Class II Gaming Regulation Proposals

A work product of the 

Tribal Gaming Working Group

July 28, 2011
Statement of Stephanie Bryan

Vice-Chair of the Poarch Band of Creek Indians

On behalf of the 

Tribal Gaming Working Group

Chairman Stevens, Distinguished Members of the Commission:

My name is Stephanie Bryan. I serve as the Vice-Chair of the Poarch Band of Creek Indians and 

the Chair of the Poarch Creek Gaming Commission. Since December 2006, I have had the 

pleasure of participating in the Tribal Gaming Working Group (“TGWG”), a coalition comprised 

of representatives of the Class II tribal gaming industry, including elected tribal officials, tribal 

gaming regulators and operators, gaming equipment manufacturers and suppliers, gaming 

laboratories, tribal organizations, gaming attorneys, and a broad spectrum of technical experts to 

prepare the documents we are submitting to you today.

Before expounding further on the TGWG’s work, allow me to first commend you on the 

Commission’s effort to reach out and conduct meaningful consultation with tribal governments 

and to elicit tribal input into this important regulatory review endeavor. Speaking on behalf of 

my Tribe, the Poarch Band of Creek Indians, and no doubt on behalf of many other tribal 

governments – particularly those who have gone on record supporting our efforts – we are 

heartened by the Commission’s commitment to working collaboratively with tribal leaders and 

regulators to ensure that the regulatory framework for Class II gaming is strong and effective. 

As we all appreciate, a lawful, robust, and well-regulated Class II gaming environment serves 

both the tribal and federal interests.

On May 15, 2011, the TGWG forwarded the Commission a set of proposed Minimum Internal 

Control Standards for Class II gaming for its review and ultimate publication as proposed Class 

II MICS. In so doing it was our expectation, of course, that all tribal governments would have 

the opportunity to review, consult, and comment on this draft prior to promulgation of a final 

rule. 

The TGWG did not undertake this effort lightly. As the Commission may already be aware, I 

served as Co-Chair of the TGWG MICS drafting process along with Matthew Morgan of the 

Chickasaw Nation and Jamie Hummingbird of the Cherokee Nation of Oklahoma. We all know 

that the current Part 543 is incomplete and largely mirrors Part 542, which is specific to Class III 

gaming. It is also largely derived from increasingly outdated Nevada gaming regulations. These 

Nevada regulations, of course, govern commercial gaming activities and are not reflective of 

Indian gaming. Try as one might, simply plunking a Class III state regulatory framework into 

the tribal Class II gaming environment is not a workable endeavor. The Class II regulatory 

framework, as you are well aware, is premised on a more limited federal role with tribal gaming 

regulatory agencies serving as the primary regulator.
It is, we assert, also apparent that both Parts 542 and 543 in their current form are difficult to use 

and apply due to duplication across multiple sections, dated terminology, and procedures that are 

obsolete and not reflective of current technology. The TGWG’s proposed Class II MICS were 

drafted with the intent of ensuring that all controls are covered in Part 543, while at the same 

time removing some of the strict procedural steps and tasks not appropriately characterized as 

standards. Recognizing, however, that many tribal governments may find a certain degree of 

guidance helpful, these procedural steps and tasks were consolidated by the TGWG into a 

comprehensive set of guidance documents consistent with the MICS. These are the documents I 

submit today.

As a result, the TGWG proposal allows for appropriate flexibility for tribal gaming regulatory 

agencies and operations, subject to TGRA oversight, to establish specific controls, policies and 

procedures tailored to each operation’s individual circumstances. Still, because of the use of 

both MICS and guidance documents, these controls, etc., are subject to basic common standards.

Prior to the end of the Commission’s regulatory review, the TGWG will also submit a 

comprehensive set of checklists to complement each section of the proposed MICS. Taken 

together, we envision that these documents will provide a comprehensive set of unambiguous

standards that will facilitate the establishment of sound procedures centered around best practices 

in the modern context of Class II gaming. 

Before closing, I must note that this past Tuesday, July 26, 2011, the Treasury Department’s 

Financial Crimes Enforcement Center, or FinCEN, issued a final rule containing revisions to the 

Title 31 or Bank Secrecy Act Regulations. These revisions may require a revision to the 

TGWG’s proposed MICS, specifically Part 543.11, and the related guidance document. The 

TGWG considered delaying submission of the guidance documents until it had the opportunity 

to carefully review FinCEN’s revisions and make any necessary edits. Ultimately, it was 

decided that the wisest course would be to get the work product into the NIGC’s hands so that 

the Commission may commence its review. Be assured, however, that the TGWG will complete 

its review of the new Title 31 provisions and offer any necessary revisions to the MICS and 

MICS guidance documents within the next two weeks. It will also strive to finalize the attendant 

checklists and submit those as well.

Very quickly, I’d like to go over the content of package we are submitting. The core of the 

document consists of the guidance documents each of which contains the pertinent MICS 

section. There are two appendices, one containing the redline of the TGWG’s proposed MICS 

revision and the other containing a redline version of the TGWG’s proposed revisions to Part 

547, the Class II technical standards. Please note that in completing the guidance documents, the 

TGWG discovered that some additional revisions to the MICS were necessary. The redline 

version reflects both the previous revisions made by the TGWG and the additional revisions 

made since our initial submission. We have also included a reference guide for the 

Commission’s convenience. This reference guide contains a detailed explanation of the 

TGWG’s objectives in relation to these proposed revisions and the guidance documents.

In closing, we again wish to commend the NIGC for providing Indian Country the opportunity to 

participate in this important endeavor. 
Contents

Tab

Statement of Stephanie Bryan, Vice-Chair of the Poarch Band of Creek Indians

Table of Contents

Proposed Part 543 Minimum Internal Control Standards for Class II Gaming A

Guidance for Complying with Proposed Part 543 Minimum Internal Control Standards

543.7 Bingo B

543.8 Pull Tabs C

543.9 Card Games D

543.10 Gaming Promotions E

543.11 Patron Deposit Accounts and Cashless Systems F

543.12 Player Tracking Systems Used in Conjunction with Class II Gaming G

543.14 Cage, Vault, Cash and Cash Equivalents H

543.15 Lines of Credit I

543.16 Security and Management of Server, Server Software, and Data Associated 

with Class II Gaming Systems J

543.17 Complimentary Services or Items K

543.19 Audit and Accounting L

543.21 Drop and Count M

543.23 Surveillance N

Proposed MICS Reference Guide O

Proposed Part 547 Minimum Technical Standards for Gaming Equipment Used with the Play of 

Class II Games – May 2011 P

Appendices

Proposed Part 543 (Redline since May 2011 Submission of TGWG Proposed Part 543) 1

Proposed Part 547 (Redline versus existing Part 547 – May 2011) 2
TAB 

A
New TGWG Proposed Part 543 as of 7/28/2011

Page 1 of 34

PROPOSED PART 543 – MINIMUM INTERNAL CONTROL STANDARDS FOR 

CLASS II GAMING

Sec.

543.1 What does this part cover?

543.2 What are the definitions for this part?

543.3 How do tribal governments comply with this part?

543.4 What are the rules of interpretation and of general application for this part? 

543.5 [RESERVED]

543.6 Does this part apply to small and charitable gaming operations?

543.7 What are the minimum internal control standards for bingo?

543.8 What are the minimum internal control standards for pull tabs?

543.9 What are the minimum internal control standards for card games?

543.10 What are the minimum internal control standards for gaming promotions?

543.11 What are the minimum internal control standards for patron deposit accounts and 

cashless systems?

543.12 What are the minimum internal control standards for player tracking?

543.13 [RESERVED]

543.14 What are the minimum internal control standards for the cage, vault, cash and cash 

equivalents?

543.15 What are the minimum internal control standards for lines of credit?

543.16 What are the minimum internal control standards for security and management of 

server, server software and data associated with Class II gaming systems?

543.17 What are the minimum internal control standards for complimentary services or items?

543.18 How does a gaming operation apply for a variance from the standards of this part?

543.19 What are the minimum internal control standards for audit and accounting?

543.20 [RESERVED]

543.21 What are the minimum internal control standards for drop and count?

543.22 [RESERVED]

543.23 What are the minimum internal control standards for surveillance?

§ 543.1 What does this part cover?

This part establishes the minimum internal control standards for the conduct of Class II games on 

Indian lands as described in 25 U.S.C. 2701 et seq.

§ 543.2 What are the definitions for this part?

The definitions in this section apply to all sections of this part unless otherwise noted.

Accountability. All financial instruments, receivables, and patron deposits constituting the total 

amount for which the bankroll custodian is responsible at a given time.

Accumulated credit payout. Credit accrued in a player interface that is paid to a patron manually 

in lieu of a player interface payout (i.e. hand pay, manual pay).
New TGWG Proposed Part 543 as of 7/28/2011

Page 2 of 34

Agent. A person authorized by the gaming operation, as approved by the TGRA, to make 

decisions or perform assigned tasks or actions on behalf of the gaming operation. This definition 

permits the use of computer applications to perform the function(s) of an agent.

Bingo paper. A consumable physical object that has one or more bingo cards on its face.

Bingo sales. Sales transactions and/or the value of purchases made by players to participate in 

the game(s).

Cage. A secure work area within the gaming operation for cashiers which may include a storage 

area for the gaming operation bankroll.

Chairman. The Chairman of the National Indian Gaming Commission. 

Cash equivalents. Documents, financial instruments other than cash, or anything else of 

representative value to which the gaming operation has assigned a monetary value. A cash 

equivalent includes, but is not limited to, tokens, chips, coupons, vouchers, payout slips and 

tickets, and other items to which a gaming operation has assigned an exchange value.

Cashless system. A system that performs cashless transactions and maintains records of those 

cashless transactions.

Cashless transaction. A movement of funds electronically from one component to another, often 

to or from a patron deposit account, or promotional account.

Chips. Cash substitutes, in various denominations, issued by a gaming operation.

Class II game. Class II gaming shall have the same meaning as defined in 25 U.S.C. 2703(7)(A).

Class II Gaming System. All components, whether or not technologic aids in electronic, 

computer, mechanical, or other technologic form, that function together to aid the play of one or 

more Class II games including accounting functions mandated by these regulations Part 547 of 

this chapter.

Commission. The National Indian Gaming Commission established by the Indian Gaming 

Regulatory Act, 25 U.S.C. 2701 et seq.

Complimentary. A service or item provided at no or reduced cost, to a patron.

Count. The act of counting and recording the drop and/or other funds. Also, the total funds 

counted for a particular game, player interface, shift, or other period.

Count room. A secured room location where the count is performed in which the cash and cash 

equivalents are counted.
New TGWG Proposed Part 543 as of 7/28/2011

Page 3 of 34

Credit line (see Lines of credit). The privilege granted by a gaming operation to a patron to (1) 

defer payment of debt or (2) to incur debt and defer its payment under specific terms and 

conditions.

Credit line limit. The maximum dollar amount of credit assigned to a patron by the gaming 

operation.

Dedicated camera. A video camera that continuously records a specific activity.

Drop. The process of removing the drop boxes from the player interface or point of purchase.

Drop proceeds. The total amount of financial instruments removed from the drop boxes.

Drop box. A locked container in which cash or cash equivalents are placed at the time of the 

transaction. 

Exception Report. A listing of occurrences, transactions or items that fall outside a 

predetermined range of acceptability.

Financial instrument. Any tangible item of value tendered in Class II game play, including, but 

not limited to bills, coins, vouchers, and coupons.

Gaming Promotion. A type of marketing activity conducted by a gaming operation which 

includes two, but not all three, of the following elements: prize, chance, consideration.

Generally Accepted Accounting Principles (GAAP). A widely accepted set of rules, conventions, 

standards, and procedures for reporting financial information, as established by the Financial 

Accounting Standards Board (FASB), including but not limited to the standards for casino 

accounting published by the American Institute of Certified Public Accountant (AICPA).

Governmental Accounting Standards Board (GASB). Generally accepted accounting principles 

used by state and local governments.

Independent. The separation of functions so that the person or process monitoring, reviewing or 

authorizing the controlled activity, function, transaction is separate from the persons or process 

performing the controlled activity, function, transaction.

Lines of credit. The privilege granted by a gaming operation to a patron to (1) defer payment of 

debt or (2) to incur debt and defer its payment under specific terms and conditions.

Manual payout. Hand payment to a player.

Marker. A document, signed by the patron promising to repay credit issued by the gaming 

operation.
New TGWG Proposed Part 543 as of 7/28/2011

Page 4 of 34

MICS. Minimum internal control standards in this part.

Patron. A person who is a customer or guest of the gaming operation and may interact with a 

Class II game. Also may be referred to as a “player”.

Patron deposit account. An account maintained on behalf of a patron, for the purpose of 

depositing and withdrawing funds for the primary purpose of interacting with a gaming activity.

Permanent Record. Those records that must be maintained for a minimum period of 5 years, 

including all documents that contain original signatures or represent audit papers.

Player interface. Any component(s) or components of a Class II gaming system, including an 

electronic or technological aid (not limited to terminals, player stations, handhelds, fixed units, 

etc.), that directly enables player interaction in a Class II game.

Prize payout. Payment to a player associated with a winning or qualifying event.

Promotional progressive pots and/or pools. Funds contributed to a game by and for the benefit 

of players and are distributed to players based on a predetermined event.

Restricted patron deposit account. An account that can be accessed only by a specific patron 

using a secured method.

SSAE. Standards for Attestation Engagements.

Shift. A time period, unless otherwise approved by the tribal gaming regulatory authority, not to 

exceed 24 hours.

Shill. An agent financed by the gaming operation and acting as a player.

Short pay. The payment of the unpaid balance of an incomplete payout.

System of Internal Controls (SICS). An overall operational framework for a gaming operation 

incorporating principles of independence and segregation of function comprised of written 

policies, procedures, and standard practices based on overarching regulatory standards 

specifically designed to create a system of checks and balances in order to safeguard the integrity 

of a gaming operation and protect its assets. 

Smart card. A card with embedded integrated circuits that possesses the means to electronically 

store or retrieve account data, and is the only source of that data.

Surveillance operation room(s). The secured area(s) where surveillance is taking place and/or 

where active surveillance equipment is located.
New TGWG Proposed Part 543 as of 7/28/2011

Page 5 of 34

Surveillance system. A system of video cameras, monitors, recorders, video printers, switches, 

selectors, and other ancillary equipment used for surveillance.

Tier A. Gaming operations with annual gross gaming revenues of more than $3 million but not 

more than $8 million.

Tier B. Gaming operations with annual gross gaming revenues of more than $8 million but not 

more than $15 million.

Tier C. Gaming operations with annual gross gaming revenues of more than $15 million.

TGRA. Tribal gaming regulatory authority which is the entity authorized by tribal law to regulate 

gaming conducted pursuant to the Indian Gaming Regulatory Act.

TICS. Tribal Internal Control Standards.

Unrestricted patron deposit account. An account that may be accessed by the holder of the 

account number.

Vault. A secure area where cash and cash equivalents are stored.

§ 543.3 How do tribal governments comply with this part?

(a) Determination of Tier. 

(1) The determination of tier level shall be made based upon the annual gross gaming 

revenues indicated within the gaming operation's audited financial statements. 

(2) Gaming operations moving from one tier to another shall have nine (9) months from 

the date of the independent certified public accountant's audit report to achieve 

compliance with the requirements of the new tier. The TGRA may extend the deadline 

by an additional six (6) months if written notice is provided to the Commission no later 

than two (2) weeks before the expiration of the nine (9) month period.

(b) TICS. TGRAs shall ensure that TICS are established and implemented that provide a level of 

control that equals or exceeds those set forth in this part.

(1) Evaluation of Existing TICS. Each TGRA must, in accordance with the tribal gaming 

ordinance, determine whether and to what extent their TICS require revision to ensure 

compliance with this part. 

(2) Compliance Date. All changes necessary to ensure compliance with this part shall be 

promulgated within twelve (12) months from the effective date of this part and 

implemented at the commencement at the next fiscal year. At the discretion of the 
New TGWG Proposed Part 543 as of 7/28/2011

Page 6 of 34

TGRA, gaming operations may have an additional six (6) months to come into 

compliance with the TICS.

(c) SICS. Each gaming operation must develop and implement a SICS that, at a minimum, 

complies with the TICS.

(1) Existing gaming operations. All gaming operations that are operating on or before the 

effective date of this part, must comply with this part within the time requirements 

established in paragraph (b) of this section. In the interim, such operations must continue 

to comply with existing TICS.

(2) New gaming operations. All gaming operations that commence operations after the 

effective date of this part, must comply with this part before commencement of 

operations.

(d) Submission to Commission. Tribal regulations promulgated pursuant to this part are not 

required to be submitted to the Commission pursuant to Sec. 522.3(b) of this chapter.

(e) Enforcement of Commission MICS.

(1) Each TGRA is required to establish and implement TICS pursuant to paragraph (b) of 

this section. Each gaming operation is then required, pursuant to paragraph (c) of this 

section, to develop and implement a SICS that complies with the TICS. Failure to do so 

may subject the tribal operator of the gaming operation, or the management contractor, to 

penalties under 25 U.S.C. 2713.

(2) Recognizing that tribes are the primary regulator of their gaming operation(s), 

enforcement action by the Commission will not be initiated under this part without first 

informing the tribe and TGRA of deficiencies in the SICS of its gaming operation and 

allowing a reasonable period of time to address such deficiencies. Such prior notice and 

opportunity for corrective action is not required where the threat to the integrity of the 

gaming operation is immediate and severe.

§ 543.4 What are the rules of interpretation and of general application for this part? 

(a) Minimum Standards. A TGRA may establish and implement additional technical standards 

that are as stringent as, or more stringent than, those set out in this part. 

(b) Only Applicable Standards Apply. Gaming equipment and software used with Class II 

gaming systems shall meet all applicable requirements of this part. For example, if a gaming 

operation does not offer lines of credit, then any standards that govern credit do not apply. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 7 of 34

(c) No Limitation of Technology. This part should not be interpreted to limit the use of 

technology or to preclude the use of technology not specifically referenced. 

(d) Severability. If any provision of this part is declared invalid by a court of competent 

jurisdiction, such decision shall not affect the remainder of this part. 

§ 543.5 [RESERVED]

§ 543.6 Does this part apply to small and charitable gaming operations?

(a) Small Gaming Operations. This part does not apply to small gaming operations provided that:

(1) The TGRA permits the operation to be exempt from this part;

(2) The annual gross gaming revenue of the operation does not exceed $3 million; and

(3) The TGRA develops and the operation complies with alternate procedures that:

(i) Protect the integrity of games offered;

(ii) Safeguard the assets used in connection with the operation; and

(iii) Create, prepare and maintain records in accordance with Generally Accepted 

Accounting Principles.

(b) Charitable Gaming Operations. This part does not apply to charitable gaming operations 

provided that:

(1) All proceeds are for the benefit of a charitable organization;

(2) The TGRA permits the charitable organization to be exempt from this part;

(3) The charitable gaming operation is operated wholly by the charitable organization‟s 

agents;

(4) The annual gross gaming revenue of the charitable operation does not exceed $3 

million; and

(5) The TGRA develops and the charitable gaming operation complies with alternate 

procedures that:

(i) Protect the integrity of the games offered;

(ii) Safeguard the assets used in connection with the gaming operation; and
New TGWG Proposed Part 543 as of 7/28/2011

Page 8 of 34

(iii) Create, prepare and maintain records in accordance with Generally Accepted 

Accounting Principles. For more information please see www.fasb.gov or 

www.fasb.org.

(c) Independent Operators. Nothing in this section exempts gaming operations conducted by 

independent operators for the benefit of a charitable organization.

§ 543.7 What are the minimum internal control standards for bingo?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. (d) Supervision. Supervision shall be 

provided for bingo operations as needed by an agent(s) with authority equal to or greater than 

those being supervised.

(e) Bingo Cards.

(1) Physical Inventory. 

(i) The bingo card inventory must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls shall 

address bingo cards exchanged between agents, increases and decreases to 

inventory, and inventory reconciliation.

(2) Sales. 

(i) The sale of bingo cards must be controlled in a manner to adequately record, 

track, and reconcile such sales, including voids. 

(ii) When the sale of bingo cards is recorded manually, such sales must be

verified by an independent agent. 

(iii) No unauthorized person shall have access to bingo card sales records.

(f) Draw.
New TGWG Proposed Part 543 as of 7/28/2011

Page 9 of 34

(1) Controls must be established requiring that all objects eligible for the draw are 

available to be drawn.

(2) The draw must be controlled in a manner that ensures random selection of the objects 

drawn.

(3) The draw must be controlled in a manner that ensures the identity of each object 

drawn is accurately recorded and transmitted to the participants.

(g) Payouts.

(1) Payouts must be controlled in a manner designed to verify winning events and prevent 

unauthorized access to, or misappropriation of, cash or cash equivalents. Such controls 

shall include, but not be limited to, the following:

(i) Payout records;

(ii) Validation and Verification;

(iii) Authorization or signatures; and

(iv) Voids.

(h) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.

(i) Technologic Aids to the Play of Bingo. Internal control procedures must be established to 

safeguard the integrity of technologic aids to the play of bingo during installations, operations, 

modifications, and retirements. Such procedures must include, but not be limited to, the 

following:

(1) Shipping and receiving;

(2) Access credential control methods; 

(3) Record keeping and audit processes; 

(4) System software signature verification; 

(5) Testing;

(6) Display of rules and necessary disclaimers such as “Malfunctions void all pays and 

plays.", etc.
New TGWG Proposed Part 543 as of 7/28/2011

Page 10 of 34

(7) Dispute resolution; 

(8) Malfunctions; and

(9) Removal, retirement, and/or destruction.

§ 543.8 What are the minimum internal control standards for pull tabs?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the pull tab operations and over the pull 

tab storage areas by an agent(s) with authority equal to or greater than those being supervised.

(e) Pull Tab Inventory. The pull tab inventory must be controlled in a manner designed to 

prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls shall 

address tabs exchanged between agents, increases and decreases to inventory, and inventory 

reconciliation.

(f) Pull Tab Sales. 

(1) Pull tab sales must be controlled in a manner to adequately record, track, and 

reconcile all pull tab sales and voids.

(2) When pull tab sales are recorded manually, total sales are verified by an agent 

independent of the pull tab sales being verified. 

(3) No person shall have unrestricted access to pull tab sales records.

(g) Winning Pull Tabs. 

(1) Redeemed pull tabs must be controlled in a manner to adequately record, track, and 

reconcile all pull tab payouts.

(2) The redeemed pull tabs shall be defaced so that they cannot be redeemed for payment 

again.
New TGWG Proposed Part 543 as of 7/28/2011

Page 11 of 34

(h) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.

§ 543.9 What are the minimum internal control standards for card games?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the card room operations by an agent(s) 

with authority equal to or greater than those being supervised.

(e) Inventory of Playing Cards. The playing card inventory must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls 

shall address cards exchanged between agents, increases and decreases to inventory, and 

inventory reconciliation.

(f) Shill Funds. Issuance and return of shill funds shall be recorded and have the written approval 

of another agent.

(g) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.

(h) Posted Rules. The rules shall be displayed or available for patron review at the gaming 

operation, including rules governing contests, prize payouts, fees, etc. 

(i) Promotional Progressive Pots and Pools such as Contests, Tournaments, Drawings and 

Giveaway Programs. Funds contributed by patrons to prize pools shall be returned and 

documented in accordance with the posted rules.
New TGWG Proposed Part 543 as of 7/28/2011

Page 12 of 34

(1) Promotional pool contributions shall be controlled in a manner to properly distinguish 

between gaming revenue and promotional pool contributions. 

(i) Promotional pool contributions shall be placed in a locked container;

(ii) Agents transporting the locked container shall be precluded from having 

access to the contents keys. 

(2) At least once a week, increases and decreases to the promotional pool amount shall be 

verified, supported by documentation, recorded and reconciled to the cash by an agent 

independent of the card room.

§ 543.10 What are the minimum internal control standards for gaming promotions?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for gaming promotions as needed by an agent(s) 

with authority equal to or greater than those being supervised.

(e) Gaming Promotions. Controls must be established in a manner designed to prevent 

unauthorized access, cheating, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following:

(1) Rules of the gaming promotion;

(2) Gaming promotion accounting; and 

(3) TGRA approval.

§ 543.11 What are the minimum internal control standards for patron deposit accounts 

and cashless systems?
New TGWG Proposed Part 543 as of 7/28/2011

Page 13 of 34

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Conflicts of Standards. If there are any inconsistencies between these regulations and external 

standards incorporated by this provision, such as Title 31 and Credit Card Act, such other 

applicable standards shall prevail.

(d) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(e) Patron Deposit Accounts and Cashless Systems.

(1) Patron deposit accounts and cashless systems must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. 

(2) All smart cards (i.e., cards that possess the means to electronically store or retrieve 

data) that maintain the only source of account data are prohibited.

(3) Patron deposit accounts may be unrestricted or restricted to a specific patron.

(4) Establishment of patron deposit accounts. The following standards apply when the 

patron establishes an account and optionally makes an initial deposit.

(i) For restricted patron deposit accounts:

(A) The patron must appear at the gaming operation in person, at a 

designated area of accountability, and present a valid government issued 

picture identification credential. 

(B) An agent must examine the patron‟s identification and record, at a 

minimum, the following information:

(1) Type, number, and expiration date of the identification; 

(2) Patron‟s name; 

(3) A unique account identifier; 

(4) Date the account was opened; and 
New TGWG Proposed Part 543 as of 7/28/2011

Page 14 of 34

(5) The agent‟s name. 

(C) The agent must require the patron to sign the account documentation 

before the account is activated.

(D) The agent or cashless system shall provide the patron deposit account 

holder with a secure method of access.

(ii) For unrestricted patron deposit accounts:

(A) The patron must be informed of the unrestricted nature of the account, 

and the fact that the account may be accessible to anyone with the account 

number.

(B) The patron must acknowledge and accept the risks associated with 

unrestricted accounts.

(5) Patron deposits, withdrawals and adjustments. 

(i) Prior to the patron making a deposit or a withdrawal from a patron deposit 

account, the agent or cashless system must verify the identity of the patron deposit 

account, the patron identity for restricted accounts, and availability of funds. 

Reliance on a secured personal identification number (PIN) entered by the patron 

is an acceptable method of verifying patron identity.

(ii) Adjustments made to the patron deposit accounts must be performed by an 

agent.

(iii) When a deposit, withdrawal or adjustment is processed by an agent, a multipart transaction record must be created containing the following information: 

(A) Same document number on all copies;

(B) Type of transaction, (e.g., deposit, withdrawal, or adjustment);

(C) Name or other identifier of the patron for restricted patron deposit 

accounts;

(D) The unique account identifier;

(E) Patron signature for withdrawals, unless a secured method of access is 

utilized;

(F) Date and time of transaction;
New TGWG Proposed Part 543 as of 7/28/2011

Page 15 of 34

(G) Dollar amount of transaction;

(H) Nature of deposit, withdrawal, or adjustment (e.g., cash, check, chips); 

and

(I) Signature of the agent processing the transaction.

(iv) When a patron deposits or withdraws funds from a patron deposit account 

electronically, the following shall be recorded and reported:

(A) Date and time of transaction;

(B) Location (e.g., player interface, kiosk);

(C) Dollar amount of transaction; and

(D) The unique account identifier.

(v) Detailed patron deposit account transaction records must be available to the 

patron upon reasonable request.

(vi) If electronic funds transfers are made to or from a gaming operation bank 

account for patron deposit account funds, the bank account must be dedicated and 

may not be used for any other types of transactions.

§ 543.12 What are the minimum internal control standards for player tracking systems 

used in conjunction with Class II gaming?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each 

gaming operation shall establish, implement and adhere to internal control policies and 

procedures that provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Player Tracking Systems. Controls must be established in a manner designed to prevent 

unauthorized access, cheating, misappropriation, forgery, theft, or fraud when a player tracking 

system is used in conjunction with Class II gaming. Such controls must include, but not be 

limited to, the following:
New TGWG Proposed Part 543 as of 7/28/2011

Page 16 of 34

(1) Operation of player tracking programs;

(2) Security of player tracking accounts; and

(3) Audit and accounting.

§ 543.13 [RESERVED]

§ 543.14 What are the minimum internal control standards for the cage, vault, cash and 

cash equivalents?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Provide supervision for cage, vault, and other operations using cash or cash 

equivalents as needed by an agent(s) with authority equal to or greater than those being 

supervised.

(e) Cash and Cash Equivalent Controls. 

(1) Cash and cash equivalents must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following actions:

(i) Counting;

(ii) Recording increases and decreases to inventory;

(iii) Inventory reconciliation;

(iv) Issuance and redemption;

(v) Transfers;

(vi) Inspecting, validating and verifying;

(vii) Cancelations and voids;
New TGWG Proposed Part 543 as of 7/28/2011

Page 17 of 34

(viii) Authorization; and

(ix) Document retention.

(f) Check Cashing. Check cashing must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must include, but 

not be limited to, the following:

(1) Acceptance of checks;

(2) Deposit of checks (Checks not deposited in the normal course of business are subject 

to § 543.15 Lines of Credit standards).

(3) Collecting and recording returned checks; 

(4) Re-deposit; and 

(5) Write-off authorization.

(6) If a third party check cashing or guarantee service is used, the examination and 

documentation procedures required by the service provider shall apply unless otherwise 

provided by tribal law or regulation. 

(g) Cage and Vault Accountability. 

(1) Increases and decreases to cage inventory shall be verified, supported by 

documentation, and recorded. Unverified transfers of cash and/or cash equivalents are 

prohibited. 

(2) The cage and vault inventories (including coin rooms/vaults) shall be counted 

independently by at least two agents, attested to by signature, and recorded in ink or other 

permanent form at the end of each shift during which activity took place. 

(h) Chip(s) and Token(s). Controls must be established to ensure accountability of chip and 

token inventory. Such controls must include, but not be limited to, the following:

(1) Purchase;

(2) Receipt;

(3) Inventory;

(4) Storage; and 

(5) Destruction.
New TGWG Proposed Part 543 as of 7/28/2011

Page 18 of 34

(i) Cage and Vault Access. Controls must be established in a manner designed to prevent 

unauthorized access, misappropriation, forgery or fraud. Such controls must include, but not be 

limited to, the following:

(1) Physical access to the cage to cage department agents, designated staff, and other 

persons authorized; and

(2) Transportation of extraneous items (e.g., personal belongings, tool boxes, beverage 

containers, etc.) into and out of the cage.

§ 543.15 What are the minimum internal control standards for lines of credit?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Establishment of Lines of Credit Policy. 

(1) If a gaming operation extends lines of credit, controls must be established to 

safeguard the assets of the gaming operation. Such controls must include the 

establishment of a lines of credit policy including the following:

(i) A process for the patron to apply for, modify, and/or re-establish lines of 

credit, to include required documentation and credit line limit;

(ii) Credit issuer authorization levels;

(iii) Identification of agents authorized to issue lines of credit;

(iv) A process for verifying lines of credit worthiness of applicants; 

(v) A system for recording patron information; to include:

(A) Name, current address, and signature;

(B) Identification credential;

(C) Authorized credit line limit; and
New TGWG Proposed Part 543 as of 7/28/2011

Page 19 of 34

(D) Approval by an agent authorized to approve credit line limits;

(vi) A process for issuing lines of credit to include the following: 

(A) Notice to patron of lines of credit terms including patron written 

acknowledgment by signature;

(B) Completion of a uniquely identified, multi-part, lines of credit 

issuance form, such as a marker or counter check, which includes the 

terms of that lines of credit transaction;

(C) Signatory requirements;

(D) Determining the amount of the patron‟s available lines of credit;

(E) Creation and maintenance of current lines of credit balance record 

updated at the time of each transaction to assure that lines of credit issued 

is within the established limit and balance for that patron. 

(F) Requirement that the agent issuing the lines of credit must be 

independent of the agent who authorized the lines of credit.

(vii) A policy establishing credit line limit exceptions to include the following:

(A) Identification of the agent(s) authorized to permit a credit line limit to 

be exceeded; 

(B) Authorization thresholds; and

(C) Required documentation.

(viii) A policy governing increases and decreases to a patron‟s lines of credit 

account balances to include the following:

(A) Documentation and record keeping requirements;

(B) Independence between the department that receives the payment and 

the department that maintains custody of the credit balance for payments 

made by mail; 

(C) Collections;

(D) Periodic audits and confirmation of balances; and
New TGWG Proposed Part 543 as of 7/28/2011

Page 20 of 34

(E) If a collection agency is utilized, a process to ensure documentation of 

increases and decreases to the lines of credit account balances.

(ix) A policy governing write-offs and settlements to include:

(A) Identification of agent(s) authorized to approve write-offs and 

settlements;

(B) Authorization levels for write-offs and settlements of lines of credit 

instruments;

(C) Required documentation for write-offs and settlements;

(D) Independence between the agent who established the lines of credit 

and the agent writing off or settling the lines of credit instrument. 

(E) Necessary documentation for the approval of write-offs and 

settlements and transmittal to the appropriate department for recording and 

deductibility.

§ 543.16 What are the minimum internal control standards for security and management 

of server, server software and data associated with Class II gaming systems?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Class II Gaming systems and Physical Controls. Controls must be established to ensure:

(1) Control of physical and logical access to server, server software and data associated 

with Class II gaming systems, including accounting, voucher, cashless and player 

tracking, among others used in conjunction with Class II gaming;

(2) Physical and logical protection of storage media and its contents, including recovery 

procedures;

(3) Access credential control methods; 

(4) Record keeping and audit processes; and
New TGWG Proposed Part 543 as of 7/28/2011

Page 21 of 34

(5) Departmental independence, including, but not limited to, means to restrict agents that 

have access to server, server software and data from having access to financial

instruments.

(d) Independence. All personnel having access to Class II gaming servers, server software 

and/or data are independent of and restricted from access to:

(1) Financial instruments (e.g. cash, cash equivalents, vouchers, and coupons);

(2) Signatory authority over financial instruments and payouts forms; and

(3) Accounting, audit, and ledger entries.

§ 543.17 What are the minimum internal control standards for complimentary services or 

items?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for approval of complimentary services as 

needed by an agent(s) with authority equal to or greater than those being supervised.

(e) Complimentary Services or Items. Controls must be established in a manner designed to 

prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following:

(1) How the gaming operation delegates to its personnel the authority to approve the 

issuance of complimentary services or items, including levels of authorization for the 

agents approving the issuance of complimentary services or items;

(2) Written limits and conditions on the approval and issuance of complimentary services 

or items, and how the conditions or limits of authority may be modified;

(3) Documentation and recordation requirements for the authorization, issuance, and 

tracking of complimentary services or items, including cash and non-cash gifts; 
New TGWG Proposed Part 543 as of 7/28/2011

Page 22 of 34

(i) Complimentary issuance records shall include the following for all 

complimentary items and services equal to or exceeding an amount established by 

the TGRA.

(A) Name of patron who received the complimentary service or item;

(B) Name(s) of issuer of the complimentary service or item;

(C) The actual cash value of the complimentary service or item;

(D) The type of complimentary service or item (i.e., food, beverage, etc.); 

and

(E) Date the complimentary service or item was issued.

(ii) Reserved.

§ 543.18 How does a gaming operation apply for a variance from the standards of this 

part?

(a) Variance.

(1) Should a TGRA grant a variance to any provision of these MICS, the TGRA shall 

deliver a notice of the same to the Commission within ten (10) days of such approval.

(i) The notice shall contain a complete copy of the information presented to the 

TGRA and the variance as granted.

(ii) The notice shall be forwarded to the Commission within ten (10) days of the 

granting of the Variance.

(2) During a thirty (30) day period when the Commission first receives the notice 

required by this subpart, the Chairman may request additional information from the 

TGRA concerning the subject of variance. Such request shall suspend the thirty (30) day 

period until the Chairman receives the TGRA response.

(b) Commission Review.

(1) Within the thirty (30) day review period, the Commission may:

(i) Advise the TGRA, in writing, that it has no objection.

(ii) Provide the TGRA a written statement itemizing its objections. 

(iii) Take no action, in which case, the TGRA‟s variance shall be final. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 23 of 34

(2) If the Commission has provided the TGRA a statement itemizing objections to the 

variance: 

(i) The TGRA shall reconsider the variance taking into account the objections 

itemized by the Commission.

(ii) The TGRA may seek reconsideration by submitting a request to the Chairman 

and members of the Commission.

(iii) Upon receipt of a request for reconsideration, the Commission shall conduct 

an informal hearing with the TGRA within 30 days, which may be conducted in 

person or through the exchange of documents, as requested by the TGRA.

(iv) After the informal hearing, the Commission must issue a written decision 

within 14 days. If the Commission disapproves the variance, such written decision 

must include an explanation of why the requested variance creates an imminent 

threat to the integrity of the tribal gaming operation.

§ 543. 19 What are the minimum internal control standards for audit and accounting?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Conflicts of Standards. When establishing SICS the gaming operation should review and 

consider incorporation of other external standards such as GAAP, SSAE, and standards 

promulgated by GASB and FASB. Accordingly, in the event of a conflict between the MICS and 

the incorporated external standards, the external standards prevail. 

(d) Operational Audits (formerly “Revenue Audit”). Controls shall be established to ensure:

(1) All audits are designed in a manner to detect unauthorized access, misappropriation, 

forgery, theft, or fraud.

(2) All audits are performed within seven (7) days of the audited activity‟s occurrence as 

follows, unless otherwise specified:

(i) Gaming revenue and payouts;
New TGWG Proposed Part 543 as of 7/28/2011

Page 24 of 34

(ii) Increases and decreases to inventory;

(iii) Cash equivalent inventory count;

(iv) Exceptions, overrides, and voids;

(v) Complimentary services and items records (Weekly);

(vi) Manual increases and decreases to/from player accounts (Weekly);

(vii) Promotions, contests, and tournaments (Weekly); and

(viii) Key control records (Quarterly).

(3) Minimum bankroll calculations are audited periodically to ensure that the gaming 

operation maintains cash in an amount sufficient to satisfy the gaming operation‟s 

obligations. 

(4) At least bi-annually, an inventory of all drop, count, override, and panel keys are 

performed and increases and decreases in key inventory are reconciled.

(5) Audit results are summarized and recorded. 

(6) Audit controlled inventories for recording the receipt, issuance, and use of controlled 

inventories (including but not limited to bingo cards, pull tabs, playing cards, keys, prenumbered and/or multi-part forms, etc.).

(7) Adjustments to original data are controlled to ensure all adjustments are properly 

completed and documented. 

(8) Exceptions are reviewed for suspect and/or unusual transactions.

(9) Documentation must be generated and maintained evidencing the performance of 

audit procedures. 

(10) If the audit is not performed by accounting agents, the agent(s) performing the audit 

are independent of the agents who performed the transactions being reviewed.

(e) Accounting. Controls must be established to ensure each gaming operation:

(1) Prepares accurate, complete, legible, and permanent records of all transactions 

pertaining to gaming revenue.

(2) Prepares general accounting records on a double-entry system of accounting, 

maintaining detailed, supporting, subsidiary records, and perform the following: 
New TGWG Proposed Part 543 as of 7/28/2011

Page 25 of 34

(i) Record gaming activity transactions in an accounting system to identify and 

track all revenues, expenses, assets, and liabilities;

(ii) Produce income and balance sheet statements;

(iii) Produce appropriate subsidiary ledgers to support the balance sheet;

(iv) Inventory and safeguard assets;

(v) Prepare, review, and maintain accurate financial statements;

(vi) Prepare minimum bankroll calculations; and

(vii) Maintain and preserve all financial books, records, and relevant supporting 

documentation.

(f) Internal Audit. Controls shall be established to ensure:

(1) Internal auditor(s) perform audits of each department of a gaming operation, at least 

annually, to review compliance with TICS, SICS, and these MICS.

(2) Internal auditor(s) are independent of the gaming operations with respect to the 

departments subject to audit (auditors internal to the operation, officers of the TGRA, or 

outside CPA firm may perform this function).

(3) Internal auditors report directly to the Tribe, TGRA, audit committee, or other entity 

designated by the Tribe.

(4) Documentation (e.g., checklists, programs, reports, etc.) is prepared to evidence all 

internal audit work and follow-up performed as it relates to compliance with TICS, SICS, 

and these MICS.

(5) Reports documenting audits performed are maintained and made available to the 

Commission upon request.

(6) All material exceptions resulting from internal audit work are investigated and 

resolved with the results documented.

(7) Internal audit findings are reported to management, responded to by management in 

the internal audit report stating corrective measures to be taken, and delivered to 

management, the Tribe, TGRA, audit committee, or other entity designated by the Tribe.

(g) Annual Audits.
New TGWG Proposed Part 543 as of 7/28/2011

Page 26 of 34

(1) Agreed upon procedures. A CPA must be engaged to perform, in accordance with 

agreed upon procedures and the most recent versions of the Statements on Standards for 

Attestation Engagements and Agreed-Upon Procedures Engagements (collectively 

„„SSAE‟s‟‟), issued by the American Institute of Certified Public Accountants Inc., an 

assessment of whether the gaming operation is in compliance with these MICS, the TICS, 

and/or the SICS.

(2) The tribe must submit two copies of the agreed-upon procedures report to the 

Commission within 120 days of the gaming operation‟s fiscal year end in conjunction 

with the submission of the annual financial audit report required under 25 CFR Part 571.

(3) Require management to have sufficient knowledge and understanding of the purpose, 

nature, and scope of the agreed upon procedures to provide adequate oversight and 

participation in the process to ensure a meaningful and useful outcome.

(4) Reliance on Internal Audit. 

(i) Agreed upon procedures are to be performed by the CPA to determine that the 

internal audit procedures performed during the fiscal year have been properly 

completed. 

(ii) The CPA may rely on the work of internal audit for the completion of the 

MICS checklists as they relate to the standards covered by this Part.

(5) Report Format. The Statements on Standards for Attestation Engagements and 

Agreed-Upon Procedure Engagements (SSAE‟s) are applicable to agreed-upon 

procedures engagements required in this Part. All noted instances of noncompliance must 

be documented in the report with a narrative description, the number of exceptions and 

sample size tested.

§ 543.20 [RESERVED]

§ 543.21 What are the minimum internal control standards for drop and count?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.
New TGWG Proposed Part 543 as of 7/28/2011

Page 27 of 34

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for drop and count as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(e) Count Room Access. Controls must be established to limit physical access to the count room 

to count team agents, designated staff, and other authorized persons. Such controls must include, 

but not be limited to, the following:

(1) Count team agents shall not be allowed to exit or enter the count room during the 

count except for emergencies or scheduled breaks.

(2) Surveillance shall be notified whenever count room agents exit or enter the count 

room during the count.

(3) The count team policy, at a minimum, shall address the transportation of extraneous 

items (e.g., personal belongings, tool boxes, beverage containers, etc.) into or out of the 

count room.

(f) Count team. Controls must be established in a manner designed to ensure security of the 

count and the count room to prevent unauthorized access, misappropriation of funds, forgery, 

theft, or fraud. Such controls must include, but not be limited to, the following:

(1) For Tier A and B operations, all counts shall be performed by a minimum of two (2) 

agents. For Tier C operations, all counts shall be performed by a minimum of three (3) 

agents.

(2) For Tier A and B operations, at no time during the count shall there be fewer than two 

(2) count team agents in the count room until the drop proceeds have been accepted into 

cage/vault accountability. For Tier C operations, at no time during the count shall there 

be fewer than three (3) count team agents in the count room until the drop proceeds have 

been accepted into cage/vault accountability.

(3) For Tier A and B operations, count team agents shall be rotated on a routine basis 

such that the count team is not consistently the same two (2) agents more than four (4) 

days per week. This standard shall not apply to gaming operations that utilize a count 

team of more than two (2) agents. For Tier C operations, count team agents shall be 

rotated on a routine basis such that the count team is not consistently the same three (3) 

agents more than four (4) days per week. This standard shall not apply to gaming 

operations that utilize a count team of more than three (3) agents.

(4) Functions performed by count team agents shall be rotated on a routine basis.
New TGWG Proposed Part 543 as of 7/28/2011

Page 28 of 34

(5) Count team agents shall be independent of the department being counted and the 

cage/vault departments. An accounting agent may be used if there is an independent audit 

of all count documentation.

(g) Drop. Controls must be established in a manner designed to ensure security of the drop 

process to prevent unauthorized access to gaming equipment and the drop, misappropriation of 

funds, forgery, theft, or fraud. Such controls must include, but not be limited to, the following:

(1) Drop schedules and periods, including procedure to continue drop once started 

through completion.

(2) Security during transport of drop boxes, including escort by a minimum of two (2) 

agents, at least one of whom is independent of the revenue being dropped.

(3) All drop boxes shall be uniquely identified to correspond with the card table, player 

interface, and/or other location from which the drop box was removed.

(4) Security over drop boxes removed and awaiting transport to the count room.

(5) Security of drop boxes until the count takes place.

(6) Notification to surveillance when a drop is to begin.

(7) Provisions for emergency drop. 

(h) Count. Controls must be established in a manner designed to ensure security of the count 

process to prevent unauthorized access to count equipment and the drop, misappropriation of 

funds, improper manipulation of financial records, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following:

(1) Establishment of a dedicated count room;

(2) Manual count process;

(3) Utilization, testing, and calibration of counters and/or validation systems; 

(4) Verification of count;

(5) Prevention of the comingling of funds until recorded per drop box; 

(6) Accurate and permanent forms of recordation for all cash and cash equivalents and 

rejected cash or cash equivalents;

(7) For card game counts, additional controls, as applicable, shall be established and 

procedures implemented to ensure:
New TGWG Proposed Part 543 as of 7/28/2011

Page 29 of 34

(i) Fills/credits, marker issue/payment slips are recorded and forwarded to the 

appropriate department for verification and reconciliation. 

(ii) Opening/closing card table inventory forms are examined and traced to or 

recorded on the appropriate documentation with discrepancies investigated and 

results documented.

(8) The reconciliation of count records to the total drop, which shall address, but not be 

limited to:

(i) Signature of each agent of the count team attesting to their participation in the 

count;

(ii) Reconciliation of the total drop by a count team agent who shall not function 

as the sole recorder; and 

(iii) Documentation of all unresolved variances.

(9) Transfer of the drop following the count.

(10) All cash and cash equivalent inventory stored in the count room shall be secured 

from unauthorized access at all times.

(11) Access to stored drop boxes, full or empty.

(i) Controlled keys or equivalents. Controls shall be established and procedures implemented to 

safeguard the use, access, and security of keys or other access methods in accordance with the 

following:

(1) Each of the following requires a separate and unique key lock or alternative secure 

access method:

(i) Drop cabinet;

(ii) Drop box release;

(iii) Drop box content; and

(iv) Storage racks and carts.

(2) Access to and return of keys or equivalents shall be documented with the date, time, 

and signature or other unique identifier of the agent accessing or returning the key(s).
New TGWG Proposed Part 543 as of 7/28/2011

Page 30 of 34

(i) For Tier A and B operations, at least two (2) drop team agents are required to 

be present to access and return keys. For Tier C operations, at least three (3) drop 

team agents are required to be present to access and return keys. 

(ii) For Tier A and B operations, at least two (2) count team agents are required to 

be present at the time count room and other count keys are issued for the count. 

For Tier C operations, at least three (two for card game drop box keys in 

operations with three tables or fewer) count team agents are required to be present 

at the time count room and other count keys are issued for the count.

(3) Where an alternative access method is utilized, the use of such method shall be 

controlled in a manner consistent with the objectives of this standard.

(4) Documentation of all keys, including duplicates, shall be maintained including:

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(5) Custody of all keys involved in the drop and count shall be maintained by a 

department independent of the count and drop agents and those departments being 

dropped and counted.

(6) Other than the count team, no agent shall have access to the drop box content keys 

while in possession of storage rack keys and/or release keys.

(7) Other than the count team, only agents authorized to remove drop boxes are allowed 

access to drop box release keys. 

(8) Utilization of keys at times other than the scheduled drop and count must be properly 

authorized and documented. 

(9) Emergency manual keys (i.e., override key) for computerized, electronic, and 

alternative key systems.

§ 543.22 [RESERVED]

§ 543.23 What are the minimum internal control standards for surveillance?
New TGWG Proposed Part 543 as of 7/28/2011

Page 31 of 34

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Surveillance Equipment and Control Room(s). Controls must be established in a manner 

designed to prevent unauthorized access and/or activities, misappropriation, forgery, theft, or 

fraud. Such controls must include, but not be limited to, the following:

(1) For Tier A, the surveillance system shall be maintained and operated from a secured 

location, such as a locked cabinet. For Tier B and C, the surveillance system shall be 

maintained and operated from a staffed surveillance operation room(s).

(2) The surveillance operation room(s) shall be secured to prevent unauthorized entry.

(3) Access to the surveillance operation room(s) shall be limited to surveillance agents

and other persons authorized.

(4) Surveillance operation room(s) access logs shall be maintained.

(5) Surveillance operation room equipment shall have total override capability over all 

other satellite surveillance equipment located outside the surveillance operation room.

(6) Power loss to the surveillance system.

(i) For Tier A, in the event of power loss to the surveillance system, immediate 

alternative security measures, such as additional supervisory or security agents, 

shall be provided. 

(ii) For Tier B and C, in the event of power loss to the surveillance system, an 

auxiliary or backup power source shall be available and capable of providing 

immediate restoration of power to all elements of the surveillance system that 

enable surveillance agents to observe all areas covered by dedicated cameras.

(7) The surveillance system shall record an accurate date and time stamp on recorded 

events. The displayed date and time shall not significantly obstruct the recorded view.

(8) All surveillance agents shall be trained in the use of the equipment, and be 

knowledgeable of the games and house rules.
New TGWG Proposed Part 543 as of 7/28/2011

Page 32 of 34

(9) Each camera required by the standards in this section shall be installed in a manner 

that will prevent it from being readily obstructed, tampered with, or disabled. 

(10) The surveillance system shall:

(i) Have the capability to display all camera views on a monitor;

(ii) Include sufficient numbers of recording devices to record the views of all 

cameras required by this section; 

(iii) Record all camera views; and

(iv) For Tier B and C only, include sufficient numbers of monitors to 

simultaneously display gaming and count room activities.

(11) A periodic check of the surveillance systems shall be conducted. When a 

malfunction of the surveillance system is discovered, the malfunction and necessary 

repairs shall be documented and repairs initiated within seventy-two (72) hours.

(i) If a dedicated camera malfunctions, immediate alternative security measures, 

such as additional supervisory or security agents, shall be provided. 

(ii) The TGRA shall be notified of any surveillance system and/or camera(s) that 

have malfunctioned for more than twenty-four (24) hours and the alternative 

security measures being provided. 

(d) Additional Surveillance Requirements. With regard to the following functions, the additional 

specified controls shall be implemented:

(1) Bingo.

(i) For manual draws, the surveillance system shall monitor the bingo ball 

drawing device or mechanical random number generator, which shall be recorded 

during the course of the draw by a dedicated camera to identify the numbers or 

other designations drawn.

(ii) The surveillance system shall monitor and record the activities of the bingo 

game, including drawing, calling, and entering the balls, numbers or other 

designations drawn.

(2) Card games.

(i) Except for card game tournaments, a dedicated camera(s) shall be used to 

provide:
New TGWG Proposed Part 543 as of 7/28/2011

Page 33 of 34

(A) An overview of the activities on each card table surface, including 

card faces and cash and/or cash equivalents;

(B) An overview of card game activities, including patrons and dealers; 

and

(C) An unobstructed view of all posted progressive pool amounts. 

(ii) For card game tournaments, a dedicated camera(s) shall be used to provide an 

overview of tournament activities, including entrances/exits and any area where 

cash or cash equivalents are exchanged.

(3) Prize Winning Events. The TGRA shall establish standards for surveillance camera 

coverage of prize winning events. Dedicated camera coverage is required when the 

progressive base value or prize amount exceeds $3,000,000.00. Recorded camera 

coverage shall include the activities of patrons and agents at the time and location of the 

prize winning event.

(4) Cash and Cash Equivalents.

(i) The surveillance system shall monitor and record: 

(A) A view of the patron, cage agent, vault agent or count team agent(s) 

and the surrounding area and counting surface;

(B) Payouts of gaming winnings; 

(C) Entry and exit doors to and from the cage, vault and other secured 

count areas;

(D) All count equipment including but not limited to reject bins, weigh 

scales, wrapping machines, currency and coin counters, and chips sorters;

(E) Any area where the manipulation of recorded data may occur;

(F) Drop and count while in process; for Tier A and B operations, if the 

count is not viewed live, the operation must establish controls to ensure a 

review of the recording within seven (7) days by an agent independent of 

the count operation and the count being reviewed. For Tier C operations, 

the count shall be viewed live.

(G) All drop boxes and storage racks by either a dedicated camera or a 

motion-detector activated camera.
New TGWG Proposed Part 543 as of 7/28/2011

Page 34 of 34

(ii) During the count process a dedicated overhead camera(s) or motion-detector 

activated camera(s) must cover the:

(A) Transaction area with the ability to identify cash and cash equivalent 

values;

(B) All counting surfaces used during the count; and 

(C) All drop boxes and their storage racks.

(e) Recording Retention. Controls must be established that include, but are not limited to, the 

following:

(1) All recordings required by this section shall be retained for a minimum of seven (7) 

days; and

(2) Suspected or confirmed gaming crimes, unlawful or suspicious activity, or detentions 

by security personnel discovered within the initial retention period shall be copied and 

retained for a time period, not less than one (1) year.

(f) Logs. Logs must be maintained and demonstrate the following:

(1) Compliance with the storage, identification, and retention standards required in this 

section;

(2) Each malfunction and repair of the surveillance system as defined in this section; and

(3) Activities performed by surveillance agents.
TAB 

B
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 1 of 18

Bingo

Purpose 

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of bingo. It has been compiled by tribal regulators, Class II gaming operators, 

and other industry resources. Using best practices, this guidance is specifically designed to 

accommodate a variety of ways to implement controls to comply with Part 543.7. Because each 

gaming operation is different and subject to varying tribal laws and regulations, each tribe is 

responsible for determining the specific controls and procedures that are most suitable for its 

gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.7 What are the minimum internal control standards for bingo?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for bingo operations as needed by an 

agent(s) with authority equal to or greater than those being supervised.

(e) Bingo Cards.

(1) Physical inventory. 

(i) The bingo card inventory must be controlled in a manner designed to 

prevent unauthorized access, misappropriation, forgery, theft, or 

fraud. Such controls shall address bingo cards exchanged between
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 2 of 18

§ 543.7 What are the minimum internal control standards for bingo?

agents, increases and decreases to inventory, and inventory 

reconciliation.

(2) Sales. 

(i) The sale of bingo cards must be controlled in a manner to adequately 

record, track, and reconcile such sales, including voids. 

(ii) When the sale of bingo cards is recorded manually, such sales must 

be verified by an independent agent. 

(iii) No unauthorized person shall have access to bingo card sales 

records.

(f) Draw.

(1) Controls must be established requiring that all objects eligible for the draw 

are available to be drawn.

(2) The draw must be controlled in a manner that ensures random selection of 

the objects drawn.

(3) The draw must be controlled in a manner that ensures that the identity of 

each object drawn is accurately recorded and transmitted to the participants. 

(g) Payouts.

(1) Payouts must be controlled in a manner designed to verify winning events

and prevent unauthorized access to, or misappropriation of, cash or cash 

equivalents. Such controls shall include, but not be limited to, the following:

(i) Payout records;

(ii) Validation and verification;

(iii) Authorization or signatures; and

(iv) Voids.

(h) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled 

in a manner designed to prevent unauthorized access, misappropriation, forgery, 

theft, or fraud. Such controls shall be in accordance with cash and cash equivalent 

controls established in subpart 543.14.

(i) Technologic Aids to the Play of Bingo. Internal control procedures must be 

established to safeguard the integrity of technologic aids to the play of bingo during 
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 3 of 18

§ 543.7 What are the minimum internal control standards for bingo?

installations, operations, modifications, and retirements. Such procedures must 

include, but not be limited to, the following:

(1) Shipping and receiving; 

(2) Access credential control methods; 

(3) Record keeping and audit processes; 

(4) System software signature verification; 

(5) Testing;

(6) Display of rules and necessary disclaimers such as “Malfunctions void all 

pays and plays.", etc.;

(7) Dispute resolution; 

(8) Malfunctions; and 

(9) Removal, retirement, and/or destruction.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Bingo 

operations. Such SICS should address, at a minimum, how the department operates, 

agents’ responsibilities, and controls to protect assets. The TGRA should review and 

approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the internal control standards shall be implemented. For

example, where an agent or multiple agents are required in the control, a computer 

application could substitute for one or all of the agents. Another example would be 

where a log is required a computer application report could substitute for the log. If 

computer systems are used, procedures must be designed to account for computer system 

failure without compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 4 of 18

with established policies and procedures or deviations from expected outcomes) 

must be investigated.

(2) Best practice suggests that when the relevant predetermined threshold is achieved,

the controls should require agents – preferably supervisory agents – to conduct a 

variance investigation. Variance investigation controls/procedures should 

include, but are not be limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recalculating inventory, cash and cash equivalents, sales and payout 

amounts;

(iii) Re-verifying the winning event and prize payouts;

(iv) Recount of assets/inventory;

(v) Surveillance reviews;

(vi) Physical inspections; and

(vii) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision. 

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a bingo

agent without any other supervision. In such instances, however, a supervisory 

agent either independent of the transaction or independent of the relevant 

department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 5 of 18

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often bingo operations and bingo card inventory should be audited. When 

an assessment and review is necessary, an agent independent of the organizational 

component responsible for bingo operations and bingo card inventory should perform it.

(f) Bingo Cards – Physical Inventory. To safeguard the integrity of the bingo card 

inventory, procedures must be established to control the physical inventory of bingo 

cards. Best practice suggests that physical inventory controls should address the 

placement of orders, receipt, storage, issuance, removal, and cancellation of bingo card 

inventory to ensure that: (i) the inventory can be accounted for at all times; (ii) an 

inventory of bingo cards is maintained sufficient to operate the games; and (iii) bingo 

cards have not been marked, altered, or otherwise manipulated. 

(1) Receipt from supplier. 

(i) When bingo card inventory is initially received from the supplier, it should

be inspected (without breaking the factory seals, if any), counted, 

inventoried, and secured by an authorized agent. Best practice suggests 

this agent should be independent of bingo card sales. 

(ii) Inventory records should include the following information: date received, 

quantities received, and the name of the individual conducting the 

inspection.

(2) Storage. 

(i) Bingo cards should be maintained in a secure location (i.e., controlled 

access, under lock and key), with appropriate surveillance coverage, which 

is accessible only to authorized agents to prevent unauthorized access and 

reduce the possibility of tampering. 

(ii) For smaller operations, inventory can be stored in a cabinet, closet, or 

other similar area; however, such area should be a secured area separate 

from the working inventory. 

(3) Issuance and Returns of Inventory. 

(i) Controls must be established for the issuance and return of inventory. 

Such controls must provide for proper recordation on appropriate control 

logs signed by the issuer and receiver, at a minimum covering the 

following circumstances:
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 6 of 18

(A) Issuance of inventory from storage to a staging area;

(B) Issuance of inventory from a staging area to the cage or sellers;

(C) Return of inventory from a staging area to storage; and

(D) Return of inventory from cage or seller to staging area or storage.

(ii) Inventory must be secured at all times with adequate controls for 

accountability and in a manner designed to prevent unauthorized access, 

tampering, and theft. 

(4) Cancellation and removal. 

(i) Bingo cards removed from inventory that are deemed out of sequence, 

flawed, or misprinted and not returned to the supplier, shall be properly 

cancelled to ensure that they are not utilized in the play of a bingo game. 

Bingo cards that are removed from inventory and returned to the supplier 

or cancelled must be properly logged as removed from inventory.

(ii) Cancellation methods may include, but are not limited to: shredding, 

drilling, and permanent ink marking. Cancelled cards may then be 

removed from inventory and recorded on the appropriate log. Best 

practice suggests that the cancellation process be under surveillance to 

ensure established controls have been followed.

(iii) In the event of an investigation, the bingo cards associated with the 

investigation must be retained intact outside of the established removal 

and cancellation policy. These bingo cards should be sealed and 

forwarded to an independent department responsible for investigations, 

such as a security or a surveillance supervisory agent.

(5) Logs. 

(i) The inventory of bingo cards should be tracked on a log(s) from original 

receipt from supplier into inventory, through use or permanent removal 

from inventory. 

(ii) Management should determine, based on the size of the operation and 

inventory needs, where bingo card inventory logs are required to ensure 

the integrity of bingo cards offered for play. 

(iii) The bingo card inventory log(s) should include: 

(A) Date;
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 7 of 18

(B) Shift; 

(C) Time;

(D) Location; 

(E) Inventory received, issued, removed, and returned;

(F) Signature of agent performing transaction; 

(G) Signature of agent performing the reconciliation; 

(H) Any variance; 

(I) Beginning and ending inventory; and 

(J) Description of inventory transaction being performed.

Examples of logs:

Log maintained in the bingo card storage room that shows inventory of all cards:

Inventory Log:

Bingo Card Record:

Best practice suggests that a log is maintained at each location (e.g., bank, booth, window, etc.) 

to record bingo card inventory received or returned.
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 8 of 18

(g) Bingo Card Sales.

(1) Controls should be established to segregate the functions of seller and payout 

verifier. Agents who sell bingo cards should not be the sole verifier of bingo 

cards for prize payouts. However, such agents may be permitted to announce the 

identifiers of the winning bingo cards to the verifier.

(2) In order to adequately record, track and reconcile sales of bingo cards, the 

following information should be documented:

(i) Date;

(ii) Shift or session;

(iii) Number of bingo cards issued, sold, and returned; 

(iv) Dollar amount of bingo card sales;

(v) Signature, initials, or identification number of the agent preparing 

the record;

(vi) Signature, initials, or identification number of an independent 

agent who verified the bingo cards returned to inventory and dollar 

amount of bingo card sales.

(3) Bingo card sale voids. Controls must be established for the voiding of bingo 

card sales. Bingo card voids must be processed in accordance with the rules 

of the game and established controls should include, but not be limited to, the 

following:

(i) Patron refunds;

(ii) Adjustments to bingo card sales to reflect voids;

(iii) Adjustments to bingo card inventory, which may include but be not 

limited to:

(A) Cancelling voided bingo cards and removing the returned bingo 

cards from inventory; or

(B) Returning the returned bingo cards to inventory, making such cards 

available for future games. 

(iv) Document the reason for the void; and
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 9 of 18

(v) Authorization for all voids.

(h) Draw.

(1) Controls must be established to ensure that all eligible objects used in the conduct 

of the bingo game are available to be drawn and that the physical integrity of the 

objects has been verified. Verification of physical objects must be performed 

before the start of the first bingo game/session and be verified by two agents. 

Best practice suggests that one of the agents be either a supervisory agent or 

independent of the bingo games department. Where the objects are electronic, 

certification in accordance with 25 CFR Part 547 is acceptable for verifying the 

integrity of the objects. 

(2) The draw must be controlled in a manner that ensures random selection of the 

objects drawn. Where the selection is electronic, certification in accordance with 

25 CFR Part 547 is acceptable for verifying the randomness of the draw.

(3) Controls should be established over the draw to: 

(i) Verify the identity of the objects as they are drawn; 

(ii) Accurately record the drawn objects; and 

(iii) Transmit the identity of the drawn objects to the participants. For 

example, each bingo blower/console should have a dedicated camera 

monitoring, and displaying to the participants, the balls as they are drawn. 

(4) Controls should be established to provide a method of recall of the draw, which 

includes the order and identity of the objects drawn, for dispute resolution 

purposes. 

(i) Verification and Prize Payout Records.

(1) Payout records, including manual payouts records. Payout records and forms 

must be controlled in a manner designed to prevent unauthorized access, 

misappropriation, fraud or forgery. 

(i) Best practice suggests that payout forms be multi-part (an electronic 

record may constitute one part) to ensure separate control of the cash 

accountability functions; and

(ii) Procedures should require funds issued for payouts to be witnessed and 

verified against the payout record or form by an agent other than the agent 

issuing the payout. 
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 10 of 18

(2) Payout forms should include the following:

(i) Date and time;

(ii) Amount of the payout (alpha and numeric);

(iii) Player interface identifier or bingo card identifier; and 

(iv) Manual payouts should also include the following:

(A) Game name or number;

(B) Description of event (i.e., pattern covered, player interface 

malfunction, etc.) as applicable;

(C) Signature of all agents involved in the transaction;

(1) Best practice suggests that at least two agents perform the 

manual payout and sign the manual payout document.

(D) Override reason(s); and

(1) Best practice suggests the agent verifies the amount of the 

prize at the player interface to the accounting system 

amount. If the player interface amount is different than the 

accounting system amount an override may be necessary 

and, if so, should be properly documented. For example, if 

the player interface indicates a verified prize of $1,250.00 

but the accounting system reflects $1,249.00, then the 

accounting system may require an override to process the 

manual payout.

(E) Any other information necessary to substantiate the payout.

(3) Controls should be established to segregate the functions of seller and payout

verifier. Agents who sell bingo cards should not be the sole verifier of bingo 

cards for prize payouts. However, such agents may be permitted to announce the 

numbers or designations on the winning bingo cards to the verifier.

(4) Validation and Verification. Controls must include steps to verify the following 

is valid for the game in play prior to payment of a winning prize:

(i) Winning card(s);

(ii) Objects drawn; and
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 11 of 18

(iii) The previously designated arrangement of numbers or designations on 

such cards, as described in 25 USC 2703(7)(A) (i.e., winning pattern).

(iv) Best practice suggests at least two agents perform the validation and 

verification. Where an automated verification method (e.g., electronic 

verifier, software program, among others) is available, validation and 

verification by such method is acceptable.

(5) Authorization or Signatures.

(i) Controls should be established in a manner designed to prevent 

unauthorized access or misappropriation of cash or cash equivalents by 

identifying the agent authorized (by position) to make a payout and at 

what levels. 

(ii) In addition, controls should include how many agents are required for 

authorization or signature for each predetermined level of payout. This 

could be accomplished through the use of a matrix, an example of which is 

provided below.

Example of Authorization or Signature Matrix (The dollar amounts noted in this matrix 

are examples only. Each operation should perform a risk assessment to determine 

appropriate payout levels and authorizations.):

Payouts up to $1,199.99

Originator of Payout Funds: Cage Cashier, Paymaster, Kiosk, or 

automated funds dispenser

Originator of Payout Document: Automated payout method

Verifier of bingo card, pattern, & amount: Automated verification method

Verifier of payment: Automated payout method

Payouts equal to or greater than to $1,200.00

Originator of Payout Funds: Cage Cashier or Paymaster

Originator of Payout Document: Automated payout method

Verifier of bingo card, pattern, & amount: Floor Person, Caller and/or automated 

verification method

Verifier of payment: Floor Person and Floor Supervisor

Per current IRS regulations, a W-2G or 1042-S form is required to be completed for payouts 

$1,200.00 and above. Such regulations are subject to change and controls should be updated 

accordingly.

Manual Payouts up to $4,999.99
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 12 of 18

Originator of Payout Funds: Cage Cashier or Paymaster

Originator of Payout Document: Paymaster

Verifier of bingo card, pattern, & amount: Floor Supervisor, Floor Person,

Security, or Technician

Verifier of payment: Floor Supervisor and Security

Per current IRS regulations, a W-2G or 1042-S form is required to be completed for payouts 

$1,200.00 and above. Such regulations are subject to change and controls should be updated 

accordingly.

Manual Payouts $5,000.00 to $19,999.99

Originator of Payout Funds: Cage Cashier or Paymaster

Originator of Payout Document: Floor Supervisor or Floor Person

Verifier of bingo card, pattern, & amount: Floor Supervisor (other than originator) 

or Floor Person (other than originator) 

or Security or Technician; and

Verifier of Payment: Shift Manager

Per current IRS regulations, a W-2G or 1042-S form is required. Such regulations are subject to 

change

Manual Payouts $20,000.00 and over

Originator of Payout Funds: Cage Cashier

Originator of Payout Document: Floor Supervisor or Floor Person

Verifier of bingo card, pattern, & amount: Shift Manager and Floor Supervisor 

(other than originator) or Technician; 

and

Verifier of Payment: Security Manager or Security

Supervisor

Per current IRS regulations, a W-2G or 1042-S form is required to be completed. Such 

regulations are subject to change.

(6) Voids. Documentation must include the reason for voids and signatures of both 

the originating agent and a supervisory agent. Best practice suggests that a 

supervisory agent process the voiding of manual payout forms. 

(i) Cash and Cash Equivalents. Controls should be established for cash and cash equivalents 

in accordance with MICS 543.14 (What are the minimum internal control standards for 

cage, vault, cash, and cash equivalents?) and the guidance provided in the associated 

document. Procedures should also comply with all applicable federal regulations (e.g.,

IRS code, Title 31, among others).

(j) Technologic Aids to the Play of Bingo. Internal control procedures must be established

to safeguard the integrity of technologic aids to the play of bingo during installations, 

operations, modifications, and retirements. Such procedures must include, but not be 

limited to, the following:
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 13 of 18

(1) Shipping and receiving.

(i) A communication process must be established between the supplier, the 

gaming operation and the TGRA to properly control the shipping and 

receiving process. Such process should include:

(A) Establishing a notification procedure covering shipping dates and 

other TGRA requirements (e.g., 5-10 business days shipping 

notification for Class II Gaming System new installation, or 3-5 

business days shipping notification for Class II game play 

software, same or next day delivery for repair and replacement 

parts). Such notification procedure is communicated to the gaming 

operation and suppliers.

(1) Best practice suggests that notification of pending 

shipments should be provided to the TGRA by the gaming 

operation. 

(2) Certification in accordance with 25 CFR §547 and approval 

by TGRA prior to shipment. 

(3) Supplier should provide notification to the TGRA, or the 

gaming operation as approved by the TGRA, of the 

shipping date and expected date of delivery. The shipping 

notification includes, but is not limited to:

(i) Name and address of the supplier;

(ii) Description of shipment;

(iii) For player interfaces: an identifier;

(iv) For software: program number and description of 

software; 

(v) Method of shipment; and

(vi) Expected date of delivery.

(4) Procedures should be established for the exchange of Class 

II gaming system components for maintenance and 

replacement (e.g., bingo card minders, screens, printers, bill 

acceptors, etc.).
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 14 of 18

(ii) Class II gaming system components must be shipped in a secure manner to 

deter unauthorized access.

(iii) Best practice suggests the TGRA, or its designee, receives all Class II 

gaming system components and game play software, and verifies against

the shipping notification.

(2) Access Credential Control Methods. 

(i) Controls should be established to restrict access to the Class II gaming 

system components. Such controls should ensure access is controlled 

through passwords, PINs, cards, or other credential controls. Refer to 

standards established under 543.16 Security and Management of Server, 

Server Software and Data Associated with Class II Gaming Systems.

(3) Recordkeeping and Audit Processes.

(i) Best practice suggests that the gaming operation, subject to TGRA

requirements, should maintain the following records, as applicable, related 

to installed game servers and player interfaces:

(A) Date placed into service;

(B) Date made available for play;

(C) Supplier;

(D) Game software version number;

(E) Unique identifier (i.e., serial number);

(F) Game title;

(G) Asset and/or location number;

(H) Seal number; and

(I) Initial meter reading.

(ii) Controls should establish procedures for auditing such records in 

accordance with MICS 543.19 (What are the minimum internal control 

standards for audit and accounting?) and associated guidance documents. 

(4) System Software Signature Verification.
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 15 of 18

(i) Procedures should be established relating to system software verifications. 

These procedures should include comparing signatures generated by the 

verification programs to the signatures provided in the independent test 

laboratory letter for that software version.

(ii) Agents, independent of the bingo operation, should perform system 

software signature verification(s) to verify that only approved software is 

installed.

(iii) Procedures should be established relating to the investigation and 

resolution of any software verification variances encountered.

(iv) Best practice suggests internal audits be conducted at intervals established 

by the TGRA. Such audits should be documented.

(5) Testing

(i) Testing should be completed during the installation process to verify the 

player interface has been properly installed. This should include testing of 

the following as applicable: 

(A) Communication to the Class II Gaming System;

(B) Communication to the accounting system;

(C) Communication to the player tracking system;

(D) Currency and vouchers to bill acceptor;

(E) Voucher printing;

(F) Meter incrementation;

(G) Verification of paytable;

(H) Verification of player interface denomination;

(I) Verification that all buttons are operational and programmed 

appropriately;

(J) System components are safely installed at location; and

(K) Ensuring that locks are secure and functioning.

(6) Display of Rules and Necessary Disclaimers
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 16 of 18

(i) The TGRA, or the operation should verify that all game rules and 

disclaimers (i.e., “Malfunctions void all pays and plays.”) shall at all times 

be displayed or made readily available to the player upon request as required 

by 25 CFR Part 547.

(k) Operations.

(1) Dispute Resolution.

(i) Controls and procedures must be established and approved by the TGRA, 

to investigate, document, and resolve patron disputes. Such procedures

should include but not be limited to:

(A) Notifying upper management and/or the TGRA of the outstanding 

nature of the dispute; 

(B) Collecting and securing all records of the dispute; and

(C) Providing patron(s) with instructions for available dispute 

resolution mechanisms.

(2) Malfunctions.

(i) Procedures should be established to investigate, document and resolve 

malfunctions. Such procedures may address, but not be limited to, the 

following:

(A) Determination of the event causing the malfunction;

(B) Review of relevant records, game recall, reports, logs, surveillance 

records;

(C) Repair or replacement of the Class II gaming component;

(D) Verification of the integrity of the Class II gaming component 

before restoring it to operation; and

(E) Completion of requisite documentation.

(3) Removal, Retirement and/or Destruction.

(i) Procedures should be established to properly retire or remove any or all 

associated components of a Class II Gaming System from operation. 

Procedures may include, but are not limited to, the following:
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 17 of 18

(A) For player interfaces and components that accept cash or cash 

equivalents:

(1) Coordinate with the drop team to perform a final drop;

(2) Collect final accounting information (e.g., meter readings, 

drop, payouts, etc.); 

(3) Remove and/or secure any or all associated equipment from 

the retired or removed component (e.g., locks, card reader, 

ticket printer); and

(4) Complete requisite documentation.

(B) For removal of software components:

(1) Purge and/or return the software to the license holder; and

(2) Complete requisite documentation.

(C) For other related equipment (e.g., blowers, cards, interface cards, 

etc.):

(1) Remove and/or secure equipment; and

(2) Complete requisite documentation.

(D) For all components:

(1) Verify that unique identifiers (i.e., serial numbers) and 

descriptions of removed/retired components are recorded 

on the retirement documentation; and

(2) Coordinate with the accounting department to properly 

retire the component in the system records.

(ii) Where the TGRA authorizes destruction of any Class II Gaming System 

components, procedures should be developed to properly destroy such 

components. Such procedures should include but not be limited to the 

following:

(A) Methods of destruction;

(B) Witness or surveillance of destruction; 

(C) Document all components destroyed; and 
FINAL DRAFT – TGWG 7/28/2011

Bingo Page 18 of 18

(D) Signatures of agents destroying components attesting to 

destruction. 

(d) Audit and Accounting. 

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

C
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 1 of 11

Pull Tabs

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of Class II pull tabs. It has been compiled by tribal regulators, Class II gaming 

operators, and other industry resources. Using best practices, this guidance is specifically 

designed to accommodate a variety of ways to implement controls to comply with Part 543.8. 

Because each gaming operation is different and subject to varying tribal laws and regulations, 

each tribe is responsible for determining the specific controls and procedures that are most 

suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.8 What are the minimum internal control standards for pull tabs.

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the pull tab operations and over 

pull tab storage areas by an agent(s) with authority equal to or greater than those 

being supervised.

(e) Pull Tab Inventory. The pull tab inventory must be controlled in a manner designed

to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall address pull tabs exchanged between agents, increases and decreases to 

inventory, and inventory reconciliation.

(f) Pull Tab Sales. 
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 2 of 11

§ 543.8 What are the minimum internal control standards for pull tabs.

(1) Pull tab sales must be controlled in a manner to adequately record, track, and 

reconcile all pull tab sales and voids.

(2) When pull tab sales are recorded manually, total sales are verified by an 

agent independent of the pull tab sales being verified. 

(3) No person shall have unrestricted access to pull tab sales records.

(g) Winning Pull Tabs.

(1) Redeemed pull tabs must be controlled in a manner to adequately record, 

track, and reconcile all pull tab payouts.

(2) The redeemed pull tabs shall be defaced so that they cannot be redeemed for 

payment again.

(h) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled 

in a manner designed to prevent unauthorized access, misappropriation, forgery, 

theft, or fraud. Such controls shall be in accordance with cash and cash equivalent 

controls established in sub part 543.14.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Pull Tabs. 

Such SICS should address, at a minimum, how the department operates, agents’ 

responsibilities, and controls to protect assets. The TGRA should review and approve the 

SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 3 of 11

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a pull tab

agent without any other supervision. In such instances, however, a supervisory 

agent either independent of the transaction or independent of the relevant 

department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often pull tab operations and inventory should be audited. When an 
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 4 of 11

assessment and review is necessary, an agent independent of the organizational 

component responsible for pull tab operations and inventory should perform it.

(f) Pull Tab Inventory. To ensure the integrity of pull tabs, a process must be established to 

control the physical inventory of pull tabs at all times. Physical inventory controls should 

cover the order, receipt, storage, issuance, return, cancellation, and removal of pull tab 

inventory by ensuring the inventory can be accounted for at all times and the pull tab 

storage area has sufficient inventory to maintain the games.

(1) Receipt from Vendor/Supplier. When received, pull tabs must be inventoried, 

documented, and secured by an authorized agent(s) independent of pull tab sales.

Documentation should include the following:

(i) Date;

(ii) Time;

(iii) Agent receiving the pull tabs;

(iv) Game name;

(v) Serial number(s); and

(vi) Form number.

(2) Storage. Pull tabs (including unused pull tabs) must be kept in a secure location 

with restricted access (i.e., controlled access, under lock and key), with 

appropriate surveillance coverage, and accessible only by authorized agents to 

prevent unauthorized access and tampering. 

(i) Best practice suggests that pull tab inventory should be stored in a pull tab 

storage room and under surveillance at all times.

(ii) For smaller pull tab operations, inventory can be stored in a pull tab 

cabinet in a separate secured area from the working inventory. 

Surveillance coverage of the pull tab inventory should be in place at all 

times.

(3) Issuances, Returns and Transfers. Issuances, returns and transfers of pull tab 

inventory can be to or from a storage room, a locked cabinet, cage, pull tab sales 

agent (i.e., cashier) and/or dispensers. Controls must be established for the 

following:

(i) Recording issuances, returns and transfers on the appropriate control log, 

including signatures from the issuing and receiving agents; and

(ii) Securing pull tabs at all times. 
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 5 of 11

(4) Cancellation and Removal.

(i) Controls must be established for the cancellation and removal of pull tabs, 

including but not limited to the following:

(A) Cancellation of damaged pull tabs (i.e., damaged by a dispensing 

machine or damaged in transit from supplier); 

(1) Unsold or damaged pull tabs must not be opened by any 

agent.

(2) Cancellation methods may include perforation or the 

writing of void across the face of the pull tab, along with 

the date, time, and persons completing the void. 

(3) Damaged winning pull tabs should be returned to the cage 

along with the winning documentation.

(B) Inventory of cancelled pull tabs; 

(C) Retention and permanent removal procedures; and

(D) Destruction of permanently removed pull tabs. 

(ii) Cancelled pull tabs should be removed from inventory, recorded on the 

appropriate log and then destroyed in accordance with established 

controls. Best practice suggests that at least two agent perform, document 

and attest to any destruction of pull tabs.

(iii) Controls should require that for each deal of pull tabs removed and 

discontinued from play that a summary report be completed explaining 

eliminating that deal from sellable inventory. The report must be sent to 

accounting and contain the following:

(A) Serial number and form number of deal;

(B) Original pull tab count;

(C) Pull tabs sold and unsold;

(D) Pull tabs redeemed;

(E) Pull tabs destroyed or cancelled; and 

(F) Date placed into play;

(G) Date removed from play;
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 6 of 11

(H) Agent performing the transaction.

(iv) In the event of an investigation, other than for a damaged pull tab (i.e.,

damaged by a dispensing machine or damaged in transit from supplier), 

the pull tabs associated with the investigation must be retained intact 

outside of the established cancellation and removal policy. These pull tabs 

should be sealed and forwarded to a security or surveillance supervisory 

agent.

(5) Inventory Control Logs. 

(i) The inventory of pull tabs must be tracked on a inventory control log(s) 

through each step in the process, from original receipt (from 

vendor/supplier) into inventory through the permanent removal from 

inventory.

(ii) Controls should establish, based on the size of the pull tab operation and 

inventory needs, where pull tab inventory control logs are required to 

ensure the integrity of pull tabs in play.

(iii) Inventory control log(s) should include the following or equivalent 

information:

(A) Location (i.e., storage room, cabinet #, sales location);

(B) Game name;

(C) Serial number;

(D) Form number;

(E) Date;

(F) Shift;

(G) Time;

(H) Beginning balance;

(I) Inventory received;

(J) Inventory returned;

(K) Inventory issued;

(L) Inventory removed;

(M) Ending inventory;
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 7 of 11

(N) Inventory count;

(O) Variance; and

(P) Signature of agent performing transaction.

(iv) Pull tab inventory must be reconciled at specified intervals based on the 

outcome of the risk assessment and in accordance with the controls 

established for audit and accounting in accordance with MICS 543.19 

(What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(v) The pull tab inventory should be tracked through each step in the process 

on the pull tab log (i.e. upon receipt, issuance, return, and removal).

Examples:

Log maintained in the pull tab storage room that shows inventory of all pull tabs:

Log maintained in the locked cabinet that tracks pull tab movement:

(g) Pull Tab Sales. Pull tab sales can be recorded manually or by point of sale system 

(i.e., centralized pull tab sale system, pull tab cash register). Controls must be 

established for pull tab sales in a manner to adequately record, track, and reconcile 

all pull tab sales and voids, including, but not limited, to the following: 

(1) Cash, cash equivalents and pull tabs are secured at all times; 

(2) Unsold or damaged pull tabs must not be opened by any agent; and
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 8 of 11

(3) All pull tab sales are documented, including but not limited to the following:

(i) Location (e.g., booth, window);

(ii) Date;

(iii) Shift;

(iv) Name of agent performing pull tab sales; 

(v) Game name;

(vi) Serial number;

(vii) Form number;

(viii) Ticket price, which must be identical to the ticket price on the flare;

(ix) Total pull tabs sales, including any pull tabs issued to patrons as payment 

for redeemed winning pull tabs;

(x) Total winning pulls tabs redeemed (i.e. total payouts);

(4) Bingo card sale voids. Controls must be established for the voiding of bingo 

card sales. Bingo card voids must be processed in accordance with the rules 

of the game and established controls should include, but not be limited to, the 

following:

(i) Patron refunds;

(ii) Adjustments to bingo card sales to reflect voids;

(iii) Adjustments to bingo card inventory, which may include but be not 

limited to:

(A) Cancelling voided bingo cards and removing the returned bingo 

cards from inventory; or

(B) Returning the returned bingo cards to inventory, making it 

available for future games. 

(iv) Document the reason for the void; and

(v) Authorization for all voids.

(h) Winning Pull Tabs. 
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 9 of 11

(1) When a winning pull tab prize exceeds a specified payout threshold, 

documentation (i.e., flare) should be available to the redemption agent for the 

purposes of verifying the authenticity of the winning pull tab. The documentation 

shall include the:

(i) Game name;

(ii) Serial number;

(iii) Form number; 

(iv) Winning combinations;

(v) Prize value.

(2) Winning pull tabs in excess of a specified amount should be compared against

pertinent documentation (i.e., flare, prize schedule) by the redeeming agent prior 

to the payment of the prize. Such verification should include the following:

(i) Game name;

(ii) Serial number;

(iii) Form number;

(iv) Winning combination;

(v) Amount; and

(vi) Payout authorizations.

(3) Winning pull tabs must be cancelled so that they cannot be presented for payment 

again.

(i) Statistical Reports.

(1) Records must be maintained for each shift, each day, month to date and year to 

date or other specified fiscal periods as required, which include the following:

(i) Write (i.e., total sales);

(ii) Payouts (i.e., total prizes paid);

(iii) Win (i.e., net hold calculated as total sales minus total prizes paid); and

(iv) Win to write hold percentage (i.e., hold percentage calculated as net hold

divided by total sales).
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 10 of 11

(2) Controls must be established for audit and accounting to review reports for 

statistical fluctuations in accordance with MICS 543.19 (What are the minimum 

internal control standards for audit and accounting?) and the guidance provided in 

the associated document.

(j) Technologic Aids to the Play of Pull Tabs. If technologic aids are used in the play of pull 

tabs, the following standards apply. 

(1) If the technologic aid contains a bill acceptor, the bill acceptor should be tested 

upon initial installation and any modification.

(2) If the technologic aid uses a bar code or microchip reader, the reader should be 

tested upon initial installation and any modification, and thereafter, periodically to 

determine that it is correctly reading the bar code or microchip.

(3) If the technologic aid returns a voucher or payment slip (i.e., cash equivalents) to 

the patron then controls must be established in accordance with MICS 543.14

(What are the minimum internal control standards for cage, vault, cash and cash 

equivalents?) and the guidance provided in the associated document. 

(k) Cash and Cash Equivalents.

(1) Cash or cash equivalents must be controlled in a manner designed to prevent

unauthorized access, misappropriation, forgery, theft or fraud and in accordance 

with MICS 543.14 (What are the minimum internal control standards for cage, 

vault, cash and cash equivalents?) and the guidance provided in the associated 

document.

(2) Best practice suggests that pull tab agent banks be issued from, and returned to, 

the cage/vault. If issued from and returned to another location(s) (i.e., within the 

pull tab operations) controls must be equivalent to those established in MICS 

543.14 MICS 543.14 (What are the minimum internal control standards for cage, 

vault, cash and cash equivalents?) and the guidance provided in the associated 

document.. 

(l) Progressive Pull Tab Games. Controls must be established for the operation of 

progressive pull tab games including requirements for the following:

(1) The progressive portion of the game must be from the same manufacturer and 

have the same form number and deal serial number as the pull tabs that make a 

patron eligible for the progressive prize;

(2) Each deal in a progressive pull tab game must contribute the same amount 

towards the progressive prize.
FINAL DRAFT – TGWG 7/28/2011

Pull Tabs Page 11 of 11

(3) When the progressive pool reaches the progressive prize amount listed on the 

flare, no additional contribution is made to the progressive pool;

(4) Patron(s) eligible for the progressive prize must be informed of the rules for 

playing for the progressive prize, including:

(i) Location, date, and time of progressive prize reveal;

(ii) Requirements for being present, if any, for the progressive prize reveal;

(iii) Requirements for providing personal contact information in the event the 

patron is not required to be present for the progressive prize reveal; and

(iv) Any other limitations or restrictions regarding eligibility for winning the 

progressive prize.

(5) Procedures in the event the progressive prize is not won or claimed, including:

(i) Closing the pull tab game; 

(ii) Claim notification to the eligible patron(s); 

(iii) Accounting for unclaimed progressive prize; and

(iv) Distribution, if any, of patrons’ contribution to the unpaid progressive 

prize.

(6) Procedures for paying the winning progressive jackpot.

(m) Audit and Accounting. 

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.

(3) While a pull tab deal is in play, all records, reports, and prize receipts for the deal

must be maintained for accounting purposes, including the flare, with the bar code 

attached, all redeemed and unsold pull tabs separated by game serial number and 

form number. Unsold or damaged pull tabs must not be opened by any agent.
TAB 

D
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 1 of 11

Card Games

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of Class II card games. It has been compiled by tribal regulators, Class II 

gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.9. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.9 What are the minimum internal control standards for card games?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the card room operations by an 

agent(s) with authority equal to or greater than those being supervised.

(e) Inventory of Playing Cards. The playing card inventory must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or 

fraud. Such controls shall address cards exchanged between agents, increases and 

decreases to inventory, and inventory reconciliation.

(f) Shill Funds. Issuance and return of shill funds shall be recorded and have the written 
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 2 of 11

§ 543.9 What are the minimum internal control standards for card games?

approval of another agent.

(g) Cash and Cash Equivalent Controls. Cash and cash equivalents must be controlled 

in a manner designed to prevent unauthorized access, misappropriation, theft, or 

fraud. Such controls shall be in accordance with cash and cash equivalent controls 

established in sub part 543.14.

(h) Posted Rules. The rules shall be displayed or available for patron review at the 

gaming operation, including rules governing contests, prize payouts, fees, etc. 

(i) Promotional Progressive Pots and Pools such as Contests, Tournaments, Drawings 

and Giveaway Programs. Funds contributed by patrons to prize pools shall be 

returned and documented in accordance with the posted rules.

(1) Promotional pool contributions shall be controlled in a manner to properly 

distinguish between gaming revenue and promotional pool contributions.

(i) Promotional pool contributions shall be placed in a locked container;

(ii) Agents transporting the locked container shall be precluded from 

having access to the contents keys. 

(2) At least once a week, increases and decreases to the promotional pool 

amount shall be verified, supported by documentation, recorded and 

reconciled to the cash by an agent independent of the card room.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Card 

Games. Such SICS should address, at a minimum, how the department operates, agents’ 

responsibilities, and controls to protect assets. The TGRA should review and approve the 

SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 3 of 11

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated, including card inventory, card room table inventory, and 

card room bank inventory. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation;

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a dealer 

without any other supervision. In such instances, however, a supervisory agent 

either independent of the transaction or independent of the relevant department or 

area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 4 of 11

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often card games and card inventory should be audited. When an 

assessment and review is necessary, an agent independent of the organizational 

component responsible for conducting card games should perform it.

(f) Playing Cards. To ensure the integrity of the card games, controls must be established to 

control the physical inventory of playing cards at all times. Physical inventory controls 

should address the orders, receipt, stocking, issuance, return, cancellation, and removal of 

playing card inventory and all items (i.e., shoes, dice and tiles) used in the play of card 

games to ensure that: 

(1) Inventory can be accounted for at all times; 

(2) The card room has sufficient inventory to maintain the games; and 

(3) Playing cards have not been marked, altered or otherwise manipulated. 

(4) Receipt from vendor. 

(i) When playing cards are initially received from the vendor, they must be 

inspected (without breaking the factory seals), counted, inventoried, and 

secured by an authorized agent independent of card games. 

(ii) Inventory records should include the following information: date 

received, quantities received and on hand, and the name of the individual 

conducting the inspection.

(5) Storage. 

(i) New and used playing cards must be maintained in a secure location (i.e., 

under lock and key) with appropriate surveillance coverage, and accessible 

only to authorized agents to prevent unauthorized access and tampering. 

(ii) Best practice suggests that card inventory should be stored in a card 

storage room, which is under surveillance at all times. For smaller card 

room operations, card inventory can be stored in a card room podium in a 

separate secured area from the working inventory. In this instance, a 

general overview of the card inventory should be covered by surveillance 

at all times. 

(6) Issuance. 
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 5 of 11

(i) Issuance of inventory can be from a storage room/location to a podium 

and/or a table(s) or from podium to a table(s).

(ii) When playing cards are issued to a table, best practice suggests that the 

card game supervisor: 

(A) Opens the decks; 

(B) Records the time and date issued and table number; and 

(C) Initials the flap of the box. 

(iii) The dealer should inspect the front and back of the cards and look for 

completeness of the deck and any marks, alterations, or other indication of 

tampering.

(7) Removal from Table. 

(i) When playing cards are removed from a table, best practice suggests that 

the card games supervisor retrieves the original box, records the time and 

date returned, and initials the flap of the box. (This process provides a 

chain of custody when an investigation is required.)

(8) Return of Inventory.

(i) Return of inventory can be from a podium and/or table to a storage room, 

a table to a podium, and should be recorded on the appropriate log.

(ii) Upon return to inventory, playing cards should be inspected to ensure that

the playing cards have not been marked, altered or otherwise manipulated. 

If any marks, alterations, or other flaws are detected, an investigation 

should be performed to determine the origin (i.e., table number, date, shift, 

and dealer[s]) of the cards. Marked, altered, or otherwise flawed cards 

should be sealed and removed from inventory. Best practice suggests such 

cards, and investigation results, should be turned over to security (or other

independent department) for further investigation, including surveillance 

review.

(9) Cancellation and Removal. 

(i) Used playing cards that are not to be re-used shall be properly cancelled 

and removed from service to prevent re-use of retired cards. 

(ii) Cancellation methods may include: drilling, corner cutting, permanent ink 

marking, and edge shaving. These cancelled cards may then be removed 
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 6 of 11

from inventory and recorded on the appropriate log. Best practice 

suggests that the cancellation process be under surveillance to permit 

verification that proper controls have been followed.

(iii) In the event of an investigation, other than for a flawed card, the cards 

associated with the investigation must be retained intact outside of the 

established retention and cancellation policy. These cards should be 

sealed, recorded, and forwarded to the agent or department handling the 

investigation.

(10) Logs. The playing card inventory should be tracked through each step in the 

process on a log(s). 

(i) Management should determine, based on the size of the operation and 

inventory needs, where card inventory logs are required to ensure the 

integrity of playing cards in use. 

(ii) The log(s) should include: 

(A) Date;

(B) Shift;

(C) Time;

(D) Location;

(E) Inventory received, returned, issued, removed;

(F) Agent performing transaction;

(G) Agent performing the reconciliation;

(H) Any variance;

(I) Beginning and ending inventory; and 

(J) Comments.
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 7 of 11

Examples of logs:

Log maintained in the card storage room that shows inventory of all cards:

Log maintained in the podium that tracks card movement:

(11) Physical Count. At a specified interval (based on risk assessment) an agent 

independent of card games and the card storage room/location should perform a 

physical count and verify that count to the inventory log. If a variance is noted, it 

should be investigated by the agent who performed the physical count utilizing 

the methods contained in the variances section of this document.

(g) Shill Funds.

(1) Controls should be developed and implemented regarding the use of shills. Such 

controls should address the following: 

(i) When shills may be used;

(ii) Agent(s) authorized to make the decision to use a shill;

(iii) Shill rules of play;

(iv) Shill fund amounts;

(v) Obtaining shill funds; 

(vi) Returning the funds; and

(vii) Monitoring and reviewing shill activities.
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 8 of 11

(2) Best practice suggests that shill funds be issued from, and returned to, the cage. If 

properly documented, shill funds could be issued from, and returned to, the card 

room bank. Such transactions should be documented on a form signed by the 

cage agent performing the transaction and the “shill agent” accepting the funds. 

This form should include: 

(i) Date;

(ii) Shift;

(iii) Time;

(iv) Location;

(v) Agents issuing/receiving funds;

(vi) Shill signature; and 

(vii) Amount.

(h) Cash and Cash Equivalents. Controls should be developed with respect to cash and cash 

equivalents designed to prevent unauthorized access, misappropriation, forgery, theft or 

fraud and in accordance with MICS 543.14 (What are the minimum internal control 

standards for cage, vault, cash and cash equivalents?) and the guidance provided in the 

associated document. Such controls should include the following transactions and 

events:

(1) Bank issuance/return;

(2) Even exchanges;

(i) Even exchanges between a table and the card room bank must be 

evidenced by the placement of a lammer on the table.

(3) Increases/decreases to bank inventory;

(4) Fills and credits; and

(i) Fills and credits must be authorized by a supervisory agent.

(5) Marker and marker payments.

(i) The issuance of markers and acceptance of marker payments must be 

authorized by a supervisory agent.

(i) Opening/Closing Count. Two agents – one of which must be a supervisory agent – must 

independently count the table inventory at the opening and closing of the table. The 

result of the count must be recorded on a form which includes the following: 
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 9 of 11

(1) Date;

(2) Shift;

(3) Table number;

(4) Amount by denomination;

(5) Amount in total; and 

(6) Signatures of both agents.

(j) Rules for Card Games and Related Promotions and Tournaments.

(1) General Rules. Controls must require rules to be posted or otherwise made 

available to patrons. Such rules must:

(i) Inform patrons of any conditions required for the patron to participate in 

the game (i.e., minimum buy in, rebuy, bankroll);

(ii) Fee schedules for the games offered and any related promotions (i.e., any 

contest, tournament, progressives); and

(iii) Best practice suggests that the process for resolving disputes should be 

posted or otherwise made available for patron review.

(2) Promotions. Controls must require that the rules including the conditions for 

participating in card game promotions are documented and made available for 

patron review. Such documentation should include the following:

(i) Rules of the promotion;

(ii) Name of the promotion;

(iii) Date(s) of the promotion;

(iv) Amount of funds to be contributed by patrons (i.e., entry fee, per pot 

contribution, buy-in);

(v) Administrative fees, if any;

(vi) Nature of qualifying hand to win;

(vii) List of available prizes;

(viii) Allocation of the promotional prize payout;
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 10 of 11

(ix) Amount of each promotional pool; and 

(x) Aggregate amount of all pools.

(3) Tournaments. Controls must require that the rules including the conditions for 

participating in card game tournaments are documented and made available for 

patron review. Such documentation should include the following; 

(i) Rules of the tournament;

(ii) Name of the tournament;

(iii) Date(s) of the tournament;

(iv) Entry fee;

(v) Administrative fees, if any;

(vi) List of available prizes;

(vii) Allocation of the tournament prize payout;

(viii) Amount of each tournament pool; and 

(ix) Aggregate amount of all pools.

(k) Promotional Progressive Pots and Pools. Controls should be developed to properly 

account for the funds contributed by patrons to promotional pots or pools. These controls 

should include:

(1) Procedures for the collection of patron contributions. Such procedures must 

include:

(i) Security of the patron contributions. 

(A) Patron contributions should be segregated from gaming funds and 

accounted for separately. For example, cash or cash equivalents 

may be converted into a non-redeemable promotional chip of the 

same value.

(B) When patron contributions are collected, the cash or cash 

equivalents should be placed in a locked container.

(C) Agents transporting the locked container must be prohibited from 

access to the content key.
FINAL DRAFT – TGWG 7/28/2011

Card Games Page 11 of 11

(2) Counting and Recording. Best practice suggests that the counting and recording 

of the promotional locked box contents should be performed by agents 

independent of the card game department, hosting department(s), and other 

sponsors. The count should be performed under a surveillance camera and the 

documentation forwarded to accounting. 

(l) Audit and Accounting. 

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

E
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 1 of 6

Gaming Promotions

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of Gaming Promotions. It has been compiled by tribal regulators, Class II 

gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.10. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.10 What are the minimum internal control standards for Gaming Promotions.

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(d) Supervision. Supervision shall be provided for gaming promotions as needed by an 

agent(s) with authority equal to or greater than those being supervised. 

(e) Gaming Promotions. Controls must be established in a manner designed to prevent 

unauthorized access, cheating, misappropriation, forgery, theft, or fraud. Such 

controls must include, but not be limited to, the following:

(1) Rules of the gaming promotion;

(2) Gaming promotion accounting; and 
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 2 of 6

§ 543.10 What are the minimum internal control standards for Gaming Promotions.

(3) TGRA approval.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Gaming 

Promotions. Such SICS should address, at a minimum, how the department operates, 

agents’ responsibilities, and controls to protect assets. The TGRA should review and 

approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 3 of 6

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision. 

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a gaming 

promotions agent without any other supervision. In such instances, however, a 

supervisory agent either independent of the transaction or independent of the 

relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often gaming promotions should be audited. When an assessment and 

review is necessary, an agent independent of the organizational component responsible 

for conducting gaming promotions (i.e., marketing) should perform it.

(f) Gaming Promotions Rules. Rules of the gaming promotion should be displayed or made 

readily available to participants upon request. Gaming promotions rules should include, 

but not be limited to, the following:

(1) The rules of play;

(2) The nature and value of the associated prize(s) or cash award(s);

(3) Any restrictions or limitations on participant eligibility;

(4) The date(s), time(s), and location(s) for the associated promotional activity or 

activities; 
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 4 of 6

(5) Any other restrictions or limitations, including any related to the claim of prizes 

or cash awards; 

(6) The announcement date(s), time(s), and location(s) for the winning entry or 

entries; and

(7) Rules governing promotions offered across multiple gaming operations, third 

party sponsored promotions, and joint promotions involving third parties.

(g) TGRA Approval. The TGRA should approve the gaming promotions program to ensure 

that it is implemented in a fair manner and is compliant with all applicable regulations 

(e.g., MICS, TICS, laws on advertising, etc.). Best practice suggests that this approval 

should occur prior to any public release of a gaming promotion. TGRAs may find it is 

most efficient to approve promotions by type or by template and review the following for 

each gaming promotion:

(1) A narrative description of the proposed gaming promotion;

(2) The rules governing entry and eligibility, including any applicable restrictions or

limitations on eligibility;

(3) The rules of play and method for selecting the winning entry or entries;

(4) Applicable restrictions or limitations on the date, time, location, and manner for 

claiming a prize or cash awards;

(5) Eligible prize(s) or cash award(s) and associated monetary value(s), including 

non-cash prizes’ fair market value and cash substitution rules for non-cash prizes;

(6) The identity of any external sponsorship for the gaming promotion, including 

contact information; 

(7) The date, time, and location where the gaming promotion will take place and the 

commencement and end dates of the promotion if it spans across multiple dates,

including specific dates for each related event; and

(8) A copy of any applicable advertisement or other promotional literature. 

(h) Conduct of Promotional Activities.

(1) Gaming operations should conduct promotional activities in accordance with the 

rules and procedures as approved by the TGRA.

(2) If the promotional activity is open to the general public, the gaming operation 

should conspicuously post the date, time and location of the promotion. Further, a 
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 5 of 6

complete copy of the rules related to play, eligibility, and claims should be made 

available to patrons upon request. 

(i) Prize Payouts.

(1) Controls should include procedures for recording prize payouts including, but not 

limited to:

(i) The name, address, and contact information of the winning patron(s);

(ii) The prize(s) awarded and the value of the prize(s); and

(iii) Any required IRS or other forms.

(2) Cash and cash equivalent payouts. When gaming promotions are used in 

conjunction with Class II gaming, controls should be established for payouts in 

accordance with MICS 543.14 (What are the minimum internal control standards 

for cage, vault, cash, and cash equivalents?) and the guidance provided in the 

associated document. Procedures should also comply with all applicable federal 

regulations (e.g., IRS code, Title 31, among others).

(3) Non-Cash Prizes. Best practice suggests that gaming operations utilize the 

following, or similar guidelines to ensure that non-cash prizes are properly 

distributed:

(i) Distribute non-cash prizes in accordance with the rules and procedures for 

the gaming promotion. 

(ii) Do not allow substitution of non-monetary prizes for cash unless 

specifically authorized by the approved rules of the gaming promotion.

(iii) Do not authorize exceptions in the absence of extraordinary circumstances

and only where proper accounting standards and operating procedures 

specifically addressing such circumstances are in place.

(iv) Prohibit substitution of non-cash prizes for cash payment for any amount 

other than the fair market value of the advertised non-cash prize as 

required by the Internal Revenue Code.

(v) Do not substitute an advertised non-cash prize or award for another noncash prize or award of a different type with a lesser value unless 

authorized by the rules.

(j) Audit and Accounting. 
FINAL DRAFT – TGWG 7/28/2011

Gaming Promotions Page 6 of 6

(1) When gaming promotions are used in conjunction with Class II gaming then 

controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

F
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 1 of 9

Patron Deposit Accounts and Cashless Systems

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of patron deposit accounts and cashless systems in conjunction with Class II 

gaming. It has been compiled by tribal regulators, Class II gaming operators, and other industry 

resources. Using best practices, this guidance is specifically designed to accommodate a variety

of ways to implement controls to comply with Part 543.11. Because each gaming operation is 

different and subject to varying tribal laws and regulations, each tribe is responsible for 

determining the specific controls and procedures that are most suitable for its gaming operations 

and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.11 What are the minimum internal control standards for Patron Deposit Accounts and 

Cashless Systems.

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Conflicts of Standards. If there are any inconsistencies between these regulations 

and external standards incorporated by this provision, such as Title 31 and Credit 

Card Act, such other applicable standards shall prevail.

(d) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(e) Patron Deposit Accounts and Cashless Systems.

(1) Patron deposit accounts and cashless systems must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or 
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 2 of 9

§ 543.11 What are the minimum internal control standards for Patron Deposit Accounts and 

Cashless Systems.

fraud. 

(2) All smart cards (i.e., cards that possess the means to electronically store or 

retrieve data) that maintain the only source of account data are prohibited.

(3) Patron deposit accounts may be unrestricted or restricted to a specific patron.

(4) Establishment of patron deposit accounts. The following standards apply 

when the patron establishes an account and optionally makes an initial 

deposit.

(i) For restricted patron deposit accounts:

(A) The patron must appear at the gaming operation in person, at 

a designated area of accountability, and present a valid 

government issued picture identification credential. 

(B) An agent must examine the patron’s identification and 

record, at a minimum, the following information:

(1) Type, number, and expiration date of the 

identification; 

(2) Patron’s name; 

(3) A unique account identifier; 

(4) Date the account was opened; and 

(5) The agent’s name. 

(C) The agent must require the patron to sign the account 

documentation before the account is activated.

(D) The agent or cashless system shall provide the patron 

deposit account holder with a secure method of access.

(ii) For unrestricted patron deposit accounts:

(A) The patron must be informed of the unrestricted nature of 

the account, and the fact that the account may be accessible

to anyone with the account number.

(B) The patron must acknowledge and accept the risks 
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 3 of 9

§ 543.11 What are the minimum internal control standards for Patron Deposit Accounts and 

Cashless Systems.

associated with unrestricted accounts.

(5) Patron deposits, withdrawals and adjustments. 

(i) Prior to the patron making a deposit or a withdrawal from a patron 

deposit account, the agent or cashless system must verify the identity 

of the patron deposit account, the patron identity for restricted 

accounts, and availability of funds. Reliance on a secured personal 

identification number (PIN) entered by the patron is an acceptable 

method of verifying patron identity.

(ii) Adjustments made to the patron deposit accounts must be performed 

by an agent.

(iii) When a deposit, withdrawal or adjustment is processed by an agent, 

a multi-part transaction record must be created containing the 

following information: 

(A) Same document number on all copies;

(B) Type of transaction, (e.g., deposit, withdrawal, or 

adjustment);

(C) Name or other identifier of the patron for restricted patron 

deposit accounts;

(D) The unique account identifier;

(E) Patron signature for withdrawals, unless a secured method 

of access is utilized;

(F) Date and time of transaction;

(G) Dollar amount of transaction;

(H) Nature of deposit, withdrawal, or adjustment (e.g., cash, 

check, chips); and

(I) Signature of the agent processing the transaction.

(iv) When a patron deposits or withdraws funds from a patron deposit 

account electronically, the following shall be recorded and reported:

(A) Date and time of transaction;
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 4 of 9

§ 543.11 What are the minimum internal control standards for Patron Deposit Accounts and 

Cashless Systems.

(B) Location (e.g., player interface, kiosk);

(C) Dollar amount of transaction; and

(D) The unique account identifier.

(v) Detailed patron deposit account transaction records must be 

available to the patron upon reasonable request.

(vi) If electronic funds transfers are made to or from a gaming operation 

bank account for patron deposit account funds, the bank account 

must be dedicated and may not be used for any other types of 

transactions.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Patron 

Deposit Accounts and Cashless Systems. Such SICS should address, at a minimum, how 

the department operates, agents’ responsibilities, and controls to protect assets. The 

TGRA should review and approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated.
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 5 of 9

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation;

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures. 

(2) The reporting structure may permit a supervisory agent to function as a patron 

deposit account agent and/or a cashier without any other supervision. In such

instances, however, a supervisory agent either independent of the transaction or 

independent of the relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function.

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often patron deposit accounts and cashless systems should be audited. 

When an assessment and review is necessary, an agent independent of the organizational 
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 6 of 9

component responsible for patron deposit accounts and cashless systems should perform 

it. 

(f) Patron Deposit Accounts and Cashless Systems.

(1) When patron deposit accounts and cashless systems are used in conjunction with 

Class II gaming, controls should be established to prevent unauthorized access, 

misappropriation, forgery or fraud, and to secure the system and accounts in 

accordance with MICS 543.16 (What are the minimum internal control standards 

for the Security and Management of Server, Server Software, and Data 

Associated with Class II Gaming Systems) and the guidance provided in the 

associated document.

(2) Each Patron Deposit Account must be uniquely identified with an account 

identifier (“Account ID”) which is intended to serve as a secure method of access.

(3) Patron deposit accounts may be unrestricted or restricted to a specific patron and 

each must be controlled in the manner identified subsections (g) and (h) of this 

document respectively. 

(g) Restricted Patron Deposit Accounts.

(1) In the case of restricted patron deposit accounts, in return for giving personal 

details to the gaming operation (required for restricted accounts), the patron may 

acquire a patron deposit account that may be used to play Class II games.

(2) In the case of restricted patron deposit accounts, the account holder has greater 

redress in the case of a lost or stolen card.

(3) In order to acquire a restricted patron deposit account, the patron must appear at 

the gaming operation in person, at a designated area of accountability, and present 

a valid government issued picture identification credential. 

(4) An agent must examine the patron’s identification and record, at a minimum, the 

following information:

(i) Type, number, and expiration date of the identification; 

(ii) Patron’s name; 

(iii) A unique account identifier; 

(iv) Date the account was opened; and 

(v) Agent’s name. 
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 7 of 9

(5) The agent must require the patron to sign the account documentation before the 

account is activated. Signatures may be collected electronically or manually and 

should be maintained for the life of the patron deposit account including data 

retention periods.

(6) The agent or cashless system shall provide the patron deposit account holder with 

a secure method of access such as an account ID and PIN or similarly secured 

access method.

(h) Unrestricted Patron Deposit Accounts.

(1) Unrestricted patron deposit account holders do not have to provide personal 

details to acquire an account. 

(2) In the case of an unrestricted patron deposit account, the account holder 

necessarily has less redress in the event of a lost card because it is treated in a 

manner similar to a voucher.

(3) Controls should require disclosure of the risks associated with the use of 

unrestricted patron deposit accounts, as required by 543.7(g) (i.e., lack of 

recourse, accessible by anyone with the account number, among others). 

Advising patrons of this information may be done in a variety of methods such as, 

by facility signage, posted rules, imprint on the account access medium (e.g.,

card, fob, among others), and/or a handout or receipt at the time the account is 

established. 

(4) Controls should require patron acceptance of the risks associated with the use of 

unrestricted patron deposit accounts, as required by 543.7(g). Acknowledgement 

and acceptance of the risks may be accomplished in a variety of ways, i.e., by use 

of the account; by accepting a form advising the patron of same at the time the 

account is established; by accepting the means of account access; by verbalizing 

acceptance; or by signing an acknowledgment form, among other means.

(5) Patrons must be provided access to their accounts on the host system. Such 

access may be provided from the player interface or via some other mechanism or 

manner of access; e.g., by the insertion of a plastic card, with a machine-readable 

secure account ID number, into a Kiosk; by the manual input of the account 

number via a player interface onboard keypad; by the use of an account access 

medium; or in any other manner authorized.

(6) An account ID may be associated to an account access media such as magnetic 

striped cards or any other medium that allows the Patron to access or interact with 

their account.
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 8 of 9

(7) Best practice suggests that the gaming operation should exercise care in selecting

technology for accessing patron deposit accounts that is designed to protect the 

account ID from unauthorized access, fraud, and forgery.

(i) This may require that technical standards are in place to provide an 

adequate level of security.

(ii) At a minimum such standards should provide that the account ID must 

access the appropriate patron deposit account. 

(i) Patron Deposits, Withdrawals and Adjustments.

(1) Cash and cash equivalents. Controls should be established for patron deposit 

accounts and cashless system transactions involving cash or cash equivalents in 

accordance with MICS 543.14 (What are the minimum internal control standards 

for cage, vault, cash, and cash equivalents?) and the guidance provided in the 

associated document. Procedures should also comply with all applicable federal 

regulations (e.g., IRS code, Title 31, among others).

(2) Controls should be in place to govern patron deposit account deposits and 

withdrawals. 

(i) Prior to the patron making a deposit into a patron deposit account, the 

agent or cashless system must verify the identity of the patron deposit 

account and, for restricted accounts, the patron’s identity. Reliance on a 

secured personal identification number (PIN) entered by the patron is an 

acceptable method of verifying patron identity.

(ii) Prior to the patron making a withdrawal from a patron deposit account, the 

agent or cashless system must verify the identity of the patron deposit 

account and availability of funds for withdrawal. 

(3) Adjustments made to the patron deposit accounts must be performed by an 

authorized agent.

(4) When a deposit, withdrawal or adjustment is processed by an agent, a multi-part 

transaction record must be created containing the following information:

(i) Same document number on all copies;

(ii) Type of transaction, (e.g., deposit, withdrawal, or adjustment);

(iii) Name or other identifier of the patron for restricted patron deposit 

accounts;
FINAL DRAFT – TGWG 7/28/2011

Patron Deposit Accounts and Cashless Systems Page 9 of 9

(iv) The unique account identifier;

(v) Patron signature for withdrawals, unless a secured method of access is 

utilized;

(vi) Date and time of transaction;

(vii) Dollar amount of transaction;

(viii) Nature of deposit, withdrawal, or adjustment (e.g., cash, check, chips); and

(ix) Signature of the agent processing the transaction.

(5) When a patron deposits or withdraws funds from a patron deposit account 

electronically, the following shall be recorded and reported:

(i) Date and time of transaction;

(ii) Location (e.g., player interface, kiosk);

(iii) Dollar amount of transaction;

(iv) The unique account identifier;

(v) Detailed patron deposit account transaction records must be available to 

the patron upon reasonable request; and

(vi) If electronic funds transfers are made to or from a gaming operation bank 

account for patron deposit account funds, the bank account must be 

dedicated. To prevent commingling of gaming operation funds with 

patron fund the bank account may not be used for any other types of 

transactions.

(j) Audit and Accounting. 

(1) When Patron Deposit Accounts and Cashless Systems are used in conjunction 

with Class II gaming then controls must be established for audit and accounting in 

accordance with MICS 543.19 (What are the minimum internal control standards 

for Audit and Accounting?) and the guidance provided in the associated 

document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

G
FINAL DRAFT – TGWG 7/28/2011

Player Tracking Systems Page 1 of 5

Player Tracking Systems

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of player tracking systems used in conjunction with Class II gaming. It has 

been compiled by tribal regulators, Class II gaming operators, and other industry resources. 

Using best practices, this guidance is specifically designed to accommodate a variety of ways to 

implement controls to comply with Part 543.12. Because each gaming operation is different and 

subject to varying tribal laws and regulations, each tribe is responsible for determining the 

specific controls and procedures that are most suitable for its gaming operations and compliant 

with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.12 What are the minimum internal control standards for player tracking systems used 

in conjunction with Class II gaming?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(d) Player Tracking Systems. Controls must be established in a manner designed to 

prevent unauthorized access, cheating, misappropriation, forgery, theft, or fraud 

when a player tracking system is used in conjunction with Class II gaming. Such 

controls must include, but not be limited to, the following:

(1) Operation of player tracking programs;

(2) Security of player tracking accounts; and
FINAL DRAFT – TGWG 7/28/2011

Player Tracking Systems Page 2 of 5

§ 543.12 What are the minimum internal control standards for player tracking systems used 

in conjunction with Class II gaming?

(3) Audit and accounting.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to the use of 

Player Tracking Systems in conjunction with Class II gaming. Such SICS should 

address, at a minimum, how the department operates, agents’ responsibilities, and 

controls to protect assets. The TGRA should review and approve the SICS prior to 

implementation

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards. 

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and
FINAL DRAFT – TGWG 7/28/2011

Player Tracking Systems Page 3 of 5

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance. 

(d) Supervision. 

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a player 

tracking or cashier agent without any other supervision. In such instances, 

however, a supervisory agent either independent of the transaction or independent 

of the relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often player tracking systems should be audited. When an assessment and 

review is necessary, an agent independent of the organizational component responsible 

for player tracking systems should perform it.

(f) Operation of Player Tracking Programs. 

(1) Gaming operations must establish controls for player tracking activities.

Procedures should include but not be limited to the following:

(i) Establishing player tracking membership;

(ii) Access to player tracking records;

(iii) Manual player tracking (e.g., card game player tracking, player tracking 

without automated systems, among others);

(iv) Issuing and redemption of benefits; and
FINAL DRAFT – TGWG 7/28/2011

Player Tracking Systems Page 4 of 5

(A) Best practice suggests that patron identification should be required 

when redeeming benefits however, reliance on a secured PIN by 

the patron is an acceptable method of verifying patron 

identification. This does not apply to Unrestricted Patron Deposit 

Accounts; refer to MICS 543.11 (What are the minimum internal 

control standards for Patron Deposit Accounts and Cashless 

Systems?) and the associated guidance document for controls 

regarding all Patron Deposit Accounts.

(v) Adjustments to player tracking activity and benefits. Adjustments made in 

the absence of the patron must be sufficiently documented, including 

substantiation of reasons for adjustment, by the agent performing the 

adjustment. This standard does not apply to the deletion of balances 

related to inactive or closed accounts through an automated process if the 

automated process is capable of generating a report of all adjustments 

made.

(2) Best practice suggests that the gaming operation make readily available the 

eligibility requirements for player tracking participation. The information should 

also include the following:

(i) Eligibility criteria;

(ii) Any restrictions or limitations on participant eligibility and membership

(e.g., must be at least 18/21 years of age to participate, must achieve a 

specified amount of activity in a specified period, and restrictions on 

holding multiple accounts, among others);

(iii) Description of potential benefits associated to participation, including 

participation and benefits offered across multiple gaming operations, 

third-party sponsored programs, and joint programs involving thirdparties; and

(iv) Any other restrictions or limitations, including any related to the claim of 

benefits (e.g., notice of expiration of benefits after a specified period of 

inactivity and rules for use of benefits by spouses or significant others, 

among others).

(f) Security of Player Tracking Accounts. When player tracking systems are used in 

conjunction with Class II gaming then controls should be established for the security and 

management of server, server software and data in accordance with MICS 543.16 (What 

are the minimum internal control standards for the security and management of server, 

server software, and data associated to Class II gaming systems?) and the guidance 

provided in the associated document.
FINAL DRAFT – TGWG 7/28/2011

Player Tracking Systems Page 5 of 5

(1) Controls must require that only authorized agents can access inactive or closed 

accounts.

(g) Audit and Accounting. 

(1) When player tracking systems are used in conjunction with Class II gaming, 

Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

H
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 1 of 15

Cage, Vault, Cash and Cash Equivalents

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for Cage, Vault, Cash and Cash Equivalents. It has been compiled by tribal regulators, Class II 

gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.14. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§543.14 What are the minimum internal control standards for the cage, vault, cash and cash 

equivalents?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Provide supervision for cage, vault, and other operations using cash or cash 

equivalents as needed by an agent(s) with authority equal to or greater than those being 

supervised.

(e) Cash and Cash Equivalent Controls. 

(1) Cash and cash equivalents must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following actions:
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 2 of 15

§543.14 What are the minimum internal control standards for the cage, vault, cash and cash 

equivalents?

(i) Counting; 

(ii) Recording increases and decreases to inventory; 

(iii) Inventory reconciliation;

(iv) Issuance and redemption;

(v) Transfers; 

(vi) Inspecting, validating and verifying; 

(vii) Cancelations and voids; 

(viii) Authorization; and 

(ix) Document retention.

(f) Check Cashing. Check cashing must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must include, 

but not be limited to, the following:

(1) Acceptance of checks;

(2) Deposit of checks (Checks not deposited in the normal course of business are subject 

to §543.15 Lines of Credit standards).

(3) Collecting and recording returned checks; 

(4) Re-deposit; and 

(5) Write-off authorization.

(6) If a third party check cashing or guarantee service is used, the examination and 

documentation procedures required by the service provider shall apply unless 

otherwise provided by tribal law or regulation. 

(g) Cage and Vault Accountability. 

(1) Increases and decreases to cage inventory shall be verified, supported by 

documentation, and recorded. Unverified transfers of cash and/or cash equivalents are 
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 3 of 15

§543.14 What are the minimum internal control standards for the cage, vault, cash and cash 

equivalents?

prohibited. 

(2) The cage and vault inventories (including coin rooms/vaults) shall be counted 

independently by at least two agents, attested to by signature, and recorded in ink or 

other permanent form at the end of each shift during which activity took place. 

(h) Chip(s) and Token(s). Controls must be established to ensure accountability of chip and token 

inventory. Such controls must include, but not be limited to, the following:

(1) Purchase;

(2) Receipt;

(3) Inventory;

(4) Storage; and 

(5) Destruction.

(i) Cage and vault access. Controls must be established to limit physical access to the cage and 

vault. The controls shall also address the transportation of extraneous items (e.g., personal 

belongings, tool boxes, beverage containers, etc.) into or out of the cage and vault.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Cage, 

Vault, Cash and Cash Equivalents. Such SICS should address, at a minimum, how the 

department operates, agents’ responsibilities, and controls to protect assets. The TGRA 

should review and approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 4 of 15

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision. 

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a cage or 

vault agent without any other supervision. In such instances, however, a 

supervisory agent either independent of the transaction or independent of the 

relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 5 of 15

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function.

(d) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often cage and vault should be audited. When an assessment and review 

is necessary, an agent independent of the organizational component responsible for 

conducting cage/vault operations should perform it.

(e) Cash and Cash Equivalent Controls. This section will cover controls for both 543.14(d) 

“Cash and cash equivalent controls” and 543.14(f) “Cage and vault accountability.” Cash 

and cash equivalents must be controlled in a manner designed to prevent unauthorized 

access, misappropriation, forgery or fraud. Such controls must include, but not be limited 

to, the following actions:

(1) Counting. 

(i) The cage, vault and satellite windows (including coin room) inventories 

must be counted by both incoming and outgoing agents. 

(ii) To maintain individual accountability, each agent must perform

independent counts and record such counts on an inventory document in 

ink or other permanent form to verify accuracy. Such counts should also 

be attested to by signature of each agent. These counts should be recorded 

at the start and end of each shift during which activity took place.

(iii) Cage and vault inventories may include but not be limited to the 

following: 

(A) Loose, strapped and bundled currency, including mutilated and 

foreign currency;

(B) Loose, rolled and bagged coin;

(C) Personal checks, cash advances, casino checks, funds on deposit

and safekeeping;

(D) Chips and tokens:

(E) All banks, such as cage banks, main bank floats, kiosk banks and 

kiosk fills.
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 6 of 15

(f) Recording Increases and Decreases to Cage/Vault Inventory.

(1) All increases and decreases to inventory must be documented and summarized on 

a cage accountability document that includes but is not limited to:

(i) Date;

(ii) Shift;

(iii) Starting and ending inventory values;

(iv) Summary of like transactions recording the values in and out separately; 

and

(v) Variances. 

(2) Best practice suggests that this be completed on a per shift basis with supporting 

documentation. 

(g) Inventory Reconciliation. Inventory reconciliations must be performed at the completion 

of each agent’s shift. All variances must be noted and investigated. Best practice 

suggests that an agent independent of the agent responsible for the bank and preferably a 

supervisory agent perform the investigation. 

(h) Issuance and Redemption. Controls should be established that detail issuance and 

redemption procedures and should include the appropriate Title 31 logging and reporting 

requirements. Such controls should include procedures for but not limited to the 

following:

(1) Voucher redemptions;

(2) Check cashing;

(3) Chip or token exchanges;

(4) Player tracking accounts that offer redeemable cash and/or cash equivalents;

(5) Patron deposit accounts, deposits and withdrawals;

(6) Fills and credits;

(7) Bank issuance to other departments;

(8) Bank deposits;
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 7 of 15

(9) Cash received from the bank;

(10) Coupon redemptions;

(11) Manual payouts;

(12) Markers issued and payments;

(13) Sales recordation; and

(14) Other issuance or redemptions as required. 

(15) Best practice suggests that patrons redeem cash equivalents for cash at change 

booths, cages or other manned locations when patron identification is required. 

Alternatively, if a gaming operation utilizes a self-serve redemption kiosk(s), use 

of secured method of access is an acceptable method for verifying patron 

identification. Thresholds should be established for the maximum dollar amount 

of vouchers, coupons and patron account balances that can be redeemed in 

accordance with applicable IRS regulations or other thresholds established by the 

gaming operation or the TGRA.

(16) Best practice suggests that when redemption systems are temporarily unavailable,

agents may redeem the instrument after recording the following:

(i) Unique identifier number;

(ii) Date and time;

(iii) Dollar amount;

(iv) Issuing device number; and

(v) Marking ticket paid.

(17) These instruments must remain in cage accountability for reconciliation purposes.

(i) Transfers. A transfer is any issuance, return, or other transfer of cash and/or cash 

equivalents, including all banks and cash drawers that include cash or cash equivalents. 

Controls should be designed in a manner to prevent unauthorized access, 

misappropriation, forgery, theft or fraud for all transfers, including from count room to 

cage/vault. Such controls must include, but not be limited to, the following:

(1) Unverified transfers of cash and/or cash equivalents are prohibited;
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 8 of 15

(2) Each transfer is counted and documented independently by each agent 

participating in the transfer including: 

(i) Date;

(ii) Time;

(iii) Shift;

(iv) Location (e.g., table number, bank number, booth, among others);

(v) Amount;

(vi) Signature of agent issuing/returning funds; and 

(vii) Signature of agent obtaining the funds.

(3) Agents certify by signature the accuracy of the transfer;

(4) All inventories/banks assigned to individual cage or vault agents are counted by 

the oncoming (or the agent to which accountability is transferred) and outgoing 

cage or vault agents; and

(5) Any variances are documented and investigated.

(j) Floating Bank Increases/Decreases. For any floating bank inventory (i.e., imprest), 

increases and decreases to inventory must be properly documented on multi-part forms.

One part of the form should remain with the agent initiating the transaction, one part 

should remain with the agent issuing the funds, and if applicable, one part of the form 

should go with the agent delivering the funds (i.e., runner) and be returned with the 

signature of the agent who receives the funds. All copies are forwarded to accounting.

(1) General. The multi-part form should include: 

(i) Date;

(ii) Time;

(iii) Shift;

(iv) Location;

(v) Amount (by denomination) being exchanged;

(vi) Signature of the agent releasing the funds;
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 9 of 15

(vii) Signature of the agent transferring the funds (runner); and 

(viii) Signature of the agent exchanging the funds.

(2) Card Games. In addition to the general documentation described in the previous 

section, the following controls must be established:

(i) Fill and credit transactions must be authorized by supervisory agents. 

(ii) Marker and Marker Payments. Marker and marker payments must be 

authorized by supervisory agents and documented on a multi-part form 

with the following information:

(A) Name of the patron;

(B) Patron account number;

(C) Table number (if issued/paid at the table);

(D) Amount issued/paid, including the nature of payment (i.e., cash, 

chips, check);

(E) Patron signature (on issuance);

(F) Authorizing agent signature; and

(G) Date and time. 

(iii) Upon re-payment, the original marker is returned to the patron and a copy 

is sent to accounting. If re-payment is made at the table, the copy should 

be placed in the drop box. 

(k) Exchanges.

(1) Even Exchanges. Even exchanges occur when a cash equivalent is exchanged for 

cash or vice versa, such as an exchange of chips for cash or cash for chips, for 

example. This can occur between a table and the card room bank, cage, or vault. 

All such transactions must be documented, and in the case of a card game, the 

exchange must be evidenced by the placement of a lammer on the card table. 

(2) Best practice suggests even exchanges should be documented on a multi-part 

form. One part of the form should remain at the location where the funds were 

released until the exchange is complete. One part should accompany the funds 

during the exchange and be returned with the signature of the agent who 
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 10 of 15

exchanged the funds. All copies should be forwarded to accounting. The multipart form should include: 

(i) Date;

(ii) Time;

(iii) Shift;

(iv) Location;

(v) Amount (by denomination) being exchanged;

(vi) Signature of the agent releasing the funds;

(vii) Signature of the agent transferring the funds (runner); and 

(viii) Signature of the agent exchanging the funds. 

(l) Inspecting, Validating, and Verifying. Best practice suggests that controls be established

in a manner to detect forged or altered instruments and counterfeit currency. Such 

procedures should require an examination of cash and cash equivalents to determine 

authenticity and should include but not be limited to the following:

(1) Vouchers;

(2) Check cashing;

(3) Chip or token exchanges;

(4) Patron deposit accounts, deposits and withdrawals;

(5) Coupon redemptions; and

(6) Other issuance or redemptions as required.

(m) Cancellations and Voids. Cancellations like voids invalidate a transaction or instrument 

and do not include cancellation of redeemed or paid instruments. Controls should be 

established for cancellations and voids that include but are not limited to: 

(1) Authorization; 

(2) Recording on system or manual logs;

(3) Void the physical instrument, including the following:
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 11 of 15

(i) Mark an indication of void across the instrument’s face (e.g., stamping 

“void” or cross-out); 

(ii) Signatures of agent(s), two agents should be required if manually 

cancelled or voided;

(iii) Reason; and

(iv) Date and time.

(4) Independent review of cancellations and/or voids. 

(n) Authorization. Authorization thresholds must be established for all cash and cash 

equivalent transactions. Thresholds may be set for each agent, role or position. An 

example would be that a cashier must have a second authorization to process a chip 

exchange greater than $3,000.00, but a supervisor might not.

(o) Document Retention. Controls must be established to ensure that cage and vault 

documentation is properly secured until transferred to accounting. Best practice suggests

that each cage and vault secure daily audit and accounting records, forms, and documents 

prior to audit. For example a cashier may place records in a locked box for next-day 

delivery to accounting for audit.

(1) Cage and vault records must be retained in accordance 543.19 (Audit and 

Accounting) and related guidance documents.

(p) Check Cashing. Check cashing must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery or fraud. Such controls must include, but 

not be limited to, the following:

(1) Acceptance of checks. Controls should be established that include but are not 

limited to:

(2) Amount limits and authorization thresholds;

(3) Type of check (i.e., personal, business, payroll, third-party, counter, travelers

etc.);

(4) Information that must be printed and/or recorded includes:

(i) Patron name;

(ii) Patron signature;
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 12 of 15

(iii) Date check was cashed;

(iv) Unique identifier (e.g., check number);

(v) Patron’s valid identification;

(vi) Bank endorsement (e.g., deposit account stamp);

(vii) Patron bank name, routing and account numbers; and 

(viii) Identity and/or signature of agent cashing the check.

(5) If checks are cashed utilizing a third-party guarantee or check cashing service, 

controls must be established to ensure that all procedures required by such service 

are adhered to unless otherwise provided by Tribal law or regulation. 

(q) Deposit of Checks. Controls must be established for the timely deposit of checks to 

minimize the risk of returned checks. Best practice suggests that checks be deposited 

daily. Checks not deposited in the normal course of business, such as checks excluded 

from regular deposits (i.e., check hold), are subject to §543.15 Lines of Credit minimum 

internal control standards.

(r) Collecting and Recording Returned Checks. Controls must be established for the 

accounting, recording and collecting of returned checks. Such controls should include 

but are not limited to:

(1) Documentation of returned check that includes but not limited to: 

(i) Patron name;

(ii) Date of check;

(iii) Amount;

(iv) Reason for return (e.g., insufficient funds, frozen account, hold);

(v) Any fees associated with the return;

(vi) Payment amounts;

(vii) Dates of each transaction or event for that check; and 

(viii) Outstanding balance.

(2) Suspension of patron check cashing privileges until returned checks are settled;
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 13 of 15

(3) Payment procedures that include but are not limited to: 

(i) Segregation of duties to ensure that all payments are processed by an 

agent(s) independent of the agent(s) who processed the deposits;

(ii) All payments are processed and recorded at an authorized location (i.e.,

cash payments made at the cage, payments received by mail posted by 

Accounting, among others);

(iii) Payments are recorded and the amount verified against outstanding 

balance owed on the returned check; and

(iv) Receipts are provided to the patron, which may include but not be limited 

to:

(A) Return of the original check;

(B) Receipts for any additional fees paid (i.e., bank and/or collection 

charges); and 

(C) Receipts for all partial payments. 

(4) Reconciliation of records must be performed in accordance with §543.19 (What 

are the internal control standards for Audit and Accounting?) and related guidance 

documents. 

(s) Re-Deposits. If the gaming operation re-deposits returned checks, controls must be 

established for the re-deposit of those checks using the same controls described for 

collection and recording returned checks.

(t) Write-Off Authorization. Controls must be established for write-offs that include but are 

not limited to:

(1) Policies that detail when a returned check should be written off. Best practice 

suggests that all means of collection should be exhausted prior to write-off; 

(2) Write-off authorization limits and thresholds, which may be determined by agent, 

role or position; 

(3) Signatures of at least two agents, with at least one of them being a supervisory 

agent; and 

(4) Documentation, which includes reason for write-off.
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 14 of 15

(u) Check Cashing Services. If a third-party check cashing or guarantee service is used, the 

examination and documentation procedures required by the service provider shall apply 

unless otherwise provided by Tribal law or regulation.

(v) Chip(s) and Token(s). Controls must be established to ensure accountability of chip and 

token inventory. Such controls must include, but not be limited to, the following

requirements:

(1) Authorization of purchases;

(2) Proper receipt and recording of shipments;

(3) Periodic inventory counts to reconcile against the purchases and to determine 

liability of circulated chips and tokens. Best practice suggests that this 

reconciliation is performed monthly and if the inventory amounts exceed 

purchases, an investigation should be performed, documented and results 

forwarded to management and/or the TGRA. Notably, an incidence of more 

inventory than purchases could indicate that chips or tokens have been 

counterfeited;

(4) Secure storage of all chips and tokens; 

(5) Use of destruction methods such as shredding, melting or concrete encasement 

that at minimum physically change the chips or tokens to indicate they have been 

removed from circulation in order to prevent the re-circulation of these chips or 

tokens; and 

(6) Require that destruction of chips and tokens is authorized, documented and 

performed by at least two agents, preferably one of which is a supervisory agent. 

Best practice suggests that the destruction be performed under surveillance. All 

records of the destruction must be forwarded to accounting.

(w) Cage and Vault Access. Controls must be established and procedures implemented to 

limit physical access to the cage and vault. The controls shall also address the 

transportation of extraneous items (e.g., personal belongings, tool boxes, beverage 

containers, etc.) into or out of the cage and vault. 

(1) Access to the cage and vault areas must be limited to authorized agents. The 

controls should require the maintenance of a list that specifies the authorization 

levels and area(s) of access for each agent.

(2) Access by others not on the list must be approved, at minimum, by management

of the area being accessed and recorded.
FINAL DRAFT – TGWG 7/28/2011

Cage, Vault, Cash and Cash Equivalents Page 15 of 15

(3) Cage and vault areas must be secured with locks and keys, card swipes, 

biometrics or other methods of secure access.

(4) Best practice suggests the transportation of extraneous items into or out of the 

cage and vault should be strictly controlled. Such controls should include, but not 

be limited to, the following:

(i) Personal belongings should be placed in lockers and not transported into 

the cage or vault;

(ii) All trash is placed in clear plastic bags and perused by agents prior to 

removal from the cage or vault and by security prior to being placed in 

outside trash cans, compactors, or removal from the facility;

(iii) If food or beverage is allowed in the cage, it must be in transparent 

containers; and

(iv) Agents clear their hands when entering or leaving the cage or vault. The 

same should be performed if the agent has to reach into any areas not 

clearly visible to surveillance (i.e., pockets, the floor, shelves, etc.). 

(x) Audit and Accounting. 

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

I
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 1 of 13

Lines of Credit 

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for Class II gaming operations to issue credit to gaming patrons for wagering activities. It has 

been compiled by tribal regulators, Class II gaming operators, and other industry resources. 

Using best practices, this guidance is specifically designed to accommodate a variety of ways to 

implement controls to comply with Part 543.15. Because each gaming operation is different and 

subject to varying tribal laws and regulations, each tribe is responsible for determining the 

specific controls and procedures that are most suitable for its gaming operations and compliant 

with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.15 What are the minimum internal control standards for lines of credit?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Establishment of Lines of Credit Policy. 

(1) If a gaming operation extends lines of credit, controls must be established to 

safeguard the assets of the gaming operation. Such controls must include the 

establishment of a lines of credit policy including the following:

(i) A process for the patron to apply for, modify, and/or re-establish 

lines of credit, to include required documentation and credit line 
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 2 of 13

§ 543.15 What are the minimum internal control standards for lines of credit?

limit;

(ii) Credit issuer authorization levels;

(iii) Identification of agents authorized to issue lines of credit;

(iv) A process for verifying lines of credit worthiness of applicants; 

(v) A system for recording patron information; to include:

(A) Name, current address, and signature;

(B) Identification credential;

(C) Authorized credit line limit; and

(D) Approval by an agent authorized to approve credit line 

limits;

(vi) A process for issuing lines of credit to include the following: 

(A) Notice to patron of lines of credit terms including patron 

written acknowledgment by signature;

(B) Completion of a uniquely identified, multi-part, lines of 

credit issuance form, such as a marker or counter check, 

which includes the terms of that lines of credit transaction;

(C) Signatory requirements;

(D) Determining the amount of the patron’s available lines of 

credit;

(E) Creation and maintenance of current lines of credit balance 

record updated at the time of each transaction to assure that 

lines of credit issued is within the established limit and 

balance for that patron. 

(F) Requirement that the agent issuing the lines of credit must 

be independent of the agent who authorized the lines of 

credit.

(vii) A policy establishing credit line limit exceptions to include the 

following:
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 3 of 13

§ 543.15 What are the minimum internal control standards for lines of credit?

(A) Identification of the agent(s) authorized to permit a credit 

line limit to be exceeded; 

(B) Authorization thresholds; and

(C) Required documentation.

(viii) A policy governing increases and decreases to a patron’s lines of 

credit account balances to include the following:

(A) Documentation and record keeping requirements;

(B) Independence between the department that receives the 

payment and the department that maintains custody of the 

credit balance for payments made by mail; 

(C) Collections;

(D) Periodic audits and confirmation of balances; and

(E) If a collection agency is utilized, a process to ensure 

documentation of increases and decreases to the lines of 

credit account balances.

(ix) A policy governing write-offs and settlements to include:

(A) Identification of agent(s) authorized to approve write-offs 

and settlements;

(B) Authorization levels for write-offs and settlements of lines 

of credit instruments;

(C) Required documentation for write-offs and settlements;

(D) Independence between the agent who established the lines of 

credit and the agent writing off or settling the lines of credit 

instrument. 

(E) Necessary documentation for the approval of write-offs and 

settlements and transmittal to the appropriate department for 

recording and deductibility.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 4 of 13

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Lines of 

Credit. Such SICS should address, at a minimum, how the department operates, agents’ 

responsibilities, and controls to protect assets. The TGRA should review and approve the 

SICS prior to implementation

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances. 

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 5 of 13

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a lines of 

credit agent without any other supervision. In such instances, however, a 

supervisory agent either independent of the transaction or independent of the 

relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often lines of credit should be audited. When an assessment and review is 

necessary, an agent independent of the organizational component responsible for 

authorizing lines of credit.

(f) Establishment of Lines of Credit Policy. By extending credit to patrons, the gaming 

operation takes the risk that the patron will be unable or unwilling to settle the debt in a 

timely manner. Credit standards must be designed to minimize this risk while 

maintaining the ability to offer credit to patrons in a timely manner.

(1) Agents involved in the credit program must be adequately trained to detect 

suspicious or criminal activity. In particular, agents must be trained to detect 

forgery, fraud, and money laundering.

(2) Agents involved in the credit program should be prohibited from applying for and 

receiving credit from the gaming operation.

(3) Credit may only be issued to patrons and used for gaming purposes within the 

casino and at amounts appropriate to the patron’s financial means and level of 

play.

(4) Oversight of the credit program must be maintained by persons, such as a 

committee, as approved by the TGRA, and should not be automated. Such 

persons shall be responsible for monitoring credit policy compliance.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 6 of 13

(i) An oversight committee may include the General Manager, Chief 

Financial Officer, Compliance Manager, Director of Marketing, and other 

upper level management personnel.

(ii) Gaming operation management should report unresolved exceptions to the 

credit program policy to the oversight committee at least monthly.

(5) Management shall establish a minimum dollar amount for credit lines and cage 

markers. For example, a typical credit line minimum might be $1,000, and a 

typical cage marker minimum might be $500. 

(6) Credit application. A primary purpose of the credit application is to record 

information needed to obtain the patron’s credit history, contact information, and 

record of the patron’s request for credit.

(i) It is strongly recommended that the credit application form indicate that 

the patron consents to the dispute resolution mechanism preferred by the 

TGRA.

(ii) At minimum, the following information must be recorded prior to 

processing an application for credit:

(A) Patron’s full name;

(B) Patron’s current residential address;

(C) Patron’s signature; and

(D) Verification of Patron’s identity, which may consist of:

(1) Valid US Driver’s License;

(2) State issued ID cards;

(3) Military ID cards;

(4) Government issued Driver’s License;

(5) Passports; or

(6) Verified check copy or deposit slip.

(iii) Additional information may also be recorded prior to processing an 

application for credit:

(A) Home phone number and cellular phone number;
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 7 of 13

(B) Date of birth;

(C) Copy of the Social Security Card; 

(D) Copy of a completed W-9 form;

(E) Business information – name, address and phone number; or

(F) Bank name, account number, and ABA number;

(1) If bank information is used to secure a line of credit, the 

account used must be one that checks can be written 

against.

(2) If more than one account is provided, the account against 

which the credit will be debited when it becomes due shall 

be verified, and the balance found to be supportive of the 

credit requested before credit is issued.

(7) Credit application processing.

(i) Prior to extending credit, the patron’s gaming operation credit record and 

other available documentation shall be examined to determine the 

patron’s:

(A) Properly authorized credit limit:

(1) The patron’s current gaming report must be printed and 

examined before credit is issued.

(i) Management shall utilize a gaming information & 

services company that provides patron credit 

information compiled from other gaming 

operations.

(2) Credit authorizers must ensure that a patron is not banned, 

barred, or subject to any gaming facility exclusions before 

credit is issued.

(3) Credit lines shall not exceed the amount that has been 

issued at other casinos without documented justification 

and approvals.

(4) Extension of credit should not exceed a specified period of 

time (e.g., thirty days) without executive management 

approval.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 8 of 13

(5) A credit agency report shall be generated upon a patron’s 

first application for credit, and for extensions of credit.

(B) Past credit issuances and payments:

(1) Derogatory information on the patron’s gaming operation 

credit record requires review by management before 

issuance of credit.

(2) Best practice suggests a patron with a negative payment 

history with the gaming operation should not be extended 

credit.

(C) Whether remaining credit is sufficient to cover the credit issuance; 

and

(D) Verification of the identity of the patron.

(8) Credit authorization. Management shall establish a chart of credit authorizers 

detailing job title and the associated maximum dollar amount able to be 

authorized by that position.

(i) Credit must be approved only after careful consideration of all the 

information outlined in the credit program policy. Considerations include:

(A) Patron’s credit balance across all gaming operations;

(B) Current credit history;

(C) Payment history across all gaming operations;

(D) Amount of credit actually used by patron in the past;

(E) Current employment or business information;

(F) Current bank information; and

(G) Personal knowledge of patron’s ability to pay.

(ii) Credit may only be granted or extended by a credit authorizer who is 

authorized to grant or extend credit of an amount equal to or higher than 

the amount of credit to be authorized. 

(iii) All approvals of credit extensions over ten percent of the previously 

established limit shall be documented.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 9 of 13

(iv) The job functions of credit approval (i.e., establishing the patron’s credit 

worthiness) and credit extension (i.e., advancing patron’s credit) shall be 

segregated for credit extensions to a single patron of a specified amount 

(e.g., not to exceed $5,000 per day).

(v) If credit is extended to a single patron exceeding a specified amount (e.g.,

$5,000), appropriate gaming personnel shall be notified on a timely basis 

of the patron’s playing on credit, the applicable amount of credit issued, 

and the available balance.

(9) Cage marker forms. Cage marker forms must be at least two parts (the original 

marker and a payment slip), and pre-numbered by the printer or concurrently 

numbered by the computerized system, and utilized in numerical sequence.

(i) The completed original cage marker shall contain at least the following 

information:

(A) Marker number;

(B) Patron’s name and signature; and

(C) Amount of credit issued (both alpha and numeric).

(ii) It is the responsibility of the credit authorizer to be certain that all required 

information has been received.

(iii) After the patron has completed the credit application, the credit authorizer 

shall enter the following on the permanent record of the application:

(A) Total amount of credit authorized;

(B) Date of authorization;

(C) Credit authorizer’s printed name; and

(D) Credit authorizer’s signature.

(g) Payments. Internal controls must be established which clearly document the receipt of 

payments, including partial payments, and ensure that they are properly credited to the 

patron’s credit account.

(1) The total amount of payments received by mail shall be reconciled on a random 

basis with the total receipts recorded by the cage to ensure proper application to 

the patron’s credit account, best practice suggests at a minimum three days a 

month.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 10 of 13

(2) All payments received on outstanding credit instruments shall be recorded in ink 

or other permanent form of recordation in the gaming operation’s records.

(i) The completed payment slip shall include:

(A) The same marker number as the original;

(B) Date and time of payment;

(C) Amount of payment;

(D) Nature of settlement (cash, chips, check, etc.); and 

(E) Signature of cashier receiving the payment.

(3) Credit line payment dispositions. Management shall establish a chart of deposit 

dates based on the total amount of the credit line.

(4) When partial payments are made on credit instruments, they shall be evidenced by 

a multi-part receipt (or another equivalent document) that contains:

(i) The same preprinted number on all copies;

(ii) Patron’s name;

(iii) Date of payment;

(iv) Dollar amount of payment (or remaining balance if a new marker is issued), 

and nature of settlement;

(v) Signature of agent receiving payment; and

(vi) Number of credit instrument on which partial payment is being made.

(5) Check cashing. Checks cashed are to be applied against a patron’s credit line.

Best practice suggests the following:

(i) Business checks should only be accepted if the check has the patron’s full 

name and business address on the bank-issued check.

(ii) Corporate, partnership, or other non-individual checks should be 

prohibited.

(iii) Business checks should not be accepted from newly established patrons.

(6) Unless account balances are routinely confirmed on a random basis by the 

accounting or internal audit departments, or statements are mailed by a person 
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 11 of 13

independent of the credit transactions and collections thereon, and the department 

receiving payments cannot access cash, then the following standards should

apply:

(i) The routing procedures for payments by mail require that a department 

independent of credit instrument custody and collection receive such 

payments;

(ii) Such receipts by mail shall be documented on a listing indicating the 

patron's name, amount of payment, nature of payment (if other than a 

check), and date payment is received; and

(iii) The total amount of the listing of mail receipts shall be reconciled with the 

total mail receipts recorded on the appropriate accountability form by the 

accounting department on a random basis (best practice suggests that this 

be completed for at least three (3) days per month).

(h) Access to Credit Documentation. Internal control standards must be developed that

reflect the highly confidential nature of patron credit information and evaluations. 

(1) The gaming operation’s opinion relative to any credit risk must be expressed only 

by and limited to those who are responsible for the administration of the credit 

function. 

(2) It is the responsibility of the credit department to protect the 

confidentiality of credit information and to ensure that only those entitled have 

access to credit records.

(3) Credit statements. Credit statements shall only be provided to patrons upon 

request after verification of their identity. If by mail, the patron’s request must be 

notarized, and the statement mailed only to the address identified on the credit 

application.

(i) Maintenance of Credit Documentation. All documentation required by the credit 

program policies and procedures must be maintained while a credit account is active and 

for a reasonable duration thereafter. This includes documentation not contained on 

gaming operation forms or computer systems, such as credit reports, correspondence with 

the patron, and credit authorizer notes.

(1) All extensions of credit and subsequent payments shall be documented on a credit 

instrument control form.

(2) Records of all correspondence, transfers to and from outside agencies, and other 

documents related to issued credit instruments shall be maintained.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 12 of 13

(3) Account codes. Management shall establish a chart of account codes for use by 

the credit department. These account codes may only be changed or updated by 

authorized agents. For example:

(i) Active: Signifies that the account is ready to be used by the patron and 

that no information is needed for the file.

(ii) Pending: Signifies that additional information must be provided before 

the status may be changed to Active.

(iii) Inactive: Signifies that the patron has not used their credit line for a 

lengthy period of time and the credit line has been removed.

(iv) Credit Suspended: Signifies that the patron lost their credit line due to 

negative history.

(j) Write-Offs and Settlements. Management must establish clear standards defining when 

and by whom a patron’s credit account balance may be settled for less than the full 

amount, or written-off as uncollectable.

(1) Written-off or settled credit instruments shall be authorized in writing.

(2) Such authorizations shall be made by at least two management agents who are 

from departments independent of the credit transaction.

(3) Settlements.

(i) After all collection efforts have been exhausted or special conditions exist, 

management may request the credit committee or TGRA, if applicable, to 

authorize settlement for a lesser amount. The consideration of settlement 

offers include the following reasons:

(A) The settlement is the only cost effective way to induce partial 

payment.

(B) The settlement is the result of a dispute with the patron regarding 

the existence of the debt.

(C) The settlement is required to retain the patron’s future business.

(D) The settlement is required to obtain the patron’s business and 

obtain timely payment.

(ii) Where possible, all parties involved in the settlement, including the 

patron, shall sign the settlement document.
FINAL DRAFT – TGWG 7/28/2011

Lines of Credit Page 13 of 13

(4) Write-offs.

(i) After all collection efforts have been exhausted, the decision may be made 

to write off a credit account.

(ii) A list of marker numbers and amounts are recorded along with a grand 

total amount.

(iii) The markers are flagged as written off and taken out of the cage inventory. 

(iv) A copy of the write-off paperwork is sent to the appropriate department.

(v) Any write-offs in excess of a certain amount will require documented 

approval in accordance with established policy.

(k) Collection Agency Use. Utilizing a collection agency does not relieve the gaming 

operation of its responsibilities to maintain documentation of the patron’s credit account.

(1) When outstanding credit instruments are transferred to a collection agency, or 

other collection representatives, a copy of the credit instrument and a receipt from 

the collections representative shall be obtained and maintained until such a time 

as the credit instrument is returned or payment is received.

(2) Best practice suggests at least quarterly an agent independent of credit 

transactions should routinely confirm on a random basis all collection account 

balances and records.

(3) Best practice suggests that at least quarterly the appropriate department should

examine credit records to determine that appropriate collections efforts are being 

made and payments are being properly recorded.

(l) Audit and Accounting. 

(1) When lines of credit are issued for Class II gaming activities, controls must be 

established for audit and accounting in accordance with MICS 543.19 (What are

the minimum internal control standards for audit and accounting?) and the 

guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

J
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 1 of 9

Security and Management of Server, Server Software and Data Associated 

with Class II Gaming Systems

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of Class II information systems. It has been compiled by tribal regulators, 

Class II gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.16. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.16 What are the minimum internal control standards for Security and Management of 

Server, Server Software and Data Associated with Class II Gaming Systems?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Class II Gaming Systems and Physical Controls. Controls must be established to 

ensure:

(1) Control of physical and logical access to server, server software and data 

associated with Class II gaming systems, including accounting, voucher, 

cashless and player tracking, among others used in conjunction with Class II 

gaming;

(2) Physical and logical protection of storage media and its contents, including

recovery procedures;

(3) Access credential control methods; 
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 2 of 9

§ 543.16 What are the minimum internal control standards for Security and Management of 

Server, Server Software and Data Associated with Class II Gaming Systems?

(4) Record keeping and audit processes; and, 

(5) Departmental independence, including, but not limited to, means to restrict 

agents that have access to server, server software and data from having 

access to financial instruments. 

(d) Independence. All personnel having access to Class II gaming servers, server 

software and/or data are independent of and restricted from access to:

(1) Financial instruments (e.g., cash, cash equivalents, vouchers, and coupons);

(2) Signatory authority over financial instruments and payouts forms; and

(3) Accounting, audit, and ledger entries.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to the 

Security and Management of Server, Server Software, and Data Associated with Class II 

Gaming Systems. Such SICS should address, at a minimum, how the department 

operates, agents’ responsibilities, and controls to protect assets. The TGRA should 

review and approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 3 of 9

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation;

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

responsible for ensuring that the department or area is operating in accordance 

with established policies and procedures.

(2) The supervisory agent should be independent of the operation of Class II games. 

Best practice suggests when assigning supervisory responsibilities to the agent(s) 

holding this position(s), the following duties should be considered: 

(i) Developing an organizational chart of the department or area;

(ii) Defining job descriptions; 

(iii) Developing a narrative description of the reporting structure, which is 

designed to ensure adequate supervision and segregation of function;

(iv) Establishing systems security management policies and controls;

(v) Monitoring and enforcing compliance with security and internal control 

standards;

(vi) Assigning security roles, responsibilities, and specifying required skills, 

and access privileges;
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 4 of 9

(vii) Assessing potential risks to the security and integrity to the Systems, 

establishing risk thresholds, and actively managing risk mitigation;

(viii) Ensuring implementation of security requirements for strategic partners 

and other third parties;

(ix) Identifying and classifying information assets;

(x) Protecting the physical environment;

(xi) Ensuring internal and external audits of the information security program 

with timely follow-up; and

(xii) Establishing a comprehensive Systems security program and oversight of, 

including but not limited to, the following:

(A) User access controls and privileges;

(B) Configuration management;

(C) Event and activity logging and monitoring;

(D) Communications and remote access security;

(E) Malicious code protection, including viruses, worms, and Trojans;

(F) Software installation and change management;

(G) Firewalls;

(H) Data encryption; and

(I) Backup and recovery.

(3) Controls should ensure that duties are adequately segregated and monitored to 

detect procedural errors and prevent the concealment of fraud. 

(4) Internal controls must require that all personnel having access to Class II gaming 

Systems have no signatory authority over financial instruments and payout forms 

and are independent of and restricted from access to:

(i) Financial instruments (e.g., cash, cash equivalents, vouchers, and 

coupons); and

(ii) Accounting, audit, and ledger entries.
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 5 of 9

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often the security and management of server, server software, and data 

associated with Class II gaming should be audited. When an assessment and review is 

necessary, an agent independent of the organizational component responsible for the 

security and management of server, server software, and data associated with Class II 

gaming should perform it.

(f) Physical Security.

(1) Internal controls must require that all servers, server software and data associated 

with Class II gaming be stored in a secured physical location such that access is 

restricted to authorized agents only.

(2) Access devices (e.g., keys, cards, fobs) to the Systems secured physical location 

should be controlled by an independent agent (e.g., security, audit).

(3) Access to the Systems’ secured physical location must be restricted to agents 

only. Vendors may be authorized access as agents in accordance with established 

policies and procedures. A record of agents granted access privileges must be 

maintained and updated. The records should be verified prior to allowing 

physical access to the Systems.

(4) Communications to and from Systems via wires, switches, hubs, wireless, 

telephone and/or any other technology must be physically secured from 

unauthorized access.

(g) Logical Security.

