Approval of sports wagering equipment and testing laboratories

205 CMR: MASSACHUSETTS GAMING COMMISSION

205 CMR 244.00: APPROVAL OF SPORTS WAGERING EQUIPMENT AND TESTING LABORATORIES Section

244.01: Sports Wagering Equipment 244.02: Testing and Approval of Sports Wagering Equipment 244.03: Integration and Change Management Requirements 244.04: Required Testing by Independent Testing Laboratories 244.05: Fees for Testing Sports Wagering Equipment 244.06: Independent Testing Laboratory Certification

244.01: Sports Wagering Equipment

(1) For purposes of this 205 CMR, Sports Wagering Equipment shall include, but not be limited to: (a) Equipment necessary for a Sports Wagering Operator to allow an individual to place, review, modify or receive winnings from a Sports Wager; (b) Equipment used by a Sports Wagering Operator to review, manage, and report information related to a Sports Wagering Account or Sports Wager; (c) Equipment that directly relates to, affects, or is used or consumed in Sports Wagering, including, but not limited to: 1. Any mechanical, electronic, or other device, mechanism, or equipment, including kiosks subject to 205 CMR 243.02: Sports Wagering Kiosks; 2. Any software, application, components, or other goods that directly relate to, affect, are used or consumed in Sports Wagering; and 3. Anything to be installed or used on a personal device used by an individual to engage in Sports Wagering. (d) Devices used in conjunction with Sports Wagering Equipment, including, but not limited, bill validators, printers, and any other associated devices identified by the Commission; and (e) Any other software and hardware required to be tested in accordance with 205 CMR 243.00.

(2) For purposes of .00, Sports Wagering Equipment shall not include: (a) Equipment or communications technology used to access a Sports Wagering Platform; (b) Intermediary software that connects an individual to the individual's financial institution; and (c) Any other device, software, or component that does not affect the operational integrity of Sports Wagering, as determined by the Commission.

244.02: Testing and Approval of Sports Wagering Equipment

(1) In order for Sports Wagering Equipment to be approved and for critical updates to the equipment to be approved for use in Sports Wagering, a Sports Wagering Operator or Sports Wagering Vendor, at its own expense, shall submit the Sports Wagering Equipment for testing and technical evaluation in accordance with .04 by a Commission-certified independent testing laboratory certified pursuant to .06 to determine compliance with M.G.L. c. 23N and .00.

(2) The Sports Wagering Operator or Sports Wagering Vendor shall provide the certified independent testing laboratory with all documentation and other materials necessary to conduct testing and evaluate compliance, including access to any software source code and the means to verify compilation of such source code. The result of the compiled source code must be identical to that in the software submitted for evaluation.

(3) If the Sports Wagering Equipment meets or exceeds the specifications set forth in M.G.L. c. 23N and .00, the independent testing laboratory shall certify the Sports Wagering Equipment. The Sports Wagering Operator and Sports Wagering Vendor shall not make use of any Sports Wagering Equipment to offer Sports Wagering in the Commonwealth without such certification.

2/17/23 (Effective 12/9/22) 205 CMR - 805

(Mass. Register #1489, 2/17/2023)

205 CMR: MASSACHUSETTS GAMING COMMISSION

244.02: continued

(4) No Sports Wagering Equipment shall be operated in Massachusetts, nor shall previously approved Sports Wagering Equipment be critically updated, unless the Sports Wagering Operator or Sports Wagering Vendor first submits a request for approval to the Commission, as directed, at least three business days prior to the anticipated operation or modification. The Commission, or its designee, may approve such request on shorter notice in exceptional circumstances. The request for approval shall be in the form prescribed by the Commission.

(5) The Commission's gaming technology lab may conduct any additional testing of the Sports Wagering Equipment it deems necessary and may require any further subsequent action prior to or after approval.

(6) The Sports Wagering Operator and Sports Wagering Vendor shall promptly notify the Commission if it becomes aware of any negative action taken in another jurisdiction relative to Sports Wagering Equipment operating in the Commonwealth, or if it becomes aware of an issue that may negatively impact the integrity of such equipment, the reporting of revenue, or Sports Wagering.

244.03: Integration and Change Management Requirements

(1) The Sports Wagering Operator shall be responsible for the Sports Wagering realized through the Sport Wagering Operator's Sports Wagering Vendors. (a) The servers and other devices of Sports Wagering Vendors shall be considered part of the Sports Wagering Operator's Sports Wagering Equipment and shall comply with M.G.L. c. 23N and .00. (b) The Sports Wagering Operator shall guarantee that any integration with the servers and other devices of Sports Wagering Vendors complies with M.G.L. c. 23N and 205 CMR 243.00. (c) An independent testing laboratory shall conduct integration testing and certification for each server and other device with the Sports Wagering Operator's Sports Wagering Equipment prior to its deployment and as required by the Commission.

(2) The Sports Wagering Operator shall submit its proposed change management procedures to the Commission for approval in the manner described in 205 CMR 238.00. Such change management processes shall detail evaluation procedures for identifying the criticality of updates and determining the updates that shall be submitted to a certified independent testing laboratory for review and certification. The submission shall, at a minimum, reflect the following: (a) These change management submission shall be: 1. Developed in accordance with the Gaming Laboratories International, LLC Guide GLI-CMP: Change Management Program Guide, version 1.0, released May 6, 2020; 2. Approved by the Commission prior to its deployment; and 3. Audited at least annually by an independent testing laboratory. (b) The Sports Wagering Operator shall issue quarterly change reports to an independent testing laboratory for review. The independent testing laboratory shall review the submission to ensure risk is being assessed according to the approved change management processes, and documentation for all changes are complete. (c) Sports Wagering Equipment operating under the approved change management processes shall be certified to the specifications set forth in M.G.L. c. 23N and 205 CMR 243.00 and accompanied by formal certification documentation from the independent testing laboratory on at least an annual basis. The Sports Wagering Operator or Sports Wagering Vendor may request an extension beyond the annual approval if it can demonstrate a hardship that prevents it from meeting the requirements for annual approval. The granting of a hardship waiver shall be in the sole discretion of the Commission.

244.04: Required Testing by Independent Testing Laboratories

(1) Any testing by the independent testing laboratory for the purposes of certifying Sports Wagering Equipment shall be conducted in compliance with M.G.L. c. 23N and 205 CMR 243.00 and 244.00.

2/17/23 (Effective 12/9/22) 205 CMR - 806

205 CMR: MASSACHUSETTS GAMING COMMISSION

244.04: continued

(2) The independent testing laboratory shall issue a report of the testing results to the Sports Wagering Operator or Sports Wagering Vendor and to the Commission. Such report shall contain: (a) the part and version numbers of the Sports Wagering Equipment tested; (b) attachments containing documents sufficient to describe the functionality and operation of all material components of the Sports Wagering Equipment; (c) a statement as to whether each of the components within the Sports Wagering Equipment, each interaction between components, and the equipment as a whole is compliant with M.G.L. c. 23N and .00; (d) the date the Sports Wagering Equipment was submitted for testing; (e) the start and end dates of the Sports Wagering Equipment testing; (f) the location of the facility used to perform the testing; and (g) a statement, signed under penalty of perjury, that all information provided in the report is accurate and complete.

(3) The independent testing laboratory's report shall not contain any information in its body that, if publicly released, may harm the integrity of the Sports Wagering Equipment, but such information may be disclosed in an attachment to the independent testing laboratory's report.

(4) The independent testing laboratory may communicate with the Sports Wagering Operator or Sports Wagering Vendor to request additional documentation or to discuss potentially non-compliant components. The independent testing laboratory shall log any communication between itself and the Operator or vendor and, upon the Commission's request, provide copies of any or all documents transmitted to or from the Operator or vendor for a minimum of the past seven years following issuance of the independent testing laboratory's report.

(5) The independent testing laboratory may rely on testing conducted and data collected from testing conducted for another jurisdiction, whether by the independent testing laboratory or by another entity, if the testing was performed by an independent party with no apparent interest in the result. An independent testing laboratory relying on such external testing or data shall clearly identify in its report all such reliance and independently verify the validity of such data or testing by making a finding that the methods described in the earlier test are reliable and there is no indication that the data is incorrect.

(6) An independent testing laboratory may rely on any data or results of testing conducted by a Commission-certified independent testing laboratory when such testing was conducted for purposes of permitting Sports Wagering Equipment in the Commonwealth. Any reliance pursuant to .04(5) or (6) shall be clearly identified in the report.

244.05: Fees for Testing Sports Wagering Equipment

(1) The Commission may assess a fee to a Sports Wagering Operator or Sports Wagering Vendor representing the cost associated with any additional testing of Sports Wagering Equipment required by the Commission's gaming technology lab in accordance with 205 CMR 244.02(5), at hourly rates to be posted by the Commission.

(2) A Sports Wagering Operator or Sports Wagering Vendor requesting that a Commission certified independent testing laboratory conduct testing shall pay all costs of the testing directly to the independent testing laboratory.

2/17/23 (Effective 12/9/22) 205 CMR - 807

205 CMR: MASSACHUSETTS GAMING COMMISSION

244.06: Independent Testing Laboratory Certification

A person certified as an independent testing laboratory pursuant to 205 CMR 144.00: Approval of Slot Machines and Other Electronic Gaming Devices and Testing Laboratories may be authorized by the Commission to provide testing services of Sports Wagering Equipment in Massachusetts. Such certified independent testing laboratory shall be subject to the same notification requirements and continued obligations outlined in 205 CMR 144.06: Independent Testing Laboratory Certification and Auditing as they relate to Sports Wagering Equipment as well as the same reporting requirements outlined in 205 CMR 144.04: Required Testing by Independent Testing Laboratories as they relate to Sports Wagering Equipment testing.

REGULATORY AUTHORITY

.00: M.G.L. c. 23N § 4.

2/17/23 (Effective 12/9/22) 205 CMR - 808