DEPARTMENT OF TREASURY

MICHIGAN GAMING CONTROL BOARD

INTERNET GAMING RULES

Filed with the secretary of state on

These rules take effect immediately upon filing with the secretary of state unless adopted under section 33, 44, or 45a(6) of the administrative procedures act of 1969, 1969 PA 306, MCL 24.233, 24.244, or 24.245a.  Rules adopted under these sections become effective 7 days after filing with the secretary of state.

(By authority conferred on the Michigan Gaming Control Board by section 10 of the lawful internet gaming act, 2019 PA 152, MCL 432.310)

R 432.611, R 432.612, R 432.613, R 432.613a, R 432.614, R 432.614a, R 432.614b, R 432.614c, R 432.614d, R 432.614e, R 432.615, R 432.615a, R 432.616, R 432.616a, R 432.616b, R 432.617, R 432.618, R 432.621, R 432.621a, R 432.621b, R 432.621c, R 432.621d, R 432.621e, R 432.621f, R 432.621g, R 432.621h, R 432.621i, R 432.621j, R 432.621k, R 432.622, R 432.623, R 432.624, R 432.624a, R 432.625, R 432.625a, R 432.625b, R 432.625c, R 432.626, R 432.627, R 432.628, R 432.628a, R 432.628b, R 432.628c, R 432.629, R 432.631, R 432.632, R 432.632a, R 432.632b, R 432.633, R 432.633a, R 432.633b, R 432.633c, R 432.634, R 432.635, R 432.636, R 432.637, R 432.637a, R 432.638, R 432.639, R 432.639a, R 432.639b, R 432.639c, R 432.639d, R 432.641, R 432.642, R 432.643, R 432.644, R 432.645, R 432.647, R 432.648, R 432.649, R 432.651, R 432.651a, R 432.651b, R 432.651c, R 432.652, R 432.653, R 432.654, R 432.655, R 432.655a, R 432.655b, R 432.655c, R 432.655d, R 432.655e, R 432.656, R 432.657, R 432.658, R 432.659, R 432.661, R 432.662, R 432.663, R 432.663a, R 432.663b, R 432.663c, R 432.664, R 432.665, R 432.665a, R 432.665b, R 432.666, R 432.667, R 432.668, R 432.671, R 432.672, R 432.673, R 432.674, R 432.675, and R 432.676 are added to the Michigan Administrative Code, as follows:

PART 1. GENERAL PROVISIONS

R 432.611 Definitions.

Rule 611. As used in these rules:

(a) “Act” means the lawful internet gaming act, 2019 PA 152, MCL 432.301 to MCL 432.322.

(b) “Affiliate” means a person that, directly or indirectly, through 1 or more intermediaries, controls or is controlled by an internet gaming operator.

(c) “Affiliate marketer” means entities and individuals involved in promoting, marketing, and directing business to online gaming sites.

(d) “Agent” means any person who is employed by any agency of the state, other than the board, the state police, or attorney general, who is assigned to perform full-time services on behalf of or for the benefit of the board regardless of the title or position held by that person.

(e) “Authorized game” means any internet game that the board determines to be suitable for use for wagering through the internet which must include, but need not be limited to, poker, blackjack, cards, slots, games played with dice or tiles, or both, such as roulette, craps, pai gow, and other games typically offered at a casino. An authorized game does not include any of the following: pick numbers or other lottery games typically offered by the bureau of lottery under the McCauley-Traxler-Law-Bowman-McNeely lottery act, 1972 PA 239, MCL 432.1 to 432.47; a lawful fantasy contest; or any lawful internet sports betting.

(f) “Authorized participant session” means the period of time that an authorized participant is logged on to an internet gaming platform.

(g) “Conflict of interest” means a situation, relationship, or association in which the private interest of employees, agents, and contractors of the board may influence the judgment of the employee, agent, or contractor in the performance of his or her public duty under the act.

(h) “Contractor” means any individual not employed by this state who performs services on behalf of or for the benefit of the board and requires unescorted access to board facilities.

(i) "Excluded person" means any individual who has been involuntarily placed in the responsible gaming database by the executive director and who is prohibited from establishing an internet wagering account or participating in internet wagering, or both, offered under the act or these rules.

(j) “Executive Director” means the executive director of the Michigan gaming control board, appointed under section 4 of the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.204.

(k) “Game server” means a server that contains game software and control programs.

(l) “Internet gaming network” means the linking of authorized participants of 1 or more Internet gaming operators to participate in peer-to-peer gaming.

(m) “Interactive gaming system” means the hardware, software, firmware, communications technology and other equipment which allows an authorized participant to remotely bet or wager through the internet or a similarly distributed networking environment, and the corresponding equipment related to game outcome determination, the display of the game and game outcomes, and other similar information necessary to facilitate play of the game. The internet gaming platform provides the authorized participant with the means to play authorized games. The internet gaming platform provides the internet gaming operator with the means to review internet wagering accounts, disable games, generate various gaming/financial transaction and account reports, input outcomes for live internet games, and set any configurable parameters. The term does not include computer equipment or communications technology used by an authorized participant to access the interactive gaming system. Unless otherwise specified in the rules, the term internet gaming platform includes the entire interactive gaming system inclusive of remote gaming systems.

(n) “Key person” means any of the following:

(i) A director of the applicant.

(ii) A managerial employee of the applicant that performs the function of principal executive officer, principal operations officer, or principal accounting officer.

(iii) A person who holds more than 5% ownership interest in the applicant.

(iv) An affiliate of the applicant.

(v) A director of an affiliate of the applicant.

(vi) A managerial employee of an affiliate of an applicant that performs the function of principal executive officer, principal operations officer, or principal accounting officer.

(vii) “Key person” does not include an elected or appointed representative of any applicant or licensee that is a federally recognized Indian tribe located in this state unless the representative is also a full-time employee of the applicant’s or licensee’s internet gaming operations. A key person for an Indian tribe will include primary management officials of the applicant who has management responsibilities for the applicant’s internet gaming operations.

(o) “Licensee” means a person who holds a license under the act.

(p) "Prohibited person" means any excluded person, any voluntarily-excluded person, and all of the following:

(i) An individual who is under the age of 21.

(ii) Any employee of, or appointee to, the Michigan gaming control board.

(iii) Employees of an internet gaming operator are prohibited from creating an internet wagering account and placing an internet wager with the internet gaming operator for which he or she is employed unless using a test account. See R 432.639a.

(iv) Employees of a casino licensed under the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.201 to 432.226, are prohibited from creating an internet wagering account and placing an internet wager with the casino licensed as the internet gaming operator for which he or she is employed unless using a test account. See R 432.639a.

(v) Employees of an internet gaming platform provider are prohibited from creating an internet wagering account and placing an internet wager with the internet gaming operator for which the internet gaming platform provider supplies the internet gaming platform unless using a test account. See R 432.639a.

(vi) Employees or appointees of a tribal casino authorized under the Indian gaming regulatory act, 25 USC 2701 to 2721, are prohibited from creating an internet wagering account and placing an internet wager with the tribal casino licensed as the internet gaming operator for which he or she is employed.

(vii) Employees of a tribal gaming regulatory agency with jurisdiction over internet gaming being operated under such tribe’s gaming ordinance and the Indian gaming regulatory act, 25 USC 2701 to 2721.

(viii) Occupational licensees and applicants are prohibited from placing wagers with the internet gaming operator or internet gaming platform provider for which they are employed or for which they had to qualify.

(ix) Individuals not in an authorized location to make a wager.

(x) An individual placing an internet wager on behalf of another

(xi) An individual wagering in violation of state, tribal, or federal law.

(xii) Other prohibited persons as determined by the board.

(q) “Peer-to-peer gaming” means all gaming activity, such as poker, where authorized participants are directly competing against each other but not the licensee.

(r) “Publicly traded corporation” means any corporation or other legal entity regulated by the U.S. Securities and Exchange Commission under the securities exchange act of 1934, 15 USC 78a to 78qq, or securities act of 1933, 15 USC 77a to 77aa.

(s) “Random number generator” or “RNG” means 1 or a combination of the following processes that produces a random sequence of values (or symbols that can be mapped to values): software-based, hardware-based, or mechanical-based. A cryptographically strong random number generator is a random number generator such that for a given n-bit sequence, the (n+1)st bit cannot be predicted (statistically) with a success probability of greater than 0.5. Additionally, should a cryptographically strong random number generator’s state be compromised, in part or in whole, the bitstream produced up until the compromise should not be reproducible.

(t) “Remote gaming system” means hardware and software used to provide authorized internet games to an authorized participant on an internet gaming platform. The remote gaming system may contain features common to game offerings, game configurations, the random number generator, and reporting. The remote gaming system may be a standalone system or integrated within another part of the internet gaming platform.

(u) “Remote/proxy player games” means all hardware, software, and communications that comprise a system used to conduct games where wagering takes place through an internet interface or human proxy, or both, on behalf of 1 or more authorized participants residing in a separate location from the gaming environment. The entire process is viewed by all remote players through real-time remote audio and video feed.

(v) “Secure transaction file” means a file that contains data, which cannot be modified without detection.

(w) “Self-authentication process” means a method used by a system to verify the validity of software and includes the following:

(i) Such method requires the calculation of an output digest, which is compared to a secure embedded value.

(ii) The output digest must be of 128-bit complexity, at a minimum.

(iii) Software will be deemed to have been authenticated if the calculated digest equals the secure embedded value.

(x) "Self-exclusion list" means a list of individuals who voluntarily excluded themselves from establishing or maintaining an internet wagering account with an internet gaming operator or internet gaming platform provider.

(y) “Strong authentication” means a method that has been demonstrated to the satisfaction of the board to effectively provide higher security than a username and password alone.

(z) "Suspended account" means an internet wagering account that has been temporarily disabled from engaging in wagering activity.

(aa) "Targeted mailing" means an advertisement or promotional offer from an internet gaming operator or an internet gaming supplier directed to an individual on the basis of specific criteria, such as being a member or former member of a rewards club or a participant in social games. "Targeted mailing" does not include mass communication, including mailings or e-mailings, made to an entire area or zip code or targeted list, nor does it include an advertisement that arrives in a packet of 5 or more non-gaming advertisements, if such packet of advertisements is addressed to "resident," "occupant," or some similar wording and not to a specific individual. "Targeted mailing" further does not include any "pop-up" advertisement that appears on an individual’s computer or mobile device on the basis of his or her IP Address.

(bb) “Theoretical return to player” or “RTP” means the expected percentage of bets or wagers that a specific game will return to the player in the long run. The RTP can be calculated via either a theoretical or simulated approach. The method used for calculation depends on the game type.

(cc) "Things of value" means anything of value which may be used to place an internet wager.

(dd) “Voluntarily-excluded person” means any individual whose name is included, at his or her own request, in the responsible gaming database or on a self-exclusion list, or both.

R 432.612 Terms defined in act.

Rule 612. Terms defined in the act have the same meaning when used in these rules.

R 432.613 Board duties, jurisdiction, and authority.

Rule 613. (1) In order to execute and administer the act for the purpose of licensing, regulating, and enforcing lawful internet gaming the board can do all of the following:

(a) Determine its practices and internal policies or procedures.

(b) Delegate to the executive director all powers and authority to act in the name of the board with respect to all reasonable, necessary, and appropriate actions to administer and carry out the administrative and executive functions of the board including, but not limited to, the power to do any of the following:

(i) Execute and enter into contracts on behalf of the board.

(ii) Hire and fire employees of the board and administer oaths.

(iii) Issue subpoenas for the attendance of witnesses and the production of documents.

(iv) Issue and renew licenses.

(v) Register vendors.

(vi) Conduct investigations, inspections, audits, share information with law enforcement agencies, conduct hearings, and settle alleged violations of the act and these rules.

(vii) Engage in other functions necessary to the proper administration and enforcement of the act and these rules.

(viii) Grant requests and waivers, answer inquiries, issue interpretations, and otherwise take any action that is reasonably requested by applicants, licensees, and vendors in furtherance of, and consistent with, the efficient administration and enforcement of the provisions of the act and these rules, as determined to be necessary or appropriate by the executive director.

(2) The board may set hiring standards for employees.

(3) The board has general responsibility for the implementation of the act. The board’s duties include, but are not limited to, all of the following:

(a) Deciding in a reasonable period of time all license applications.

(b) Investigating applicants for licenses or registration. The board may grant licenses or register persons in accordance with the act and these rules.

(d) Investigating alleged violations of the act or these rules and taking appropriate disciplinary action against a licensee or any other person, or instituting appropriate legal action for enforcement, or both.

(e) Conducting investigative and contested case hearings, issuing subpoenas and administering oaths and affirmations to the witnesses to exercise and discharge the powers and duties of the board under the act.

(f) Revoking or suspending licenses and registrations and imposing fines as the board considers necessary and in compliance with applicable laws of this state.

(g) Imposing fines against individuals and against internet gaming operators and internet gaming suppliers for engaging in a fraudulent practice, or for each violation of the act, these rules, any resolution or order of the board, or for any other action that the board determines is a detriment or impediment to internet gaming.

(h) Taking any other action as may be reasonable or appropriate to enforce the act and these rules.

(4) The board may seek and will receive the cooperation and assistance of other departments and agencies in conducting background investigations and in fulfilling its responsibilities under the act.

R 432.613a Member, employee, or agent of board; conduct generally.

Rule 613a. (1) By January 31 of each year, each member, the executive director, and all employees of the board will file 1 or more board disclosure forms. The board will determine the contents of the form, but it must include such information as necessary to ensure the integrity of internet gaming and disclosure of all relevant financial information. The form may be combined with similar forms required by other acts or rules.

(2) Any member, the executive director, employee, or agent of the board who is negotiating for, or acquires by any means, any interest in any person who is a licensee or an applicant or any person affiliated with such a person, must immediately provide written notice of the details of the interest to the chairperson. The member, executive director, employee, or agent of the board must not act on behalf of the board with respect to that person.

(3) A member, the executive director, employee, or agent of the board may enter into any negotiations for employment with any person or affiliate of any person who is a licensee or an applicant. The member, executive director, employee, agent, licensee, applicant, or affiliate must immediately notify the chairman and the executive director once the invitation to discuss negotiations has been extended. A potential employer asking if an individual would be interested in a position or explaining the nature of a position does not constitute negotiations for employment. Further, an individual completing an employment application does not constitute negotiations for employment. The member, executive director, employee, or agent of the board must not take any action on behalf of the board with respect to that person while the negotiations are ongoing. All members, the executive director, board employees, agents, and contractors must, to the maximum extent possible, avoid situations, relationships, or associations that may represent or lead to an actual or perceived conflict of interest.

(4) A member, the executive director, an employee, or agent or their spouse may not accept any gift, gratuity, compensation, travel, lodging, or anything of value, directly or indirectly, from any licensee or any applicant or affiliate or representative of an applicant or licensee, unless the acceptance conforms to a written policy issued by the chairperson. The chairman may exempt attendance at a reception, and food and drink for immediate consumption from this policy. The policy must be publicly available and shared with all licensees.

(5) A licensee or applicant, or affiliate or representative of an applicant or licensee, may not, directly or indirectly, give or offer to give any gift, gratuity, compensation, travel, lodging, or anything of value to any member, the executive director, an employee, or agent of the board which the member, employee, or agent of the board is prohibited from accepting under subrule (4) of this rule.

(6) A licensee or applicant or any affiliate or representative of an applicant or licensee must not engage in ex parte communications with a member of the board. A member of the board must not engage in any ex parte communications with a licensee or an applicant or with any affiliate or representative of an applicant or licensee.

(7) Any member, licensee, or applicant or affiliate or representative of a board member, licensee, or applicant who receives any ex parte communication in violation of subrule (6) of this rule, or who is aware of an attempted communication in violation of subrule (6) of this rule, must immediately report details of the communication or attempted communication in writing to the chairperson.

(8) A member, the executive director, an employee, or agent of the board must not have an internet wagering account or participate in or wager on any internet gaming conducted in this state except as part of the individual’s surveillance, security, or other official duty authorized by the board.

(9) Violation of this section by a licensee, applicant, or affiliate or representative of a licensee or applicant or affiliate, may result in denial of an application for licensure, revocation or suspension of license, or other action by the board.

(10) Violation of this section does not create a civil cause of action.

R 432.614 Denial or non-renewal hearings.

Rule 614. (1) A person whose application for a license or a transfer of ownership has been denied, whose license has not been renewed, or who has been denied an approval from the board required in these rules may request a hearing. The hearing will be de novo.

(2) The person must submit an original hearing request, pleading, or other written document to the board, must serve each party or attorney of record, and provide a proof of service on each party or attorney of record.

R 432.614a Request for hearing.

Rule 614a. (1) A request for hearing must meet all of the following requirements:

(a) Be in writing.

(b) State the name, current address, and current telephone number of the petitioner.

(c) State in detail the reasons why, and the facts upon which the petitioner will rely to show that, the petitioner's application for a license should not have been denied, the license should have been renewed, the transfer of ownership should have been approved, or approval should have been granted.

(d) Be signed, verified, and dated. A petitioner must have the verification notarized and include a certification stating, "Under the penalty of perjury, the undersigned has examined this request for hearing and to the best of my knowledge and belief, it is true, complete, and correct."

(2) A request for hearing must be submitted within 21 days after service of the notice of denial, notice of nonrenewal, or disapproval. A request for a hearing submitted by certified mail or overnight express mail will be deemed submitted in a timely manner if it is postmarked no later than 21 days after service of a notice of denial, notice of nonrenewal, or disapproval.

(3) A request for a hearing is deemed granted unless denied.

(4) A request for a hearing may be withdrawn by the petitioner. If the request for hearing is withdrawn, then the initial denial, nonrenewal, or disapproval becomes a final board order.

(5) Unless the board denies a request for hearing, the board will submit the request for hearing to the appropriate state agency.

