N.Y. Comp. Codes R. & Regs. tit. 9, § 5330.10 – System requirements for mobile sports wagering.

(1) acceptance and registration of all sports wagers;
(2) generation of all electronic sports wagering tickets;
(3) computation of sports wagering and payoffs;
(4) maintenance of records of all sports wagering activities;
(5) generation of all reports;
(6) maintenance of the integrity of sports wagering platforms, authorized sports bettors’ data and sports wagering data storage in the case of a system failure, using methods outlined in the approved internal controls of the platform provider;
(7) creation of a secure method to control remote access to the platform using firewalls or other protections and maintenance of secure logs outlined in the approved internal controls of the platform provider;
(8) maintenance of all transactional sports wagering data for a period of 5 years, to which each authorized sports bettor shall have ready access with respect to each sports bettor’s own data and which shall be capable of being provided to such bettor through a customer service inquiry within 10 days of such request, all at no cost to such bettor; and
(9) establishment of a wallet that authorized sports bettors may use across all skins in New York State associated with such platform provider, so long as the commission has approved such establishment.
(d) Skin requirements.
The systems of a skin shall be responsible for the following, at a minimum:
(1) establishment of public-facing markets and odds for display to an authorized sports bettor holding an account with such skin;
(2) guarantee of the payment of winning sports wagers;
(3) creation of a mechanism for an authorized sports bettor to establish daily, weekly or monthly deposit limits;
(4) limitation of each authorized sports bettor to one active account per skin;
(5) prohibition of anyone under the age of 21 from participating in mobile sports wagering;
(6) employment of systems and procedures to maintain the security of authorized sports bettors’ accounts and information from tampering or unauthorized access, using the minimum standard encryption of AES 256 or other NIST standards. Such information to be secured shall include:
1. (i) personally identifiable information, including Social Security number;
2. (ii) biometric data, including account personal identification number and/or password;
3. (iii) methods of account funding, including credit card numbers, bank account numbers or other personal financial information; and
4. (iv) sports wagering data, accounts, reports, significant events or other sensitive information obtained through the operation of mobile sports wagering;
(7) creation of logs that can be exported in regard to player activity and sports wagering information, as may be required by the commission;
(8) ensuring that no sports wagering is based on a prohibited sports event;
(9) implementation of a monitoring system that identifies and reports suspected structured sports wagers and unusual or suspicious wagering activity; and
(10) establishing procedures for the temporary suspension of an account, at the request of an account holder or on the initiative of the skin.
(e) Third-party communications.
If a mobile sports wagering licensee communicates with a third-party system, such licensee shall ensure the integrity of such communications through encryption or the use of secure communications protocols.
(f) Information recording.
A mobile sports wagering system provided by a mobile sports wagering licensee shall be capable of recording the following information for each sports wager made in the system:
(1) description of event;
(2) sports wager selection;
(3) type of sports wager;
(4) amount of sports wager;
(5) date and time of sports wager; and
(6) unique sports wager identifier.
(g) Past posting and known-event outcomes.
A skin shall prevent past posting of sports wagers and the voiding or cancellation of sports wagers after the outcome of an event is known.
(h) Self-authentication.
A skin shall, at least once every 24 hours, perform a self-authentication process on all software used in the mobile sports wagering system to offer, record and process sports wagers to ensure there have been no unauthorized modifications. In the event that an unauthorized modification is identified as a result of this process, a skin shall notify the commission promptly. The mobile sports wagering system shall record the results of all self-authentication attempts and maintain such record for a period of not less than 90 days.
(i) Controls.
A skin shall have controls in place to review the accuracy and timeliness of any data feeds used in its mobile sports wagering system to offer or settle sports wagers. In the event that an incident or error occurs that results in a loss of communication with data feeds, such error shall be recorded in a log capturing the date and time of the error and the nature of the error. Errors shall be submitted to the commission within 48 hours of occurrence. Such information shall be maintained by the reporting skin for a period of not less than six months.
(j) Commission access to systems and data.
Consistent with existing commission authority and in a manner approved by the commission, a skin shall provide the commission with access to servers and other software used in creation of sports wagers, sports wagering transactions and related data the commission may deem necessary.

(a) Submission to laboratory.

Prior to conducting mobile sports wagering, all equipment and software used in conjunction with its operation shall be submitted to a licensed independent gaming test laboratory for review and certification for compliance with the standards set forth in this Part and any additional technical requirements the commission establishes.

(b) Server location.

The platform, servers and other equipment to accept sports wagers shall be located within a casino, as the commission shall direct and facilitate. A casino at which such equipment is located shall ensure that access to such equipment is granted to licensed employees of the mobile sports wagering licensee whose equipment is located there.

The systems of a platform provider shall be able to provide the following, at a minimum: