§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 1 of 7 NIGC VERSION 

 11/30/2011 

On October 8, 2008, the NIGC published final Class III MICS in the Federal Register. 73 FR 

60492. The effective date of that rule has been postponed until 2012. 76 FR 53817.  In 2010, the 

NIGC posted on its web site draft Class II MICS. The Proposed MICS published in the Federal 

Register on October 8, 2008 reserved § 543.11 and the 2010 draft regulations did not suggest new 

language for the section. Because there is no draft 2010 regulation, this document will 

compare the TGWG MICS proposal to the 2008 MICS published in the Federal Register. 

Editing convention: The words in blue (underlined) and red (struck-through) are the additions and 

deletions made by the TGWG. 

2008 Proposed MICS  TGWG Version 

§ 543.11 

Reserved 

§ 543.11  

Reserved 

What are the minimum internal control 

standards for patron deposit accounts and 

cashless systems?  

(a) Internal Control Procedures. Subject to the 

approval and oversight of the TGRA, each 

gaming operation shall establish, implement 

and adhere to internal control policies and 

procedures that provide at least the level of 

control established by the standards of this 

section.  

(b) Computer Applications. For any computer 

applications utilized, alternate documentation 

and/or procedures that provide at least the level 

of control established by the standards of this 

section, as approved in writing by the TGRA, 

will be acceptable.  

(c) Conflicts of Standards. If there are any 

inconsistencies between these regulations and 

external standards incorporated by this 

provision, such as Title 31 and Credit Card 

Act, such other applicable standards shall 

prevail.  

(d) Variances. The TGRA shall establish the 

threshold level at which a variance shall be 

reviewed. Any such review shall be 

documented.  

(e) Patron Deposit Accounts and Cashless 

Systems.  

(1) Patron deposit accounts and cashless 

systems must be controlled in a manner 

designed to prevent unauthorized access, 

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 2 of 7 NIGC VERSION 

 11/30/2011 

misappropriation, forgery, theft, or fraud.  

(2) All smart cards (i.e., cards that possess the 

means to electronically store or retrieve data) 

that maintain the only source of account data 

are prohibited.  

(3) Patron deposit accounts may be unrestricted 

or restricted to a specific patron.  

(4) Establishment of patron deposit accounts. 

The following standards apply when the patron 

establishes an account and optionally makes an 

initial deposit.  

(i) For restricted patron deposit accounts: 

(A) The patron must appear at the gaming 

operation in person, at a designated area of 

accountability, and present a valid government 

issued picture identification credential.  

(B) An agent must examine the patron�s 

identification and record, at a minimum, the 

following information:  

(1) Type, number, and expiration date of the 

identification;  

(2) Patron�s name;  

(3) A unique account identifier;  

(4) Date the account was opened; and  

(5) The agent�s name.  

(C) The agent must require the patron to sign 

the account documentation before the account 

is activated.  

(D) The agent or cashless system shall provide 

the patron deposit account holder with a secure 

method of access.  

(ii) For unrestricted patron deposit accounts:  

(A) The patron must be informed of the 

unrestricted nature of the account, and the fact 

that the account may be accessible to anyone 

with the account number.  

(B) The patron must acknowledge and accept 

the risks associated with unrestricted accounts.  

(5) Patron deposits, withdrawals and 

adjustments.  

(i) Prior to the patron making a deposit or a 

withdrawal from a patron deposit account, the 

agent or cashless system must verify the 

identity of the patron deposit account, the 

patron identity for restricted accounts, and 

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 3 of 7 NIGC VERSION 

 11/30/2011 

availability of funds. Reliance on a secured 

personal identification number (PIN) entered 

by the patron is an acceptable method of 

verifying patron identity.  

(ii) Adjustments made to the patron deposit 

accounts must be performed by an agent.  

(iii) When a deposit, withdrawal or adjustment 

is processed by an agent, a multi-part 

transaction record must be created containing 

the following information: 

(A) Same document number on all copies;  

(B) Type of transaction, (e.g., deposit, 

withdrawal, or adjustment);  

(C) Name or other identifier of the patron for 

restricted patron deposit accounts;  

(D) The unique account identifier;  

(E) Patron signature for withdrawals, unless a 

secured method of access is utilized;  

(F) Date and time of transaction;  

(G) Dollar amount of transaction;  

(H) Nature of deposit, withdrawal, or 

adjustment (e.g., cash, check, chips); and  

(I) Signature of the agent processing the 

transaction.  

(iv) When a patron deposits or withdraws funds 

from a patron deposit account electronically, 

the following shall be recorded and reported:  

(A) Date and time of transaction;  

(B) Location (e.g., player interface, kiosk);  

(C) Dollar amount of transaction; and  

(D) The unique account identifier.  

(v) Detailed patron deposit account transaction 

records must be available to the patron upon 

reasonable request.  

(vi) If electronic funds transfers are made to or 

from a gaming operation bank account for 

patron deposit account funds, the bank account 

must be dedicated and may not be used for any 

other types of transactions.  

NIGC Comments to TGWG Proposed Regulation 

Effect of 2010 Draft Regulation: Provisions for patron deposit accounts can be found in § 

543.7(g) of the 2010 draft regulations and is intended to provide controls for the establishment 

and maintenance of patron deposit accounts. These deposit accounts are typically used for 

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 4 of 7 NIGC VERSION 

 11/30/2011 

wagering activities and are considered monies owed to the patrons who established them. The 

regulation is also consistent with Title 31, Bank Secrecy Act parts103.28 and 36, which requires 

gaming operations to maintain certain records and verify identification when establishing casino 

accounts including patron deposit accounts. 

Effect of TGWG Proposal: The proposed standards appear to create two different types of patron 

deposit accounts; unrestricted and restricted. The restricted accounts appear to be consistent with 

NIGC regulation part 543.7(g) and Title 31 of the Bank Secrecy Act. However, it appears that 

unrestricted patron deposit accounts may not be consistent with our regulation or Title 31 as they 

do not require the verification of identification when establishing such accounts. Also, the 

inclusion of “Agent” within the proposed standard is ambiguous and provides no guidance to the 

tribes on whether the agent is a Class II vendor representative or an employee of the gaming 

operation. The definition of “Agent,” as included in 543.2, may not be consistent with NIGC 

regulation 25 CFR part 556, Background Investigations for Primary Management Officials and 

Key Employees. 

TGWG Guidance 

(f) Patron Deposit Accounts and Cashless Systems.  

 (1) When patron deposit accounts and cashless systems are used in conjunction with 

Class II gaming, controls should be established to prevent unauthorized access, misappropriation, 

forgery or fraud, and to secure the system and accounts in accordance with MICS 543.16 (What 

are the minimum internal control standards for the Security and Management of Server, Server 

Software, and Data Associated with Class II Gaming Systems) and the guidance provided in the 

associated document.  

 (2) Each Patron Deposit Account must be uniquely identified with an account identifier 

(“Account ID”) which is intended to serve as a secure method of access.  

 (3) Patron deposit accounts may be unrestricted or restricted to a specific patron and each 

must be controlled in the manner identified subsections (g) and (h) of this document respectively. 

NIGC Comment to TGWG Guidance 

The use of “should” rather than “shall” or “must” in the guidance could lead the reader to believe 

that the standard is not required by the MICS but that it is recommended. Otherwise guidance 

appears relevant except for the use of “unrestricted” patron deposit accounts. 

TGWG Guidance 

 (g) Restricted Patron Deposit Accounts.  

 (1) In the case of restricted patron deposit accounts, in return for giving personal details 

to the gaming operation (required for restricted accounts), the patron may acquire a patron deposit 

account that may be used to play Class II games.  

 (2) In the case of restricted patron deposit accounts, the account holder has greater 

redress in the case of a lost or stolen card.   

 (3) In order to acquire a restricted patron deposit account, the patron must appear at the 

gaming operation in person, at a designated area of accountability, and present a valid 

government issued picture identification credential.   

