§ 543.12 What are the minimum internal control standards for 

player tracking systems used in conjunction with Class II 

gaming?  

Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 1 of 4 NIGC VERSION 

11/30/2011 

On October 8, 2008, the NIGC published final Class III MICS in the Federal Register. 73 FR 

60492. The effective date of that rule has been postponed until 2012. 76 FR 53817.  In 2010, the 

NIGC posted on its web site draft Class II MICS. The Proposed MICS published in the Federal 

Register on October 8, 2008 reserved § 543.12 and the 2010 draft regulations did not suggest new 

language for the section. Because there is no draft 2010 regulation, this document will 

compare the TGWG MICS proposal to the 2008 MICS published in the Federal Register. 

Editing convention: The words in blue (underlined) and red (struck-through) are the additions and 

deletions made by the TGWG. This document does not include discussion of sections 543.10(a) – 

(c) (Internal Control Procedures, Computerized applications, Variances) of the TGWG Version. 

The provisions are identical to others discussed in earlier comparison documents. 

2008 Proposed MICS TGWG Version 

§543.12  

RESERVED  

§ 543.12  

[RESERVED] What are the minimum 

internal control standards for player 

tracking systems used in conjunction with 

Class II gaming?  

(d) Player Tracking Systems. Controls must be 

established in a manner designed to prevent 

unauthorized access, cheating, 

misappropriation, forgery, theft, or fraud when 

a player tracking system is used in conjunction 

with Class II gaming. Such controls must 

include, but not be limited to, the following:  

(1) Operation of player tracking programs;  

(2) Security of player tracking accounts; and  

(3) Audit and accounting.  

NIGC Comments to TGWG Proposed Regulation 

Effect of 2010 Draft Regulation: The related standards in 543.7(g) of the 2010 draft regulation are 

intended to require that changes to player tracking account balances are only performed by 

authorized employees and that changes to player tracking systems are performed only by 

independent individuals or by individuals whose changes are randomly verified by supervisors 

independent of the department making the changes.  

Effect of TGWG Proposal: The TGWG created a new section which does not appear to be 

consistent with the related standards in 543.7(g) of the 2010 draft regulation and effectively 

reduces guidance and specificity provided by the current provision. The current provision reflects 

only minimal best practices for an area that is prone to abuse. To further minimize these controls 

does not serve the best interests of tribal gaming. 

§ 543.12 What are the minimum internal control standards for 

player tracking systems used in conjunction with Class II 

gaming?  

Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 2 of 4 NIGC VERSION 

11/30/2011 

TGWG Guidance  

 (e) Risk Assessments.  Risk assessments and periodic program reviews may be used to 

determine how often player tracking systems should be audited.  When an assessment and review 

is necessary, an agent independent of the organizational component responsible for player 

tracking systems should perform it.   

NIGC Comment to TGWG Guidance 

Guidance should recommend that the risk assessments be performed by the internal auditors who 

are generally in the position to perform such assessments/reviews and who typically perform the 

audits. The language “independent of the organizational component responsible for conducting 

the audited operations should perform it” should also be clarified. 

TGWG Guidance  

 (f) Operation of Player Tracking Programs.   

 (1) Gaming operations must establish controls for player tracking activities. Procedures 

should include but not be limited to the following:  

NIGC Comment to TGWG Guidance 

The use of “should” rather than “shall” or “must” in the guidance could lead the reader to believe 

that 543.12(f) does not require that the following procedures be established but that are merely 

recommended. 

TGWG Guidance  

 (i) Establishing player tracking membership;  

 (ii) Access to player tracking records;  

 (iii) Manual player tracking (e.g., card game player tracking, player tracking without 

automated systems, among others);  

 (iv) Issuing and redemption of benefits; and  

(A) Best practice suggests that patron identification should be required when redeeming 

benefits, however, reliance on a secured PIN by the patron is an acceptable method of verifying 

patron identification.  This does not apply to Unrestricted Patron Deposit Accounts; refer to 

MICS 543.11 (What are the minimum internal control standards for Patron Deposit Accounts and 

Cashless Systems?) and the associated guidance document for controls regarding all Patron 

Deposit Accounts.  