(6) Default judgment or dismissal may result at any stage of the proceeding.

R 432.614b Proceedings.

Rule 614b. (1) The burden of proof is at all times on the petitioner. The petitioner must have the affirmative responsibility of establishing, by clear and convincing evidence, any of the following:

(a) The petitioner should have been awarded a license.

(b) The license should have been renewed.

(d) Approval should have been granted.

(2) The hearing will be conducted in accordance with the administrative procedures act of 1969, 1969 PA 306, MCL 24.201 to 24.328, except as otherwise provided in these rules or the act.

R 432.614c Prohibition on ex parte communication.

Rule 614c. A party or its attorney must not communicate directly or indirectly with the hearing officer regarding any pending matter, except upon notice and opportunity for all parties to participate. A party that engages in ex parte communication with the hearing officer may be subject to sanctions and penalties.

R 432.614d Sanctions and penalties.

Rule 614d. (1) The hearing officer may make recommendations of sanctions and penalties if the hearing officer finds that a party has failed to appear at a scheduled hearing, has acted in bad faith for the purpose of delay, or has otherwise abused the hearing process. Sanctions and penalties include, but are not limited to, a fine or default judgment or a directed finding on 1 or more issues.

(2) If a petitioner refuses to testify on his or her own behalf with respect to any question propounded to him or her, then the hearing officer may infer that the testimony or answer would have been adverse to the case of the petitioner.

(3) If the petitioner or attorney of record fails to answer a subpoena or refuses to testify fully at the request of the board, then the failure may be deemed independent grounds for a finding that the petitioner should have been denied a license or the transfer of ownership. The hearing officer may also infer from the failure to answer a subpoena or refusing to testify fully that the testimony would have been adverse to the petitioner.

R 432.614e Recording proceedings; transmittal of record and board action.

Rule 614e. (1) Oral proceedings involving contested issues must be recorded to ensure the preservation of the testimony. A party may request a transcript of the proceedings. The requesting party must pay for the transcript.

(2) Unless otherwise specified by the board, the hearing officer, within 60 days of

the conclusion of the hearing, or the submission of post-hearing briefs or proposed findings of fact, will issue, to the board and to the parties, written findings of fact,

conclusions of law, and recommendations. Findings of fact must be based exclusively on

testimony, evidence, and matters within the record. The findings of fact must be stated

separately.

(3) Unless otherwise agreed to by the parties or as set by the hearing officer, the

parties will have 21 days from the service of the findings of fact, conclusions of law, and

recommendations of the hearing officer to file objections.

(4) Unless otherwise agreed to by the parties or as set by the hearing officer, the

parties may file a response to the objections within 21 days from service of the objections.

(5) After the time period for the parties to file objections and responses to those objections, the hearing officer must transmit the entire record to the board.

(6) Before issuing a final order, the board must consider the record as a whole.

(7) After considering the record, the board may take any of the following actions:

(a) Affirm the written recommendations, findings of fact, and conclusions of law submitted by the hearing officer as its final board order.

(b) Issue a final order modifying the written recommendations, findings of fact, and conclusions of law submitted by the hearing officer.

(c) Issue a final order rejecting the written recommendations, findings of fact, and conclusions of law submitted by the hearing officer.

(d) Issue an order remanding the matter, with instructions, to the hearing officer for further proceedings.

(8) The board must serve copies of its orders on the parties.

(9) A board order becomes effective upon service.

R 432.615 Request for declaratory ruling; form; contents.

Rule 615. (1) An individual who requests a declaratory ruling from the board as to the applicability to an actual state of facts of a statute, rule, resolution, or order administered, promulgated, or issued by the board must do so in writing.

(2) The written request must contain the relevant and material facts along with a reference to the statute, rule, resolution, or order applicable.

R 432.615a Declaratory ruling; notice of issuance; request for information or arguments;

hearing.

Rule 615a. (1) Within 90 days of the receipt of the request for a declaratory ruling, the board will issue a written notification by regular first-class mail to the petitioner and the petitioner’s legal counsel, if any, stating whether or not a declaratory ruling will be issued.

(2) If the board decides to issue a declaratory ruling, the board may do any of the

following:

(a) Request more information from the individual.

(b) Request information from other interested parties.

(d) Request oral or written arguments from interested parties.

(e) Hold a hearing upon proper notice to all interested parties.

(f) Decline to issue a declaratory ruling.

R 432.616 Reasons for investigation of, or disciplinary action against, licensee; hearing

procedure.

Rule 616. (1) The board may initiate an investigation or a disciplinary action, or both, against a licensee if the board has reason to believe that at least 1 of the following provisions applies:

(a) The licensee is not maintaining suitability for licensure as provided by the act.

(b) The licensee is not complying with licensure conditions.

(2) Before initiating disciplinary proceedings, the board must give notice and an opportunity to show compliance in accordance with section 92 of the administrative procedures act of 1969, 1969 PA 306, MCL 24.292.

(3) An internet gaming operator is responsible for the conduct of any licensee it uses to conduct internet wagering under the act. An internet gaming supplier is also responsible for its conduct of internet gaming under the act and these rules. Any violation of the act or the rules by the internet gaming operator in which the internet gaming supplier participated in the action will also be considered a violation by the internet gaming supplier, and the board may hold both, or either, accountable for the violation.

(4) The board may initiate disciplinary proceeding by designating a member or the executive director to conduct a hearing or by initiating proceedings with the appropriate state agency under the contested case provisions of the administrative procedures act of 1969, 1969 PA 306, MCL 24.271 to 24.288, and the rules promulgated thereto.

R 432.616a Actions available to hearing officer.

Rule 616a. (1) The hearing officer may make recommendations to impose sanctions and penalties if the hearing officer finds that a party has failed to appear for a scheduled hearing, acted in bad faith for the purpose of delay, or has otherwise abused the hearing process.

(2) If a respondent fails to testify on the respondent's own behalf with respect to any question propounded to the respondent, then the hearing officer may infer that the testimony or answer would have been adverse to the case of the party refusing to testify.

(3) If the respondent or attorney of record fails to answer a subpoena or refuses to testify fully at the request of the board, then the failure may be deemed independent grounds for a finding that the respondent should be disciplined. The hearing officer may also infer that the testimony would have been adverse to the respondent.

R 432.616b Actions available to the board.

Rule 616b. The board may take any of the following disciplinary actions against a licensee:

(a) Suspend, revoke, restrict, or place conditions on the license of a licensee.

(b) Require the removal of a licensee or the removal of an employee of a licensee.

(d) Impose against an occupational licensee, for each violation of the act or these rules, a civil penalty of not more than $10,000.00 as a result of the violation or attempted violation of the rules.

(e) Any other action deemed necessary by the board to ensure compliance with the act or these rules.

R 432.617 Special proceedings.

Rule 617. (1) The board may suspend a license without notice or hearing if the board determines that the safety or health of persons or employees or the integrity of internet gaming is jeopardized by continuing an operation or that the action is necessary for the immediate preservation of the integrity of internet gaming, public peace, health, safety, morals, good order, or general welfare.

(2) The suspension may remain in effect until the board determines that the cause for suspension has been abated.

(3) Following a hearing, the board may revoke the license upon a determination that satisfactory progress toward abating the hazard has not been made.

R 432.618 Waiver of requirements.

Rule 618. The board may, in writing, waive, restrict, or alter any requirement or procedure set forth in these rules, if the board determines any of the following:

(a) The requirement or procedure is impractical or burdensome.

(b) That the waiver, restriction, or alteration is in the best interest of the public and the internet gaming.

(c) That the waiver, restriction, or alteration is not outside the technical requirements necessary to serve the purpose of the requirement or procedure.

PART 2. LICENSING: OPERATOR, SUPPLIER, OCCUPATIONAL; VENDOR REGISTRATION

R 432.621 Required notification of anticipated or actual changes in key person of

internet gaming operator and internet gaming supplier.

Rule 621. An internet gaming operator applicant or licensee must notify the board prior to anticipated or actual change in key person. An internet gaming supplier applicant or licensee must notify the board of any change in key person within 30 days of appointment.

R 432.621a Notification of new financial sources of internet gaming platform providers.

Rule 621a. An internet gaming platform provider applicant or licensee must notify the board, in writing, as soon as practicable, after it becomes aware that it intends to enter into a transaction related in any way to its development and operations that may result in any new financial backers, investors, mortgages, bondholders, or holders of indentures, notes, or other evidences of indebtedness of the applicant or licensee. A publicly traded corporation will be considered to have complied with this rule if it has complied with the reporting requirements in R 432.621d.

R 432.621b Notification by applicants or licensees required.

Rule 621b. (1) An internet gaming operator or internet gaming supplier applicant or licensee, affiliate that has control of an internet gaming operator applicant or licensee, or other person that has control of an internet gaming operator or internet gaming supplier applicant or licensee must notify the board, as soon as practicable after it becomes aware that, with regard to any such company, any person or individual has:

(a) Beneficially acquired more than 5% of any class of the company's equity securities.

(b) The ability to control the applicant for an internet gaming operator license or internet gaming supplier license, or holder of an internet gaming operator license or internet gaming supplier license, or affiliate that has control of an internet gaming operator applicant or licensee.

(c) The ability to elect 1 or more directors of the applicant for an internet gaming operator license or internet gaming supplier license, or holder of an internet gaming operator license or internet gaming supplier license, or affiliate that has control of an internet gaming operator license applicant or licensee.

(2) To the extent known by the internet gaming operator license or internet gaming supplier license applicant or licensee, the required notification must include the name, business address, phone number, and other personal identification information for each person.

(3) A person applying for or holding an internet gaming operator license or internet gaming supplier license must report to the board the election or appointment of a director or officer of that applicant or licensee or a holding company of that applicant or licensee who is actively and directly engaged in the administration or supervision of that applicant’s or licensee’s internet gaming operation.

(4) A person who applies for or holds an internet gaming operator license and all other persons covered by this part must file any other document requested by the board to ensure compliance with the act or this part within 30 days of a board request or at another time established by the board.

(5) A publicly traded corporation will be considered to have complied with this rule if it has complied with the reporting requirements in R 432.621d.

R 432.621c Required notification of formation, dissolution, or transfer of subsidiaries.

Rule 621c. (1) An internet gaming operator or internet gaming supplier applicant or licensee, affiliate that has control of an internet gaming operator applicant or licensee, or other person that has control of an internet gaming operator or internet gaming supplier applicant or licensee, must report, in writing, to the board, as soon as practicable, the formation or dissolution of, or any transfer of, a nonpublicly traded or publicly traded interest in an internet gaming operator or internet gaming supplier applicant or licensee, affiliate that has control of an internet gaming operator applicant or licensee, or other person that has control of an internet gaming operator or internet gaming supplier applicant or licensee.

(2) A publicly traded corporation will be considered to have complied with this rule if it has complied with the reporting requirements in R 432.621d.

R 432.621d Publicly traded corporation reporting requirements.

Rule 621d. (1) A publicly traded corporation or other person that applies for or holds an internet gaming operator license or internet gaming supplier license who is a public reporting company under the securities exchange act of 1934, 15 USCS 78a to 78qq, or the securities act of 1933, 15 USCS 77a to 77aa, must submit a copy of all submissions required by the U.S. Securities and Exchange Commission to the board in a format prescribed by the board. The submissions will be due within 14 days of the filing dates required by the U.S. Securities and Exchange Commission.

(2) If a publicly traded corporation or other person that applies for or holds an internet gaming operator license or internet gaming supplier license receives any material document filed with the U.S. Securities and Exchange Commission by any other person relating to the publicly traded corporation, the person must file 1 copy of the document with the board within 14 days after receipt of the material.

(3) A publicly traded corporation or other person that applies for or holds an internet gaming operator license or internet gaming supplier license must file a list of record holders of its voting securities with the board annually.

R 432.621e Exemption for institutional investors.

Rule 621e. (1) An institutional investor who acquires beneficial ownership of a person that has applied for or holds an internet gaming operator license or internet gaming supplier license must notify the board within 14 days after the institutional investor acquires the interest or files form 13-D or 13-G with the U.S. Securities and Exchange Commission, or both, and must provide additional information, and may be subject to a finding of suitability, as required by the board.

(2) An institutional investor who acquires and holds a less than 25% interest for investment purposes only in a person that has applied for or holds an internet gaming operator license or internet gaming supplier license in this state may in a manner and form prescribed by the board, file an exemption form to establish exemption from the eligibility and suitability requirements of the act.

(3) The licensee in whom the institutional investor acquires the interest must file an application for approval of the transfer within 30 days after the transfer. Within the same time period, the institutional investor must file either an exemption form if the institutional investor holds the interest for investment purposes only or an application and disclosure forms as part of the licensee’s application if the institutional investor does not hold the interest for investment purposes only.

(4) The board may require that any person, including an institutional investor, seeking approval to hold ownership interests subject to this part apply for a finding of suitability in accordance with this rule if the board deems the finding of suitability necessary to ensure compliance with the act and these rules. If the board denies a request for an institutional investor exemption, the institutional investor must, within 30 days, either divest itself of the interest or file application and disclosure forms as part of the relevant licensee’s license.

(5) The following activities are deemed to be consistent with holding equity securities for investment purposes only under this rule:

(a) Voting, directly or indirectly, through the delivery of a proxy furnished by the board of directors, on all matters voted on by the holders of the voting securities.

(b) Serving as a member of a committee of creditors or security holders formed in connection with a debt restructuring.

(c) Nominating a candidate for election or appointment to the board of directors in connection with a debt restructuring.

(d) Accepting appointment or election as a member of the board of directors in connection with a debt restructuring and serving in that capacity until the conclusion of the member's term.

(e) Making financial and other inquiries of management of the type normally made by securities analysts for information purposes and not to cause a change in its management, policies, or operations.

(f) Other activities that the board determines to be consistent with the investment intent.

(6) If an institutional investor acquires 25% or more ownership interest of a licensee, the institutional investor must notify the board within 14 days of acquiring the ownership interest.

R 432.621f Applicability of part; transfer of ownership interest; limitation.

Rule 621f. (1) An interest in a person applying for or holding an internet gaming operator license or internet gaming supplier license may only be transferred in accordance with this part.

(2) The following persons must provide notice to the board no later than 30 days after execution of the transfer:

(a) Except for an internet gaming platform provider, a person that transfers or acquires greater than a 5% interest in a person that has applied for or holds an internet gaming supplier license in this state.

(b) Except for an internet gaming platform provider, a person who, as a result of an acquisition, has acquired an interest totaling greater than 5% in a person that has applied for or holds an internet gaming supplier license in this state.

(3) Except as stated in subrules (5) and (6) of this rule, the following persons must provide notice to the board 30-days prior to execution of a transfer:

(a) A person that intends to transfer or acquire greater than a 5% interest in a person that has applied for or holds an internet gaming operator license or internet gaming platform provider in this state.

(b) A person who, as a result of an acquisition, will acquire an interest totaling greater than 5% in a person that has applied for or holds an internet gaming operator license or is an internet gaming platform provider in this state.

(4) The board must determine the person acquiring the interest is eligible and suitable under the standards set forth in the act and these rules, unless the board grants the person an institutional-investor exemption under these rules or under section 6(11), MCL 432.306, or section 8(10), MCL 432.308 of the act. Once the board determines that the person acquiring the interest is eligible and suitable under the standards set in the act and these rules, the executive director may approve the transfer.

(5) A transfer of interest to an institutional investor that acquires or will have acquired, upon completion of the transfer, less than 25% of the equity securities of a person that applies for or holds an internet gaming operator license or internet gaming supplier license may occur without first receiving executive director approval if the equity securities are held for investment purposes only but is subject to other requirements of this part.

(6) A transfer of interest in an internet gaming operator or internet gaming supplier licensee may occur if the transfer is between persons the board has found eligible and suitable for licensure during the licensing period in which the transfer occurs. In those cases, approval of the transfer must be requested no later than 30 days after the transfer, and the executive director may decide the application.

(7) If approval of the transfer of interest is denied by the executive director or the person acquiring the interest is found unsuitable by the board, the transferee must divest itself of the interest within 30 days after the date of the order denying approval.

R 432.621g Application for transfer of ownership.

Rule 621g. (1) A person desiring to acquire an ownership interest in a person applying for or holding an internet gaming operator license or internet gaming supplier license must complete and submit application and disclosure forms, in the manner and form prescribed by the board.

(2) A person desiring to acquire an interest in a person applying for or holding an internet gaming operator license or internet gaming supplier license must present evidence that the person desiring to acquire the interest is eligible and suitable under the standards and criteria for licensure set forth in the act and these rules.

(3) A person applying for or holding an internet gaming operator license or internet gaming supplier license that is attempting to transfer an ownership interest must submit any information or documentation deemed necessary by the board to ensure compliance with the act and these rules.

R 432.621h Transfer investigative costs and fees.

Rule 621h. An investigation fee may be assessed to the extent that there are costs directly associated with the background investigation relating to the person desiring to acquire an interest in an internet gaming operator or internet gaming supplier. Unless otherwise determined by the board, approval may be withheld until full payment of the direct background investigation fees.

R 432.621i Denials.

Rule 621i. If an application for a transfer of interest is denied, a notice of denial will be issued.

R 432.621j Review of information at licensee’s or applicant’s premises; costs to internet

gaming operator and internet gaming supplier.

Rule 621j. (1) The board may review, at the premises of the custodian of the information, any information that the act or these rules provide for from any of the following entities:

(a) A license applicant.

(b) A licensee.

(2) If information is reviewed at the premises of the custodian of the information then the license applicant or licensee must, as soon as practicable, reimburse the board for all licensure investigation expenses incurred in performing the review at the premises of the custodian of the information, including travel, food, and lodging that exceed the amount of the application fee.

R 432.621k Applicant/licensee disclosure of representatives to act on their behalf before the board.