(1) Internal controls should require that security standards and procedures are 

designed and operate to protect all Systems and are documented and enforced to 

ensure:

(i) Access to Systems software and application programs is restricted and 

secured from unauthorized access;

(ii) Access to data associated to Class II gaming is restricted and secured from 

unauthorized access; 

(iii) Access to communications facilities, systems, and information 

transmissions associated to Class II gaming systems is restricted and 

secured from unauthorized access; and

(iv) Unused services and non-essential ports are disabled whenever possible. 

The manufacturer/supplier of the System must be consulted prior to the 

deactivation of any service or ports to ensure that an essential service/port 
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 6 of 9

is not inadvertently disabled. For example, many essential services only 

run sporadically, so usage by itself is not always a reliable measure of

importance or necessity. 

(2) Procedures are in place to ensure that all activity performed on Systems is 

restricted, secured from unauthorized access, and logged. Authorized agents may 

include vendors and other client and/or host systems but only in accordance with 

established policies and procedures.

(3) Communications to and from Systems via wires, switches, hubs, modems, routers, 

wireless access points, telephone and/or any other technology must be logically 

secured from unauthorized access.

(h) User Controls.

(1) Systems, including application software, must be secured with passwords or other 

approved means as applicable. 

(2) Internal controls should require that management personnel or persons 

independent of the department being controlled should assign and control access 

to system functions.

(3) Access credentials (e.g., passwords, PINs, cards) should be controlled as follows:

(i) Each user should have their own individual access credential; 

(ii) Access credentials should be changed at established intervals but not less 

than quarterly; and

(iii) Access credential records should be maintained either manually or by 

systems that automatically record access changes and force access 

credential changes, including the following information for each user:

(A) User’s name;

(B) Date the user was given access and/or password change; and

(C) Description of the access rights assigned to user. Many system and 

operators manage access rights per user profile or position. This 

method aids in assuring all users of the same position have access 

controls based on the same user profile. 

(4) Controls and procedures should ensure that when an individual has multiple user 

profiles, only one user profile per application is used at a time.
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 7 of 9

(5) Patrons may also be “users” of a Class II gaming system, including player 

tracking systems used in association with Class II gaming, and patron access is 

subject to the operation controls and procedures.

(6) Lost or compromised access credentials must be deactivated as soon as possible, 

generally within 24 hours if not immediately.

(i) Security or destruction of access credentials (e.g., cards, fobs, etc.) found 

meets the deactivation requirement. 

(ii) Unrestricted Patron Deposit Account access credentials (e.g., card, fob, 

etc.) should be secured and not destroyed for a specified period of time 

sufficient to provide accounting to account for any remaining balances.

(7) Controls should require that the access credentials of terminated users must be 

deactivated within a specified period of time. Best practice suggests that such 

deactivation should be completed immediately upon an agent’s termination, 

where possible, but within 24 to 72 hours of termination at most. When 

determining the allowable time period for deactivation, the level of risk for the 

access held by the terminated user should be considered.

(8) Controls must require that only authorized agents can access inactive or closed 

accounts of other users, such as player tracking accounts and terminated employee 

accounts, among others.

(i) Installations & Modifications.

(1) Controls must mandate that only TGRA authorized or approved systems and 

modifications can be installed.

(2) Internal controls must require recordkeeping of all new installations and/or

modifications to Class II gaming systems. These records should include, at a 

minimum:

(i) The date of the installation or change;

(ii) The nature of the installation or change (e.g., new software, database 

update, server repair, significant configuration changes [e.g., such as 

player tracking point structure changes]); 

(iii) Evidence of verification that the installation or the changes are approved 

(i.e., checksums, versions); and

(iv) The identity of the agent(s) performing the installation/modification. 
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 8 of 9

(3) Except for emergencies, best practice suggests procedures should be implemented 

to plan installations and modifications in advance and to minimize interruption of 

gaming activity and service to patrons.

(4) Documentation should be maintained (e.g., manuals, user guides) describing the 

systems in use and the operation, including hardware.

(5) Best practice suggests that changes to the Systems should be done in consultation 

with the manufacturer and/or supplier to prevent damage, both physical and 

logical, or compliance concerns to the approved system.

(j) Remote Access.

(1) Remote access to Systems should be governed by a detailed set of policies and 

procedures. Remote access may be allowed by agents for system support as long 

as each access is documented and maintained at the place of authorization,

including:

(i) Name of agent authorizing access;

(ii) Name of agent accessing system;

(iii) Verification of the agent’s authorization;

(iv) Reason for remote access;

(v) Description of work performed; and

(vi) Date, time, and use start and end of access.

(2) Controls must require that all remote access is performed via a secured method.

(k) Incident Response.

(1) Controls should require documented procedures for responding to, investigating, 

resolving, documenting, and reporting security incidents associated with Systems.

(2) Procedure should require timely response to all security incidents, be formally 

documented and tested at specified intervals not less than annually.

(l) Backups and Disaster Recovery.

(1) Controls should include adequate backup and disaster recovery procedures

including, but not limited to, the following:

(i) Daily backup of all data;
FINAL DRAFT – TGWG 7/28/2011

Security and Management of Server, Server Software and Data Page 9 of 9

(ii) Backup of all programs or the ability to reinstall the exact programs as 

needed;

(iii) Secured storage of all backup data files and programs, or other adequate 

protection. Backup data files and programs should be stored in a secured 

manner in another building that is physically separated from the building 

where the system’s hardware and software are located. Backup data files 

and programs may also be stored in the same building as the 

hardware/software as long as such files and programs are secured in a 

fireproof safe or some other manner that will ensure the safety of the files 

and programs in the event of a fire or other disaster;

(iv) Mirrored or redundant data source; and

(v) Redundant and/or backup hardware.

(2) Controls should include disaster recovery procedures, including but not limited to, 

the following.

(i) Data backup restoration;

(ii) Program restoration; and

(iii) Redundant or backup hardware restoration.

(3) Disaster recovery procedures should be tested on a sample basis at specified 

intervals not less than annually with test results documented.

(4) Backup data files and disaster recovery components should be managed with the 

same security and access controls as the System for which they are designed to 

support. 

(m) Audit and Accounting. 

(1) When servers, server software, and data are used in conjunction with Class II 

gaming, controls must be established for audit and accounting in accordance with 

MICS 543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

K
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 1 of 6

Complimentary Services or items

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for complimentary services or items. It has been compiled by tribal regulators, Class II gaming 

operators, and other industry resources. Using best practices, this guidance is specifically 

designed to accommodate a variety of ways to implement controls to comply with Part 543.17. 

Because each gaming operation is different and subject to varying tribal laws and regulations, 

each tribe is responsible for determining the specific controls and procedures that are most 

suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.17 What are the minimum internal control standards for complimentary services or 

items?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(d) Supervision. Supervision shall be provided for approval of complimentary services 

as needed by an agent(s) with authority equal to or greater than those being 

supervised.

(e) Complimentary Services or Items. Controls must be established in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. 

Such controls must include, but not be limited to, the following:

(1) How the gaming operation delegates to its personnel the authority to approve 
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 2 of 6

§ 543.17 What are the minimum internal control standards for complimentary services or 

items?

the issuance of complimentary services or items, including levels of 

authorization for the agents approving the issuance of complimentary 

services or items;

(2) Written limits and conditions on the approval and issuance of complimentary 

services or items, and how the conditions or limits of authority may be 

modified, 

(3) Documentation and recordation requirements for the authorization, issuance, 

and tracking of complimentary services or items, including cash and noncash gifts; 

(i) Complimentary issuance records shall include the following for all 

complimentary items and services equal to or exceeding an amount 

established by the TGRA.

(A) Name of patron who received the complimentary service or 

item;

(B) Name(s) of issuer of the complimentary service or item;

(C) The actual cash value of the complimentary service or item;

(D) The type of complimentary service or item (i.e., food, 

beverage, etc.); and

(E) Date the complimentary service or item was issued.

(ii) Reserved.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to 

Complimentary Services or Items. Such SICS should address, at a minimum, how the 

department operates, agents’ responsibilities, and controls to protect assets. The TGRA 

should review and approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 3 of 6

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision. Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in accordance 

with established policies and procedures. 

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 4 of 6

(2) The reporting structure may permit a supervisory agent to function as a 

complementary services or items agent without any other supervision. In such 

instances, however, a supervisory agent either independent of the transaction or 

independent of the relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often complimentary services or items should be audited. When an 

assessment and review is necessary, an agent independent of the organizational 

component issuing complimentary services or items (i.e., marketing or gaming 

department) should perform it.

(f) Complimentary Services or Items. Complimentary services or items must be controlled 

in a manner designed to prevent unauthorized access, misappropriation, forgery or fraud. 

Such controls must include the establishment of comp limits, authorization levels, 

issuance criteria, inventory controls, tracking of complimentary services or items, and 

audit and accounting procedures, as well as the following: 

(1) The procedures by which the gaming operation delegates to its agents the 

authority to approve the issuance of complimentary services or items;

(2) The procedures by which conditions or limits, if any, may apply to such authority 

are established and modified (including limits based on relationships between the 

authorizer and recipient), and must also include audit procedures in accordance 

with 543.19 and related guidance documents; and

(3) The written procedures must include, at a minimum, the following controls:

(i) Only authorized agents may issue complimentary services or items. 

(ii) Functions should be adequately segregated to prevent misappropriation of 

complimentary services or items. For example, the gaming operation 

agents entering manual player ratings resulting in additional comps for a 

patron must obtain approval from a supervisory agent prior to issuing

complimentary services or items to that patron. Conversely, if the agent is 

simply performing a data entry function and did not perform the manual 
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 5 of 6

rating, a requirement for additional authorization to issue complimentary 

services or items is typically not required. 

(iii) Complimentary services or items may only be issued to eligible patrons.

Because comps may only be issued to patrons, best practice suggests that 

if the comp process and forms are used to issue employee incentives, gifts,

or for other business expenses, the form should provide for the appropriate 

tracking for proper accounting. The following examples are illustrative of 

this point:

(A) For example, if management wishes to reward an employee with a 

gift of a free meal in the steakhouse and comp forms are used to do 

so, the form should have an “Employee Incentives” checkbox or 

other notation so that the expense may be properly entered into the 

general ledger. 

(B) Similarly, if management wishes to honor a celebrity with a gift of 

a free night stay at the hotel and comp forms are used to do so, the 

form should have a “Business Expense” checkbox or other 

notation so that the expense may be properly entered into the 

general ledger.

(iv) Records for each comp issuance must include the following: 

(A) Patron name and any additional information required;

(B) Authorizing agent’s name;

(C) Signature of the authorizing agent(s) (electronic signature will 

suffice); 

(D) Cash value of complimentary services or items; 

(E) Type of complimentary services or items given (i.e., food, 

beverage, t-shirt, hotel, travel, etc.);

(F) Date issued; and

(G) Expiration date, if any. 

(v) Maintaining justification for issuance such as patron loyalty programs, 

dispute resolutions, and special occasions, among others.
FINAL DRAFT – TGWG 7/28/2011

Complementary Services or Items Page 6 of 6

(vi) Best practice suggests that manual comp forms should be issued in at least 

duplicate, with one (1) copy forwarded directly to accounting, and one (1) 

copy issued to the patron or point of sale agent for processing.

(vii) Sending redeemed comps and forms to accounting daily for auditing 

purposes.

(viii) Perform audit of comp transactions in accordance with 543.19 (Audit and 

Accounting) and related guidance documents.

(g) Audit and Accounting.

(1) When complimentary services or items are used in conjunction with Class II 

gaming then controls must be established for audit and accounting in accordance 

with MICS 543.19 (What are the minimum internal control standards for audit 

and accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

L
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 1 of 15

Audit and Accounting

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for gaming operation audit and accounting activities. It has been compiled by tribal regulators, 

Class II gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.19. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.19 What are the minimum internal control standards for audit and accounting?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Conflicts of Standards. When establishing SICS the gaming operation should review 

and consider incorporation of other external standards such as GAAP, SSAE, and 

standards promulgated by GASB and FASB. Accordingly, in the event of a conflict 

between the MICS and the incorporated external standards, the external standards 

prevail. 

(d) Operational Audits (formerly “Revenue Audit”). Controls shall be established to 

ensure:

(1) All audits are designed in a manner to detect unauthorized access, 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 2 of 15

§ 543.19 What are the minimum internal control standards for audit and accounting?

misappropriation, forgery, theft, or fraud.

(2) All audits are performed within seven (7) days of the audited activity‟s 

occurrence as follows, unless otherwise specified:

(i) Gaming revenue and payouts;

(ii) Increases and decreases to inventory;

(iii) Cash equivalent inventory count;

(iv) Exceptions, overrides, and voids;

(v) Complimentary services and items records (Weekly);

(vi) Manual increases and decreases to/from player accounts (Weekly); 

(vii) Promotions, contests, and tournaments (Weekly); and

(viii) Key control records (Quarterly).

(3) Minimum bankroll calculations are audited periodically to ensure that the 

gaming operation maintains cash in an amount sufficient to satisfy the 

gaming operation‟s obligations. 

(4) At least bi-annually, an inventory of all drop, count, override, and panel keys 

are performed and increases and decreases in key inventory are reconciled.

(5) Audit results are summarized and recorded. 

(6) Audit controlled inventories for recording the receipt, issuance, and use of 

controlled inventories (including but not limited to bingo cards, pull tabs, 

playing cards, keys, pre-numbered and/or multi-part forms, etc.).

(7) Adjustments to original data are controlled to ensure all adjustments are 

properly completed and documented. 

(8) Exceptions are reviewed for suspect and/or unusual transactions.

(9) Documentation must be generated and maintained evidencing the 

performance of audit procedures. 

(10) If the audit is not performed by accounting agents, the agent(s) performing 

the audit are independent of the agents who performed the transactions being 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 3 of 15

§ 543.19 What are the minimum internal control standards for audit and accounting?

reviewed.

(e) Accounting. Controls must be established to ensure each gaming operation:

(1) Prepares accurate, complete, legible, and permanent records of all 

transactions pertaining to gaming revenue.

(2) Prepares general accounting records on a double-entry system of accounting, 

maintaining detailed, supporting, subsidiary records, and perform the 

following: 

(i) Record gaming activity transactions in an accounting system to 

identify and track all revenues, expenses, assets, and liabilities;

(ii) Produce income and balance sheet statements;

(iii) Produce appropriate subsidiary ledgers to support the balance sheet.

(iv) Inventory and safeguard assets; 

(v) Prepare, review, and maintain accurate financial statements;

(vi) Prepare minimum bankroll calculations; and

(vii) Maintain and preserve all financial books, records, and relevant 

supporting documentation. 

(f) Internal Audit. Controls shall be established to ensure:

(1) Internal auditor(s) perform audits of each department of a gaming operation, 

at least annually, to review compliance with TICS, SICS, and these MICS.

(2) Internal auditor(s) are independent of the gaming operations with respect to 

the departments subject to audit (auditors internal to the operation, officers of 

the TGRA, or outside CPA firm may perform this function).

(3) Internal auditors report directly to the Tribe, TGRA, audit committee, or other 

entity designated by the Tribe.

(4) Documentation (e.g., checklists, programs, reports, etc.) is prepared to 

evidence all internal audit work and follow-up performed as it relates to 

compliance with TICS, SICS, and these MICS.

(5) Reports documenting audits performed are maintained and made available to 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 4 of 15

§ 543.19 What are the minimum internal control standards for audit and accounting?

the Commission upon request.

(6) All material exceptions resulting from internal audit work are investigated 

and resolved with the results documented.

(7) Internal audit findings are reported to management, responded to by 

management in the internal audit report stating corrective measures to be 

taken, and delivered to management, the Tribe, TGRA, audit committee, or 

other entity designated by the Tribe.

(g) Annual Audits.

(1) Agreed upon procedures. A CPA must be engaged to perform, in accordance 

with agreed upon procedures and the most recent versions of the Statements 

on Standards for Attestation Engagements and Agreed-Upon Procedures 

Engagements (collectively „„SSAE‟s‟‟), issued by the American Institute of 

Certified Public Accountants Inc., an assessment of whether the gaming 

operation is in compliance with these MICS, the TICS, and/or the SICS.

(2) The tribe must submit two copies of the agreed-upon procedures report to the 

Commission within 120 days of the gaming operation‟s fiscal year end in 

conjunction with the submission of the annual financial audit report required 

under 25 CFR Part 571.

(3) Require management to have sufficient knowledge and understanding of the 

purpose, nature, and scope of the agreed upon procedures to provide adequate 

oversight and participation in the process to ensure a meaningful and useful 

outcome.

(4) Reliance on Internal Audit. 

(i) Agreed-upon procedures are to be performed by the CPA to 

determine that the internal audit procedures performed during the 

fiscal year have been properly completed. 

(ii) The CPA may rely on the work of internal audit for the completion of 

the MICS checklists as they relate to the standards covered by this 

Part.

(5) Report Format. The Statements on Standards for Attestation Engagements 

and Agreed-Upon Procedure Engagements (SSAE‟s) are applicable to 

agreed-upon procedures engagements required in this Part. All noted 

instances of noncompliance must be documented in the report with a narrative 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 5 of 15

§ 543.19 What are the minimum internal control standards for audit and accounting?

description, the number of exceptions and sample size tested. 

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Audit and 

Accounting. Such SICS should address, at a minimum, how the department operates, 

agents‟ responsibilities, and controls to protect assets. The TGRA should review and 

approve the SICS prior to implementation

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation; 

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 6 of 15

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often operations should be audited. When an assessment and review is 

necessary, an agent independent of the organizational component responsible for 

conducting the audited operations should perform it. 

(f) Conflicts of Standards. When establishing SICS, gaming operations should review and 

consider incorporation of other external standards such as GAAP, SSAE, and standards

promulgated by GASB and FASB. Accordingly, in the event of a conflict between the 

MICS and the incorporated external standards, the external standards prevail.

(g) Operational Audits (formerly “Revenue Audit”).

(1) General. Audits must be performed by agent(s) independent of the transactions being 

audited. Controls must be established to require each of the following operational 

areas to be audited in accordance with a specific audit checklist:

(i) Bingo;

(ii) Pull tabs;

(iii) Card games;

(iv) Gaming promotions;
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 7 of 15

(v) Patron deposit accounts and cashless systems;

(vi) Player tracking;

(vii) Cage, vault, cash and cash equivalents;

(viii) Lines of credit;

(ix) Security and management of server, server software, and data associated 

with Class II gaming systems;

(x) Complimentary services or items; and

(xi) Drop and count.

(2) Daily Audits. 

(i) Daily audit checklists should be generated and maintained to ensure all 

appropriate audit procedures are performed. Daily audit checklists should 

include but are not limited to the following:

(A) Audit date, business date, and operational area;

(B) Recalculation of supporting records and documents to reconcile to 

summarized paperwork (e.g., total sales and payouts per shift

and/or day and for each operational area);

(C) Review of metered amounts for reasonableness;

(D) Verification of metered amounts to actual amounts;

(E) Investigation of variances from actual to meter amounts;

(F) Correction of any meter variances;

(G) Verification that all copies of multi-part forms are secure, 

complete, and unaltered;

(1) Best practice suggests that each operational area secure 

daily audit and accounting records, forms, and documents 

prior to audit. For example, a cashier may place records in 

a locked box for next-day delivery to accounting for audit.

(H) Recalculation of any manually prepared inventory forms; 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 8 of 15

(I) Verify that any inventory variances have been investigated and 

documented;

(J) Verification of beginning balances to previous ending balances;

(K) Documentation of all adjustments to any system generated 

information;

(L) Verification of the integrity of all exception information (i.e.,

voids, overrides);

(M) Verification of signatures on documents;

(N) Verify compliance with established authorization thresholds, if 

applicable;

(O) Verify the integrity of any manually prepared forms;

(P) Account for pre-numbered sequential forms; 

(Q) Verify that adjustments to original data are properly completed and 

documented; and

(R) Review key control logs for proper issuance and return.

(ii) At the end of the daily audit, the financial information should be 

summarized in the accounting records. Daily audit reports should be 

compared and reconciled to the monthly general ledger balances before 

closing each month. 

(3) Weekly Audits. Audits must be performed by agent(s) independent of the 

transactions being audited. Controls must be established to ensure that each of the 

following is audited in accordance with a specific audit checklist at least weekly.

Weekly audits should include:

(i) Complimentary services and items records should be summarized and 

reviewed for proper authorization and compliance with established 

authorization thresholds. If the actual amounts exceed authorization 

thresholds or an improper authorization exists, then the variance should be 

investigated, documented and forwarded to management for review.

(A) A detailed reporting of comp transactions that meet a specified 

threshold should be prepared not less than weekly. Best practice 

suggests that the threshold is not more than $100. The detailed 

report should be forwarded to management for review.
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 9 of 15

(ii) Best practice suggests that all patron account activity be summarized and 

reconciled. Additionally, all manual increases and decreases to patron 

accounts should be summarized and reviewed including but not limited to 

the following account types:

(A) Patron Deposit Accounts;

(B) Player tracking benefits earned and redeemed, including:

(1) Points;

(2) Comps; and/or

(3) Other player tracking awards.

(C) Lines of Credit, including: 

(1) Verifying compliance with credit limits and other 

established credit issuance procedures;

(2) Reconciling accounts receivable balances, of both active 

and inactive accounts, against individual credit records and 

physical instruments;

(3) The audit shall examine records to determine that 

appropriate collection efforts are being made and payments 

are being properly recorded; and 

(4) The following additional audits should be performed at 

specified intervals.

i. Account balances are confirmed on a random basis. 

Best practice suggests quarterly but at least three 

times a year;

ii. Partial payments are reconciled to total payments

recorded by the cage for the day and ensure that 

such partial payments are numerically accounted 

for. Best practice suggests five days per month but 

at least weekly.

(D) Safekeeping.
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 10 of 15

(iii) Promotions, contests, and tournaments should have a weekly 

reconciliation between cash received, cash returned to the patrons, and 

pool balances. This weekly reconciliation should also include:

(A) Verify that any information posted for patron review on 

promotional pool balances is accurate;

(B) Review of tax information; 

(C) Verify that prizes were distributed in accordance with the rules of 

the event; and

(D) If the gaming operation holds entry fees on behalf of players, 

establishing and reconciling a liability (i.e., if the event is not held 

within the same month the funds are received).

(4) Monthly Audits. The following audits should be performed not less than 

monthly:

(i) Reconcile inventory records to the amount of revenue recognized; 

(ii) Verify inventory balances; and

(iii) Review reports at specified intervals (i.e., shift, day, but not less than 

monthly) for statistical fluctuations exceeding a specified threshold (best 

practice suggests using a 3% threshold), including:

(A) Investigate and document variances; and

(B) Report variances to management and the TGRA upon request.

(5) Quarterly Audits. Quarterly audits of keys and key controls should be performed. 

This audit should include:

(i) If using a computerized key system, a review of the access issued to 

agents to verify proper authorization has been granted; and 

(ii) For manual key systems, management should determine (based on the risk 

assessment) how many days to review the sign in/out logs for 

completeness and to verify agents are complying with key control 

procedures.

(6) Periodic Audit of Cash. Best practice suggests a review of gaming operations 

cash on hand and cash in bank at specified intervals based on the outcome of the 

risk assessment. Such review should include:
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 11 of 15

(i) Verification that the gaming operation maintains liquid cash in an amount 

sufficient to satisfy the gaming operation‟s immediate obligations; and 

(ii) Performance of a bank reconciliation to verify that:

(A) Deposits are recorded properly and timely;

(B) Cleared casino checks are compared to check registers;

(C) All cash purchases from the bank are reviewed;

(D) Variances are investigated and documented; and 

(E) Other charges/charge backs (i.e., returned checks) are 

substantiated.

(7) Bi-annual Audits. At least twice a year the following key inventory procedures 

must be performed:

(i) An actual inventory count of active keys, keys waiting for destruction, and 

duplicate (inactive) keys; and

(ii) A reconciliation of keys made and destroyed during the period being 

audited.

(8) Independence of Agents. There must be independence between the agent(s) 

performing the audit and the agent(s) who performed the transactions being 

audited and reviewed.

(9) All audit and accounting records, including investigations and variances, must be 

made available upon request to the TGRA and other authorized entities as 

required.

(h) Accounting.

(1) Controlled Inventories. For any inventories that accounting maintains for proper 

segregation, controls should be developed to account for the following:

(i) Receipt of Inventory. When inventory is received it should be counted 

and recorded on a log. 

(ii) Storage of Inventory. Storage of inventory should be secured and 

recorded on the appropriate log.

(iii) Issuance of Inventory. Issuance of inventory should be performed by an 

accounting agent, and should be recorded on the appropriate log.
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 12 of 15

(iv) Use of Inventory. Accounting should perform a reconciliation between 

inventory used and inventory issued. Variances should be investigated 

and documented, with results forwarded to management.

(v) Return of Inventory. Return of inventory should be performed by an 

accounting agent, and should be recorded on the appropriate log.

(vi) Audit of Accounting Managed Inventory. Controls should require an 

agent independent of accounting to audit any inventories managed by 

accounting.

(2) Preparation of Records. 

(i) The gaming operation must conform to generally accepted accounting 

principles (GAAP) when preparing financial statements, including 

subsidiary ledgers. 

(ii) Best practice suggests the gaming operation should record all transactions 

pertaining to gaming revenue in an automated or computerized accounting 

system. This will help ensure preparation of accurate, complete, legible, 

and permanent records of those transactions. 

(iii) The accounting system should be designed to prepare general accounting 

records on a double-entry system of accounting.

(iv) The accounting system should have the capability to record gaming 

activity transactions to identify and track all revenues, expenses, assets, 

and liabilities in order to produce income and balance sheet statements. 

(v) Appropriate subsidiary ledgers should be prepared and maintained to 

support balance sheet items. Subsidiary ledgers should be reviewed on a 

monthly basis for completeness and accuracy to affirm inventory, asset 

valuation, and liabilities. Subsidiary ledgers should also be verified to the 

general ledger balances monthly and all variances investigated and 

documented. 

(vi) The accounting system should have the capability to prepare and maintain 

accurate financial statements. These financial statements must be 

reviewed after preparation. Best practice suggests that management 

agents independent of accounting perform the review.

(3) Minimum Bankroll Calculation. The gaming operation should coordinate with 

the TGRA to determine the frequency for preparation of a minimum bankroll 

calculation. The gaming operation should further coordinate with the TGRA to 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 13 of 15

determine, based on the needs of the operation, what minimum bankroll 

calculation to perform to ensure the gaming operation maintains cash (on hand 

and in bank) in an amount sufficient to satisfy obligations to patrons as they are 

incurred. 

(4) Maintenance and Preservation of Books, Records, and Documentation. The 

gaming operation must develop controls to ensure that all financial books, 

records, and relevant supporting documentation, are maintained and preserved as 

required. 

(i) Internal Audit.

(1) Internal Auditors. Best practice suggests the internal audit function be performed 

in accordance with the Professional Practices Framework established by the 

Institute of Internal Auditors. This function can be performed by auditors internal 

to the operation, officers of the TGRA, or an outside services firm (i.e., CPA 

firm).

(2) Scope and Frequency of Audits. 

(i) Internal audits must be performed for each gaming department of the 

operation at least annually. 

(ii) The internal auditor(s) should coordinate with the TGRA and gaming 

operation to determine the frequency of these and additional audits, as 

well as the departments to be audited outside of the scope of each gaming 

department. 

(iii) Audits must be performed to review for compliance with the MICS, TICS, 

and SICS. Additionally, the internal auditor should coordinate with the 

TGRA and the gaming operation to determine if a review of compliance to 

additional policies is suggested.

(3) Independence. There should be independence between the agent(s) performing 

the internal audit and the department(s) subject to the audit(s). Controls should be 

in place specifying to whom internal auditors report.

(4) Reports. Reports documenting audits performed are maintained and made 

available to the Commission pursuant to 25 USC §2706(b)(1)-(4). 

(5) Material Exceptions. 

(i) The internal auditor should coordinate with management and the TGRA to 

determine a definition of material exception for each gaming area. 
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 14 of 15

(ii) The audit program for each area should include the scope of the audit 

work tested and material exception thresholds for each of the testing items. 

(iii) All material exceptions resulting from internal audit work should be 

investigated and resolved with the results documented. 

(6) Internal Audit Findings. 

(i) Internal audit findings are reported to management. Management must 

prepare a response specifying corrective measures to be taken, if any,

which should be included in the internal audit report and distributed to 

designated entities. 

(ii) Internal auditors should verify that corrective measures have been put in 

place and effectively resolve any material exceptions.

(j) Annual Audits.

(1) Agreed Upon Procedures. 

(i) A CPA must be engaged to perform an assessment of whether the gaming 

operation is in compliance with the MICS, the TICS, and/or the SICS.

Such assessment should be made in substantial accordance with agreed 

upon procedures and the most recent versions of the Statements on 

Standards for Attestation Engagements and Agreed-Upon Procedures 

Engagements (collectively „„SSAE‟s‟‟) issued by the American Institute of 

Certified Public Accountants, Inc.

(ii) Best practice suggests that management should have a basic understanding 

of the procedures the CPA should be performing in the engagement. The 

items or areas that should be addressed include:

(A) An organizational chart depicting segregation of duties or 

independence of department functions or responsibilities;

(B) A description of the duties, responsibilities and reporting

obligations of the internal auditor(s);

(C) A copy of the SICS and other operating policy and procedure 

manuals, as needed;

(D) A discussion of known fraud at the gaming operation;

(E) Completion of the MICS compliance checklist for at least one 

unannounced observation of drop and count;
FINAL DRAFT – TGWG 7/28/2011

Audit and Accounting Page 15 of 15

(F) Interviews with gaming operation agents and management 

responsible for performing the audit function;

(G) Compliance testing of various documents related to the audit 

functions;

(H) Discussion of changes in management, including revisions in 

policies and procedures affected by the management change;

(I) Discussion of risks and opportunities;

(J) Understanding of ongoing issues of concern; and

(K) A review of randomly selected contracts.

(2) Submissions of Agreed-Upon Procedures Report to the Commission. The tribe 

must submit two copies of the agreed-upon procedures report to the Commission

within 120 days of the gaming operation‟s fiscal year end in conjunction with the 

submission of the annual financial audit report required under 25 CFR Part 571. 

(3) Reliance on Internal Audit. 

(i) Agreed-upon procedures are to be performed by the CPA to determine that 

the internal audit procedures performed during the fiscal year have been 

properly completed. This can be performed by the CPA looking at the 

audit reports generated by the internal audit department to ensure an audit 

was completed during the fiscal year for all gaming areas. 

(ii) The CPA may rely on the work of internal audit for the completion of the 

MICS checklists as they relate to the standards covered by Part 543. Best 

practice suggests, based on the CPA review of audit reports and MICS 

checklists completed by internal audit, testing may be expanded where 

material exceptions were not corrected.
TAB 

M
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 1 of 14

Drop and Count

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for the operation of Drop and Count. It has been compiled by tribal regulators, Class II gaming 

operators, and other industry resources. Using best practices, this guidance is specifically 

designed to accommodate a variety of ways to implement controls to comply with Part 543.21. 

Because each gaming operation is different and subject to varying tribal laws and regulations, 

each tribe is responsible for determining the specific controls and procedures that are most 

suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.21 What are the minimum internal control standards for drop and count?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(d) Supervision. Supervision shall be provided for drop and count as needed by an 

agent(s) with authority equal to or greater than those being supervised.

(e) Count Room Access. Controls must be established to limit physical access to the 

count room to count team agents, designated staff, and other authorized persons.

Such controls must include, but not be limited to, the following:

(1) Count team agents shall not be allowed to exit or enter the count room during 

the count except for emergencies or scheduled breaks.

(2) Surveillance shall be notified whenever count room agents exit or enter the 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 2 of 14

§ 543.21 What are the minimum internal control standards for drop and count?

count room during the count.

(3) The count team policy, at a minimum, shall address the transportation of 

extraneous items (e.g., personal belongings, tool boxes, beverage containers, 

etc.) into or out of the count room.

(f) Count team. Controls must be established in a manner designed to ensure security of 

the count and the count room to prevent unauthorized access, misappropriation of 

funds, forgery, theft, or fraud. Such controls must include, but not be limited to, the 

following:

(1) For Tier A and B operations, all counts shall be performed by a minimum of 

two (2) agents. For Tier C operations, all counts shall be performed by a 

minimum of three (3) agents.

(2) For Tier A and B operations, at no time during the count shall there be fewer 

than two (2) count team agents in the count room until the drop proceeds 

have been accepted into cage/vault accountability. For Tier C operations, at 

no time during the count shall there be fewer than three (3) count team 

agents in the count room until the drop proceeds have been accepted into 

cage/vault accountability.

(3) For Tier A and B operations, count team agents shall be rotated on a routine 

basis such that the count team is not consistently the same two (2) agents 

more than four (4) days per week. This standard shall not apply to gaming 

operations that utilize a count team of more than two (2) agents. For Tier C 

operations, count team agents shall be rotated on a routine basis such that the 

count team is not consistently the same three (3) agents more than four (4) 

days per week. This standard shall not apply to gaming operations that 

utilize a count team of more than three (3) agents.

(4) Functions performed by count team agents shall be rotated on a routine basis.

(5) Count team agents shall be independent of the department being counted and 

the cage/vault departments. An accounting agent may be used if there is an 

independent audit of all count documentation.

(g) Drop. Controls must be established in a manner designed to ensure security of the 

drop process to prevent unauthorized access to gaming equipment and the drop, 

misappropriation of funds, forgery, theft, or fraud. Such controls must include, but 

not be limited to, the following:

(1) Drop schedules and periods, including procedure to continue drop once 

started through completion.
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 3 of 14

§ 543.21 What are the minimum internal control standards for drop and count?

(2) Security during transport of drop boxes, including escort by a minimum of 

two (2) agents, at least one of whom is independent of the revenue being 

dropped.

(3) All drop boxes shall be uniquely identified to correspond with the card table, 

player interface, and/or other location from which the drop box was 

removed.

(4) Security over drop boxes removed and awaiting transport to the count room.

(5) Security of drop boxes until the count takes place. 

(6) Notification to surveillance when a drop is to begin.

(7) Provisions for emergency drop. 

(h) Count. Controls must be established in a manner designed to ensure security of the 

count process to prevent unauthorized access to count equipment and the drop, 

misappropriation of funds, improper manipulation of financial records, forgery, theft, 

or fraud. Such controls must include, but not be limited to, the following:

(1) Establishment of a dedicated count room;

(2) Manual count process;

(3) Utilization, testing, and calibration of counters and/or validation systems;

(4) Verification of count;

(5) Prevention of the comingling of funds until recorded per drop box;

(6) Accurate and permanent forms of recordation for all cash and cash 

equivalents and rejected cash or cash equivalents;

(7) For card game counts, additional controls, as applicable, shall be established 

and procedures implemented to ensure:

(i) Fills/credits, marker issue/payment slips are recorded and forwarded 

to the appropriate department for verification and reconciliation.

(ii) Opening/closing card table inventory forms are examined and traced 

to or recorded on the appropriate documentation with discrepancies 

investigated and results documented.

(8) The reconciliation of count records to the total drop, which shall address, but 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 4 of 14

§ 543.21 What are the minimum internal control standards for drop and count?

not be limited to:

(i) Signature of each agent of the count team attesting to their 

participation in the count;

(ii) Reconciliation of the total drop by a count team agent who shall not 

function as the sole recorder; and 

(iii) Documentation of all unresolved variances.

(9) Transfer of the drop following the count.

(10) All cash and cash equivalent inventory stored in the count room shall be 

secured from unauthorized access at all times.

(11) Access to stored drop boxes, full or empty.

(i) Controlled Keys or Equivalents. Controls shall be established and procedures 

implemented to safeguard the use, access, and security of keys or other access 

methods in accordance with the following:

(1) Each of the following requires a separate and unique key lock or alternative 

secure access method:

(i) Drop cabinet;

(ii) Drop box release; 

(iii) Drop box content; and 

(iv) Storage racks and carts.

(2) Access to and return of keys or equivalents shall be documented with the 

date, time, and signature or other unique identifier of the agent accessing or 

returning the key(s).

(i) For Tier A and B operations, at least two (2) drop team agents are 

required to be present to access and return keys. For Tier C 

operations, at least three (3) drop team agents are required to be 

present to access and return keys.

(ii) For Tier A and B operations, at least two (2) count team agents are 

required to be present at the time count room and other count keys 

are issued for the count. For Tier C operations, at least three (two 

for card game drop box keys in operations with three tables or fewer) 

count team agents are required to be present at the time count room 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 5 of 14

§ 543.21 What are the minimum internal control standards for drop and count?

and other count keys are issued for the count.

(3) Where an alternative access method is utilized, the use of such method shall 

be controlled in a manner consistent with the objectives of this standard.

(4) Documentation of all keys, including duplicates, shall be maintained 

including:

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(5) Custody of all keys involved in the drop and count shall be maintained by a 

department independent of the count and drop agents and those departments 

being dropped and counted.

(6) Other than the count team, no agent shall have access to the drop box content 

keys while in possession of storage rack keys and/or release keys.

(7) Other than the count team, only agents authorized to remove drop boxes are 

allowed access to drop box release keys. 

(8) Utilization of keys at times other than the scheduled drop and count must be

properly authorized and documented. 

(9) Emergency manual keys (i.e., override key) for computerized, electronic, and 

alternative key systems.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to Drop and 

Count. Such SICS should address, at a minimum, how the department operates, agents’ 

responsibilities, and controls to protect assets. The TGRA should review and approve the 

SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 6 of 14

substitute for one or all of the agents. Another example would be where a log is required 

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes) 

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) document(s) review, including all department(s) records 

relating to the variance investigation;

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 7 of 14

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often drop and count functions should be audited. When an assessment 

and review is necessary, an agent independent of the organizational component 

responsible for conducting drop and count functions should perform it.

(f) Count Room Access. Controls should be established for count room access that include, 

but are not limited to:

(1) Procedures restricting the exiting and entering of the count room by count agents 

during the count. The procedures should also cover entering and exiting during 

emergencies and scheduled breaks. Additionally, the procedures should specify

who and when persons or agents other than count agents can enter the count 

room, such as authorized observers, auditors, supervisors for resolution of 

problems, and authorized maintenance agents.

(2) Notification to an independent party such as surveillance or security if count room 

or other authorized agents need to exit or enter the count room during the count.

(3) The transportation of extraneous items (e.g., personal belongings, tool boxes, 

beverage containers, etc.) into or out of the count room. Best practice suggests

that unnecessary items are prohibited and necessary items are inspected upon exit. 

(4) The security of the count room when storing cash or cash equivalents (e.g., coins, 

tokens, chips, currency, and vouchers).

(g) Count Team. Controls should be established in a manner designed to ensure security of 

the count and the count room to prevent unauthorized access, misappropriation of funds, 

forgery, theft, or fraud. Such controls must include, but not be limited to, the following:

(1) Based on the gaming operation’s Tier, counts must be performed by a count team 

that consists of at least the minimum number of agents required by the MICS.

(2) The minimum number of count team agents must be present at all times during 

the count until all drop proceeds are transferred to the cage/vault accountability. 

(3) Controls must include procedures to ensure that if the count team consists of the 

minimum number of agents required by the MICS, that the agents are sufficiently 

rotated to prevent the same count team from working together more than four (4) 

days a week to mitigate against the potential for collusive fraud or theft.

(4) Controls must require that count team agents rotate functions performed during 

the count on a routine basis. An example is the count agent who removed drop 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 8 of 14

box content yesterday will be counting today and another count agent will 

conduct the removal.

(5) The count team must be independent of transactions being counted as well as 

independent of the cage/vault departments. An accounting representative may be 

used if there is an independent audit of all count documentation.

(h) Drop. Controls must be established for the drop process and be designed in a manner to 

identify and prevent misappropriation of funds, forgery, theft, and/or fraud during the 

drop. Such controls should include, but not be limited to:

(1) Procedures to ensure that the drop process continues through completion once 

started.

(2) Notification to surveillance when a drop process is to begin, including emergency 

drops. Best practice suggests that surveillance is notified no later than when the 

first drop box is dropped.

(3) Best practice suggests that the TGRA should be notified of established and any 

changes to the drop schedule.

(4) Security of empty drop boxes transported to the floor, drop boxes dropped and 

drop boxes awaiting transport to the count room, including escorts as required by 

the MICS. Best practice suggests that at least one (1) escort is a Security agent 

and that these controls also cover emergency drops. The presence of an 

independent agent helps prevent possible collusion.

(5) Security of drop boxes awaiting count and emergency drop boxes.

(6) Controls must ensure that drop agent(s) are independent of the department being 

dropped.

(i) A system in which all drop boxes are uniquely identified to correspond 

with the card table, player interface, and/or other location from which the 

drop box was removed. This will prevent possible commingling of funds 

and ensure proper recording of the drop. An example is labeling each 

drop box with a number corresponding to a permanent number on the 

player interface or card game table. Generally, card game drop boxes are 

also labeled to indicate game, table number, and shift.

(i) Count. Controls must be established for the Count process including, but not limited to:

(1) Designation of a count room or other secure area with identical controls.

(2) Controls to cover all aspects of count and equipment used, including manual 

counts.
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 9 of 14

(3) Procedures to prevent the commingling of funds from different revenue centers

during the emptying and counting of drop box until the content of each drop box 

is recorded.

(4) Count equipment and systems should be tested, with the results documented, at 

minimum before the first count begins to ensure the accuracy of the equipment. 

Such procedures may include but not be limited to:

(i) At least two (2) count agents should verify the test results. 

(ii) The test should be performed with test currency and coin (in all 

denominations), vouchers, and other financial instruments to verify that 

the equipment is functioning properly.

(iii) If currency counters are utilized, at least one count agent who is not 

loading or unloading the currency counter should observe the loading and 

unloading of all currency at the currency counter, including rejected 

currency. 

(iv) If currency counters are utilized, controls should be established to ensure 

all rejected cash or cash equivalents are counted and recorded to the drop 

box for which it was being counted. 

(v) If the currency counter does not automatically count the currency twice, 

then it should be run through the counter a second time.

(vi) For counts that do not utilize a currency counter, a count agent who did 

not perform the initial count should perform a second count.

(vii) If a currency counter interface is used, it should be adequately restricted 

(e.g., password, keys, etc.) to prevent unauthorized access.

(5) The test results must be delivered to the accounting department.

(6) The count team must not have access to bill-in meter amounts for the count being

performed. This does not prohibit count team members from performing tasks 

that involve access to bill-in meter amounts when such members are not 

performing a count for those metered values. 

(7) Access to stored drop boxes, full or empty, is restricted to authorized agents.

(8) Coin, cash, and cash equivalents must be controlled in a manner that precludes the 

commingling with the count from another revenue area. Best practice suggests

that when the count for a revenue area is complete it is transferred to the 

cage/vault prior to another count being started. 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 10 of 14

(9) The minimum number of count agents, per Tier as defined in the MICS, shall be 

present throughout the bundling, strapping, or sacking of the drop proceeds. Tiers

A and B require a minimum of two (2) count agents at all times. Tier C requires a 

minimum of three (3) count agents at all times.

(10) Requirements for permanent forms of recordation.

(i) Procedures to correct information originally recorded by count team 

agents on count documentation should be established, including but not be 

limited to, the following. 

(A) All corrections should be made with a permanent ink pen;

(B) A single line should be drawn through the error;

(C) The correct figure should be entered above the original figure;

(D) The correction should be initialed by at least two (2) count team 

agents verifying the change;

(E) If a currency interface is used, corrections to count data may be 

made using one of the following:

(1) During the count process, correct the error in the currency 

interface and enter the authorization (e.g., passwords, key, 

etc.) of at least two (2) count team agents.

(2) An exception report should be generated identifying the 

drop box identifier, the incorrect value, the correct value, 

and the identity of count team agents attesting to the 

correction.

(F) All documentation and records for corrections must be forwarded

to the accounting department.

(11) Verification that each drop box is emptied during the count. Two (2) agents must

participate in the verification process. A surveillance agent may serve as one of 

these two (2) agents if verification is monitored in its entirety with good clarity by 

surveillance cameras. A person independent of the agent who removed the 

contents from the drop box may also serve as one of the two (2) required agents to 

verify the drop box is empty. 

(12) Count results must be recorded for each drop box. 

(13) For card game counts, additional controls, as applicable, shall be established and 
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 11 of 14

procedures implemented to ensure the security and delivery of any card table

fills/credits, marker issues/payments, opening/closing inventory forms to 

accounting. Some gaming operations record these forms in the count room and 

then forward to accounting while others may only forward these forms to 

accounting for recording. In either situation the forms must be controlled, secured 

and forwarded to accounting.

(14) Procedures must require that at least one (1) agent who is not the sole recorder of 

the count reconcile the count results in total.

(15) Coupons or other promotional items not included in gross revenue may be 

recorded on a supplemental document by either the count team members or 

accounting personnel. All single-use coupons should be cancelled daily by an 

authorized agent to prevent improper recirculation.

(16) All count team agents must sign the report attesting to their participation in the 

count.

(17) A final verification of the total drop proceeds, before transfer to cage/vault, must

be performed by the at least two (2) agents, preferably a supervisory agent and 

one (1) count team agent. The verification of transferred funds is required by the 

Part 543.14 (d)(1)(v). 

(i) Final verification should include the comparison of currency counted 

totals against the currency counter/system report, if any counter/system is 

used.

(ii) Any unresolved variances are documented and the documentation remains 

part of the final count record forwarded to accounting.

(iii) This verification does not require a complete recount of the drop proceeds 

but does require a review sufficient to verify the total drop proceeds being 

transferred. 

(iv) The two (2) agents must sign the report attesting to the accuracy of the 

total drop proceeds verified.

(18) The drop proceeds are transferred to the cage/vault, where it is recounted and 

verified. 

(i) The count documentation and records must not be transferred to the 

cage/vault with the drop proceeds. 

(ii) The cage/vault agent should have no knowledge or record of the drop 

proceeds total before it is verified. Best practice suggests that the agent
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 12 of 14

should perform what is known as a “blind count.” 

(iii) All count records should be forwarded to accounting. Alternatively, it 

may be adequately secured (e.g., locked container to which only 

accounting agents can gain access).

(19) The cage/vault agent receiving the transferred drop proceeds must sign the report 

attesting to the verification of the total received. 

(20) Controls should be established to require all verification, recount, and signatory 

requirements for partial transfers in accordance with the same controls that are 

applicable to the transfer of the total drop proceeds. To prevent commingling of 

funds, best practice suggests that partial transfers should be properly segregated 

from any funds still being counted.

(21) Any unresolved variances between total drop proceeds recorded on the count 

room report and the cage/vault final verification during transfer must be 

documented and investigated.

(22) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit

(i) Controlled Keys or Equivalent.

(1) All drop and count keys must be secured and controlled by agents independent of 

the operational areas or departments for which the keys provide access, including 

the following:

(i) Player interfaces for any Class II game;

(ii) Card games;

(iii) Kiosks;

(iv) Drop;

(v) Count; and

(vi) Cage/vault.

(2) Each of the following requires a separate and unique key lock or alternative 

secure access method:

(i) Drop cabinet;
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 13 of 14

(ii) Drop box release; 

(iii) Drop box content; and 

(iv) Storage racks and carts.

(3) All controlled drop and count keys or equivalents must be secured in a manner 

designed to prevent unauthorized access.

(i) Controls must prohibit any one agent from having simultaneous access to 

the cabinet, release, content, and storage racks keys. The count team 

agents may have access to release, content, and storage racks keys only 

during a count.

(4) All key or equivalent issuances and returns, including emergency manual/override 

keys, must be performed by the minimum number of agents in accordance with 

the MICS, be documented and maintained by a key control agent including, but 

not be limited to:

(i) Date issued/returned;

(ii) Time issued/returned;

(iii) Unique identifier for the key issued/returned;

(iv) Name of the agent the key was issued to/returned by; and

(v) Reason for access to the key(if a key watch system is not in use and/or 

emergency key access is made the reason should be recorded).

(5) Emergency manual keys (a.k.a. override keys) for computerized, electronic, 

and/or alternative key systems must be secured and controlled. Best practice 

suggests that at least three (3) agents, two (2) from independent departments, be 

involved in the issuance and return of the emergency manual/override keys.

(6) When controls require physical involvement of more than one agent in the key 

control process, including for the entire duration of drop and count, surveillance 

may not act as one of those agents. If physically present, security agents may act 

as part of the minimum number of agents required by the MICS.

(7) All duplicate keys should be maintained in a manner that provides the same 

degree of control as is required for the original keys.

(8) Documentation of all keys, including duplicates and emergency manual/override 

keys, shall be maintained by a key control agent including, but not be limited to:
FINAL DRAFT – TGWG 7/28/2011

Drop and Count Page 14 of 14

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; 

(iv) Issuance and return; and

(v) Authorization and access.

(9) An agent independent of the drop, count, cage/vault, and key control must audit

key access records periodically, in accordance with Part 543.19, and for propriety.

(10) Any suspicious or unusual activity discovered in the audit of key access records 

must be reported to management and/or the TGRA. 

(i) Audit and Accounting. 

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example, a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

N
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 1 of 14

Surveillance

Purpose

This section provides guidance on the development of internal controls, policies, and procedures 

for gaming operation surveillance activities. It has been compiled by tribal regulators, Class II 

gaming operators, and other industry resources. Using best practices, this guidance is 

specifically designed to accommodate a variety of ways to implement controls to comply with 

Part 543.23. Because each gaming operation is different and subject to varying tribal laws and 

regulations, each tribe is responsible for determining the specific controls and procedures that are 

most suitable for its gaming operations and compliant with the MICS. 

Furthermore, internal controls, policies, and procedures should be established and updated in a 

manner that accommodates changes and advancements in technology. Nothing in this guidance 

document should be read to limit the use of technology, regardless of whether or not such 

technology is mentioned herein.

§ 543.23 What are the minimum internal control standards for surveillance?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, 

each gaming operation shall establish, implement and adhere to internal control 

policies and procedures that provide at least the level of control established by the 

standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate 

documentation and/or procedures that provide at least the level of control established 

by the standards of this section, as approved in writing by the TGRA, will be 

acceptable.

(c) Surveillance Equipment and Control Room(s). Controls must be established in a 

manner designed to prevent unauthorized access and/or activities, misappropriation,

forgery, theft, or fraud. Such controls must include, but not be limited to, the 

following:

(1) For Tier A, the surveillance system shall be maintained and operated from a 

secured location, such as a locked cabinet. For Tier B and C, the 

surveillance system shall be maintained and operated from a staffed 

surveillance operation room(s).

(2) The surveillance operation room(s) shall be secured to prevent unauthorized 

entry.
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 2 of 14

§ 543.23 What are the minimum internal control standards for surveillance?

(3) Access to the surveillance operation room shall be limited to surveillance 

agents and other authorized persons.

(4) Surveillance operation room(s) access logs shall be maintained.

(5) Surveillance operation room equipment shall have total override capability 

over all other satellite surveillance equipment located outside the 

surveillance operation room.

(6) Power loss to the surveillance system.

(i) For Tier A, in the event of power loss to the surveillance system, 

immediate alternative security measures, such as additional 

supervisory or security agents, shall be provided. 

(ii) For Tier B and C, in the event of power loss to the surveillance 

system, an auxiliary or backup power source shall be available and 

capable of providing immediate restoration of power to all elements 

of the surveillance system that enable surveillance agents to observe 

all areas covered by dedicated cameras. 

(7) The surveillance system shall record an accurate date and time stamp on 

recorded events. The displayed date and time shall not significantly obstruct 

the recorded view.

(8) All surveillance agents shall be trained in the use of the equipment, and be 

knowledgeable of the games and house rules.

(9) Each camera required by the standards in this section shall be installed in a 

manner that will prevent it from being readily obstructed, tampered with, or 

disabled. 

(10) The surveillance system shall: 

(i) Have the capability to display all camera views on a monitor;

(ii) Include sufficient numbers of recording devices to record the views 

of all cameras required by this section; 

(iii) Record all camera views; and

(iv) For Tier B and C only, include sufficient numbers of monitors to 

simultaneously display gaming and count room activities.

(11) A periodic check of the surveillance systems shall be conducted. When a 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 3 of 14

§ 543.23 What are the minimum internal control standards for surveillance?

malfunction of the surveillance system is discovered, the malfunction and 

necessary repairs shall be documented and repairs initiated within seventytwo (72) hours.

(i) If a dedicated camera malfunctions, immediate alternative security 

measures, such as additional supervisory or security agents, shall be 

provided. 

(ii) The TGRA shall be notified of any surveillance system and/or 

camera(s) that have malfunctioned for more than twenty-four (24) 

hours and the alternative security measures being provided. 

(d) Additional Surveillance Requirements. With regard to the following functions, the 

additional specified controls shall be implemented:

(1) Bingo. 

(i) For manual draws, the surveillance system shall monitor the bingo 

ball drawing device or mechanical random number generator, which 

shall be recorded during the course of the draw by a dedicated 

camera to identify the numbers or other designations drawn.

(ii) The surveillance system shall monitor and record the activities of the 

bingo game, including drawing, calling, and entering the balls, 

numbers or other designations drawn.

(2) Card games. 

(i) Except for card game tournaments, a dedicated camera(s) shall be 

used to provide:

(A) An overview of the activities on each card table surface, 

including card faces and cash and/or cash equivalents;

(B) An overview of card game activities, including patrons and 

dealers; and

(C) An unobstructed view of all posted progressive pool 

amounts. 

(ii) For card game tournaments, a dedicated camera(s) shall be used to 

provide an overview of tournament activities, including 

entrances/exits and any area where cash or cash equivalents are 

exchanged.
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 4 of 14

§ 543.23 What are the minimum internal control standards for surveillance?

(3) Prize Winning Events. The TGRA shall establish standards for surveillance 

camera coverage of prize winning events. Dedicated camera coverage is 

required when the progressive base value or the prize amount exceeds 

$3,000,000.00. Recorded camera coverage must include the activities of 

patrons and agents at the time and location of the prize winning event. 

(4) Cash and Cash Equivalents.

(i) The surveillance system shall monitor and record: 

(A) A view of the patron, cage agent, vault agent or count team 

agent(s) and the surrounding area and counting surface;

(B) Payouts of gaming winnings; 

(C) Entry and exit doors to and from the cage, vault and other 

secured count areas;

(D) All count equipment including but not limited to reject bins, 

weigh scales, wrapping machines, currency and coin 

counters, and chips sorters;

(E) Any area where the manipulation of recorded data may 

occur;

(F) Drop and count while in process; for Tier A and B 

operations, if the count is not viewed live, the operation 

must establish controls to ensure a review of the recording 

within seven (7) days by an agent independent of the count 

operation and the count being reviewed. For Tier C 

operations, the count shall be viewed live.

(G) All drop boxes and storage racks by either a dedicated 

camera or a motion-detector activated camera.

(ii) During the count process a dedicated overhead camera(s) or motion 

detector activated camera(s) must cover the:

(A) Transaction area with the ability to identify cash and cash 

equivalent values;

(B) All counting surfaces used during the count; and 

(C) All drop boxes and their storage racks.
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 5 of 14

§ 543.23 What are the minimum internal control standards for surveillance?

(e) Recording Retention. Controls must be established that include, but are not limited 

to, the following:

(1) All recordings required by this section shall be retained for a minimum of 

seven (7) days; and

(2) Suspected or confirmed gaming crimes, unlawful or suspicious activity, or 

detentions by security personnel discovered within the initial retention 

period shall be copied and retained for a time period, not less than one (1) 

year.

(f) Logs. Logs must be maintained and demonstrate the following:

(1) Compliance with the storage, identification, and retention standards required

in this section;

(2) Each malfunction and repair of the surveillance system as defined in this 

section; and

(3) Activities performed by surveillance agents.

(a) Internal Control Procedures. The TGRA should ensure that the gaming operation 

establishes a system of internal control standards (SICS) that are applicable to 

Surveillance. Such SICS should address, at a minimum, how the department operates, 

agents’ responsibilities, and controls to protect assets. The TGRA should review and 

approve the SICS prior to implementation.

(b) Computer Applications. A gaming operation may use computer applications, whether 

developed in-house or acquired externally, provided that controls are established in 

accordance with MICS and approved in writing by the TGRA. For any computer 

applications utilized, alternate documentation and/or procedures that provide at least the 

level of control established by the standards shall be implemented. For example, where 

an agent or multiple agents are required in the control, a computer application could 

substitute for one or all of the agents. Another example would be where a log is required;

a computer application report could substitute for the log. If computer systems are used, 

procedures must be designed to account for computer system failure without 

compromising the effectiveness of the internal control standards.

(c) Variances.
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 6 of 14

(1) The TGRA or the gaming operation as authorized by the TGRA should establish a 

threshold at which variances (i.e., exceptions against controls, inconsistencies 

with established policies and procedures or deviations from expected outcomes)

must be investigated. 

(2) Best practice suggests that when the relevant predetermined variance threshold is 

achieved, the controls should require agents – preferably supervisory agents – to 

conduct a variance investigation. Variance investigation controls/procedures 

should include, but are not limited to: 

(i) Transaction(s) documents(s) review, including all department(s) records 

relating to the variance investigation;

(ii) Recount of assets/inventory;

(iii) Surveillance reviews;

(iv) Physical inspections; and

(v) Agent interviews.

(3) The investigation results must be supported by documentation and forwarded to 

the accounting department for review and retention. Best practice suggests that 

documentation should include copies of transaction forms, logs, and a description 

of the variance.

(d) Supervision.

(1) Controls should identify the supervisory agent in the department or area 

ultimately responsible for ensuring that the department or area is operating in 

accordance with established policies and procedures.

(2) The reporting structure may permit a supervisory agent to function as a 

surveillance agent without any other supervision. In such instances, however, a 

supervisory agent either independent of the transaction or independent of the 

relevant department or area must resolve disputes.

(3) Best practice suggests that the written system of internal controls should include:

(i) An organizational chart of the department or area;

(ii) Job descriptions; and

(iii) A narrative description of the reporting structure, which is designed to 

ensure adequate supervision and segregation of function. 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 7 of 14

(e) Risk Assessments. Risk assessments and periodic program reviews may be used to 

determine how often surveillance operations should be audited. When an assessment and 

review is necessary, an agent independent of the organizational component responsible 

for conducting surveillance should perform it.

(f) Surveillance Operation Room/Location. For Tiers B and C, the operation must have a 

dedicated surveillance operation room. For Tier A, the surveillance system shall be 

maintained and operated from a secured location, such as, a locked cabinet, a locked 

storage room, or a secure server room.

(1) The surveillance operation room should be a room dedicated to the surveillance 

system and, for Tiers B and C, manned 24 hours a day by surveillance agents that 

have been properly trained in surveillance techniques and casino operations.

(2) For Tiers B and C, the surveillance operation room should be in the back of the 

house (i.e., an area in which access by the general public is prohibited) or offsite, 

and locked at all times. For Tier A operations, the area or location housing the 

surveillance system must be locked at all times.

(3) Access. 

(i) Access to the surveillance operation room should be governed by a 

detailed set of internal control policies and procedures. Best practice 

includes developing a chart or matrix that outlines, by position, who can 

access the surveillance operation room, surveillance reports, surveillance 

equipment and surveillance recordings. The matrix should include, but 

not be limited to those persons requiring routine access, such as regulatory 

agents, credentialed auditors, and supervisory agents (see example below).

(A) Access is generally limited to surveillance agents and surveillance 

supervisors. 

(B) If other persons need access, an approval process should be in 

place that provides for an evaluation of their need for access. 

(ii) Before anyone not listed on the access chart/matrix may gain entry into the 

surveillance room, best practice suggests surveillance agents obtain 

authorization from the TGRA. Such TGRA authorization should be 

documented on the sign-in log.

(iii) All access made to the surveillance operation room should be recorded 

through the use of a sign-in/access log. This log should include: date, 

room entry time, name of person accessing the room, reason for access, 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 8 of 14

department/position, signature of the agent who authorized access, and 

room exit time.

Example of Access Matrix:

ACCESS TO SENSITIVE AREAS/ASSETS CHART

Surveillance Room Surveillance Reports Surveillance Recordings

General Manager Unlimited Unlimited Unlimited

Security Dir/Mgr/Supv Unlimited Unlimited Unlimited

Surveillance Dir/Mgr/Supv Unlimited Unlimited Unlimited

Surveillance Agents Unlimited Unlimited Unlimited

Bingo Dir/Mgr Denied (4) (3/4)

Card Room Dir/Mgr Denied (4) (3/4)

Card Room Lead Floorperson Denied (4) (3/4)

TGRA Agents Unlimited Unlimited Unlimited

Surveillance Equipment Vendors (2) Denied (2)

Human Resources Dir/Mgr (1) (4) (3/4)

Housekeeping Agents (1) Denied Denied

Maintenance Agents (1) Denied Denied

NIGC Agents (1) (3) (3/4)

Local Law Enforcement Officers (1) (4) (3/4)

Restrictions/Conditions:

(1) May access the area/asset when accompanied by surveillance agents.

(2) May access the area/asset for maintenance/installation when accompanied by surveillance agents.

(3) May view under supervision of a Surveillance or Security Supervisors.

(4) May check out or be issued copies of reports and/or recordings.

(g) Surveillance System, Equipment, and Operations Requirements.

(1) Control of Surveillance Equipment. Surveillance operation room agents must 

have the ability and/or authority to add, remove, or change the settings and 

capabilities of any satellite surveillance equipment. The primary objective of this 

control is to ensure that the surveillance agents have the ability to utilize the 

surveillance system at all times without delay or interference. 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 9 of 14

(2) Power Loss. 

(i) For Tiers B and C, if power is lost to the surveillance system, an auxiliary 

or backup power source must be capable of providing immediate 

restoration of power to all elements of the surveillance system that are 

required in the internal controls. Best practice suggests that UPS 

(uninterruptable power supply) bridging and generator are available as 

backup power sources. 

(ii) For Tier A operations, and in the event the auxiliary or back up power 

source fails in a Tier B or C operation, immediate alternative security 

measures (i.e., security agents) must be provided.

(3) Date/Time Stamp. 

(i) Best practice suggests surveillance systems should be synchronized with a 

standard time service (i.e., naval observatory).

(ii) Surveillance agents should test the date/time used by the surveillance 

system against a standard time service at intervals established by 

management. 

(iii) Best practice suggests cameras should be purposely focused or positioned 

in a fashion that allows for the date/time stamp to be recorded without 

obscuring the recorded view. 

(4) Surveillance Agent Qualifications. All surveillance agents must be proficient in 

the use of the surveillance room equipment and have knowledge of all casino 

games offered to the public for play. Such knowledge must be sufficient to 

identify inappropriate behaviors and compliance concerns. Surveillance agents 

must also possess a comprehensive understanding of established standard 

operating procedures for the departments subject to surveillance. 

(5) Cameras. 

(i) Best practice suggests that cameras be installed in a housing unit to 

obscure the camera itself from public view and help ensure it is not 

physically tampered with.

(ii) Best practice suggests that surveillance agents periodically review each 

camera to ensure the view has not been obstructed, and the camera has not 

been tampered with or disabled. 

(6) Monitors/Recording Devices. 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 10 of 14

(i) All camera views required by the MICS must be capable of being 

displayed on a monitor(s) and recorded. 

(ii) Based on the size of the operation, surveillance management must

determine the number of: (i) monitors necessary for the surveillance 

agent(s) to be able to observe more than one activity at a time; and (ii) 

recording devices necessary to ensure that all camera views required by 

the MICS are recorded.

(7) Surveillance System Checks. 

(i) Based on the size of the operation, surveillance management must 

determine proper intervals to perform a check of the surveillance system. 

Best practice suggests once every shift. This periodic check should 

include visual confirmation that all cameras, monitors, and recording 

devices are in working order. 

(ii) When a malfunction of the surveillance system is discovered, the 

following procedures should apply:

(A) If immediate correction is possible, correction should be performed 

and documented on the activity log as to what measures were taken 

to correct the malfunction. Example – VCR #1 not operational, 

replaced with new VCR.

(B) If not immediately correctable, the agent who discovered the 

malfunction should report the malfunction to surveillance 

management.

(C) Management should determine the necessary immediate steps for 

alternative security measures to be performed until the malfunction 

is corrected. Alternative security measures include: repositioning 

another camera, posting additional security agents, and changing 

the location of gaming activity.

(D) Management should then identify the source of the malfunction 

and the necessary steps to perform to correct the malfunction. 

Corrective measures must be initiated within 72 hours. Upon 

completion, corrective measures should be documented. 

(h) Additional Surveillance Requirements. The gaming operation must implement additional 

surveillance controls for the following gaming areas:

(1) Bingo. Surveillance coverage for manual bingo draws should include:
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 11 of 14

(i) Dedicated cameras that provide sufficient coverage to view the ball draw 

with at least two views to verify winning balls, blower showing ball 

number or other designation as drawn, or rabbit ears showing all balls 

drawn, and/or game board showing numbers or other designations drawn. 

(ii) At least one of these views, or a separate view, should show the agent 

performing the ball draw.

(2) Card Games.

(i) Best practice suggests that a dedicated camera be positioned over each 

card game table to allow a general overview of card game activities, 

including patrons and dealers. The general overview is intended to assist 

in the safeguarding of the table chip tray, ensure the dealer is placing the 

rake in the drop box, maintain security of the patrons’ funds, observe the 

functionality of the game, and protect the integrity of the play of the game. 

(ii) Best practice suggests that camera coverage be provided over any card 

room bank. This coverage should include a dedicated camera to provide a 

general overview of the agents, patrons, and activities associated with card 

room transactions. 

(iii) PTZ (pan, tilt, and zoom) cameras should be positioned throughout the 

card room with the ability to allow for observation of activities and events. 

Surveillance management should determine, based on the size of the 

operation, how many PTZ cameras are required to provide adequate 

supplemental support. 

(3) Prize Winning Events. 

(i) Based on the size of the operation, management, as approved by the 

TGRA, must determine the threshold at which prize winning events must 

be covered by surveillance cameras. For prizes and progressive base

values in excess of $3 million, dedicated camera coverage is mandatory. 

(A) For prize payouts that are supported by system documentation or 

where a gaming system determines the outcome of the game play, 

camera coverage should give an overview of the activities of the 

patrons and agents at the time and location of the winning event. 

(B) For contests or drawings, where the prize payout is not supported 

by system documentation, adequate camera coverage and 

monitoring should include: 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 12 of 14

(1) Any storage component maintaining patron’s entries;

(2) The winning event;

(3) Agents and patrons involved; and 

(4) Any event that requires validation of the outcome to 

maintain confidence and trust that the contest has been 

conducted fairly. 

(4) Cash and Cash Equivalents.

(i) Best practice suggests that the surveillance system has coverage of the 

activities occurring in all cage, vault, and count room areas to monitor the 

activities of agents within these areas. Dedicated cameras should also be 

placed over each transaction area to view exchanges of cash and cash 

equivalents. Additional cameras should provide coverage of the patrons 

and agents involved in these exchange transactions. 

(ii) Based on the gaming operation’s risk assessment, determine what 

additional camera coverage is needed over cash and cash equivalents 

stored in cabinets, safes, vaults, drawers, etc., to safeguard those assets. 

For example: 

(A) The operation requires a $3M cash on hand inventory, three people 

work in the cage operation area at all times so management 

determines one camera is sufficient coverage over the storage area. 

(B) The operation requires a $3M cash on hand inventory, one person 

works in the cage operation area at any given time so management 

determines three cameras are necessary.

(iii) For surveillance coverage during the count process, cameras should be 

placed in a manner that provides an overview of the count room operations 

to ensure that:

(A) There are no blind spots in the room;

(B) All procedures and activities being performed by the count team 

can be viewed; 

(C) Irregularities can be detected during the count process; and

(D) Assets are safeguarded.
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 13 of 14

(iv) Best practice suggests that the surveillance system has the capability of 

monitoring and recording audio of the count room while the count is in 

process. This is to enhance investigations into possible misappropriation 

of funds. 

(i) Recording Retention. 

(1) The surveillance system shall be designed to retain all recordings of coverage 

provided by the required dedicated cameras for at least seven days, however, a 

seven-day period may be insufficient for investigatory and other purposes. To 

accommodate investigatory and other needs, best practice suggests that the 

retention period be set at 21 days or longer (including the supporting nondedicated camera recordings).

(2) For incidents and investigations, best practice suggests a review of all applicable 

statutes of limitation to aid in establishing minimum archiving practices based on 

incident type. 

(j) Logs.

(1) Logs must be developed to show compliance with the standards required in this 

section. 

(2) Best practice suggests maintaining at least two logs for recording retention. One 

for the minimum retention period and one for investigations and other incidents.

(3) The minimum retention log can be a manual log, matrix, or chart, and should 

include date, shift or times, brief description of recorded activity and 

camera/recorder identifier. 

(4) The investigation/incident log can be a manual log and should include date and 

time of the incident, a brief description of the incident, camera/recorder identifier,

and a unique investigation identifier (i.e., investigation report number).

(5) The logs for malfunctions and repairs of the surveillance system should include

the date, time, and nature of the malfunction, efforts expended to resolve the 

malfunction, the date of each effort, the reason for any delays in repairs (if 

applicable), date of repair, and alternative security measures taken (if applicable).

(6) For the surveillance activity log, best practice suggests the operation maintain a 

daily activity report that lists all proactive, reactive, and regulated functions 

performed by the surveillance agents. 

(k) Audit and Accounting. 
FINAL DRAFT – TGWG 7/28/2011

Surveillance Page 14 of 14

(1) Controls must be established for audit and accounting in accordance with MICS 

543.19 (What are the minimum internal control standards for audit and 

accounting?) and the guidance provided in the associated document.

(2) Best practice suggests that each operational area secure daily audit and accounting 

records, forms, and documents prior to audit. For example a cashier may place 

records in a locked box for next-day delivery to accounting for audit.
TAB 

O
Proposed MICS Reference Guide

A work product of the 

Tribal Gaming Working Group

July 28, 2011
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 2 of 25

FINAL DRAFT

Introduction

This document is intended to be a reference guide to support the proposed changes to the Part 543 Minimum 

Internal Control Standards for Class II Gaming submitted to NIGC on May 15, 2011 (includes updated proposal 

submitted at the end of July 2011) by the Tribal Gaming Working Group (TGWG).

This document includes a section by section recap of the objectives and intent of the changes proposed by the 

TGWG. Comparative references are between the NIGC Proposed Part 543 MICS (dates vary) and the TGWG 

Proposed MICS (May 13, 2011). Comments from the TGWG on why a proposed change is recommended are 

included and directly associated to section numbers for easy reference. 

Contents

Introduction ..........................................................................................................................................................2

Proposed MICS Overview.......................................................................................................................................4

TGWG Transmittal Memo 5/15/11 .....................................................................................................................................5

General Changes..................................................................................................................................................12

Proposed Changes by Section ..............................................................................................................................13

543.1 What does this part cover?..............................................................................................................................13

543.2 What are the definitions for this part?.............................................................................................................14

543.3 How do tribal governments comply with this part?..........................................................................................14

543.4 [Reserved].......................................................................................................................................................15

543.5 [Reserved].......................................................................................................................................................15

543.6 Does this party apply to small and charitable gaming operations?....................................................................15

543.7 What are the minimum internal control standards for bingo? ..........................................................................15

543.8 What are the minimum internal control standards for pull tabs?......................................................................16

543.9 What are the minimum internal control standards for card games? .................................................................16

543.10 What are the minimum internal control standards for gaming promotions?.....................................................16

543.11 What are the minimum internal control standards for patron deposit accounts and cashless systems? ............16

543.12 What are the minimum internal control standards for player tracking systems used in conjunction with Class II 

gaming? .......................................................................................................................................................................17

543.13 [Reserved].......................................................................................................................................................17

543.14 What are the minimum internal control standards for cage, vault, cash and cash equivalents? ........................17

543.15 What are the minimum internal control standards for lines of credit?..............................................................17

543.16 What are the minimum internal control standards for security and management of server, server software, and 

data associated with Class II gaming systems?..................................................................................................................18
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 3 of 25

FINAL DRAFT

543.17 What are the minimum internal control standards for complimentary services or items?.................................18

543.18 How does a gaming operation apply for a variance from the standards of this part? ........................................18

543.19 What are the minimum internal control standards for audit and accounting? ..................................................18

543.20 [Reserved].......................................................................................................................................................19

543.21 What are the minimum internal control standards for drop and count?...........................................................19

543.22 [Reserved] – Combined with 543.19 ................................................................................................................19

543.23 What are the minimum internal control standards for surveillance? ................................................................19

543.30 Moved to 543.2...............................................................................................................................................19

543.31 Combined with 543.21 ....................................................................................................................................20

543.32 Combined with 543.19 ....................................................................................................................................20

543.33 Combined with 543.23 ....................................................................................................................................20

543.40 Moved to 543.2...............................................................................................................................................20

543.41 Combined with 543.21 ....................................................................................................................................20

543.42 Combined with 543.19 ....................................................................................................................................21

543.43 Combined with 543.23 ....................................................................................................................................21

543.50 Combined with 543.19 ....................................................................................................................................21

Guidance .............................................................................................................................................................22

Checklists ............................................................................................................................................................24
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 4 of 25

FINAL DRAFT

Proposed MICS Overview

The following letter was submitted with the TGWG’s Proposed Part 543 MICS and Part 547 Technical Standards. 

This letter provides an overview of the intent and objectives that the TGWG had for their submission of the 

proposed changes to Part 543 Minimum Internal Control Standards for Class II Gaming. It also provides a 

description of the work effort that the TGWG put into the review, research, and writing of the proposed changes 

submitted to the NIGC. Some of the objectives are listed below.

 Ensuring that all controls are covered in Part 543

 Eliminating duplication across multiple sections

 Consolidating controls and simplifying language so MICS are easier to understand and implement

 Minimizing procedural steps and tasks to provide TGRA and gaming operations with needed flexibility to 

establish appropriate controls, policies and procedures for a variety of operations

 Ensure effective regulation of Class II gaming without causing undo financial hardship on tribes

 Ensuring consistency across all sections to eliminate confusion
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 5 of 25

FINAL DRAFT

TGWG Transmittal Memo 5/15/11
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 6 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 7 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 8 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 9 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 10 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 11 of 25

FINAL DRAFT
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 12 of 25

FINAL DRAFT

General Changes

The TGWG found in their work sessions and consultations with tribal regulators, gaming operators and other 

industry experts that the existing Part 543 and the NIGC proposed MICS seemed to mandate specific procedures. 

Some of the specific procedures may have originated from other jurisdictions and/or mandated only a single way 

to comply, often with out-dated procedures. This was found to be very limiting where different procedures could 

comply with the intent of the control and sometimes created unnecessary financial hardship.

For this reason proposed changes throughout the MICS focus on what must be controlled and to what extent it 

must be controlled rather than what method must be used to control it. For instance where the existing MICS 

may require a particular department or job position to perform a task, the proposed changes focus on the 

function and controls the task must be performed under. Example; “... must be placed in a locked box, or in the 

case of a cashier, in the appropriate place in the cashier’s cage ...” versus “... must be secured at all times ... “. This 

was done to make the MICS easier to use and with the intent of providing the primary regulator (TGRA) the 

flexibility to establish controls and approve procedures appropriate to each gaming operation.

The following changes were also applied consistently across multiple or all sections of the proposed MICS. 

 The primary objectives to be met in establishing tribal internal control standards, policies, and 

procedures

 Support for alternate computer applications and technology in the presence of equivalent controls

 Enhanced controls for the audit and investigation of variances

 Consistent inventory controls

 Mandated supervision over all Class II gaming

For instance, controls for inventoried items were consolidated and simplified to provide flexibility in the method 

which tribes may comply without eliminating the primary controls to prevent unauthorized access, 

misappropriation, forgery, theft or fraud and mandate the control of exchanges and inventory management. The 

same controls are included in all sections that require inventory controls. This provides flexibility and consistency.

Other changes proposed are intended to eliminate confusion by reorganizing related information into fewer 

sections. For instance, the bingo section currently has audit and accounting controls in addition to several other 

sections for internal audit, accounting and revenue audit. This made the MICS more difficult to use and could 

cause confusion when TGRAs are trying to ensure coverage for all audit and accounting controls while 

implementing TICS and SICS. Therefore the TGWG proposed moving and consolidating these scattered controls

into a single related section and believe that the reorganized MICS will be much easier to reference.
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 13 of 25

FINAL DRAFT

Proposed Changes by Section

The following provides an overview by section of the TGWG changes proposed. References compare the TGWG 

proposed changes with those proposed by the NIGC. In some instances the existing adopted Part 543 may also be 

referenced.

543.1 What does this part cover?

TGWG proposed changes to this section are primarily focused on an objective to ensure that Part 543 contains all 

controls required to support Class II gaming and to eliminate any confusion that has been experienced in the past 

by having references to Part 542 Minimum Internal Control Standards for Class III Gaming.

Consistent with the changes proposed by the NIGC, with only a couple exceptions, the TGWG proposed that 

sections currently referenced in 543.1 from Part 542 be replaced with new sections in 543. 

The exceptions:

 TGWG proposes that the same be done for the controls currently referenced in 542.18 (How does a 

gaming operation apply for a variance from the standards of this part?)

 The TGWG combined the following sections to eliminate confusion and make the MICS easier to use, 

consolidating 11 sections into 3

o 543.19 covers internal audit for all Tiers, accounting and revenue audit; consolidating 5 sections 

into 1

o 543.21 covers drop and count controls for all Tiers; consolidating 3 sections into 1

o 543.23 cover surveillance controls for all Tiers; consolidating 3 sections into 1

The chart below lists each section from Part 542 referenced in the existing adopted Part 543, the changes 

proposed by NIGC, and the changes proposed by TGWG. This information is provided as a quick reference for 

section movement from Part 542 and consolidation of the same within the TGWG proposal.

Existing 

Part 543

NIGC

Proposed MICS

TGWG

Proposed MICS

TGWG Comments

542.14 543.14 543.14 Consistent with NIGC proposal

542.15 543.15 543.15 Consistent with NIGC proposal

542.17 543.17 543.17 Consistent with NIGC proposal

542.18 542.18 543.18 New section; recommendation is consistent with NIGC 

proposal for moving other sections from Part 542 to this 

part

542.20 543.2 543.2 Consistent with NIGC proposal the definition for a Tier A 

gaming operation has been moved to the definitions 

section (543.2); section 543.20 [Reserved]

542.21 543.21 543.21 Consistent with NIGC proposal as a new section in 543, 

the TGWG also proposes the consolidation of 543.21, 

543.31, and 543.41 to eliminate confusion and make the 

MICS easier to use for all Tiers
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 14 of 25

FINAL DRAFT

Existing 

Part 543

NIGC

Proposed MICS

TGWG

Proposed MICS

TGWG Comments

542.22 543.22 543.19 TGWG proposes that internal audit controls for all Tiers 

be covered in 543.19 along with all other audit and 

accounting controls

542.23 543.23 543.23 Consistent with NIGC proposal as a new section in 543, 

the TGWG also proposes the consolidation of 543.23, 

543.33, and 543.43 to eliminate confusion and make the 

MICS easier to use for all Tiers

542.30 543.2 543.2 Consistent with NIGC proposal the definition for a Tier B 

gaming operation has been moved to the definitions 

section (543.2)

542.31 543.31 543.21 Drop and count controls for all Tiers consolidated into 

543.21 to eliminate confusion and make the MICS easier 

to use

542.32 543.32 543.19 Internal audit controls for all Tiers be covered in 543.19 

along with all other audit and accounting controls

542.33 543.33 543.23 Surveillance controls for all Tiers consolidated into 543.23 

to eliminate confusion and make the MICS easier to use

542.40 543.2 543.2 Consistent with NIGC proposal the definition for a Tier C 

gaming operation has been moved to the definitions 

section (543.2)

542.41 543.41 543.21 Drop and count controls for all Tiers consolidated into 

543.21 to eliminate confusion and make the MICS easier 

to use

542.42 543.42 543.19 Internal audit controls for all Tiers be covered in 543.19 

along with all other audit and accounting controls

542.43 543.43 543.23 Surveillance controls for all Tiers consolidated into 543.23 

to eliminate confusion and make the MICS easier to use

543.2 What are the definitions for this part?

The definitions section was updated to be consistent with the proposed MICS changes. Definitions for terms that 

are not used in the proposed MICS were eliminated to avoid confusion. Other terms were added to ensure clarity

for new terms and consistency throughout the entire part. Commonly used acronyms were also defined to 

support simplifier language within the controls, such as TICS for tribal internal control standards.

543.3 How do tribal governments comply with this part?

Consistent with the NIGC proposed changes, the TGWG proposed changes reflect the mandate for tribes to 

implement Tribal Internal Control Standards (TICS) and gaming operation to implement a System of Internal 

Controls (SICS) that fully support compliance with Part 543. References to TICS, SICS, and TGRA were added to 

simplify the language. 
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 15 of 25

FINAL DRAFT

Internal and external audit controls were moved to 543.19 with audit and accounting controls to eliminate 

duplicated content, minimize confusion and to make the MICS easier to use. The new section 543.19 also 

includes new references to other industry standards that apply to audit and accounting such as GAAP.

543.4 [Reserved] 

This section has been reserved and is consistent with the NIGC proposal.

543.5 [Reserved] 

This section has been reserved and is consistent with the NIGC proposal.

543.6 Does this party apply to small and charitable gaming operations?

All changes proposed by TGWG for this section are consistent with those proposed by NIGC.

543.7 What are the minimum internal control standards for bingo?

The TGWG added new controls in this section to strengthen the intent for establishing internal controls for bingo. 

Additional controls were added for alternate computer applications and managing variances. These additions are 

common throughout the proposed MICS.

Controls for the inventory of bingo cards were consolidated and simplified to provide flexibility in the method 

which tribes may employ to comply without eliminating the primary controls that prevent unauthorized access, 

misappropriation, forgery, theft, or fraud and mandate the control of exchanges and inventory management. 

Other changes to this section are proposed to eliminate confusion. For instance, this section currently has audit 

and accounting controls in addition to other sections for internal audit and revenue audit specifically. This could 

be quite confusing when trying to ensure coverage while implementing TICS and SICS. Hence, the TGWG 

proposed moving and consolidating these scattered controls into a single related section. The following controls 

were moved from this section to other sections as listed below.

NIGC Proposed MICS TGWG Comments

(d) Operational controls This section primarily dealt with controls for handling cash and cash 

equivalents; the TGWG proposes that these controls be moved to 543.14 

(Cage, vault, cash and cash equivalents) 

(e) Gaming equipment These controls were consolidated into the proposed “543.7 (i) Technologic 

Aids to the Play of Bingo” section

(f) Voucher systems Since vouchers are cash equivalents these controls were covered to 543.14 

(Cage, vault, cash and cash equivalents) and a consolidated section “543.7 (h) 

Cash and cash equivalents”

(g) Patron accounts and 

cashless systems

These controls moved to a separate section, 543.11 (Patron deposit accounts 

and cashless systems)
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 16 of 25

FINAL DRAFT

NIGC Proposed MICS TGWG Comments

(h) Promotions These controls moved to a separate section, 543.10 (Gaming promotions)

(i) Accounting While the NIGC proposed a new section (543.50 Revenue Audit) for these 

controls, TGWG believes it is less confusing and easier to use when moved to 

543.19 (Audit and accounting) as proposed

543.8 What are the minimum internal control standards for pull tabs?

Consistent with the NIGC proposal, the TGWG proposes this new section to cover pull tabs. Changes were 

proposed similar to those made in the bingo section to consolidate, simplify and provide tribes with the flexibility 

to establish appropriate procedures for each operation. Other controls in this section were clarified to include 

electronic equivalents and support technology.

543.9 What are the minimum internal control standards for card games?

Also consistent with the NIGC proposal, the TGWG proposes this new section to cover card games. Changes

proposed in the bingo and pull tab sections are similar in this section for consistency. For instance, all audit and 

accounting controls for card games were moved to 543.19 (Audit and accounting).

The TGWG believes that using consistent wording and controls throughout the Part helps tribes and gaming 

operations understand the regulations intent without having to learn different nomenclature and conventions 

from section to section. This is reflected in controls for inventory management in all sections that include 

inventory controls.

543.10 What are the minimum internal control standards for gaming promotions?

This is a new section proposed by the TGWG to address promotions for Class II games. This topic was previously 

covered in the existing and proposed NIGC MICS for bingo only in 543.7 (h), but the TGWG felt that these controls 

apply to all Class II games and warranted a separate section.

543.11 What are the minimum internal control standards for patron deposit accounts and 

cashless systems?

This is a new section proposed by the TGWG to address patron deposit accounts and cashless systems for Class II 

games. This topic was previously covered in the existing and proposed NIGC MICS for bingo only in 543.7 (g), but 

the TGWG felt that these controls apply to all Class II games and warranted a separate section.

The new proposed MICS include controls for both restricted and unrestricted patron deposit accounts. To ensure 

consistency with other industries and regulations, considerable research was done in this area including reviews 

of the Credit Card Act and how prepaid and gift cards are regulated throughout the country.
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 17 of 25

FINAL DRAFT

543.12 What are the minimum internal control standards for player tracking systems 

used in conjunction with Class II gaming?

This is a new section proposed by the TGWG to address the use of player tracking systems in conjunction with 

Class II games. This topic was previously covered in the existing and proposed NIGC MICS for bingo only in 543.7 

(g)(3)(ii)(A)-(C), but the TGWG felt that these controls apply to all Class II games and warranted a separate 

section.

543.13 [Reserved] 

This section has been reserved and is consistent with the NIGC proposal.

543.14 What are the minimum internal control standards for cage, vault, cash and cash 

equivalents?

This section reflects a new name and an expanded scope with the consolidation of controls from other sections. 

This was done to eliminate confusion and organize the controls in a manner that is consistent with most gaming 

operations and mandates accountability regardless of location or department.

One of the areas expanded in the TGWG proposal is “Variances”. The TGWG feels strongly that tribes and gaming 

operations must establish strong controls for the review of all types of transactions and investigate all variances

and exceptions. Another area that was expanded was check cashing. The proposed MICS now cover the entire 

lifecycle of the check cashing and deposit process.

The management of payouts was consolidated in this section to eliminate confusion between types of 

transactions (e.g. manual payouts vs. short pays) since the TGWG believes that all payouts processed must meet 

the same requirements.

Controls from other sections were moved to this section to ensure that wherever the accountability for a 

particular asset or transaction is assigned the controls are centralized and consistent.

Controls were added to other sections (e.g., Bingo, Pull Tabs, Card Games) referencing these controls to ensure 

consistency and eliminate confusion.

543.15 What are the minimum internal control standards for lines of credit?

This section reflects a new name to distinguish it from check cashing which is covered in the proposed 543.14 

(Cage, vault, cash, and cash equivalents) section. The TGWG has expanded the controls required for lines of credit 

to minimize risk for financial loss and consolidated similar controls for consistency and to make the controls 

easier to use. 
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 18 of 25

FINAL DRAFT

543.16 What are the minimum internal control standards for security and management of 

server, server software, and data associated with Class II gaming systems?

This section reflects a new name to focus the content on Class II gaming systems. TGWG found that the MICS 

previously referring to Information Technology could cause confusion as to which systems the controls were 

applicable.

Proposed changes reflect consolidating similar controls for consistency and to make the controls easier to use 

and allowing flexibility in how a tribe and gaming operation can comply with the MICS. 

543.17 What are the minimum internal control standards for complimentary services or 

items?

Consistent with the NIGC proposal, the TGWG proposes this new section to cover complimentary services or 

items. Along with a proposed change to the definition for “complimentary services or items” to cover all comps 

versus only those issued “ at the discretion of...”, the proposed controls are applicable to all complimentary 

services or items. Supervision controls are also proposed to ensure greater oversight.

Changes were proposed similar to those made throughout Part 543 to consolidate, simplify and provide tribes 

with the flexibility to establish appropriate procedures for each operation. 

543.18 How does a gaming operation apply for a variance from the standards of this part?

TGWG proposed this new section with the objective to ensure that Part 543 contains all controls required to 

support Class II gaming and to eliminate any confusion that has been experienced in the past by having 

references to Part 542 Minimum Internal Control Standards for Class III Gaming.

In addition to moving these controls into a new section in Part 543 other changes were proposed to consolidate, 

simplify, and provide flexibility in TGRAs establishing appropriate variance controls for their gaming operations. 

543.19 What are the minimum internal control standards for audit and accounting?

Consistent with the NIGC proposal, the TGWG proposes this new section to cover controls for accounting. The 

TGWG proposes that the controls NIGC proposed in 543.22, 543.32, 543.42, and 543.50 should be consolidated 

into this new section to eliminate duplication and potential confusion. This recommendation consolidates all 

controls for audit and accounting into a single section and makes it much easier for TGRAs and gaming operations 

to effectively use the information and ensure coverage when implementing TICS and SICS.

Another significant improvement included in the TGWG proposed controls for audit and accounting is the clear 

references to and support for external standards promulgated by GASB and GASB, such as GAAP.
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 19 of 25

FINAL DRAFT

Changes were proposed similar to those made in other sections to consolidate, simplify and provide tribes with 

the flexibility to establish appropriate procedures for each gaming operation. 

543.20 [Reserved] 

This section has been reserved and is consistent with the NIGC proposal. 

In both the NIGC and TGWG proposed MICS this section, the definition of Tier A gaming operations, was moved 

to the definitions section (543.2) and this section reserved. 

543.21 What are the minimum internal control standards for drop and count?

Similar to the NIGC proposal, the TGWG proposes this new section to cover controls for drop and count. The 

NIGC proposal maintained the existing convention that each Tier requires a separate section. The TGWG proposal 

consolidates the drop and count controls for all Tiers into this section. Controls that are specific to a Tier are 

called out clearly throughout this section. As with other sections this change makes the MICS significantly easier 

to use and eliminates the potential for confusion with three sections (543.21, 543.31, and 543.41) now combined 

into one section. 

New controls were also proposed to ensure supervision of all drop and count operations, ensuring greater 

oversight.

543.22 [Reserved] – Combined with 543.19

This section has been reserved. 

In the NIGC proposed MICS this section covered controls for internal audit for Tier A gaming operations only. 

Those controls have been included in the proposed audit and accounting section (543.19) of these MICS.

543.23 What are the minimum internal control standards for surveillance?

Similar to with the NIGC proposal, the TGWG proposes this new section to cover controls for surveillance. The 

NIGC proposal maintained the existing convention that each Tier requires a separate section. The TGWG proposal 

consolidates the surveillance controls for all Tiers into this section. Controls that are specific to a Tier are called 

out clearly throughout this section. As with other sections this change makes the MICS significantly easier to use 

and eliminates potential confusion with three sections (543.23, 543.33, and 543.43) combined into one section. 

543.30 Moved to 543.2 

This section has been moved and is consistent with the NIGC proposal. 
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 20 of 25

FINAL DRAFT

In the proposed NIGC MICS this section, the definition of Tier B gaming operations, was moved to the definitions 

section (543.2) and this section reserved. The TGWG proposal also moved this content to definitions (543.2), but 

saw no need to reserve this section number for future use.

543.31 Combined with 543.21

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for drop and count for Tier B gaming operations only. 

Those controls have been included in the proposed drop and count section (543.21).

543.32 Combined with 543.19

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for internal audit for Tier B gaming operations only. 

Those controls have been included in the proposed audit and accounting section (543.19).

543.33 Combined with 543.23

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for surveillance for Tier B gaming operations only. Those 

controls have been included in the proposed surveillance section (543.23).

543.40 Moved to 543.2 

This section has been moved and is consistent with the NIGC proposal. 

In the proposed NIGC MICS this section was moved to definitions (543.2) and reserved. The TGWG proposal also 

moved this content to definitions (543.2), but saw no need to reserve this section number for future use.

543.41 Combined with 543.21

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for drop and count for Tier C gaming operations only. 

Those controls have been included in the proposed drop and count section (543.21).
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 21 of 25

FINAL DRAFT

543.42 Combined with 543.19

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for internal audit for Tier C gaming operations only. 

Those controls have been included in the proposed audit and accounting section (543.19).

543.43 Combined with 543.23

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for surveillance for Tier C gaming operations only. Those 

controls have been included in the proposed surveillance section (543.23).

543.50 Combined with 543.19

This section has been moved and is no longer used. 

In the NIGC proposed MICS this section covered controls for revenue audit. Those controls been included in the 

proposed audit and accounting section (543.19).
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 22 of 25

FINAL DRAFT

Guidance

The TGWG has written guidance documents to aid tribes, TGRAs, and gaming operators in understanding the 

MICS intent and how to comply with each section. There is a significant focus throughout the guidance 

documents on consistency. Comprehensive information is provided that offers procedural options and other 

useful guidance. Industry standards, best practices, other related regulations and standards in addition to the 

proposed MICS are referenced as appropriate to provide tribes information and sources that they may need to 

consider and/or must comply with when developing their internal controls, policies, and procedures.

Some guidance documents also include samples to be sure that the content is understood and is demonstrated.

The guidance documents will be submitted to NIGC for consideration.

Below is a DRAFT sample of a checklist. 

Sample Guidance Document – Pages 1 & 2 of 4

MICS

Lists MICS (as proposed)

Guidance

Detailed guidance on 

complying with the MICS

Purpose

Explains the objectives of 

the guidance document
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 23 of 25

FINAL DRAFT

Sample Guidance Document – Pages 3 & 4 of 4

Guidance

Detailed guidance on 

complying with the MICS
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 24 of 25

FINAL DRAFT

Checklists

The TGWG is currently drafting sample checklists for the proposed MICS to aid the NIGC and tribes in 

implementing standardized compliance checklists for the MICS once adopted. The checklists will be submitted to 

the NIGC for consideration upon completion. Below is a DRAFT sample of a checklist. 

Sample MICS Compliance Checklist – Card Games – Page 1 of 10
TGWG Proposed MICS Reference Guide

July 28, 2011 A work product of Tribal Gaming Working Group (TGWG) Page 25 of 25

FINAL DRAFT

Sample MICS Compliance Checklist – Card Games – Page 2 of 10
TAB 

P
Final Proposed TGWG Draft Part 547 as of 5/13/2011

1

PART 547 – MINIMUM TECHNICAL STANDARDS FOR GAMING EQUIPMENT USED WITH THE 

PLAY OF CLASS II GAMES 

Sec. 

547.1 What is the purpose of this part?

547.2 How do these regulations affect state jurisdiction?

547.3 What are the definitions for this part?

547.4 How does a tribal government, TGRA, or tribal gaming operation comply with this part?

547.5 What are the rules of interpretation and of general application for this part?

547.6 What are the minimum technical standards for enrolling and enabling Class II gaming system components?

547.7 What are the minimum technical hardware standards applicable to Class II gaming systems?

547.8 What are the minimum technical software standards applicable to Class II gaming systems?

547.9 What are the minimum technical standards for Class II gaming system accounting functions? 

547.10 What are the minimum standards for Class II gaming system critical events?

547.11 What are the minimum technical standards for money and credit handling?

547.12 What are the minimum technical standards for downloading on a Class II gaming system?

547.13 What are the minimum technical standards for program storage media?

547.14 What are the minimum technical standards for electronic random number generation? 

547.15 What are the minimum technical standards for electronic data communications between system 

components? 

547.16 What are the minimum standards for game artwork, glass, and rules? 

547.17 How does a TGRA grant a variance from these standards? 

Authority: 25 U.S.C. 2706(b). 

§ 547.1 What is the purpose of this part? 

The Indian Gaming Regulatory Act, 25 U.S.C. 2703(7)(A)(i), permits the use of electronic, computer, or other 

technologic aids in connection with the play of Class II games. This part establishes the minimum technical standards 

governing the use of such aids. 

§ 547.2 How do these regulations affect state jurisdiction? 

Nothing in this part shall be construed to grant to a state jurisdiction over Class II gaming or to extend a state’s 

jurisdiction over Class III gaming. 

§ 547.3 What are the definitions for this part? 

For the purposes of this part, the following definitions apply: 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

2

Account access component. A component within a Class II gaming system that reads or recognizes account access 

media and gives a patron the ability to interact with an account. 

Account access medium. A magnetic stripe card or any other medium inserted into, or otherwise made to interact 

with, an account access component in order to give a patron the ability to interact with an account. 

Audit mode. The mode where it is possible to view Class II gaming system accounting functions, statistics, etc. and 

perform non-player-related functions. 

Agent. A person authorized by the gaming operation, as approved by the TGRA, to make decisions, tasks or actions 

on the behalf of the gaming operation. This definition permits the use of computer applications to perform the 

function(s) of an agent.

Cancel credit. An action initiated by the Class II gaming system where some or all of a player’s credits are 

removed by an attendant and paid to the player. 

Cashless system. A system that performs cashless transactions and maintains records of those cashless 

transactions. 

Cashless transaction. A movement of funds electronically from one component to another, often to or from a 

patron deposit account, or promotional account. 

CD-ROM. Compact Disc – Read Only Memory. 

Chairman. The Chairman of the National Indian Gaming Commission. 

Class II game. Class II gaming shall have the same meaning as defined in 25 U.S.C. 2703(7)(A).

Class II gaming system. All components, whether or not technologic aids in electronic, computer, mechanical, or 

other technologic form, that function together to aid the play of one or more Class II games, including accounting 

functions mandated by these regulations. 

Commission. The National Indian Gaming Commission established by the Indian Gaming Regulatory Act, 25 

U.S.C. 2701 et seq. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

3

Coupon. A financial instrument of fixed wagering value, usually paper, that can only be used to acquire noncashable credits through interaction with a voucher system. This does not include instruments such as printed 

advertising material that cannot be validated directly by a voucher system. 

Critical memory. Memory locations storing data essential to the functionality of the Class II gaming system. 

DLL. A Dynamic-Link Library file. 

Download package. Approved data sent to a component of a Class II gaming system for such purposes as changing 

the component software. 

DVD. Digital Video Disk or Digital Versatile Disk. 

EPROM. Erasable Programmable Read Only Memory – a storage area that may be filled with data and 

information, that once written is not modifiable, and that is retained even if there is no power applied to the machine. 

Fault. An event that when detected by a Class II gaming system causes a discontinuance of game play or other 

component functions.

Financial instrument. Any tangible item of value tendered in Class II game play, including, but not limited to, bills, 

coins, vouchers and coupons. 

Financial instrument acceptor. Any component that accepts financial instruments, such as a bill validator. 

Financial instrument dispenser. Any component that dispenses financial instruments, such as a ticket printer. 

Financial instrument storage component. Any component that stores financial instruments, such as a drop box.

Flash memory. Non-volatile memory that retains its data when the power is turned off and that can be 

electronically erased and reprogrammed without being removed from the circuit board. 

Game software. The operational program or programs that govern the play, display of results, and/or awarding of 

prizes or credits for Class II games. 

Gaming equipment. All electronic, electro-mechanical, mechanical, or other physical components utilized in the 

play of Class II games. 

Hardware. Gaming equipment. 

Interruption. Any form of mis-operation, component failure, or interference to the Class II gaming equipment. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

4

Modification. A revision to any hardware or software used in a Class II gaming system. 

Non-cashable credit. Credits given by an operator to a patron; placed on an Class II gaming system through a 

coupon, cashless transaction or other approved means; and capable of activating play but not being converted to cash. 

Patron. A person who is a customer or guest of the gaming operation and may interact with a Class II game. 

Also may be referred to as a “player”.

Patron deposit account. An account maintained on behalf of a patron, for the purpose of depositing and 

withdrawing cashable funds for the primary purpose of interacting with a gaming activity. 

Player interface. Any component or components of a Class II gaming system, including an electronic or 

technologic aid (not limited to terminals, player stations, handhelds, fixed units, etc.), that directly enables player 

interaction in a Class II game. 

Prize schedule. The set of prizes available to players for achieving pre-designated patterns in the Class II game. 

Program storage media. An electronic data storage component, such as a CD-ROM, EPROM, hard disk, or flash 

memory on which software is stored and from which software is read. 

Progressive prize. A prize that increases by a selectable or predefined amount based on play of a Class II game. 

Random number generator (RNG). A software module, hardware component or combination of these designed to 

produce outputs that are effectively random. 

Reflexive software. Any software that has the ability to manipulate and/or replace a randomly generated outcome 

for the purpose of changing the results of a Class II game or deprives a player of a prize to which the player is otherwise 

entitled based on the random outcome of the game.

Removable/rewritable storage media. Program or data storage components that can be removed from gaming 

equipment and be written to, or rewritten by, the gaming equipment or by other equipment designed for that purpose. 

Server. A computer that controls one or more applications or environments within a Class II gaming system. 

Test/diagnostics mode. A mode on a component that allows various tests to be performed on the Class II gaming 

system hardware and software. 

Testing laboratory. An organization recognized by a TGRA pursuant to § 547.4(f). 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

5

TGRA. Tribal gaming regulatory authority, which is the entity authorized by tribal law to regulate gaming 

conducted pursuant to the Indian Gaming Regulatory Act. 

Voucher. A financial instrument of fixed wagering value, usually paper, that can only be used to acquire an 

equivalent value of cashable credits or cash through interaction with a voucher system. 

Voucher system. A component of the Class II gaming system or an external system that securely maintains records 

of vouchers and coupons; validates payment of vouchers; records successful or failed payments of vouchers and 

coupons; and controls the purging of expired vouchers and coupons. 

§ 547.4 How does a tribal government, TGRA, or tribal gaming operation comply with this part? 

(a) Limited immediate compliance. A TGRA shall: 

(1) Require that all Class II gaming system software that affects the play of the Class II game and were in operation 

prior to November 10, 2008 be submitted, together with the signature verification required by § 547.8(f), to a testing 

laboratory recognized pursuant to paragraph (f) of this section.

(2) Require that the testing laboratory test the submission to the standards established by § 547.8(b), § 547.8(f), § 

547.14, § 547.5(c), and to any additional technical standards adopted by the TGRA; 

(3) Require that the testing laboratory provide the TGRA with a formal written report setting forth and certifying to 

the findings and conclusions of the test; 

(i) The testing laboratory’s written report shall note the submission of any other compliance with applicable federal 

laws or regulations.

(ii) [Reserved]

(4) Make a finding, in the form of a certificate provided to the supplier or manufacturer of the Class II gaming 

system, that the Class II gaming system qualifies for grandfather status under the provisions of this section, but only 

upon receipt of a testing laboratory’s report that the Class II gaming system is compliant with § 547.8(b), § 547.8(f), § 

547.5(c), § 547.14, and any other technical standards adopted by the TGRA. If the TGRA does not issue the certificate, 

or if the testing laboratory finds that the Class II gaming system is not compliant with § 547.8(b), § 547.8(f), § 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

6

547.5(c), § 547.14, or any other technical standards adopted by the TGRA, then the gaming system shall immediately 

be removed from play and not be utilized. 

(5) Retain a copy of any testing laboratory's report so long as the Class II gaming system that is the subject of the 

report remains available to the public for play; 

(6) Retain a copy of any certificate of grandfather status so long as the Class II gaming system that is the subject of 

the certificate remains available to the public for play; and 

(7) Require the supplier of any player interface to designate with a permanently affixed label each player interface 

with an identifying number and the date of manufacture or a statement that the date of manufacture was on or before 

the effective date of this part. The TGRA shall also require the supplier to provide a written declaration or affidavit 

affirming that the date of manufacture was on or before November 10, 2008.

(b) Grandfather provisions. All Class II gaming systems manufactured or placed in a tribal facility on or before the 

effective date of this part and certified pursuant to paragraph (a) of this section are grandfathered Class II gaming 

systems for which the following provisions apply:

(1) Grandfathered Class II gaming system shall be available for use at any tribal gaming facility subject to approval 

by the TGRA, which shall transmit its notice of that approval, identifying the grandfathered Class II gaming system 

and its components, to the Commission. 

(2) As permitted by the TGRA, individual hardware or software components of a grandfathered Class II gaming 

system may be repaired or replaced to ensure proper functioning, security, or integrity of the grandfathered Class II 

gaming system. 

(3) All modifications that affect the play of a grandfathered Class II gaming system must be approved pursuant to 

paragraph (c) of this section, except for the following: 

(i) Any software modifications that the TGRA finds will maintain or advance the system's overall compliance with 

this part or any applicable provisions of part 543 of this chapter, after receiving a new testing laboratory report that the 

modifications are compliant with the standards established by § 547.8(b), § 547.5(c), § 547.14, and any other standards 

adopted by the TGRA;
Final Proposed TGWG Draft Part 547 as of 5/13/2011

7

(ii) Any hardware modifications that the TGRA finds will maintain or advance the system’s overall compliance 

with this part or any applicable provisions of part 543 of this chapter; and 

(iii) Any other modification to the software of a grandfathered Class II gaming system that the TGRA finds will not 

detract from, compromise or prejudice: 

(A) The proper functioning, security, or integrity of the Class II gaming system, and 

(B) The gaming system’s overall compliance with the requirements of this part or any applicable provisions of part 

543 of this chapter. 

(iv) No such modification may be implemented without the approval of the TGRA. The TGRA shall maintain a 

record of the modification so long as the Class II gaming system that is the subject of the modification remains 

available to the public for play and shall make the record available to the Commission upon request. The Commission 

will only make available for public review records or portions of records subject to release under the Freedom of 

Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; or the Indian Gaming Regulatory Act, 25 

U.S.C. 2716(a). 

(c) Submission, testing, and approval – generally. Except as provided in paragraphs (b) and (d) of this section, no 

TGRA shall permit in a tribal gaming operation the use of any Class II gaming system, or any associated cashless 

system or voucher system or any modification thereto, unless: 

(1) The Class II gaming system, cashless system, voucher payment system, or modification has been submitted to 

a testing laboratory; 

(2) A TGRA shall require a testing laboratory to test the submission to the standards established by:

(i) This part; 

(ii) Any applicable provisions of part 543 of this chapter that are testable by the testing laboratory; and 

(iii) The TGRA;

(3) The testing laboratory provides a formal written report to the party making the submission, setting forth and 

certifying to its findings and conclusions; and 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

8

(4)(i) Following receipt of the testing laboratory's report, the TGRA makes a finding that the Class II gaming 

system, cashless system, or voucher system conforms to the standards established by: 

(A) This part; 

(B) Any applicable provisions of part 543 of this chapter that are testable by the testing laboratory; and 

(C) The TGRA. 

(ii) The TGRA shall retain a copy of the testing laboratory's report so long as the Class II gaming system, cashless 

system, voucher system, or modification thereto that is the subject of the report remains available to the public for play 

in its gaming operation. 

(d) Emergency hardware and software modifications.

(1) A TGRA, in its discretion, may permit modified hardware or software to be made available for play without prior 

laboratory testing or review if the modified hardware or software is: 

(i) Necessary to correct a problem affecting the fairness, security, or integrity of a game or accounting system or 

any cashless system, or voucher system; or 

(ii) Unrelated to game play, an accounting system, a cashless system, or a voucher system. 

(2) If a TGRA authorizes new or modified software or hardware to be made available for play or use without prior 

testing laboratory review, the TGRA shall thereafter require the hardware or software manufacturer to: 

(i) Immediately advise other users of the same hardware or software of the importance and availability of the 

update; 

(ii) Immediately submit the new or modified hardware or software to a testing laboratory for testing and 

verification of compliance with this part and any applicable provisions of part 543 of this chapter that are testable by 

the testing laboratory; and 

(iii) Immediately provide the TGRA with a software signature verification tool meeting the requirements of § 

547.8(f) for any new or modified software. 

(3) If a TGRA authorizes a software or hardware modification under this paragraph, it shall maintain a record of 

the modification and a copy of the testing laboratory report so long as the Class II gaming system that is the subject of 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

9

the modification remains available to the public for play and shall make the record available to the Commission upon 

request. The Commission will only make available for public review records or portions of records subject to release 

under the Freedom of Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; or the Indian Gaming 

Regulatory Act, 25 U.S.C. 2716(a). 

(e) Compliance by charitable gaming operations. This part shall not apply to charitable gaming operations, 

provided that: 

(1) The tribal government determines that the organization sponsoring the gaming operation is a charitable 

organization; 

(2) All proceeds of the charitable gaming operation are for the benefit of the charitable organization; 

(3) The TGRA permits the charitable organization to be exempt from this part; 

(4) The charitable gaming operation is operated wholly by the charitable organization’s employees or volunteers; 

and 

(5) The annual gross gaming revenue of the charitable gaming operation does not exceed $1,000,000. 

(f) Testing laboratories. (1) A testing laboratory may provide the examination, testing, evaluating and reporting 

functions required by this section provided that: 

(i) It demonstrates its integrity, independence and financial stability to the TGRA. 

(ii) It demonstrates its technical skill and capability to the TGRA. 

(iii) If the testing laboratory is owned or operated by the tribe, the testing laboratory must be independent from the 

manufacturer and gaming operator for whom it is providing the testing, evaluating, and reporting functions required by 

this section. 

(iv) The TGRA:

(A) Makes a suitability determination of the testing laboratory based upon standards no less stringent than those set 

out in §§ 533.6(b)(1)(ii) through (v) of this chapter and based upon no less information than that required by § 537.1 of 

this chapter, or 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

10

(B) Accepts, in its discretion, a determination of suitability for the testing laboratory made by any other gaming 

regulatory authority in the United States. 

(v) After reviewing the suitability determination and the information provided by the testing laboratory, the TGRA

determines that the testing laboratory is qualified to test and evaluate Class II gaming systems. 

(2) The TGRA shall: 

(i) Maintain a record of all determinations made pursuant to paragraphs (f)(1)(iii) and (f)(1)(iv) of this section for a 

minimum of three years and shall make the records available to the Commission upon request. The Commission will 

only make available for public review records or portions of records subject to release under the Freedom of 

Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; or the Indian Gaming Regulatory Act, 25 

U.S.C. 2716(a). 

(ii) Place the testing laboratory under a continuing obligation to notify it of any adverse regulatory action in any 

jurisdiction where the testing laboratory conducts business. 

(iii) Require the testing laboratory to provide notice of any material changes to the information provided to the 

TGRA. 

§ 547.5 What are the rules of interpretation and of general application for this part? 

(a) Minimum standards. A TGRA may establish and implement additional technical standards that are as stringent 

as, or more stringent than, those set out in this part. 

(b) Only applicable standards apply. Gaming equipment and software used with Class II gaming systems shall 

meet all applicable requirements of this part. For example, if a Class II gaming system lacks the ability to print or 

accept vouchers, then any standards that govern vouchers do not apply. 

(c) Fairness. No Class II gaming system shall cheat or mislead users. All prizes advertised shall be available to win

during the game. Test laboratory shall calculate and/or verify the mathematical expectations of game play, where 

applicable, in accordance with the manufacturer stated submission. The results shall be included in the test laboratory’s 

report to the TGRA. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

11

(d) Approved equipment and software only. All gaming equipment and software used with Class II gaming systems 

shall be identical in all respects to a prototype reviewed and tested by a testing laboratory and approved for use by the 

TGRA pursuant to § 547.4(a) through (c). Unapproved software shall not be loaded onto or stored on any program 

storage medium used in a Class II gaming system, except as provided in § 547.4(d).

(e) Proper functioning. All gaming equipment and software used with Class II gaming systems shall perform 

according to the manufacturer’s design and operating specifications. 

(f) No Limitation of Technology. This part should not be interpreted to limit the use of technology or to preclude the 

use of technology not specifically referenced. 

(g) Severability. If any provision of this part is declared invalid by a court of competent jurisdiction, such decision 

shall not affect the remainder of this part. 

§ 547.6 What are the minimum technical standards for enrolling and enabling Class II gaming system 

components? 

(a) General requirements. Class II gaming systems shall provide a method to: 

(1) Enroll and unenroll system components; 

(2) Enable and disable specific system components. 

(b) Specific requirements. Class II gaming systems shall: 

(1) Ensure that only enrolled and enabled system components participate in gaming; and 

(2) Ensure that the default condition for components shall be unenrolled and disabled. 

§ 547.7 What are the minimum technical hardware standards applicable to Class II gaming systems? 

(a) Printed circuit boards.

(1) Printed circuit boards that have the potential to affect the outcome or integrity of the game, and are specially 

manufactured or proprietary and not off-the-shelf, shall display a unique identifier such as a part number and/or 

revision number, which shall be updated to reflect new revisions or modifications of the board. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

12

(2) Switches or jumpers on all circuit boards that have the potential to affect the outcome or integrity of any game, 

progressive award, financial instrument, cashless transaction, voucher transaction, or accounting records shall be 

capable of being sealed. 

(b) Electrostatic discharge. Class II gaming system components accessible to the public shall be constructed so 

that they exhibit immunity to human body electrostatic discharges on areas exposed to contact. Static discharges of 

±15 kV for air discharges and ±7.5 kV for contact discharges may not cause damage, or inhibit operation or integrity of 

the Class II gaming system. 

(c) Physical enclosures. Physical enclosures shall be of a robust construction designed to resist determined illegal 

entry. All protuberances and attachments such as buttons, identification plates, and labels shall be sufficiently robust to 

avoid unauthorized removal. 

(d) Player interface. The player interface shall include a method or means to: 

(1) Display information to a player; and 

(2) Allow the player to interact with the Class II gaming system. 

(e) Account access components. A Class II gaming system component that reads account access media shall be 

located within a secure, locked or tamper-evident area or in a cabinet or housing that is of a robust construction 

designed to resist determined illegal entry and to protect internal components. In addition, the account access 

component: 

(1) Shall be constructed so that physical tampering leaves evidence of such tampering; and 

(2) Shall provide a method to enable the Class II gaming system to interpret and act upon valid or invalid input or 

error condition. 

(f) Financial instrument storage components. Any Class II gaming system components that store financial 

instruments and that are not designed to be operated under the direct control of a gaming operation employee or agent 

shall be located within a secure and locked area or in a locked cabinet or housing that is of a robust construction 

designed to resist determined illegal entry and to protect internal components.
Final Proposed TGWG Draft Part 547 as of 5/13/2011

13

(g) Financial instrument acceptors. (1) Any Class II gaming system components that handle financial instruments 

and that are not designed to be operated under the direct control of an agent shall:

(i) Be located within a secure, locked and tamper-evident area or in a locked cabinet or housing that is of a robust 

construction designed to resist determined illegal entry and to protect internal components; 

(ii) Be able to detect the entry of valid or invalid financial instruments and to provide a method to enable the Class 

II gaming system to interpret and act upon valid or invalid input or error condition; and 

(iii) Be constructed to permit communication with the Class II gaming system of the accounting information 

required by § 547.9(a) and by applicable provisions of any Commission and tribal gaming regulatory regulations 

governing minimum internal control standards. 

(2) Prior to completion of a valid financial instrument transaction by the Class II gaming system, no monetary 

amount related to that instrument shall be available for play. For example, credits shall not be available for play until 

currency or coupon inserted into an acceptor is secured in the storage component. 

(3) The monetary amount related to all valid financial instrument transactions by the Class II gaming system shall 

be recorded as required by § 547.9(a) and the applicable provisions of any Commission and TGRA regulations 

governing minimum internal control standards. 

(h) Financial instrument dispensers.

(1) Any Class II gaming system components that dispense financial instruments and that are not designed to be 

operated under the direct control of a gaming operation employee or agent shall: 

(i) Be located within a secure, locked and tamper-evident area or in a locked cabinet or housing that is of a robust 

construction designed to resist determined illegal entry and to protect internal components; 

(ii) Provide a method to enable the Class II gaming system to interpret and act upon valid or invalid input or error 

condition; and 

(iii) Be constructed to permit communication with the Class II gaming system of the accounting information 

required by § 547.9(a) and by applicable provisions of any Commission and tribal gaming regulatory regulations 

governing minimum internal control standards. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

14

(2) The monetary amount related to all valid financial instrument transactions by the Class II gaming system shall 

be recorded as required by § 547.9(a), the applicable provisions of part 543 of this chapter, and any TGRA regulations 

governing minimum internal control standards. 

(i) Game Outcome Determination Components. Any Class II gaming system logic components that affect the game 

outcome and that are not designed to be operated under the direct control of a gaming operation employee or agent 

shall be located within a secure, locked and tamper-evident area or in a locked cabinet or housing that is of a robust 

construction designed to resist determined illegal entry and to protect internal components. DIP switches or jumpers 

that can affect the integrity of the Class II gaming system must be capable of being sealed by the TGRA. 

(j) Door access detection. All components of the Class II gaming system that are locked in order to meet the 

requirements of this part shall include a sensor or other methods to monitor an open door. A door open sensor, and its 

components or cables, shall be secure against attempts to disable them or interfere with their normal mode of 

operation.

(k) Separation of functions/no limitations on technology. Nothing herein shall prohibit the account access 

component, financial instrument storage component, financial instrument acceptor, and financial instrument dispenser 

from being included within the same component, or separated into individual components. 

§ 547.8 What are the minimum technical software standards applicable to Class II gaming systems? 

This section provides general software standards for Class II gaming systems for the play of Class II games, 

including, where applicable, games similar to bingo.

(a) Player interface displays. (1) If not otherwise provided to the player, the player interface shall display the 

following: 

(i) The purchase or wager amount; 

(ii) Game results; and

(iii) Any player credit balance. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

15

(2) Between plays of any game and until the start of the next play, or until the player selects a new game option 

such as purchase or wager amount or card selection, whichever is earlier, if not otherwise provided to the player, the 

player interface shall display: 

(i) The total purchase or wager amount and all prizes and total credits won for the last game played; 

(ii) The final results for the last game played; and 

(iii) Any default purchase or wager amount for the next play. 

(b) Game initiation and play. (1) Each game played on the Class II gaming system shall follow and not deviate 

from a constant set of rules for each game provided to players pursuant to § 547.16.

(2) The Class II gaming system shall not alter or allow to be altered the card permutations used for play of a Class 

II game unless specifically chosen by the player prior to commitment to participate in the game. No duplicate cards 

shall be sold for any common draw. 

(3) No game play shall commence and, no financial instrument or credit shall be accepted on the affected player 

interface, in the presence of any fault condition that affects the outcome of the game, open door, or while in test, audit, 

or lock-up mode. 

(4) The player must choose to participate in the play of a game. 

(c) Audit Mode. (1) If an audit mode is provided, the Class II gaming system shall provide, for those components 

actively involved in the audit: 

(i) All accounting functions required by § 547.9, by applicable provisions of any Commission regulations 

governing minimum internal control standards, and by any internal controls adopted by the tribe or TGRA; 

(ii) Display player interface identification; and 

(iii) Display software version or game identification; 

(2) Audit mode shall be accessible by a secure method such as an employee or agent PIN, key or other auditable 

access control.

(3) Accounting function data shall be accessible by an agent at any time, except during a payout, during a handpay, 

or during play. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

16

(4) The Class II gaming system shall disable financial instrument acceptance on the affected player interface while 

in audit mode, except during financial instrument acceptance testing. 

(d) Last bingo game play recall. The last bingo game play recall function shall: 

(1) Be retrievable at all times, other than when the recall component is involved in the play of a game, upon the 

operation of an external key-switch, entry of an audit card, or a similar method; 

(2) Display the results of recalled bingo game play as originally displayed or in text representation so as to enable 

the TGRA or operator to clearly identify the bingo game play sequences and results that occurred;

(3) Allow the Class II gaming system component providing bingo game play recall, upon return to normal game 

play mode, to restore any affected display to the positions, forms and values displayed before access to the bingo game 

play recall information; and 

(4) Provide the following information for the current and previous four bingo game plays and shall display: 

(i) Play start time, end time, and date; 

(ii) The total number of credits at the start of play; 

(iii) The purchase or wager amount; 

(iv) The total number of credits at the end of play; and 

(v) The total number of credits won as a result of the bingo game play recalled, and the value in dollars and cents 

for progressive prizes, if different. 

(vi) For bingo games and, where applicable, games similar to bingo, also display: 

(A) The card(s) used by the player; 

(B) The identifier of the game played; 

(C) The numbers or other designations drawn, in the order that they were drawn; 

(D) The numbers or other designations and prize patterns covered on each card; 

(E) All prizes won by the player, including winning patterns, if any; and 

(F) The unique identifier of the card on which prizes were won; 

(vii) For pull-tab games only, also display:
Final Proposed TGWG Draft Part 547 as of 5/13/2011

17

(A) The result(s) of each pull-tab, displayed in the same pattern as on the tangible pull-tab;

(B) All prizes won by the player;

(C) The unique identifier of each pull tab; and

(D) Any other information necessary to fully reconstruct the current and four previous plays.

(e) Voucher and credit transfer recall. Notwithstanding the requirements of any other section in this part, a Class II 

gaming system shall have the capacity to: 

(1) Display the information specified in § 547.11(b)(5)(ii) through (vi) for the last five vouchers or coupons printed 

and the last five vouchers or coupons accepted; and 

(2) Display a complete transaction history for the last five cashless transactions made and the last five cashless 

transactions accepted. 

(f) Software signature verification. The manufacturer or developer of the Class II gaming system must provide to 

the testing laboratory and to the TGRA an industry-standard methodology, acceptable to the TGRA, for verifying the 

Class II gaming system game software. By way of illustration, for game software stored on rewritable media, such 

methodologies include signature algorithms and hashing formulas such as SHA-1. 

(g) Test, diagnostic, and demonstration modes. If test, diagnostic, and/or demonstration modes are provided, the 

Class II gaming system shall, for those components actively involved in the test, diagnostic, or demonstration mode: 

(1) Clearly indicate when that component is in the test, diagnostic, or demonstration mode; 

(2) Not alter financial data on that component other than temporary data; 

(3) Only be available after entering a specific mode; 

(4) Disable credit acceptance and payment unless credit acceptance or payment is being tested; and 

(5) Terminate all mode-specific functions upon exiting a mode. 

(h) Multigame. If multiple games are offered for player selection at the player interface, the player interface shall: 

(1) Provide a display of available games; 

(2) Provide the means of selecting among them; 

(3) Display the full amount of the player’s credit balance;
Final Proposed TGWG Draft Part 547 as of 5/13/2011

18

(4) Identify the game selected or being played; and 

(5) Not force the play of a game after its selection. 

(i) Program interruption and resumption. The Class II gaming system software shall be designed so that upon 

resumption following any interruption, the system: 

(1) Is able to return to a known state; 

(2) Shall check for any fault condition upon resumption; 

(3) Shall verify the integrity of data stored in critical memory; 

(4) Shall return the purchase or wager amount to the player in accordance with the rules of the game; and 

(5) Shall detect any change or corruption in the Class II gaming system software. 

(j) Class II gaming system components acting as progressive controllers. This paragraph applies to progressive 

controllers and components acting as progressive controllers in Class II gaming systems. 

(1) Modification of progressive parameters shall be conducted in a secure manner approved by the TGRA. Such 

parameters may include: 

(i) Increment value; 

(ii) Secondary pool increment(s); 

(iii) Reset amount(s); 

(iv) Maximum value(s); and 

(v) Identity of participating player interfaces. 

(2) The Class II gaming system component or other progressive controller shall provide a means of creating a 

progressive balancing report for each progressive link it controls. At a minimum, that report shall provide balancing of 

the changes of the progressive amount, including progressive prizes won, for all participating player interfaces versus 

current progressive amount(s), plus progressive prizes. In addition, the report shall account for, and not be made 

inaccurate by, unusual events such as: 

(i) Class II gaming system critical memory clears; 

(ii) Modification, alteration, or deletion of progressive prizes; 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

19

(iii) Offline equipment; or 

(iv) Multiple site progressive prizes. 

(k) Critical memory. (1) Critical memory may be located anywhere within the Class II gaming system. Critical 

memory is any memory that maintains any of the following data: 

(i) Accounting data; 

(ii) Current credits; 

(iii) Configuration data; 

(iv) Last game play recall information required by § 547.8(d); 

(v) Game play recall information for the current game play, if incomplete; 

(vi) Software state (the last normal state software was in before interruption); 

(vii) RNG seed(s), if necessary for maintaining integrity; 

(viii) Encryption keys, if necessary for maintaining integrity; 

(ix) Progressive prize parameters and current values; 

(x) The five most recent financial instruments accepted by type, excluding coins and tokens; 

(xi) The five most recent financial instruments dispensed by type, excluding coins and tokens; and 

(xii) The five most recent cashless transactions paid and the five most recent cashless transactions accepted. 

(2) Critical memory shall be maintained using a methodology that enables errors to be identified and acted upon. 

All accounting and recall functions shall be verified as necessary to ensure their ongoing integrity. 

(3) The validity of affected data stored in critical memory shall be checked after each of the following events: 

(i) Every restart; 

(ii) Each attendant paid win; 

(iii) Each attendant paid progressive win; 

(iv) Each sensored door closure; and 

(v) Every reconfiguration, download, or change of prize schedule or denomination requiring operator intervention 

or action. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

20

(l) Secured access. Class II gaming systems that use a logon or other means of secured access shall include a user 

account lockout after a predetermined number of consecutive failed attempts to access system. 

§ 547.9 What are the minimum technical standards for Class II gaming system accounting functions? 

This section provides standards for accounting functions used in Class II gaming systems. 

(a) Required accounting data. The following minimum accounting data, however named, shall be maintained by 

the Class II gaming system. 

(1) Amount In: The total value of all financial instruments and cashless transactions accepted by the Class II 

gaming system. Each type of financial instrument accepted by the Class II gaming system shall be tracked 

independently per financial instrument acceptor, and as required by applicable requirements of the TGRA

regulations governing minimum internal control standards.

(2) Amount Out: The total value of all financial instruments and cashless transactions paid by the Class II 

gaming system, plus the total value of attendant pay. Each type of financial instrument paid by the Class II 

Gaming System shall be tracked independently per financial instrument dispenser, and as required by 

applicable requirements of the TGRA regulations governing minimum internal control standards.

(b) Accounting data storage. If the Class II gaming system electronically maintains accounting data: 

(1) Accounting data shall be stored with at least eight decimal digits. 

(2) Credit balances shall have sufficient digits to accommodate the design of the game. 

(3) Accounting data displayed to the player may be incremented or decremented using visual effects, but the 

internal storage of this data shall be immediately updated in full. 

(4) Accounting data shall be updated upon the occurrence of the relevant accounting event. 

(5) Modifications to accounting data shall be recorded, including the identity of the person(s) making the 

modifications, and be reportable by the Class II gaming system. 

(c) Rollover. Accounting data that rolls over to zero shall not corrupt data. 

(d) Credit balance display and function. (1) Any credit balance maintained at the player interface shall be 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

21

prominently displayed at all times except: 

(i) In audit, configuration, recall and test modes; or 

(ii) Temporarily, during entertaining displays of game results. 

(2) Progressive prizes may be added to the player’s credit balance provided: 

(i) The player credit balance is maintained in dollars and cents; 

(ii) The progressive accounting data is incremented in number of credits; or 

(iii) The prize in dollars and cents is converted to player credits or transferred to the player’s credit balance in a 

manner that does not mislead the player or cause accounting imbalances. 

(3) If the player credit balance displays in credits, but the actual balance includes fractional credits, the Class II 

gaming system shall display the fractional credit when the player credit balance drops below one credit. 

§ 547.10 What are the minimum standards for Class II gaming system critical events? 

This section provides standards for events such as system critical faults, deactivation, door open or other changes 

of states, and lockup within the Class II gaming system. 

(a) Fault events. (1) The following events are to be treated as described below:

Events Definition and action to be taken

(i) Component fault

(ii) Financial storage component full

(iii) Financial output component 

empty

(iv) Financial component fault

(v) Critical memory error

Reported when a fault on a component is detected. When possible, this event

message should indicate what the nature of the fault is.

Reported when a financial instrument acceptor or dispenser includes storage, 

and it becomes full. This event message should indicate what financial storage 

component is full.

Reported when a financial instrument dispenser is empty. The event message 

should indicate which financial output component is affected, and whether it 

is empty.

Reported when an occurrence on a financial component results in a known 

fault state.

Some critical memory error has occurred. When a non-correctable critical 

memory error has occurred, the data on the Class II gaming system 

component can no longer be considered reliable. Accordingly, any game play 

on the affected component shall cease immediately, and an appropriate 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

22

(vi) Progressive communication fault

(vii) Program storage medium fault

message shall be displayed, if possible. 

If applicable; when communications with a progressive controller component 

is in a known fault state. 

The software has failed its own internal security check or the medium itself 

has some fault. 

Any game play on the affected component shall cease immediately, and an 

appropriate message shall be displayed, if possible.

(2) The occurrence of any event identified in paragraph (a)(1) of this section shall be recorded. 

(3) Upon clearing any event identified in paragraph (a)(1) of this section, the Class II gaming system shall: 

(i) Record that the fault condition has been cleared; 

(ii) Ensure the integrity of all related accounting data; and 

(iii) In the case of a malfunction, return a player’s purchase or wager according to the rules of the game. 

(b) Door open/close events. (1) In addition to the requirements of paragraph (a)(1) of this section, the Class II 

gaming system shall perform the following for any component affected by any sensored door open event: 

(i) Indicate that the state of a sensored door changes from closed to open or opened to closed; 

(ii) Disable all financial instrument acceptance, unless a test mode is entered; 

(iii) Disable game play on the affected player interface; 

(iv) Disable player inputs on the affected player interface, unless test mode is entered; and 

(v) Disable all financial instrument disbursement, unless a test mode is entered. 

(2) The Class II gaming system may return the component to a ready to play state when all sensored doors are 

closed. 

(c) Non-fault events. (1) The following non-fault events are to be treated as described below, if applicable:

Events Definition and action to be taken
Final Proposed TGWG Draft Part 547 as of 5/13/2011

23

(i) Player interface power off during 

play

(ii) Player interface power on

(iii) Financial instrument storage 

component container/ stacker 

removed

This condition is reported by the affected component(s) to indicate power has 

been lost during game play. 

This condition is reported by the affected component(s) to indicate it has been 

turned on. 

This condition is reported when a financial instrument storage container has 

been removed. The event message should indicate which storage container 

was removed. 

§ 547.11 What are the minimum technical standards for money and credit handling? 

This section provides standards for money and credit handling by a Class II gaming system. 

(a) Credit acceptance, generally. (1) Upon any credit acceptance, the Class II gaming system shall register the 

correct number of credits on the player’s credit balance. 

(2) The Class II gaming system shall reject financial instruments deemed invalid. 

(b) Credit redemption, generally. (1) For cashable credits on a player interface, players shall be allowed to cash out 

and/or redeem those credits at the player interface except when that player interface is: 

(i) Involved in the play of a game; 

(ii) In audit mode, recall mode or any test mode; 

(iii) Detecting any sensored door open condition; 

(iv) Updating the player credit balance or total win accounting data; or 

(v) Displaying a fault condition that would prevent cash-out or credit redemption. In this case a fault indication 

shall be displayed. 

(2) For cashable credits not on a player interface, the player shall be allowed to cash out and/or redeem those 

credits at any time. 

(3) A Class II gaming system shall not automatically pay an award subject to mandatory tax reporting or 

withholding. 

(4) Credit redemption by voucher or coupon shall conform to the following: 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

24

(i) A Class II gaming system may redeem credits by issuing a voucher or coupon when it communicates with a 

voucher system that validates the voucher or coupon. 

(ii) A Class II gaming system that redeems credits by issuing vouchers and coupons shall either: 

(A) Maintain an electronic record of all information required by paragraphs (b)(5)(ii) through (vi) of this section; 

or 

(B) Generate two identical copies of each voucher or coupon issued, one to be provided to the player and the other 

to be retained within the machine for audit purposes. 

(5) Valid vouchers and coupons shall contain the following: 

(i) Gaming operation name and location; 

(ii) The identification number of the Class II gaming system component or the player interface number, as 

applicable; 

(iii) Date and time of issuance; 

(iv) Alpha and numeric dollar amount; 

(v) A sequence number; 

(vi) A validation number that: 

(A) Is produced by a means specifically designed to prevent repetition of validation numbers; and 

(B) Has some form of checkcode or other form of information redundancy to prevent prediction of subsequent 

validation numbers without knowledge of the checkcode algorithm and parameters; 

(vii) For machine-readable vouchers and coupons, a bar code or other form of machine readable representation of 

the validation number, which shall have enough redundancy and error checking to ensure that 99.9% of all misreads 

are flagged as errors; 

(viii) Transaction type or other method of differentiating voucher and coupon types; and 

(ix) Expiration period or date. 

(6) Transfers from an account may not exceed the balance of that account.
Final Proposed TGWG Draft Part 547 as of 5/13/2011

25

(7) For Class II gaming systems not using dollars and cents accounting and not having odd cents accounting, the 

Class II gaming system shall reject any transfers from voucher payment systems or cashless systems that are not even 

multiples of the Class II gaming system denomination. 

(8) Voucher redemption systems shall include the ability to report redemptions per redemption location or user. 

§ 547.12 What are the minimum technical standards for downloading on a Class II gaming system? 

This section provides standards for downloading on a Class II gaming system. 

(a) Downloads. (1) Downloads are an acceptable means of transporting approved content, including but not limited 

to software, files, data, and prize schedules. 

(2) Downloads of software, games, prize schedules, or other download packages shall be conducted only as 

authorized by the TGRA. 

(3) Downloads shall use secure methodologies that will deliver the download data without alteration or 

modification, in accordance with § 547.15(a). 

(4) Downloads conducted during operational periods shall be performed in a manner that will not affect game play. 

(5) Downloads shall not affect the integrity of accounting data. 

(6) The Class II gaming system or the TGRA shall log each download of any download package. Each log record 

shall contain as a minimum: 

(i) The time and date of the initiation of the download; 

(ii) The time and date of the completion of the download; 

(iii) The Class II gaming system components to which software was downloaded; 

(iv) The version(s) of download package and any software downloaded. Logging of the unique software signature 

will satisfy this requirement; 

(v) The outcome of any software verification following the download (success or failure); and 

(vi) The name and identification number, or other unique identifier, of any individual(s) conducting or scheduling 

a download. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

26

(b) Verifying downloads. Downloaded software on a Class II gaming system shall be verified by the Class II 

gaming system using a software signature verification method that meets the requirements of § 547.8(f). 

§ 547.13 What are the minimum technical standards for program storage media? 

This section provides minimum standards for removable, (re-)writable, and nonwritable storage media in Class II 

gaming systems. 

(a) Removable program storage media. All removable program storage media shall maintain an internal checksum 

or signature of its contents. Verification of this checksum or signature is to be performed after every restart. If the 

verification fails, the affected Class II gaming system component(s) shall lock up and enter a fault state. 

(b) Nonrewritable program storage media. (1) All EPROMs and Programmable Logic Devices (PLDs) that have 

erasure windows shall be fitted with covers over their erasure windows. 

(2) All unused areas of EPROMs shall be written with the inverse of the erased state (e.g., zero bits (00 hex) for 

most EPROMs), random data, or repeats of the program data. 

(3) Flash memory storage components intended to have the same logical function as ROM, i.e. not to be 

dynamically written, shall be write-protected or otherwise protected from unauthorized modification. 

(4) The write cycle shall be closed or finished for all CD-ROMs such that it is not possible to write any further data 

to the CD. 

(5) Write protected hard disks are permitted if the hardware means of enabling the write protect is easily viewable 

and can be sealed in place Write protected hard disks are permitted using software write protection verifiable by a 

testing laboratory. 

(c) Writable and rewritable program storage media. (1) Writable and rewritable program storage, such as hard 

disk drives, Flash memory, writable CD-ROMs, and writable DVDs, may be used provided that the software 

stored thereon may be verified using the mechanism provided pursuant to § 547.8(f). 

(2) Program storage shall be structured so there is a verifiable separation of fixed data (e.g. program, fixed 

parameters, DLLs) and variable data. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

27

(d) Identification of program storage media. All program storage media that is not rewritable in circuit, (e.g.

EPROM, CD-ROM) shall be uniquely identified, displaying: 

(1) Manufacturer; 

(2) Program identifier; 

(3) Program version number(s); and 

(4) Location information, if critical (e.g. socket position 3 on the printed circuit board). 

§ 547.14 What are the minimum technical standards for electronic random number generation? 

This section provides minimum standards for electronic RNGs in Class II gaming systems. 

(a) Properties. All RNGs shall produce output having the following properties: 

(1) Statistical randomness; 

(2) Unpredictability; and 

(3) Non-repeatability. 

(b) Statistical Randomness. (1) Numbers or other designations produced by an RNG shall be statistically random 

individually and in the permutations and combinations used in the application under the rules of the game. For 

example, if a bingo game with 75 objects with numbers or other designations has a progressive winning pattern of the 

five numbers or other designations on the bottom of the card and the winning of this prize is defined to be the five 

numbers or other designations are matched in the first five objects drawn, the likelihood of each of the 75C5 

combinations are to be verified to be statistically equal. 

(2) Numbers or other designations produced by an RNG shall pass the statistical tests for randomness to a 99% 

confidence level.

(i) Mandatory statistical tests for randomness to include:

(A) Chi-square test; 

(B) Runs test (patterns of occurrences shall not be recurrent); and
Final Proposed TGWG Draft Part 547 as of 5/13/2011

28

(C) Serial correlation test potency and degree of serial correlation (outcomes shall be independent from the 

previous game).

(ii) Optional statistical tests for randomness may include:

(A) Equi-distribution (frequency) test; 

(B) Gap test; 

(C) Poker test; 

(D) Coupon collector’s test; 

(E) Permutation test; 

(F) Spectral test; or

(G) Test on subsequences. 

(c) Unpredictability. (1) It shall not be feasible to predict future outputs of an RNG, even if the algorithm and the 

past sequence of outputs are known. 

(2) Unpredictability shall be ensured by reseeding or by continuously cycling the RNG, and by providing a 

sufficient number of RNG states for the applications supported. 

(3) Re-seeding may be used where the re-seeding input is at least as statistically random as, and independent of, the 

output of the RNG being re-seeded. 

(d) Non-repeatability. The RNG shall not be initialized to reproduce the same output stream that it has produced 

before, nor shall any two instances of an RNG produce the same stream as each other. This property shall be ensured 

by initial seeding that comes from: 

(1) A source of "true" randomness, such as a hardware random noise generator; or 

(2) A combination of timestamps, parameters unique to a Class II gaming system, previous RNG outputs, or other, 

similar method. 

(e) General requirements. (1) Software that calls an RNG to derive game outcome events shall immediately use the 

output returned in accordance with the game rules. 

(2) The use of multiple RNGs is permitted as long as they operate in accordance with this section. 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

29

(3) RNG outputs shall not be arbitrarily discarded or selected. 

(4) Where a sequence of outputs is required, the whole of the sequence in the order generated shall be used in 

accordance with the game rules. 

(5) The Class II gaming system shall neither adjust the RNG process or game outcomes based on the history of 

prizes obtained in previous games nor use any reflexive software or secondary decision that affects the results shown to 

the player or game outcome. In no event shall the Class II gaming system deprive a player of a prize to which the player 

is otherwise entitled based on the random outcome of the game. Nothing in this paragraph shall prohibit the use of 

entertaining displays.

(f) Scaling algorithms and scaled numbers. An RNG that provides output scaled to given ranges shall: 

(1) Be independent and uniform over the range; 

(2) Provide numbers scaled to the ranges required by game rules, and notwithstanding the requirements of 

paragraph (e)(3) of this section, may discard numbers that do not map uniformly onto the required range but shall use 

the first number in sequence that does map correctly to the range; and

(3) Be capable of producing every possible outcome of a game according to its rules.

§ 547.15 What are the minimum technical standards for electronic data communications between system 

components? 

This section provides minimum standards for electronic data communications with gaming equipment or 

components used with Class II gaming systems. 

(a) Sensitive data. Communication of sensitive data shall be secure from eavesdropping, access, tampering, 

intrusion or alteration unauthorized by the TGRA. Sensitive data shall include, but not be limited to: 

(1) RNG seeds and outcomes; 

(2) Encryption keys, where the implementation chosen requires transmission of keys; 

(3) PINs; 

(4) Passwords; 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

30

(5) Financial instrument transactions; 

(6) Transfers of funds; 

(7) Player tracking information; 

(8) Download Packages; and 

(9) Any information that affects game outcome. 

(b) Wireless communications. (1) Wireless access points shall not be accessible to the general public. 

(2) Open or unsecured wireless communications are prohibited. 

(3) Wireless communications shall be secured using a methodology that makes eavesdropping, access, tampering, 

intrusion or alteration impractical. By way of illustration, such methodologies include encryption, frequency hopping, 

and code division multiplex access (as in cell phone technology). 

(c) Methodologies shall be used that will ensure the reliable transfer of data and provide a reasonable ability to 

detect and act upon any corruption of the data. 

(d) Class II gaming systems shall record detectable, unauthorized access or intrusion attempts. 

(e) Remote communications shall only be allowed if authorized by the TGRA. Class II gaming systems shall have 

the ability to enable or disable remote access, and the default state shall be set to disabled. 

(f) Failure of data communications shall not affect the integrity of critical memory. 

(g) The Class II gaming system shall log the establishment, loss, and re-establishment of data communications 

between sensitive Class II gaming system components. 

§ 547.16 What are the minimum standards for game artwork, glass, and rules? 

This section provides standards for the display of game artwork, the displays on belly or top glass, and the display 

and disclosure of game rules, whether in physical or electronic form. 

(a) Rules, instructions, and prize schedules, generally. The following shall at all times be displayed or made 

readily available to the player upon request: 

(1) Game name, rules, and options such as the purchase or wager amount stated clearly and unambiguously; 
Final Proposed TGWG Draft Part 547 as of 5/13/2011

31

(2) Denomination; 

(3) Instructions for play on, and use of, the player interface, including the functions of all buttons; and 

(4) A prize schedule or other explanation, sufficient to allow a player to determine the correctness of all prizes 

awarded, including; 

(i) The range and values obtainable for any variable prize; 

(ii) Whether the value of a prize depends on the purchase or wager amount; and 

(iii) The means of division of any pari-mutuel prizes; but 

(iv) For Class II Gaming Systems, the prize schedule or other explanation need not state that subsets of winning 

patterns are not awarded as additional prizes (e.g. five in a row does not also pay three in a row or four in a row), unless 

there are exceptions, which shall be clearly stated. 

(b) Disclaimers. The Class II gaming system shall continually display: 

(1) “Malfunctions void all prizes and plays” or equivalent; and 

(2) “Actual Prizes Determined by Bingo [or other applicable Class II game] Play. Other Displays for Entertainment 

Only.” or equivalent.

§ 547.17 How does a gaming operation apply for a variance from the standards of this part?

(a) Variance.

(1) Should a TGRA grant a variance to any provision of these standards, the TGRA shall deliver a notice of the 

same to the Commission within ten (10) days of such approval.

(i) The notice shall contain a complete copy of the information presented to the TGRA and the variance as granted.

(ii) The notice shall be forwarded to the Commission within ten (10) days of the granting of the Variance.

(2) During a thirty (30) day period when the Commission first receives the notice required by this subpart, the 

Chairman may request additional information from the TGRA concerning the subject of variance. Such request shall 

suspend the thirty (30) day period until the Chairman receives the TGRA response.

(b) Commission Review.
Final Proposed TGWG Draft Part 547 as of 5/13/2011

32

(1) Within the thirty (30) day review period, the Commission may:

(i) Advise the TGRA, in writing, that it has no objection.

(ii) Provide the TGRA a written statement itemizing its objections. 

(iii) Take no action, in which case, the TGRA’s variance shall be final. 

(2) If the Commission has provided the TGRA a statement itemizing objections to the variance: 

(i) The TGRA shall reconsider the variance taking into account the objections itemized by the Commission.

(ii) The TGRA may seek reconsideration by submitting a request to the Chairman and members of the 

Commission.

(iii) Upon receipt of a request for reconsideration, the Commission shall conduct an informal hearing with the 

TGRA within 30 days, which may be conducted in person or through the exchange of documents, as requested by the 

TGRA.

(iv) After the informal hearing, the Commission must issue a written decision within 14 days. If the Commission 

disapproves the variance, such written decision must include an explanation of why the requested variance creates an 

imminent threat to the integrity of the tribal gaming operation.
APPENDIX 1
New TGWG Proposed Part 543 as of 7/28/2011

Page 1 of 35

PROPOSED PART 543 – MINIMUM INTERNAL CONTROL STANDARDS FOR 

CLASS II GAMING

Sec.

543.1 What does this part cover?

543.2 What are the definitions for this part?

543.3 How do tribal governments comply with this part?

543.4 What are the rules of interpretation and of general application for this part? 

543.5 [RESERVED]

543.6 Does this part apply to small and charitable gaming operations?

543.7 What are the minimum internal control standards for bingo?

543.8 What are the minimum internal control standards for pull tabs?

543.9 What are the minimum internal control standards for card games?

543.10 What are the minimum internal control standards for gaming promotions?

543.11 What are the minimum internal control standards for patron deposit accounts and 

cashless systems?

543.12 [RESERVED]What are the minimum internal control standards for player tracking?

543.13 [RESERVED]

543.14 What are the minimum internal control standards for the cage, vault, cash and cash 

equivalents?

543.15 What are the minimum internal control standards for lines of credit?

543.16 What are the minimum internal control standards for security and management of 

server, server software and data associated with Class II gaming systems?

543.17 What are the minimum internal control standards for complimentary services or items?

543.18 How does a gaming operation apply for a variance from the standards of this part?

543.19 What are the minimum internal control standards for audit and accounting?

543.20 [RESERVED]

543.21 What are the minimum internal control standards for drop and count?

543.22 [RESERVED]

543.23 What are the minimum internal control standards for surveillance?

§ 543.1 What does this part cover?

This part establishes the minimum internal control standards for the conduct of Class II games on 

Indian lands as described in 25 U.S.C. 2701 et seq.

§ 543.2 What are the definitions for this part?

The definitions in this section apply to all sections of this part unless otherwise noted.

Accountability. All financial instruments, receivables, and patron deposits constituting the total 

amount for which the bankroll custodian is responsible at a given time.

Accumulated credit payout. Credit accrued in a player interface that is paid to a patron manually 

in lieu of a player interface payout (i.e. hand pay, manual pay).
New TGWG Proposed Part 543 as of 7/28/2011

Page 2 of 35

Agent. A person authorized by the gaming operation, as approved by the TGRA, to make 

decisions or perform assigned tasks or actions on behalf of the gaming operation. This definition 

permits the use of computer applications to perform the function(s) of an agent.

Bingo paper. A consumable physical object that has one or more bingo cards on its face.

Bingo sales. Sales transactions and/or the value of purchases made by players to participate in 

the game(s).

Cage. A secure work area within the gaming operation for cashiers which may include a storage 

area for the gaming operation bankroll.

Chairman. The Chairman of the National Indian Gaming Commission. 

Cash equivalents. Documents, financial instruments other than cash, or anything else of 

representative value to which the gaming operation has assigned a monetary value. A cash 

equivalent includes, but is not limited to, tokens, chips, coupons, vouchers, payout slips and 

tickets, and other items to which a gaming operation has assigned an exchange value.

Cashless system. A system that performs cashless transactions and maintains records of those 

cashless transactions.

Cashless transaction. A movement of funds electronically from one component to another, often 

to or from a patron deposit account, or promotional account.

Chips. Cash substitutes, in various denominations, issued by a gaming operation.

Class II game. Class II gaming shall have the same meaning as defined in 25 U.S.C. 2703(7)(A).

Class II Gaming System. All components, whether or not technologic aids in electronic, 

computer, mechanical, or other technologic form, that function together to aid the play of one or 

more Class II games including accounting functions mandated by these regulations part Part 547 

of this chapter.

Commission. The National Indian Gaming Commission established by the Indian Gaming 

Regulatory Act, 25 U.S.C. 2701 et seq.

Complimentary. A service or item provided at no or reduced cost, to a patron at the discretion of 

an agent authorized to issue such services or items.

Count. The act of counting and recording the drop and/or other funds. Also, the total funds 

counted for a particular game, player interface, shift, or other period.
New TGWG Proposed Part 543 as of 7/28/2011

Page 3 of 35

Count room. A secured room location where the count is performed in which the cash and cash 

equivalents are counted.

Credit line (see Lines of credit). The privilege granted by a gaming operation to a patron to (1) 

defer payment of debt or (2) to incur debt and defer its payment under specific terms and 

conditions.

Credit line limit. The maximum dollar amount of credit assigned to a patron by the gaming 

operation.

Dedicated camera. A video camera that continuously records a specific activity.

Drop. The process of removing the drop boxes from the player interface or point of purchase.

Drop proceeds. The total amount of financial instruments removed from the drop boxes.

Drop box. A locked container in which cash or cash equivalents are placed at the time of the 

transaction. 

Exception Report. A listing of occurrences, transactions or items that fall outside a 

predetermined range of acceptability.

Financial instrument. Any tangible item of value tendered in Class II game play, including, but 

not limited to bills, coins, vouchers, and coupons.

Gaming Promotion. A type of marketing activity conducted by a gaming operation which 

includes two, but not all three, of the following elements: prize, chance, consideration.

Generally Accepted Accounting Principles (GAAP). A widely accepted set of rules, conventions, 

standards, and procedures for reporting financial information, as established by the Financial 

Accounting Standards Board (FASB), including but not limited to the standards for casino 

accounting published by the American Institute of Certified Public Accountant (AICPA).

Governmental Accounting Standards Board (GASB). Generally accepted accounting principles 

used by state and local governments.

Independent. The separation of functions so that the person or process monitoring, reviewing or 

authorizing the controlled activity, function, transaction is separate from the persons or process 

performing the controlled activity, function, transaction.

Lines of credit. The privilege granted by a gaming operation to a patron to (1) defer payment of 

debt or (2) to incur debt and defer its payment under specific terms and conditions.

Manual payout. Hand payment to a player.
New TGWG Proposed Part 543 as of 7/28/2011

Page 4 of 35

Marker. A document, signed by the patron promising to repay credit issued by the gaming 

operation.

MICS. Minimum internal control standards in this part.

Patron. A person who is a customer or guest of the gaming operation and may interact with a 

Class II game. Also may be referred to as a “player”.

Patron deposit account. An account maintained on behalf of a patron, for the purpose of 

depositing and withdrawing funds for the primary purpose of interacting with a gaming activity.

Permanent Record. Those records that must be maintained for a minimum period of 5 years, 

including all documents that contain original signatures or represent audit papers.

Player interface. Any component(s) or components of a Class II gaming system, including an 

electronic or technological aid (not limited to terminals, player stations, handhelds, fixed units, 

etc.), that directly enables player interaction in a Class II game.

Prize payout. Payment to a player associated with a winning or qualifying event.

Promotional progressive pots and/or pools. Funds contributed to a game by and for the benefit 

of players and are distributed to players based on a predetermined event.

Restricted patron deposit account. An account that can be accessed only by a specific patron 

using a secured method.

SSAE. Standards for Attestation Engagements.

Shift. A time period, unless otherwise approved by the tribal gaming regulatory authority, not to 

exceed 24 hours.

Shill. An agent financed by the gaming operation and acting as a player.

Short pay. The payment of the unpaid balance of an incomplete payout.

System of Internal Controls (SICS). An overall operational framework for a gaming operation 

incorporating principles of independence and segregation of function comprised of written 

policies, procedures, and standard practices based on overarching regulatory standards 

specifically designed to create a system of checks and balances in order to safeguard the integrity 

of a gaming operation and protect its assets. 

Smart card. A card with embedded integrated circuits that possesses the means to electronically 

store or retrieve account data, and is the only source of that data.
New TGWG Proposed Part 543 as of 7/28/2011

Page 5 of 35

Surveillance operation room(s). The secured area(s) where surveillance is taking place and/or 

where active surveillance equipment is located.

Surveillance system. A system of video cameras, monitors, recorders, video printers, switches, 

selectors, and other ancillary equipment used for surveillance.

Tier A. Gaming operations with annual gross gaming revenues of more than $3 million but not 

more than $8 million.

Tier B. Gaming operations with annual gross gaming revenues of more than $8 million but not 

more than $15 million.

Tier C. Gaming operations with annual gross gaming revenues of more than $15 million.

TGRA. Tribal gaming regulatory authority which is the entity authorized by tribal law to regulate 

gaming conducted pursuant to the Indian Gaming Regulatory Act.

TICS. Tribal Internal Control Standards.

Unrestricted patron deposit account. An account that may be accessed by the holder of the 

account number.

Vault. A secure area where cash and cash equivalents are stored.

§ 543.3 How do tribal governments comply with this part?

(a) Determination of Tier. 

(1) The determination of tier level shall be made based upon the annual gross gaming 

revenues indicated within the gaming operation's audited financial statements. 

(2) Gaming operations moving from one tier to another shall have nine (9) months from 

the date of the independent certified public accountant's audit report to achieve 

compliance with the requirements of the new tier. The TGRA may extend the deadline 

by an additional six (6) months if written notice is provided to the Commission no later 

than two (2) weeks before the expiration of the nine (9) month period.

(b) TICS. TGRAs shall ensure that TICS are established and implemented that provide a level of 

control that equals or exceeds those set forth in this part.

(1) Evaluation of Existing TICS. Each TGRA must, in accordance with the tribal gaming 

ordinance, determine whether and to what extent their TICS require revision to ensure 

compliance with this part. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 6 of 35

(2) Compliance Date. All changes necessary to ensure compliance with this part shall be 

promulgated within twelve (12) months from the effective date of this part and 

implemented at the commencement at the next fiscal year. At the discretion of the 

TGRA, gaming operations may have an additional six (6) months to come into 

compliance with the TICS.

(c) SICS. Each gaming operation must develop and implement a SICS that, at a minimum, 

complies with the TICS.

(1) Existing gaming operations. All gaming operations that are operating on or before the 

effective date of this part, must comply with this part within the time requirements 

established in paragraph (b) of this section. In the interim, such operations must continue 

to comply with existing TICS.

(2) New gaming operations. All gaming operations that commence operations after the 

effective date of this part, must comply with this part before commencement of 

operations.

(d) Submission to Commission. Tribal regulations promulgated pursuant to this part are not 

required to be submitted to the Commission pursuant to Sec. 522.3(b) of this chapter.

(e) Enforcement of Commission MICS.

(1) Each TGRA is required to establish and implement TICS pursuant to paragraph (b) of 

this section. Each gaming operation is then required, pursuant to paragraph (c) of this 

section, to develop and implement a SICS that complies with the TICS. Failure to do so 

may subject the tribal operator of the gaming operation, or the management contractor, to 

penalties under 25 U.S.C. 2713.

(2) Recognizing that tribes are the primary regulator of their gaming operation(s), 

enforcement action by the Commission will not be initiated under this part without first 

informing the tribe and TGRA of deficiencies in the SICS of its gaming operation and 

allowing a reasonable period of time to address such deficiencies. Such prior notice and 

opportunity for corrective action is not required where the threat to the integrity of the 

gaming operation is immediate and severe.

§ 543.4 What are the rules of interpretation and of general application for this part? 

(a) Minimum Standards. A TGRA may establish and implement additional technical standards 

that are as stringent as, or more stringent than, those set out in this part. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 7 of 35

(b) Only Applicable Standards Apply. Gaming equipment and software used with Class II 

gaming systems shall meet all applicable requirements of this part. For example, if a gaming 

operation does not offer lines of credit, then any standards that govern credit do not apply. 

(c) No Limitation of Technology. This part should not be interpreted to limit the use of 

technology or to preclude the use of technology not specifically referenced. 

