205 CMR 238.00 — Additional uniform standards of accounting procedures and internal controls for sports wagering

205 CMR: MASSACHUSETTS GAMING COMMISSION 205 CMR 238.00: ADDITIONAL UNIFORM STANDARDS OF ACCOUNTING PROCEDURES AND INTERNAL CONTROLS FOR SPORTS WAGERING Section

205 CMR 238.00 Additional uniform standards of accounting procedures and internal controls for sports wagering

238.01 Definitions

238.01: Definitions

238.02 Sports Wagering Operator's System of Internal Controls

238.02: Sports Wagering Operator's System of Internal Controls

238.03 Records Regarding Company Ownership

238.03: Records Regarding Company Ownership

238.04 Sports Wagering Operator's Organization

238.04: Sports Wagering Operator's Organization

238.05 System for Ensuring Employees Are Properly Licensed or Registered

238.05: System for Ensuring Employees Are Properly Licensed or Registered

238.06 System for Business Dealings with Sports Wagering Vendors

238.06: System for Business Dealings with Sports Wagering Vendors

238.07 Information Security Responsibilities

238.07: Information Security Responsibilities

238.08 Accounting Records

238.08: Accounting Records

238.09 Retention, Storage and Destruction Records

238.09: Retention, Storage and Destruction Records

238.10 Jobs Compendium Submission

238.10: Jobs Compendium Submission

238.11 Personnel Assigned to the Operation and Conduct of Sports Wagering

238.11: Personnel Assigned to the Operation and Conduct of Sports Wagering

238.12 Reserve Requirement

238.12: Reserve Requirement

238.13 Complimentary Services or Items and Promotional Gaming Credits

238.13: Complimentary Services or Items and Promotional Gaming Credits

238.14 Risk Management Framework

238.14: Risk Management Framework

238.15 Taxation Requirements

238.15: Taxation Requirements

238.16 Bank Secrecy Act Compliance

238.16: Bank Secrecy Act Compliance

238.17 Anti-Money Laundering (AML) Monitoring

238.17: Anti-Money Laundering (AML) Monitoring

238.18 Integrity Monitoring/Suspicious Behavior

238.18: Integrity Monitoring/Suspicious Behavior

238.19 Responsible Gaming and Problem Gaming Plan

238.19: Responsible Gaming and Problem Gaming Plan

238.20 Protection of Minors and Underage Youth

238.20: Protection of Minors and Underage Youth 238:21: Patron Protection Information

238.22 Complaints Pertaining to Sports Wagering

238.22: Complaints Pertaining to Sports Wagering

238.23 Sports Wagering Counter

238.23: Sports Wagering Counter

238.24 Gaming Day

238.24: Gaming Day

238.25 Accounting Controls within the Sports Wagering Counter

238.25: Accounting Controls within the Sports Wagering Counter

238.26 Procedures for Acceptance of Tips or Gratuities from Patrons

238.26: Procedures for Acceptance of Tips or Gratuities from Patrons

238.27 Prohibition of Credit Extension

238.27: Prohibition of Credit Extension

238.28 Events, Odds and Result Management

238.28: Events, Odds and Result Management

238.29 Monitoring the Sports Wagering Activities

238.29: Monitoring the Sports Wagering Activities

238.30 Acceptance of Sports Wagers

238.30: Acceptance of Sports Wagers

238.31 In-Game or In-Play Wagering

238.31: In-Game or In-Play Wagering

238.32 Restricted Patrons

238.32: Restricted Patrons

238.33 Prohibited Persons

238.33: Prohibited Persons

238.34 Layoff Wagers

238.34: Layoff Wagers

238.35 Cancelled or Voided Wagers

238.35: Cancelled or Voided Wagers

238.36 Accounting Controls for Sports Wagering Kiosks

238.36: Accounting Controls for Sports Wagering Kiosks

238.37 Sports Wagering Equipment

238.37: Sports Wagering Equipment

238.38 Change Management

238.38: Change Management

238.39 Sports Wagering Accounts

238.39: Sports Wagering Accounts

238.40 Test Accounts

238.40: Test Accounts

238.41 Sports Wagering Accounting Requirements

238.41: Sports Wagering Accounting Requirements

238.42 Commission Access to Sports Wagering Data

238.42: Commission Access to Sports Wagering Data

238.43 Reports of Sports Wagering Operations

238.43: Reports of Sports Wagering Operations

238.44 Data and Network Security Requirements

238.44: Data and Network Security Requirements

238.45 Confidential Information and Personally Identifiable Information Security

238.45: Confidential Information and Personally Identifiable Information Security

238.46 Reprints of Sports Wagering Tickets and Vouchers

238.46: Reprints of Sports Wagering Tickets and Vouchers

238.47 Validation and Payout of Sports Wagering Tickets and Vouchers

238.47: Validation and Payout of Sports Wagering Tickets and Vouchers

238.48 Expiration of Sports Wagering Tickets and Vouchers; Payment to the Sports Wagering Control

238.48: Expiration of Sports Wagering Tickets and Vouchers; Payment to the Sports Wagering Control Fund

238.49 Entertainment, Filming or Photography within the Sports Wagering Area or Sports Wagering

238.49: Entertainment, Filming or Photography within the Sports Wagering Area or Sports Wagering Facility

238.50 Policies and Procedures for Ensuring a Workplace Free from Unlawful Discrimination,

238.50: Policies and Procedures for Ensuring a Workplace Free from Unlawful Discrimination, Harassment and Retaliation (Mass. Register #1572, 04/24/2026)

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.01 Definitions

238.01: Definitions As used in 205 CMR 238.00, the following words and phrases shall have the following meanings, unless the context clearly indicates otherwise: Cash means currency or coin. Cash Equivalent means a certified check, cashier's check, treasurer's check, personal check, travelers' check, money order, or other instrument as specified by the Commission. Check means as defined in M.G.L. c. 106, §§ 3 through 104. Chief Sports Wagering Executive means the individual responsible for the daily conduct of a Sports Wagering Operator's business. Unless the Chief Sports Wagering Executive also serves as the Chief Executive Officer of the Sports Wagering Operator, the Chief Sports Wagering Executive shall report directly to the Chief Executive Officer of the Sports Wagering Operator. Confidential Information means information related to a Sports Wagering Account, the placing of any Wager or any other sensitive information related to the operation of Sports Wagering including the amount credited to, debited from, withdrawn from, or present in any particular Sports Wagering Account; the amount of money Wagered by a particular patron on any event or series of events; the unique patron ID or username and authentication credentials that identify the patron; the identities of particular Sporting Events on which the patron is Wagering or has Wagered; or the location from which the patron is Wagering, has Wagered, or has accessed their Sports Wagering Account. Confidential Information may also include Personally Identifiable Information. Personally Identifiable Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular patron, individual or household. Personally Identifiable Information includes, but is not limited to, Personal Information as that phrase is defined in M.G.L. c. 93H and 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth. Personally Identifiable Information may also include Confidential Information. Segregated Account means a financial account that segregates funds owned by patrons and that is restricted to funds owned by patrons in the United States, and not comingled with the Sports Wagering Operator's operational funds. Sports Wagering Counter means any a window in a structure approved by the Commission within a Gaming Establishment or Sports Wagering Facility from which a Ticket Writer conducts Sports Wagering transactions. Sports Wagering Liability means the amounts accepted by the Sports Wagering Operator on Sports Wagers whose outcomes have not been determined and amounts owed but unpaid on winning Sports Wagering tickets or vouchers. Ticket Writer means a person assigned the responsibility for the operation of a Ticket Writer Station. Ticket Writer Station means a point of sale used by a Ticket Writer for the execution or formalization of Sports Wagers placed on behalf of a patron.

238.02 Sports Wagering Operator's System of Internal Controls

238.02: Sports Wagering Operator's System of Internal Controls (1) At least 45 days prior to commencing operations, a Sports Wagering Operator shall submit to the Commission its proposed system of Internal Controls, consisting of procedures and administrative and accounting controls, in accordance with 205 CMR 238.02(4). An Operations Certificate shall not issue until the Operator's Internal Controls are approved in accordance with 205 CMR 238.02(2). (2) A system of Internal Controls shall be organized and formatted as required by the Commission. (3) The Commission shall refer the proposed system of Internal Controls submitted in accordance with 205 CMR 238.02(1) to the Executive Director, who shall review the submission for compliance with M.G.L. c. 23N and 205 CMR. Upon completion of review, the Executive

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.02 continued

238.02: continued Director shall, in writing, either approve the submission or advise the Sports Wagering Operator of any deficiency, and any corresponding recommendation or required change. The Executive Director may include any other recommendations or required changes intended to ensure that a robust system of Internal Controls is implemented by the Sports Wagering Operator. The Sports Wagering Operator may, by writing to the Executive Director, either accept a recommendation or required change or dispute the recommendation or required change. If the Sports Wagering Operator disputes the recommendation or required change, the Sports Wagering Operator shall also provide the reason(s) for its dispute. Any such dispute shall be resolved by the Commission. (4) The Commission or the Executive Director may revisit any provision of a Sports Wagering Operator's Internal Controls at any time and render recommendations and required changes as necessary. If the Commission or Executive Director renders any such recommendations and required changes, the Commission or Executive Director shall provide the Sports Wagering Operator a reasonable period to implement any such recommendations and required changes. Upon approval by the Executive Director, the Executive Director shall issue a written approval to the Sports Wagering Operator, including any associated conditions. (5) If a Sports Wagering Operator seeks to change any provision of its approved Internal Controls, the Sports Wagering Operator shall submit the proposed change, including an explanation thereof, and new certifications from its chief legal and financial officers consistent with 205 CMR 238.02(7)(i) and (j), to the Commission within 15 days of determining that such a change is necessary. The Commission shall refer the proposed change to the Executive Director who shall review the proposal for compliance with 205 CMR 238.00. Changes to the system of Internal Controls will generally be permitted if the proposed change does not lessen the applicable administrative, accounting, or physical control the Sports Wagering Operator has over its operations in the Commonwealth. Upon completion of review, the Executive Director shall either approve the proposed change or advise the Sports Wagering Operator in writing as to why the proposal does not comply with 205 CMR 238.00. The Sports Wagering Operator may appeal the Executive Director's determination to the Commission, which shall resolve the dispute. Approved changes shall be maintained as part of the approved Internal Controls. (6) A Sports Wagering Operator shall not implement modifications to Internal Controls until approved by the Executive Director or the Commission. Until such time, the Sports Wagering Operator shall continue to implement the most recently approved Internal Controls; provided, however, that if the Executive Director does not object to or otherwise respond to the submission in writing within 15 business days of receipt of the submission, the Sports Wagering Operator may implement the proposed change subject to further direction by the Executive Director in accordance with 205 CMR 238.02(4). (7) The Internal Controls shall, at a minimum, include the following: (a) Administrative controls which include, as their primary objective, policies and procedures designed to assure that all activities and transactions of the Sports Wagering Operator are instituted and completed in accordance with applicable policy or procedure; (b) Accounting controls which include, as their primary objective, procedures to assure that all activities and transactions of the Sports Wagering Operator are accurately reported and recorded in accordance with generally accepted accounting principles; (c) Reporting controls which include policies and procedures for the timely furnishing of economic and social impact reports, and standard financial and statistical reports and information in accordance with 205 CMR, and the continuing disclosure and reporting obligations of licensees; (d) For Category 1 Sports Wagering Operators and Category 2 Sports Wagering Operators, the Internal Controls required for a gaming establishment as specified in 205 CMR 138.00: Uniform Standards of Accounting Procedures and Internal Controls shall apply to a Sports Wagering Area and Sports Wagering Facility. Where compliance with the provisions of both 205 CMR 138.00 and 205 CMR 238.00 is not possible, a Gaming Licensee or Sports Wagering Operator shall comply with 205 CMR 138.00 with respect to gaming operations and 205 CMR 238.00 with respect to Sports Wagering Operations and identify its intent to do so in its written system of Internal Controls; provided, that:

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.02 continued

238.02: continued

1. in a Category 2 Sports Wagering Facility, an individual supervising a surveillance department monitoring room in accordance with 205 CMR 138.04(2)(a) shall hold an Occupational License in accordance with 205 CMR 235.00 rather than being licensed as a key gaming employee in accordance with 205 CMR 134.00: Licensing and Registration of Employees, Vendors, Junket Enterprises and Representatives, and Labor Organizations;
2. in a Category 2 Sports Wagering Facility, the security department internal control procedures required by 205 CMR 138.14: Internal Control Procedures for Security Department shall include a requirement that the facility be protected by security staff at all times, including overnight; and
3. in a Category 2 Sports Wagering Facility, the floor plan required by 205 CMR 138.07: Floor Plans shall depict adequate space for law enforcement officers; for the Bureau and Sports Wagering Division; and for designated agents for the purposes of 205 CMR 133.00 and 233.00; (e) Access controls which include, as their primary objective, the safeguarding of the Operator's assets, including but not limited to, organizational safeguards, such as segregation of duties between incompatible functions, and physical safeguards, such as restricted access to assets and routine security devices such as cameras and locking doors. Such access controls shall be consistent with the requirements in 205 CMR 141.00: Surveillance of the Gaming Establishment regarding surveillance of gaming establishments; (f) An infrastructure and data security plan which employs technical security controls as described in 205 CMR 243.01: Standards for Sports Wagering Equipment; (g) A plan to ensure compliance with 205 CMR 240.00: Adjusted Gross Sports Wagering and Adjusted Gross Fantasy Wagering Receipts Tax Remittance and Reporting with respect to tax remittance and reporting; (h) All applicable policies and procedures required pursuant to 205 CMR 238.04 through 238.72 and procedures and practices specified in 205 CMR 243.00: Standards for Sports Wagering Equipment; (i) A certification by the Sports Wagering Operator's chief legal officer that the submitted Internal Controls conform to M.G.L. c. 23N, 205 CMR 238.01, and any applicable regulations referenced therein; (j) A certification by the Sports Wagering Operator's chief financial officer that the submitted Internal Controls provide adequate and effective controls, establish a consistent overall system of internal procedures and administrative and accounting controls, and conform to generally accepted accounting principles and 205 CMR; (k) A plan to ensure compliance with the Operator's House Rules, including House Rules that comply with 205 CMR 243.00: Sports Wagering Equipment. (l) A plan, as required by 205 CMR 257.00: Data Privacy, to safeguard Confidential Information and Personally Identifiable Information and to ensure compliance with the requirements of 205 CMR 257.00, M.G.L. c. 93H, M.G.L. c. 93I, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and any other applicable law, regulation or order of a governmental body regarding data privacy and security; and (m) A description of the Operator's use of computerized algorithms, automated decision-making, machine learning, artificial intelligence, or any similar system, which shall include, at a minimum a description of permissible and impermissible uses of such practices and capabilities, the purposes for which they are used and the types of input and output data and an accounting of the source of each, and a description of how the Operator may use such systems to minimize risky play behavior. (8) If the Sports Wagering Operator intends to utilize any new technology not identified in its initial Internal Controls proposal, it shall submit the changes to its system of Internal Controls to incorporate the use of any such new technology to the Commission, which shall refer the proposed change to the Executive Director who shall review the proposal in accordance with 205 CMR 238.02(4). (9) (a) If a Sports Wagering Operator seeks to incorporate a provision in its Internal Controls that is not permitted under 205 CMR 238.00, or to exclude a provision required by 205 CMR 238.00, it may petition the Executive Director for permission to do so by including, in its Internal Controls filing, its proposal or petition to change a provision of the Internal Controls in accordance with 238.02(5), along with a citation to the applicable provision of 205 CMR 238.00 and a written explanation as to why the exemption is appropriate. The Executive

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.02 continued

238.02: continued Director may allow the exemption upon a finding that the proposal is at least equivalent to the exemption, identifying the provision of 205 CMR 238.00 from which an exemption was granted and providing the general reason for granting the exemption. (b) In the event that a Sports Wagering Operator is temporarily unable to abide by a provision of its Internal Controls, the Bureau may, upon written request by the Sports Wagering Operator, grant a limited temporary exemption from a provision of the Sports Wagering Operator's Internal Controls, provided that:

1. such exemption shall not to exceed 48 hours;
2. the provision relates to the operation of Sports Wagering; and
3. the exemption is supported by good cause showing that the health, safety or welfare of the public or the integrity of Sports Wagering will not be adversely impacted by the exemption. Where the circumstances warrant, such an exemption may be renewed by the Bureau for one additional 48-hour period. All such requests and determinations shall be documented and submitted to the Executive Director for review as promptly as possible. (10) The Commission and the Bureau may take any steps necessary to investigate and enforce a Sports Wagering Operator's Internal Controls for compliance with 205 CMR 238.00. The Sports Wagering Operator shall, through either independent or internal auditors, periodically compare its approved system of Internal Controls, as written, to the system actually in place and operating for the purpose of identifying areas of noncompliance, if any, so as to take immediate corrective action. (11) The Commission or its designee may perform any inspection necessary in order to determine conformance with the approved Internal Controls. (12) The Sports Wagering Operator shall maintain in its records a complete set of its system of Internal Controls in effect at that time. (13) The Sports Wagering Operator shall submit all filings and records required pursuant to 205 CMR 238.00 electronically to the Commission, unless otherwise directed by the Commission. (14) To the extent a third-party is involved in or provides any of the Internal Controls required pursuant to 205 CMR 238.00, the Sports Wagering Operator's Internal Controls shall document the roles and responsibilities of the third-party and shall include procedures to evaluate the adequacy of and monitor compliance with the third-party's system of Internal Controls.

238.03 Records Regarding Company Ownership

238.03: Records Regarding Company Ownership The Sports Wagering Operator shall maintain all records regarding the Sports Wagering Operator's ownership, as described in 205 CMR at a location determined by the Sports Wagering Operator, provided that the Commission shall be notified of such location. The Commission shall be granted prompt and unfettered access to all such records upon request.

238.04 Sports Wagering Operator's Organization

238.04: Sports Wagering Operator's Organization (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include tables of organization, which shall include the provisions required in 205 CMR 138.04(1). (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include provisions detailing the structure, function, and area of responsibility for the following mandatory departments and supervisory positions: (a) For Category 1 Sports Wagering Operators or Category 2 Sports Wagering Operators, a surveillance department as described in 205 CMR 138.04(2)(a); (b) An internal audit department as described in 205 CMR 138.04(2)(b); (c) An IT department as described in 205 CMR 138.04(2)(c); (d) A Sports Wagering department supervised by an executive who shall be responsible for the management of the Sports Wagering department. The Chief Sports Wagering Executive shall be responsible for the operation and conduct of all Sports Wagering;

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.04 continued

238.04: continued (e) For Category 1 Sports Wagering Operators or Category 2 Sports Wagering Operators, a security department as described in 205 CMR 138.04(2)(e); (f) An accounting department as described in 205 CMR 138.04(2)(f); (g) A compliance committee as described in 205 CMR 138.04(2)(g); and (h) An independent audit committee as described in 205 CMR 138.04(2)(h). Each of the mandatory departments and supervisors shall cooperate with, yet perform its functions independently of, all other mandatory departments and supervisors. (3) All departments required pursuant to 205 CMR 138.04(2) and the Sports Wagering Department shall be supervised at all times by at least one individual who has been licensed in accordance with 205 CMR 235.00: Sports Wagering Occupational Licenses, or is exempt from such licensure under 205 CMR 235.01: Sports Wagering Employees Requiring Occupational Licenses. (4) The chief executives of the surveillance and internal audit departments required by 205 CMR 238.04(2) shall comply with the reporting requirements of 205 CMR 138.04(4). (5) In the event of a vacancy in the chief executive officer position, the Chief Sports Wagering Executive, or any executive position responsible for management of one of the mandatory departments set forth in 205 CMR 238.04(2)(a) through (f), the Sports Wagering Operator shall continue to meet the requirements of 205 CMR 138.00 Uniform Standards of Accounting Procedures and Internal Controls and 205 CMR 238.00. (6) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include, and a Sports Wagering Operator shall maintain on file, a current table of organization delineating the lines of authority for all personnel engaged in the operation of Sports Wagering. The table of organization shall, for each department and division, include direct and indirect lines of authority within the department or division. (7) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan for ensuring that all Sports Wagering employees employed by the Sports Wagering Operator are properly trained in their respective professions. Proper training of a Sports Wagering employee in the respective field for which the Sports Wagering employee is or shall be employed by the Sports Wagering Operator may be established as set forth in 205 CMR 138.04(7).

238.05 System for Ensuring Employees Are Properly Licensed or Registered

238.05: System for Ensuring Employees Are Properly Licensed or Registered (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan for ensuring that all individuals employed by an Operator to perform duties directly related to the operation of Sports Wagering in the Commonwealth in a supervisory role are properly licensed in accordance with 205 CMR 235.00: Sports Wagering Occupational Licensing. The system of Internal Controls shall include, without limitation, the procedures outlined in 205 CMR 138.05(1). (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan for reporting to the Commission on a bi-monthly basis and in a format as directed by the Commission, the information required by 205 CMR 138.05(2) for each individual licensed in accordance with 205 CMR 235.00: Sports Wagering Occupational Licensing.

238.06 System for Business Dealings with Sports Wagering Vendors

238.06: System for Business Dealings with Sports Wagering Vendors (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan for ensuring that all Persons conducting business with a Sports Wagering Operator as a Sports Wagering Vendor are properly licensed or registered in accordance with 205 CMR 234.00: Sports Wagering Vendors, if necessary. The system of Internal Controls shall include, without limitation, the procedures outlined in 205 CMR 138.06(1).

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.06 continued

238.06: continued (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan for providing a Disbursement Report to the Commission on a bi-monthly basis and in a format as directed by the Commission. The Disbursement Report shall reflect, for each Sports Wagering Vendor licensed or registered in accordance with 205 CMR 234.00: Sports Wagering Vendors, the information required by 205 CMR 138.06(2). (3) Each Sports Wagering Operator shall maintain a fully signed copy of every written agreement and records. With respect to every unwritten agreement to which it a Sports Wagering Operator is a party, the Sports Wagering Operator shall provide, at a minimum, the information required by 205 CMR 138.06(3).

238.07 Information Security Responsibilities

238.07: Information Security Responsibilities A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall ensure that an Information Security Management System (ISMS) is effectively implemented and information security function responsibilities are effectively allocated. (1) The Sports Wagering Operator shall implement, maintain, and comply with a comprehensive ISMS, the purpose of which shall be to take reasonable steps to protect the confidentiality, integrity, and availability of Confidential Information and Personally Identifiable Information of individuals that place a Sports Wager or have an account with the Sports Wagering Operator, including all measures required by 205 CMR, M.G.L. c. 93H, M.G.L. c. 93I, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and any other applicable law, regulation or order of a governmental body regarding data privacy and security. (2) The ISMS shall contain administrative, technical, and physical safeguards appropriate to the size, complexity, nature, and scope of the operations and the sensitivity of the Confidential Information and Personally Identifiable Information owned, licensed, maintained, handled, or otherwise in the possession of the Sports Wagering Operator. (3) The Sports Wagering Operator shall establish an information security forum or other organizational structure to monitor and review the ISMS to ensure its continuing suitability, adequacy and effectiveness. The information security forum or other organization structure shall maintain formal minutes of meetings, and convene at least every six months. (4) The Sports Wagering Operator shall maintain an information security department responsible for developing a security strategy in accordance with the overall operation of the Sports Wagering Operation in the Commonwealth. The information security department shall subsequently work with the other departments of the Sports Wagering Operator to implement any plans relative to the protection of Confidential Information and Personally Identifiable Information of individuals that place a Sports Wager or have an account with the Sports Wagering Operator. The information security department shall be involved in reviewing all tasks and processes that are necessary for the Sports Wagering Operator to maintain the security of Personally Identifiable Information and Confidential Information of individuals that place a Sports Wager or have an account with the Sports Wagering Operator, including, but not limited to, the protection of information and data, communications, physical, virtual, personnel, and overall business operational security. (5) The information security department shall report to executive level management or higher and shall be independent of the IT department with regard to the management of security risk. (6) The information security department shall have access to all necessary resources to enable the adequate assessment, management, and reduction of risk. (7) The head of the information security department shall be a full member of the information security forum and be responsible for recommending information security policies and changes to the Sports Wagering Operator.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.08 Accounting Records

238.08: Accounting Records (1) A Sports Wagering Operator shall maintain complete, accurate, and legible records of all transactions pertaining to the revenues and costs for the Sports Wagering Operation, including those required in accordance with M.G.L. c. 23N and 205 CMR. (2) A Sports Wagering Operator shall maintain general accounting records on a double entry system of accounting with transactions recorded on the accrual basis. A Sports Wagering Operator shall also maintain detailed, supporting, subsidiary records sufficient to meet the requirements of M.G.L. c. 23N and 205 CMR.

238.09 Retention, Storage and Destruction Records

238.09: Retention, Storage and Destruction Records (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a records retention schedule, and provisions related to the storage and destruction of records that, at a minimum, incorporates the provisions specified in 205 CMR 138.09(1). In addition, the Operator's records retention schedule shall include provisions by category relative to all Sports Wagering related records and records relative to Sports Wagering Vendors. (2) (a) A Sports Wagering Operator may petition the Commission at any time for approval of a facility to be used to generate or store records required to be retained in accordance with 205 CMR 138.09(1). Such petition shall include:

1. A detailed description of the proposed facility, including location, security and fire safety systems; and
2. The procedures pursuant to which Commission agents will be able to gain access to the records retained at the proposed facility. (b) A Sports Wagering Operator may store any records electronically or via other suitable medium approved by the Commission. (3) A Sports Wagering Operator shall, except as otherwise provided, notify the Commission and the Gaming Enforcement Division of the Massachusetts Attorney General's Office in writing at least 60 days prior to the scheduled destruction of any record required to be retained in accordance with 205 CMR 238.09(1). Such notice shall list each type of record scheduled for destruction, including a description sufficient to identify the records included, the retention period and the date of destruction. (4) The Commission or the Gaming Enforcement Division of the Massachusetts Attorney General's Office may prohibit the destruction of any record required to be retained in accordance with 205 CMR 238.09(1) by notifying the Sports Wagering Operator in writing within 45 days of receipt of the notice of destruction pursuant to 205 CMR 238.09(3) or within the specified retention period. Such original record may thereafter be destroyed only with the consent of the Commission, the Bureau, and the Massachusetts Attorney General's Office. (5) The Sports Wagering Operator may utilize the services of a disposal company for the destruction of any records required to be retained in accordance with 205 CMR 238.09(1). Any cash complimentary coupons to be destroyed by a disposal company shall be cancelled with a void stamp, hole punch or similar device, or must contain a clearly marked expiration date which has expired. (6) Nothing in 205 CMR 238.00 shall be construed as relieving a Sports Wagering Operator from meeting any obligation to prepare or maintain any book, record or document required by any other federal, state or local governmental body, authority or agency or as otherwise required in its capacity as a Gaming Licensee pursuant to M.G.L. c. 23K and 205 CMR.

238.10 Jobs Compendium Submission

238.10: Jobs Compendium Submission A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a jobs compendium detailing job descriptions, chains of command, and lines of authority for all personnel engaged in the operation of Sports Wagering, which meets the provisions specified in 205 CMR 138.10: Jobs Compendium Submission.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.11 Personnel Assigned to the Operation and Conduct of Sports Wagering

238.11: Personnel Assigned to the Operation and Conduct of Sports Wagering Each Sports Wagering Operator shall be required to employ the following personnel in the following manner in the operation of its Sports Wagering regardless of the position titles assigned to such personnel by the Operator in its approved jobs compendium: (1) Each Sports Wagering Operator shall at all times maintain a level of staffing that ensures the proper operation and effective supervision of all Sports Wagering. (2) Each Category 1 Sports Wagering Operator or Category 2 Sports Wagering Operator shall be required to employ a Sports Wagering manager. The Sports Wagering manager shall be the executive assigned the responsibility and authority for the supervision and management of Sports Wagering employees in a Sports Wagering Area or Sports Wagering Facility, including, without limitation, the hiring and termination of all Sports Wagering employees within a Sports Wagering Area or Sports Wagering Facility. (3) The following personnel shall be used to operate Sports Wagering in a Sports Wagering Area or Sports Wagering Facility: (a) Ticket Writers shall be the Persons assigned the responsibility for the operation of a Ticket Writer Station; (b) Sports Wagering supervisors shall be the first level supervisors assigned the responsibility for directly supervising the operation of Sports Wagering in a Sports Wagering Area or Sports Wagering Facility; (c) Sports Wagering shift managers shall be the second level supervisor with the responsibility for the overall supervision of Sports Wagering in a Sports Wagering Area or Sports Wagering Facility for each shift; and (d) The Sports Wagering department manager shall be the executive assigned the responsibility and authority for the supervision and management of the overall operation of the Operator's Sports Wagering Operation. In the absence of the Sports Wagering department manager, the Sports Wagering shift manager shall have the authority of the Sports Wagering department manager.

238.12 Reserve Requirement

238.12: Reserve Requirement (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a plan to maintain and protect sufficient cash and other supplies to conduct Sports Wagering at all times through a reserve in the amount necessary to ensure the security of funds held in Sports Wagering Accounts and the ability to cover the outstanding Sports Wagering liability, including the amounts accepted by the Sports Wagering Operator on Sports Wagers whose outcomes have not been determined and amounts owed but unpaid on winning Sports Wagering tickets or vouchers. The reserve may be in the form of Cash, Cash Equivalents, payment processor reserves, payment processor receivables, an irrevocable letter of credit, a bond, or a combination thereof; provided that the amount of the reserve intended to cover the Sports Wagering liability must be in the form of, or backed up by, an irrevocable letter of credit approved by the Commission and which may be drawn by the Commission in the event of cessation of Sports Wagering Operations in accordance with 205 CMR 258.00. (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall ensure funds in Sports Wagering Accounts, including pending withdrawals, are either:

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.12 continued

238.12: continued (a) Held in trust for the patron in a Segregated Account managed in accordance with 205 CMR 248.00: Sports Wagering Account Management; (b) Held in the form of cash reserves; (c) Backed up by an irrevocable letter of credit approved by the Comission; or (d) A combination of the forms described in 205 CMR 238.12(2)(a) through (c). The amount held pursuant to 205 CMR 238.12 shall be an amount equal to 110% of the total funds held in Sports Wagering Accounts, as estimated and reported the most recent quarter of the Fiscal year. (3) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall implement procedures that are reasonably designed to: (a) Ensure that the funds in the Segregated Account or cash held in reserve do not belong to the Sports Wagering Operator and are not available to creditors other than the patron whose funds are being held; (b) Prevent commingling of funds in the Segregated Account or cash held in reserve with other funds including, without limitation, funds of the Sports Wagering Operator; and (c) Ensure that letters of credit approved by the Commission pursuant to 205 CMR 238.12(2)(c) are not available to creditors of the Sports Wagering Operator, except than as set forth in such letters of credit. (4) A Sports Wagering Operator must have access to all Sports Wagering Accounts and Sports Wager data to ensure the amount of its reserve is sufficient. Unless otherwise directed by the Commission, a Sports Wagering Operator must file a monthly attestation with the Commission, in the form and manner prescribed by the Commission, that funds have been safeguarded in accordance with 205 CMR 238.12. (5) The Commission may audit a Sports Wagering Operator's reserve at any time and may direct a Sports Wagering Operator to take any action necessary to ensure the purposes of 205 CMR 238.12 are achieved, including, but not limited to, requiring the Sports Wagering Operator to modify the form of its reserve or increase the amount of its reserve.