Rule 621k. (1) An applicant or licensee must file, with the board, a list of persons authorized to act on the applicant's or licensee's behalf as to any matter before the board. An attorney appearing on behalf of an applicant or licensee in a matter before the board must promptly file an appearance identifying his or her client and the matter in which the attorney will appear.

(2) A person holding or applying for a license must establish and identify a representative within Michigan for the purpose of accepting service of process, notices, and other forms of communication from the board for the person holding or applying for a license.

R 432.622 License classifications.

Rule 622. (1) Internet gaming operator license. The following persons are eligible to hold an internet gaming operator license:

(a) A person that holds a casino license under the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.201 to 432.226.

(b) An Indian tribe that lawfully conducts class III gaming in a casino located in this state under a facility license issued in accordance with a tribal gaming ordinance approved by the chair of the National Indian Gaming Commission.

(2) Internet gaming supplier license. A person that provides goods or services that directly affect wagering, play, and results of internet games to internet gaming operators is required to hold an internet gaming supplier license. Internet gaming supplier includes, but is not limited to, the following:

(a) Internet gaming platform providers.

(b) Geofence providers.

(c) Providers of software that directly affect wagering, play, the results of an internet game, or the integrity of internet gaming.

(d) Providers hosting live internet gaming data.

(e) Affiliate marketers that have a payment agreement based on the sharing of gross receipts or adjusted gross receipts.

(f) Unless otherwise determined by the board, any other person that meets 1 or more of the following criteria:

(i) The person manufactures, supplies, or distributes devices, machines, equipment, items, or articles that meet any of the following provisions:

(A) Are specifically designed for use in the conduct of internet gaming.

(B) Have the capacity to affect the outcome of an internet wager.

(ii) The person services or repairs internet gaming wagering devices, machines, equipment, items, or articles impacting the integrity of internet gaming.

(iii) The person provides services directly related to the operation, security, surveillance, or management of internet gaming.

(iv) The person provides other goods or services determined by the board to be so utilized in, or incidental to, the operation of an internet gaming operator that the person must be licensed as an internet gaming supplier to protect the public and enhance the credibility and integrity of internet gaming in this state.

(3) A person must be licensed as an internet gaming supplier before providing goods, software, or services as an internet gaming supplier to an internet gaming operator.

R 432.623 Occupational licensing.

Rule 623. (1) An individual must have an occupational license if his or her duties directly impact the integrity of internet gaming as determined by the board in its sole discretion subject to the following:

(a) The board will exercise its discretion with respect to any internet gaming operator applicant or licensee that is an Indian tribe consistent with limitations prescribed in the act.

(b) An internet gaming operator or internet gaming supplier may provide an explanation, such as a job description, to support an allegation that a position should not require an occupational license.

(c) Elected or appointed officials of a federally recognized Indian tribe located within this state are exempt from any occupational licensing requirement unless they are employees of the tribe’s internet gaming operation.

(2) Individuals in the following positions are deemed by the board to directly impact the integrity of internet gaming:

(a) An individual who has the capability of affecting the outcome of an internet game through other than read-only or the equivalent access to any critical components of an internet gaming platform identified in Part 3 of these rules.

(b) An individual who directly supervises individuals who have the capability of affecting the outcome of an internet game through other than read-only or the equivalent access to any critical components of an internet gaming platform identified in Part 3 of these rules.

(c) An individual who directly manages an internet gaming operation or who directly supervises an individual who directly manages an internet gaming operation.

(d) Any other individual who directly impacts the integrity of internet gaming as determined by the board.

(3) An individual applying for an occupational license must complete an application in the manner and form prescribed by the board and submit it together with the required application fee and a written statement from an internet gaming operator or internet gaming supplier indicating that it has employed or will employ the individual if the individual is licensed.

(4) If a preliminary review of the application and criminal history check does not uncover or indicate any circumstance that may require denial of the application under the licensing standards established in this rule, a temporary occupational license may be issued. The temporary occupational license authorizes the individual to perform the employment duties for which the license is sought, pending action on the license application. A temporary license is valid until the occupational license application is withdrawn or denied, the temporary license is suspended or revoked, or the license is issued by the board.

(5) An individual has the burden to establish by clear and convincing evidence his or her suitability as to character, reputation, integrity, and responsibility.

(6) The board may, in its discretion, deny an occupational license to an individual who is or does any of the following:

(a) Fails to disclose or states falsely any information requested in the application.

(b) Has been convicted of a criminal offense involving gambling, dishonesty, theft, or fraud in any jurisdiction. However, the board may waive this requirement if the conviction occurred more than 5 years before the applicant applies for a license and the board is convinced that the applicant does not pose a threat to the integrity of internet gaming and the applicant otherwise meets the requirements of this section.

(d) Lacks the requisite suitability as to integrity and character as determined by the board.

(e) Has had a prior gambling related license or license application suspended, restricted, revoked, or denied for just cause in any other jurisdiction.

(7) The board will decide whether to grant or deny the application for an occupational license. Such decision will not be arbitrary or capricious.

(8) Upon granting the application for an occupational license and payment of the licensing fee, the executive director will issue the occupational license.

(9) The occupational license is not transferable to another individual.

(10) An occupational licensee must have on his or her person the license while working for the applicable internet gaming operator or internet gaming supplier in this state during work hours.

(11) The board may exempt an individual from any or all of the occupational licensing requirements if:

(a) The individual is licensed under the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.201 to MCL 432.226.

(b) The individual is licensed under the lawful sports betting act, 2019 PA 149, MCL 432.401 to MCL 432.419.

(c) The board determines, in its sole discretion, that licensing is not deemed necessary to protect the public interest or accomplish the policies of the act.

(12) The board may suspend, revoke, summarily suspend, or refuse to renew a license for just cause.

(13) An occupational license is valid for 2 years and must be renewed as prescribed by the board. If the occupational licensee files a renewal request and pays the licensing fee in a timely manner and in the manner and form prescribed by the board, then the licensee’s existing occupational license does not expire until a decision on the application for renewal is made.

R 432.624 Fees, fines, taxes, payments, and assessments.

Rule 624. (1) All fees, fines, taxes, payments, and assessments provided for under the act and these rules must be timely submitted to the board by a payment method acceptable to the board, such as a certified check, cashier's check, money order made payable to "State of Michigan," or electronic transfer of funds.

(2) An internet gaming operator must remit the tax or payment imposed by the act to the board by an electronic transfer of funds. An internet gaming operator licensee must maintain an account at a designated financial institution that is capable of handling electronic fund transfers.

(3) The following nonrefundable license application fees must be submitted to the board, together with the required license application form or forms, for the corresponding license classification to which the fees relate:

(a) Internet gaming operator license application: $50,000.00.

(b) Internet gaming supplier license application: $2,500.00.

(4) The license application fee will be used by the board to conduct an appropriate background investigation of the applicant as prescribed by the board, the act, and these rules. No portion of a remitted application fee will be refunded.

(5) An additional background investigation charge may be assessed to the extent the board's direct investigative costs exceed the applicant's application fee. Unless otherwise determined by the board, a license may not be issued until payment of the additional assessed charge for completion of the background investigation is received by the board.

(6) A licensee may also be assessed the board's direct investigative costs arising from a background investigation for renewal of a license to the extent such costs exceed the application fees. The board may deny a renewal application if the licensee does not pay the additional assessed costs by a date set by the board.

(7) The following license fees must be submitted to the board by the applicant upon initial issuance of the license under the act and these rules:

(a) Internet gaming operator license: $100,000.00.

(b) Internet gaming supplier license: $5,000.00.

(8) The following annual license fees must be submitted to the board by the licensee each year after the initial license is issued under the act and these rules:

(a) Internet gaming operator license: $50,000.00

(b) Internet gaming supplier license: $2,500.00.

R 432.624a Deposit of fees, fines, taxes, payments, and assessments.

Rule 624a. Except as provided in sections 15 and 15a of the act, MCL 432.315 and 432.315a, all fees, fines, taxes, payments, and assessments imposed by this state under the act and these rules must be deposited into the internet gaming fund.

R 432.625 Investigation process for internet gaming operators and internet gaming

suppliers.

Rule 625. The board will conduct a background investigation on an applicant subject to the limitations of section 6 of the act, MCL 432.306, when the applicant is an Indian tribe. The board will also use the information provided in the application and disclosure form or forms as a basis for a background investigation and to evaluate and determine the eligibility and suitability of the applicant to receive an internet gaming operator license or internet gaming supplier license under the licensing standards and criteria provided in the act and these rules. A misrepresentation or omission in the application is cause for the denial, suspension, restriction, or revocation of an internet gaming operator license or internet gaming supplier license by the board.

R 432.625a Persons required to be found eligible and suitable.

Rule 625a. (1) The board will not issue or renew an internet gaming operator license or internet gaming supplier license unless every person required by the act and these rules as part of the application for issuance or renewal of the license has first been determined by the board to be eligible and suitable in accordance with the relevant licensing standards set forth in the act and these rules.

(2) Unless otherwise prescribed by the board, the following persons are required to be found eligible and suitable as part of the application for the issuance, or request for renewal, of an internet gaming operator license or internet gaming supplier license:

(a) A person who is required to apply for an internet gaming operator license or internet gaming supplier license under the act and these rules.

(b) A person who is included in the term “applicant” as defined by the act.

(3) A person required to be found eligible and suitable as part of the application for issuance or renewal of an internet gaming operator license or internet gaming supplier license must complete and file with the board an application and required disclosure forms in the manner and form prescribed by the board.

(4) A person that applies for or holds an internet gaming operator or internet gaming supplier license must ensure that all persons who are required by the act and these rules to establish their eligibility and suitability as part of the applicant's application for the issuance, or the licensee's maintenance or renewal, of the internet gaming operator license or internet gaming supplier license have filed, with the board, all required applications, reports, and disclosure forms in the manner and form prescribed by the board.

R 432.625b License issuance by the board—standards and criteria.

Rule 625b. (1) Except to the extent the board may require different or additional procedures, an applicant for an internet gaming operator license or internet gaming supplier license will be subject to all of the following before licensing:

(a) Application

(b) Background Investigation

(2) A person that is required to be licensed as an internet gaming operator or internet gaming supplier under the act and these rules must, before issuance of an internet gaming operator’s or internet gaming supplier’s license, produce such information, documentation, and assurances to establish all of the following by clear and convincing evidence:

(a) Its suitability as to character, reputation, integrity, business probity, and financial ability.

(b) Its willingness to be subject to the jurisdiction of the board.

(c) The applicant has adequate capitalization and the financial ability and the means to develop, construct, operate, and maintain the applicant’s internet gaming operator or internet gaming supplier business in accordance with the act and these rules.

(d) The applicant has adequate capitalization and the financial ability to responsibly pay its secured and unsecured debts in accordance with its financing agreements and other contractual obligations.

(e) The applicant’s compliance with casino or casino-related licensing requirements or compacts with this state or any other jurisdiction.

(f) The applicant and all other persons required to be found eligible and suitable as part of the application are eligible and suitable for licensure under the licensing standards, criteria, and requirements.

(g) The applicant, if an individual, and all other individuals required to be found eligible and suitable as part of the application are not less than 21 years of age, unless otherwise approved by the board.

(h) The applicant and all other persons required to be found eligible and suitable as part of the application have not been convicted of any criminal offense involving gaming, theft, dishonesty, or fraud in any jurisdiction. However, the board may waive this requirement if the conviction occurred more than 5 years before the applicant applies for a license and the board is convinced that the applicant does not pose a threat to the integrity of internet gaming and the applicant otherwise meets the requirements of this section.

(i) The applicant and all other persons required to be found eligible and suitable as part of the application do not appear on the exclusion list of any jurisdiction.

(j) The applicant and all other persons required to be found eligible and suitable as part of the application are in substantial compliance with all local, state, and federal laws.

(k) The applicant has the financial ability to purchase and maintain adequate liability and casualty insurance and to provide an adequate surety bond.

(3) Subrule (2) of this rule does not apply to an Indian tribe except to the extent authorized by the act. To the extent a non-tribal applicant or licensee will be providing goods and services to an internet gaming operator who is an Indian tribe, that applicant or licensee will be required to provide information relative to its relationship with the internet gaming operator to determine if it is an arm of the tribe. “Arm of the tribe” means a tribally-created economic entity owned in part or in whole by the Indian tribe which was intended by the Indian tribe to share in its sovereign immunity.

(4) Once licensed, a person must comply with the act and these rules. Failure to comply may result in disciplinary action.

R 432.625c Provisional licenses for internet gaming suppliers.

Rule 625c. (1) Upon written request of a person applying for an internet gaming supplier’s license, the executive director may issue a provisional license to the applicant and permit the applicant to conduct business transactions with, and provide goods and services to internet gaming operators, if all of the following provisions are complied with:

(a) A completed application, an application fee, and all required disclosure forms and other required written documentation and materials have been submitted by the applicant.

(b) Preliminary review of the application and a criminal history check does not reveal that the applicant or the applicant’s affiliates or key person have been convicted of a felony or misdemeanor involving gambling, theft, dishonesty, or fraud, or may otherwise be ineligible or unsuitable to permit licensure under the act or these rules.

(d) The applicant has a letter of intent to provide goods or services to an internet gaming operator or the applicant shows good cause for being granted a provisional license.

(2) A provisional license issued under this rule expires on the date provided by the board.

(3) If the internet gaming supplier’s provisional license expires, or is suspended or revoked, the executive director will forward the applicant’s application for an internet gaming supplier license to the board at the conclusion of the background investigation for action on the application.

(4)The board may, at its discretion, waive any or all of the provisions listed in subrule (1) of this rule if the applicant is licensed by the board under the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.201 to 432.226, or the lawful sports betting act, 2019 PA 149, MCL 432.401 to 432.419.

R 432.626 Denials.

Rule 626. (1) If the board denies the application for a license, it will direct the executive director to issue a notice of denial.

(2) An applicant, including an individual applying for an occupational license, who is served with a notice of denial under these rules may request a contested case hearing as set forth in these rules.

(3) The notice of denial is a finding that the person is ineligible or unsuitable for licensure or is otherwise in violation of the licensing requirements of the act or these rules. When the board denies an application for a license, the person is prohibited from conducting business that would otherwise require licensure.

(4) A person whose application for a license has been denied may not reapply for a period of one-year from the date on which the board voted to deny the application unless otherwise approved by the board.

(5) A person whose application for a license was denied may seek leave of the board to reapply within the one-year period by addressing the request to the board. The board may require the person to present oral or written argument outlining why an exception should be made.

R 432.627 Renewal of a license.

Rule 627. (1) An internet gaming operator or internet gaming supplier license when issued is valid for a five-year period.

(2) An internet gaming operator or internet gaming supplier licensee may renew its license every 5 years after receiving its initial license.

(3) An internet gaming operator or internet gaming supplier licensee intending to renew its license must, at least 30 days before expiration of its license, submit the annual license renewal fee and application in the manner and form required by the board.

(4) If the board denies the application for renewal, it will direct the executive director to issue the licensee a notice of nonrenewal.

(5) An internet gaming operator or internet gaming supplier licensee who is served with a notice of nonrenewal under this rule may request a contested case hearing as set forth in these rules.

(6) The notice of nonrenewal is a finding that the internet gaming operator or internet gaming supplier licensee is ineligible or unsuitable for licensure or is otherwise in violation of the licensing requirements of the act or rules of the board. When the board denies an application for renewal, the person is prohibited from conducting business that would otherwise require such licensure.

R 432.628 Application explained; applicant to demonstrate eligibility and suitability.

Rule 628. (1) An application for a license under the act and these rules is a request by the applicant seeking a revocable privilege. A license will be granted by the board if the applicant meets the licensing requirements of the act and these rules.

(2) An applicant for a license under the act and these rules must, at all times, have the burden of demonstrating to the board, by clear and convincing evidence, that the applicant is eligible and suitable to be granted and retain the license for which application is made under the applicable licensing standards and requirements of the act and these rules.

(3) A license issued by the board under the act and these rules is a revocable privilege granted by the board. A person who holds a license does not acquire, and will not be deemed to acquire, a vested property right or other right, in the license.

(4) An applicant or licensee must accept any risk of adverse publicity, public notice, notoriety, embarrassment, criticism, financial loss, or other unfavorable or harmful consequences that may occur in connection with, or as a result of, the application and licensing process or the public disclosure of information submitted to the board with a license application or at the board's request under the act and these rules.

(5) An applicant or licensee may claim any privilege afforded by the Constitution or laws of the United States or of this state in refusing to answer questions or provide information requested by the board. However, a claim of privilege with respect to any testimony or evidence pertaining to the eligibility or suitability of an applicant or licensee to be granted or hold a license under the act and these rules may constitute cause for denial, suspension, revocation, or restriction of the license.

(6) An applicant and licensee have a continuing duty to do all the following:

(a) Notify the board of a material change in the information submitted in the license application submitted by the applicant or licensee or a change in circumstance that may render the applicant or licensee ineligible or unsuitable to hold the license under the licensing standards and requirements of the act and these rules.

(b) Maintain the applicant's or licensee's eligibility and suitability to be issued and hold the license held or applied for under the act and these rules.

(c) Provide any information or records requested by the board relating to licensing or regulation; cooperate with the board in investigations, inspections, audits, hearings, and enforcement and disciplinary actions; allow access to its facilities relevant to Michigan internet gaming operation; and comply with all conditions, restrictions, requirements, orders, and rulings of the board in accordance with the act and these rules.

R 432.628a Eligibility and suitability of new key person.

Rule 628a. An individual required to be found eligible and suitable or licensed under the act or these rules by virtue of his or her position with an internet gaming operator licensee must not perform any duties or exercise any powers of the position until he or she is determined to be eligible and suitable and is licensed by the board.

R 432.628b Duty to disclose violation of licenses.

Rule 628b. An internet gaming operator and an internet gaming supplier must immediately notify the board, in writing, if it becomes aware that an internet gaming operator, internet gaming supplier, or occupational licensee involved in its internet gaming operations under the act has acted contrary to the act or these rules.

R 432.628c Contracts.

Rule 628c. The internet gaming operator must maintain all contracts that relate to its Michigan internet gaming operations for 5 years following its expiration. The board must be allowed access to any contract related to its Michigan internet gaming operations entered into by an internet gaming operator upon demand. The internet gaming operator may be required by the board to promptly submit copies of any such contract upon request of the board.

R 432.629 Vendors.

Rule 629. (1) Vendor Registration.

(a) A vendor who provides goods or services, or both, directly or indirectly, to an internet gaming operator or internet gaming platform provider in connection with its Michigan internet gaming operation may be required to register with the board. Vendors requiring registration include, but are not limited to, the following:

(i) Affiliate marketers which do not have an agreement based on the sharing of gross receipts or adjusted gross receipts.

(A) In connection with its vendor registration, the affiliate marketer must certify it does not promote or market, or both, illegal online gaming sites to individuals located in Michigan. An illegal online gaming site is one that is not licensed to accept wagers from customers located in Michigan or any other state.

(ii) Payment processors.

(iii) A person that provides over $100,000.00 worth of goods or services, or both, to any internet gaming operator or internet gaming supplier in connection with its Michigan internet gaming operations in a calendar year.

(iv) Data warehouses providing physical security and infrastructure.

(v) Any other person as deemed necessary by the board.

(b) Unless otherwise provided for by the board, a person must be registered as a vendor before providing goods or services, or both, as a vendor to an internet gaming operator or internet gaming platform provider.

(c) An internet gaming operator or an internet gaming platform provider is prohibited from using an unregistered vendor to provide goods or services that require a vendor registration.

(d) Unless otherwise provided for by the board, the following persons are not required to register as a vendor:

(i) Insurance companies.

(ii) A person or entity that provides legal services.

(iii) Entities providing medical related services.

(iv) Michigan public institutions of higher education.

(v) Public utilities regulated by the Michigan Public Service Commission.

(vi) A Michigan or federally chartered depository financial institution.

(vii) A person or business that provides goods or services as a result of the licensee’s employees engaging in business travel, including transportation, lodging, food, and fuel providers.

(viii) A person who provides employee training or professional development to a licensee.

(ix) A person who provides conferences, seminars, publications, or memberships that will directly contribute to the work performance or professional development of the licensee’s employees.

(e) To register, a vendor must complete and file with the board an application for registration and required disclosure forms in the manner and form prescribed by the board. An application for registration and required disclosure forms must be submitted, together with a nonrefundable application fee of $200.00 to the board by a payment method acceptable to the board, such as a certified check, cashier’s check, money order made payable to “State of Michigan,” or electronic fund transfer.

(2) Renewal of a Vendor Registration.

(a) A vendor must renew its registration every 5 years after initial registration.

(b) A vendor intending to renew its registration must, at least 30 days before expiration of its registration, submit the annual registration fee and application in the manner and form required by the board.

(3) Vendor Conduct.

(a) A vendor must, at all times, conduct itself in a manner that does not compromise the integrity of internet gaming or violate any applicable provisions of the act and these rules.

(b) The board may conduct an investigation to determine if a vendor has acted in a manner that does or could compromise the integrity of internet gaming in this state. The following may be considered during an investigation:

(i) Criminal records.

(ii) Suspension of licenses, registration certificates, or their equivalent, or any other adverse actions in other jurisdictions.

(iii) Business reputation.

(iv) Associations with businesses and individuals.

(v) Compliance with gaming laws and regulations in Michigan and other jurisdictions.

(vi) Any other information deemed appropriate by the board.

(c) Vendors agree to be subject to the jurisdiction of the board; have a continuing duty to provide information or records requested by the board; must cooperate with the board in any investigation, inspection, audit, or inquiry; and must allow the board access to its facilities that are relevant to Michigan internet gaming operations.

(d) If the investigation reveals a vendor’s conduct could or does compromise the integrity of internet gaming in this state, the board may issue a cease and desist order, obtain injunctive relief, and/or take any other action necessary to protect the integrity of internet gaming in this state.

(e) Vendors have a continuing duty to notify the board of any change in information previously submitted to the board.

PART 3. TECHNICAL STANDARDS

R 432.631 Geofence requirements.

Rule 631. (1) All internet wagering transactions must be initiated and received or otherwise made by an authorized participant located in this state.

(2) In order to prevent the unauthorized placement of an internet wager by an individual or authorized participant not within this state, the internet gaming operator and its internet gaming platform provider must utilize a geofencing system to reasonably detect the physical location of an individual or authorized participant attempting to access the internet gaming platform and place an internet wager and to monitor and block unauthorized attempts to access the internet gaming platform in order to place an internet wager when an individual or authorized participant is not within the permitted boundary.

(3) The geofencing system must ensure that any individual or authorized participant is located within the permitted boundary when placing any internet wager, and must be equipped to dynamically monitor the individual’s or authorized participant’s location and block unauthorized attempts to access the internet gaming platform in order to place an internet wager throughout the duration of the internet gaming authorized participant session.

(4) The board will approve all technical specifications for geofencing and any specific requirements related to geofencing technology that is commercially available.

R 432.632 Approval of internet gaming platform and games.

Rule 632. (1) Except as otherwise determined by the board in writing, an internet gaming platform provider or internet gaming supplier must not distribute an internet gaming platform or internet game to an internet gaming operator unless the item has been approved by the board.

(2) An internet gaming platform provider may seek approval of its internet gaming platform by submitting an application to the board in the manner and form prescribed by the board.

(3) If an internet gaming operator does not utilize an internet gaming platform provider and, instead, develops its own internet gaming platform or internet game, the internet gaming operator will be considered both an internet gaming operator and internet gaming platform provider for the purposes of this part.

R 432.632a Internet gaming platform and internet game submission and approval

process.

Rule 632a. (1) Each internet gaming platform provider must submit its internet gaming platform proposed for use by an internet gaming operator to the board or to an independent lab approved by the board for evaluation. The internet gaming platform provider must provide all information the board requests including, but not limited to, all the following:

(a) A complete, comprehensive, and technically accurate description and explanation of the internet gaming platform and its intended use in both technical and lay language. The document must be signed under penalty of perjury.

(b) Detailed operating procedures or service manuals, or both, of the internet gaming platform.

(d) Details of all tests performed on the internet gaming platform, the conditions and standards under which the tests were performed, the test results, and the identity of the individual who conducted each test.

(e) A description of all hardware devices.

(f) A description of all software including software version.

(g) A description of all wagering communications.

(h) A description of all third-party integrated systems.

(i) Any equipment that is required to perform testing.

(j) A detailed description of the risk management framework including, but not limited to:

(i) User access controls for all internet sports betting personnel.

(ii) Information regarding segregation of duties.

(iii) Information regarding automated risk management procedures.

(iv) Information regarding fraud detection.

(v) Controls for ensuring regulatory compliance.

(vi) Description of anti-money laundering compliance standards.

(2) An internet gaming platform provider or internet gaming supplier must submit all internet games, including, but not limited to, slot machine, table, live dealer/proxy player, progressives, and peer-to-peer games proposed for use by any internet gaming operator to the board or to an independent lab approved by the board for evaluation.

(3) The internet gaming platform provider or internet gaming supplier must provide all information the board requests, including, but not limited to, all the following:

(a) A complete, comprehensive, and technically accurate description and explanation of the internet game and its intended use in both technical and lay language. The document must be signed under penalty of perjury.

(b) Detailed operating procedures.

(d) A description of all software including software version.

(e) Complete paytable information including paytable identification and date code.

(f) Detailed information on the RNG.

(g) Return to player (RTP) calculation sheet.

(h) Rake percentage.

(i) Rules of the game.

(4) All internet game software used to conduct internet gaming must be designed with a method to permit the validation of software using a Gaming Authentication Tool or other method approved by the board.

(5) A submission for board approval of progressive software to be used on an internet gaming platform must also include all of the following at a minimum:

(a) Software controlling the internet jackpot.

(b) A mechanism to authenticate the software.

(d) The internet games that are common to a single progressive.

(e) The odds of hitting the progressive amount.

(f) The reset value of the progressive.

(g) The rate of progression for the progressive amount.

(h) How the rate of progression is split between the various progressive components.

(i) Other information deemed necessary and requested in writing by the board to ensure compliance with the act and this part.

(6) All the following provisions apply to calculation sheets:

(a) For each internet game program submitted, the internet gaming platform provider or internet gaming supplier requesting approval must supply calculation sheets that determine the RTP percentage, including base game, bonus games or features, free games, double-up options, progressives, and any other game features included in the RTP calculation.

(b) Where different player options such as number of credits, lines bet, or player strategy cause the pay table to vary, a separate calculation for each option is required.

(7) The internet gaming platform provider or internet gaming supplier must submit all internet game source code and any special tool, computer equipment, compiling program, or other technical assistance necessary to compile the submitted software. The result of the compiled source code must be identical to that in the storage medium submitted for evaluation.

(8) The internet gaming platform provider or internet gaming supplier must provide the board with a method to compensate for or resolve any differences between the compiled program and the submitted program. The internet gaming platform provider or internet game supplier may employ other equivalent methods that ensure the results of the complied source code are identical to the storage medium submitted for evaluation upon written request and approval of the board.

(9) Except where the board has provided written notification that approval is not required, an internet gaming operator must install or use an internet gaming platform and/or internet game that has been approved by the board. An internet gaming operator must not alter the manner in which the internet gaming platform or internet game operates without the prior written approval of the board.

(10) After evaluating the internet gaming platform or internet game, the board will advise the internet gaming platform provider or internet gaming supplier, in writing, of the determination.

R 432.632b Procedures and notification requirements after approval.

Rule 632b. (1) If another gaming jurisdiction revokes or otherwise directs discontinuance of the internet gaming platform, any component of the internet gaming platform, internet game, or internet game component that has been approved by the board, the internet gaming operator, internet gaming platform provider, and/or internet gaming supplier must advise the board in writing of the discontinuance within 21 days of the revocation or direction of discontinuance.

(2) An internet gaming operator, internet gaming operator license applicant, internet gaming platform provider, and/or internet gaming supplier must immediately notify the board, in writing, of any defects or malfunctions of the internet gaming platform, any component of the internet gaming platform, internet game, or internet game component that adversely affects the integrity or conduct of internet wagering, proper reporting of adjusted gross receipts, or materially affects the operation, safety, or wagering on any internet gaming platform, any component of the internet gaming platform, internet game, or any component of an internet game that has been approved by the board and is utilized by the internet gaming operator or internet gaming operator license applicant.

(3) An internet gaming operator, internet gaming platform provider, and internet gaming supplier must maintain all records required under this section for a minimum of 5 years.

(4) The board may require an internet gaming operator to discontinue use of the internet gaming platform, any component of the internet gaming platform, internet game, or any component of the internet game for any of the following reasons:

(a) The internet gaming platform, platform component, internet game, or internet game component does not perform in the manner described in the application and related submission documentation.

(b) The internet gaming platform, platform component, internet game, or internet game component is defective or malfunctions frequently.

(c) The internet gaming platform, platform component, internet game, or internet game component has a detrimental impact on the conduct or integrity of internet gaming.

(d) The internet gaming platform, platform component, internet game, or internet game component improperly computes adjusted gross receipts.

(5) The board will provide written notification to the internet gaming operator, internet gaming platform provider, and the internet gaming supplier that the internet gaming platform, platform component, internet game, or internet game component is no longer approved for use.

R 432.633 Internet gaming platform and internet games technical standards.

Rule 633. (1) An internet gaming platform or internet game, or both, for use to conduct internet gaming must meet the specifications set forth in these rules or other technical specifications as prescribed by the board. Failure to comply with the approved specifications, internal controls, or technical specifications may result in disciplinary action by the board.

(2) Internet gaming operators, internet gaming platform providers, and internet gaming suppliers must comply with, and the board adopts and incorporates by reference, Gaming Laboratories International, LLC Standard GLI-19: Standards for Interactive Gaming Systems, version 2.0, released February 15, 2013, which is available for inspection and distribution at no cost, as of the time of adoption of these rules, at the board’s office located at 3062 W. Grand Blvd., Suite L-700, Detroit, Michigan 48202-6062 or Gaming Laboratories International website at https://gaminglabs.com and does not include any later amendments or editions. GLI-19 standards are intended to supplement rather than supplant other technical standards and requirements under these rules.

(3) Prior to conducting internet gaming, and as otherwise required by the board, the internet gaming platform provider must submit the internet gaming platform used in conjunction with the internet gaming operation to the board or an independent testing laboratory approved by the board for certification testing.

(4) If the internet gaming platform meets or exceeds the technical standards adopted in subrule (2) of this rule, the board or independent testing laboratory approved by the board will certify the internet gaming platform. Internet gaming operators or internet gaming platform providers are prohibited from offering internet gaming in Michigan without such certification. The internet gaming platform provider is responsible for all costs associated with testing and obtaining such certifications.

(5) All internet games for proposed use must meet or exceed the technical standards adopted in subrule (2) of this rule. Internet gaming operators, internet gaming platform providers, and internet gaming suppliers are prohibited from offering any internet game without such written approval by the board. An internet gaming platform provider and internet gaming supplier is responsible for all costs associated with testing and obtaining such approvals.

R 432.633a Additional internet gaming software and platform technical standards.

Rule 633a. (1) Software utilized for internet gaming must either:

(a) Continuously display the current time in the time zone where the game server is physically located and the time elapsed that an authorized participant has been in the current internet gaming authorized participant session, or

(b) Cause a pop-up notification, at least every half-hour, to be prominently displayed on the client terminal advising the authorized participant of the current time and the amount of time elapsed since his or her log on.

(2) An internet gaming platform must not induce an authorized participant to continue placing internet wagers when play is in session, when the authorized participant attempts to end an internet gaming authorized participant session, or when the authorized participant wins or loses an internet wager.

(3) Game play must be initiated only after an authorized participant has affirmatively placed an internet wager and activated play. No auto play feature will be permitted in internet game software unless authorized by the board.

(4) All internet games must operate in accordance with the game rules and internet wagering account terms and conditions approved by the board.

R 432.633b Standards for approval of slot machine internet games and random number

generators.

Rule 633b. (1) Except as otherwise provided in this section, each slot machine internet game which requires an internet wager must have an RTP equal to or greater than 80 percent but not more than 100 percent.

(2) Except as otherwise provided in this section, all winning combinations for each slot machine internet game must be available on each play that requires an internet wager.

(3) Slot machine internet games must not offer a play with the odds of payout greater than 50 million to 1.

(4) The RTP of a slot machine internet game must not decrease by more than 1/100of a percentage point with an increased internet wager unless the aggregate total of the decreases in RTP for plays offered by the slot machine internet game is no more than 1/2 of 1 percent.

(5) All the following must not be included as a payout when determining the RTP of a slot machine internet game:

(a) A payout of merchandise or thing of value.

(b) A complimentary.

(6) The projected contribution from a progressive award may not count toward the RTP of a slot machine internet game in order to achieve the minimum RTP as approved by the board.

(7) A slot machine internet game that requires strategy choices, such as video poker, must comply with all the following:

(a) Have its RTP calculated based upon the player exercising optimal strategy during game play.

(b) Disclose optimal strategy to achieve the highest RTP.

(c) Provide mathematically sufficient information for the authorized participant to derive optimal strategy in order to achieve the highest RTP.

(8) When a slot machine internet game offers play which permits an authorized participant to risk an award or make a subsequent internet wager as an extension of a game outcome, the slot machine internet game must comply with all the following:

(a) Only allow the authorized participant to risk an award if the award can be increased as a result of continued play.

(b) Disclose the optimal strategy or provide mathematically sufficient information for the authorized participant to derive optimal strategy if the choice affects the RTP of the slot machine internet game.

(9) A slot machine internet game must be designed in such a manner that prevents scripting and fairly represents the reel symbols selected by the RNG. It is acceptable to display an alternate version of the video reel strips during reel spin animation provided all the following conditions are met:

(a) The top award and bonus trigger symbols are not displayed more often than they appear on the actual reel strips.

(b) The random selection process for game outcome is not affected.

(d) A description of the alternate spinning video reels is provided to the board.

(e) The spinning video reel display is not misleading.

(10) A slot machine internet game that offers free play awards must not display as a possible outcome any amount that could only be won through the consecutive activation of free play awards won on the wager. For example, if the highest jackpot offered by a slot machine internet game is $1,000.00 and it is possible to win 2 free play awards on one wager, the slot machine internet game must not display $2,000.00 as a possible jackpot.

(11) Internet games that allow an authorized participant to select from 2 or more internet game themes must be capable of displaying all the following:

(a) A clear indication of which game has been selected for play.

(b) A clear description of the rules governing the game selected.

(12) The virtual button panel must operate correctly in conjunction with the submitted pay table program. For example, the button panel must match the game play with regards to the number of lines being played and number of credits being wagered.

Slot machine internet games with an auto pick feature must comply with all the following:

(a) Disclose to the authorized participant that the slot machine internet game is designed with an auto pick feature.

(b) Disclose the rules regarding the auto pick feature.

(c) When the RTP is based upon optimal play, select the choice which provides the highest RTP; or when the RTP is not based upon optimal play, perform the selection in an unbiased manner.

(13) All free game and re-spin awards must display the remaining number of games or spins left following each free game or re-spin unless otherwise approved by the board.

(14) The RNG must comply with all RNG requirements adopted in subrule (2) of R 432.633.

R 432.633c Additional standards for approval of table internet games.

