N.Y. Comp. Codes R. & Regs. tit. 9, § 5329.10 – Sports pool system requirements.

(1) user access controls for all sports pool personnel;
(2) information in regard to segregation of duties;
(3) information in regard to automated risk management procedures;
(4) information in regard to fraud detection;
(5) controls ensuring regulatory compliance;
(6) description of anti-money laundering compliance standards;
(7) description of all software applications that comprise the system;
(8) description of all types of sports wagers available to be offered by the system;
(9) description of all integrated third-party systems; and
(10) description of the method to prevent past posting.
(d) Data retention.
A sports pool system shall maintain all transactional sports wagering data for a period of 10 years.
(e) Information recording.
A sports pool system shall be capable of recording the following information for each sports wager made:
(1) description of event;
(2) event number;
(3) sports wager selection;
(4) type of sports wager;
(5) amount of sports wager;
(6) date and time of sports wager;
(7) unique wager identifier; and
(8) when the sports wagering ticket expires.
(f) Wagering tickets.
Each sports wagering ticket a cashier or automated ticket machine generates shall include:
(1) all of the information set forth in subdivision (e) of this section;
(2) name and address of the party issuing the sports wagering ticket;
(3) a barcode or similar symbol or marking as approved by the commission, corresponding to the unique sports wager identifier;
(4) method of redeeming winning sports wagering ticket via mail; and
(5) identification of the cashier or automated ticket machine generating the sports wagering ticket.
(g) Vouchers.
Sports pool vouchers issued by a sports pool system shall contain the following information:
(1) date, time, and location of issuance;
(2) amount of the voucher;
(3) unique voucher identifier;
(4) expiration date of the voucher;
(5) name of casino; and
(6) a statement that the voucher can be redeemed only in exchange for a sports wager or cash.
(h) Voucher redemption.
If a sports pool system issues and redeems a sports pool voucher, the system shall be capable of recording the following information for each voucher:
(1) amount of voucher;
(2) date, time, and location of issuance;
(3) unique voucher identifier;
(4) expiration date of the voucher; and
(5) date, time, and location of redemption, if applicable.
(i) Required system functions.
A sports pool system shall be capable of performing the following functions:
(1) creating sports wagers;
(2) settling sports wagers;
(3) voiding sports wagers;
(4) cancelling sports wagers;
(5) processing lost, destroyed or expired sports wagering tickets;
(6) preventing any sports wager in excess of $10,000 or making a payout in excess of $10,000 until authorized by a supervisor; and
(7) maintaining the following:
1. (i) description of the event;
2. (ii) event number;
3. (iii) sports wager selection;
4. (iv) type of sports wager;
5. (v) amount of sports wager;
6. (vi) amount of potential payout;
7. (vii) date and time of sports wager;
8. (viii) identity of the cashier accepting the sports wager;
9. (ix) unique sports wagering ticket or voucher identifier;
10. (x) expiration date of sports wagering ticket;
11. (xi) the authorized sports bettor’s name, if known;
12. (xii) date, time, amount, and description of the settlement;
13. (xiii) location where the sports wager was made;
14. (xiv) location of redemption; and
15. (xv) identity of cashier settling the sports wager, if applicable.
  (j) Voided and cancelled sports wagers.
  When a sports pool wager is voided or cancelled, the system shall indicate clearly that the sports wagering ticket is voided or cancelled, render such ticket nonredeemable and make an entry in the system indicating the void or cancellation and identity of the cashier or automated process.
  (k) Past posting and known event outcomes.
  A sports pool system shall prevent past posting of sports wagers and the voiding or cancellation of sports wagers after the outcome of an event is known.
  (l) Self-authentication.
  A sports pool system shall, at least once every 24 hours, perform a self-authentication process on all software used in the sports pool system to offer, record and process sports wagers to ensure there have been no unauthorized modifications. In the event that an unauthorized modification is identified as a result of this process, at a minimum, the system immediately shall notify the casino operations wagering manager using an automated process. The operations manager shall notify the commission promptly of the authentication failure. The system shall record the results of all self-authentication attempts and maintain such record for a period of not less than 90 days.
  (m) Controls.
  A sports pool system shall have controls in place to review the accuracy and timeliness of any data feeds used to offer or settle sports wagers. In the event that an incident or error occurs that results in a loss of communication with data feeds used to offer or redeem sports wagers, such error shall be recorded in a log capturing the date and time of the error, the nature of the error and a description of such error’s impact on the system's performance. Such information shall be maintained for a period of not less than six months.
  (n) Commission access to data.
  Consistent with existing commission authority, the casino sports wagering licensee and sports pool vendor shall provide access to sports wagering transaction and related data the commission may deem necessary, in a manner approved by the commission.
  (o) Sports pool system.
  A sports pool system shall be capable of preventing any sports pool wager in excess of $10,000 or making a payout in excess of $10,000 until authorized by a supervisor. A sports pool system shall be capable of maintaining the following:
(1) description of the event;
(2) event number;
(3) sports wager selection;
(4) type of sports wager;
(5) amount of sports wager;
(6) amount of potential payout;
(7) date and time of sports wager;
(8) identity of the cashier accepting the sports wager;
(9) unique wagering ticket or voucher identifier;
(10) expiration date of sports wagering ticket;
(11) the authorized sports bettor’s name, if known;
(12) date, time, amount, and description of the settlement;
(13) location where the sports wager was made;
(14) location of redemption; and
(15) identity of cashier settling the sports wager, if applicable
(p) Redeemed lost wagering tickets.
For all lost sports wagering tickets that are redeemed, a sports pool system shall record and maintain the following information:
(1) date and time of redemption;
(2) employee responsible for redeeming the sports wagering ticket;
(3) name of the authorized sports bettor redeeming the sports wagering ticket;
(4) unique sports wagering ticket identifier; and
(5) location of the redemption.

(a) Submission to laboratory.

Prior to operating a sports pool, all equipment and software used in conjunction with its operation shall be submitted to a licensed independent gaming test laboratory for review and certification for compliance with the standards set forth in this Part and any additional technical requirements the commission establishes.

(b) Server and wager creation.

The server or other equipment to accept sports wagers shall be located within the casino. In creating sports wagers that will be offered to the public, a sports pool operations manager may receive advice and recommendations from any source or entity in other jurisdictions and may take into consideration information in regard to odds and wagers placed on sports events.

A sports pool system submission shall contain a description of the risk management framework, including, without limitation: