alpha and numeric). Alpha is optional if another unalterable method is used for 

evidencing the amount paid; 

(D) The signature of at least one agent verifying and witnessing the short pay; and 

(E) Reason for short pay. 

(iii) In other situations that allow an agent to input a prize payout or change the dollar amount of the prize payout by 

more than $1 in a Class II gaming system that has an automated prize payout component, two agents, one of which 

is a supervisory employee, must be physically involved in verifying and witnessing the prize payout. 

(iv) For manually paid promotional prize payouts, as a result of the play of a game and where the amount paid is not 

included in the prize schedule, the documentation (single-part form or log is acceptable) must include the following 

information: 

(A) Date and time; 
(B) Player interface number; 

(C) Dollar amount paid (both alpha and numeric). Alpha is optional if another unalterable method is used for 

evidencing the amount paid; 

(D) The signature of at least one agent verifying and witnessing the manual promotional prize payout of $599 or less 

and two agents verifying and witnessing the manual promotional prize payout exceeding $599; 

(E) Description or name of the promotion; and 

(F) Total amount of manual promotional prize payouts must be recorded by shift, session or other relevant time 

period. 

(v) When a controlled manual payout document is voided, the agent completing the void must clearly mark “void” 

across the face of the document, sign across the face of the document and all parts of the document must be 

retained for accountability. 

(d) Operational controls. (1) Procedures must be established and implemented with the intent to prevent unauthorized 

access to or fraudulent transactions involving cash or cash equivalents. 

(2) Cash or cash equivalents exchanged between two persons must be counted independently by at least two 

persons and reconciled to the recorded amounts at the end of each shift or if applicable each session. Unexplained 

variances must be documented and maintained. Unverified transfers of cash or cash equivalents are prohibited. 

(3) Procedures must be established and implemented to control cash or cash equivalents in accordance with this 

section and based on the amount of the transaction. These procedures include, but are not limited to, counting and 

recording on an accountability form by shift, session or relevant time period the following: 

(i) Inventory, including any increases or decreases; 

(ii) Transfers; 

(iii) Exchanges, including acknowledging signatures or initials; and 

(iv) Resulting variances. 

(4) Any change of control of accountability, exchange or transfer must require the cash or cash equivalents be 

counted and recorded independently by at least two persons and reconciled to the recorded amount. 

(e) Gaming equipment. (1) Procedures must be established and implemented with the intention to restrict access to 

agents for the following: 

(i) Controlled gaming equipment/components ( e.g. , draw objects and back-up draw objects); and 

(ii) Random number generator software. (Additional information technology security standards can be found in 

§543.16 of this part.) 

(2) The game software components of a Class II gaming system will be identified in the test laboratory report. When 

initially received, the software must be verified to be authentic copies, as certified by the independent testing 

laboratory. 

(3) Procedures must be established relating to the periodic inspection, maintenance, testing, and documentation of a 

random sampling of gaming equipment/components, including but not limited to: 

(i) Software related to game outcome must be authenticated semi-annually by an agent independent of bingo 

operations by comparing signatures against the test laboratory letter on file with the tribal gaming regulatory authority 

for that version. 
(ii) Class II gaming system interfaces to external systems must be tested annually for accurate communications and 

appropriate logging of events. 

(4) Records must be maintained for each player interface that indicate the date the player interface was placed into 

service or made available for play, the date the player interface was removed from service and not available for play, 

and any changes in player interface identifiers. 

(f) Voucher systems. (1) The voucher system must be utilized to verify the authenticity of each voucher or coupon 

redeemed. 

(2) If the voucher is valid, the patron is paid the appropriate amount. 

(3) Procedures must be established and implemented to document the payment of a claim on a voucher that is not 

physically available or a voucher that cannot be validated ( e.g. , mutilated, expired, lost, stolen, etc.). 

(i) If paid, appropriate documentation is retained for reconciliation purposes. 

(ii) Payment of a voucher for $50 or more, a supervisory employee must review the applicable voucher system, player 

interface or other transaction history records to verify the validity of the voucher and initial the voucher or 

documentation prior to payment. 

(4) Vouchers redeemed must remain in the cashier's accountability for reconciliation purposes. The voucher 

redemption system reports must be used to ensure all paid vouchers have been validated. 

(5) Vouchers paid during a period while the voucher system is temporarily out of operation must be marked “paid”, 

initialed and dated by the cashier. If the voucher is greater than a predetermined amount approved (not to exceed 

$500), a supervisory employee must approve the payment and evidence that approval by initialing the voucher prior 

to payment. 