Rule 633c. (1) Unless otherwise authorized by the board, all table internet games must comply with all the following:

(a) Where applicable, accurately represent the layout and equipment used to play its corresponding authorized non-internet table game including, when applicable, wagering areas, cards, dice, or tiles. For the purposes of this subsection, authorized non-internet table game will mean the corresponding game that is authorized for play by the regulatory body with regulatory jurisdiction over the corresponding game conducted in the internet gaming operator’s land-based gaming operation.

(b) Function in accordance with approved table internet game rules.

(d) Conspicuously indicate minimum and maximum wagers.

(e) Contain help screens that provide information and rules regarding approved variations, such as the number of decks used, special odds, and supplemental wagers.

(2) Table internet games may be designed to permit an authorized participant to occupy more than 1 betting position at an individual game.

R 432.634 Location of servers, security, and cloud storage.

Rule 634. (1) An internet gaming operator and its internet gaming platform provider must place a server or other equipment that is capable of receiving internet wagers in this state. The location selected must have adequate security, protections, and controls over the servers including those adopted in subrule (2) of R 432.633. The internet gaming operator and its internet gaming platform provider must provide the board with information on the location of all servers.

(2) The board may approve of the use of cloud storage for duplicate data upon written request of an internet gaming operator or internet gaming platform provider.

R 432.635 Communication standards.

Rule 635. (1) All internet gaming platforms authorized by the board under these rules must be designed to ensure the integrity and confidentiality of all individual and authorized participant communications and ensure the proper identification of the sender and receiver of all communications.

(2) If communications are performed across a public or third-party network, the internet gaming platform must either encrypt the data packets or utilize a secure communications protocol to ensure the integrity and confidentiality of the transmission.

(3) Internet gaming platform providers must meet or exceed all communication standards prescribed by the board.

(4) Internet gaming platform providers and internet gaming operators must address all communication requirements in the internet gaming platform and internal controls submitted to the board for approval.

R 432.636 Internet gaming data logging standards.

Rule 636. (1) Internet gaming platforms must employ a mechanism capable of maintaining a separate copy of all information the board requires to be logged on a separate and independent logging device capable of being administered by an employee with no incompatible function.

(2) If the internet gaming platform can be configured such that any logged data is contained in a secure transaction file, a separate logging device is not required.

(3) Internet gaming platform providers must meet or exceed all internet gaming data logging standards prescribed by the board. Internet gaming platform providers and internet gaming operators must address all internet gaming data logging requirements in the internet gaming platform and internal controls submitted to the board for approval.

(4) The internet gaming platform must provide a mechanism for the board to query and export, in a format required by the board, all internet gaming platform data related to internet gaming conducted under the act.

R 432.637 Self-monitoring of internet gaming platform critical components.

Rule 637. An internet gaming platform must, at least once every 24 hours, perform a self-authentication process on all software used to offer, record, and process internet wagers conducted under this act which is identified by the board as a critical component to ensure there have been no unauthorized modifications. In the event of an authentication failure, the internet gaming platform must immediately notify the internet gaming operator, internet gaming platform provider, and the board within 24 hours. The results of all self-authentication attempts must be retained by the internet gaming platform for a period of not less than 90 days.

R 432.637a Change approval.

R. 637a. (1) Any change or modification to the internet gaming platform which impacts a regulated feature of an approved internet gaming platform, unless otherwise permitted by the board, requires submission to and approval by the board prior to the implementation of the change or modification. Regulated feature includes, but are not limited to, internet gaming platform and internet game software which is validated using a Gaming Authentication Tool or other method approved by the board and all critical component software.

(2) The internet gaming operator and its internet gaming platform provider must submit change control processes that detail evaluation procedures for all updates and changes to equipment and the internet gaming platform to the board for approval. These processes must include details for identifying the criticality of updates and determining the updates that must be submitted to the board or a board approved independent testing laboratory for review and certification.

R 432.638 Internet gaming platform assessment.

Rule 638. (1) Each internet gaming operator or internet gaming platform provider will, within 90 days of commencing operations, and annually thereafter, perform an internet gaming platform integrity and security assessment of the internet gaming platform conducted by an independent professional selected by the internet gaming operator or internet gaming platform provider and subject to approval of the board. The scope of the internet gaming platform integrity and security assessment will be subject to approval of the board and must include, at a minimum, all of the following:

(a) A vulnerability assessment of internal, external, and wireless networks with the intent of identifying vulnerabilities of all devices, internet gaming platform, and applications connected to or present on the networks.

(b) A penetration test of all internal, external, and wireless networks to confirm if identified vulnerabilities of all devices, internet gaming platform, and applications are susceptible to compromise.

(c) A policy and procedures review against the current ISO 27001 standard or another similar standard approved by the board.

(d) Any other specific criteria or standards for the internet gaming platform integrity and security assessment as prescribed by the board.

(2) The full independent professional's report on the assessment must be submitted to the board and must include all the following:

(a) Scope of review.

(b) Name and company affiliation of the individual or individuals who conducted the assessment.

(d) Findings.

(e) Recommended corrective action, if applicable.

(f) Internet gaming operator’s or internet gaming platform provider’s response to the findings and recommended corrective action.

R 432.639 Internet gaming operators/internet gaming platform provider technical and

security standards (controls).

Rule 639. (1) An internet gaming operator and its internet gaming platform provider must adopt, implement, and maintain technical security standards (controls) that meet or exceed those adopted in subrule (2) of R 432.633 The technical security standards must apply, at a minimum, to all the following critical components of the internet gaming platform:

(a) Components which record, store, process, share, transmit, or retrieve sensitive information (e.g., validation numbers, personal identification number (PIN), individual and authorized participant data).

(b) Components which generate, transmit, or process random numbers used to determine the outcome of games or virtual events.

(d) Points of entry to and exit from the components provided for in subrules (1)(a) to (1)(c) of this rule and other systems which are able to communicate directly with core critical internet gaming platform components.

(e) Communication networks which transmit sensitive information involving internet gaming under the act.

(2) The technical security standards set forth below are the minimum standards an internet gaming operator or internet gaming platform provider must incorporate into its internal controls.

(a) Internet Gaming Platform Operations and Security.

(i) Internet Gaming Platform Operations and Security. The internet gaming operator or internet gaming platform provider must adopt, implement, and maintain procedures for, at a minimum, the following:

(A) Monitoring the critical components and the transmission of data of the entire internet gaming platform.

(B) Maintenance of all aspects of security of the internet gaming platform to ensure secure and reliable communications.

(D) Monitoring and adjusting resource consumption and maintaining a log of the internet gaming platform performance.

(E) Investigating, documenting, and resolving malfunctions.

(ii) Physical Location of Servers and Security. The internet gaming platform must be housed in secure locations. Internet gaming operators and their internet gaming platform providers must provide the board with information on the location of all internet gaming platform servers. The secure locations must have sufficient protection from unauthorized access and physical and environmental hazards and be equipped with surveillance and security systems that meet or exceed industry standards.

(iii) Internet Gaming Platform Logical Access Controls. The internet gaming platform must be logically secured against unauthorized access.

(iv) Internet Gaming Platform User Authorization. The internet gaming platform must be subject to user authorization requirements as required by the board.

(v) Server Programming. The internet gaming platform must be sufficiently secure to prevent any user-initiated programming capabilities on the server that may result in unauthorized modifications to the database.

(vi) Verification Procedures. Procedures must be in place for verifying on demand that the critical control program components of the internet gaming platform in the production environment are identical to those approved by the board.

(vii) Electronic Document Retention System. The internet gaming operator or internet gaming platform provider must establish procedures that ensure that all reports required under the act and rules are stored in an electronic document retention system.

(viii) Asset Management. All assets that house, process, or communicate sensitive information, including those comprising the operating environment of the internet gaming platform or its components, or both, must be accounted for and have a nominated owner or designated management official that is responsible for each asset.

(b) Backup and Recovery.

(i) Data Security. The internet gaming platform must provide a logical means for securing individual and authorized participant data and wagering data, including accounting, reporting, significant event, or other sensitive information, against alteration, tampering, or unauthorized access.

(ii) Data Alteration. The alteration of any accounting, reporting, or significant event data relating to internet wagering under the act will not be permitted without supervised access controls. In the event any data is changed, all information required by the board must be documented or logged.

(iii) Backup Frequency. Backup scheme implementation relating to information involving internet wagering under the act must occur at least once every day or as otherwise specified by the board.

(iv) Storage Medium Backup. Audit logs, internet gaming platform databases, and any other pertinent individual and authorized participant data and wagering data must be stored using reasonable protection methods. The internet gaming platform must be designed to protect the integrity of this data in the event of a failure. Redundant copies of this data must be kept on the internet gaming platform with open support for backups and restoration, so that no single failure of any portion of the internet gaming platform would cause the loss or corruption of such data.

(v) Internet Gaming Platform Failure. The internet gaming platform must have sufficient redundancy and modularity so that if any single component or part of a component fails, the functions of the internet gaming platform and the process of auditing those functions can continue with no critical data loss. When 2 or more components are linked, the process of all internet gaming operations between the components must not be adversely affected by restart or recovery of either component and upon restart or recovery, the components must immediately synchronize the status of all transactions, data, and configurations with one another.

(vi) Accounting and Master Resets. The internet gaming operator or internet gaming platform provider must be able to identify and properly handle the situation where a master reset has occurred on any component which affects internet gaming under the act.

(vii) Recovery Requirements. In the event of a catastrophic failure when the internet gaming platform cannot be restarted in any other way, it must be possible to restore the internet gaming platform from the last backup point and fully recover. The contents of that backup must contain critical information as required by the board.

(viii) Uninterrupted Power Supply (UPS) Support. All internet gaming platform components must be provided with adequate primary power. Where the server is a stand-alone application, it must have an UPS connected and must have sufficient capacity to permit a methodical shut-down that retains all individual and authorized participant data and wagering data during a power loss. It is acceptable that the internet gaming platform may be a component of a network that is supported by a network-wide UPS provided that the server is included as a device protected by the UPS. There must be a surge protection system in use if not incorporated into the UPS itself.

(ix) Business Continuity and Disaster Recovery Plan. A business continuity and disaster recovery plan must be in place to recover internet gaming operations conducted under the act if the internet gaming platform’s production environment is rendered inoperable.

(i) Connectivity. Only authorized devices are permitted to establish communications between any internet gaming platform components.

(ii) Communication Protocol. Each component of the internet gaming platform must function as indicated by a documented secure communication protocol.

(iii) Communication Over Internet/Public Network. Communications between internet gaming platform components must be secure. Individual and authorized participant data, sensitive information, internet wagers, results, financial information, and individual and authorized participant transaction information related to internet gaming conducted under the act must always be encrypted and protected from incomplete transmissions, misrouting, unauthorized message modification, disclosure, duplication, or replay.

(iv) Wireless Local Area Network (WLAN) Communications. The use of WLAN communications must adhere to applicable requirements specified for wireless devices and are subject to approval by the board.

(v) Network Security Management. Networks must be logically separated to ensure that there is no network traffic on a network link which cannot be serviced by hosts on that link.

(d) Third-Party Service Providers.

(i) Third-Party Service Communications. Where communications related to internet gaming conducted under the act are implemented with third-party service providers, the internet gaming platform must securely communicate with all third-party service providers utilizing encryption and strong authentication, ensure that all login events are recorded to an audit file, and ensure that all communications do not interfere or degrade normal internet gaming platform functions.

(ii) Third-Party Services. The roles and responsibilities of each third-party service provider engaged by the internet gaming operator or internet gaming platform provider must be defined and documented in a manner approved by the board. The internet gaming operator or internet gaming platform provider must have policies and procedures in place for managing third-party service providers and monitoring their adherence to relevant security requirements.

(e) Technical Controls.

(i) Domain Name Service (DNS) Requirements. An internet gaming operator or internet gaming platform provider must establish requirements that apply to servers used to resolve DNS queries used in association with the internet gaming platform.

(ii) Cryptographic Controls. An internet gaming operator or internet gaming platform provider must establish and implement a policy for the use of cryptographic controls that ensures the protection of information.

(iii) Encryption Key Management. The management of encryption keys must follow defined processes established by the internet gaming operator or internet gaming platform provider and approved by the board.

(f) Remote Access and Firewalls.

(i) Remote Access Security. Remote access, if approved by the board, must be performed via a secured method, must have the option to be disabled, may accept only the remote connections permissible by the firewall application and internet gaming platform settings, and must be limited to only the application functions necessary for users to perform their job duties.

(ii) Remote Access and Guest Accounts Procedures. Remote access and guest accounts procedures must be established that ensure that remote access is strictly controlled.

(iii) Remote Access Activity Log. The remote access application must maintain an activity log which updates automatically and records and maintains all remote access information.

(iv) Firewalls. All communications, including remote access, must pass through at least 1 approved application-level firewall. This includes connections to and from any non-internet gaming platform hosts used by the internet gaming operator or internet gaming platform provider.

(v) Firewall Audit Logs. The firewall application must maintain an audit log and must disable all communications and generate an error if the audit log becomes full. The audit log must contain, at a minimum, all the following information:

(a) All changes to configuration of the firewall.

(b) All successful and unsuccessful connection attempts through the firewall.

(vi) Firewall Rules Review. The firewall rules must be periodically reviewed by the internet gaming operator or internet gaming platform provider to verify the operating condition of the firewall and the effectiveness of its security configuration and rule sets and must be performed on all the perimeter firewalls and the internal firewalls.

(g) Change Management.

(i) Program Change Control Procedures. Program change control procedures must ensure that only authorized versions of programs are implemented on the production environment.

(ii) Software Development Life Cycle. The acquisition and development of new software must follow defined processes established by the internet gaming operator or internet gaming platform provider and subject to review by the board.

(iii) Patches- All patches should be tested, as applicable, in a development and test environment configured to match the target production environment before being deployed into production. Permitted exceptions, related procedures and controls must be fully addressed.

(h) Periodic Security Testing.

(i) Technical Security Testing. Periodic technical security tests on the production environment must be performed quarterly or as otherwise required by the board to guarantee that no vulnerabilities putting at risk the security and operation of the internet gaming platform exist.

(ii) Vulnerability Assessment. The internet gaming operator or the internet gaming platform provider must conduct vulnerability assessments. The purpose of the vulnerability assessment is to identify vulnerabilities, which could be later exploited during penetration testing by making basic queries relating to services running on the internet gaming platform concerned.

(iii) Penetration Testing. The internet gaming operator or the internet gaming platform provider must conduct penetration testing. The purpose of the penetration testing is to exploit any weaknesses uncovered during the vulnerability assessment on any publicly exposed applications or internet gaming platform hosting applications processing, transmitting, and/or storing sensitive information.

(iv) Information Security Management System (ISMS) Audit. An audit of the ISMS will be periodically conducted, including all the locations where sensitive information is accessed, processed, transmitted, and/or stored. The ISMS will be reviewed against common information security principles in relation to confidentiality, integrity, and availability.

(v) Cloud Service Audit. An internet gaming operator and its internet gaming platform provider that utilizes a cloud service provider (CSP), if approved by the board, to store, transmit, or process sensitive information must undergo a specific audit as required by the board. The CSP will be reviewed against common information security principles in relation to the provision and use of cloud services, such as ISO/IEC 27017 and ISO/IEC 27018, or equivalent.

(3) The internet gaming operator and its internet gaming platform provider must include the technical security standards (controls) in the internal controls and internet gaming platform submitted to the board for approval.

(4) The technical security standards (controls) must:

(a) Have a provision requiring review when changes occur to the internet gaming platform.

(b) Be approved by the internet gaming operator’s or internet gaming platform provider’s senior management.

(d) Undergo review at planned intervals.

(e) Delineate the responsibilities of the internet gaming operator’s staff, the internet gaming platform provider’s staff, and the staff of any third parties for the operation, service, and maintenance of the internet gaming platform or its components, or both.

R 432.639a Test accounts.

Rule 639a. (1) An internet gaming operator or internet gaming platform provider may establish test accounts to be used to test the various components and operation of an internet gaming platform in accordance with internal controls adopted by the internet gaming operator or internet gaming platform provider, which, at a minimum, must address all the following:

(a) The procedures for the issuance of funds used for testing, including the identification of who is authorized to issue the funds and the maximum amount of funds that may be issued.

(b) The procedures for assigning each test account for use by only 1 individual. This does not preclude an internet gaming operator from establishing a specific scenario or instance of test account that may be shared by multiple users provided that each user activities are separately logged.

(c) The maintenance of a record for all test accounts, to include when they are active, to whom they are issued, and the employer of the individual to whom they are issued.

(d) The procedures for the auditing of testing activity by the internet gaming operator or internet gaming platform provider to ensure the accountability of funds used for testing and proper adjustments to gross receipts.

(e) The procedures for authorizing and auditing out-of-state test activity.

(2) Peer-to-peer games may be tested by a user with multiple test accounts provided that no authorized participants are involved in game play.

R 432.639b Remote/proxy player.

Rule 639b. An internet gaming operator or its internet gaming platform provider must obtain written board approval to conduct remote/proxy player live dealer or other similar type games. The gaming environment used to conduct remote/proxy player or similar games must be located in this state in a location approved by the board.

R 432.639c Progressive jackpots.

Rule 639c. (1) An internet gaming operator or its internet gaming platform provider may offer a progressive jackpot that increases uniformly in value as the internet game is played based upon an approved rate of progression and is awarded for a specific outcome or event.

(2) The rules governing the award and the value of the progressive award must be readily available to individuals and authorized participants.

(3) An internet gaming operator or its internet gaming platform provider must obtain approval from the board in the form and manner prescribed by the board prior to offering, modifying, or transferring a progressive jackpot on software approved by the board under these rules.

(4) Two or more linked internet games offering the same progressive jackpot may be of different denominations or have different minimum internet wagers required to win the progressive jackpot, or both, provided that the probability of winning the progressive jackpot is directly proportional to the minimum internet wager required to win that jackpot. For example, if on the same link, a nickel game requires 20 credits (a $1.00 wager), a quarter game requires 8 credits (a $2.00 wager), and a dollar game requires 3 credits (a $3.00 wager) to win the progressive jackpot, then the probability of a winning internet wager must be 3 times more likely on a linked dollar game than on the linked nickel game, and twice more likely on a linked quarter game than on the linked nickel game. Similarly, if among 3 linked quarter denomination games, the first required 2 credits (a $0.50 wager), the second required 4 credits (a $1.00 wager), and the third required 8 credits (a $2.00 wager) to play for the progressive jackpot, then on each wager, the probability of winning the jackpot would be twice more likely on the second game than on the first game, and 4 times more likely on the third game than on the first game.

(5) The internet gaming operator and its internet gaming platform provider must ensure that progressive jackpot awards that have a reset amount greater than $5,000.00 are reconciled at least once a month in accordance with approved internal controls unless otherwise required by the board.

(6) An internet gaming operator and its internet gaming platform provider must maintain a detailed record of the monthly reconciliation. An internet gaming operator and its internet gaming platform provider must also reconcile a progressive jackpot prior to a transfer or modification.

(7) The internet gaming operator and its internet gaming platform provider must investigate the reason for any progressive amount variance exceeding $100.00 and file an incident report with the board that must include corrective actions proposed or taken to resolve the variance.

(8) An internet gaming operator and its internet gaming platform provider must remove or make the progressive game unavailable to individuals and authorized participants for all occurrences in which a game malfunctions or if otherwise required by the board.

(9) The internet gaming operator and its internet gaming platform that chooses to restore a progressive jackpot previously made unavailable pursuant to this section, must restore the entire progressive jackpot amount. The amount restored must include the entire jackpot, including the seed amount and all previously collected authorized participant contributions.

(10) An internet gaming operator may remove or transfer a progressive jackpot upon obtaining board approval as provided for in this section and subsequent to notification to individuals and authorized participants, which must be, at a minimum, 10 days for a transfer and 30 days for removal.

(11) If a wide area progressive offered on the internet is removed, it must be restored or transferred by the internet gaming platform provider or internet gaming supplier as applicable. The amount restored or transferred must include the entire jackpot, including the seed amount and all previously collected authorized participant contributions.

R 432.639d Internet gaming networks.

Rule 639d. (1) With the approval of the board, 1 or more internet gaming operators may participate in an internet gaming network as set forth in a written agreement that has been executed by each internet gaming operator. The agreement must include all provisions required by the board.

(2) Each party to an agreement for an internet gaming network must be jointly and severally liable for acts, omissions, and violations of the act or these rules.

PART 4. AUTHORIZED PARTICIPANT INTERNET WAGERS

R 432.641 Authorized participant complaints.

Rule 641. (1) An internet gaming operator or internet gaming platform provider must include on its internet gaming platform a clear mechanism to advise authorized participants of their right to make a complaint against the internet gaming operator, internet gaming platform provider, or another authorized participant (when collusion is suspected or when an authorized participant is disruptive or abusive), including information explaining how complaints can be filed, how complaints are resolved, and how the authorized participant may submit a complaint to the board.

(2) An internet gaming operator or internet gaming platform provider must attempt to resolve all complaints with the authorized participant.

(3) An internet gaming operator or internet gaming platform provider must investigate each complaint and provide a response to the authorized participant within 10 calendar days of receipt of the complaint.

(4) In its response, the internet gaming operator or internet gaming platform provider must advise the authorized participant of his or her right to submit the complaint to the board in the form and manner prescribed by the board.

(5) The complaint and the internet gaming operator’s or internet gaming platform provider’s response must be made in writing.

(6) Unless otherwise directed by the board, for complaints related to internet wagering accounts, game outcomes, and/or illegal activity related to internet gaming that cannot be resolved to the satisfaction of the authorized participant, the internet gaming operator or internet gaming platform provider must promptly notify the board of the complaint and the internet gaming operator’s or internet gaming platform provider’s response.

(7) On receipt of a complaint from an authorized participant or notification of an unresolved complaint from an internet gaming operator or internet gaming platform provider, the board may conduct any investigation the board deems necessary and may direct an internet gaming operator or internet gaming platform provider to take any corrective action the board deems appropriate.

(8) An internet gaming operator or internet gaming platform provider must maintain records related to authorized participant complaints for a minimum of 5 years and must provide such records to the board on request.

R 432.642 Bank secrecy act compliance.

Rule 642. (1) An internet gaming operator or internet gaming platform provider must comply with all provisions of the bank secrecy act of 1970, 31 USC 5311 to 5332, applicable to the internet gaming operator’s or internet gaming platform provider’s internet gaming operation.

(2) An internet gaming operator or internet gaming platform provider must with regard to its internet gaming operation maintain records related to its compliance with the bank secrecy act of 1970, 31 USC 5311 to 5332, including all currency transaction reports, suspicious activity reports, and any supporting documentation, for a minimum of 5 years. The internet gaming operator or internet gaming platform provider must provide such records to the board and any appropriate law enforcement agencies on request consistent with the authorization prescribed in the bank secrecy act of 1970, 31 USC 5311 to 5332, and applicable regulations.

(3) An internet gaming operator or internet gaming platform provider must provide a written notice to the board as soon as the internet gaming operator or internet gaming platform provider becomes aware of a compliance review that is conducted by the Internal Revenue Service under the bank secrecy act of 1970, 31 USC 5311 to 5332, and involves or impacts the internet gaming operator’s or internet gaming platform provider’s internet gaming operation. The internet gaming operator or internet gaming platform provider must provide a copy of the compliance review report or the equivalent to the board within 10 days of the receipt of the report by the internet gaming operator or internet gaming platform provider.

R 432.643 Integrity monitoring/suspicious behavior.

Rule 643. (1) An internet gaming operator or internet gaming platform provider must employ personnel responsible for ensuring the operation and integrity of internet gaming and reviewing all reports of suspicious behavior. Unless otherwise directed by the board, an internet gaming operator or internet gaming platform provider must immediately notify the board upon detecting or becoming aware of any of the following:

(a) Any individual participating in internet wagering who is engaging in or attempting to engage in, or who is reasonably suspected of, cheating, theft, embezzlement, collusion, use of funds derived from illegal activity, money laundering, or any other illegal activities, including those activities prohibited in section 13 of the act, MCL 432.313.

(b) Any individual who is reasonably suspected of misrepresenting their identity or using false identification to establish or attempt to establish an internet wagering account.

(d) Any criminal or disciplinary proceedings commenced against the internet gaming operator or internet gaming platform provider in connection with its internet gaming.

(e) Any suspicious internet wagering activity or patterns that indicate a concern regarding the integrity of an internet game or internet wagering.

(f) Any other conduct that corrupts the outcome of an internet game or internet wager.

(g) Any internet wagers that violate any applicable state or federal law.

(2) An internet gaming platform provider must promptly notify all affected internet gaming operators of any issues impacting the integrity of internet gaming.

(3) The board may require an internet gaming operator or internet gaming platform provider to provide any hardware or software necessary to the board, or to an independent lab approved by the board, for evaluation of its internet gaming offering or to conduct further monitoring of data provided by its internet gaming platform.

(4) An internet gaming operator or internet gaming platform provider must maintain records demonstrating its compliance with this section, including all reports of suspicious behavior and any supporting documentation, for a minimum of 5 years and must provide such records to the board on request.

R 432.644 Reserve requirement.

Rule 644. (1) An internet gaming operator or internet gaming platform provider must maintain a reserve in the amount necessary to ensure the security of funds held in internet wagering accounts. The reserve must be in the form of:

(a) Cash or cash equivalents maintained in a U.S. bank account segregated from the internet gaming operator’s or internet gaming platform provider’s operational funds.

(b) An irrevocable letter of credit.

(d) Any other form acceptable to the board.

(e) Any combination of the above.

(2) The reserve must be not less than the sum of the following:

(a) The daily ending cashable balance of all authorized participants’ internet wagering accounts.

(b) Pending withdrawals.

(3) Funds held in internet wagering accounts must not be automatically transferred by an internet gaming operator or internet gaming platform provider, nor will an internet gaming operator or internet gaming platform provider be permitted to require an authorized participant to transfer funds from his or her internet wagering account, in order to circumvent the requirements of this section.

(4) Amounts available to authorized participants for play that are not redeemable for cash may be excluded from the reserve computation.

(5) On request, the board may allow an internet gaming operator or internet gaming platform provider to combine the reserve for all of its Michigan internet gaming, all of its Michigan internet sports betting conducted under the lawful sports betting act, 2019 PA 149, MCL 432.401 to 432.419, or both.

(6) An internet gaming operator or internet gaming platform provider must have access to all internet wagering account and transaction data to ensure the amount of its reserve is sufficient. Unless otherwise directed by the board, an internet gaming operator or internet gaming platform provider must file a monthly attestation with the board, in the form and manner prescribed by the board, that funds have been safeguarded under this section.

(7) The board may audit an internet gaming operator’s or internet gaming platform provider’s reserve at any time and may direct an internet gaming operator or internet gaming platform provider to take any action necessary to ensure the purposes of this section are achieved, including but not limited to requiring the internet gaming operator or internet gaming platform provider to modify the form of its reserve or increase the amount of its reserve.

R 432.645 Voiding of internet wagers.

Rule 645. An internet gaming operator or internet gaming platform provider may not void a completed internet wager without board approval except where a void is necessary to resolve an internet gaming platform or internet game error or malfunction.

R 432.647 Negative internet wagering account balance prohibited.

Rule 647. An internet gaming platform must employ a mechanism that can detect and prevent any internet wagering or withdrawal activity initiated by an authorized participant that would result in a negative balance of the internet wagering account.

R 432.648 Minimum and maximum internet wager.

Rule 648. Unless otherwise prescribed by the board, there must be no limitation as to the minimum or maximum internet wager an internet gaming operator or internet gaming platform provider may accept. This rule does not preclude an internet gaming operator or internet gaming platform provider from establishing its own minimum or maximum internet wagers or limiting an authorized participant’s internet wager for reasons deemed necessary or appropriate by the internet gaming operator or internet gaming platform provider.

R 432.649 Tournaments/contests, bonus and promotional wagering, advertising, and

player loyalty programs.

Rule 649. (1) An internet gaming operator or internet gaming platform provider may conduct an internet gaming tournament or contest on an authorized game subject to all of the following:

(a) No internet gaming tournament or contest will be conducted unless the internet gaming operator or internet gaming platform provider, prior to the first time a tournament or contest type is offered, files written notice with the board of its intent to offer such a tournament or contest. The internet gaming operator or internet gaming platform provider may file a master tournament list with the board to satisfy this requirement.

(b) Each internet gaming operator or internet gaming platform provider will have on file for each tournament or contest type it offers, which must address, at a minimum, all the following:

(i) Internet game type (for example, hold 'em poker).

(ii) Rules concerning tournament or contest play and participation.

(iii) Entry fee amount or amounts per participant.

(iv) Funding source amount or amounts comprising the prize pool (for example, buy-ins, re-buys, or add-ons).

(v) Prize structure on payout.

(vi) Methodology for determining winner or winners.

(2) An internet gaming operator or internet gaming platform provider may conduct internet gaming bonus and promotional wagering offers subject to all of the following:

(a) An internet gaming operator or internet gaming platform provider must maintain a record of all bonus and promotional wagering offers related to internet gaming in an electronic file that is readily available to the board.

(b) All bonus and promotional wagering offers must be stated in clear and unambiguous terms and must be accessible by the authorized participant after the offer is accepted and prior to completion.

(i) The date and time the offer is active and expires.

(ii) Authorized participant eligibility, including any limitations on participation.

(iii) Any restriction on withdrawals of funds.

(iv) Wagering requirements and limitations by type of internet game.

(v) The order in which funds are used for internet wagers.

(vi) Eligible internet games.

(vii) Rules regarding cancellation.

(3) An internet gaming platform or internet gaming platform provider must provide a clear and conspicuous method for an authorized participant to cancel his or her participation in a bonus or promotional wagering offer that utilizes restricted gaming credits that cannot be cashed out until a wagering requirement or other restrictions associated with the credits is met. If an authorized participant elects to proceed with cancellation, unrestricted funds remaining in an internet wagering account must be returned according to the terms and conditions.

(4) Once an authorized participant has met the terms of a bonus or promotional wagering offer, an internet gaming operator or internet gaming platform provider must not limit winnings earned while participating in the offer.

(5) Internet gaming operators or internet gaming platform providers may utilize celebrity authorized participants or other authorized participants to participate in peer-to-peer games for advertising or publicity purposes. Such authorized participants may have their internet wagering account funded in whole or in part by an internet gaming operator or internet gaming platform provider.

(6) An internet gaming operator or internet gaming platform provider may pay a fee to the celebrity authorized participant. If a celebrity authorized participant is utilized and the celebrity authorized participant generates winnings that the internet gaming operator or internet gaming platform provider does not permit the celebrity authorized participant to retain, such winnings must be included in gross receipts in a manner approved by the board.

(7) All tournaments or contests, bonus and promotional wagering, advertising, and player loyalty programs offered or conducted, or both, by an internet gaming operator or internet gaming platform provider on the internet gaming platform must comply with the technical standards adopted in subrule (2) of R 432.633, as applicable.

PART 5. INTERNET WAGERING ACCOUNTS

R 432.651 Single wagering account in use for internet wagering.

Rule 651. (1) An internet gaming operator or internet gaming platform provider will limit each authorized participant to one internet wagering account and username. Each internet wagering account must be all of the following:

(a) Non-transferable.

(b) Unique to the authorized participant who establishes the internet wagering account.

(c) Distinct from any other account number that the authorized participant may have established with the internet gaming operator or internet gaming platform provider.

(2) An internet gaming operator or internet gaming platform provider must implement internal controls and publish procedures to terminate all accounts of any individual who establishes or seeks to establish multiple active internet wagering accounts, whether directly or by use of another individual as a proxy.

R 432.651a Age and identity verification.

Rule 651a. (1) An internet gaming operator or internet gaming platform provider must verify the identity of an individual’s identity before allowing that individual to create an internet wagering account and place an internet wager.

(2) Only an individual who is 21 years of age or older and not a prohibited person may create an internet wagering account, deposit funds, or participate in internet wagering. The internet gaming operator or internet gaming platform provider must deny the ability to create an internet wagering account, deposit funds, or participate in internet wagering to any individual who is under 21 years of age or is a prohibited person.

(3) An internet gaming operator or internet gaming platform provider must use commercially available and demonstratable standards to confirm that an individual attempting to create an internet wagering account is not a prohibited person.

(4) Third-party service providers may be used for age and identity verification of individuals attempting to create internet wagering accounts.

R 432.651b Data security of age and identity verification information.

Rule 651b. Details of the age and identity verification process must be kept by the internet gaming operator or internet gaming platform provider in a secure manner approved by the board.

R 432.651c Handling of internet wagering accounts found to be used in fraudulent

manner.

Rule 651c. An internet gaming operator or internet gaming platform provider must have a documented system of internal controls for the handling of authorized participants or other individuals discovered to be using internet wagering accounts in a fraudulent manner, including, but not limited to the following:

(1) The maintenance of information about any authorized participant’s activity or other individual’s activity, such that if fraudulent activity is detected, the internet gaming operator or internet gaming platform provider and the board have all of the necessary information to take appropriate action.

(2) The suspension of any internet wagering account discovered to be providing fraudulent access to prohibited persons.

(3) The treatment of deposits, internet wagers, and wins associated with a prohibited person’s fraudulent use of an account and the confiscation of any winnings and things of value of a prohibited person in accordance with Part 7 of these rules.

R 432.652 Terms and conditions for internet wagering accounts.

Rule 652. (1) All terms and conditions for internet wagering accounts must be included in the internal controls of the internet gaming operator or internet gaming platform provider addressing all aspects of the internet wagering, including, but not limited to all of the following:

(a) Name of the party or parties with whom the individual is entering into a contractual relationship, including any licensee.

(b) Individual's consent to have the internet gaming operator or internet gaming platform provider confirm the individual's age and identity.

(i) Prohibition from allowing any other individual to access or use his or her internet wagering account.

(ii) Prohibition from engaging in internet wagering activity unless physically present in Michigan.

(iii) Consent to the monitoring and recording by the internet gaming operator or internet gaming platform provider and/or the board of any internet wagering communications and geographic location information.

(iv) Consent to the jurisdiction of this state to resolve any disputes arising out of internet wagering.

(v) Prohibition against utilizing automated computerized software or other equivalent mechanism, such as a "bot," to engage in play.

(d) Full explanation of all fees and charges imposed upon an authorized participant related to internet wagering transactions.

(e) Availability of internet wagering account statements detailing the authorized participant’s internet wagering account activity.

(f) Privacy policies, including information access.

(g) Legal age policy, including a statement that it is a criminal offense to allow an individual who is under the age of 21 to participate in internet wagering.

(h) Full explanation of all rules applicable to dormant internet wagering accounts.

(i) Authorized participant’s right to set responsible gaming limits and to self-exclude.

(j) Authorized participant’s right to suspend his or her internet wagering account for a period of no less than 72 hours.

(k) Actions that will be taken in the event an authorized participant becomes disconnected from the internet gaming platform during game play.

(l) Notice that a malfunction voids all pays.

(m) Estimated time period for withdrawal of funds from internet wagering account.

(2) Whenever the internet gaming terms and conditions are changed, the internet gaming operator or internet gaming platform provider will require the authorized participant to acknowledge acceptance of such change. Unless otherwise authorized by the board, the authorized participant’s acknowledgement must be date and time stamped by the internet gaming platform, as applicable.

R 432.653 Authorized participant protections.

