Code of Massachusetts Regulations › 205 CMR - MASSACHUSETTS GAMING COMMISSION › Title 205 CMR 238.00 - Additional Uniform Standards of Accounting Procedures and Internal Controls for Sports Wagering › Section 238.02 - Sports Wagering Operator's System of Internal Controls

Current through Register 1525, July 5, 2024
(1) At least 45 days prior to commencing
			 operations, a Sports Wagering Operator shall submit to the Commission its
			 proposed system of Internal Controls, consisting of procedures and
			 administrative and accounting controls, in accordance with
			 205
			 CMR 238.02(4). An Operations
			 Certificate shall not issue until the Operator's Internal Controls are approved
			 in accordance with
			 205
			 CMR 238.02(2).
(2) A system of Internal Controls shall be
			 organized and formatted as required by the Commission.
(3) The Commission shall refer the proposed
			 system of Internal Controls submitted in accordance with
			 205
			 CMR 238.02(1)  to the
			 Executive Director, who shall review the submission for compliance with M.G.L.
			 c. 23N and 205 CMR. Upon completion of review, the Executive Director shall, in
			 writing, either approve the submission or advise the Sports Wagering Operator
			 of any deficiency, and any corresponding recommendation or required change. The
			 Executive Director may include any other recommendations or required changes
			 intended to ensure that a robust system of Internal Controls is implemented by
			 the Sports Wagering Operator. The Sports Wagering Operator may, by writing to
			 the Executive Director, either accept a recommendation or required change or
			 dispute the recommendation or required change. If the Sports Wagering Operator
			 disputes the recommendation or required change, the Sports Wagering Operator
			 shall also provide the reason(s) for its dispute. Any such dispute shall be
			 resolved by the Commission.
(4) The
			 Commission or the Executive Director may revisit any provision of a Sports
			 Wagering Operator's Internal Controls at any time and render recommendations
			 and required changes as necessary. If the Commission or Executive Director
			 renders any such recommendations and required changes, the Commission or
			 Executive Director shall provide the Sports Wagering Operator a reasonable
			 period to implement any such recommendations and required changes. Upon
			 approval by the Executive Director, the Executive Director shall issue a
			 written approval to the Sports Wagering Operator, including any associated
			 conditions.
(5) If a Sports
			 Wagering Operator seeks to change any provision of its approved Internal
			 Controls, the Sports Wagering Operator shall submit the proposed change,
			 including an explanation thereof, and new certifications from its chief legal
			 and financial officers consistent with
			 205
			 CMR 238.02(7)(i) and (j), to
			 the Commission within 15 days of determining that such a change is necessary.
			 The Commission shall refer the proposed change to the Executive Director who
			 shall review the proposal for compliance with
			 205 CMR
			 238.00. Changes to the system of Internal Controls
			 will generally be permitted if the proposed change does not lessen the
			 applicable administrative, accounting, or physical control the Sports Wagering
			 Operator has over its operations in the Commonwealth. Upon completion of
			 review, the Executive Director shall either approve the proposed change or
			 advise the Sports Wagering Operator in writing as to why the proposal does not
			 comply with
			 205 CMR
			 238.00. The Sports Wagering Operator may appeal the
			 Executive Director's determination to the Commission, which shall resolve the
			 dispute. Approved changes shall be maintained as part of the approved Internal
			 Controls.
(6) A Sports Wagering
			 Operator shall not implement modifications to Internal Controls until approved
			 by the Executive Director or the Commission. Until such time, the Sports
			 Wagering Operator shall continue to implement the most recently approved
			 Internal Controls; provided, however, that if the Executive Director does not
			 object to or otherwise respond to the submission in writing within 15 business
			 days of receipt of the submission, the Sports Wagering Operator may implement
			 the proposed change subject to further direction by the Executive Director in
			 accordance with
			 205
			 CMR 238.02(4).