(6) Paid vouchers are maintained in the cashier's accountability for reconciliation purposes. 

(7) Upon restored operation of the voucher system, vouchers redeemed while the voucher system was temporarily 

out of operation must be validated as expeditiously as possible. 

(8) Unredeemed vouchers can only be voided in the voucher system by supervisory employees. The supervisory 

employee completing the void must clearly mark “void” across the face of the voucher and sign across the face of the 

voucher, if available. The accounting department will maintain the voided voucher, if available. 

(g) Patron accounts and cashless systems. (1) All smart cards ( i.e. , cards that possess the means to electronically 

store or retrieve data) that maintain the only source of account data are prohibited. 

(2) For patron deposit accounts the following standards must apply: 

(i) For each patron deposit account, an agent must: 

(A) Require the patron to personally appear at the gaming operation; 

(B) Record the type of identification credential examined, the credential number, the expiration date of credential, and 

the date credential was examined. ( Note: A patron's driver's license is the preferred method for verifying the patron's 

identity. A passport, non-resident alien identification card, other government issued identification credential or another 

picture identification credential normally acceptable as a means of identification when cashing checks, may also be 

used.); 

(C) Record the patron's name and may include another identifier ( e.g. , nickname, title, etc.) of the patron, if 

requested by patron; 

(D) Record a unique identity for each patron deposit account; 

(E) Record the date the account was opened; and 
(F) Provide the account holder with a secure method of access to the account. 

(ii) Patron deposit accounts must be established for patrons at designated areas of accountability and the creation of 

the account must meet all the controls of paragraph (g)(2)(i) of this section when the patron makes an initial deposit 

of cash or cash equivalents. 

(iii) If patron deposit account adjustments may be made by the operation, the operation must be authorized by the 

account holder to make necessary adjustments. This requirement can be met through the collection of a single 

authorization that covers the life of the patron deposit account. 

(iv) Patron deposits & withdrawals. (A) Prior to the patron making a withdrawal from a patron deposit account, the 

cashier must verify the identity of the patron and availability of funds. Reliance on a secured PIN entered by the 

patron is an acceptable method of verifying patron identity. 

(B) A multi-part deposit/withdrawal record must be created when the transaction is processed by a cashier, including; 

( 1 ) Same document number on all copies; 

( 2 ) Type of transaction, deposit or withdrawal; 

( 3 ) Name or other identifier of the patron; 

( 4 ) At least the last four digits of the account identifier; 

( 5 ) Patron signature for withdrawals, unless a secured PIN is utilized by the patron; 

( 6 ) Date of transaction; 

( 7 ) Dollar amount of transaction; 

( 8 ) Nature of deposit or withdrawal ( e.g. , cash, check, chips); and 

( 9 ) Signature of the cashier processing the transaction. 

(C) A copy of the transaction record must be secured for reconciliation of the cashier's bank for each shift. All 

transactions involving patron deposit accounts must be accurately tracked. 

(D) The copy of the transaction record must be forwarded to the accounting department at the end of the gaming day. 

(E) When a cashier is not involved in the deposit/withdrawal of funds, procedures must be established that safeguard 

the integrity of the process used. 

(v) Patron Deposit Account Adjustments. (A) Adjustments to the patron deposit accounts must be performed by an 

agent. 

(B) A record must be created when the transaction is processed, including; 

( 1 ) Unique transaction identifier; 

( 2 ) Type of transaction, adjustment; 

( 3 ) Name or other identifier of the patron; 

( 4 ) At least the last four digits of the account identifier; 

( 5 ) Date of transaction; 
( 6 ) Dollar amount of transaction; 

( 7 ) Reason for the adjustment; and 

( 8 ) Signature or unique identifier for the agent who made the adjustment. 

(C) The transaction record must be forwarded to the accounting department at the end of the gaming day. 

(vi) Where available, systems reports that indicate the dollar amount of transactions for patron deposit accounts ( e.g. 

, deposits, withdrawals, account adjustments, etc.) that should be reflected in each cashier's accountability must be 

utilized at the conclusion of each shift in the reconciling of funds. 

(vii) Cashless transactions and electronic funds transfers to and from patron deposit accounts must be recorded and 

maintained at the end of the gaming operations specified 24-hour accounting period. 

(viii) Procedures must be established to maintain a detailed record for each patron deposit account that includes the 

dollar amount of all funds deposited and withdrawn, account adjustments made, and the transfers to or from player 

interfaces. 

(ix) Detailed patron deposit account transaction records must be available to the patron upon reasonable request and 

to the tribal gaming regulatory authority upon request. 

(x) Only dedicated gaming operation bank accounts must be used to record electronic funds transfers to or from the 

patron deposit accounts. Gaming operation bank accounts dedicated to electronic funds transfers to or from the 

patron deposit accounts must not be used for any other types of transactions. 

(3) For promotional and other accounts the following standards must apply: 

(i) Changes to promotional and other accounts must be performed by an agent. 

(ii) The following standards apply if a player tracking system is utilized: 

(A) In the absence of the patron, modifications to balances on a promotional or other account must be made under 

the authorization of supervisory employees and must be sufficiently documented (including substantiation of reasons 

for modification). Modifications are randomly verified by independent agents on a quarterly basis. This standard does 

not apply to the deletion of balances related to inactive or closed accounts through an automated process. 

(B) Access to inactive or closed accounts is restricted to supervisory employees. 

(C) Patron identification is required when redeeming values. 

Reliance on a secured PIN by the patron is an acceptable method of verifying patron identification. 

(h) Promotions. (1) The conditions for participating in promotional programs, including drawings and giveaway 

programs must be approved and available for patron review at the gaming operation. 

(2) Changes to the player tracking systems, promotional accounts, promotion and external bonusing system 

parameters which control features such as the awarding of bonuses, the issuance of cashable credits, non-cashable 

credits, coupons and vouchers, must be performed under the authority of supervisory employees, independent of the 

department initiating the change. Alternatively, the changes may be performed by supervisory employees of the 

department initiating the change if sufficient documentation is generated and the propriety of the changes are 

randomly verified by supervisory employees independent of the department initiating the change on a monthly basis. 

(3) All other changes to the player tracking system must be appropriately documented. 

(4) All relevant controls from Sec. 543.16 of this part will apply. 

(i) Accounting. (1) Accounting/audit standards. (i) Accounting/auditing procedures must be performed by agents who 

are independent of the persons who performed the transactions being reviewed. 
(ii) All accounting/audit procedures and actions must be documented ( e.g. , log, checklist, investigations and notation 

on reports), maintained for inspection and provided to the tribal gaming regulatory authority upon request. 

(iii) Accounting/audit procedures must be performed reviewing transactions for relevant accounting periods, including 

a 24-hour accounting period and reconciled in total for those time periods. 

(iv) Accounting/audit procedures must be performed within seven days of the transaction's occurrence date being 

reviewed. 

(v) Accounting/audit procedures must be in place to review variances related to bingo accounting data, which must 

include at a minimum any variance noted by the Class II gaming system for cashless transactions in and out, 

electronic funds transfer in and out, external bonus payouts, vouchers out and coupon promotion out. 

(vi) At least monthly, an accounting/audit agent must confirm that the appropriate investigation has been completed 

for the review of variances. 

(2) Audit tasks to be performed for each day's business. 

(i) Records of bingo card sales must be reviewed for proper authorization, completion and accurate calculations. 

(ii) Manual payout summary report, if applicable, must be reviewed for proper authorizations, completion, accurate 

calculations, and authorization confirming manual payout summary report totals. 

(iii) A random sampling of records of manual payouts must be reviewed for proper authorizations and completion for 

manual payouts less than $1,200. 

(iv) Records of all manual prize payouts of $1,200 or more must be reviewed for proper authorizations and 

completion. 

(v) Where manual payout information is available per player interface, records of manual payouts must be reviewed 

against the recorded manual payout amounts per player interface. 

(vi) Manual payout forms must be reconciled to each cashier's accountability documents and in total for each relevant 

period ( e.g. , session, shift, day, etc.). 

(vii) Records of voided manual payouts must be reviewed for proper authorization and completion. 

(viii) Records of voided bingo cards must be reviewed for proper authorization and completion. 

(ix) Use of controlled forms must be reviewed to ensure each form is accounted for. 

(x) Where bingo sales are available per player interface, bingo sales must be reviewed for reasonableness. 

(xi) Amount of financial instruments accepted per financial instrument type and per financial instrument acceptor must 

be reviewed for reasonableness, to include but not limited to zero amounts. 

(xii) Where total prize payouts are available per player interface, total prize payouts must be reviewed for 

reasonableness. 