 (v) Adjustments to player tracking activity and benefits.  Adjustments made in the 

absence of the patron must be sufficiently documented, including substantiation of reasons for 

adjustment, by the agent performing the adjustment.  This standard does not apply to the deletion 

of balances related to inactive or closed accounts through an automated process if the automated 

process is capable of generating a report of all adjustments made.  

 (2) Best practice suggests that the gaming operation make readily available the eligibility 

requirements for player tracking participation.  The information should also include the 

§ 543.12 What are the minimum internal control standards for 

player tracking systems used in conjunction with Class II 

gaming?  

Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 3 of 4 NIGC VERSION 

11/30/2011 

following:  

 (i) Eligibility criteria;  

 (ii) Any restrictions or limitations on participant eligibility and membership (e.g., must be 

at least 18/21 years of age to participate, must achieve a specified amount of activity in a 

specified period, and restrictions on holding multiple accounts, among others);  

 (iii) Description of potential benefits associated to participation, including participation 

and benefits offered across multiple gaming operations, third-party sponsored programs, and joint 

programs involving third-parties; and  

 (iv) Any other restrictions or limitations, including any related to the claim of benefits 

(e.g., notice of expiration of benefits after a specified period of inactivity and rules for use of 

benefits by spouses or significant others, among others).   

NIGC Comment to TGWG Guidance 

Guidance should be expanded upon to provide more guidance for “Adjustments to player tracking 

activity and benefits.” Oversight and/or subsequent review of manual player tracking 

adjustments, point transfers between patron accounts, security over found player tracking cards, 

etc, should be included in the guidance.  

TGWG Guidance  

  (g) Security of Player Tracking Accounts.  When player tracking systems are used in 

conjunction with Class II gaming then controls should be established for the security and 

management of server, server software and data in accordance with MICS 543.16 (What are the 

minimum internal control standards for the security and management of server, server software, 

and data associated to Class II gaming systems?) and the guidance provided in the associated 

document.  

NIGC Comment to TGWG Guidance 

The use of “should” rather than “shall” or “must” in the guidance could lead the reader to believe 

that 543.12(g) does not require that controls be established for the security and management of 

server, server software, and data that comply with 543.16. 

TGWG Guidance  

(1) Controls must require that only authorized agents can access inactive or closed 

accounts.  

NIGC Comment to TGWG Guidance 

The level of control for closed accounts is appropriate, but there needs to be extra scrutiny for 

“inactive” accounts. “Inactive accounts should be in a separate section. The Guidance lacks a 

safeguard for the most popular type of collusions/scams, such as player point theft by player club 

employees, and may not have any provision for explicit segregation of duties highlighted in 

(f)(1)(v) above. Guidance should be expanded to provide more guidance for “Adjustments to 

§ 543.12 What are the minimum internal control standards for 

player tracking systems used in conjunction with Class II 

gaming?  

Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 4 of 4 NIGC VERSION 

11/30/2011 

player tracking activity and benefits.” Oversight and/or subsequent review of manual player 

tracking adjustments, point transfers between patron accounts, security over found player 

tracking cards, etc, should be included in the guidance.  

TGWG Guidance   

 (h) Audit and Accounting.   

 (1) When player tracking systems are used in conjunction with Class II gaming, Controls 

must be established for audit and accounting in accordance with MICS 543.19 (What are the 

minimum internal control standards for audit and accounting?) and the guidance provided in the 

associated document.  

 (2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place records in a 

locked box for next-day delivery to accounting for audit.  

NIGC Comment to TGWG Guidance 

Guidance in (1) appears relevant while it is unclear why paragraph (2) is provided as paragraph 

(1) is a general statement and (2) is one of many “best practice” suggestions that could be 

provided.