(d) Severability. If any provision of this part is declared invalid by a court of competent 

jurisdiction, such decision shall not affect the remainder of this part. 

§ 543.5 [RESERVED]

§ 543.6 Does this part apply to small and charitable gaming operations?

(a) Small Gaming Operations. This part does not apply to small gaming operations provided that:

(1) The TGRA permits the operation to be exempt from this part;

(2) The annual gross gaming revenue of the operation does not exceed $3 million; and

(3) The TGRA develops and the operation complies with alternate procedures that:

(i) Protect the integrity of games offered;

(ii) Safeguard the assets used in connection with the operation; and

(iii) Create, prepare and maintain records in accordance with Generally Accepted 

Accounting Principles.

(b) Charitable Gaming Operations. This part does not apply to charitable gaming operations 

provided that:

(1) All proceeds are for the benefit of a charitable organization;

(2) The TGRA permits the charitable organization to be exempt from this part;

(3) The charitable gaming operation is operated wholly by the charitable organization‟s 

agents;

(4) The annual gross gaming revenue of the charitable operation does not exceed $3 

million; and

(5) The TGRA develops and the charitable gaming operation complies with alternate 

procedures that:
New TGWG Proposed Part 543 as of 7/28/2011

Page 8 of 35

(i) Protect the integrity of the games offered;

(ii) Safeguard the assets used in connection with the gaming operation; and

(iii) Create, prepare and maintain records in accordance with Generally Accepted 

Accounting Principles. For more information please see www.fasb.gov or 

www.fasb.org.

(c) Independent Operators. Nothing in this section exempts gaming operations conducted by 

independent operators for the benefit of a charitable organization.

§ 543.7 What are the minimum internal control standards for bingo?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for bingo operations as needed by an agent(s) 

with authority equal to or greater than those being supervised.

(de) Bingo Cards.

(1) Physical Inventory of bingo paper. 

(i) The bingo paper card inventory must be controlled in a manner designed to 

prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall address bingo paper cards exchanged between two agents, increases 

and decreases to inventory, and inventory reconciliation.

(2) Bingo salesSales. 

(i) Bingo The sales of bingo cards must be controlled in a manner to adequately 

record, track, and reconcile all bingosuch sales, including but not limited to voids

of bingo cards. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 9 of 35

(ii) When the sale of bingo cards sales areis recorded manually, total such sales 

are must be verified by an agent independent agentof the bingo sales being 

verified. 

(iii) No unauthorized person shall have unrestricted access to bingo card sales 

records.

(ef) Draw.

(1) The draw must be controlled in a manner that ensures the identity of each object 

drawn is accurately recorded and transmitted to the participants. 

(21) Controls must be present to ensureestablished requiring that all objects eligible for 

the draw are available to be drawn.

(2) The draw must be controlled in a manner that ensures random selection of the objects 

drawn.

(13) The draw must be controlled in a manner that ensures the identity of each object 

drawn is accurately recorded and transmitted to the participants.

(fg) Manual Payouts.

(1) Manual payouts Payouts must be controlled in a manner designed to verify winning 

events and prevent unauthorized access to, or misappropriation of, cash or cash 

equivalents. Such controls shall include, but not be limited to, the following:

(i) Manual payout Payout documentsrecords;

(ii) Validation and Verification;

(iii) Authorization and or signatures; and

(iv) Changes to Prize Payout amounts;

(v) Manually paid promotional prize payouts; and

(viiv) Voids.

(gh) Cash or and Cash Equivalent Controls. Cash or and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.
New TGWG Proposed Part 543 as of 7/28/2011

Page 10 of 35

(hi) Class II Gaming systemsTechnologic Aids to the Play of Bingo. Internal control procedures 

must be established to safeguard the integrity of all or part of a Class II gaming 

systemtechnologic aids to the play of bingo during installations, operations, modifications, and 

retirements. Such procedures must include, but not be limited to, the following:

(1) Shipping and receiving;

(2) Access credential control methods; 

(3) Record keeping and audit processes; 

(4) System software signature verification; 

(5) Testing;

(6) Display of rules and necessary disclaimers such as “Malfunctions void all prizes and 

pays and plays.", etc.

(7) Dispute resolution; 

(8) Malfunctions; and

(9) Removal, retirement, and/or destruction.

§ 543.8 What are the minimum internal control standards for pull tabs?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the pull tab operations and over the pull 

tab storage areas by an agent(s) with authority equal to or greater than those being supervised.

(de) Pull Tab Inventory of pull tabs. The pull tab inventory must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls 

shall address tabs exchanged between two agents, increases and decreases to inventory, and 

inventory reconciliation.
New TGWG Proposed Part 543 as of 7/28/2011

Page 11 of 35

(cf) Pull Tab Sales. 

(1) Pull tab sales must be controlled in a manner to adequately record, track, and 

reconcile all pull tab sales and voids.

(2) When pull tab sales are recorded manually, total sales are verified by an agent 

independent of the pull tab sales being verified. 

(3) No person shall have unrestricted access to pull tab sales records.

(dg) Winning Pull Tabs. 

(1) Redeemed pull tabs must be controlled in a manner to adequately record, track, and 

reconcile all pull tab payouts.

(2) The redeemed pull tabs shall be defaced so that they cannot be redeemed for payment 

again.

(eh) Cash or and Cash Equivalent Controls. Cash or and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.

§ 543.9 What are the minimum internal control standards for card games?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided during the card room operations by an agent(s) 

with authority equal to or greater than those being supervised.

(e) Inventory of Playing Cards. The playing card inventory must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls 

shall address tabs cards exchanged between two agents, increases and decreases to inventory, 

and inventory reconciliation.
New TGWG Proposed Part 543 as of 7/28/2011

Page 12 of 35

(f) Shill Funds. Issuance and return of shill funds shall be recorded and have the written approval 

of another agent.

(g) Cash or and Cash Equivalent Controls. Cash or and cash equivalents must be controlled in a 

manner designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such 

controls shall be in accordance with cash and cash equivalent controls established in sub part 

543.14.

(h) Posted Rules. The rules shall be displayed or available for patron review at the gaming 

operation, including rules governing contests, prize payouts, fees, etc. 

(i) Promotional Progressive Pots and Pools such as Contests, Tournaments, Drawings and 

Giveaway Programs. Funds contributed by patrons to prize pools shall be returned and 

documented in accordance with the posted rules.

(1) Promotional pool contributions shall be controlled in a manner to properly distinguish 

between gaming revenue and promotional pool contributions. 

(i) Promotional pool contributions shall be placed in a locked container;

(ii) Agents transporting the locked container shall be precluded from having 

access to the contents keys. 

(2) At least once a dayweek, increases and decreases to the promotional pool amount 

shall be verified, supported by documentation, recorded and reconciled to the cash by an 

agent independent of the card room.

§ 543.10 What are the minimum internal control standards for gaming promotions?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for gaming promotions as needed by an agent(s) 

with authority equal to or greater than those being supervised.
New TGWG Proposed Part 543 as of 7/28/2011

Page 13 of 35

(e) Gaming Promotions. Controls must be established in a manner designed to prevent 

unauthorized access, cheating, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following:

(1) Rules of the gaming promotion;

(2) Gaming promotion accounting; and 

(3) TGRA approval.

§ 543.11 What are the minimum internal control standards for patron deposit accounts 

and cashless systems?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Conflicts of Standards. If there are any inconsistencies between these regulations and external 

standards incorporated by this provision, such as Title 31 and Credit Card Act, such other 

applicable standards shall prevail.

(d) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented.

(e) Patron Deposit Accounts and Cashless Systems.

(1) Patron deposit accounts and cashless systems must be controlled in a manner 

designed to prevent unauthorized access, misappropriation, forgery, theft, or fraud. 

(2) All smart cards (i.e., cards that possess the means to electronically store or retrieve 

data) that maintain the only source of account data are prohibited.

(3) Patron deposit accounts may be unrestricted or restricted to a specific patron.

(4) Establishment of patron deposit accounts. The following standards apply when the 

patron establishes an account and optionally makes an initial deposit.

(i) For restricted patron deposit accounts:
New TGWG Proposed Part 543 as of 7/28/2011

Page 14 of 35

(A) The patron must appear at the gaming operation in person, at a 

designated area of accountability, and present a valid government issued 

picture identification credential. 

(B) An agent must examine the patron‟s identification and record, at a 

minimum, the following information:

(1) Type, number, and expiration date of the identification; 

(2) Patron‟s name; 

(3) A unique account identifier; 

(4) Date the account was opened; and 

(5) The agent‟s name. 

(C) The agent must require the patron to sign the account documentation 

before the account is activated.

(D) The agent or cashless system shall provide the patron deposit account 

holder with a secure method of access.

(ii) For unrestricted patron deposit accounts:

(A) The patron must be informed of the unrestricted nature of the account, 

and the fact that the account may be accessible to anyone with the account 

number.

(B) The patron must acknowledge and accept the risks associated with 

unrestricted accounts.

(5) Patron deposits, withdrawals and adjustments. 

(i) Prior to the patron making a deposit or a withdrawal from a patron deposit 

account, the agent or cashless system must verify the identity of the patron deposit 

account, the patron identity for restricted accounts, and availability of funds. 

Reliance on a secured personal identification number (PIN) entered by the patron 

is an acceptable method of verifying patron identity.

(ii) Adjustments made to the patron deposit accounts must be performed by an 

agent.

(iii) When a deposit, withdrawal or adjustment is processed by an agent, a multipart transaction record must be created containing the following information: 
New TGWG Proposed Part 543 as of 7/28/2011

Page 15 of 35

(A) Same document number on all copies;

(B) Type of transaction, (e.g., deposit, withdrawal, or adjustment);

(C) Name or other identifier of the patron for restricted patron deposit 

accounts;

(D) The unique account identifier;

(E) Patron signature for withdrawals, unless a secured method of access is 

utilized;

(F) Date and time of transaction;

(G) Dollar amount of transaction;

(H) Nature of deposit, withdrawal, or adjustment (e.g., cash, check, chips); 

and

(I) Signature of the agent processing the transaction.

(iv) When a patron deposits or withdraws funds from a patron deposit account 

electronically, the following shall be recorded and reported:

(A) Date and time of transaction;

(B) Location (e.g., player interface, kiosk);

(C) Dollar amount of transaction; and

(D) The unique account identifier.

(v) Detailed patron deposit account transaction records must be available to the 

patron upon reasonable request.

(vi) If electronic funds transfers are made to or from a gaming operation bank 

account for patron deposit account funds, the bank account must be dedicated and 

may not be used for any other types of transactions.

§ 543.12 [RESERVED]What are the minimum internal control standards for player 

tracking systems used in conjunction with Class II gaming?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each 

gaming operation shall establish, implement and adhere to internal control policies and 

procedures that provide at least the level of control established by the standards of this section.
New TGWG Proposed Part 543 as of 7/28/2011

Page 16 of 35

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Player Tracking Systems. Controls must be established in a manner designed to prevent 

unauthorized access, cheating, misappropriation, forgery, theft, or fraud when a player tracking 

system is used in conjunction with Class II gaming. Such controls must include, but not be 

limited to, the following:

(1) Operation of player tracking programs;

(2) Security of player tracking accounts; and

(3) Audit and accounting.

§ 543.13 [RESERVED]

§ 543.14 What are the minimum internal control standards for the cage, vault, cash and 

cash equivalents?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Provide supervision for cage, vault, and other operations using cash or cash 

equivalents as needed by an agent(s) with authority equal to or greater than those being 

supervised.

(de) Cash or and Cash Equivalent Controls. 

(1) Cash or and cash equivalents must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following actions:
New TGWG Proposed Part 543 as of 7/28/2011

Page 17 of 35

(i) Counting;

(ii) Recording increases and decreases to inventory;

(iii) Inventory reconciliation;

(iv) Issuance and redemption;

(v) Transfers;

(vvi) Inspecting, validating and verifying;

(vivii) Cancelations and voids;

(viiviii) Authorization; and

(viiiix) Document retention.

(ef) Check Cashing. Check cashing must be controlled in a manner designed to prevent 

unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must include, but 

not be limited to, the following:

(1) Acceptance of checks;

(2) Deposit of checks (Checks not deposited in the normal course of business are subject 

to § 543.15 Lines of Credit standards).

(3) Collecting and recording returned checks; 

(4) Re-deposit; and 

(5) Write-off authorization.

(6) If a third party check cashing or guarantee service is used, the examination and 

documentation procedures required by the service provider shall apply unless otherwise 

provided by Tribal tribal law or regulation. 

(fg) Cage and Vault Accountability. 

(1) Increases and decreases to cage inventory shall be verified, supported by 

documentation, and recorded. Unverified transfers of cash and/or cash equivalents are 

prohibited. 

(2) The cage and vault inventories (including coin rooms/vaults) shall be counted 

independently by at least two agents, attested to by signature, and recorded in ink or other 

permanent form at the end of each shift during which activity took place. 
New TGWG Proposed Part 543 as of 7/28/2011

Page 18 of 35

(gh) Chip(s) and Token(s). Controls must be established to ensure accountability of chip and 

token inventory. Such controls must include, but not be limited to, the following:

(1) Purchase;

(2) Receipt;

(3) Inventory;

(4) Storage; and 

(5) Destruction.

(hi) Cage and Vault Access. Controls must be established in a manner designed to prevent 

unauthorized access, misappropriation, forgery or fraud. Such controls must include, but not be 

limited to, the following:

(1) Physical access to the cage to cage department agents, designated staff, and other 

persons authorized; and

(2) Transportation of extraneous items (e.g., personal belongings, tool boxes, beverage 

containers, etc.) into and out of the cage.

§ 543.15 What are the minimum internal control standards for lines of credit?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computer Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Establishment of Lines of Credit Policy. 

(1) If a gaming operation extends lines of credit, controls must be established to 

safeguard the assets of the gaming operation. Such controls must include the 

establishment of a lines of credit policy including the following:

(i) A process for the patron to apply for, modify, and/or re-establish lines of 

credit, to include required documentation and credit line limit;
New TGWG Proposed Part 543 as of 7/28/2011

Page 19 of 35

(ii) Credit issuer authorization levels;

(iii) Identification of agents authorized to issue lines of credit;

(iv) A process for verifying lines of credit worthiness of applicants; 

(v) A system for recording patron information; to include:

(A) Name, current address, and signature;

(B) Identification credential;

(C) Authorized credit line limit; and

(D) Approval by an agent authorized to approve credit line limits;

(vi) A process for issuing lines of credit to include the following: 

(A) Notice to patron of lines of credit terms including patron written 

acknowledgment by signature;

(B) Completion of a uniquely identified, multi-part, lines of credit 

issuance form, such as a marker or counter check, which includes the 

terms of that lines of credit transaction;

(C) Signatory requirements;

(D) Determining the amount of the patron‟s available lines of credit;

(E) Creation and maintenance of current lines of credit balance record 

updated at the time of each transaction to assure that lines of credit issued 

is within the established limit and balance for that patron. 

(F) Requirement that the agent issuing the lines of credit must be 

independent of the agent who authorized the lines of credit.

(vii) A policy establishing credit line limit exceptions to include the following:

(A) Identification of the agent(s) authorized to permit a credit line limit to 

be exceeded; 

(B) Authorization thresholds; and

(C) Required documentation.
New TGWG Proposed Part 543 as of 7/28/2011

Page 20 of 35

(viii) A policy governing increases and decreases to a patron‟s lines of credit 

account balances to include the following:

(A) Documentation and record keeping requirements;

(B) Independence between the department that receives the payment and 

the department that maintains custody of the credit balance for payments 

made by mail; 

(C) Collections;

(D) Periodic audits and confirmation of balances; and

(E) If a collection agency is utilized, a process to ensure documentation of 

increases and decreases to the lines of credit account balances.

(ix) A policy governing write-offs and settlements to include:

(A) Identification of agent(s) authorized to approve write-offs and 

settlements;

(B) Authorization levels for write-offs and settlements of lines of credit 

instruments;

(C) Required documentation for write-offs and settlements;

(D) Independence between the agent who established the lines of credit 

and the agent writing off or settling the lines of credit instrument. 

(E) Necessary documentation for the approval of write-offs and 

settlements and transmittal to the appropriate department for recording and 

deductibility.

§ 543.16 What are the minimum internal control standards for security and management 

of server, server software and data associated with Class II gaming systems?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.
New TGWG Proposed Part 543 as of 7/28/2011

Page 21 of 35

(c) Class II Gaming systems and Physical Controls. Controls must be established to ensure:

(1) Control of physical and logical access to server, server software and data associated 

with Class II gaming systems, including accounting, voucher, cashless and player 

tracking, among others used in conjunction with Class II gaming;

(2) Physical and logical protection of storage media and its contents, including recovery 

procedures;

(3) Access credential control methods; 

(4) Record keeping and audit processes; and,

(5) Departmental independence, including, but not limited to, means to restrict agents that 

have access to server, server software and data from having access to financial 

instruments.

(d) Independence. All personnel having access to Class II gaming servers, server software 

and/or data are independent of and restricted from access to:

(1) Financial instruments (e.g. cash, cash equivalents, vouchers, and coupons);

(2) Signatory authority over financial instruments and payouts forms; and

(3) Accounting, audit, and ledger entries.

§ 543.17 What are the minimum internal control standards for complimentary services or 

items?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for approval of complimentary services as 

needed by an agent(s) with authority equal to or greater than those being supervised.
New TGWG Proposed Part 543 as of 7/28/2011

Page 22 of 35

(de) Complimentary Services and or Items. Controls must be established in a manner designed to 

prevent unauthorized access, misappropriation, forgery, theft, or fraud. Such controls must 

include, but not be limited to, the following:

(1) How the gaming operation delegates to its personnel the authority to approve the 

issuance of complimentary services and or items, including levels of authorization for the 

agents approving the issuance of complimentary services and or items;

(2) Written limits and conditions on the approval and issuance of complimentary services 

or items, and how the conditions or limits of authority may be modified, ;

(3) Documentation and recordation requirements for the authorization, issuance, and 

tracking of complimentary services and or items, including cash and non-cash gifts; 

(i) Complimentary issuance records shall include the following for all 

complimentary items and services equal to or exceeding an amount established by 

the TGRA.

(A) Name of patron who received the complimentary service or item;

(B) Name(s) of issuer of the complimentary service or item;

(C) The actual cash value of the complimentary service or item;

(D) The type of complimentary service or item (i.e., food, beverage, etc.); 

and

(E) Date the complimentary service or item was issued.

(ii) Reserved.

§ 543.18 How does a gaming operation apply for a variance from the standards of this 

part?

(a) Variance.

(1) Should a TGRA grant a variance to any provision of these MICS, the TGRA shall 

deliver a notice of the same to the Commission within ten (10) days of such approval.

(i) The notice shall contain a complete copy of the information presented to the 

TGRA and the variance as granted.

(ii) The notice shall be forwarded to the Commission within ten (10) days of the 

granting of the Variance.
New TGWG Proposed Part 543 as of 7/28/2011

Page 23 of 35

(2) During a thirty (30) day period when the Commission first receives the notice 

required by this subpart, the Chairman may request additional information from the 

TGRA concerning the subject of variance. Such request shall suspend the thirty (30) day 

period until the Chairman receives the TGRA response.

(b) Commission Review.

(1) Within the thirty (30) day review period, the Commission may:

(i) Advise the TGRA, in writing, that it has no objection.

(ii) Provide the TGRA a written statement itemizing its objections. 

(iii) Take no action, in which case, the TGRA‟s variance shall be final. 

(2) If the Commission has provided the TGRA a statement itemizing objections to the 

variance: 

(i) The TGRA shall reconsider the variance taking into account the objections 

itemized by the Commission.

(ii) The TGRA may seek reconsideration by submitting a request to the Chairman 

and members of the Commission.

(iii) Upon receipt of a request for reconsideration, the Commission shall conduct 

an informal hearing with the TGRA within 30 days, which may be conducted in 

person or through the exchange of documents, as requested by the TGRA.

(iv) After the informal hearing, the Commission must issue a written decision 

within 14 days. If the Commission disapproves the variance, such written decision 

must include an explanation of why the requested variance creates an imminent 

threat to the integrity of the tribal gaming operation.

§ 543. 19 What are the minimum internal control standards for audit and accounting?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.
New TGWG Proposed Part 543 as of 7/28/2011

Page 24 of 35

(c) Conflicts of Standards. When establishing SICS the gaming operation should review and 

consider incorporation of other external standards such as GAAP, SSAE, and standards 

promulgated by GASB and FASB. Accordingly, in the event of a conflictIf there are any 

inconsistencies between the MICS and the these regulations and external standards incorporated

external standards, by this provision, such as GASB, GAAP, FASB, and SSAE, such other 

applicablethe external standards shall prevail. 

(d) Operational Audits (formerly “Revenue Audit”). Controls shall be established to ensure:

(1) All audits are designed in a manner to detect unauthorized access, misappropriation, 

forgery, theft, or fraud.

(2) All audits are performed within seven (7) days of the audited activity‟s occurrence as 

follows, unless otherwise specified:

(i) Gaming revenue and payouts;

(ii) Increases and decreases to inventory;

(iii) Cash equivalent inventory count;

(iv) Exceptions, overrides, and voids;

(v) Complimentary services and items records (Weekly);

(vi) Manual increases and decreases to/from player accounts (Weekly);

(vii) Promotions, contests, and tournaments (Weekly); and

(viii) Key control records (Quarterly).

(3) Minimum bankroll calculations are audited periodically to ensure that the gaming 

operation maintains cash in an amount sufficient to satisfy the gaming operation‟s 

obligations. 

(4) At least bi-annually, an inventory of all drop, count, override, and panel keys are 

performed and increases and decreases in key inventory are reconciled.

(5) Audit results are summarized and recorded. 

(6) Audit Controls are developed to accountcontrolled inventories for recording the 

receipt, issuance, and use of controlled inventories (including but not limited to bingo 

cards, pull tabs, playing cards, keys, pre-numbered and/or multi-part forms, etc.).
New TGWG Proposed Part 543 as of 7/28/2011

Page 25 of 35

(7) Adjustments to original data are controlled to ensure all adjustments are properly 

completed and documented. 

(8) Exceptions are reviewed for suspect and/or unusual transactions.

(9) Documentation must be generated and maintained evidencing the performance of 

audit procedures. 

(10) If the audit is not performed by accounting agents, the agent(s) performing the audit 

are independent of the agents who performed the transactions being reviewed.

(e) Accounting. Controls must be established to ensure each gaming operation:

(1) Prepares accurate, complete, legible, and permanent records of all transactions 

pertaining to gaming revenue.

(2) Prepares general accounting records on a double-entry system of accounting, 

maintaining detailed, supporting, subsidiary records, and perform the following: 

(i) Record gaming activity transactions in an accounting system to identify and 

track all revenues, expenses, assets, and liabilities;

(ii) Produce income and balance sheet statements;

(iii) Produce appropriate subsidiary ledgers to support the balance sheet;

(iv) Inventory and safeguard assets;

(v) Prepare, review, and maintain accurate financial statements;

(vi) Prepare minimum bankroll calculations; and

(vii) Maintain and preserve all financial books, records, and relevant supporting 

documentation.

(f) Internal Audit. Controls shall be established to ensure:

(1) Internal auditor(s) perform audits of each department of a gaming operation, at least 

annually, to review compliance with TICS, SICS, and these MICS, TICS, and SICS.

(2) Internal auditor(s) are independent of the gaming operations with respect to the 

departments subject to audit (auditors internal to the operation, officers of the TGRA, or 

outside CPA firm may perform this function).
New TGWG Proposed Part 543 as of 7/28/2011

Page 26 of 35

(3) Internal auditors report directly to the Tribe, TGRA, audit committee, or other entity 

designated by the Tribe.

(4) Documentation (e.g., checklists, programs, reports, etc.) is prepared to evidence all 

internal audit work and follow-up performed as it relates to compliance with TICS, SICS, 

and these MICS, TICS, and SICS.

(5) Reports documenting audits performed are maintained and made available to the 

Commission upon request.

(6) All material exceptions resulting from internal audit work are investigated and 

resolved with the results documented.

(7) Internal audit findings are reported to management, responded to by management in 

the internal audit report stating corrective measures to be taken, and delivered to 

management, the Tribe, TGRA, audit committee, or other entity designated by the Tribe.

(g) Annual Audits.

(1) Agreed upon procedures. A CPA must be engaged to perform, in accordance with 

agreed upon procedures and the most recent versions of the Statements on Standards for 

Attestation Engagements and Agreed-Upon Procedures Engagements (collectively 

„„SSAE‟s‟‟), issued by the American Institute of Certified Public Accountants Inc., an 

assessment of whether the gaming operation is in compliance with these MICS, the TICS, 

and/or the SICS.

(2) The tribe must submit two copies of the agreed-upon procedures report to the 

Commission within 120 days of the gaming operation‟s fiscal year end in conjunction 

with the submission of the annual financial audit report required under 25 CFR Part 571.

(3) Require management to have sufficient knowledge and understanding of the purpose, 

nature, and scope of the agreed upon procedures to provide adequate oversight and 

participation in the process to ensure a meaningful and useful outcome.

(4) Reliance on Internal Audit. 

(i) Agreed upon procedures are to be performed by the CPA to determine that the 

internal audit procedures performed during the fiscal year have been properly 

completed. 

(ii) The CPA may rely on the work of internal audit for the completion of the 

MICS checklists as they relate to the standards covered by this Part.
New TGWG Proposed Part 543 as of 7/28/2011

Page 27 of 35

(5) Report Format. The Statements on Standards for Attestation Engagements and 

Agreed-Upon Procedure Engagements (SSAE‟s) are applicable to agreed agreed-upon 

procedures engagements required in this Part. All noted instances of noncompliance must 

be documented in the report with a narrative description, the number of exceptions and 

sample size tested.

§ 543.20 [RESERVED]

§ 543.21 What are the minimum internal control standards for drop and count?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Variances. The TGRA shall establish the threshold level at which a variance shall be 

reviewed. Any such review shall be documented. 

(d) Supervision. Supervision shall be provided for drop and count as needed by an agent(s) with 

authority equal to or greater than those being supervised.

(de) Count Room Access. Controls must be established to limit physical access to the count room 

to count team agents, designated staff, and other authorized persons. Such controls must include, 

but not be limited to, the following:

(1) Count team agents shall not be allowed to exit or enter the count room during the 

count except for emergencies or scheduled breaks.

(2) Surveillance shall be notified whenever count room agents exit or enter the count 

room during the count.

(3) The count team policy, at a minimum, shall address the transportation of extraneous 

items (e.g., personal belongings, tool boxes, beverage containers, etc.) into or out of the 

count room.

(ef) Count team. Controls must be established in a manner designed to ensure security of the 

count and the count room to prevent unauthorized access, misappropriation of funds, forgery, 

theft, and or fraud. Such controls must include, but not be limited to, the following:
New TGWG Proposed Part 543 as of 7/28/2011

Page 28 of 35

(1) For Tier A and B operations, all counts shall be performed by a minimum of two (2) 

agents. For Tier C operations, all counts shall be performed by a minimum of three (3) 

agents.

(2) For Tier A and B operations, at no time during the count shall there be fewer than two 

(2) count team agents in the count room until the drop proceeds have been accepted into 

cage/vault accountability. For Tier C operations, at no time during the count shall there 

be fewer than three (3) count team agents in the count room until the drop proceeds have 

been accepted into cage/vault accountability.

(3) For Tier A and B operations, count team agents shall be rotated on a routine basis 

such that the count team is not consistently the same two (2) agents more than four (4) 

days per week. This standard shall not apply to gaming operations that utilize a count 

team of more than two (2) agents. For Tier C operations, count team agents shall be 

rotated on a routine basis such that the count team is not consistently the same three (3) 

agents more than four (4) days per week. This standard shall not apply to gaming 

operations that utilize a count team of more than three (3) agents.

(4) Functions performed by count team agents shall be rotated on a routine basis.

(5) For Tier A and B operations, if the count is not viewed live, the operation must 

establish controls to ensure a review of the recording within seven (7) days by an agent 

independent of the count operation and the count being reviewed. For Tier C operations, 

the count shall be viewed live.

(65) Count team agents shall be independent of the department being counted and the 

cage/vault departments. An accounting agent may be used if there is an independent audit 

of all count documentation.

(fg) Drop. Controls must be established in a manner designed to ensure security of the drop 

process to prevent unauthorized access to gaming equipment and the drop, misappropriation of 

funds, forgery, theft, and or fraud. Such controls must include, but not be limited to, the 

following:

(1) Drop schedules and periods, including procedure to continue drop once started 

through completion.

(2) Security during transport of drop boxes, including escort by a minimum of two (2) 

agents, at least one of whom is independent of the revenue being dropped.

(3) All drop boxes shall be uniquely identified to correspond with the card table, player 

interface, and/or other location from which the drop box was removed.
New TGWG Proposed Part 543 as of 7/28/2011

Page 29 of 35

(4) Security over drop boxes removed and awaiting transport to the count room.

(5) Security of drop boxes until the count takes place.

(6) Notification to surveillance when a drop is to begin.

(7) Provisions for emergency drop. 

(gh) Count. Controls must be established in a manner designed to ensure security of the count 

process to prevent unauthorized access to count equipment and the drop, misappropriation of 

funds, improper manipulation of financial records, forgery, theft, and or fraud. Such controls 

must include, but not be limited to, the following:

(1) Establishment of a dedicated count room;

(2) Manual count process;

(3) Utilization, testing, and calibration of counters and/or validation systems; 

(4) Verification of count;

(5) Prevention of the comingling of funds until recorded per drop box; 

(6) Accurate and permanent forms of recordation for all cash and cash equivalents and 

rejected cash or cash equivalents;

(7) For card game counts, additional controls, as applicable, shall be established and 

procedures implemented to ensure:

(i) Fills/credits, Pit Marker marker Issueissue/Payment payment Slips slips are 

recorded and forwarded to the appropriate department for verification and 

reconciliation. 

(ii) Opening/closing card table inventory forms are examined and traced to or 

recorded on the appropriate documentation with discrepancies investigated and 

results documented.

(8) The reconciliation of count records to the total drop, which shall address, but not be 

limited to:

(i) Signature of each agent of the count team attesting to their participation in the 

count;

(ii) Reconciliation of the total drop by a count team agent who shall not function 

as the sole recorder; and 
New TGWG Proposed Part 543 as of 7/28/2011

Page 30 of 35

(iii) Documentation of all unresolved variances.

(9) Transfer of the drop following the count.

(10) All cash and cash equivalent inventory stored in the count room shall be secured 

from unauthorized access at all times.

(11) Access to stored drop boxes, full or empty.

(hi) Controlled keys or equivalents. Controls shall be established and procedures implemented to 

safeguard the use, access, and security of keys or other access methods in accordance with the 

following:

(1) Each of the following requires a separate and unique key lock or alternative secure 

access method:

(i) Drop cabinet;

(ii) Drop box release;

(iii) Drop box content; and

(iv) Storage racks and carts.

(2) Access to and return of keys or equivalents shall be manually or electronically 

documented with the date, time, and signature or other unique identifier of the agent 

accessing or returning the key(s).

(i) For Tier A and B operations, at least two (2) drop team agents are required to 

be present to access and return keys. For Tier C operations, at least three (3) drop 

team agents are required to be present to access and return keys. 

(ii) For Tier A and B operations, at least two (2) count team agents are required to 

be present at the time count room and other count keys are issued for the count. 

For Tier C operations, at least three (two for card game drop box keys in 

operations with three tables or fewer) count team agents are required to be present 

at the time count room and other count keys are issued for the count.

(iii3) Where an alternative access method is utilized, the use of such method shall be 

controlled in a manner consistent with the objectives of this standard.

(34) Documentation of all keys, including duplicates, shall be maintained including:

(i) Unique identifier for each individual key;
New TGWG Proposed Part 543 as of 7/28/2011

Page 31 of 35

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(45) Custody of all keys involved in the drop and count shall be maintained by a 

department independent of the count and drop agents and those departments being 

dropped and counted.

(56) Other than the count team, no agent shall have access to the drop box content keys 

while in possession of storage rack keys and/or release keys.

(67) Other than the count team, only agents authorized to remove drop boxes are allowed 

access to drop box release keys. 

(78) Utilization of keys at times other than the scheduled drop and count is must be

properly authorized and documented. 

(89) Emergency manual keys (a.k.ai.e., Override override Keykey) for computerized, 

electronic, and alternative key systems.

§ 543.22 [RESERVED]

§ 543.23 What are the minimum internal control standards for surveillance?

(a) Internal Control Procedures. Subject to the approval and oversight of the TGRA, each gaming 

operation shall establish, implement and adhere to internal control policies and procedures that 

provide at least the level of control established by the standards of this section.

(b) Computerized Applications. For any computer applications utilized, alternate documentation 

and/or procedures that provide at least the level of control established by the standards of this 

section, as approved in writing by the TGRA, will be acceptable.

(c) Surveillance Equipment and Control Room(s). Controls must be established in a manner 

designed to prevent unauthorized access and/or activities, cheating, misappropriation, forgery, 

theft, or fraud. Such controls must include, but not be limited to, the following:

(1) For Tier A, the surveillance system shall be maintained and operated from a secured 

location, such as a locked cabinet. For Tier B and C, the surveillance system shall be 

maintained and operated from a staffed surveillance operation room(s).

(2) The surveillance operation room(s) shall be secured to prevent unauthorized entry.
New TGWG Proposed Part 543 as of 7/28/2011

Page 32 of 35

(3) Access to the surveillance operation room(s) shall be limited to surveillance agents, 

designated staff, and other persons authorized.

(4) Surveillance operation room(s) access logs shall be maintained.

(5) Surveillance operation room equipment shall have total override capability over all 

other satellite surveillance equipment located outside the surveillance operation room.

(6) Power loss to the surveillance system.

(i) For Tier A, in the event of power loss to the surveillance system, immediate 

alternative security measures, such as additional supervisory or security agents, 

shall be provided. 

(ii) For Tier B and C, in the event of power loss to the surveillance system, an 

auxiliary or backup power source shall be available and capable of providing 

immediate restoration of power to all elements of the surveillance system that 

enable surveillance agents to observe all areas covered by dedicated cameras.

(7) The surveillance system shall record an accurate date and time stamp on recorded 

events. The displayed date and time shall not significantly obstruct the recorded view.

(8) All surveillance agents shall be trained in the use of the equipment, and be 

knowledgeable of the games and house rules.

(9) Each camera required by the standards in this section shall be installed in a manner 

that will prevent it from being readily obstructed, tampered with, or disabled. 

(10) The surveillance system shall:

(i) Have the capability to display all camera views on a monitor;

(ii) Include sufficient numbers of recording devices to record the views of all 

cameras required by this section; 

(iii) Record all camera views; and

(iv) For Tier B and C only, include sufficient numbers of monitors to 

simultaneously display gaming and count room activities.

(11) A periodic check of the surveillance systems shall be conducted. When a 

malfunction of the surveillance system is discovered, the malfunction and necessary 

repairs shall be documented and repairs initiated within seventy-two (72) hours.
New TGWG Proposed Part 543 as of 7/28/2011

Page 33 of 35

(i) If a dedicated camera malfunctions, immediate alternative security measures, 

such as additional supervisory or security agents, shall be provided. 

(ii) The TGRA shall be notified of any surveillance system and/or camera(s) that 

have malfunctioned for more than twenty-four (24) hours and the alternative 

security measures being provided. 

(d) Additional Surveillance Requirements. With regard to the following functions, the additional 

specified requirements controls shall be implemented:

(1) Bingo.

(i) For manual draws, the surveillance system shall monitor the bingo ball 

drawing device or mechanical random number generator, which shall be recorded 

during the course of the draw by a dedicated camera to identify the balls numbers 

or other designations drawn or numbers selected.

(ii) The surveillance system shall monitor and record the activities of the bingo 

game, including drawing, calling, and entering, and the balls, numbers or other 

designations drawn or selected.

(2) Card games.

(i) Except for card game tournaments, a dedicated camera(s) shall be used to 

provide:

(A) An overview of the activities on each card table surface, including 

card faces and cash and/or cash equivalents;

(B) An overview of card game activities, including patrons and dealers; 

and

(C) An unobstructed view of all posted progressive pool amounts. 

(ii) For card game tournaments, a dedicated camera(s) shall be used to provide an 

overview of tournament activities, including entrances/exits and any area where 

cash or cash equivalents are exchanged.

(3) Prize payoutsWinning Events. The TGRA shall establish standards for surveillance 

camera coverage of payouts prize winning events. Dedicated camera coverage is required 

when the progressive base value or prize amountin excess ofexceeds $3,000,000.00 for 

fixed prize payouts or progressive reset values. Such Recorded camera coverage shall 
New TGWG Proposed Part 543 as of 7/28/2011

Page 34 of 35

include the activities of patrons and agents at the time and location of the prize winning 

event.

(4) Cash and Cash Equivalents.

(i) The surveillance system shall monitor and record: 

(A) An view of the patron, cage agent, vault agent or count team agent(s) 

and the surrounding area and counting surface;

(B) Payouts of gaming winnings; 

(C) Entry and exit doors to and from the cage, vault and other secured 

count areas;

(D) All count equipment including but not limited to reject bins, weigh 

scales, wrapping machines, currency and coin counters, and chips sorters;

(E) Any area where the manipulation of recorded data may occur;

(F) Drop and count while in process; for Tier A and B operations, if the 

count is not viewed live, the operation must establish controls to ensure a 

review of the recording within seven (7) days by an agent independent of 

the count operation and the count being reviewed. For Tier C operations, 

the count shall be viewed live.

(G) All drop boxes and storage racks by either a dedicated camera or a 

motion-detector activated camera.

(ii) During the count process a dedicated overhead camera(s) or motion-detector 

activated camera(s) must cover the:

(A) Transaction area with the ability to identify cash and cash equivalent 

values;

(B) All counting surfaces used during the count; and 

(C) All drop boxes and their storage racks.

(e) Recording Retention. Controls must be established that include, but are not limited to, the 

following:

(1) All recordings required by this section shall be retained for a minimum of seven (7) 

days; and
New TGWG Proposed Part 543 as of 7/28/2011

Page 35 of 35

(2) Suspected or confirmed gaming crimes, unlawful or suspicious activity, or detentions 

by security personnel discovered within the initial retention period shall be copied and 

retained for a time period, not less than one (1) year.

(f) Logs. Logs must be maintained and demonstrate the following:

(1) Compliance with the storage, identification, and retention standards required in this 

section;

(2) Each malfunction and repair of the surveillance system as defined in this section; and

(3) Activities performed by surveillance agents.
APPENDIX 

2
1

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

1

PART 547 --– MINIMUM TECHNICAL STANDARDS FOR GAMING EQUIPMENT USED 

WITH THE PLAY OF CLASS II GAMES.

Sec. 

547.1 547.1 What is the purpose of this part?

547.2 547.2 How do these regulations affect state jurisdiction?

547.3 547.3 What are the definitions for this part?

547.4 547.4 How does a tribal government, tribal gaming regulatory authorityTGRA, or tribal gaming 

operation comply with this part?

547.5 547.5 What are the rules of interpretation and of general application for this part?

547.6 547.6 What are the minimum technical standards for enrolling and enabling Class II gaming 

system components?

547.7 547.7 What are the minimum technical hardware standards applicable to Class II gaming 

systems?

547.8 547.8 What are the minimum technical software standards applicable to Class II gaming 

systems?

547.9 547.9 What are the minimum technical standards for Class II gaming system accounting 

functions? 

547.10 547.10 What are the minimum standards for Class II gaming system critical events?

547.11 547.11 What are the minimum technical standards for money and credit handling?

547.12 547.12 What are the minimum technical standards for downloading on a Class II gaming 

system?

547.13 547.13 What are the minimum technical standards for program storage media?

547.14 547.14 What are the minimum technical standards for electronic random number generation? 

547.15 547.15 What are the minimum technical standards for electronic data communications between 

system components? 

547.16 547.16 What are the minimum standards for game artwork, glass, and rules? 

547.17 547.17 How does a tribal gaming regulatory authority apply forTGRA grant a variance from 

these standards?

Authority: 25 U.S.C. 2706(b). 

§ 547.1 What is the purpose of this part? 

The Indian Gaming Regulatory Act, 25 U.S.C. 2703(7)(A)(i), permits the use of electronic, 

computer, or other technologic aids in connection with the play of Class II games. This part establishes 

the minimum technical standards governing the use of such aids. 

§ 547.2 How do these regulations affect state jurisdiction? 

Nothing in this part shall be construed to grant to a state jurisdiction over Class II gaming or to 

extend a state’s jurisdiction over Class III gaming. 

§ 547.3 What are the definitions for this part? 
2

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

2

For the purposes of this part, the following definitions apply: 

Account AccessComponent,access component. A component within a Class II gaming system that 

reads or recognizes account access media and gives a patron the ability to interact with his or heran

account. 

Account AccessMedium,access medium. A magnetic stripe card or any other medium inserted into, 

or otherwise made to interact with, an account access component in order to give a patron the ability to 

interact with an account. 

Audit Mode,mode. The mode where it is possible to view Class II gaming system accounting 

functions, statistics, etc. and perform non-player-related functions. 

Agent, An employee or other. A person authorized by the gaming operation, as approved by the 

tribal gaming regulatory authority, designated for certainTGRA, to make decisions, tasks andor

actions inon the behalf of the gaming operation. This definition permits the use of computer 

applications to perform the function(s) of an agent.

Cancel Credit,credit. An action initiated by the Class II gaming system where some or all of a 

player’s credits are removed by an attendant and paid to the player. 

Cashless System,system. A system that performs cashless transactions and maintains records of 

those cashless transactions. 

Cashless Transaction,transaction. A movement of funds electronically from one component to 

another, often to or from a patron deposit account., or promotional account.

CD-ROM,. Compact Disc – Read Only Memory. 

Chairman,. The Chairman of the National Indian Gaming Commission. 

Class II Game, The same as “classgame. Class II gaming” in shall have the same meaning as 

defined in 25 U.S.C. 2703(7)(A).
3

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

3

Class II GamingSystem,gaming system. All components, whether or not technologic aids in 

electronic, computer, mechanical, or other technologic form, that function together to aid the play of 

one or more Class II games, including accounting functions mandated by these regulations. 

Commission,. The National Indian Gaming Commission established by the Indian Gaming 

Regulatory Act, 25 U.S.C. 2701 et seq. 

Coupon,. A financial instrument of fixed wagering value, usually paper, that can only be used to 

acquire non-cashable credits through interaction with a voucher system. This does not include 

instruments such as printed advertising material that cannot be validated directly by a voucher system. 

Critical Memory,memory. Memory locations storing data essential to the functionality of the Class 

II gaming system. 

DLL,. A Dynamic-Link Library file. 

Download Package,package. Approved data sent to a component of a Class II gaming system for 

such purposes as changing the component software. 

DVD,. Digital Video Disk or Digital Versatile Disk. 

ElectromagneticInterference, The physical characteristic of an electronic component to emit

electronic noise either into free air, onto the power lines, or onto communication cables.

(Remark: Definition not used in this proposed draft.)

Electrostatic Discharge. A single-event, rapid transfer of electrostatic charge between two 

objects, usually resulting when two objects at different potentials come into direct contact with

each other. 

EPROM,. Erasable Programmable Read Only Memory – a storage area that may be filled with data 

and information, that once written is not modifiable, and that is retained even if there is no power 

applied to the machine. 

Fault,. An event that when detected by a Class II gaming system causes a discontinuance of game 

play or other component functions. 
4

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

4

Financial Instrument,instrument. Any tangible item of value tendered in Class II game play, 

including, but not limited to, bills, coins, vouchers and coupons. 

Financial InstrumentAcceptor,instrument acceptor. Any component that accepts financial 

instruments, such as a bill validator. 

(Remark: Added clarity when referring to proposed TGWG draft Part 543.)

Financial InstrumentDispenser,instrument dispenser. Any component that dispenses financial 

instruments, such as a ticket printer. 

(Remark: Added clarity when referring to proposed TGWG draft Part 543.)

Financial InstrumentStorageComponent,instrument storage component. Any component that 

stores financial instruments., such as a drop box.

(Remark: Added clarity when referring to proposed TGWG draft Part 543.)

Flash Memory,memory. Non-volatile memory that retains its data when the power is turned off and 

that can be electronically erased and reprogrammed without being removed from the circuit board. 

Game Software,software. The operational program or programs that govern the play, display of 

results, and/or awarding of prizes or credits for Class II games. 

Gaming Equipment,equipment. All electronic, electro-mechanical, mechanical, or other physical 

components utilized in the play of Class II games. 

Hardware,. Gaming equipment. 

Interruption,. Any form of mis-operation, component failure, or interference to the Class II gaming 

equipment. 

Modification,. A revision to any hardware or software used in a Class II gaming system. 

Non-cashable Credit,credit. Credits given by an operator to a patron; placed on an Class II gaming 

system through a coupon, cashless transaction or other approved means; and capable of activating play 

but not being converted to cash. 

Patron. A person who is a customer or guest of the gaming operation and may interact with a 
5

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

5

Class II game. Also may be referred to as a “player”.

Patron DepositAccount,deposit account. An account maintained on behalf of a patron, for the 

purpose of depositing and withdrawing cashable funds for the primary purpose of interacting with a 

gaming activity. 

Player Interface,interface. Any component or components of a Class II gaming system, including 

an electronic or technologic aid (not limited to terminals, player stations, handhelds, fixed units, etc.), 

that directly enables player interaction in a Class II game. 

Prize Schedule,schedule. The set of prizes available to players for achieving pre-designated 

patterns in the Class II game. 

Program StorageMedia,storage media. An electronic data storage component, such as a CD-ROM, 

EPROM, hard disk, or flash memory on which software is stored and from which software is read. 

Progressive Prize,prize. A prize that increases by a selectable or predefined amount based on play 

of a Class II game. 

Random NumberGeneratornumber generator (RNG),. A software module, hardware component or 

combination of these designed to produce outputs that are effectively random. 

Reflexive Software,software. Any software that has the ability to manipulate and/or replace a 

randomly generated outcome for the purpose of changing the results of a Class II game or deprives a 

player of a prize to which the player is otherwise entitled based on the random outcome of the game.

(Remark: The added language makes this definition more consistent with the industry 

understanding of reflexive technology. The proposed language operates to clearly identify the 

harm the provision is intended to prevent.)

Removable/RewritableStorageMedia,/rewritable storage media. Program or data storage 

components that can be removed from gaming equipment and be written to, or rewritten by, the gaming 

equipment or by other equipment designed for that purpose. 
6

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

6

Server,. A computer that controls one or more applications or environments within a Class II 

gaming system. 

Test/DiagnosticsMode,diagnostics mode. A mode on a component that allows various tests to be 

performed on the Class II gaming system hardware and software. 

Testing Laboratory,laboratory. An organization recognized by a tribal gaming regulatory

authorityTGRA pursuant to § 547.4(f). 

TGRA. Tribal GamingRegulatoryAuthority. The gaming regulatory authority, which is the entity 

authorized by tribal law to regulate gaming conducted pursuant to the Indian Gaming Regulatory Act. 

Voucher,. A financial instrument of fixed wagering value, usually paper, that can only be used to 

acquire an equivalent value of cashable credits or cash through interaction with a voucher system. 

Voucher System,system. A component of the Class II gaming system or an external system that 

securely maintains records of vouchers and coupons; validates payment of vouchers; records successful 

or failed payments of vouchers and coupons; and controls the purging of expired vouchers and coupons. 

§ 547.4 How does a tribal government, tribalgamingregulatoryauthorityTGRA, or tribal gaming 

operation comply with this part? 

(a) (a) Limited immediate compliance. A tribal gaming regulatory authorityTGRA shall: 

(1) Require that all Class II gaming system software that affects the play of the Class II game

and were in operation prior to November 10, 2008 be submitted, together with the signature 

verification required by § 547.8(f), to a testing laboratory recognized pursuant to paragraph (f) of this 

section within 120 days after November 10, 2008.

(Remark: Submission under this provision was restricted to TGRAs and only provided for games in 

active operation on the effective date. Accordingly, manufacturers who may have had inactive 

games that would otherwise qualify for grandfather status would not have been able to qualify such 

games for grandfather status. To ensure that tribes are able to take advantage of all Class II systems 
7

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

7

eligible for grandfather status, we propose the foregoing revision to this sub-section. We further 

note that any concerns with system integrity are addressed by the non-waive able provision 

governing the integrity of the grandfathered systems set forth in subpart 547.4.)

(2) (2) Require that the testing laboratory test the submission to the standards established by § 

547.8(b), § 547.8(f), § 547.14, the minimum probability standards of § 547.5(c), and to any additional 

technical standards adopted by the tribal gaming regulatory authority;TGRA; 

(Remark: Minimal probability standards are not applicable to Bingo.)

(3) (3) Require that the testing laboratory provide the tribal gaming regulatory authorityTGRA with a 

formal written report setting forth and certifying to the findings and conclusions of the test; 

(i) The testing laboratory’s written report shall note the submission of any other compliance with 

applicable federal laws or regulations.

(Remark: Given that other federal agencies are responsible for establishing and enforcing electrical 

product safety standards, the NIGC lack’s jurisdiction over this subject matter. However, this section 

was added to clarify that it is industry standard for the laboratories to make note or include other 

laboratory certifications as provided by the manufacturer in their report.)

(4) (4) Make a finding, in the form of a certificate provided to the supplier or manufacturer of the 

Class II gaming system, that the Class II gaming system qualifies for grandfather status under the 

provisions of this section, but only upon receipt of a testing laboratory’s report that the Class II gaming 

system is compliant with § 547.8(b), § 547.8(f), the minimum probability standards of § 547.5(c), § 

547.14, and any other technical standards adopted by the tribal gaming regulatory authorityTGRA. If 

the tribal gaming regulatory authorityTGRA does not issue the certificate, or if the testing laboratory 

finds that the Class II gaming system is not compliant with § 547.8(b), § 547.8(f), the minimum

probability standards of § 547.5(c), § 547.14, or any other technical standards adopted by the tribal 

gaming regulatory authorityTGRA, then the gaming system shall immediately be removed from play 

and not be utilized. (See previous remark regarding minimal probability.)
8

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

8

(5) (5) Retain a copy of any testing laboratory's report so long as the Class II gaming system that is the 

subject of the report remains available to the public for play; 

(6) (6) Retain a copy of any certificate of grandfather status so long as the Class II gaming system that 

is the subject of the certificate remains available to the public for play; and 

(7) (7) Require the supplier of any player interface to designate with a permanently affixed label each 

player interface with an identifying number and the date of manufacture or a statement that the date of 

manufacture was on or before the effective date of this part. The tribal gaming regulatory

authorityTGRA shall also require the supplier to provide a written declaration or affidavit affirming 

that the date of manufacture was on or before on or before November 10, 2008. 

(b) (b) Grandfather provisions. All Class II gaming systems manufactured or placed in a tribal facility 

on or before the effective date of this part and certified pursuant to paragraph (a) of this section are 

grandfathered Class II gaming systems for which the following provisions apply: 

(1) Grandfathered Class II gaming systems may continue in operation for a period of five

years from November 10, 2008.

(Remark: The proposed strike out is intended to rectify the economically burdensome and unfair 

effect of the rule as promulgated. In the first place, the rule as promulgated is unduly restrictive

and given that its promulgation was not supported by relevant and credible data, it is arbitrary and 

capricious as well. Operation of grandfathered Class II gaming systems under the existing 

grandfather provision demonstrate no reason to suggest retention any time restrictions on usage of 

the grandfathered Class II gaming systems. Additionally, any concerns with system integrity are 

addressed by the non-waive able provision governing the integrity of the grandfathered systems set 

forth in subpart 547.4. Finally, any concerns with regard to product safety standards are within the 

jurisdiction of other agencies and therefore beyond the scope of NIGC jurisdiction.)

