Section 3 - Control Activity Matrix (“CAM”) Requirements

Last Updated

3.1 CAM requirements for operators

All operators are required to design and implement control activities in order to comply with the Registrar’s Standards. Operators are expected to have those controls in place in advance of going live in Ontario's igaming market. Any exceptions should be discussed on a case-by-case basis with the AGCO Technology Regulation and iGaming Compliance Branch. These processes and controls are to be summarized in a CAM. Each operator’s CAM must be independently audited to ensure the controls have been designed to meet the Registrar's Standards, and then submitted to the AGCO for review in accordance with the timing described below.

An operator’s CAM must summarize all controls related to the gaming site, including the following:

  • Since major technology controls are contained within igaming platforms, operators are expected to work with their third-party platform providers, where applicable, to make sure their CAMs reflect the full spectrum of controls that are in place to meet the Registrar’s Standards for Internet Gaming.

  • An operator’s CAM is not required to include controls in place by third-party GRSs who run critical gaming systems or by game suppliers who develop games.  These registrants have their own CAM requirements, as described below. 

Subject to independent audit

The operator must subject the CAM to an independent audit. The independent audit should be carried out by a unit or function within the operator’s organization that was not involved in developing the CAM, like the Internal Audit function, or a designated external auditor. The independent audit results, confirming compliance, must be included with the operator’s CAM submission.

Timing for submitting the CAM

The required timing for submission of the CAM will vary depending on the level of risk assessed during the AGCO’s registration process.

  1. Operators that are assessed during the eligibility review as potentially posing elevated risk: 

    The operator may be required to submit their CAM as part of their application for registration before their registration is issued.

  • A determination of elevated risk may be based on several factors. For example, operators new to igaming with minimal to no experience, operators that hold no licences/registrations in other jurisdictions, operators that have a history of significant non-compliance, and operators whose gap analysis demonstrates a poor understanding of the Standards or significant gaps with respect to the Standards.

  1. Operators that do not pose an elevated risk:

    The operator will be required to submit the CAM within three months of their go-live date in the Ontario market. More details about the submission process for these Operators will be provided as part of future additions to this guide related to ongoing (post go-live) compliance requirements and processes.

Operators are encouraged to prioritize the development and independent audit of their CAM to prevent registration delays. Each operator will receive notification in writing of applicable CAM submission timing requirements from the AGCO.

3.2 CAM requirements for GRSs who run critical gaming systems

Before going live in the Ontario igaming market, GRSs who run critical gaming systems must confirm to the AGCO that they have a CAM in place that meets all applicable and relevant Standards.

As noted earlier, critical gaming systems are a sub-set of “gaming equipment”, which is in turn defined in the Gaming Control Act 1992. The components of these systems include certified games, random number generators, and components of igaming systems that accept, process, determine the outcome of, display, and log details about player bets and wagers.

This confirmation shall be included in the Technology Confirmation Letter discussed in Section 2.

These GRSs are not required to submit these CAMs for the AGCO’s review. However, in response to identified risks, and for compliance purposes, the AGCO may at any time request the CAM.

3.3 CAM requirements for other types of GRSs

Other types of GRSs are not required to prepare a CAM or to submit a CAM for review to the AGCO. However, these GRSs are required to have effective control activities and related documentation in place. The AGCO may request evidence of appropriate control activities from any GRS at any time.