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 5 of 7 NIGC VERSION 

 11/30/2011 

 (4) An agent must examine the patron’s identification and record, at a minimum, the 

following information:  

 (i) Type, number, and expiration date of the identification;   

 (ii) Patron’s name;   

 (iii) A unique account identifier;   

 (iv) Date the account was opened; and   

 (v) Agent’s name.    

 (5) The agent must require the patron to sign the account documentation before the 

account is activated.  Signatures may be collected electronically or manually and should be 

maintained for the life of the patron deposit account including data retention periods.  

 (6) The agent or cashless system shall provide the patron deposit account holder with a 

secure method of access such as an account ID and PIN or similarly secured access method. 

NIGC Comment to TGWG Guidance 

The use of “should” rather than “shall” or “must” in the guidance could lead the reader to believe 

that the standard is not required by the MICS but that it is recommended. The inclusion of 

“Agent” within the proposed standard is ambiguous and provides no guidance to the tribes on 

whether the agent is a Class II vendor representative or an employee of the gaming operation. 

Also the definition of “Agent,” as included in 543.2, may not be consistent with NIGC regulation 

25 CFR Part 556, Background Investigations for Primary Management Officials and Key 

Employees. Otherwise guidance appears relevant. 

TGWG Guidance 

 (h) Unrestricted Patron Deposit Accounts.  

 (1) Unrestricted patron deposit account holders do not have to provide personal details to 

acquire an account.   

 (2) In the case of an unrestricted patron deposit account, the account holder necessarily 

has less redress in the event of a lost card because it is treated in a manner similar to a voucher.  

 (3) Controls should require disclosure of the risks associated with the use of unrestricted 

patron deposit accounts, as required by 543.7(g) (i.e., lack of recourse, accessible by anyone with 

the account number, among others).  Advising patrons of this information may be done in a 

variety of methods such as, by facility signage, posted rules, imprint on the account access 

medium (e.g., card, fob, among others), and/or a handout or receipt at the time the account is 

established.    

 (4) Controls should require patron acceptance of the risks associated with the use of 

unrestricted patron deposit accounts, as required by 543.7(g).  Acknowledgement and acceptance 

of the risks may be accomplished in a variety of ways, i.e., by use of the account; by accepting a 

form advising the patron of same at the time the account is established; by accepting the means of 

account access; by verbalizing acceptance; or by signing an acknowledgment form, among other 

means.  

 (5) Patrons must be provided access to their accounts on the host system.  Such access 

may be provided from the player interface or via some other mechanism or manner of access; 

e.g., by the insertion of a plastic card, with a machine-readable secure account ID number, into a 

Kiosk; by the manual input of the account number via a player interface onboard keypad; by the 

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 6 of 7 NIGC VERSION 

 11/30/2011 

use of an account access medium; or in any other manner authorized.  

 (6) An account ID may be associated to an account access media such as magnetic striped 

cards or any other medium that allows the Patron to access or interact with their account.  

  (7) Best practice suggests that the gaming operation should exercise care in selecting 

technology for accessing patron deposit accounts that is designed to protect the account ID from 

unauthorized access, fraud, and forgery.  

 (i) This may require that technical standards are in place to provide an adequate level of 

security.  

 (ii) At a minimum such standards should provide that the account ID must access the 

appropriate patron deposit account.  

NIGC Comment to TGWG Guidance 

The guidance appears to create two different types of patron deposit accounts; unrestricted and 

restricted. The restricted accounts appear to be consistent with NIGC regulation part 543.7(g) and 

Title 31 of the Bank Secrecy Act. However, it appears that unrestricted patron deposit accounts 

may not be consistent with the NIGC regulation or Title 31 as they do not require the verification 

of identification when establishing such accounts. Under the general conditions of the BSA it 

would not appear that a gaming operation can avoid the requirements by simply asking a patron 

to acknowledge these risks, whether in writing or verbally. Also, the use of “should” rather than 

“shall” or “must” in the guidance could lead the reader to believe that the standard is not required 

by the MICS but that it is recommended. 

TGWG Guidance 

 (i) Patron Deposits, Withdrawals and Adjustments.   

 (1) Cash and cash equivalents.  Controls should be established for patron deposit 

accounts and cashless system transactions involving cash or cash equivalents in accordance with 

MICS 543.14 (What are the minimum internal control standards for cage, vault, cash, and cash 

equivalents?) and the guidance provided in the associated document.  Procedures should also 

comply with all applicable federal regulations (e.g., IRS code, Title 31, among others).  

 (2) Controls should be in place to govern patron deposit account deposits and 

withdrawals.   

 (i) Prior to the patron making a deposit into a patron deposit account, the agent or 

cashless system must verify the identity of the patron deposit account and, for restricted accounts, 

the patron’s identity.  Reliance on a secured personal identification number (PIN) entered by the 

patron is an acceptable method of verifying patron identity.  

 (ii) Prior to the patron making a withdrawal from a patron deposit account, the agent or 

cashless system must verify the identity of the patron deposit account and availability of funds for 

withdrawal.   

 (3) Adjustments made to the patron deposit accounts must be performed by an authorized 

agent.   

 (4) When a deposit, withdrawal or adjustment is processed by an agent, a multi-part 

transaction record must be created containing the following information:   

 (i)  Same document number on all copies;  

 (ii) Type of transaction, (e.g., deposit, withdrawal, or adjustment);  

§ 543.11 What are the minimum internal control standards for 

patron deposit accounts and cashless systems? 

 Comparison of July TGWG Submission to July 2010 Draft MICS 

Page 7 of 7 NIGC VERSION 

 11/30/2011 

 (iii) Name or other identifier of the patron for restricted patron deposit accounts;  

 (iv) The unique account identifier;  

 (v) Patron signature for withdrawals, unless a secured method of access is utilized;  

 (vi) Date and time of transaction;  

 (vii) Dollar amount of transaction;  

 (viii) Nature of deposit, withdrawal, or adjustment (e.g., cash, check, chips); and  

 (ix) Signature of the agent processing the transaction.  

 (5) When a patron deposits or withdraws funds from a patron deposit account 

electronically, the following shall be recorded and reported:  

 (i) Date and time of transaction;  

 (ii) Location (e.g., player interface, kiosk);  

 (iii) Dollar amount of transaction;  

 (iv) The unique account identifier;  

 (v)  Detailed patron deposit account transaction records must be available to the patron 

upon reasonable request; and  

 (vi) If electronic funds transfers are made to or from a gaming operation bank account for 

patron deposit account funds, the bank account must be dedicated.  To prevent commingling of 

gaming operation funds with patron fund the bank account may not be used for any other types of 

transactions.   

NIGC Comment to TGWG Guidance 

The use of “should” rather than “shall” or “must” in the guidance could lead the reader to believe 

that the standard is not required by the MICS but that it is recommended. The inclusion of 

“Agent” within the proposed standard is ambiguous and provides no guidance to the tribes on 

whether the agent is a Class II vendor representative or an employee of the gaming operation. 

Also the definition of “Agent” as included in 543.2 may not be consistent with NIGC regulation 

25 CFR 556, Background Investigations for Primary Management Officials and Key Employees. 

Otherwise guidance appears relevant. 

TGWG Guidance 

 (j) Audit and Accounting.    

 (1) When Patron Deposit Accounts and Cashless Systems are used in conjunction with 

Class II gaming then controls must be established for audit and accounting in accordance with 

MICS 543.19 (What are the minimum internal control standards for Audit and Accounting?) and 

the guidance provided in the associated document.  

(2) Best practice suggests that each operational area secure daily audit and accounting records, 

forms, and documents prior to audit.  For example, a cashier may place records in a locked box 

for next-day delivery to accounting for audit. 

NIGC Comment to TGWG Guidance 

 The Guidance in (1) is a general comment applicable to any section while that in (2) is 

related to one of many standards that could be provided and is out of place in relation to (1).