238.13 Complimentary Services or Items and Promotional Gaming Credits

238.13: Complimentary Services or Items and Promotional Gaming Credits A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include a detailed complimentary distribution program consistent with 205 CMR 138.13: Complimentary Services or Items and Promotional Gaming Credits, and a description of its proposed use and distribution of promotional gaming credits, provided that Sports Wagering Operators shall not be required to provide the monthly invoices required by 205 CMR 138.13(4).

238.14 Risk Management Framework

238.14: Risk Management Framework (1) A Sports Wagering Operator must implement risk management procedures. These procedures may be provided in-house by a unit capable of performing this function with appropriate segregation of functions and reporting duties, or by a licensed Sports Wagering Vendor. (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall contain a description of the risk management framework, including, but not limited to: (a) Automated and manual risk management procedures; (b) Employee management, including access controls and segregation of duties; (c) Information regarding identifying and reporting fraud and suspicious conduct; (d) Controls ensuring regulatory compliance;

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.14 continued

238.14: continued (e) Description of Anti-Money Laundering (AML) compliance standards; (f) Description of all software applications that comprise the Sports Wagering Equipment; (g) Description of all types of Sports Wagers available to be offered by the Sports Wagering Operator; (h) Description of the method to prevent past-post Wagers from being placed; (i) Description of all integrated third-party platforms; and (j) Any other information which may be required by the Commission. (3) A Sports Wagering Operator shall file with the Commission, in a manner and form approved by the Commission, a report of any error that occurs in offering an event or Wager or if an unapproved Sporting Event or Wager category is offered to the public.

238.15 Taxation Requirements

238.15: Taxation Requirements (1) The Sports Wagering Operator shall comply with all applicable tax laws and regulations including, without limitation, laws and regulations applicable to tax withholding, and providing information about payouts and withholdings to taxing authorities and to patrons. A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall ensure compliance with all Internal Revenue Service (IRS) requirements. The Sports Wagering Operator shall make tax withholdings and provide tax and revenue reporting as required by the IRS and Department of Revenue. (2) The Sports Wagering Operator shall disclose potential tax liabilities to patrons at the time of award of any payout in excess of limits set by the IRS, whether such payouts are made at a Gaming Establishment, Sports Wagering Facility or via a Sports Wagering Platform. Such disclosures shall include a statement that the obligation to pay applicable taxes on payouts is the responsibility of the patron and that failure to pay applicable tax liabilities may result in civil penalties or criminal liability. Upon written request, the Sports Wagering Operator shall provide patrons with summarized tax information on the patrons' Sports Wagering activities.

238.16 Bank Secrecy Act Compliance

238.16: Bank Secrecy Act Compliance (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall ensure compliance with all provisions of The Bank Secrecy Act of 1970, 31 USC §§ 5311 to 5332, applicable to the operation of Sports Wagering. (2) A Sports Wagering Operator shall, with regard to its Sports Wagering Operation, maintain records related to its compliance with The Bank Secrecy Act of 1970, 31 USC §§ 5311 to 5332, including all currency transaction reports, suspicious activity reports, and any supporting documentation, for a minimum of five years. The Sports Wagering Operator shall provide such records to the Commission and any appropriate law enforcement agencies upon request consistent with the authorization prescribed in The Bank Secrecy Act of 1970, 31 USC §§ 5311 to 5332, and applicable regulations. (3) A Sports Wagering Operator shall provide written notice to the Commission as soon as the Sports Wagering Operator becomes aware of a compliance review that is conducted by the Internal Revenue Service under The Bank Secrecy Act of 1970, 31 USC §§ 5311 to 5332, and involves or impacts the Sports Wagering Operator's Sports Wagering Operation. The Sports Wagering Operator shall provide a copy of the compliance review report or the equivalent to the Commission within ten days of receipt of the report by the Sports Wagering Operator.

238.17 Anti-Money Laundering (AML) Monitoring

238.17: Anti-Money Laundering (AML) Monitoring A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall implement AML procedures and policies that adequately address the risks posed by Sports Wagering for the potential of money laundering and terrorist financing. At a minimum, the AML procedures and policies shall provide for: (1) Controls to assure ongoing compliance with the local AML regulations and standards observed by the Commission pursuant to M.G.L. c. 23K and 23N and 205 CMR;

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.17 continued

238.17: continued (2) Up to date training of employees in the identification of unusual or suspicious transactions; (3) Assigning an individual or individuals to be responsible for all areas of AML by the Sports Wagering Operator, including reporting unusual or suspicious transactions; (4) Use of any automated data processing systems to aid in assuring compliance; and (5) Periodic independent tests for compliance with a scope and frequency as required by the Commission. Logs of all tests shall be maintained and available for Commission inspection upon request.

238.18 Integrity Monitoring/Suspicious Behavior

238.18: Integrity Monitoring/Suspicious Behavior (1) A Sports Wagering Operator shall implement integrity monitoring procedures. These procedures may be provided in-house by a unit capable of performing this function with appropriate segregation of functions and reporting duties, or by a licensed Sports Wagering Vendor. (2) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include provisions for a Sports Wagering Operator to, within a reasonable timeframe approved by the Commission, report the following to the Commission: (a) Any facts or circumstances related to the operation of a Sports Wagering Operator that constitute a violation of state or federal law and also promptly report to the appropriate state or federal authorities any suspicious betting over a threshold set by the Sports Wagering Operator, as approved by the Commission; (b) Any information regarding irregularities in volume or changes in odds that could signal suspicious activities which were identified in accordance with M.G.L. c. 23N, § 12(a)(i); (c) Any information relating to criminal or disciplinary proceedings commenced against the Sports Wagering Operator in connection with its operations; (d) Any information relating to the following, which shall also be reported to the relevant Sports Governing Body:

1. Abnormal betting activity or patterns that may indicate a concern with the integrity of a Sporting Event;
2. Any potential breach of the internal rules and codes of conduct pertaining to Sports Wagering of a relevant Sports Governing Body;
3. Any other conduct that corrupts a betting outcome of a Sporting Event for purposes of financial gain including, but not limited to, match-fixing;
4. Suspicious or illegal Wagering activities, including, but not limited to, use of funds derived from illegal activity, Wagers to conceal or launder funds derived from illegal activity, use of agents to place Wagers, and use of a false identification;
5. Complaints of an athlete engaging in prohibited wagering conduct. (3) A Sports Wagering Operator shall maintain the confidentiality of information provided by a Sports Governing Body, and a Sports Governing Body shall maintain the confidentiality of information provided by a Sports Wagering Operator for purposes of investigating or preventing the conduct described in 205 CMR 238.18(2)(e), unless: (a) disclosure is required by M.G.L. c. 23N, the Commission, other law or court order; (b) disclosure is required by agreement with an applicable players' associations or collective bargaining unit; (c) the Sports Governing Body or Sports Wagering Operator consents to disclosure; (d) disclosure is necessary for the Sports Governing Body to conduct and resolve integrity-related investigations; or (e) the Sports Governing Body deems in its reasonable judgment that disclosure is necessary to maintain the actual or perceived integrity of its sporting events. (4) A Sports Wagering Operator receiving a report of suspicious betting activity may suspend Wagering on Sporting Events or Wager categories identified in the report, and may place a hold on suspicious Wagers while investigating such suspicious Wagers, but may only cancel or void Sports Wagers related to the report after receiving approval from the Commission.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.18 continued

238.18: continued (5) Upon request by the Commission or its designee, a Sports Wagering Operator shall provide remote, read-only access and the necessary software and hardware for the Commission to evaluate or monitor, at a minimum, the Sports Wagering Platform and the following: (a) All reports of abnormal betting activity; (b) If the abnormal betting activity was subsequently determined to be suspicious or illegal Wagering; (c) All reports deemed suspicious or illegal Wagering activity; and (d) The actions taken by the Sports Wagering Operator according to its integrity monitoring procedures. (6) A Sports Wagering Operator shall use commercially reasonable efforts to cooperate with investigations conducted by Sports Governing Bodies or law enforcement agencies, including, but not limited to, using commercially reasonable efforts to provide or facilitate the provision of anonymized betting information and audio or video files relating to Persons placing Wagers pursuant to M.G.L. c. 23N, § 11(h) and (i). All disclosures pursuant to 205 CMR 238.18(5) are subject to the Sports Wagering Operator's obligation to comply with all federal, state and local laws and regulations, including, but not limited to, laws and regulations relating to privacy and Confidential Information or Personally Identifiable Information. (7) If required pursuant to M.G.L. c. 23N, § 11(i) or (j), a Sports Wagering Operator shall share with the Commission or the Sports Governing Body or its designee, in a frequency, form and manner to be approved by the Commission, the anonymized betting information required in M.G.L. c. 23N, § 11(i) with respect to Sports Wagers on Sporting Events of the Sports Governing Body. Nothing in 205 CMR 238.18 shall require a Sports Wagering Operator to provide any information that is prohibited by federal, state or local law or regulation, including, but not limited to, laws and regulations relating to privacy, Confidential Information or Personally Identifiable Information. (8) A Sports Wagering Operator shall maintain records of all integrity monitoring services and activities, including all reports of abnormal or suspicious betting activity and any supporting documentation, for a minimum of five years. (9) The Commission may require a Sports Wagering Operator to provide to the Commission, or to an independent testing laboratory approved by the Commission, any hardware or software necessary for the evaluation of its Sports Wagering offering or to conduct further monitoring of Sports Wagering data.