(2) (1) Grandfathered Class II gaming system shall be available for use at any tribal gaming facility 

subject to approval by the tribal gaming regulatory authorityTGRA, which shall transmit its notice of 
9

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

9

that approval, identifying the grandfathered Class II gaming system and its components, to the 

Commission. 

(3) (2) As permitted by the tribal gaming regulatory authorityTGRA, individual hardware or software 

components of a grandfathered Class II gaming system may be repaired or replaced to ensure proper 

functioning, security, or integrity of the grandfathered Class II gaming system. 

(4) (3) All modifications that affect the play of a grandfathered Class II gaming system must be 

approved pursuant to paragraph (c) of this section, except for the following: 

(i) Any software modifications that the tribal gaming regulatory authorityTGRA finds will 

maintain or advance the system's overall compliance with this part or any applicable provisions of parts

542 andpart 543 of this chapter, after receiving a new testing laboratory report that the modifications 

are compliant with the standards established by § 547.8(b), the minimum probability requirements of§ 

547.5(c), § 547.14, and any other standards adopted by the tribal gaming regulatory authority;TGRA;

(Remark: Reference to part 542 removed throughout the proposed draft part 547 because it is not 

applicable to minimal technical standards for gaming equipment used with the play of Class II games.)

(ii) Any hardware modifications that the tribal gaming regulatory authorityTGRA finds will 

maintain or advance the system’s overall compliance with this part or any applicable provisions of parts

542 andpart 543 of this chapter; and 

(iii) Any other modification to the software of a grandfathered Class II gaming system that the 

tribal gaming regulatory authorityTGRA finds will not detract from, compromise or prejudice: 

(A) (A) The proper functioning, security, or integrity of the Class II gaming system, and 

(B) The gaming system’s overall compliance with the requirements of this part or any applicable 

provisions of parts 542 andpart 543 of this chapter. 

(iv) No such modification may be implemented without the approval of the tribal gaming

regulatory authority TGRA. The tribal gaming regulatory authorityTGRA shall maintain a record of 

the modification so long as the Class II gaming system that is the subject of the modification remains 
1

0

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

10

available to the public for play and shall make the record available to the Commission upon request. 

The Commission will only make available for public review records or portions of records subject to 

release under the Freedom of Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; or 

the Indian Gaming Regulatory Act, 25 U.S.C. 2716(a). 

(c) (c) Submission, testing, and approval - generally. Except as provided in paragraphs (b) and (d) of 

this section, no tribal gaming regulatory authorityTGRA shall permit in a tribal gaming operation the 

use of any Class II gaming system, or any associated cashless system or voucher system or any 

modification thereto, unless: 

(1) (1) The Class II gaming system, cashless system, voucher payment system, or modification has 

been submitted to a testing laboratory; 

(2) The (2) A TGRA shall require a testing laboratory teststo test the submission to the standards 

established by:

(i) This part; 

(ii) Any applicable provisions of parts 542 andpart 543 of this chapter that are testable by the 

testing laboratory; and 

(iii) The tribal gaming regulatory authorityTGRA;

(3) (3) The testing laboratory provides a formal written report to the party making the submission, 

setting forth and certifying to its findings and conclusions; and 

(4)(i) (4)(i) Following receipt of the testing laboratory's report, the tribal gaming regulatory

authorityTGRA makes a finding that the Class II gaming system, cashless system, or voucher system 

conforms to the standards established by: 

(A) This part; 

(B) Any applicable provisions of parts 542 andpart 543 of this chapter that are testable by the 

testing laboratory; and 

(C) The tribal gaming regulatory authority TGRA. 
1

1

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

11

(ii) The tribal gaming regulatory authority TGRA shall retain a copy of the testing laboratory's report 

so long as the Class II gaming system, cashless system, voucher system, or modification thereto that is 

the subject of the report remains available to the public for play in its gaming operation. 

(d) (d) Emergency hardware and software modifications.

(1) A tribal gaming regulatory authorityTGRA, in its discretion, may permit modified hardware or 

software to be made available for play without prior laboratory testing or review if the modified 

hardware or software is: 

(i) Necessary to correct a problem affecting the fairness, security, or integrity of a game or 

accounting system or any cashless system, or voucher system; or 

(ii) Unrelated to game play, an accounting system, a cashless system, or a voucher system. 

(2) If a tribal gaming regulatory authorityTGRA authorizes new or modified software or hardware to 

be made available for play or use without prior testing laboratory review, the tribal gaming regulatory

authorityTGRA shall thereafter require the hardware or software manufacturer to: 

(i) Immediately advise other users of the same hardware or software of the importance and 

availability of the update; 

(ii) Immediately submit the new or modified hardware or software to a testing laboratory for 

testing and verification of compliance with this part and any applicable provisions of parts 542 andpart

543 of this chapter that are testable by the testing laboratory; and 

(iii) Immediately provide the tribal gaming regulatory authorityTGRA with a software signature 

verification tool meeting the requirements of § 547.8(f) for any new or modified software. 

(3) If a tribal gaming regulatory authorityTGRA authorizes a software or hardware modification under 

this paragraph, it shall maintain a record of the modification and a copy of the testing laboratory report 

so long as the Class II gaming system that is the subject of the modification remains available to the 

public for play and shall make the record available to the Commission upon request. The Commission 

will only make available for public review records or portions of records subject to release under the 
1

2

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

12

Freedom of Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 U.S.C. 552a; or the Indian 

Gaming Regulatory Act, 25 U.S.C. 2716(a). 

(e) Compliance by charitable gaming operations. This part shall not apply to charitable gaming 

operations, provided that: 

(1) The tribal government determines that the organization sponsoring the gaming operation is a 

charitable organization; 

(2) All proceeds of the charitable gaming operation are for the benefit of the charitable organization; 

(3) The tribal gaming regulatory authority TGRA permits the charitable organization to be exempt 

from this part; 

(4) The charitable gaming operation is operated wholly by the charitable organization’s employees or 

volunteers; and 

(5) The annual gross gaming revenue of the charitable gaming operation does not exceed $1,000,000. 

(f) Testing laboratories. (1) A testing laboratory may provide the examination, testing, evaluating and 

reporting functions required by this section provided that: 

(i) It demonstrates its integrity, independence and financial stability to the tribal gaming

regulatory authority.TGRA. 

(ii) It demonstrates its technical skill and capability to the tribal gaming regulatory

authority.TGRA. 

(iii) ItIf the testing laboratory is not owned or operated by the same tribe or tribal gaming 

regulatory authoritytribe the testing laboratory must be independent from the manufacturer and

gaming operator for whom it is providing the testing, evaluating, and reporting functions required by 

this section.

(Remark: The existing rule improperly restricts tribes from owning or operating test laboratories. The 

proposed revision corrects this problem, while at the same time ensuring independence and the 

appropriate segregation of function.)
1

3

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

13

(iv) The tribal gaming regulatory authorityTGRA:

(A) Makes a suitability determination of the testing laboratory based upon standards no less 

stringent than those set out in §§ 533.6(b)(1)(ii) through (v) of this chapter and based upon no less 

information than that required by § 537.1 of this chapter, or 

(B) Accepts, in its discretion, a determination of suitability for the testing laboratory made by any other 

gaming regulatory authority in the United States. 

(v) After reviewing the suitability determination and the information provided by the testing laboratory, 

the tribal gaming regulatory authorityTGRA determines that the testing laboratory is qualified to test 

and evaluate Class II gaming systems. 

(2) The tribal gaming regulatory authority TGRA shall: 

(i) Maintain a record of all determinations made pursuant to paragraphs (f)(1)(iv) and (f)(1)(v) of 

this section for a minimum of three years and shall make the records available to the Commission upon 

request. The Commission will only make available for public review records or portions of records 

subject to release under the Freedom of Information Act, 5 U.S.C. 552; the Privacy Act of 1974, 5 

U.S.C. 552a; or the Indian Gaming Regulatory Act, 25 U.S.C. 2716(a). 

(ii) Place the testing laboratory under a continuing obligation to notify it of any adverse regulatory 

action in any jurisdiction where the testing laboratory conducts business. 

(iii) Require the testing laboratory to provide notice of any material changes to the information 

provided to the tribal gaming regulatory authority.TGRA. 

§ 547.5 What are the rules of interpretation and of general application for this part? 

(a) (a) Minimum standards. A tribal gaming regulatory authorityTGRA may establish and implement 

additional technical standards that are as stringent as, or more stringent than, those set out in this part. 

(b) (b) Only applicable standards apply. Gaming equipment and software used with Class II gaming 

systems shall meet all applicable requirements of this part. For example, if a Class II gaming system 

lacks the ability to print or accept vouchers, then any standards that govern vouchers do not apply. 
1

4

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

14

(c) (c) Fairness. No Class II gaming system shall cheat or mislead users. All prizes advertised shall be 

available to win during the game. No progressive prize shall have a probability of winning less than

1 in 100,000,000. No other prize shall have a probability of winning less than 1 in 50,000,000.Test 

laboratory shall calculate and/or verify the mathematical expectations of game play, where applicable,

in accordance with the manufacturer stated submission. The results shall be included in the test 

laboratory’s report to the TGRA. 

(Remark: This correctly states the terms applicable to the game of Bingo where use of the term 

mathematical probability standards is incorrect. In Bingo, it is appropriate to require the manufacturer 

to disclose to TGRA the mathematical expectations of the game and to have the laboratories such 

mathematical expectations. In the existing rule the NIGC included an admittedly arbitrary probability 

standard that unfairly operates to limit game design and is not consistent with the probability standards 

applicable to most, if not all, charitable bingo operations and state lotteries.)

(d) (d) Approved equipment and software only. All gaming equipment and software used with Class II 

gaming systems shall be identical in all respects to a prototype reviewed and tested by a testing 

laboratory and approved for use by the tribal gaming regulatory authorityTGRA pursuant to § 547.4(a)

through (c). Unapproved software shall not be loaded onto or stored on any program storage medium 

used in a Class II gaming system, except as provided in § 547.4(d).

(e) (e) Proper functioning. All gaming equipment and software used with Class II gaming systems 

shall perform according to the manufacturer’s design and operating specifications. 

(f) (f) No Limitation of Technology. This part should not be interpreted to limit the use of technology or 

to preclude the use of technology not specifically referenced. 

(g) (g) Severability. If any provision of this part is declared invalid by a court of competent 

jurisdiction, such decision shall not affect the remainder of this part. 

§ 547.6 What are the minimum technical standards for enrolling and enabling Class II gaming 

system components? 
1

5

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

15

(a) (a) General requirements. Class II gaming systems shall provide a method to: 

(1) Enroll and unenroll system components; 

(2) (2) Enable and disable specific system components. 

(b) Specific requirements. Class II gaming systems shall: 

(1) (1) Ensure that only enrolled and enabled system components participate in gaming; and 

(2) (2) Ensure that the default condition for components shall be unenrolled and disabled. 

§ 547.7 What are the minimum technical hardware standards applicable to Class II gaming 

systems? 

(a) Generalrequirements. (1) The Class II gaming system shall operate in compliance with

applicable regulations of the Federal Communications Commission.

(2) Prior to approval by the tribal gaming regulatory authority pursuant to §

547.4(c), the Class II gaming system shall have obtained from 

Underwriters’ Laboratories, or its equivalent, relevant certification(s) 

required for equipment of its type, including but not limited to 

certifications for liquid spills, electromagnetic interference, etc.

(Remark: Other federal agencies are responsible for establishing and enforcing electrical product safety 

standards. Accordingly, promulgation of such standards is beyond the scope of NIGC jurisdiction.

However, sub-part 547.4 (a)(3)(i) is proposed above to reflect that it is industry standard for the 

laboratories to make note or include other laboratory certifications as provided by the manufacturer in 

their report.)

(b)(a) Printed circuit boards.

(1) Printed circuit boards that have the potential to affect the outcome or integrity of the game, 

and are specially manufactured or proprietary and not off-the-shelf, shall display a 

unique identifier such as a part number and/or revision number, which shall be updated 
1

6

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

16

to reflect new revisions or modifications of the board. 

(2) Switches or jumpers on all circuit boards that have the potential to affect the outcome or 

integrity of any game, progressive award, financial instrument, cashless transaction, 

voucher transaction, or accounting records shall be capable of being sealed. 

(c) (b) Electrostatic discharge. Class II gaming system components accessible to the public shall be 

constructed so that they exhibit immunity to human body electrostatic discharges on areas exposed to 

contact. Static discharges of ±15 kV for air discharges and ±7.5 kV for contact discharges may not 

cause damage, or inhibit operation or integrity of the Class II gaming system. 

(d) (c) Physical enclosures. Physical enclosures shall be of a robust construction designed to resist 

determined illegal entry. All protuberances and attachments such as buttons, identification plates, and 

labels shall be sufficiently robust to avoid unauthorized removal. 

(e) (d) Player interface. The player interface shall include a method or means to: 

(1) Display information to a player; and 

(2) Allow the player to interact with the Class II gaming system. 

(f) (e) Account access components. A Class II gaming system component that reads account access 

media shall be located within a secure, locked or tamper-evident area or in a cabinet or housing that is 

of a robust construction designed to resist determined illegal entry and to protect internal components. 

In addition, the account access component: 

(1) (1) Shall be constructed so that physical tampering leaves evidence of such tampering; and 

(2) (2) Shall provide a method to enable the Class II gaming system to interpret and act upon valid or 

invalid input or error condition. 

(g) (f) Financial instrument storage components. Any Class II gaming system components that store 

financial instruments and that are not designed to be operated under the direct control of a gaming 

operation employee or agent shall be located within a secure and locked area or in a locked cabinet or 
1

7

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

17

housing that is of a robust construction designed to resist determined illegal entry and to protect internal 

components.

(Remark: Technical Standards should only cover the design of the component; operation of the 

component should be covered in the MICS.)

(h) (g) Financial instrument acceptors. (1) Any Class II gaming system components that handle 

financial instruments and that are not designed to be operated under the direct control of an agent shall:

(Remark: Technical Standards should only cover the design of the component; operation of the 

component should be covered in the MICS.)

(i) Be located within a secure, locked and tamper-evident area or in a locked cabinet or housing 

that is of a robust construction designed to resist determined illegal entry and to protect internal 

components; 

(ii) Be able to detect the entry of valid or invalid financial instruments and to provide a method to 

enable the Class II gaming system to interpret and act upon valid or invalid input or error condition; and 

(iii) Be constructed to permit communication with the Class II gaming system of the accounting 

information required by § 547.9(a) and by applicable provisions of any Commission and tribal gaming 

regulatory regulations governing minimum internal control standards. 

(2) (2) Prior to completion of a valid financial instrument transaction by the Class II gaming system, no 

monetary amount related to that instrument shall be available for play. For example, credits shall not be 

available for play until currency or coupon inserted into an acceptor is secured in the storage 

component. 

(3) (3) The monetary amount related to all valid financial instrument transactions by the Class II 

gaming system shall be recorded as required by § 547.9(a) and the applicable provisions of any 

Commission and tribal gaming regulatory authority TGRA regulations governing minimum internal 

control standards.

(ih) Financial instrument dispensers.
1

8

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

18

(1) Any Class II gaming system components that dispense financial instruments and that are not 

designed to be operated under the direct control of a gaming operation employee or agent shall:

(Remark: Technical Standards should only cover the design of the component; operation of the 

component should be covered in the MICS.)

(i) Be located within a secure, locked and tamper-evident area or in a locked cabinet or housing 

that is of a robust construction designed to resist determined illegal entry and to protect internal 

components; 

(ii) Provide a method to enable the Class II gaming system to interpret and act upon valid or 

invalid input or error condition; and 

(iii) Be constructed to permit communication with the Class II gaming system of the accounting 

information required by § 547.9(a) and by applicable provisions of any Commission and tribal gaming 

regulatory regulations governing minimum internal control standards. 

(2) (2) The monetary amount related to all valid financial instrument transactions by the Class II 

gaming system shall be recorded as required by § 547.9(a), the applicable provisions of parts 542

andpart 543 of this chapter, and any tribal gaming regulatory authorityTGRA regulations governing 

minimum internal control standards. 

(ji) Game Outcome Determination Components. Any Class II gaming system logic components 

that affect the game outcome and that are not designed to be operated under the direct control of a 

gaming operation employee or agent shall be located within a secure, locked and tamper-evident area or 

in a locked cabinet or housing that is of a robust construction designed to resist determined illegal entry 

and to protect internal components. DIP switches or jumpers that can affect the integrity of the Class II 

gaming system must be capable of being sealed by the tribal gaming regulatory authority.TGRA. 

(k) (j) Door access detection. All components of the Class II gaming system that are locked in order to 

meet the requirements of this part shall include a sensor or other methods to monitor an open door. A 
1

9

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

19

door open sensor, and its components or cables, shall be secure against attempts to disable them or 

interfere with their normal mode of operation;. 

(lk) Separation of functions/no limitations on technology. Nothing herein shall prohibit the 

account access component, financial instrument storage component, financial instrument acceptor, and 

financial instrument dispenser from being included within the same component, or separated into 

individual components. 

§ 547.8 What are the minimum technical software standards applicable to Class II gaming 

systems? 

This section provides general software standards for Class II gaming systems for the play of Class II 

games, including where applicable games similar to bingo.

(a) (a) Player interface displays. (1) If not otherwise provided to the player, the player interface shall 

display the following: 

(i) The purchase or wager amount; 

(ii) Game results; and

(iii) Any player credit balance. 

(2) (2) Between plays of any game and until the start of the next play, or until the player selects a new 

game option such as purchase or wager amount or card selection, whichever is earlier, if not otherwise 

provided to the player, the player interface shall display: 

(i) The total purchase or wager amount and all prizes and total credits won for the last game 

played; 

(ii) The final results for the last game played, including entertaining displays of results, if any; 

and 

(Remarks: In Bingo gaming systems, game outcome is displayed on the bingo card located on the 

player interface which is independent of, and separate from, any entertaining display. Because an 

entertaining display cannot in anyway affect the player outcome of the game, it is irrelevant for 
2

0

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

20

regulatory purposes. Furthermore, inclusion of regulatory language concerning entertaining displays 

creates a false appearance of legal relevancy that enhances the potential for patron disputes. We,

therefore, have proposed the removal of this language.)

(iii) Any default purchase or wager amount for the next play. 

(b) (b) Game initiation and play. (1) Each game played on the Class II gaming system shall follow and 

not deviate from a constant set of rules for each game provided to players pursuant to § 547.16. Any

change in rules constitutes a different game. There shall be no automatic or undisclosed changes of 

rules.

(Remark: These statements have caused much confusion in the industry, particularly the 

laboratories. To eliminate this confusion, we propose removal of these statements as they are 

redundant with the first sentence.)

(2) For bingo games and games similar to bingo,The Class II gaming system shall not alter or allow 

to be altered the card permutations or game rules used for play of a Class II game unless specifically 

chosen by the player prior to commitment to participate in the game. No duplicate cards shall be sold 

for any common draw. 

(Remark: Removed “game rules” reference because it is addressed in 547.8 (b)(1) above.)

(3) No game play shall commence and, no financial instrument or credit shall be accepted on the 

affected player interface, in the presence of any fault condition that affects the outcome of the game, 

open door, or while in test, audit, or lock-up mode. 

(4) The player must choose to participate in the play of a game. 

(c) Audit Mode. (1) If an audit mode is provided, the Class II gaming system shall provide, for those 

components actively involved in the audit: 

(i) All accounting functions required by § 547.9, by applicable provisions of any 

Commission regulations governing minimum internal control standards, and by any 

internal controls adopted by the tribe or tribal gaming regulatory authority;TGRA; 
2

1

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

21

(ii) Display player interface identification; and 

(iii) Display software version or game identification; 

(2) Audit mode shall be accessible by a secure method such as an employee or agent PIN and ,key or 

other auditable access control.

(Remark: Removed “and” to eliminate confusion that multiple controls may be required.)

(3) (3) Accounting function data shall be accessible by an agent authorized person at any time, except 

during a payout, during a handpay, or during play. 

(4) (4) The Class II gaming system shall disable financial instrument acceptance on the affected player 

interface while in audit mode, except during financial instrument acceptance testing. 

(d) (d) Last bingo game play recall. The last bingo game play recall function shall: 

(Remark: The term “play” clarifies the need to identify the activity of a specific bingo game play

instance.)

(1) (1) Be retrievable at all times, other than when the recall component is involved in the play of a 

game, upon the operation of an external key- switch, entry of an audit card, or a similar method; 

(2) (2) Display the results of recalled bingo games play as originally displayed or in text representation

, including entertaining display results implemented in video, rather than electro-mechanical, form,

if any, so as to enable thetribal gaming regulatory authority TGRA or operator to clearly identify the 

bingo game play sequences and results that occurred;

(Remarks: The entertaining display has no legal significance to the outcome of the play of a bingo 

game. Its inclusion in any regulation is therefore legally inappropriate. The decision to display the 

entertaining display as a record should be a business decision made by the gaming operation, TGRA, 

and/or manufacturer. This is solely a business decision between the all parties, therefore a federal 

requirement is inappropriate. See previous remark for 547.8 (a)(2)(ii).)
2

2

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

22

(3) (3) Allow the Class II gaming system component providing bingo game play recall, upon return to 

normal game play mode, to restore any affected display to the positions, forms and values displayed 

before access to the bingo game play recall information; and 

(4) (4) Provide the following information for the current and previous four bingo games played plays

and shall display: 

(i) Game Play start time, end time, and date; 

(ii) The total number of credits at the start of play, less the purchase or wager amount; 

(iii) The purchase or wager amount; 

(iv) The total number of credits at the end of play; and 

(v) The total number of credits won as a result of the bingo game play recalled, and the value in 

dollars and cents for progressive prizes, if different. 

(vi) For bingo games and, where applicable, games similar to bingo only, also display: 

(A) The card(s) used by the player; 

(B) The identifier of the bingo game played; 

(C) The numbers or other designations drawn, in the order that they were drawn; 

(D) The numbers or other designations and prize patterns covered on each card; 

(E) All prizes won by the player, including winning patterns and entertaining displays

implemented in video, rather than electro- mechanical form, if any; and 

(Remark: See previous remark for 547.8 (a)(2)(ii).)

(F) The unique identifier of the card on which prizes were won; 

(vii) For pull-tab games only, also display:

(A) The result(s) of each pull-tab, displayed in the same pattern as on

the tangible pull-tab;

(B) All prizes won by the player;

(C) The unique identifier of each pull tab; and
2

3

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

23

(D) Any other information necessary to fully reconstruct the 

current and four previous plays.

(e) (e) Voucher and credit transfer recall. Notwithstanding the requirements of any other section 

in this part, a Class II gaming system shall have the capacity to: 

(1) (1) Display the information specified in § 547.11(b)(5)(ii) through (vi) for the last five vouchers 

or coupons printed and the last five vouchers or coupons accepted; and 

(2) (2) Display a complete transaction history for the last five cashless transactions made and the 

last five cashless transactions accepted. 

(f) (f) Software signature verification. The manufacturer or developer of the Class II gaming system 

must provide to the testing laboratory and to the tribal gaming regulatory authorityTGRA an industrystandard methodology, acceptable to the tribal gaming regulatory authorityTGRA, for verifying the 

Class II gaming system game software. By way of illustration, for game software stored on rewritable 

media, such methodologies include signature algorithms and hashing formulas such as SHA-1. 

(g) (g) Test, diagnostic, and demonstration modes. If test, diagnostic, and/or demonstration modes are 

provided, the Class II gaming system shall, for those components actively involved in the test, 

diagnostic, or demonstration mode: 

(1) Clearly indicate when that component is in the test, diagnostic, or demonstration mode; 

(2) Not alter financial data on that component other than temporary data; 

(3) Only be available after entering a specific mode; 

(4) (4) Disable credit acceptance and payment unless credit acceptance or payment is being tested; and 

(5) (5) Terminate all mode-specific functions upon exiting a mode. 

(h) Multi-game. If multiple games are offered for player selection at the player interface, the player 

interface shall: 

(1) (1) Provide a display of available games; 

(2) (2) Provide the means of selecting among them; 
2

4

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

24

(3) (3) Display the full amount of the player’s credit balance;

(4) Identify the game selected or being played; and 

(5) (5) Not force the play of a game after its selection. 

(i) Program interruption and resumption. The Class II gaming system software shall be 

designed so that upon resumption following any interruption, the system: 

(1) (1) Is able to return to a known state; 

(2) Shall check for any fault condition upon resumption; 

(3) (3) Shall verify the integrity of data stored in critical memory; 

(4) (4) Shall return the purchase or wager amount to the player in accordance with the rules of the 

game; and 

(5) (5) Shall detect any change or corruption in the Class II gaming system software. 

(j) Class II gaming system components acting as progressive controllers. This paragraph applies 

to progressive controllers and components acting as progressive controllers in Class II gaming systems. 

(1) (1) Modification of progressive parameters shall be conducted in a secure manner approved by the 

tribal gaming regulatory authorityTGRA. Such parameters may include: 

(i) Increment value; 

(ii) Secondary pool increment(s); 

(iii) Reset amount(s); 

(iv) Maximum value(s); and 

(v) (v) Identity of participating player interfaces. 

(2) (2) The Class II gaming system component or other progressive controller shall provide a means of 

creating a progressive balancing report for each progressive link it controls. At a minimum, that report 

shall provide balancing of the changes of the progressive amount, including progressive prizes won, for 

all participating player interfaces versus current progressive amount(s), plus progressive prizes. In 

addition, the report shall account for, and not be made inaccurate by, unusual events such as: 
2

5

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

25

(i) Class II gaming system critical memory clears; 

(ii) Modification, alteration, or deletion of progressive prizes; 

(iii) Offline equipment; or 

(iv) Multiple site progressive prizes. 

(k) (k) Critical memory. (1) Critical memory may be located anywhere within the Class II gaming 

system. Critical memory is any memory that maintains any of the following data: 

(i) Accounting data; 

(ii) Current credits; 

(iii) Configuration data; 

(iv) Last game play recall information required by § 547.8(d); 

(v) Game play recall information for the current game play , if incomplete; 

(vi) Software state (the last normal state software was in before interruption); 

(vii) RNG seed(s), if necessary for maintaining integrity; 

(viii) Encryption keys, if necessary for maintaining integrity; 

(ix) Progressive prize parameters and current values; 

(x) The five most recent financial instruments accepted by type, excluding coins and tokens; 

(xi) The five most recent financial instruments dispensed by type, excluding coins and tokens; and 

(xii) The five most recent cashless transactions paid and the five most recent cashless transactions 

accepted. 

(2) (2) Critical memory shall be maintained using a methodology that enables errors to be identified 

and acted upon. All accounting and recall functions shall be verified as necessary to ensure their 

ongoing integrity. 

(3) (3) The validity of affected data stored in critical memory shall be checked after each of the 

following events: 

(i) Every restart; 
2

6

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

26

(ii) Each attendant paid win; 

(iii) Each attendant paid progressive win; 

(iv) Each sensored door closure; and 

(v) (v) Every reconfiguration, download, or change of prize schedule or denomination requiring 

operator intervention or action. 

(l) Secured access. Class II gaming systems that use a logon or other means of secured access 

shall include a user account lockout after a predetermined number of consecutive failed attempts to 

access system. 

§ 547.9 What are the minimum technical standards for Class II gaming system accounting 

functions? 

This section provides standards for accounting functions used in Class II gaming systems. 

(a) (a) Required accounting data. The following minimum accounting data, however named, shall be 

maintained by the Class II gaming system. 

(1) Amount In: The total value of all financial instruments and cashless transactions accepted by 

the Class II gaming system. Each type of financial instrument accepted by the Class II gaming 

system shall be tracked independently per financial instrument acceptor, and as required by 

applicable requirements of any Commission and tribal gaming regulatory authority the TGRA

regulations governing minimum internal control standards.

(2) Amount Out: The total value of all financial instruments and cashless transactions paid by 

the Class II gaming system, plus the total value of attendant pay. Each type of financial 

instrument paid by the Class II Gaming System shall be tracked independently per financial 

instrument dispenser, and as required by applicable requirements of any Commission and tribal 

gaming regulatory authority the TGRA regulations governing minimum internal control 

standards.

(b) (b) Accounting data storage. If the Class II gaming system electronically maintains 
2

7

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

27

accounting data: 

(1) (1) Accounting data shall be stored with at least eight decimal digits. 

(2) (2) Credit balances shall have sufficient digits to accommodate the design of the game. 

(3) (3) Accounting data displayed to the player may be incremented or decremented using visual 

effects, but the internal storage of this data shall be immediately updated in full. 

(4) (4) Accounting data shall be updated upon the occurrence of the relevant accounting event. 

(5) (5) Modifications to accounting data shall be recorded, including the identity of the person(s) 

making the modifications, and be reportable by the Class II gaming system. 

(c) (c) Rollover. Accounting data that rolls over to zero shall not corrupt data. 

(d) (d) Credit balance display and function. (1) Any credit balance maintained at the player 

interface shall be prominently displayed at all times except: 

(i) In audit, configuration, recall and test modes; or 

(ii) Temporarily, during entertaining displays of game results. 

(2) (2) Progressive prizes may be added to the player’s credit balance provided: 

(i) The player credit balance is maintained in dollars and cents; 

(ii) The progressive accounting data is incremented in number of credits; or 

(iii) The prize in dollars and cents is converted to player credits or transferred to the player’s 

credit balance in a manner that does not mislead the player or cause accounting imbalances. 

(3) (3) If the player credit balance displays in credits, but the actual balance includes fractional 

credits, the Class II gaming system shall display the fractional credit when the player credit balance 

drops below one credit. 

§ 547.10 What are the minimum standards for Class II gaming system critical events? 

This section provides standards for events such as system critical faults, deactivation, door 

open or other changes of states, and lockup within the Class II gaming system. 

(a) (a) Fault events. (1) The following events are to be treated as described below: 
2

8

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

28

Events Definition and action to be taken

(i) Component fault

(ii) Financial storage component 

full

(iii) Financial output component 

empty

(iv) Financial component fault

(v) Critical memory error

(vi) Progressive communication 

fault

(vii) Program storage medium 

fault

Reported when a fault on a component is detected. When possible, this event

message should indicate what the nature of the fault is.

Reported when a financial instrument acceptor or dispenser includes 

storage, and it becomes full. This event message should indicate what 

financial storage component is full.

Reported when a financial instrument dispenser is empty. The event 

message should indicate which financial output component is affected, 

and whether it is empty.

Reported when an occurrence on a financial component results in a 

known fault state.

Some critical memory error has occurred. When a non-correctable 

critical memory error has occurred, the data on the Class II gaming 

system component can no longer be considered reliable. Accordingly, 

any game play on the affected component shall cease immediately, and 

an appropriate message shall be displayed, if possible. 

If applicable; when communications with a progressive controller 

component is in a known fault state. 

The software has failed its own internal security check or the medium 

itself has some fault. 

Any game play on the affected component shall cease immediately, and 

an appropriate message shall be displayed, if possible.

(2) (2) The occurrence of any event identified in paragraph (a)(1) of this section shall be recorded. 

(3) (3) Upon clearing any event identified in paragraph (a)(1) of this section, the Class II gaming 

system shall: 

(i) Record that the fault condition has been cleared; 

(ii) Ensure the integrity of all related accounting data; and 

(iii) In the case of a malfunction, return a player’s purchase or wager according to the rules of 

the game. 
2

9

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

29

(b) (b) Door open/close events. (1) In addition to the requirements of paragraph (a)(1) of this 

section, the Class II gaming system shall perform the following for any component affected by any 

sensored door open event: 

(i) Indicate that the state of a sensored door changes from closed to open or opened to 

closed; 

(ii) Disable all financial instrument acceptance, unless a test mode is entered; 

(iii) Disable game play on the affected player interface; 

(iv) Disable player inputs on the affected player interface, unless test mode is entered; and 

(v) (v) Disable all financial instrument disbursement, unless a test mode is entered. 

(2) (2) The Class II gaming system may return the component to a ready to play state when all 

sensored doors are closed. 

(c) (c) Non-fault events. (1) The following non-fault events are to be treated as described below, if 

applicable:

Event Definition and action to be taken

(i) Player interface power off 

during play 

(ii) Player interface power on

(iii) Financial instrument storage 

component container/ 

stacker removed

This condition is reported by the affected component(s) to indicate power 

has been lost during game play. 

This condition is reported by the affected component(s) to indicate it has 

been turned on. 

This condition is reported when a financial instrument storage container 

has been removed. The event message should indicate which storage 

container was removed. 

§ 547.11 What are the minimum technical standards for money and credit handling? 

This section provides standards for money and credit handling by a Class II gaming system. 

(a) (a) Credit acceptance, generally. (1) Upon any credit acceptance, the Class II gaming system 

shall register the correct number of credits on the player’s credit balance. 

(2) (2) The Class II gaming system shall reject financial instruments deemed invalid. 
3

0

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

30

(b) (b) Credit redemption, generally. (1) For cashable credits on a player interface, players shall 

be allowed to cash out and/or redeem those credits at the player interface except when that player 

interface is: 

(i) Involved in the play of a game; 

(ii) In audit mode, recall mode or any test mode; 

(iii) Detecting any sensored door open condition; 

(iv) Updating the player credit balance or total win accounting data; or 

(v) Displaying a fault condition that would prevent cash-out or credit redemption. In this 

case a fault indication shall be displayed. 

(2) (2) For cashable credits not on a player interface, the player shall be allowed to cash out and/or 

redeem those credits at any time. 

(3) (3) A Class II gaming system shall not automatically pay an award subject to mandatory tax 

reporting or withholding. 

(4) (4) Credit redemption by voucher or coupon shall conform to the following: 

(i) A Class II gaming system may redeem credits by issuing a voucher or coupon when it 

communicates with a voucher system that validates the voucher or coupon. 

(ii) A Class II gaming system that redeems credits by issuing vouchers and coupons shall 

either: 

(A) (A) Maintain an electronic record of all information required by paragraphs (b)(5)(ii) through 

(vi) of this section; or 

(B) (B) Generate two identical copies of each voucher or coupon issued, one to be provided to the 

player and the other to be retained within the machine for audit purposes. 

(5) (5) Valid vouchers and coupons shall contain the following: 

(i) Gaming operation name and location; 
3

1

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

31

(ii) The identification number of the Class II gaming system component or the player 

interface number, as applicable; 

(iii) Date and time of issuance; 

(iv) Alpha and numeric dollar amount; 

(v) A sequence number; 

(vi) A validation number that: 

(A) (A) Is produced by a means specifically designed to prevent repetition of validation numbers; 

and 

(B) (B) Has some form of checkcode or other form of information redundancy to prevent 

prediction of subsequent validation numbers without knowledge of the checkcode algorithm and 

parameters; 

(vii) For machine-readable vouchers and coupons, a bar code or other form of machine 

readable representation of the validation number, which shall have enough redundancy and error 

checking to ensure that 99.9% of all misreads are flagged as errors; 

(viii) Transaction type or other method of differentiating voucher and coupon types; and 

(ix) Expiration period or date. 

(6) (6) Transfers from an account may not exceed the balance of that account. 

(7) For Class II gaming systems not using dollars and cents accounting and not having odd 

cents accounting, the Class II gaming system shall reject any transfers from voucher payment 

systems or cashless systems that are not even multiples of the Class II gaming system 

denomination. 

(8) (8) Voucher redemption systems shall include the ability to report redemptions per redemption 

location or user. 

§ 547.12 What are the minimum technical standards for downloading on a Class II gaming 

system? 
3

2

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

32

This section provides standards for downloading on a Class II gaming system. 

(a) (a) Downloads. (1) Downloads are an acceptable means of transporting approved content, 

including but not limited to software, files, data, and prize schedules. 

(2) Downloads of software, games, prize schedules, or other download packages shall be 

conducted only as authorized by the tribal gaming regulatory authority.TGRA. 

(3) (3) Downloads shall use secure methodologies that will deliver the download data without 

alteration or modification, in accordance with § 547.15(a). 

(4) (4) Downloads conducted during operational periods shall be performed in a manner that will 

not affect game play. 

(5) (5) Downloads shall not affect the integrity of accounting data. 

(6) (6) The Class II gaming system or the tribal gaming regulatory authorityTGRA shall log each 

download of any download package. Each log record shall contain as a minimum: 

(i) The time and date of the initiation of the download; 

(ii) The time and date of the completion of the download; 

(iii) The Class II gaming system components to which software was downloaded; 

(iv) The version(s) of download package and any software downloaded. Logging of the unique 

software signature will satisfy this requirement; 

(v) (v) The outcome of any software verification following the download (success or failure); and 

(vi) The name and identification number, or other unique identifier, of any individual(s) 

conducting or scheduling a download. 

(b) (b) Verifying downloads. Following download of any gameDownloaded software, the on a

Class II gaming system shall verify the downloaded softwarebe verified by the Class II gaming 

system using a software signature verification method that meets the requirements of § 547.8(f). 

Using any method it deems appropriate, the tribal gaming regulatory authority shall confirm the

verification.
3

3

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

33

(Remark: The last sentence was removed because it is a MICS issue and is addressed in the TGWG

proposed draft part 543.)

§ 547.13 What are the minimum technical standards for program storage media? 

This section provides minimum standards for removable, (re-)writable, and nonwritable 

storage media in Class II gaming systems. 

(a) (a) Removable program storage media. All removable program storage media shall maintain 

an internal checksum or signature of its contents. Verification of this checksum or signature is to 

be performed after every restart. If the verification fails, the affected Class II gaming system 

component(s) shall lock up and enter a fault state. 

(b) Nonrewritable program storage media. (1) All EPROMs and Programmable Logic Devices 

(PLDs) that have erasure windows shall be fitted with covers over their erasure windows. 

(2) (2) All unused areas of EPROMs shall be written with the inverse of the erased state (e.g., zero 

bits (00 hex) for most EPROMs), random data, or repeats of the program data. 

(3) (3) Flash memory storage components intended to have the same logical function as ROM, i.e.

not to be dynamically written, shall be write- protected or otherwise protected from unauthorized 

modification. 

(4) (4) The write cycle shall be closed or finished for all CD-ROMs such that it is not possible to 

write any further data to the CD. 

(5) (5) Write protected hard disks are permitted if the hardware means of enabling the write 

protect is easily viewable and can be sealed in place Write protected hard disks are permitted using 

software write protection verifiable by a testing laboratory. 

(c) (c) Writable and rewritable program storage media. (1) Writable and rewritable program 

storage, such as hard disk drives, Flash memory, writable CD-ROMs, and writable DVDs, may 

be used provided that the software stored thereon may be verified using the mechanism 

provided pursuant to § 547.8(f). 
3

4

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

34

(2) (2) Program storage shall be structured so there is a verifiable separation of fixed data (e.g.

program, fixed parameters, DLLs) and variable data. 

(d) (d) Identification of program storage media. All program storage media that is not rewritable

in circuit, (e.g. EPROM, CD-ROM) shall be uniquely identified, displaying: 

(1) Manufacturer; 

(2) Program identifier; 

(3) Program version number(s); and 

(4) Location information, if critical (e.g. socket position 3 on the printed circuit board). 

§ 547.14 What are the minimum technical standards for electronic random number 

generation? 

This section provides minimum standards for electronic RNGs in Class II gaming systems. 

(a) (a) Properties. All RNGs shall produce output having the following properties: 

(1) Statistical randomness; 

(2) Unpredictability; and 

(3) Non-repeatability. 

(b) (b) Statistical Randomness. (1) Numbers or other designations produced by an RNG shall be 

statistically random individually and in the permutations and combinations used in the application 

under the rules of the game. For example, if a bingo game with 75 objects with numbers or other 

designations has a progressive winning pattern of the five numbers or other designations on the 

bottom of the card and the winning of this prize is defined to be the five numbers or other 

designations are matched in the first five objects drawn, the likelihood of each of the 75C5 

combinations are to be verified to be statistically equal. 

(2) (2) Numbers or other designations produced by an RNG shall pass the statistical tests for 

randomness to a 99% confidence level., which may include:

(i) Mandatory statistical tests for randomness to include:
3

5

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

35

(A) Chi-square test; 

(B) Runs test (patterns of occurrences shall not be recurrent); and

(C) Serial correlation test potency and degree of serial correlation (outcomes shall be 

independent from the previous game).

(ii) Optional statistical tests for randomness may include:

(ii) (A) Equi-distribution (frequency) test; 

(iii) (B) Gap test; 

(iv) (C) Poker test;

 (v) (D) Coupon collector’s test; 

(vi) (E) Permutation test; 

(vii) Run test (patterns of occurrences shall not be recurrent); 

(viii) (F) Spectral test; 

(ix) Serial correlation test potency and degree of serial correlation (outcomes shall be

independent from the previous game); and 

(x) (G) Test on subsequences. 

(Remark: TGWG wanted to ensure that industry standard RNG tests were mandated. Less 

commonly used tests were not considered adequate. See NIGC “Part 547 Bulletin 2008-4 Tech 

Stds RNG correction 110708”)

(c) (c) Unpredictability. (1) It shall not be feasible to predict future outputs of an RNG, even if the 

algorithm and the past sequence of outputs are known. 

(2) (2) Unpredictability shall be ensured by re-seeding or by continuously cycling the RNG, and 

by providing a sufficient number of RNG states for the applications supported. 

(3) (3) Re-seeding may be used where the re-seeding input is at least as statistically random as, 

and independent of, the output of the RNG being re-seeded. 
3

6

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

36

(d) (d) Non-repeatability. The RNG shall not be initialized to reproduce the same output stream 

that it has produced before, nor shall any two instances of an RNG produce the same stream as 

each other. This property shall be ensured by initial seeding that comes from: 

(1) (1) A source of "true" randomness, such as a hardware random noise generator; or 

(2) (2) A combination of timestamps, parameters unique to a Class II gaming system, previous 

RNG outputs, or other, similar method. 

(e) (e) General requirements. (1) Software that calls an RNG to derive game outcome events shall 

immediately use the output returned in accordance with the game rules. 

(2) (2) The use of multiple RNGs is permitted as long as they operate in accordance with this 

section. 

(3) (3) RNG outputs shall not be arbitrarily discarded or selected. 

(4) (4) Where a sequence of outputs is required, the whole of the sequence in the order generated 

shall be used in accordance with the game rules. 

(5) (5) The Class II gaming system shall neither adjust the RNG process or game outcomes based 

on the history of prizes obtained in previous games nor makeuse any reflexive software or 

secondary decision that affects the results shown to the player or game outcome. In no event shall 

the Class II gaming system deprive a player of a prize to which the player is otherwise entitled 

based on the random outcome of the game. Nothing in this paragraph shall prohibit the use of 

entertaining displays. 

(Remark: The added language makes this provision more consistent with the industry 

understanding of reflexive technology. The proposed language operates to clearly identify the 

harm the provision is intended to prevent.)

(f) (f) Scaling algorithms and scaled numbers. An RNG that provides output scaled to given 

ranges shall: 

(1) (1) Be independent and uniform over the range; 
3

7

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

37

(2) (2) Provide numbers scaled to the ranges required by game rules, and notwithstanding the 

requirements of paragraph (e)(3) of this section, may discard numbers that do not map uniformly 

onto the required range but shall use the first number in sequence that does map correctly to the 

range; 

(3) (3) Be capable of producing every possible outcome of a game according to its rules; and 

(4) Use an unbiased algorithm. A scaling algorithm is considered to be unbiased if the measured 

bias is no greater than 1 in 100 million. 

(Remark: See NIGC Bulletin 11/7/2008 #2008-4)

§ 547.15 What are the minimum technical standards for electronic data communications 

between system components? 

This section provides minimum standards for electronic data communications with gaming 

equipment or components used with Class II gaming systems. 

(a) (a) Sensitive data. Communication of sensitive data shall be secure from eavesdropping, 

access, tampering, intrusion or alteration unauthorized by the tribal gaming regulatory

authorityTGRA. Sensitive data shall include, but not be limited to: 

(1) (1) RNG seeds and outcomes; 

(2) Encryption keys, where the implementation chosen requires transmission of keys; 

(3) PINs; 

(4) (4) Passwords; 

(5) (5) Financial instrument transactions; 

(6) Transfers of funds; 

(7) (7) Player tracking information; 

(8) Download Packages; and 

(9) (9) Any information that affects game outcome. 
3

8

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

38

(b) (b) Wireless communications. (1) Wireless access points shall not be accessible to the general 

public. 

(2) (2) Open or unsecured wireless communications are prohibited. 

(3) (3) Wireless communications shall be secured using a methodology that makes eavesdropping, 

access, tampering, intrusion or alteration impractical. By way of illustration, such methodologies 

include encryption, frequency hopping, and code division multiplex access (as in cell phone 

technology). 

(c) (c) Methodologies shall be used that will ensure the reliable transfer of data and provide a 

reasonable ability to detect and act upon any corruption of the data. 

(d) (d) Class II gaming systems shall record detectable, unauthorized access or intrusion attempts. 

(e) (e) Remote communications shall only be allowed if authorized by the tribal gaming

regulatory authorityTGRA. Class II gaming systems shall have the ability to enable or disable 

remote access, and the default state shall be set to disabled. 

(f) (f) Failure of data communications shall not affect the integrity of critical memory. 

(g) The Class II gaming system shall log the establishment, loss, and re-establishment of 

data communications between sensitive Class II gaming system components. 

§ 547.16 What are the minimum standards for game artwork, glass, and rules? 

This section provides standards for the display of game artwork, the displays on belly or top 

glass, and the display and disclosure of game rules, whether in physical or electronic form. 

(a) (a) Rules, instructions, and prize schedules, generally. The following shall at all times be 

displayed or made readily available to the player upon request: 

(1) (1) Game name, rules, and options such as the purchase or wager amount stated clearly and 

unambiguously; 

(2) (2) Denomination; 
3

9

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

39

(3) (3) Instructions for play on, and use of, the player interface, including the functions of all 

buttons; and 

(4) (4) A prize schedule or other explanation, sufficient to allow a player to determine the 

correctness of all prizes awarded, including; 

(i) The range and values obtainable for any variable prize; 

(ii) Whether the value of a prize depends on the purchase or wager amount; and 

(iii) The means of division of any pari-mutuel prizes; but 

(iv) For bingo and games similar to bingoClass II Gaming Systems, the prize schedule or 

other explanation need not state that subsets of winning patterns are not awarded as additional 

prizes (e.g. five in a row does not also pay three in a row or four in a row), unless there are 

exceptions, which shall be clearly stated. 

(b) (b) Disclaimers. The Class II gaming system shall continually display: 

(1) “Malfunctions void all prizes and plays” or equivalent; and 

(2) (2) “Actual Prizes Determined by Bingo [or other applicable Class II game] Play. Other 

Displays for Entertainment Only.” or equivalent.

§ 547.17 Howdoesa tribalgamingregulatoryauthorityapplyforavariancefromthese the

standards of this part?

(a) TribalGamingRegulatoryAuthorityapproval. (1) A tribal gaming regulatory 

authority may approve a variance from the requirements of this part if it has 

determined that the variance will achieve a level of security and integrity 

sufficient to accomplish the purpose of the standard it is to replace.

(a) Variance.
4

0

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

40

(1) Should a TGRA grant a variance to any provision of these standards, the TGRA 

shall deliver a notice of the same to the Commission within ten (10) days of such 

approval.

(Remark: Please see transmittal memorandum.)

(2) For each enumerated standard for which the tribal gaming regulatory 

authority approves a variance, it shall submit to the Chairman within 30 

days, a detailed report, which shall include the following:

(i) An explanation of how the variance achieves a level of security and integrity

sufficient to accomplish the purpose of the standard it is to replace; and(ii) The

variance as granted and the record on which it is based.

(3) In the event that the tribal gaming regulatory authority or the tribe’s 

government chooses to submit a variance request directly to the Chairman 

for joint government to government review, the tribal gaming regulatory 

authority or tribal government may do so without the approval

requirement set forth in paragraph (a) (1) of this section.

(b) ChairmanReview. (1) The Chairman may approve or object to a variance 

granted by a tribal gaming regulatory authority.

(2) Any objection by the Chairman shall be in written form with an 

explanation why the variance as approved by the tribal gaming regulatory 

authority does not provide a level of security or integrity sufficient to 

accomplish the purpose of the standard it is to replace.

(3) If the Chairman fails to approve or object in writing within 60 days after 

the date of receipt of a complete submission, the variance shall be 

considered approved by the Chairman. The Chairman and the tribal 
4

1

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

41

gaming regulatory authority may, by agreement, extend this deadline an 

additional 60 days.

(i) The notice shall contain a complete copy of the information presented to the 

TGRA and the variance as granted.

(ii) The notice shall be forwarded to the Commission within ten (10) days of 

the granting of the Variance.

(4) No variance may be implemented until approved by the tribal gaming regulatory

authority pursuant to paragraph (a)(1) of this section or the Chairman has approved

pursuant to paragraph (b)(1) of this section.

(2) During a thirty (30) day period when the Commission first receives the notice 

required by this subpart, the Chairman may request additional information from the 

TGRA concerning the subject of variance. Such request shall suspend the thirty (30) 

day period until the Chairman receives the TGRA response.

(b) Commission Review.

(c) CommissionReview. (1) Should the tribal gaming regulatory authority elect to 

maintain its approval after written objection by the Chairman, the tribal gaming 

regulatory authority shall be entitled to an appeal to the full Commission in accordance

with the following process:

(1) Within the thirty (30) day review period, the Commission may:

(i) Within 60 days of receiving an objection, the tribal gaming regulatory

authority shall file a written notice of appeal with the Commission that may

include a request for an oral hearing or it may request that the matter be decided

upon written submissions. Advise the TGRA, in writing, that it has no 

objection.

(ii) Within 10 days after filing a notice of appeal the tribal gaming 

regulatory authority shall file a supplementalstatement specifying the reasons

why the tribal gaming regulatory authority believes the Chairman’s objection
4

2

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

42

should be reviewed, and shall include supporting documentation, if any. Provide 

the TGRA a written statement itemizing its objections. 

(iii) Failure to file an appeal or submit the supplementalstatement within the

time provided by this section shall result in a waiver of the opportunity for an

appeal.Take no action, in which case, the TGRA’s variance shall be final. 

(2) If the Commission has provided the TGRA a statement itemizing objections to the 

variance: 

(i) The TGRA shall reconsider the variance taking into account the objections 

itemized by the Commission.

(ii) The TGRA may seek reconsideration by submitting a request to the 

Chairman and members of the Commission.

(iii) Upon receipt of a request for reconsideration, the Commission shall 

conduct an informal hearing with the TGRA within 30 days, which may be 

conducted in person or through the exchange of documents, as requested by the 

TGRA.

(iv) If an oral hearing is requested it shall take place within 30 days of the notice

of appeal and a record shall be made.

(v) If the tribal gaming regulatory authority requests that the appeal be 

decided on the basis of written submission, the Commission shall 

issue a written decision within 30 days of receiving the supplemental 

statement.After the informal hearing, the Commission must issue a 

written decision within 14 days. If the Commission disapproves the 

variance, such written decision must include an explanation of why 

the requested variance creates an imminent threat to the integrity of 

the tribal gaming operation.

(vi) The Commission shall uphold the objection of the Chairman, only if, 

upon de novo review of the record upon which the Chairman’s 

decision is based, the Commission determines that the variance 

approved by the tribal gaming regulatory authority does not achieve
4

3

Redline with Remarks for Published Part 547 to 

Proposed TGWG Draft Part 547 as of 5/13/2011

43

a level of security and integrity sufficient to accomplish the purpose 

of the standard it is to replace.

(vii) The Commission shall issue a decision within 30 days of the oral 

hearing unless the tribal gaming regulatory authority elects to provide

the Commission additional time, not to exceed an additional

30 days, to issue a decision. In the absence of a decision by the 

Commission within the time provided, the decision of the tribal 

gaming regulatory authority shall be deemed affirmed.

(viii) The Commission’s decision shall constitute final agency action.

Dated: September , 2008

Philip N. Hogen, 

Chairman

Norman H. DesRosiers

ViceChairman