1. (1) user access controls;
2. (2) a description of segregation of duties;
3. (3) procedures for identifying and reporting fraud and suspicious conduct or activity;
4. (4) procedures to prevent sports wagering by patrons prohibited from sports wagering;
5. (5) a description of all integrated third-party systems;
6. (6) procedures on how to maintain the integrity of sports wagering platforms, authorized sports bettor’s data and sports wagering data storage in the case of a system failure;
7. (7) description of the secure method to control remote access to the sports wagering platform using firewalls or other protections and maintaining secure logs;
8. (8) all data sources used in sports wager determination. Official data from a sports governing body shall be used to determine all sports wagers, unless a skin (through its data provider vendor, if applicable) demonstrates to the satisfaction of the commission that sports wagers for such sports wager type may be determined reliably, accurately and timely by an alternative data source. If the commission determines that an alternative data source for a type of wager is acceptable, then each skin shall be permitted to use such alternative data source to settle such wager types. See Racing, Pari-Mutuel Wagering and Breeding Law section 1367(14);
9. (9) the method in which the mobile sports wagering licensee shall implement the statewide voluntary self-exclusion database and other prohibited sports bettors into its system; and

10. (10) where the mobile sports wagering licensee plans to list, on a website or mobile application, information concerning assistance for compulsive play in New York State, including a toll-free number directing callers to reputable resources, free of charge to the caller.

    (c) Authorized sports bettor account requirements.

    Internal controls for authorized sports bettor account requirements shall address:

11. (1) controls in place to limit each authorized sports bettor to one active account per skin, as required by Racing, Pari-Mutuel Wagering and Breeding Law section 1367-a(4)(a)(i);
12. (2) the multi-factor authentication method to be used;
13. (3) the mechanism for an authorized sports bettor to establish daily, weekly or monthly deposit limits, as required by Racing, Pari-Mutuel Wagering and Breeding Law section 1367-a(4)(a)(xii);
14. (4) controls in place to prohibit anyone under the age of 21 from participating in mobile sports wagering;
15. (5) the mechanism, if any, the platform provider or skin will use to create a wallet to be used by authorized sports bettors across multiple skins associated with such platform provider;
16. (6) the systems and procedures in place to maintain the security of authorized sports bettors’ accounts, including the encryption of personally identifiable information and biometric data, Social Security number, account personal identification number and/or password and methods of account funding;
17. (7) how the mobile sports wagering licensee intends to meet all requirements set forth in section 5330.4 of this Part;
18. (8) procedures for issuing a form W-2G, if such thresholds are met;
19. (9) procedures for authorized sports bettors to obtain a year-end win-loss statement;
20. (10) the mechanism for allowing an authorized sports bettor to close an account;
21. (11) a procedure for when an authorized sports bettor’s lifetime deposits reach $2,500, and every year thereafter, for such bettors to acknowledge the bettor has met the deposit threshold and may elect to establish limits or close such account and that the bettor has received disclosures that include problem gaming resources, as required by Racing, Pari-Mutuel Wagering and Breeding Law section 1367-a(4)(a)(xiii); and

22. (12) how a dormant account is defined and what the process is for reconciliation of such accounts.

    (d) Prevention of circumvention of sports wagering amount acknowledgments.

    A skin shall provide the acknowledgment set forth in paragraph (c)(11) of this section whenever such skin knows or should know that an authorized sports bettor has taken or is attempting to take action designed to circumvent the monetary threshold set forth in such paragraph.

    (e) Operational requirements.

    Internal controls for operational requirements shall address:

23. (1) a description of how the skin intends to segregate sports bettors’ funds from operating funds;
24. (2) procedures to ensure no sports wagering shall be based on a prohibited sports event;
25. (3) a description of anti-money laundering compliance standards;
26. (4) a description of the monitoring system that identifies and reports suspected structured sports wagers and unusual or suspicious wagering activity;
27. (5) procedures for the skin reconciling gross gaming revenue and remitting such amount to the platform provider for the payment of taxes and fees to the commission; and

28. (6) in the event of changes and upgrades to the mobile sports wagering server or other hardware and software used to execute mobile sports wagering, procedures the mobile sports wagering licensee intends to follow in order to receive approval from the commission, including recertification of such sports wagering components.

    (f) Amendments to internal controls.

    A mobile sports wagering licensee shall submit to the commission any proposed amendment to such licensee’s approved internal controls at least 30 days in advance of the date the proposed amendment is intended to take effect. If a proposed amendment is requested to take effect in fewer than 30 days, the mobile wagering licensee shall submit an expedited amendment request to the commission.

(a) Submission.

Each mobile sports wagering licensee shall submit to the commission, for approval, internal controls for all aspects of mobile sports wagering operations prior to commencing operations. The submission of internal controls shall be organized to correspond to the subdivisions set forth in this section.

(b) System requirements.

Internal controls for system requirements shall address: