Management Integrity

1.1 There shall be a commitment to character, integrity and high ethical values demonstrated through attitude and actions.

Requirements – At a minimum:

1. Matters identified in management letters from internal and external auditors and matters identified by the Registrar shall be responded to in a timely manner.
2. All applicable laws and regulations shall be adhered to.
3. Operators and gaming-related suppliers shall create and abide by a code of conduct which addresses at a minimum conflicts of interest and transparency in dealings with the Registrar. The code of conduct must be regularly reviewed by the organization’s senior management.
   
   Guidance: Management in the context of this Standard refers to executives and senior level management who have the day-to-day responsibility of managing the business of
   the organization.

Sound Control Environment

1.2 Formal control activities shall be submitted to the Registrar which have been assessed by an independent oversight function acceptable to the Registrar for alignment with the Standards and Requirements and authorized by the appropriate level of management.

Requirements – At a minimum:

1. A process shall be in place to periodically review control activities for effectiveness in fulfilling the Standards and Requirements and to document, remedy and adjust the controls where deficiencies or gaps are found.
2. Substantial changes to the control environment shall be communicated to the Registrar in a timely manner.
3. Control activities must be available to the AGCO (or its designate) for regulatory assurance purposes.
   
   Guidance: Independent oversight may be exercised by an internal audit body and/or external auditor, as considered appropriate by the Operator or gaming-related supplier and as acceptable to the Registrar. The Registrar recognizes that oversight practices may vary by Operator / gaming-related supplier depending on their size, ownership structure, scope and complexity of operations, corporate strategy and risk profile. Whatever the case, the independent oversight function should be responsible for auditing the organization’s compliance management framework, identifying, managing and reporting on risks the organization is or might be exposed to and exercising oversight that is independent from operational management. It should also have direct and unrestricted access to the Board.
   
   Additional Guidance for Gaming-Related Suppliers: In the application of the entity level Standards and Requirements, it is recognized that some gaming-related suppliers, particularly suppliers of gaming equipment, operate in jurisdictions in addition to Ontario and may be limited in their ability to design and implement control activities based solely on the Standards and Requirements. The intent is that these Standards and Requirements apply to gaming-related suppliers in respect of their conduct in Ontario. At a minimum, the entity level Standards and Requirements seek assurance that gaming-related suppliers, including suppliers operating in multiple jurisdictions, will have acceptable control activities and that periodic review for gaps in control activities is carried out and that the suppliers ensure that the control activities are followed where such control activities affect the respective supplier’s conduct in Ontario.

​1.2.1 Removed, March 2022.

1.3 Removed, September 2020.

1.4 Removed, September 2020.

1.5 Removed, September 2020.

1.6 Removed, September 2020.

1.7 Management overrides of the control activities shall be clearly documented and made available to the Registrar upon request.

Requirements – At a minimum:

1. Approval from at least two senior-level managers is required in order to override any
   control activity, and in each instance the override shall be reported to the Board or other
   governance structure where a Board does not exist
   
   Guidance: The intent of this Standard is to allow senior-level management to override
   controls on a one-off basis in necessary circumstances and to ensure that appropriate
   documentation is maintained for auditing purposes. This Standard is not intended to
   address permanent changes to the control environment.

​1.8 Operators must establish, implement and maintain controls to support preparation of financial reports which comply with all applicable accounting standards, rules and good practices.

Organizational Structure and Capabilities

1.9 Employees must have the competence, skills, experience and training required to execute control activities that are relevant to their responsibilities.

Requirements – At a minimum:

1. Employees involved in performing control activities must be trained and have knowledge of the organization’s control environment, the regulatory risks that the controls are designed to mitigate and the regulatory objectives reflected in the Standards and Requirements.

1.10 Organizational structures shall be designed to promote a sound control environment and proper segregation of duties to ensure that the possibility for collusion or unauthorized or illegal activities is minimized.

Requirements – At a minimum:

1. Employees shall be given the appropriate and documented authority and responsibility to carry out their job functions, subject to supervision.
2. The adequacy of segregation of duties as they relate to player protection, game integrity and protection of assets shall be regularly reviewed by the organization’s internal audit group or other independent oversight function acceptable to the Registrar.
3. Operators must maintain an up to date organizational chart showing key reporting lines and relationships, and make it available to the Registrar upon request.

1.11 Management clearly understands its accountability and authority for the control environment.

Requirements – At a minimum:

1. Management shall have been trained and have knowledge of the organization’s control environment, the regulatory risks that the controls are designed to mitigate and the regulatory objectives reflected in the Standards and Requirements.

1.12 Information, including logs, related to compliance with the law, the Standards and Requirements and/or adherence with control activities shall be retained for a minimum of three (3) years, unless otherwise stated.

1.13 All surveillance recordings shall be retained for a minimum period as specified by the Registrar.

Oversight

1.14 Compliance with the Standards and Requirements shall be documented in an organized manner to ensure that the information is capable of being reviewed and audited by an independent oversight function.

Requirements – At a minimum:

1. Documentation shall be reviewed and analyzed to ensure compliance with the Standards and Requirements, and approved by management.
2. Internal and external auditors shall be granted access to all relevant systems, documentation (including control activities) and resources for the purpose of conducting an audit.
3. Where directed, Operators and gaming-related suppliers shall retain an independent auditor acceptable to the Registrar to carry out audits required by the Registrar and provide copies of the audit reports to the Registrar.
   
   Guidance: The intent of this Requirement is to allow the Registrar to direct third party audits where he considers necessary for regulatory assurance purposes. Although the auditor would be retained by the Operator or gaming-related supplier in these circumstances, it would report directly to the Registrar.
4. In reviewing control activities for compliance with the Standards and Requirements, internal and external auditors shall take into account the Registrar’s expectations, as articulated herein.

1.15 Primary accountability for compliance resides with the Board, or other governance structure, where a Board does not exist, and there shall be evidence that the Board, or other governance structure, has carried out its responsibility in this respect.

Requirements – At a minimum:

1. A compliance oversight function shall be established that is independent of the activities it oversees.
   
   Guidance: Overall responsibility for compliance monitoring should ideally rest with a chief compliance officer or if such person does not exist, a member of senior management.
2. An internal audit function shall be established that regularly audits the organization’s control environment and compliance management framework and exercises oversight that is independent from operational management. The internal audit function shall have the authority to independently review any aspect of the operations.
   
   Guidance: Where this is not feasible given the organization’s size or structure, audits should be carried out by another independent oversight function.
3. The compliance oversight function and internal audit or other independent oversight function shall have direct and unrestricted access to the Board, or other governance structure, and shall report on all important issues regarding compliance on a regular basis or as necessary.
4. The Board, or other governance structure, shall establish a committee or committees to oversee the organization’s compliance and audit oversight functions, with appropriate terms of reference addressing composition and accountabilities.
5. Members of the Board, or other governance structure, and of any committees established to oversee the organization’s compliance and audit oversight functions shall understand the business’s operations, initiatives and major transactions, and shall have the skills, training, experience and independence to carry out their fiduciary responsibilities.

1.16 There shall be an independent “whistleblowing” process to allow employees to anonymously report deficiencies or gaps in the control environment as well as incidents of possible non-compliance with the controls, Standards and Requirements, or the law.

Requirements – At a minimum, Operators shall:

1. Issues raised through the “whistleblowing” process must be addressed and communicated to the Board in a timely manner.

1.17 Registrants shall engage with the Registrar in a transparent way.

Requirements – At a minimum, Operators shall:

1. Provide reports regarding any incident or matter that may affect the integrity or public confidence in gaming, including any actions taken to prevent similar incidents from occurring in the future, in accordance with the established notification matrix.
2. Provide reports regarding any incident of non-compliance with the law, Standards and Requirements or control activities, including any actions taken to correct the cause of noncompliance, in accordance with the established notification matrix.
3. [Removed September 2020.]
4. Make available any data, information and documents requested by the Registrar.
5. [Removed September 2020.]

Information Technology

1.18 A recognized industry standard framework shall be used to manage the information technology (IT) control environment to support compliance with the Standards and Requirements.

Security Management

1.19 Users shall be granted access to the gaming system based on business need.

Requirements – At a minimum:

1. Access privileges are granted, modified and revoked based on employment status and job requirements and all activities associated with these actions are logged.
2. Access privileges are independently reviewed and confirmed on a periodic basis.

1.20 Access to gaming information systems shall be monitored, logged and shall be traceable to a specific individual.

Requirements – At a minimum:

1. All accounts for business users shall be uniquely assigned to an individual.
2. All system accounts (or other accounts with equivalent privileges) shall be restricted to staff that provide IT support, and mechanisms shall be in place to secure and monitor use of those accounts.

1.21 Processes shall be in place to ensure that only authorized individuals are permitted to open system accounts.

1.22 Industry accepted components, both hardware and software, shall be used where possible.

1.23 Any connection or interface between the gaming system and any other system, whether internal or external third party, shall be monitored, hardened and regularly assessed to ensure the integrity and security of the gaming system.

1.24 Mechanisms shall be in place to ensure the reliability, integrity and availability of the gaming system.

1.25 There shall be a suitably secure physical environment in place to prevent unauthorized access to the gaming system and to ensure the protection of assets.

1.26 Gaming systems, infrastructure, data, activity logs and all other related components shall be protected from threats, vulnerabilities, attacks or breaches.

Requirements – At a minimum:

1. All users shall be authenticated.
2. All components shall be hardened in accordance with industry and technology good practices prior to going live and prior to any changes.
3. The appropriateness and effectiveness of steps taken to harden technology components shall be regularly assessed.
4. Patches to correct any security risks shall be updated regularly

1.27 Security activities shall be logged in an auditable manner, monitored, promptly analyzed and a report prepared and escalated as appropriate.

Requirements – At a minimum:

1. Attempts to attack, breach or access gaming system components in an unauthorized manner shall be responded to in a timely and appropriate manner.
2. Intrusion attempts shall be actively detected and where possible prevented from causing disruption or outage of the gaming system.
3. There shall be adequate logging to capture and monitor any attempts to attack, breach or access in an unauthorized manner any components of the gaming system. There shall be an appropriate escalation procedure.

1.28 Independent assessments shall be regularly performed by a qualified individual to verify the adequacy of gaming system security and all of its related components.

1.29 Operators and gaming-related suppliers shall stay current on security trends, issues and solutions.

Change Management

1.30 A system development lifecycle that considers security and processing integrity shall be in place for gaming system technology developed in-house.

1.31 Due diligence must be performed on all acquired gaming system technology to ensure security and processing integrity requirements are met.

1.32 A testing strategy to address changes in technology shall be in place to ensure that deployed gaming systems operate as intended.

1.33 All gaming system changes shall be appropriately, consistently and clearly documented, reviewed, tested and approved.

Requirements – At a minimum:

1. All gaming system technology components are installed and maintained in accordance with the appropriate change management procedures.
2. Requests for changes and maintenance of the gaming system are standardized and are subject to change management procedures.
3. Emergency changes are approved, tested, documented, and monitored.
4. Change management procedures shall account for segregation of duties between development and production.
5. Only dedicated and specific accounts may be used to make changes.

1.34 The gaming system shall be able to detect unauthorized changes.

Data Governance

1.35 Data governance shall be in place to address data processing integrity and protection of sensitive data.

1.36 Sensitive data, including player information and data relevant to determining game outcomes, shall be secured and protected from unauthorized access or use at all times.

Requirements – At a minimum:

1. The gaming system shall ensure that data is appropriately backed up in a manner that allows it to be completely and accurately restored.
2. Data backups shall be stored off-site in a secure location and in accordance with applicable policies and laws.

1.37 Player information shall be securely protected and its usage controlled by OLG.

Requirements – At a minimum:

1. Data collection and protection requirements for player personal information shall meet those set out in the Freedom of Information and Protection of Privacy Act.
2. Player information shall only be used for OLG’s business unless there is prior approval from OLG.

1.38 Removed January 2022.

1.39 Communication of sensitive game data shall be protected for integrity.

1.40 Procedures shall be established and documented for IT operations and incident management, including managing, monitoring and responding to security and processing integrity events.

Requirements – At a minimum:

1. Proactive monitoring and detection of errors in the gaming system and related components shall be in place. Action shall be immediately taken to correct incidents of non-compliance with the Standards and Requirements or control activities.
2. There shall be time synchronization of the gaming system environment and related components.
3. Event data shall be retained to provide chronological information and logs to enable the reconstruction, review and examination of the time sequences of processing.

1.41 Gaming applications on all portable devices shall be appropriately secured.
Guidance: This Standard is not intended to capture players using their own portable devices such as their smartphones, but rather employees or players using portable devises to access the Operator’s gaming system.

Third Party Management

1.42 Operators and gaming-related suppliers shall only contract with reputable suppliers.

1.43 Removed, September 2020

1.44 Operators and gaming-related suppliers shall provide the Registrar with a list of suppliers that provide them with goods or services in relation to lottery schemes and shall ensure that this list is kept up to date.

Compliance with Technical Standards

1.45 Operators and gaming-related suppliers shall comply with applicable technical standards issued by the Registrar.

Compliance with OLG Policies and Procedures

1.46 All registrants and non-gaming-related suppliers who are exempt from registration will comply with all applicable OLG policies and procedures to the extent that they are consistent with these Standards and Requirements.

 2.1 Advertising and marketing materials and communications shall not target underage or self-excluded persons to participate in lottery schemes and shall not include underage individuals.

Requirements – At a minimum, materials and communications shall not:

1. Be based on themes, or use language, intended to appeal primarily to minors.
2. Appear on billboards or other outdoor displays that are directly adjacent to schools or other primarily youth-oriented locations.
3. Contain cartoon figures, symbols, role models, and/or celebrity/entertainer endorsers whose primary appeal is to minors.
4. Use individuals who are, or appear to be, minors to promote gambling.
5. Appear in media and venues directed primarily to minors, or where most of the audience is reasonably expected to be minors.

2.2 Advertising and marketing materials and communications shall not be misleading.

Requirements – At a minimum, materials and communications shall not:

1. Imply that playing a lottery scheme is required in order to fulfill family or social obligations or solve personal problems.
2. Promote playing a lottery scheme as an alternative to employment, as a financial investment, or as a requirement for financial security
3. Contain endorsements by well-known personalities that suggest that playing lottery schemes has contributed to their success.
4. Encourage play as a means of recovering past gambling or other financial losses.
5. Be designed so as to make false promises or present winning as the probable outcome.
6. Imply that chances of winning increase:
   1. The longer one plays;
   2. The more one spends; or
   3. Suggest that skill can influence the outcome (for games where skill is not a factor).

2.2.1   Advertising and marketing materials that communicate gambling inducements, bonuses and credits related to sport and event betting are prohibited, except in the following:  

1. on operator websites, including the landing page;   
2. the gaming site;   
3. signage inside the premises, on the property on which the premises are situated, or immediately adjacent to the premises; or  
4. through direct advertising and marketing, after receiving active player consent.  

Guidance:   

• This standard does not prohibit the use of inducements, bonuses and credits.   
• Except as outlined in the Standard, all public advertising of gambling inducements, bonuses and credits related to sport and event betting is otherwise prohibited, including targeted advertising and algorithm-based ads.   
• Direct marketing and advertising includes but is not limited to direct messaging via social media, emails, texts, and phone calls.   

2.2.2   Permitted advertising and marketing materials that communicate gambling inducements, bonuses and credits must, at a minimum:  

• Disclose all material conditions and limitations of the offer at its first presentation.
• Not be described as free unless the inducement, bonus or credit is free. If the player has to risk or lose their own money or if there are conditions attached to their own money, the offer must disclose those terms and may not be described as free.
• Not be described as risk-free if the player needs to incur any loss or risk their own money to use or withdraw winnings from the risk-free bet.   

2.2.3   Players must be provided an opt-in process whereby they actively consent to receiving any direct advertising and marketing of inducements, bonuses and credits, and must be provided a method to withdraw their consent at any time, where such marketing and advertising materials are available.  

Guidance:   

• Direct marketing and advertising includes but is not limited to: direct messaging via social media, emails, texts, and phone calls.   

2.3 Information about the risks of gambling and where to obtain additional information or assistance shall be made readily available to all patrons.

Requirements – At a minimum:

1. Responsible gambling materials and information about obtaining help, including the number for Connex Ontario, shall be available, visible and accessible to all patrons.
2. Information about setting betting limits, if applicable, shall be made available to all patrons.
3. Information about self-exclusion programs shall be available, visible and accessible to all patrons.
4. Advertising and marketing materials shall, where effective, contain a responsible gambling message.
5. All information related to responsible gambling shall be regularly and periodically reviewed and updated to ensure that it is accurate, up to date and in line with industry good practice.

2.4 Patrons shall be provided with meaningful and accurate information to enable them to make informed choices.

Requirements – At a minimum:

1. Meaningful and accurate information on the rules of play shall be clearly stated and made available to patrons.
2. Meaningful and accurate information on the odds of winning, payout odds or returns to patrons shall be clearly stated and made available to patrons.

3. Odds in sport and event betting sometimes change prior to or during an event. Changes in odds must be updated and publicly available to all players. This is not intended to entitle a player who has previously placed a bet to receive new odds on that bet.

4. For games that include progressive awards, Operators shall provide notice to patrons of the disposition of accumulated progressive prizes prior to a progressive game being converted or removed.
5. For live table games, game specific minimum and maximum wagers shall be clearly posted and visible to patrons playing the game (applicable to Casinos only).
6. For sport and event betting, provide any other information on elements that will affect play or results (e.g., the method of placing bets).
7. Cash out options and how to redeem winning bets in sport and event betting.

2.5 Support shall be provided to persons showing signs of potentially problematic gambling behavior.

Requirements – At a minimum:

1. All employees who interact with players shall receive training in a Registrar-approved program designed to identify and respond appropriately to players who may be showing signs of problem gambling.
2. Players shall be provided with easily accessible contact information of at least one organization dedicated to treating and assisting problem gamblers.
3. OLG shall develop and enforce responsible gambling policies, procedures and training, ensure they are available, kept up to date and relevant, and that the Operator complies with them.
4. Responsible gambling policies shall be reviewed periodically for effectiveness.

2.6 OLG shall provide a common voluntary self-exclusion program.

Requirements – At a minimum:

1. At the time of signing up for self-exclusion, individuals shall have the option to be excluded from any or all gaming sectors (e.g. Casino, cGaming).
2. Despite requirement 1, if a player self-excludes from a Casino, the player is not eligible to gamble on OLG’s iGaming site for the duration of the self-exclusion period.
3. Individuals shall have the option to sign up for the self-exclusion program at gaming sites or at an off-site location.
4. Self-exclusions shall have a clearly defined term length.
5. Operators shall take active steps to identify, and if required, remove self-excluded persons from the gaming site when they are found to be in breach of their self-exclusion agreement.
   
   Guidance: OLG’s self-exclusion program may be executed in each of the gamingsectors using different processes and technologies to reflect the distinct operational circumstances of that sector.

​2.7 Individuals who have decided to voluntarily self-exclude shall be removed from mailing lists and shall not receive incentives or promotions for any products and services during the period of self-exclusion.

2.8 Game designs and features shall be clear and shall not mislead the player. This Standard does not apply to sport and event betting products.

Requirements – At a minimum:

1. Where a game simulates a physical device, the theoretical probabilities and visual representation of the game shall correspond to the features and actions of the physical device, unless otherwise disclosed to the player.
2. Game design shall not give the player the perception that speed of play or skill affects the outcome of the game when it does not.
3. After the selection of game outcome, the game shall not make a variable secondary decision which affects the result shown to the player. If the outcome is chosen that the game will lose then the game shall not substitute a particular type of loss to show to the player (i.e. near miss).
4. Where the game requires a pre-determined pattern (for example, hidden prizes on a map), the locations of the winning spots shall not change during play, except as provided for in the rules of play.
5. Games shall not display amounts or symbols that are unachievable.
6. Games shall not contain intentionally programmed subliminal messaging.
7. Where games involve reels:
   1. For single line games, jackpot symbols shall not appear in their entirety more than 12 times on average, adjacent to the pay-line, for every time they appear on the pay-line;
   2. For multi-line games, jackpot symbols shall not appear in their entirety more than 12 times, on average, not on any pay-line, for every time they appear on any pay-line.
8. Free-to-play games shall not misrepresent or mislead players as to the likelihood of winning or prize distribution of similar games played for money.
9. The denomination of each credit shall be clearly displayed on game screens.

2.8.1 The method of making bets in sport and event betting must be straightforward and understandable. Information must be made available so that the player is clearly informed of the details of the bet prior to making the bet. All selections in a bet must be made clear to the player.

Requirements – At a minimum:

1. Bets on multiple events (parlays) must be identified as parlays.
2. The player must be informed that a bet selected by the player has or has not been accepted.
3. Where the player has placed a bet and the odds, payout odds, or prices of the bet change prior to the bet being confirmed by the Operator, the player must have the option of confirming or withdrawing the bet (with refund of the bet). This requirement may not apply to an option for automatic acceptance of changes in bets described in Requirement 4 below.
4. Where the Operator offers an option of automatic acceptance of changes in bets, the player must manually opt in to activate this functionality and must be able to opt out at any time. The details of this auto-accept function and any options for the function must be clearly explained to the player prior to their consent to the application of the function.
5. The player must be informed of the period in which bets can be made on an event or series of events and bets cannot be placed after the close of the betting period.
6. Free to play sport and event betting games must not mislead players about the odds, payouts or any element of a bet for value available in sport and event betting.
7. All bets and payouts must be expressed in Canadian currency.

Guidance: This Standard is not intended to prohibit or preclude in-play betting.

2.8.2 Players must be able to access information regarding available sport and event bets without having to place a bet. This information includes:

1. Information on the bets available;
2. Odds, payouts and prices for available bets;
3. In a dynamic betting environment, including those where individuals’ wagers are gathered into pools:
   • The most up-to-date odds and payouts;
   • The up-to-date total value of the pool for market pools and pool bets that are offered.

2.8.3 Reputable and legitimate data source(s) must be used to determine the outcome of a bet. These data source(s) shall be made available to the player upon request.

2.8.4 In sport and event betting, bets shall not be given a commonly accepted name, such as “moneyline”, if the bet does not operate as a player would reasonably expect.

2.9 Free-to-play games shall provide the same responsible gambling and player protection information as games played for money.

2.10 Removed, July 2019.

2.11 Games shall not encourage players to chase their losses, or increase the amount they have decided to gamble, or continue to gamble after they have indicated that they want to stop.

2.11.1 Where an account is used, no player’s account is permitted to have a negative funds balance. A player’s account with a negative funds balance must be suspended and no transactions permitted after the negative funds balance arises. No transaction is permitted until the negative funds balance is eliminated. No bet will be accepted that could result in a negative funds balance.

Guidance: This Standard is not intended to prohibit the resettlement of bets when reasonable and necessary.

2.12 Players shall have the means to track the passage of time.

2.13 Games that are located in gaming sites that are not age-restricted shall not appeal primarily to, nor be associated with, underage individuals.

2.14 Credit shall not be extended or lent to patrons to gamble (not applicable to Casinos).

2.15 Operators shall ensure that credit services provided to patrons are carried out in a responsible manner (applicable to Casinos only).

Requirements – At a minimum:

1. Operators shall not extend credit to individuals who display problem gambling behavior.
2. If a player requests a credit limit increase, the Operator shall not increase the player’s credit limit until at least 24 hours have passed since the request.

3.1 Only eligible individuals are permitted access to a gaming site.

Requirements – At a minimum:

1. A policy on eligibility of access to the gaming site, play and payment of prizes shall be established, implemented and made public.
2. The following individuals shall not be permitted access to the gaming site:
   1. An individual under 19 years of age where the gaming site is a Casino, except in the course of employment;
   2. An individual under 18 years of age where the gaming site is a cGaming site, except in the course of employment;
   3. Individuals who appear to be intoxicated if the site is a physical premises;
   4. Every individual who advises the Operator or OLG that the individual is participating in a self-exclusion process established by OLG that applies to the site, unless the individual is accessing the gaming site in the course of their employment;
   5. An individual who is known by the Operator to have been restricted from accessing the gaming site or playing a lottery scheme as a condition of a court order;
   6. Individuals who the Operator or OLG have reason to believe have been excluded from the site under subsection 3.6(1) of the GCA

3.2 Only eligible individuals are permitted to play a lottery scheme.

Requirements – At a minimum:

1. The following individuals shall not be permitted to play lottery schemes
   1. An individual under 19 years of age where the gaming site is a Casino
   2. An individual under 18 years of age where the gaming site is a cGaming site;
   3. Individuals who appear to be intoxicated if the site is a physical premises;
   4. Every individual who advises the Operator or OLG that the individual is participating in a self-exclusion process established by OLG that applies to the site;
   5. An individual who is known by the Operator to have been restricted from accessing the gaming site or playing a lottery scheme as a condition of a court order;
   6. Individuals who the Operator or OLG have reason to believe have been excluded from the site under subsection 3.6(1) of the GCA;
   7. Officers, members of the board of directors or partners of the Operator;
   8. Registered gaming assistants of an Operator or OLG employed at any gaming site operated by the Operator or OLG;
   9. Executives or staff of a trade union who represent or negotiate on behalf of employees employed at the site;
   10. Employees of registered suppliers who maintain or repair gaming equipment at the site;
   11. Members or employees of the AGCO;
   12. Officers, members of the board of directors, or employees of OLG, unless they are within the description set out in subsection 22(6) of Ontario Regulation 78/12 (ie. they are registered as category 2 gaming assistants or otherwise not required to be registered by the AGCO).
2. Individuals described in paragraphs 1. a. and b. and e. to l. shall not be permitted to win prizes.
   
   Note: This Standard does not preclude the AGCO from participating in games for regulatory assurance purposes.

2. Individuals found to have engaged in prohibited activity in Standard 3.2.1 shall not be eligible for prizes.

​3.3 Lottery schemes shall be provided only within Ontario, unless the lottery scheme is conducted in conjunction with the government of another province.

4.1 All gaming activities and financial transactions shall be conducted fairly and honestly, and must be independently verifiable.

Requirements – At a minimum:

1. Continuous independent monitoring and recording of lottery schemes and cash (and cash equivalent) handling must be in place to support the verification of:
   1. Adherence to required rules of play by players and employees or, in sport and event betting, the processing and redemption, if any, of the bet fairly, honestly and in accordance with the terms of the bet placed by the player, including applicable betting rules;
   2. Confirmation of outcomes of lottery schemes;
   3. Prize payment to the proper person;
   4. Accuracy of financial transactions.
2. Continuous logs shall be maintained for critical gaming systems including to track financial accounting and game state history.
3. [Removed September 2018.]

4.2 Rules of play, including any subsequent modifications, shall be submitted to the Registrar for approval. This Standard is not applicable to sport and event betting.

Requirements – At a minimum, the rules of play shall contain:

1. Odds of winning, payout odds or returns to players.
2. A description of how the game is played.
3. Circumstances in which a game can be declared void.

Guidance: Sport and event betting rules of play do not need to be submitted to the Registrar for approval.

4.3 Lottery schemes must be conducted in accordance with the approved rules of play. Sport and event betting must be conducted fairly, honestly and in accordance with the terms of the bet placed by the player.

Requirements – At a minimum:

1. All bets shall be accepted, processed and settled in accordance with the approved rules of play.
2. Adequate supervision of the lottery scheme is in place to ensure adherence to required procedures.
3. Devices that compromise or affect the integrity of lottery schemes shall not be permitted.
4. Sport and event bets shall be accepted, processed, and settled in accordance with the terms of the bet placed by the player, including any applicable betting rules.

4.4 [Removed, April 2017]

4.5 All gaming systems and gaming supplies, including any subsequent modifications, shall be submitted to the Registrar for assessment and approval, at the expense of the supplier, prior to being provided to any gaming site.

Requirements:

1. [Removed, July 2019]. 
2. Chips and tokens which meet the following specifications are deemed to be approved for play in Ontario (applicable to Casinos only): 
   1. Designed and manufactured to minimize the possibility of counterfeiting in accordance with industry good practice; 
   2. Bear the manufacturer’s name or a distinctive logo or other mark identifying the manufacturer; 
   3. Bear the name of the issuer; and 
   4. Except in the case of non-value chips used exclusively for the playing of roulette, indicate the value of the chip or token. 
   5. Tokens must possess attributes that distinguish them from other tokens and coins (e.g. alloy composition, security marks, patterns) to permit acceptance of only valid coins by coin acceptors. 
      
      Guidance: Non-electronic or non-electromagnetic gaming supplies used in operation with table games in accordance with the Rules of Play (e.g. dice, cards) do not require additional assessment or approval by the Registrar, and can be made available for play. 
3. Playing cards used for gaming are imprinted with an identifier unique to the gaming site (applicable to Casinos only)

4.6 Gaming systems and gaming supplies shall be provided, installed, configured, maintained, repaired, and operated in a way that ensures the integrity, safety and security of the approved gaming supplies and systems, and in accordance with the Registrar’s approval.

Requirements – At a minimum:

1. Only gaming systems and gaming supplies approved by the Registrar shall be used at a gaming site.
2. The Registrar shall be immediately notified where there is any problem with the integrity or security of the gaming system or gaming supplies.
3. Monitoring shall be performed throughout the life of the gaming system and gaming supplies to ensure they are operating as approved.
4. In the event of any suspected integrity or security problem with a gaming system or gaming supply, the current state of the gaming system and gaming supply, and any supportive evidence shall be preserved until investigators (OPP or AGCO) have provided direction.
5. [Removed, September 2020.]

4.7 Production, testing and development systems shall be logically separated.

4.8 Game outcomes shall be recoverable, where technically possible, so that player bets can be settled appropriately.

4.9 Where game outcomes or sport and event betting transactions are not recoverable, the Operator shall have clearly defined policies in respect of treating the player fairly when resolving the player’s transactions. These policies and processes shall be made available to players.

4.10 Mechanisms shall be in place to allow a game to be recreated up to and including the last communicated state to the player.

Requirements – At a minimum:

1. Selected electronic game elements and game outcomes shall be logged before they are displayed to the player.
2. Information shall be captured that is needed to continue a partially complete game within a reasonable period of time.

4.10.1 Where there are suspected game or system faults that may impact game integrity or fairness including the integrity or fairness of sport and event betting (e.g., influencing a player’s chances of winning or the return to players), Operators shall make the game unavailable to players until the issue has been resolved. In the case of sport and event betting, making a game unavailable may include the suspension of betting, the withholding of funds, and the refund of any bet until a gaming system fault has been resolved. Operator decisions must be fair, reasonable, and made in good faith.

4.11 A player’s bet and the outcome of the game shall be clearly displayed and easy to understand.

3. The date and time of the bet.
4. The payout odds and total monies bet.
5. How to redeem a winning bet.

Guidance: Indicating where redemption instructions can be found satisfies the redemption portion of this requirement.

4.11.2 The results of a bet on a sport or event must be provided to players. Any change to the results of a sport or event must be made available. Sport and event bets must be settled fairly and in accordance with the terms of the bet placed by the player. Where raised, the reasons for the settlement must be clearly and promptly provided to the player.

4.11.3 If players are playing using an account, account balances will be updated as the results of bets are confirmed.

4.11.4 Sport and event betting Operators shall have controls in place to ensure the accuracy and timeliness of sport and event results data.

4.12 Patron complaints and any inquiries related to game integrity must be recorded and addressed in a timely and appropriate manner.

4.13 Games shall pay out accurately, completely and within a reasonable time of winning, subject to checks and verifications.

4.14 Operators shall have mechanisms in place to appropriately deter, prevent and detect collusion and cheating.

4.15 All relevant activities related to the detection of collusion and cheating shall be logged.

4.16 Players must be able to easily and readily report activities related to collusion and cheating.

4.20 An Operator receiving a report of suspicious activity under Standard 4.19 may suspend or cancel sport and event betting on events related to the report or withhold associated customer funds. To this end, an Operator must ensure that it has reserved itself the authority to suspend betting, void bets, and withhold associated customer funds. The Operator’s decision to suspend or cancel sport and event betting, or withhold associated customer funds, on events related to the report must be fair, reasonable, and made in good faith.

4.21 An Operator offering sport and event betting products shall ensure that all bets offered meet the following criteria:

1. The outcome of the event being bet on can be documented and verified;
2. The outcome of the event being bet on can be generated by a reliable and independent process;
3. The outcome of the event being bet on is not affected by any bet placed;
4. The majority of participants in the event or league are 18 years of age or older; event shall be broadly defined as assessing total participants in the event/league, rather than in a particular heat, game, match or final contest in the overall sporting event;
5. For sporting events being bet on, the event must be effectively supervised by a sport governing body which must, at minimum, prescribe final rules and enforces codes of conduct that include prohibitions on betting by insiders (not applicable to novelty bets);
6. There are integrity safeguards in place which are sufficient to mitigate the risk of match-fixing, cheat- at-play, and other illicit activity that might influence the outcome of bet upon events;
7. The bet is not on a past event for which the outcome is publicly known;
8. The bet is not reasonably objectionable;
9. The event being bet on does not involve animal fighting or cruelty;
10. Bets on assets and financial markets (e.g., stocks, bonds, currencies, real property) are prohibited;
11. Bets which expose players to losses greater than the amount wagered are prohibited;
12. Bets which mimic the structure of financial instruments, products, or markets are prohibited;
13. Bets on synthetic lottery products and bets on lottery outcomes are prohibited;
14. The event being bet on is conducted in conformity with all applicable laws;
15. Bets on minor league sports in Canada, including the Canadian Hockey League (CHL), are prohibited.

Guidance:

• For the purpose of Req. 8, reasonably objectional bets include bets on events which are unethical, allow entertainment to be derived from human suffering or death or involve non-consensual violence or injury.
• Req. 12 applies to contracts for difference including spread betting.