Rule 653. (1) An internet gaming operator or internet gaming platform provider must provide an authorized participant protection information page which must be readily accessible to each authorized participant. The authorized participant protection page must be accessible to an authorized participant throughout an authorized participant session. The authorized participant protection page must contain, at a minimum, all the following:

(a) Method for changing or retrieving a password or other approved access security feature and the ability to choose "strong authentication" login protection.

(b) Method for filing a complaint with the internet gaming operator or internet gaming platform provider.

(c) Method for filing with the board an unresolved complaint after all reasonable means to resolve the complaint with the internet gaming operator or internet gaming platform provider have been exhausted utilizing forms and in the manner prescribed by the board.

(d) Method for obtaining a copy of the internet wagering terms and conditions agreed to when establishing an internet wagering account.

(e) Method for the authorized participant to obtain his or her internet wagering account and game history from the internet gaming operator or internet gaming platform provider.

(f) Notification that underage gambling is a criminal offense and that anyone who facilitates an individual under the age of 21 to place an internet wager has committed a criminal offense and must be prohibited from internet gaming.

(g) Notification that the authorized participant is responsible for configuring his or her terminal's auto-lock feature to protect the terminal from unauthorized use.

(h) Notification that an authorized participant is prohibited from allowing any other individual to access or use his or her internet wagering account.

(i) Information about potential risks associated with excessive participation in internet wagering, and where to get help related to gaming responsibly.

(j) A list of the available authorized participant protection measures that can be invoked by the authorized participant, such as self-imposed limits, and information on how to invoke those measures.

(k) Mechanisms in place for authorized participants to detect unauthorized use of their internet wagering account, such as the authorized participant reviewing credit card statements against known deposits.

(l) Other authorized participant protections authorized by the board.

(2) Authorized participants must be provided with an easy and obvious method to impose limitations for internet wagering parameters including, but not limited to, deposits, wagers, and time-based limitations. The self-imposed limitation method must provide the following functionality:

(a) Upon receiving any self-imposed limitation order, the internet gaming operator or internet gaming platform provider must ensure that all specified limits are correctly implemented immediately or at the point in time that was clearly indicated to the authorized participant.

(b) The self-imposed limitations set by an authorized participant must not override more restrictive internet gaming operator or internet gaming platform provider-imposed limitations. The more restrictive limitations must take priority.

(c) Once established by an authorized participant and implemented by the internet gaming platform, it must only be possible to reduce the severity of self-imposed limitations upon 24 hours’ notice, or as required by the board.

(d) Self-imposed limitations must not be compromised by internal status events, such as self-imposed exclusion.

(3) The self-imposed limitations must be available to the authorized participant immediately after the internet wagering account is created, when placing a deposit into his or her internet wagering account, and upon logging into his or her internet wagering account.

R 432.654 Responsible gaming.

Rule 654. Each internet gaming operator’s website or internet gaming platform must display a responsible gaming logo in a manner approved by the board to direct an authorized participant to the internet gaming operator’s website or internet gaming platform responsible gaming page. The responsible gaming page must be accessible to an authorized participant during an authorized participant session and must contain, but is not limited to, the following:

(1) A prominent message, which states "If you or someone you know has a gambling problem and wants help, call the Michigan Department of Health and Human Services Gambling Disorder Help-line at: 800-270-7117”.

(2) A direct link to the Michigan Gaming Control Board Compulsive/Problem Gambling website (https://www.michigan.gov/mgcb/0,4620,7-351-79256-231582--,00.html ) and other organizations based in the United States dedicated to helping people with potential gambling problems.

(3) A clear statement of the internet gaming operator’s or internet gaming platform provider’s policy and commitment to responsible gaming.

(4) Other responsible gaming measures required by the board.

R 432.655 Internet wagering account requirements.

Rule 655. To establish an internet wagering account, an internet gaming operator or internet gaming platform provider must do all of the following:

(1) Create an electronic authorized participant file, which must, at a minimum, include the following:

(a) The authorized participant’s legal name.

(b) The authorized participant’s date of birth.

(c) The authorized participant’s Social Security number, or the last 4 digits thereof, or an equivalent identification number for a noncitizen authorized participant, such as a passport or taxpayer identification number.

(d) The authorized participant’s internet wagering account number or username.

(e) The authorized participant’s residential address. A post office box is not acceptable.

(f) The authorized participant’s electronic mail address.

(g) The authorized participant’s telephone number.

(h) Any other information collected from the authorized participant used to verify his or her identity.

(i) The method used to verify the authorized participant’s identity.

(j) The date of verification.

(2) Encrypt all of the following information contained in an electronic authorized participant file:

(a) Any portion of the authorized participant’s Social Security number or equivalent identification number for a noncitizen authorized participant, such as a passport or taxpayer identification number.

(b) The authorized participant’s passwords and PINs.

(3) Verify the authorized participant’s age and identity and record the date of verification in accordance with any of the following:

(a) Reliable forms of personal identification specified in the internet gaming operator’s or internet gaming platform provider’s internal controls.

(b) Other methodology for remote multi-source authentication, which may include third-party and governmental databases, as approved by board.

(c) Record the document number of the government issued identification credential examined, if applicable. If a government issued identification credential is not required for registration, the electronic record that details the process used to confirm the authorized participant’s identity must be recorded.

(4) Require the authorized participant to establish a password or other access security feature as approved by the board and advise the authorized participant to utilize strong authentication login protection.

(5) Record the authorized participant’s acceptance of the internet gaming operator’s or internet gaming platform provider’s internet wagering terms and conditions to participate in internet gaming through the internet gaming operator’s or internet gaming platform provider’s website.

(6) Record the authorized participant’s certification that the information provided to the internet gaming operator or internet gaming platform provider is accurate.

(7) Record the authorized participant’s acknowledgment that the legal age for internet wagering is 21, and that he or she is prohibited from allowing any other individual to access or use his or her internet wagering account.

(8) Notify the authorized participant of the establishment of the account via electronic mail.

R 432.655a Internet wagering account funding.

Rule 655a. An authorized participant’s internet wagering account may be funded through the use of any of the following:

(1) An authorized participant’s credit or debit card.

(2) An authorized participant’s deposit of cash or cash equivalent at a cashiering location approved by the board.

(3) An authorized participant’s reloadable prepaid card, which has been verified as being issued to the authorized participant and is non-transferable.

(4) Promotional credit.

(5) Winnings.

(6) Adjustments made by the internet gaming operator or internet gaming platform provider with documented notification to the authorized participant.

(7) ACH transfer, provided that the internet gaming operator or internet gaming platform provider has security measures and controls to prevent ACH fraud regarding failed ACH deposits.

(8) Wire transfer.

(9) Any other means approved by the board.

R 432.655b Failed ACH deposits.

Rule 655b. A failed ACH deposit attempt will not be considered fraudulent if the authorized participant has successfully deposited funds via an ACH transfer on a previous occasion with no outstanding chargebacks. Otherwise, the internet gaming operator or internet gaming platform provider will do all of the following:

(1) Temporarily block the authorized participant’s internet wagering account for investigation of fraud after 5 consecutive failed ACH deposit attempts within a 10-minute time period. If there is no evidence of fraud, the block may be vacated.

(2) Suspend the authorized participant’s internet wagering account after 5 additional consecutive failed ACH deposit attempts within a 10-minute period.

R 432.655c Transfer of funds prohibited.

Rule 655c. An internet gaming operator or internet gaming platform provider must not permit an authorized participant to transfer funds from one authorized participant’s internet wagering account to another authorized participant’s internet wagering account or any other wagering account.

R 432.655d Authorized participant account withdrawal.

Rule 655d. (1) An authorized participant must be allowed to withdraw the funds maintained in his or her internet wagering account, whether such account is open or closed, except as otherwise provided in these rules.

(2) An internet gaming operator or internet gaming platform provider must honor such authorized participant request to withdraw funds within ten business days of the request, unless the conditions set forth in subrule (3) of this rule are met.

(3) The internet gaming operator or internet gaming platform provider may decline to honor an authorized participant request to withdraw funds only if the internet gaming operator or internet gaming platform provider believes in good faith that the authorized participant engaged in either fraudulent conduct or other conduct that would put the internet gaming operator or internet gaming platform provider in violation of the act and these rules. In such cases, the internet gaming operator or internet gaming platform provider must do all of the following:

(a) Provide notice to the authorized participant of the nature of the investigation of the internet wagering account.

(b) Conduct its investigation in a reasonable and expedient fashion, providing the authorized participant additional written notice of the status of the investigation every tenth business day starting from the day the original notice was provided to the authorized participant.

(4) For purposes of this provision, a request for withdrawal will be considered honored if it is processed by the internet gaming operator or internet gaming platform provider notwithstanding a delay by a payment processor, credit card issuer, or the custodian of a financial account.

R 432.655e Internet wagering account review requirements.

Rule 655e. All adjustments to internet wagering accounts for amounts of $500.00 or under will be periodically reviewed by supervisory personnel as set forth in the internet gaming operator’s or internet gaming platform provider’s internal controls. All other adjustments must be authorized by supervisory personnel prior to being entered.

R 432.656 Internet wagering account information.

Rule 656. (1) An internet gaming platform must provide an account statement with account details to an authorized participant on demand, which must include detailed account activity for at least 6 months. In addition, an internet gaming platform must, upon request, be capable of providing a summary statement of all authorized participant activity during the past 2 years. Information provided on the summary statement must include, but not be limited to, the following:

(a) Deposits to the internet wagering account.

(b) Withdrawals from the internet wagering account.

(d) Beginning and ending internet wagering account balances.

(e) Self-imposed limit history, if applicable.

(2) An internet gaming operator or internet gaming platform provider must periodically re-verify an authorized participant’s identification upon reasonable suspicion that the authorized participant’s identification has been compromised.

R 432.657 Internet wagering account closure.

Rule 657. An internet gaming platform must provide a conspicuous and readily accessible method for an authorized participant to close his or her internet wagering account through the account management or similar page or through the internet gaming platform customer support team. Any balance remaining in an internet wagering account closed by an authorized participant will be refunded pursuant to the internet gaming operator’s or internet gaming platform provider’s internal controls.

R 432.658 Internet wagering dormant accounts.

Rule 658. An internet gaming operator or internet gaming platform provider will consider an internet wagering account to be dormant if the authorized participant has not logged into the internet wagering account for at least 3 years. A dormant internet wagering account will be closed by the internet gaming operator or internet gaming platform provider. Any balance remaining in a dormant internet wagering account will be refunded or escheated in accordance with the internet gaming operator’s or internet gaming platform provider’s internal controls.

R 432.659 Suspension and restoration of internet wagering accounts.

Rule 659. (1) An internet gaming platform must employ a mechanism that places an internet wagering account in a suspended mode under any of the following conditions:

(a) When requested by the authorized participant for a specified period of time, which will not be less than 72 hours.

(b) When required by the board.

(d) When initiated by an internet gaming operator or internet gaming platform provider that has evidence that indicates any of the following:

(i) Illegal activity.

(ii) A negative internet wagering account balance.

(iii) A violation of the internet wagering account terms and conditions has taken place on an authorized participant’s internet wagering account.

(2) When an internet wagering account is in a suspended mode, the internet gaming platform must do all of the following:

(a) Prevent the authorized participant from internet wagering.

(b) Prevent the authorized participant from depositing funds unless the account is suspended due to having a negative internet wagering account balance but only to the extent the internet wagering account balance is brought back to zero dollars.

(c) Prevent the authorized participant from withdrawing funds from his or her suspended account, unless the suspended mode was initiated by the authorized participant.

(d) Prevent the authorized participant from making changes to his or her internet wagering account.

(e) Prevent the removal of the internet wagering account from the internet gaming platform.

(f) Prominently display to the authorized participant that the internet wagering account is in a suspended mode, the restrictions placed on the internet wagering account, and any further course of action needed to remove the suspended mode.

(3) A suspended account may be restored for any of the following reasons:

(a) Upon expiration of the time period established by the authorized participant.

(b) If authorized by the board.

(d) When the internet gaming operator or internet gaming platform provider has lifted the suspended status.

PART 6. AUDIT AND INTERNAL CONTROLS

R 432.661 Internal control standards applicability of part.

Rule 661. This part applies to internet gaming operators and internet gaming platform providers.

R 432.662 Purpose.

Rule 662. The procedures of the internal control standards are designed to ensure all of the following:

(1) Assets are safeguarded.

(2) The financial records of the internet gaming operator and internet gaming platform provider are accurate and reliable.

(3) The transactions of the internet gaming operator and internet gaming platform provider are performed only in accordance with the act and these rules.

(4) The transactions are recorded adequately to permit the proper recording of the adjusted gross receipts, fees, and all applicable taxes and payments.

(5) Accountability of assets is maintained in accordance with generally accepted accounting principles.

(6) Only authorized personnel have access to assets.

(7) Internet wagering account balances are complete and accurate. Appropriate action is taken with respect to discrepancies.

(8) Internet wagering accounts and personal identifiable information are adequately protected.

(9) The functions, duties and responsibilities are appropriately segregated and performed in accordance with sound practices by competent, qualified personnel and that no employee of the internet gaming operator, internet gaming platform provider, a supplier, registered vendor, or third-party provider is in a position to perpetuate and conceal errors or irregularities in the normal course of the employee’s duties.

(10) Internet gaming is conducted with integrity and in accordance with the act and these rules.

R 432.663 Board approval of internal control standards and requirements.

Rule 663. (1) Unless otherwise provided for by the board, prior to beginning internet gaming, an internet gaming operator /or internet gaming platform provider, or both, must submit its administrative and accounting procedures in detail in a written system of internal control for board review and written approval. A written system of internal controls must include a detailed narrative description of the administrative and accounting procedures designed to satisfy the requirements of these rules.

(2) The written system of internal controls must address the following items, at a minimum:

(a) Procedures for responding to a failure of the internet gaming platform (i.e., game, system, communications, or platform malfunction), including procedures for restoring internet gaming. The internet gaming operator or internet gaming platform provider, or both, must also file with the board an incident report for each significant platform failure and document the date, time, and reason for the failure along with the date and time the system is restored.

(b) User access controls for all internet gaming personnel.

(d) Automated and manual risk management procedures.

(e) Procedures for identifying and reporting fraud and suspicious conduct.

(f) Procedures to prevent wagering by prohibited persons.

(g) Procedures for internet gaming operator-imposed or internet gaming platform provider-imposed exclusion of authorized participants, including the following:

(i) Providing a notification containing operator-imposed or internet gaming platform provider-imposed exclusion status and general instructions for resolution.

(ii) Ensuring that immediately upon executing the operator-imposed or internet gaming platform provider-imposed exclusion order, no new wagers or deposits are accepted from the authorized participant, until such time as the operator-imposed or internet gaming platform provider-imposed exclusion has been revoked.

(iii) Ensuring that the authorized participant is not prevented from withdrawing any or all of his or her account balance, provided that the internet gaming operator or internet gaming platform provider acknowledges that the funds have cleared, and that the reason or reasons for exclusion would not prohibit a withdrawal.

(h) Description of anti-money laundering compliance standards.

(i) Process for submitting or receiving approval of all types of internet games and wagers available.

(j) Description of process for accepting wagers and issuing payouts, plus any additional controls for accepting wagers and issuing payouts in excess of $10,000.00.

(k) Description of process for voiding or cancelling wagers and refunding the authorized participant in accordance with these rules.

(l) Description of process for accepting multiple wagers from one authorized participant in a 24-hour cycle, including process to identify authorized participant structuring of wagers to circumvent recording and reporting requirements.

(m) Procedure for the recording of and reconciliation of internet gaming transactions.

(n) Procedures for issuance and acceptance of promotional funds for internet gaming.

(o) Description of all integrated third-party platforms.

(p) Procedures for identifying and restricting prohibited persons.

(q) Description of process to close out dormant accounts.

(r) Procedures for making adjustments to an internet wagering account, providing a method for an authorized participant to close out an account and how an authorized participant will be refunded after the closure of an account or how funds will be escheated.

(s) Procedures to verify each authorized participant's physical location in accordance with Part 3 of these rules.

(t) Procedures for the security and sharing of personal identifiable information of an authorized participant, funds or financial information in an internet wagering account and other information as required by the board. The procedures must include the means by which an internet gaming operator and/or internet gaming platform provider will provide notice to an authorized participant related to the sharing of personal identifiable information.

(u) Detailed responsible gaming measures.

(v) Method for securely implementing the responsible gaming database.

(w) Methods for securely issuing, modifying, and resetting an authorized participant’s account password, PIN, or other approved security feature, where applicable. Any method must include notification to the authorized participant following any modification via electronic or regular mail, text message, or other manner approved by the board. Such methods must include, at a minimum, one of the following:

(i) Proof of identity, if in person.

(ii) The correct response to 2 or more challenge questions.

(iii) Strong authentication.

(x) Procedures for receiving, investigating, and responding to all authorized participant complaints.

(y) Detail the location of the internet gaming servers, including any third-party remote location servers, and what controls will be in place to ensure security of the internet gaming servers.

(z) Technical security standards (controls) required by these rules.

(aa) Procedures for registration of authorized participants and establishing internet wagering accounts, including a procedure for authenticating the age, identity and physical address of an applicant for an internet wagering account and whether the applicant is prohibited from establishing or maintaining an account under applicable laws or regulations.

(bb) Procedures for terminating an internet wagering account and the return of any funds remaining in the internet wagering account to the authorized participant or confiscation of funds in accordance with these rules.

(cc) Procedures for the logging in and authentication of an authorized participant in order to enable the authorized participant to commence internet gaming and the logging off of the authorized participant when the authorized participant has completed play, including a procedure to automatically log an authorized participant out of the internet wagering account after a specified period of inactivity.

(dd) Procedures for the crediting and debiting of an internet wagering account.

(ee) Procedures for withdrawing funds from an internet wagering account by the authorized participant.