238.19 Responsible Gaming and Problem Gaming Plan

238.19: Responsible Gaming and Problem Gaming Plan (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall contain a Responsible Gaming and Problem Gaming Plan as set forth in 205 CMR 233.06(6). (2) At least once every three years, each Responsible Gaming and Problem Gaming Plan shall be subject to an independent audit, as assessed by industry standards and performed by a third-party auditor approved by the Commission, which review shall be paid for by the Sports Wagering Operator.

238.20 Protection of Minors and Underage Youth

238.20: Protection of Minors and Underage Youth The system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include the internal policies and procedures as required in 205 CMR 250.00: Protection of Minors and Underage Youth.

238.21 Patron Protection Information

238.21: Patron Protection Information (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall provide for the prominent display of patron protection information outlined in 205 CMR 243.01: Standards for Sports Wagering Equipment, including the telephone number and website for a problem gambling hotline overseen by the department of public health approved by the Commission pursuant to M.G.L. c. 23N, § 4(d)(3).

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.21 continued

238.21: continued (2) The Sports Wagering Operator's mobile application and digital platform shall prominently display the patron protection information upon each entry into the application or platform. (3) The Gaming Establishment or Sports Wagering Facility shall prominently display the patron protection information in locations approved by the Commission.

238.22 Complaints Pertaining to Sports Wagering

238.22: Complaints Pertaining to Sports Wagering A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures for receiving, investigating, responding to and reporting on complaints by patrons. (1) When a patron makes a complaint, the Sports Wagering Operator shall immediately issue a complaint report, setting out: (a) The name of the complainant; (b) The nature of the complaint; (c) The name of the Persons, if any against whom the complaint was made; (d) The date of the complaint; (e) The action taken or proposed to be taken, if any, by the Sports Wagering Operator; and (f) A numerical identifier to differentiate the Operator and date of complaint. (2) All complaints received by a Sports Wagering Operator from a patron, and the Sports Wagering Operator's responses to complaints, shall be retained for at least five years and made immediately available to the Commission upon its request. (3) A Sports Wagering Operator shall investigate and attempt to resolve all complaints made by a patron. (4) A Sports Wagering Operator shall respond to such complaints in writing within ten business days. If the relief requested in the complaint will not be granted, the response to the complaint shall state the reasons with specificity. (5) If the response to a complaint is that more information is needed, the form and nature of the necessary information shall be specifically stated. When additional information is received, further response shall be required within seven business days. (6) In its response, the Sports Wagering Operator shall advise the patron of the patron's right to submit the complaint to the Commission in the form and manner prescribed by the Commission. (7) Unless otherwise directed by the Commission, the Sports Wagering Operator shall promptly notify the Commission of any complaints related to Sports Wagering Accounts, settlement of Sports Wagers, or illegal activity related to Sports Wagering which cannot be resolved to the satisfaction of the patron, and the Sports Wagering Operator's response. Such notification shall include the numerical identifier associated with the complaint and the date of the complaint. (8) Upon receipt of a complaint from a patron or notification of an unresolved complaint from a Sports Wagering Operator, the Commission may conduct an investigation and direct a Sports Wagering Operator to take any corrective action the Commission considers appropriate.

238.23 Sports Wagering Counter

238.23: Sports Wagering Counter The system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include policies and procedures relative to the Sports Wagering Counter. (1) Each Sports Wagering Counter shall: (a) Be designed and constructed to provide adequate security for the materials stored and the activities performed therein. Such design and construction shall be approved by the Commission;

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.23 continued

238.23: continued (b) Include manually triggered silent alarm systems, which shall be connected directly to the monitoring rooms of the surveillance and the security departments; (c) Include one or more Ticket Writer Stations, each of which shall contain:

1. A Ticket Writer's drawer and interface through which financial transactions related to Sports Wagering will be conducted;
2. A permanently affixed number, which shall be visible to the closed circuit television system;
3. Manually triggered silent alarm systems, which shall be connected directly to the monitoring rooms of the surveillance and the security departments; and
4. Full enclosures, unless funds in excess of $30,000 are either secured in a drop safe approved by the Commission or transferred to the vault or cage. (d) Include closed circuit television cameras capable of accurate visual monitoring and recording of any activities, including the capturing of the patron's facial image when conducting transactions at the counter; (e) Have an alarm for each emergency exit door that is not a mantrap; and (f) Include a secure location, such as a vault, for the purpose of storing funds issued by a cage to be used in the operation of Sports Wagering. The vault shall:
5. Be a fully enclosed room, located in an area not accessible to the public;
6. Have a metal door with a locking mechanism that shall be maintained and controlled by the Sports Wagering manager;
7. Have an alarm device that signals the surveillance department whenever the door to the vault is opened; and
8. Have closed circuit television cameras capable of accurate visual monitoring and recording of all activities in the vault. (2) A Sports Wagering Counter shall have an operating balance not to exceed an amount described in the system of internal controls submitted by a Sports Wagering Operator in accordance with 205 CMR 138.02: Account Refusals. Funds in excess of the operating balance shall be transferred to the cage in a secured container by an employee of the counter accompanied by a security officer. Prior to transporting the funds, the security department shall notify the surveillance department that the transfer will take place. The surveillance department shall monitor the transfer. The funds shall be transferred with appropriate documentation.

238.24 Gaming Day

238.24: Gaming Day A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall incorporate a "gaming day" for accounting purposes.

238.25 Accounting Controls within the Sports Wagering Counter

238.25: Accounting Controls within the Sports Wagering Counter A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall detail the accounting controls for the Sports Wagering Counter, which shall include the following: (1) The assets for which each Ticket Writer is responsible shall be maintained on an imprest basis. A Ticket Writer shall not permit any other person to access the Ticket Writer's imprest inventory. (2) A Ticket Writer shall begin a shift with an imprest amount of currency and coin to be known as the "wagering inventory." No funds shall be added to or removed from the Wagering inventory during such shift except: (a) In collection of Sports Wagers; (b) In order to make change for a patron placing a Sports Wager; (c) In collection for the issuance of Sports Wagering vouchers; (d) In payment of winning or properly cancelled or refunded Wagers; (e) In payment of Sports Wagering vouchers; (f) To process deposits or withdrawals to or from a patron's Sports Wagering Account; or (g) In exchanges with the cashier's cage, a satellite cage, or vault supported by proper documentation which documentation shall be sufficient for accounting reconciliation purposes.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.25 continued

238.25: continued (3) A "Wagering Inventory Slip" shall be completed and signed by the Wagering shift manager, and the following information, at a minimum, shall be recorded thereon at the commencement of a shift: (a) The date, time, and shift of preparation; (b) The denomination of currency and coin in the Wagering inventory issued to the Ticket Writer; (c) The total amount of each denomination of currency and coin in the Wagering inventory issued to the Ticket Writer; (d) The Ticket Writer station to which the Ticket Writer is assigned; and (e) The signature of the Wagering shift manager. (4) A Ticket Writer assigned to a Ticket Writer station shall count and verify the Wagering inventory at the vault or other approved location and shall agree the count to the Wagering Inventory Slip. The Ticket Writer shall sign the count sheet attesting to the accuracy of the information recorded thereon. The Wagering inventory shall be placed in a Ticket Writer's drawer and transported directly to the appropriate Ticket Writer station by the Ticket Writer. (5) Whenever funds are transferred from the vault to a Ticket Writer, the Wagering shift manager responsible for the vault shall prepare a two-part Writer Transfer-Out form. Upon completion of the form, the original shall be retained by the vault manager and the duplicate shall be retained by the Ticket Writer. The form shall include, at a minimum, the: (a) Date and time of the transfer; (b) Designation of the vault location; (c) Ticket Writer Station to where the funds are being transferred to; (d) Amount of each denomination being transferred; (e) Total amount of the transfer; (f) Signature of the preparer of the transfer; (g) Signature of the manager verifying and issuing the funds; and (h) Signature of the Ticket Writer verifying and receiving the funds. (6) Whenever funds are transferred from the Ticket Writer to a vault, a two-part Writer Transfer-In form shall be prepared. Upon completion of the form, the original shall be retained by the Ticket Writer and the duplicate shall be immediately returned with the funds to the vault. The form shall include, at a minimum, the: (a) Date and time of the transfer; (b) Designation of the vault location where the funds are being transferred to; (c) Ticket Writer station to where the funds are being transferred from; (d) Amount of each denomination being transferred; (e) Total amount of the transfer; (f) Signature of the Ticket Writer verifying and sending the funds to the vault; and (g) Signature of the manager verifying and receiving the funds. (7) At the conclusion of a Ticket Writer's shift, the Ticket Writer's drawer and its contents shall be transported directly to the vault or to a location approved by the Commission in the Sports Wagering Counter, where the Ticket Writer shall count the contents of the drawer and record the following information, at a minimum, on the Wagering Inventory Slip: (a) The date, time, and shift of preparation; (b) The denomination of currency, coin, gaming chips, where applicable, and coupons in the drawer; (c) The total amount of each denomination of currency, coin, gaming chips, and coupons in the drawer; (d) The total of the Writer Transfer-Out forms; (e) The total of the Writer Transfer-In forms; (f) The total amount in the drawer; and (g) The signature of the Ticket Writer. (8) The Wagering shift manager shall compare the Ticket Writer closing balance to the Wagering Inventory Slip total, record any over or short amount, and sign the Wagering Inventory Slip.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.25 continued

238.25: continued (9) If the Wagering Inventory Slip lists an overage or shortage, the Ticket Writer and the Wagering shift manager shall attempt to determine the cause of the discrepancy in the count. If the discrepancy cannot be resolved, such discrepancy shall be reported to the surveillance department and the Wagering manager or department supervisor in charge at such time. Any discrepancy in excess of $500.00 shall be reported to the Commission. Such report shall include the following: (a) Date on which the discrepancy occurred; (b) Shift during which the discrepancy occurred; (c) Name of the Ticket Writer; (d) Name of the Wagering shift manager; (e) Ticket Writer Station number; and (f) Amount of the discrepancy. (10) Whenever funds are transferred from the vault to the cashier's cage, the Wagering shift manager responsible for the vault shall prepare a two-part Vault Transfer-Out form. Upon completion of the form, the original shall be retained by the vault manager and the duplicate shall be transferred with the funds to the cashier's cage. The form shall include, at a minimum, the: (a) Date and time of the transfer; (b) Designation of the vault location; (c) Designation of the cage location; (d) Amount of each denomination being transferred; (e) Total amount of the transfer; (f) Signature of the preparer of the transfer; (g) Signature of the vault manager verifying and issuing the funds; and (h) Signature of the cage cashier verifying and receiving the funds. (11) Whenever funds are transferred from the cashier's cage to a vault, a two-part Vault Transfer-In form shall be prepared. Upon completion of the form, the original shall be retained by the cage cashier and the duplicate shall be transferred with the funds to the vault. The form shall include, at a minimum, the: (a) Date and time of the transfer; (b) Designation of the vault location where the funds are being transferred to; (c) Cashier location where the funds are being transferred from; (d) Amount of each denomination being transferred; (e) Total amount of the transfer; (f) Signature of the cage cashier verifying and sending the funds to the vault; and (g) Signature of the vault manager verifying and receiving the funds.