5.1 Operators shall have available for review by the AGCO accurate floor plans of the premises.

Requirements – At a minimum:

1. Floor plans shall identify the sensitivity level of each area of the premises including:
   1. Areas within the premises at which lottery schemes are offered, showing the current inventory and location of games;
   2. Financial control areas;
   3. Areas containing sensitive inventories.
2. Floor plans or other documentation shall identify areas where a dual authorization access system or two factor access system is appropriate, given the sensitivity level of the area.
3. Floor plans or other documentation shall include the maximum capacity approved for the gaming site.

5.2 Only authorized individuals shall be permitted access to sensitive areas.

Requirements – At a minimum, Operators shall:

1. Adopt a dual authorization access system or two factor access system for those sensitive areas of the premises or sensitive parts of gaming supplies identified by the Operator.
   
   Guidance: There may be various levels of sensitivity in a gaming site. Dual authorization access will be appropriate for the highest risk areas, such as playing card vaults and cash count rooms, where strict controls are necessary to secure the gaming site and/ or safeguard gaming integrity or assets. Two factor access, on the other hand, may be appropriate for other types of sensitive areas or equipment. Each gaming site is unique and should define its sensitive areas as it deems appropriate. The Registrar, however, retains the authority to direct an Operator to adopt a certain form of access authorization for a certain area or equipment, as deemed necessary.

5.3 Individuals suspected of, or engaged in, creating a disturbance that could be harmful to the individual, to the public or to gaming-related assets shall be removed from the premises, and the occurrence shall be reported in accordance with the established notification matrix.

5.4 A policy and process shall be in place to provide individuals with security escorts to and from vehicles, where it is requested.

5.5 Areas under the control of the Operator shall be monitored for the presence of unattended children. All occurrences of unattended children shall be addressed and reported in accordance with the established notification matrix.

5.6 There shall be site emergency procedures to protect the public from personal harm and limit the damage to or loss of gaming-related assets

Requirements – At a minimum:

1. Employees or persons retained by the Operator shall be competent in implementing site emergency procedures and evacuation plans.

5.7 Security and surveillance shall be in place to protect the public and gaming-related assets and to record transactions.

Requirements – At a minimum:

1. Floor plans must show surveillance equipment positioning for each area including:
   1. location(s) of the lottery schemes (including the camera coverage for each);
   2. areas containing cash or cash equivalents such as cages, count rooms, armoured car pickups and deliveries;
   3. areas containing sensitive inventories;
   4. all entrances and exits (points of egress).
      
      Guidance: The intent of Requirement 1(d) is to ensure that all points of access, which directly or indirectly lead to the gaming floor or sensitive areas at a minimum have camera coverage or an alarm, which is actively monitored for unauthorized access.
2. Surveillance plans must include activities that address the following:
   1. camera coverage and control systems for all lottery schemes;
   2. secure movement of cash, cash equivalents and sensitive inventories within the gaming site;
   3. interventions related to persons suspected of conducting illegal activities at the gaming site.
3. [Removed, September 2020.]
4. Continuous independent monitoring must be provided even if the premises is closed to the public.
5. Video/digital recordings shall be made and retained for a minimum period as specified by the Registrar.
6. The handling of sensitive inventories shall be conducted securely at all times, to prevent loss or misuse.

7. The AGCO OPP Casino Enforcement Unit, a unit of the OPP Bureau assigned to the AGCO, must be provided with independent monitoring equipment with override capability within the Casino Enforcement Unit work area (applicable to Casinos only).

5.8 There shall be timely and accurate maintenance of gaming-related financial transactions, accounting information and data.

5.9 Lottery schemes shall be played only within designated areas of the premises.

6.1 Mechanisms shall be in place to reasonably identify and prevent unlawful activities at the gaming site.

Requirements – At a minimum, the Operator shall:

1. Conduct periodic risk assessments to determine the potential for unlawful activities, including money laundering, fraud, theft and cheat at play.
2. Ensure that all relevant individuals involved in the operation, supervision or monitoring of the gaming site shall remain current in the identification of techniques or methods that may be used for the commission of crimes at the gaming site.
3. Appropriately monitor player and employee transactions and analyze suspicious transactions for possible unlawful activity.

4. Not knowingly permit the structuring of transactions designed to avoid or circumvent reporting, record-keeping and patron identification requirements contained within these Standards or other regulations.

5. Report suspicious behaviour, cheating at play and unlawful activities in accordance with the established notification matrix.

 6.2 Anti-money laundering policies and procedures to support obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act shall be implemented and enforced.

Requirements – At a minimum:

1. Copies of all reports filed with the FINTRAC and supporting records shall be made available to the Registrar in accordance with the established notification matrix.
2. Removed, July 2019.

3. Operators shall ensure their anti-money laundering internal controls align with those of the designated reporting entity under the PCMLTFA.

3. Implement risk-based policies and procedures that provide for escalating measures to deal with patrons who engage in behaviour that is consistent with money laundering indicators, including the refusal of transactions or exclusion of the patron.
4. Ensure that mechanisms are in place to share information, in a lawful manner, about high risks or suspicious activities with other Operators which may also be subject to similar activity.

*Section 6.3 does not currently apply to cGaming sites.