(xiii) Amount of financial instruments dispensed per financial instrument type and per financial instrument dispenser 

must be reviewed for reasonableness, to include but not limited to zero amounts. 

(xiv) For a random sampling, foot the vouchers redeemed and trace the totals to the totals recorded in the voucher 

system and to the amount recorded in the applicable cashier's accountability document. 

(xv) Daily exception information provided by systems used in the operation of bingo must be reviewed for propriety of 

transactions and unusual occurrences. 
(xvi) Ensure promotional coupons which are not financial instruments are properly cancelled to prevent improper 

recirculation. 

(xvii) Reconcile all parts of the form used to document transfers that increase/decrease the inventory of an 

accountability (includes booths and any other accountability areas). 

(xviii) Reconcile voucher liability ( e.g. , issued-voided-redeemed-expired = unpaid) to the voucher system records. 

(xix) The total of all patron deposit accounts must be reconciled, as follows: 

(A) A report must be generated that details each day's beginning and ending balance of patron deposit accounts, 

adjustments to patron deposit accounts, and all patron deposit account transactions. 

(B) Reconcile the beginning and ending balances to the summary of manual deposit/withdrawal and account 

adjustment documentation to the patron deposit account report. 

(xx) Reconcile each day's patron deposit account liability ( e.g. , deposits ± adjustments−withdrawals = total account 

balance) to the system records. 

(xxi) Reconcile electronic funds transfers to the cashless system records, the records of the outside entity which 

processed the transactions and the operations dedicated cashless account bank records. 

(xxii) Accounting data used in performance analysis may only be altered to correct amounts that were determined to 

be in error. When correcting accounting data, the correct amount must be indicated in any Class II gaming system 

exception reports generated. 

(xxiii) Accounting/auditing agents must reconcile the audited bingo totals report to the audited bingo accounting data 

for each day. 

(xxiv) Accounting/auditing agents must ensure each day's bingo accounting data used in performance reports has 

been audited and reconciled. 

(xxv) If the Class II gaming system produces exception reports they must be reviewed on a daily basis for propriety of 

transactions and unusual occurrences. 

(3) Audit tasks to be performed at relevant periods: 

(i) Financial instrument acceptor data must be recorded immediately prior to or subsequent to a financial instrument 

acceptor drop. The financial instrument acceptor amount-in data must be recorded at least weekly. The time between 

recordings may extend beyond one week in order for a recording to coincide with the end of an accounting period 

only if such extension is for no longer than six additional days. 

(ii) When a player interface is removed from the floor, the financial instrument acceptor contents must be protected to 

prevent the misappropriation of stored funds. 

(iii) When a player interface is permanently removed from the floor, the financial instrument acceptor contents must 

be counted and recorded. 

(iv) For currency interface systems, accounting/auditing agents must make appropriate comparisons of system 

generated count as recorded in the statistical report at least one drop period per month. Discrepancies must be 

resolved prior to generation/distribution of reports. 

(v) For each drop period, accounting/auditing agents must compare the amount-in per financial instrument accepted 

by the financial instrument acceptors to the drop amount counted for the period. Discrepancies must be resolved 

before the generation/distribution of statistical reports. 

(vi) Investigation must be performed for any one player interface having an unresolved drop variance in excess of an 

amount that is both more than $25 and at least three percent (3%) of the actual drop. The investigation performed 
and results of the investigation must be documented, maintained for inspection, and provided to the tribal gaming 

regulatory authority upon request. 

(vii) The results of a variance investigation, including the date and personnel involved in any investigation, will be 

documented in the appropriate report and retained. The results will also include any corrective action taken ( e.g. , 

accounting data storage component replaced, interface component repaired, software debugged, etc.). The 

investigation will be completed and the results documented within seven days of the day the variance was noted, 

unless otherwise justified. 

(viii) Procedures must be established and implemented to perform the following on a regular basis, at a minimum of 

monthly, and using predetermined thresholds: 

(A) Where the Class II gaming system is capable of providing information per player interface, identify and investigate 

player interfaces with total prize payouts exceeding bingo sales; 

(B) Where bingo sales is available per player interface, investigate any percentage of increase/decrease exceeding a 

predetermined threshold, not to exceed 20%, in total bingo sales as compared to a similar period of time that 

represents consistency in prior performance. 

(C) Investigate any exception noted in paragraphs (i)(3)(viii)(A) and (B) of this section and document the findings. The 

investigation may include procedures to review one or more of the following: 

( 1 ) Verify days on floor are comparable. 

( 2 ) Non-prize payouts for authenticity and propriety. 

( 3 ) Player interface out of service periods. 

( 4 ) Unusual fluctuations in manual payouts. 

(D) If the investigation does not identify an explanation for exceptions then a physical check procedure must be 

performed, as required by paragraph (i)(3)(viii)(E) of this section. 

(E) Document any investigation of unresolved exceptions using a predefined player interface physical check 

procedure and checklist, to include a minimum of the following as applicable: 

( 1 ) Verify game software; 

( 2 ) Verify player interface configurations; 

( 3 ) Test amount in accounting data for accuracy upon insertion of financial instruments into the financial instrument 

acceptor; 

( 4 ) Test amount out accounting data for accuracy upon dispensing of financial instruments from the financial 

instrument dispenser; 

( 5 ) Record findings and repairs or modifications made to resolve malfunctions, including date and time, player 

interface identifier and signature of the agent performing the player interface physical check, and additional 

signatures as required; and 

( 6 ) Maintain player interface physical check records, either in physical or electronic form, for the period prescribed 

by the procedure. 

(ix) For Class II gaming systems, procedures must be performed at least monthly to verify that the system accounting 

data is accurate. 

(x) For Tier C, at least weekly: 

(A) Financial instruments accepted at a kiosk must be removed and counted by at least two agents; and 
(B) Kiosk transactions must be reconciled to the beginning and ending balances for each kiosk. 

(xi) At the conclusion of a promotion, accounting/audit agents must perform procedures ( e.g. , interviews, review of 

payout documentation, etc.) to ensure that promotional prize payouts, drawings, and giveaway programs are 

conducted in accordance with the rules provided to the patrons. 

(4) Inter-tribal prize pools. Procedures must be established and implemented to govern the participation in inter-tribal 

prize pools, which at a minimum must include the review, verification and maintenance of the following records, which 

must be made available, within a reasonable time of the request, to the tribal gaming regulatory authority upon 

request: 

(i) Summary of contributions in total made to an inter-tribal prize pool; 

(ii) Summary of disbursements in total from an inter-tribal prize pool; and 

(iii) Summary of inter-tribal prize pool funds availability. 

(5) Performance Analysis. (i) Bingo performance data must be recorded at the end of the gaming operations specified 

24-hour accounting period. Such data must include: 

(A) Amount-in and amount-out for each Class II gaming system. 

(B) The total value of all financial instruments accepted by the Class II gaming system by each financial instrument 

acceptor and by each financial instrument type. 

(C) The total value of all financial instruments dispensed by the Class II gaming system and by each financial 

instrument type. 

(D) The total value of all manual payouts by each Class II gaming system. 

(E) The total value of bingo purchases for each Class II gaming system. 

(F) The total value of prizes paid for each Class II gaming system. 

(ii) Procedures must be established and implemented that ensure the reliability of the performance data. 

(iii) Upon receipt of the summary of the data, the accounting department must review it for reasonableness using preestablished parameters defined by the gaming operation. 

(iv) An agent must record and maintain all required data before and after any maintenance or modifications that 

involves the clearing of the data ( e.g. , system software upgrades, data storage media replacement, etc.). The 

information recorded must be used when reviewing performance reports to ensure that the maintenance or 

modifications did not improperly affect the data in the reports. 

(6) Statistical reporting. (i) The bingo sales, prize payouts, bingo win, and actual bingo win percentages must be 

recorded for: 

(A) Each shift or session; 

(B) Each day; 

(C) Month-to-date; and 

(D) Year-to-date or fiscal year-to-date. 

(ii) A monthly comparison for reasonableness must be made of the amount of bingo paper sold from the bingo paper 

control log to the amount of bingo paper sales revenue recognized. 
(iii) Management employees independent of the bingo department must review bingo statistical information on at 

least a monthly basis. 

(iv) Agents independent of the bingo department must investigate any large or unusual statistical fluctuations, as 

defined by the gaming operation. 

(v) Such investigations must be documented, maintained for inspection, and provided to the tribal gaming regulatory 

authority upon request. 

(vi) The actual bingo win percentages used in the statistical reports should not include operating expenses ( e.g. , a 

percentage payment to administrators of inter-tribal prize pools), promotional prize payouts or bonus payouts not 

included in the prize schedule. 

(7) Progressive prize pools. (i) A display that shows the amount of the progressive prize must be conspicuously 

displayed at or near the player interface(s) to which the prize applies. 

(ii) At least once each day, each gaming operation must record the total amount of each progressive prize pool 

offered at the gaming operation on the progressive log. 

(iii) When a manual payment for a progressive prize is made from a progressive prize pool, the amount must be 

recorded on the progressive log. 

(iv) Each gaming operation must record, on the progressive log, the base reset amount of each progressive prize the 

gaming operation offers. 

(v) Procedures must be established and implemented specific to the transfer of progressive amounts in excess of the 

base reset amount to other awards or prizes. Such procedures may also include other methods of distribution that 

accrue to the benefit of the gaming public. 

§§ 543.8-543.15 [Reserved] 

§ 543.16 What are the minimum internal controls for information technology?

(a) Physical security measures restricting access to agents, including vendors, must exist over the servers, including 

computer terminals, storage media, software and data files to prevent unauthorized access and loss of integrity of 

data and processing.

(b) Unauthorized individuals must be precluded from having access to the secured computer area(s). 

(c) User controls. (1) Computer systems, including application software, must be secured through the use of 

passwords or other approved means. 

(2) Procedures must be established and implemented to ensure that management or independent agents assign and 

control access to computer system functions. 

(3) Passwords must be controlled as follows unless otherwise addressed in the standards in this section. 

(i) Each user must have his or her own individual user identification and password. 

(ii) When an individual has multiple user profiles, only one user profile per application may be used at a time. 

(iii) Passwords must be changed at least quarterly with changes documented. Documentation is not required if the 

system prompts users to change passwords and then denies access if the change is not completed. 

(iv) The system must be updated to change the status of terminated users from active to inactive status within 72 

hours of termination. 
(v) At least quarterly, independent agents must review user access records for appropriate assignment of access and 

to ensure that terminated users do not have access to system functions. 

(vi) Documentation of the quarterly user access review must be maintained. 

(vii) System exception information ( e.g. , changes to system parameters, corrections, overrides, voids, etc.) must be 

maintained. 

(4) Procedures must be established and implemented to ensure access listings are maintained which include at a 

minimum: 

(i) User name or identification number (or equivalent); and 

(ii) Listing of functions the user can perform or equivalent means of identifying same. 

(d) Adequate backup and recovery procedures must be in place that include: 

(1) Daily backup of data files—(i) Backup of all programs. Backup of programs is not required if the program can be 

reinstalled. 

(ii) Secured storage of all backup data files and programs, or other adequate protection to prevent the permanent loss 

of any data. 

(iii) Backup data files and programs may be stored in a secured manner in another building that is physically 

separated from the building where the system's hardware and software are located. They may also be stored in the 

same building as the hardware/software as long as they are secured in a fireproof safe or some other manner that will 

ensure the safety of the files and programs in the event of a fire or other disaster. 

(2) Recovery procedures must be tested on a sample basis at least annually with documentation of results. 

(e) Access records. (1) Procedures must be established to ensure computer access records, if capable of being 

generated by the computer system, are reviewed for propriety for the following at a minimum: 

(i) Class II gaming systems; 

(ii) Accounting/auditing systems; 

(iii) Cashless systems; 

(iv) Voucher systems; 

(v) Player tracking systems; and 

(vi) External bonusing systems. 

(2) If the computer system cannot deny access after a predetermined number of consecutive unsuccessful attempts 

to log on, the system must record unsuccessful log on attempts. 

(f) Remote access controls. (1) For computer systems that can be accessed remotely, the written system of internal 

controls must specifically address remote access procedures including, at a minimum: 

(i) Record the application remotely accessed, authorized user's name and business address and version number, if 

applicable; 

(ii) Require approved secured connection; 

(iii) The procedures used in establishing and using passwords to allow authorized users to access the computer 

system through remote access; 
(iv) The agents involved and procedures performed to enable the physical connection to the computer system when 

the authorized user requires access to the system through remote access; and 

(v) The agents involved and procedures performed to ensure the remote access connection is disconnected when the 

remote access is no longer required. 

(2) In the event of remote access, the information technology employees must prepare a complete record of the 

access to include: 

(i) Name or identifier of the employee authorizing access; 

(ii) Name or identifier of the authorized user accessing system; 

(iii) Date, time, and duration of access; and 

(iv) Description of work performed in adequate detail to include the old and new version numbers, if applicable of any 

software that was modified, and details regarding any other changes made to the system.