238.26 Procedures for Acceptance of Tips or Gratuities from Patrons

238.26: Procedures for Acceptance of Tips or Gratuities from Patrons (1) An employee of a Sports Wagering Operator, other than an Occupational Licensee, may accept a Sports Wagering ticket as a tip Wager so long as the employee did not solicit the Sports Wagering ticket, did not participate in the selection of the Wager and the Sports Wagering ticket is placed into a tip pool. (2) A tip or gratuity may be provided electronically to a dealer or employee of a Sports Wagering Operator upon initiation and authorization by a patron. A Sports Wagering Operator shall include in its Internal Controls the method utilized for the distribution of electronic tips or gratuities and ensure that a report listing all electronic tips shall be available from the system where the transaction occurred. (3) An Occupational Licensee may not accept a tip or gratuity from a patron of the Sports Wagering Operator.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.27 Prohibition of Credit Extension

238.27: Prohibition of Credit Extension A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include controls relating to the prohibition of a Sports Wager, issuance of cash, or deposit of funds into a Sports Wagering Account that is derived from the extension of credit by affiliates or agents of the Sports Wagering Operator pursuant to M.G.L. c. 23N, § 4(d)(2)(viii). For purposes of 205 CMR 238.27, credit shall not be deemed to have been extended where, although funds have been deposited into a Sports Wagering Account, the Sports Wagering Operator is awaiting actual receipt of such funds in the ordinary course of business. (1) Credit providers such as small amount credit contracts (payday lending) shall not be advertised or marketed to patrons. (2) A patron shall not be referred to a credit provider to finance their Sports Wagering activity. (3) Confidential Information and Personally Identifiable Information related to a patron shall not be provided to any credit provider.

238.28 Events, Odds and Result Management

238.28: Events, Odds and Result Management `A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures regarding the selection of the events and for setting and updating the odds, wagering margins or blocking events, as well as for receiving the results from reliable sources. Procedures shall exist for validating accuracy and preventing fraudulent activities. Such procedures shall be based on the respect of integrity, responsible gaming, and ensuring transparency.

238.29 Monitoring the Sports Wagering Activities

238.29: Monitoring the Sports Wagering Activities A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures for monitoring all changes to odds or blocking throughout a Sporting Event, monitoring of the Wager category, events and patron transactions for the detection of irregularities, monitoring of winners over a certain amount of gains, and deposits over a certain size. Such procedures shall also specify thresholds of payment and methods of collection.

238.30 Acceptance of Sports Wagers

238.30: Acceptance of Sports Wagers A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures relative to the Sporting Events and their Wager categories offered for Sports Wagering pursuant to 205 CMR 247.00: Uniform Standards of Sports Wagering. Such procedures shall include the following: (1) The adoption, maintenance and updating of House Rules; (2) Processes for submitting or receiving approval for Sporting Events and Wager categories; (3) Descriptions of the processes for accepting Wagers and issuing payouts, plus any additional controls for accepting Wagers and issuing payouts in excess of $10,000; (4) Descriptions of the processes for accepting multiple Wagers from one patron in a 24-hour cycle, including the process to identify structuring of Wagers to circumvent recording and reporting requirements; (5) Identification of all data sources used in a Sports Wager determination; (6) Description of the processes for line setting and line moving; (7) Procedures to review the completeness, accuracy, reliability, timeliness, and availability of any data feeds used to offer or settle Sports Wagers;

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.30 continued

238.30: continued (8) Processes for submitting or receiving approval for Sports Wagering tournaments, contests, or pools; (9) Procedures for issuance and acceptance of promotional gaming credits for Sports Wagering; and (10) Procedures to identify a Wager or an attempt to Wager above any maximum Wager threshold set by the Sports Wagering Operator that qualifies as unusual or suspicious Wagering. (11) Procedures to provide timely notice to a patron that their wagering activity has been limited, including a specific explanation for the attachment of the limit(s) and identification as to which market(s) are so limited.

238.31 In-Game or In-Play Wagering

238.31: In-Game or In-Play Wagering A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures to assure and monitor the integrity of the in-game or in-play Wagering offering, the results handling and patron protection. Indicative areas for consideration in the procedure for results handling shall include, but not be limited to, time delays, sources of results, and reversal of results. The procedures shall also account for courtsiding prevention mechanisms including a delay in live pictures.

238.32 Restricted Patrons

238.32: Restricted Patrons A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall meet the requirements of 205 CMR 243.01(1)(t) and include the following in accordance with M.G.L. c. 23N, § 11(a): (1) No Sports Wagering Operator, directors, officers, owners, employees, subcontractors, or Qualifiers of the Sports Wagering Operator, as well as those within the same household as any such Person, may place Sports Wagers with the Sports Wagering Operator, or with any other Sports Wagering Operator tethered to the Operator, on any event, except in private pools where the player's association with the Sports Wagering Operator is clearly disclosed. Nor may such individual place Sports Wagers through another person as a proxy or agent. However, Sports Wagering Operator employees may use clearly marked test accounts for testing purposes such as evaluating a Sports Wagering Platform. Sports Wagering Operators shall make these restrictions known to all affected individuals and corporate entities. (2) No individual with proprietary or non-public information held by the Sports Wagering Operator may place Sports Wagers with the Sports Wagering Operator, or with any other Sports Wagering Operator tethered to the Operator. Nor may such individual place Sports Wagers through another person as a proxy or agent. Sports Wagering Operators shall make these restrictions known to all affected individuals and corporate entities. (3) No Sports Wagering Operator shall allow a professional or athlete, coach, referee, team owner, employee of a Sports Governing Body or its member teams and patron and referee union personnel, place Sports Wagers on events in the sport in which the individual participates, or in which the athlete the individual represents participates. Nor may such athlete, sports agent, team official, team representative, referee or league official place Wagers through another person as a proxy or agent. A Sports Wagering Operator may not be held liable for a violation of 205 CMR 238.32(3) if: (a) The Sports Wagering Operator makes commercially reasonable efforts to obtain lists of such Persons for the purpose of implementing 205 CMR 238.32, such as by monitoring for and restricting accounts of such Persons; (b) The Sports Wagering Operator makes these restrictions known to all affected individuals and corporate entities; (c) The Sports Governing Body in which the athlete, sports agent, team official, team representative, referee or league official participates, maintains and enforces a policy that excludes such individuals from placing Wagers in that sport; (d) The Commission has previously used the list of barred employees from the Sports Wagering Operator in accordance with M.G.L. c. 23N, § 11(a)(ii), and worked directly with a member team to determine the risk posed by certain employees for obtaining nonpublic information on a Sporting Event and removed an employee without knowledge of team strategy or game operations from such a list after the Commission determined any such risk is de minimis; and

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.32 continued

238.32: continued (e) The Sports Wagering Operator, upon learning of a violation of 205 CMR 238.32(3), informs the Commission, immediately bars the individual committing the violation from Sports Wagering by suspending such individual's Sports Wagering Account and banning such individual from further Sports Wagering, terminates any existing promotional agreements with such individual and refuses to make any new promotional agreements that compensate such individual. (4) The Sports Wagering Operator shall prevent persons from placing Sports Wagers as agents or proxies for others.

238.33 Prohibited Persons

238.33: Prohibited Persons A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include commercially reasonable methods to prevent a prohibited person from placing a Sports Wager. (1) For the purposes of 205 CMR 238.33, a prohibited person refers to: (a) Any individual prohibited from Sports Wagering pursuant to 205 CMR 152.00: Individuals Excluded from a Gaming Establishment; (b) Any individual prohibited from Sports Wagering pursuant to 205 CMR 250.00: Protection of Minors and Underage Youth from Sports Wagering; (c) Any individual who is self-excluded from Sports Wagering pursuant to 205 CMR 233.00: Sports Wagering Voluntary Self-exclusion; (d) Any individual who is prohibited from or subject to limitations regarding Sports Wagering pursuant to 205 CMR 254.00: Temporary Prohibition from Sports Wagering, and regulations pertaining to play management and limit setting; (e) Any individual Wagering while not in the authorized geographic boundaries within the Commonwealth; (f) Any individual placing Sports Wagers as agents or proxies for others; (g) Any restricted patron Wagering in violation of their restrictions established in 205 CMR 238.32; (h) Any individual Wagering in violation of state, local or federal law; or (i) Other prohibited Persons as determined by the Commission. (2) If a Sports Wagering Operator detects, or is notified of, an individual suspected of being a prohibited Person who has engaged or is engaging in prohibited Sports Wagering, the Sports Wagering Operator, shall use reasonable measures to verify whether the individual is prohibited or not. (3) If the Sports Wagering Operator establishes, by reasonable measures, that the individual is prohibited, the Sports Wagering Operator shall cancel the individual's Sports Wager and confiscate any resulting funds. (4) If the Sports Wagering Operator is unable to establish, by reasonable measures, that the individual is prohibited, then the individual is presumed to not be a prohibited Person for the purposes of 205 CMR 238.33.

238.34 Layoff Wagers

238.34: Layoff Wagers A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures for a Sports Wagering Operator to accept layoff Wagers placed by other Sports Wagering Operators and place layoff Wagers with other Sports Wagering Operators for the purpose of offsetting patron Sports Wagers. (1) The Sports Wagering Operator placing a layoff Wager shall inform the Sports Wagering Operator accepting the Wager that the Wager is being placed by a Sports Wagering Operator and shall disclose the Operator's identity pursuant to M.G.L. c. 23N, § 13(c).

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.34 continued

238.34: continued (2) The Sports Wagering Operator may decline to accept a layoff Wager in its sole discretion. (3) Layoff wagers shall be reported to the Commission.

238.35 Cancelled or Voided Wagers

238.35: Cancelled or Voided Wagers For any transaction where a Sports Wagering Operator may cancel or void a Wager, with or without prior authorization of the Commission, the Sports Wagering Operator shall submit a system of Internal Controls in accordance with 205 CMR 238.02 for voiding Wagers and subsequent allocation of patron funds. Such system shall include, at a minimum, the following: (1) Cancellation of an otherwise validly placed Wager by a Sports Wagering Operator shall be nondiscretionary. A Sports Wagering Operator shall cancel or void a Wager without prior authorization of the Commission under the following circumstances: (a) Any Wager where after a patron has placed a Sports Wager, the Sporting Event is cancelled, postponed or rescheduled to a different date prior to completion of the Sporting Event;

1. In the case of a Wager on a portion of a Sporting Event, that Wager shall be valid when the event is canceled, postponed, or rescheduled if the outcome of the affected portion was determined prior to the cancelation, postponement or rescheduling; or
2. A Sports Wagering Operator may establish a timeframe in which an event may be rescheduled or postponed without canceling the wager. This timeframe shall be tied to specific Sporting Events, subject to the approval of the Commission, and documented in the system of Internal Controls. (b) A change in the venue where a Sporting Event was scheduled to be held occurs after a patron has placed a Sports Wager; (c) Any tier 1 Sports Wager in a non-team event when an individual athlete or competitor fails to participate in a Sporting Event and the outcome of the Wager is solely based upon the individual athlete or competitor's performance; (d) Any tier 2 Sports Wager when an individual athlete or competitor fails to participate in a Sporting Event and the outcome of the wager is solely based upon that individual athlete or competitor's performance; (e) Any Sports Wager received for an act, or set of acts, to be performed during a Sporting Event when such act or acts does not occur and the ability to Wager on the non-occurrence of the event was not offered. For example, a Sports Wager on punt return yardage in an American football game where no punts occur and zero was not an available Wager; (f) Any Wager received on whether a team will qualify to participate in post-season competitions when the number of teams allowed to participate in the post-season changes after a patron has placed a Wager; (g) Changes to rules by a Sports Governing Body regarding the format or number of athletes or competitors scheduled to participate in a defined phase of a sporting event or that particular phase is not played at all; (h) A material change in circumstances for a given Sporting Event or Wager category occurs, provided:
3. The Commission approves the material change;
4. The Sports Wagering Operator documents the material change in its system of Internal Controls; and
5. The Sports Wagering Operator displays the material change to a patron at the time of placement of the Sports Wager. (i) When a patron requests a Sports Wager be cancelled or voided prior to the commencement of the Sporting Event due to:
6. An error in communicating the type, amount or parameters of the Wager; or
7. An error of a Ticket Writer entering such transaction in the Sports Wagering Equipment, in such case the ticket writer must call a supervisor to cancel or void the Wager; or (j) When authorized or ordered by the Commission pursuant to 205 CMR 238.35.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.35 continued

238.35: continued (2) For all circumstances that are not set forth in 205 CMR 238.35(1), a Sports Wagering Operator may request the Commission authorize the cancellation or voiding of all Wagers of a specific type, kind, or subject. A Sports Wagering Operator shall submit its request to cancel or void the Wager in writing, and such request shall contain the following: (a) A description of the type, kind, or subject of Wager the Sports Wagering Operator is requesting to cancel or void; (b) A description of any facts relevant to the request; and (c) An explanation why cancelling or voiding the Wager is in the best interests of the Commonwealth or ensures the integrity of the Sports Wagering industry. (3) The Sports Wagering Operator shall provide any additional information requested by the Commission to review and approve the request. (4) The Commission shall issue a written order granting or denying the request to cancel or void the Wager. In determining whether to grant or deny the request, the Commission shall consider any relevant factors, including: (a) Whether the alleged facts implicate the integrity of the Sporting Event subject to the Wager or the Sports Wagering industry; (b) Whether the alleged facts implicate possible illegal activity relating to the Sporting Event or the Sports Wagering industry; (c) Whether allowing the Wager would be unfair to patrons; or (d) Whether allowing the Wager is contrary to public policy. (5) No Wager subject to the request to cancel or void shall be redeemed, cancelled, or voided, until the Commission or its designee issues an order granting or denying the request to cancel. (6) If the Commission or its designee grants the request to cancel or void, the Sports Wagering Operator shall make commercially reasonable efforts to notify patrons of the cancellation or voiding of the Wager. (7) The Commission or its designee has discretion to order all Sports Wagering Operators to cancel or void all Wagers on a specific Sporting Event or Wagers of a specific type or kind on a specific Sporting Event. In exercising its discretion, the Commission shall apply the same factors described in 205 CMR 238.35(1). (8) A patron may request the Commission or its designee review any Wager declared cancelled or voided by a Sports Wagering Operator. If the Commission or its designee concludes there is no reasonable basis to believe there was obvious error in the placement or acceptance of the Wager, the Commission or its designee may order the Sports Wagering Operator to honor the Wager. (9) If a Wager is declared canceled or voided, the Wager shall be refunded to the patron and that amount shall be deducted from the Adjusted Gross Sports Wagering Receipts. For cancelled or voided Wagers not tied to a Sports Wagering Account, the following shall apply: (a) Any cancelled or voided Wager shall be refunded upon request by a patron prior to the expiration of the original redemption period and shall be deducted from Adjusted Gross Sports Wagering Receipts; and (b) At the expiration of any outstanding cancelled or voided Wager which has not been refunded, the original amount of the outstanding Wager shall be deducted from Adjusted Sports Wagering Receipts and remitted to the Sports Wagering Fund. (10) All voided or cancelled Wagers and all refunds of any voided or cancelled Wager pursuant to 205 CMR 238.35 shall be logged at the time they occur and such log must be made available to the Commission upon request.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.36 Accounting Controls for Sports Wagering Kiosks

238.36: Accounting Controls for Sports Wagering Kiosks (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include provisions governing a Sports Wagering Kiosk for the acceptance of Sports Wagers and redemption of winning Sports Wagering tickets and vouchers that comports with 205 CMR 243.00: Sports Wagering Equipment. (2) The Sports Wagering Operator shall ensure Sports Wagering Kiosks are configured to prohibit the following: (a) Issue or redeem a Sports Wagering Voucher or payout with a value in excess of $10,000; (b) Issue or redeem a Sports Wagering Voucher or payout in excess of limits set by the IRS.

238.37 Sports Wagering Equipment

238.37: Sports Wagering Equipment A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures relative to Sports Wagering Equipment that include, at a minimum, provisions to ensure that all Sports Wagering Equipment comport with 205 CMR 243.00: Sports Wagering Equipment. Such procedures shall include the following: (1) The location of the servers used for Sports Wagering, including any third-party remote location servers, and what controls will be in place to ensure security of the servers; and (2) The procedures and security standards as to receipt, handling, and storage of Sports Wagering Equipment, including within a Sports Wagering Area, Sports Wagering Facility, or Gaming Establishment.

238.38 Change Management

238.38: Change Management A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include change management processes which detail evaluation procedures for identifying the criticality of updates to Sports Wagering Equipment and determining the updates that must be submitted to the approved independent testing laboratory for review and certification. The processes shall be subject to the provisions of 205 CMR 244.03: Integration Requirements and Change Management.

238.39 Sports Wagering Accounts

238.39: Sports Wagering Accounts A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include procedures relative to Sports Wagering Accounts that include, at a minimum, provisions to ensure that all Sports Wagering Accounts comport with 205 CMR 248.00: Sports Wagering Account Management.

238.40 Test Accounts

238.40: Test Accounts A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include the procedures for establishing test accounts to be used by the Operator and the Commission to test the various components and operation of Sports Wagering Equipment. Such procedures shall include, at a minimum: (1) The procedures for issuing funds used for testing, including the identification of who may issue the funds and the maximum amount of funds that may be issued; (2) The procedures for assigning each test account for use by only one individual. However, a Sports Wagering Operator may establish a specific scenario or instance of a test account that may be shared by multiple users if each user's activities are separately logged; (3) The maintenance of a record for all test accounts, to include when they are active, to whom they are issued, and the employer of the individual to whom they are issued; (4) The procedures for auditing testing activity by the Sports Wagering Operator to ensure the accountability of funds used for testing and proper adjustments to gross Sports Wagering receipts; and

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.40 continued

238.40: continued (5) The procedures for authorizing and auditing out-of-state test activity.

238.41 Sports Wagering Accounting Requirements

238.41: Sports Wagering Accounting Requirements The system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include Sports Wagering accounting procedures designed to ensure that the Sports Wagering Operator's wagering activities are accurately and timely recorded and reported. Specifically, the policies and procedures shall comport with 205 CMR 243.01: Standards for Sports Wagering Equipment and must address: (1) The procedures and security for the daily calculation and recording of gross Sports Wagering receipts, Adjusted Gross Sports Wagering Receipts and winnings. (2) The policies and procedures in connection with the internal audit department of its Sports Wagering Operations. (3) The procedure for the recording of and reconciliation of Sports Wagering transactions.

238.42 Commission Access to Sports Wagering Data

238.42: Commission Access to Sports Wagering Data A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall detail the controls to assure that all data the Commission requires to be maintained under M.G.L. c. 23N or 205 CMR is appropriately segregated and controlled to prevent unauthorized access. Sports Wagering Operators must provide the Commission with access to all such data, upon request, within a time provided for by the Commission. A Sports Wagering Operator must retain such data for a minimum of five years.

238.43 Reports of Sports Wagering Operations

238.43: Reports of Sports Wagering Operations A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall detail the Sports Wagering Operator's ability to maintain daily records and must be able to prepare reports supporting gross Sports Wagering receipts and Adjusted Gross Sports Wagering Receipts, wagering liability, payouts, and any other reports considered necessary by the Commission. The Sports Wagering Operator shall timely file with the Commission any additional reports required by M.G.L. c. 23N or by any rule or regulation.

238.44 Data and Network Security Requirements

238.44: Data and Network Security Requirements (1) A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall ensure compliance with all applicable state and federal requirements for data and network security including 205 CMR, M.G.L. c. 93H, M.G.L. c. 93I, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and any other applicable law, regulation or order of a governmental body. (2) Pursuant to M.G.L. c. 23N, § 11(a)(v), a Sports Wagering Operator shall employ commercially reasonable methods to maintain the security of Wagering data, Confidential Information and other Personally Identifiable Information from unauthorized access and dissemination; provided, however, that nothing in M.G.L. c. 23N or 205 CMR shall preclude the use of internet or cloud-based hosting of such data and information or disclosure as required by court order, other law or M.G.L. c. 23N; and provided further, that such data and information shall be hosted in the United States. (3) Internal and external network vulnerability scans shall be run at least quarterly and after any significant change to the Sports Wagering Platform or network infrastructure. Testing procedures must verify that four quarterly internal and scans took place in the past 12 months and that re-scans occurred until all "Medium Risk" (CVSS 4.0 or Higher) vulnerabilities were resolved or accepted via a formal risk acceptance program. Internal scans should be performed from an authenticated scan perspective. External scans can be performed from an uncredentialed perspective.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.44 continued

238.44: continued (a) The quarterly scans may be performed by either a qualified employee of the Sports Wagering Operator or a qualified independent technical expert selected by the Sports Wagering Operator and subject to approval of the Commission in accordance with 205 CMR 243.01: Standards for Sports Wagering Equipment. (b) Verification of scans must be submitted to the Commission on a quarterly basis and must include a remediation plan and any risk mitigation plans for those vulnerabilities not able to be resolved.

238.45 Confidential Information and Personally Identifiable Information Security

238.45: Confidential Information and Personally Identifiable Information Security (1) Any information obtained in respect to Sports Wagering or the Sports Wagering Account, including Confidential Information and Personally Identifiable Information and authentication credentials, shall be collected, maintained, stored and secured in compliance with the privacy policies and 205 CMR138.73: Personally Identifiable Information and Confidential Information Security and any other policies in 205 CMR , M.G.L. c. 93H, M.G.L. c. 93I, 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth, and any other applicable law, regulation or order of a governmental body. Confidential Information, Personally Identifiable Information and the Sports Wagering Account funds shall be considered as critical assets for the purposes of risk assessment. (2) No employee or agent of the Sports Wagering Operator shall divulge any Confidential Information or Personally Identifiable Information related to a Sports Wagering Account, the placing of any Wager or any other sensitive information related to the operation of Sports Wagering except as required or permitted by 205 CMR 238.45 or elsewhere explicitly permitted in 205 CMR, the Commission or other authorized governmental agencies, including: (a) The amount of money credited to, debited from, withdrawn from, or present in any particular Sports Wagering Account; (b) The amount of money Wagered by a particular patron on any event or series of events; (c) The unique patron ID or username and authentication credentials that identify the patron; (d) The identities of particular Sporting Events on which the patron is Wagering or has Wagered; and (e) Unless otherwise authorized by the patron, the name, address, and other Personally Identifiable Information or Confidential Information in the possession of the Sports Wagering Operator that would identify the patron to anyone other than the Commission or the Sports Wagering Operator, provided, however, that such authorization must be clear, conspicuous, and received apart from any other agreement or approval of the patron. Acceptance of general or broad terms of use or similar documents that purport to permit the sharing of Personally Identifiable Information or Confidential Information in the same document shall not constitute adequate authorization, not shall hovering over, muting, pausing, pre-selecting, or closing a given piece of content without affirmatively granting consent; or purported agreement. Further, no authorization shall be deemed to be a waiver of any of the patron's other rights. The option to withdraw such consent must be clearly and conspicuously available to the patron online through any patron account page on the Sports Wagering Operator's website and within any Sports Wagering mobile application. A patron shall not be required to confirm withdrawal of consent more than once, and no intervening pages or offers will be presented to the patron before such confirmation is presented to the patron.

238.46 Reprints of Sports Wagering Tickets and Vouchers

238.46: Reprints of Sports Wagering Tickets and Vouchers A system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall detail procedures to reprint tickets or vouchers that fail to print at either a Ticket Writer Station or Sports Wagering Kiosk. Such procedures shall include a requirement of supervisory authorization for the reprint.

238.47 Validation and Payout of Sports Wagering Tickets and Vouchers

238.47: Validation and Payout of Sports Wagering Tickets and Vouchers A system of Internal Controls submitted by a Sports Wagering Licensee in accordance with 205 CMR 238.02 shall include the necessary controls in place for validation and payment of prizes and to prevent fraud related to unclaimed winning Sports Wagering tickets and vouchers.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.47 continued

238.47: continued (1) Validation Process. The Sports Wagering Operator shall define and implement procedures to ensure the validity of winning Sports Wagering tickets and vouchers, and process payouts thereof. (a) No Sports Wagering ticket or voucher recorded or reported as previously paid, canceled, or non-existent shall be deemed a valid ticket or voucher by the Sports Wagering Operator. The Sports Wagering Operator may withhold payment and refuse to cash any Sports Wagering ticket or voucher deemed not valid. (b) The Sports Wagering Operator shall not satisfy claims on lost, mutilated, or altered Sports Wagering tickets without authorization of the Commission.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.47 continued

238.47: continued (2) Security of Unclaimed Ticket and Voucher Data. The Sports Wagering Operator shall implement technical and procedural controls to ensure the confidentiality, integrity, and availability of unclaimed winning Sports Wagering ticket and voucher data. This shall include as a minimum, files containing information on specific winning Sports Wagering tickets and vouchers yet to be claimed and any validation files. Specific consideration shall be given to access control to restrict access to the data, monitoring of user interaction with the data, and a process for dealing with unauthorized access or export of the data. (3) Payout Procedure. A Sports Wagering Operator's Internal Controls shall include a winning Sports Wagering ticket and voucher payout procedure that: (a) Defines a maximum payout period; (b) Includes a process to audit final transfers upon Wager settlement; (c) Details the rules and due diligence required prior to making a decision on payout for a lost, stolen or damaged ticket or voucher; (d) Details the procedure with regard to inquiries into the validity of claims; (e) Includes a procedure with regard to late or last minute payouts; and (f) Addresses whether or not a winning ticket may be redeemed by mail and, if so, the procedures for such redemption. (4) Fraud Detection. There shall be adequate audit records kept and reviewed as part of the winning Sports Wagering ticket and voucher payout procedure to identify unusual patterns of late payouts and any claims made by personnel that might require investigation.

238.48 Expiration of Sports Wagering Tickets and Vouchers; Payment to the Sports Wagering Control Fund

238.48: Expiration of Sports Wagering Tickets and Vouchers; Payment to the Sports Wagering Control Fund (1) The system of Internal Controls submitted by a Sports Wagering Operator in accordance with 205 CMR 238.02 shall include provisions governing the expiration of winning Sports Wagering tickets and vouchers that provide, at a minimum, that: (a) Any money that is owed to a patron by a Sports Wagering Operator as a result of a winning Sports Wagering ticket or voucher must be claimed within one year of the date of the Sporting Event for which the Wager was won or the obligation of the Sports Wagering Operator to pay the patron will expire. Upon expiration of the obligation, the involved funds must be transferred to the Sports Wagering Control Fund in accordance with M.G.L. c. 23N, § 13(h). In calculating the one year period referenced in 205 CMR 238.48(1)(a) and in M.G.L. c. 23N, § 13(h), any period of time for which the Gaming Establishment or Sports Wagering facility was not in operation shall be excluded; and (b) A Sports Wagering Operator shall maintain a record of all unclaimed winning Sports Wagering tickets and vouchers that have expired. (2) Before the end of each calendar month, the Sports Wagering Operator shall report the total value of winning Sports Wagering tickets and vouchers owed to its patrons that expired during the preceding calendar month in a format prescribed by the Commission. (3) Each Sports Wagering Operator shall submit a wire transfer or a check with its monthly report payable to the Sports Wagering Control Fund in accordance with M.G.L. c. 23N, § 13(h) in the amount of the winning Sports Wagering tickets and vouchers owed to its patrons that expired during the preceding month as stated in the report. (4) Upon the payment of the expired debt, the Sports Wagering Operator shall post the payment and remove the amount from its records as an outstanding debt. (5) Failure to make the payment to the Sports Wagering Control Fund by the due date shall result in the imposition of penalties and interest as prescribed by 205 CMR. (6) Nothing in 205 CMR 238.48 shall preclude the Sports Wagering Operator from, in its discretion, issuing cash or other form of complimentary to a patron to compensate the patron for a winning Sports Wagering ticket or voucher that has expired.

205 CMR: MASSACHUSETTS GAMING COMMISSION

238.49 Entertainment, Filming or Photography within the Sports Wagering Area or Sports Wagering

238.49: Entertainment, Filming or Photography within the Sports Wagering Area or Sports Wagering Facility Any entertainment, filming or photography within the Sports Wagering Area of the Gaming Establishment or Sports Wagering Facility shall not disrupt or interfere with the: (1) Efficient operations of Sports Wagering; (2) The security of the Gaming Establishment or any portion thereof; (3) Surveillance operations; or (4) The security or integrity of Sports Wagering Operations or any authorized Sports Wagering.

238.50 Policies and Procedures for Ensuring a Workplace Free from Unlawful Discrimination, Harassment

238.50: Policies and Procedures for Ensuring a Workplace Free from Unlawful Discrimination, Harassment and Retaliation The Sports Wagering Operator, as well as their submitted system of Internal Controls, shall comply with 205 CMR 138.72: Policies and Procedures for Ensuring a Workplace Free from Unlawful Discrimination, Harassment and Retaliation. REGULATORY AUTHORITY 205 CMR 238.00: M.G.L. 23N, §§ 4, 6, and 10.