(7) The Internal Controls shall, at a
			 minimum, include the following:
(a)
			 Administrative controls which include, as their primary objective, policies and
			 procedures designed to assure that all activities and transactions of the
			 Sports Wagering Operator are instituted and completed in accordance with
			 applicable policy or procedure;
(b)
			 Accounting controls which include, as their primary objective, procedures to
			 assure that all activities and transactions of the Sports Wagering Operator are
			 accurately reported and recorded in accordance with generally accepted
			 accounting principles;
(c)
			 Reporting controls which include policies and procedures for the timely
			 furnishing of economic and social impact reports, and standard financial and
			 statistical reports and information in accordance with 205 CMR, and the
			 continuing disclosure and reporting obligations of licensees;
(d) For Category 1 Sports Wagering Operators
			 and Category 2 Sports Wagering Operators, the Internal Controls required for a
			 gaming establishment as specified in
			 205 CMR
			 138.00:
Uniform Standards of Accounting
			 Procedures and Internal Controls
shall apply to a Sports Wagering Area
			 and Sports Wagering Facility. Where compliance with the provisions of both
			 205 CMR
			 138.00 and
			 205 CMR
			 238.00 is not possible, a Gaming Licensee or Sports
			 Wagering Operator shall comply with
			 205 CMR
			 138.00 with respect to gaming operations and
			 205 CMR
			 238.00 with respect to Sports Wagering Operations and
			 identify its intent to do so in its written system of Internal Controls;
			 provided, that:
1. in a Category 2 Sports
			 Wagering Facility, an individual supervising a surveillance department
			 monitoring room in accordance with
			 205
			 CMR 138.04(2)(a)  shall hold
			 an Occupational License in accordance with
			 205 CMR
			 235.00 rather than being licensed as a key gaming
			 employee in accordance with
			 205 CMR
			 134.00:
Licensing and Registration of
			 Employees, Vendors, Junket Enterprises and Representatives, and Labor
			 Organizations
;
2. in a
			 Category 2 Sports Wagering Facility, the security department internal control
			 procedures required by
			 205
			 CMR 138.14:
Internal Control
			 Procedures for Security Department
shall include a requirement that
			 the facility be protected by security staff at all times, including overnight;
			 and
3. in a Category 2 Sports
			 Wagering Facility, the floor plan required by
			 205
			 CMR 138.07:
Floor Plans
shall depict adequate space for law enforcement officers; for the Bureau and
			 Sports Wagering Division; and for designated agents for the purposes of
			 205 CMR
			 133.00 and
			 233.00;
(e) Access controls which include, as their
			 primary objective, the safeguarding of the Operator's assets, including but not
			 limited to, organizational safeguards, such as segregation of duties between
			 incompatible functions, and physical safeguards, such as restricted access to
			 assets and routine security devices such as cameras and locking doors. Such
			 access controls shall be consistent with the requirements in
			 205 CMR
			 141.00:
Surveillance of the Gaming
			 Establishment
regarding surveillance of gaming
			 establishments;
(f) An
			 infrastructure and data security plan which employs technical security controls
			 as described in
			 205
			 CMR 243.01:
Standards for Sports
			 Wagering Equipment
;
(g) A
			 plan to ensure compliance with
			 205 CMR
			 240.00:
Adjusted Gross Sports Wagering and
			 Adjusted Gross Fantasy Wagering Receipts Tax Remittance and Reporting
with respect to tax remittance and reporting;
(h) All applicable policies and procedures
			 required pursuant to
			 205
			 CMR 238.04 through
			 238.72 and procedures and
			 practices specified in
			 205 CMR
			 243.00:
Standards for Sports Wagering
			 Equipment
;
(i) A
			 certification by the Sports Wagering Operator's chief legal officer that the
			 submitted Internal Controls conform to M.G.L. c. 23N,
			 205
			 CMR 238.01, and any applicable regulations
			 referenced therein;
(j) A
			 certification by the Sports Wagering Operator's chief financial officer that
			 the submitted Internal Controls provide adequate and effective controls,
			 establish a consistent overall system of internal procedures and administrative
			 and accounting controls, and conform to generally accepted accounting
			 principles and 205 CMR;
(k) A plan
			 to ensure compliance with the Operator's House Rules, including House Rules
			 that comply with
			 205 CMR
			 243.00:
Sports Wagering
			 Equipment
.
(l) A plan, as
			 required by
			 205 CMR
			 257.00:
Data Privacy
, to safeguard
			 Confidential Information and Personally Identifiable Information and to ensure
			 compliance with the requirements of
			 205 CMR
			 257.00, M.G.L. c. 93H, M.G.L. c. 93I,
			 201 CMR
			 17.00:
Standards for the Protection of
			 Personal Information of Residents of the Commonwealth
, and any other
			 applicable law, regulation or order of a governmental body regarding data
			 privacy and security; and
(m) A
			 description of the Operator's use of computerized algorithms, automated
			 decision-making, machine learning, artificial intelligence, or any similar
			 system, which shall include, at a minimum a description of permissible and
			 impermissible uses of such practices and capabilities, the purposes for which
			 they are used and the types of input and output data and an accounting of the
			 source of each, and a description of how the Operator may use such systems to
			 minimize risky play behavior.