(ff) Procedures for the protection of an authorized participant’s funds, including the segregation of an authorized participant’s funds from operating funds of the internet gaming operator and/or internet gaming platform provider.

(gg) Procedures and security for the calculation and recording of gross receipts, adjusted gross receipts and winnings.

(hh) Procedures and security standards as to receipt, handling, and storage of internet gaming equipment.

(ii) Procedures and security standards to protect and respond to suspected or actual hacking or tampering by any individual with the internet gaming operator’s or internet gaming platform provider’s internet gaming website and internet gaming devices and associated equipment.

(jj) Procedures and appropriate measures implemented to deter, detect and, to the extent possible, to prevent cheating, including collusion, and use of cheating devices, including the use of software programs that make bets according to algorithms.

(kk) Procedures to govern emergencies, including suspected or actual cyber-attacks, hacking, or tampering with the internet gaming platform, internet gaming website and internet gaming devices and associated equipment. The procedures must include the process for the reconciliation or repayment of an authorized participant's internet wagering account.

(ll) Policies and procedures in connection with the internal audit function of its internet gaming operations.

(mm) Establishing policies and procedures with respect to credit.

(nn) Any other items deemed necessary by the board.

(3) To the extent a third-party is involved in or provides any of the internal controls required in these rules, the internet gaming operator’s and/or internet gaming platform provider’s internal controls must document the roles and responsibilities of the third-party and must include procedures to evaluate the adequacy of and monitor compliance with the third-party’s internal control procedures.

R 432.663a Amendments to internal controls.

Rule 663a. Unless otherwise provided by the board, all of the following provisions apply to amendments to the internal control procedures:

(1) Amendments to any portion of the internal control procedures must be submitted to the board for approval. If within 30 days the board has not approved, denied, or otherwise provided written notice, an internet gaming operator or internet gaming platform provider, or both, may implement the amended internal controls as submitted with the board retaining its authority to require further amendment, approval, or denial.

(2) The board may, in writing, approve, deny, or require a revision to the amendment to the internal control procedures. If the internet gaming operator or internet gaming platform provider, or both, is notified of a required revision, the internet gaming operator or internet gaming platform provider must work with the board to address the revision.

(3) If the board requests additional information, clarification, or revision of an amendment to an internal control and the internet gaming operator and/or internet gaming platform provider fails to satisfy the request within 30 days of the board request, the board will consider the amendment denied and it cannot be implemented or if previously implemented per subrule (1) of this rule, the internet gaming operator or internet gaming platform provider will have 15 days to cease implementation of that amendment. If the internet gaming operator or internet gaming platform provider, or both, subsequently wants to pursue the amendment, it must resubmit the request along with the additional information previously requested by the board.

R 432.663b Emergency procedures.

Rule 663b. (1) In the event of an emergency, the internet gaming operator or internet gaming platform provider, or both, may temporarily amend an internal control procedure. The executive director or his or her designee must be notified that an emergency exists before temporarily amending an internal control procedure.

(2) An internet gaming operator and/or internet gaming platform provider must submit the temporary emergency amendment of the internal control procedures to the executive director or his or her designee within 3 days of the amendment. The submission must include the detailed emergency procedures that will be implemented and the time period the emergency procedures will be temporarily in place. Any concerns the board has with the submission will be addressed with the internet gaming operator and/or internet gaming platform provider.

(3) As soon as the circumstances necessitating the emergency amendment to the internal control procedures abate, an internet gaming operator and/or internet gaming platform provider will resume compliance with the approved internal control procedures.

R 432.663c Failure to comply with requirements.

Rule 663c. If the board determines that the internet gaming operator’s or internet gaming platform provider’s, or both, administrative or accounting procedures or its written internal control procedures do not comply with the requirements of these rules or requires improvement, then the board will notify the internet gaming operator or internet gaming platform provider, or both, in writing. Within 15 days after receiving the notification, the internet gaming operator or internet gaming platform provider must amend its procedures and written internal control procedures accordingly and must submit, for board approval, a copy of the written internal control procedures, as amended, and a description of any other remedial measure taken.

R 432.664 Compliance with internal controls.

Rule 664. (1) Internet gaming operators or internet gaming platform providers, or both, must comply with all internal controls.

(2) If an internet gaming operator or internet gaming platform provider, or both, fails to comply with any provision of its internal controls, the board may initiate a disciplinary action.

R 432.665 Accounting records.

Rule 665. (1) An internet gaming operator and internet gaming platform provider must maintain complete, accurate, and legible records of all transactions related to its internet gaming, including transactions pertaining to its revenues, expenses, assets, liabilities, and equity in conformance with generally accepted accounting principles.

(2) The board may direct an internet gaming operator and internet gaming platform provider to alter the manner in which the records are maintained if the internet gaming operator’s and internet gaming platform provider’s records are not in accordance with generally accepted accounting principles or if the records are not in sufficient detail.

(3) The accounting records must be maintained using a double entry system of accounting with transactions recorded on the accrual basis and supported by detailed subsidiary records.

(4) The detailed subsidiary records must include, at a minimum, all of the following:

(a) Detailed general ledger accounts identifying all revenue, expenses, assets, liabilities, and equity.

(b) A record of all investments, advances, loans, and accounts receivable balances due the establishment.

(d) A record of all accounts receivable written off as uncollectible.

(e) Journal entries prepared.

(f) Tax work papers used in preparation of any state or federal tax return if applicable.

(g) Records supporting the accumulation of the costs for complimentary services and items. A complimentary service or item provided to individuals in the normal course of an internet gaming business will be recorded at an amount based upon the full retail price normally charged for the service or item or as is otherwise consistent with generally accepted accounting principles.

(h) Records required by the internal control system.

(i) Other records that the board requires to be maintained.

(5) The internet gaming operator or internet gaming platform provider, or both, must maintain all records supporting the adjusted gross receipts.

(6)If an internet gaming operator or internet gaming platform provider, or both, fails to maintain the records used by it to calculate the adjusted gross receipts, then the board may compute and determine the amount upon the basis of an audit conducted by the board using available information.

R 432.665a Annual audits and annual compliance reports.

Rule 665a. (1) All of the following provisions apply to annual and special audits and other reports:

(a) The board requires an annual audit of the financial condition of the internet gaming operator’s and internet gaming platform provider’s total internet gaming operations. For an internet gaming operator licensed as a casino under the Michigan Gaming Control and Revenue Act, the audit prepared pursuant to section 14 of the Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.214, satisfies this requirement. An independent certified public accountant will perform the annual audit.

(b) The annual audit must be performed and presented in accordance with generally accepted accounting principles and contain the opinion of the independent certified public accountant as to its fair preparation and presentation in accordance with generally accepted accounting principles.

(c) To assure the integrity of internet gaming and compliance with the act and these rules, the board may require a special audit of an internet gaming operator or internet gaming platform provider, or both, to be conducted by board personnel or an independent certified public accountant. The board will establish the scope, procedures, and reporting requirements of a special audit. For an internet gaming operator who is an Indian tribe, the scope of the special audit will be limited to the internet gaming operator’s internet gaming operations.

(2) The board will require annual compliance reports to be prepared by the internet gaming operator or the internet gaming platform provider, or both, and submitted in a manner and form prescribed by the board. The annual compliance report will address all of the following areas:

(a) Compliance with procedures to ascertain that adjusted gross receipts are determined and state and local taxes or payments are paid, in conformity with the act and these rules.

(b) Compliance with applicable ordinances and agreements with other governmental authorities.

(c) Compliance with internal control procedures, accounting procedures, credit procedures, dispute procedures, and board-imposed security and safety requirements.

(d) A material deviation from the internal control procedures, accounting procedures, credit and dispute procedures, and board-imposed security and safety requirements.

(e) Corrective action taken to resolve deficiencies observed in subrules (1)(a) to (1)(d) of this rule.

(f) Other matters required by the board to measure compliance with the act and these rules.

(3) The board will determine the date of filing and the number of copies of audits or reports required under this rule. The audits or reports must be received by the board or postmarked no later than the required filing date.

(4) The reporting year-end of the internet gaming operator and internet gaming platform provider will be December 31 unless otherwise approved by the board.

R 432.665b Board access to platform data.

Rule 665b. The internet gaming operator or internet gaming platform provider must provide access to internet gaming platform related data as deemed necessary by the board and in a manner approved by the board.

R 432.666 Records retention.

Rule 666. (1) Each internet gaming operator or internet gaming supplier must maintain, in a place secure from theft, loss, or destruction, adequate records of its business and accounting operations. An internet gaming operator or internet gaming supplier must make the records available to the board, upon request, within a time provided for by the board. An internet gaming operator or internet gaming supplier must hold the records for not less than 5 years. The records must include, but not be limited to, all of the following:

(a) All correspondence with, or reports to, the board or any local, state, tribal, or federal governmental agency.

(b) All correspondence concerning the business of an internet gaming operator or internet gaming supplier.

(2) An internet gaming operator or internet gaming supplier must keep and maintain accurate, complete, and legible records of any books, records, or documents pertaining to, prepared in, or generated by, the internet gaming operator or internet gaming supplier, including, but not limited to, all of the following:

(a) Forms.

(b) Reports.

(d) Ledgers.

(e) Subsidiary records.

(f) Computer generated data.

(g) Internal audit records.

(h) Correspondence.

(i) Personnel records.

An internet gaming operator or internet gaming supplier must keep and maintain the books, records, or documents in a manner and form approved or required by the board.

(3) An internet gaming operator or internet gaming supplier must organize and index all required records in a manner that enables the board to locate, inspect, review, and analyze the records with reasonable ease and efficiency.

(4) For an internet gaming operator that is an Indian tribe records required to be maintained under this section will be limited to those records related to the internet gaming operator’s internet gaming operations.

R 432.667 Taxes and payments.

Rule 667. (1) Reporting. The internet gaming platform must be able to generate reports supporting adjusted gross receipts, wagering liability, winnings, and any other reports deemed necessary by the board or as required by the internal controls. The reporting must be done on a form and in the manner prescribed by the board.

(2) Fine for Late Payments. An internet gaming operator who fails to remit to the board the tax or payment imposed under the act is liable, for a payment of a fine as determined by the board of up to 25% per month of the amounts ultimately found to be due, to be recovered by the board.

R 432.668 Write-offs/amounts returned/disputed credit or debit charges.

Rule 668. (1) An internet gaming operator will not receive a deduction from gross receipts unless written approval is granted by the board for the following:

(a) Amounts returned to an authorized participant because of a game, platform, or system malfunction or because the internet wager must be voided because of concerns regarding integrity of the wager or game that were previously included in the computation of gross receipts.

(b) Uncollectible markers or successfully disputed credit or debit card charges that were previously included in the computation of gross receipts. Discretionary write-offs by the internet gaming operator do not constitute an uncollectible marker.

(2) An internet gaming operator must submit for board review and approval a written request (including all supporting documentation) of the deductions it would like to take against gross receipts.

PART 7. RESPONSIBLE GAMING; PROHIBITED PERSON

R 432.671 Establishment and maintenance of the responsible gaming database.

Rule 671. (1) The board establishes a responsible gaming database which will contain a list of individuals who are prohibited from establishing an internet wagering account or participating in internet wagering offered by an internet gaming operator.

(2) The executive director may place an individual’s name in the responsible gaming database for any of the following reasons:

(a) The individual has been convicted in any jurisdiction of a felony, a crime of moral turpitude, or a crime involving gaming.

(b) The individual has violated the act or another gaming-related law.

(c) The individual has performed an act or has a notorious or unsavory reputation such that the individual's participation in internet wagering under the act would adversely affect public confidence and trust in internet gaming.

(d) The individual's name is on a valid and current exclusion list maintained by this state or another jurisdiction in the United States.

(e) A court has ordered the placement of an individual’s name in the responsible gaming database.

(f) The internet gaming operator or internet gaming platform provider has requested an individual’s name be included in the responsible gaming database.

(g) Any other reason the executive director considers appropriate to protect the integrity of internet gaming under the act and these rules.

(3) An internet gaming operator or internet gaming platform provider may request an individual’s name be included in the responsible gaming database. The request must be done in the manner and form prescribed by the executive director, but must at a minimum include all of the following:

(a) The individual’s name and other identifying information.

(b) The reason why the internet gaming operator or internet gaming platform provider believes the individual should be included.

(d) Any other information requested by the executive director.

(4) If the executive director places an individual in the responsible gaming database, it will notify the individual. This notification will include the basis for the individual’s placement in the responsible gaming database and explain that the individual is prohibited from establishing an internet wagering account or making an internet wager as authorized by the act and these rules.

(5) An excluded person may request a hearing under these rules to contest placement in the responsible gaming database. It will be the excluded person’s responsibility to prove by clear and convincing evidence why he or she should not be in the responsible gaming database.

(6) Involuntary placement in the responsible gaming database is permanent, unless removed by the executive director. The executive director will only remove an excluded person from the responsible gaming database if the excluded person no longer satisfies the criteria for placement.

R 432.672 Voluntary placement in the responsible gaming database.

Rule 672. (1) An individual may have his or her name placed in the responsible gaming database for a period of 1 or 5 years by submitting a request in the manner and form prescribed by executive director.

(2) An individual seeking voluntary placement in the responsible gaming database must agree to release the state, the board and its employees and agents, the internet gaming operator, the internet gaming platform provider, and each of their respective officers, directors, their employees and agents from any harm, monetary or otherwise, which may arise as a consequence of placing his or her name in the responsible gaming database.

(3) The executive director will not include an individual in the responsible gaming database until the individual has provided all necessary information.

(4) Unless requested by a voluntarily-excluded person, an internet gaming operator or internet gaming platform provider may not prohibit an individual in the responsible gaming database from engaging in other forms of gaming authorized by law in this state or in another jurisdiction.

R 432.673 Distribution of the responsible gaming database.

Rule 673. (1) The executive director will provide the internet gaming operator and internet gaming platform provider with information deemed necessary to carry out the purposes of this part in the act and these rules.

(2) Internet gaming operators and internet gaming platform providers may only use the information as provided for in the internal controls and as is consistent with the act and these rules.

(3) Use of information from the responsible gaming database for a purpose other than what is provided for in the act or these rules may result in disciplinary action by the board against the licensee or a civil fine. Nothing in this part is intended to preclude the disclosure of such information pursuant to subpoena or other legal process.

R 432.674 Self-exclusion list.

Rule 674. (1) Each internet gaming operator and internet gaming platform provider must establish and maintain a self-exclusion list as prescribed in the act, these rules, direction of the executive director and in accordance with internal controls.

(2) The self-exclusion list must be designed to safeguard the confidentiality of the information.

(3) An individual may have his or her name added to the self-exclusion list maintained by the internet gaming operator or internet gaming platform provider if he or she agrees to release the state, the board and its employees and agents, the internet gaming operator, the internet gaming betting platform provider, and each of their respective officers, directors, employees, and agents from any harm, monetary or otherwise, which may arise as a consequence of placing his or her name in the responsible gaming database or self-exclusion list.

(4) Any individual requesting placement on the self-exclusion list must submit through his or her internet wagering account a completed request for self-exclusion as prescribed by the internet gaming operator or internet gaming platform provider, or both.

(5) It is permissible for an internet gaming operator or internet gaming platform provider to disclose the names of voluntarily-excluded persons on the self-exclusion list to a person licensed or registered by the board for the purpose of allowing the third-party to remove the names of such individuals from a targeted mailing or other advertising or promotion to be made on behalf of an internet gaming operator or internet gaming platform provider.

(6) A licensed or registered third-party that obtains the self-exclusion list from an internet gaming operator or internet gaming platform provider is permitted to use the list solely to exclude names and other information from targeted mailings or other advertising or promotion made on behalf of the internet gaming operator or internet gaming platform provider. The third-party to whom such information is disclosed is prohibited from distributing or disclosing the information to the public or to any other party. Disclosure may result in disciplinary action or civil fine.

(7) Unless requested by a voluntarily-excluded person, an internet operator or internet gaming platform provider may not prohibit an individual on the self-exclusion list from engaging in other forms of gaming authorized by law in this state or in another jurisdiction.

R 432.675 Prohibited persons.

Rule 675. (1) An internet gaming operator and an internet gaming platform provider must make reasonable efforts to prevent a prohibited person from establishing an internet wagering account and not permit the prohibited person to place an internet wager based on the most current information available to the internet gaming operator and internet gaming platform provider.

(2) If an internet gaming operator or internet gaming platform provider detects, or is notified of, an individual suspected of being a prohibited person who had engaged or is engaging in prohibited internet wagering, the internet gaming operator or internet gaming platform provider, or both, must use reasonable measures to verify whether the individual is prohibited or not. If the internet gaming operator or internet gaming platform provider cannot establish using reasonable measures that the individual is prohibited, the individual will be presumed to not be a prohibited person for the purposes of this section.

(3) Upon verification of a prohibited status, the internet gaming operator or internet gaming platform provider, or both, must do both of the following:

(a) Immediately prohibit access to the individual’s internet wagering account.

(b) Seize from such individual any winnings or things of value obtained from engaging in internet wagering.

(4) The internal controls of an internet gaming operator or internet gaming platform provider must contain procedures for processing any winnings or things of value confiscated or withheld from a prohibited person.

R 432.676 Duty of internet gaming operator and internet gaming platform provider.

Rule 676. (1) The internet gaming operator and internet gaming platform provider must prohibit a prohibited person from establishing an internet wagering account or from participating in internet wagering, or both, offered under the act and these rules.

(2) If an internet gaming operator or internet gaming platform provider becomes aware that a prohibited person has established an internet wagering account or has participated in internet wagering, the internet gaming operator or internet gaming platform provider must provide written notice to the executive director. Any internet wager made by a prohibited person must be cancelled and the internet wagering account used to place such wager must be suspended or closed.