DEPARTMENT OF TREASURY

MICHIGAN GAMING CONTROL BOARD

INTERNET GAMING RULES

Filed with the secretary of state on December 2, 2020

These rules take effect immediately upon filing with the secretary of state unless

adopted under section 33, 44, or 45a(6) of the administrative procedures act of 1969,

1969 PA 306, MCL 24.233, 24.244, or 24.245a. Rules adopted under these sections

become effective 7 days after filing with the secretary of state.

(By authority conferred on the Michigan Gaming Control Board by section 10 of the

lawful internet gaming act, 2019 PA 152, MCL 432.310)

R 432.611, R 432.612, R 432.613, R 432.613a, R 432.614, R 432.614a, R 432.614b, R

432.614c, R 432.614d, R 432.614e, R 432.615, R 432.615a, R 432.616, R 432.616a, R

432.616b, R 432.617, R 432.618, R 432.621, R 432.621a, R 432.621b, R 432.621c, R

432.621d, R 432.621e, R 432.621f, R 432.621g, R 432.621h, R 432.621i, R 432.621j, R

432.621k, R 432.622, R 432.623, R 432.624, R 432.624a, R 432.625, R 432.625a, R

432.625b, R 432.625c, R 432.626, R 432.627, R 432.628, R 432.628a, R 432.628b, R

432.628c, R 432.629, R 432.631, R 432.632, R 432.632a, R 432.632b, R 432.633, R

432.633a, R 432.633b, R 432.634, R 432.635, R 432.636, R 432.637, R 432.637a, R

432.638, R 432.639, R 432.639a, R 432.639b, R 432.639c, R 432.639d, R 432.641, R

432.642, R 432.643, R 432.644, R 432.645, R 432.647, R 432.648, R 432.649, R 432.651,

R 432.651a, R 432.651b, R 432.651c, R 432.652, R 432.653, R 432.654, R 432.655, R

432.655a, R 432.655b, R 432.655c, R 432.655d, R 432.655e, R 432.656, R 432.657, R

432.658, R 432.659, R 432.661, R 432.662, R 432.663, R 432.663a, R 432.663b, R

432.663c, R 432.664, R 432.665, R 432.665a, R 432.665b, R 432.666, R 432.667, R

432.668, R 432.671, R 432.672, R 432.673, R 432.674, R 432.675, and R 432.676 are

added to the Michigan Administrative Code, as follows:

PART 1. GENERAL PROVISIONS

R 432.611 Definitions.

Rule 611. As used in these rules:

(a) “Act” means the lawful internet gaming act, 2019 PA 152, MCL 432.301 to MCL

432.322.

(b) “Affiliate” means a person that, directly or indirectly, through 1 or more

intermediaries, controls or is controlled by an internet gaming operator.

(c) “Affiliate marketer” means a person involved in promoting, marketing, and directing

business to online gaming sites who is compensated based on the volume of customer

referrals to an online gaming site or customer activity, including but not limited to,

October 8, 2020

2

number of registrations, number of depositing registrations, or wagering activity, or

both.

(d) “Agent” means any individual who is employed by any agency of this state, other

than the board, the state police, or attorney general, and who is assigned to perform

full-time services on behalf of or for the benefit of the board regardless of the title or

position held by that individual.

(e) “Authorized game” means any internet game that the board determines to be suitable

for use for wagering through the internet, which must include, but need not be limited

to, poker, blackjack, cards, slots, games played with dice or tiles, or both, such as

roulette, craps, pai gow, and other games typically offered at a casino. An authorized

game does not include any of the following: pick numbers or other lottery games

typically offered by the bureau of lottery under the McCauley-Traxler-Law-Bowman-

McNeely lottery act, 1972 PA 239, MCL 432.1 to 432.47; a lawful fantasy contest; or

any lawful internet sports betting.

(f) “Authorized participant session” means the period of time that an authorized

participant is logged on to an internet gaming platform.

(g) “Conflict of interest” means a situation, relationship, or association in which the

private interest of employees, agents, and contractors of the board may influence the

judgment of the employee, agent, or contractor in the performance of his or her public

duty under the act.

(h) “Contractor” means any individual not employed by this state who performs services

on behalf of or for the benefit of the board and requires unescorted access to board

facilities.

(i) "Excluded person" means any individual who has been involuntarily placed in the

responsible gaming database by the executive director and who is prohibited from

establishing an internet wagering account or participating in internet wagering, or

both, offered under the act or these rules.

(j) “Executive Director” means the executive director of the Michigan gaming control

board, appointed under section 4 of the Michigan Gaming Control and Revenue Act,

1996 IL 1, MCL 432.204.

(k) “Game server” means a server that contains game software and control programs.

(l) “Internet gaming network” means the linking of authorized participants of 1 or more

Internet gaming operators to participate in peer-to-peer gaming in this state. An

internet gaming network does not include linking of authorized participants pursuant

to a multijurisdictional internet gaming agreement entered into in accordance with the

act.

(m)“Interactive gaming system” means the hardware, software, firmware,

communications technology and other equipment that allows an authorized

participant to remotely bet or wager through the internet or a similarly distributed

networking environment, and the corresponding equipment related to game outcome

determination, the display of the game and game outcomes, and other similar

information necessary to facilitate play of the game. The internet gaming platform

provides the authorized participant with the means to play authorized games. The

internet gaming platform provides the internet gaming operator with the means to

review internet wagering accounts, disable games, generate various gaming/financial

transaction and account reports, input outcomes for live internet games, and set any

3

configurable parameters. The term does not include computer equipment or

communications technology used by an authorized participant to access the

interactive gaming system. Unless otherwise specified in these rules, the term

internet gaming platform includes the entire interactive gaming system inclusive of

remote gaming systems.

(n) “Key person” means any of the following except as otherwise provided in paragraph

(vii):

(i) A director of the applicant.

(ii) A managerial employee of the applicant that performs the function of principal

executive officer, principal operations officer, or principal accounting officer.

(iii) A person who holds more than 5% ownership interest in the applicant.

(iv) An affiliate of the applicant.

(v) A director of an affiliate of the applicant.

(vi) A managerial employee of an affiliate of an applicant that performs the function

of principal executive officer, principal operations officer, or principal

accounting officer.

(vii) “Key person” does not include an elected or appointed representative of any

applicant or licensee that is a federally recognized Indian tribe located in this state

unless the representative is also a full-time employee of the applicant’s or licensee’s

internet gaming operations. A key person for an Indian tribe includes a primary

management official of the applicant who has management responsibilities for the

applicant’s internet gaming operations.

(o) “Licensee” means a person who holds a license under the act.

(p) “Live game” means a game conducted by a gaming attendant (e.g., dealer, croupier,

etc.) or other gaming equipment (e.g., an automated roulette wheel, ball blower, or

gaming device), or both, in a live game environment in which authorized participants

have the ability to review game play and communicate game decisions through the

internet gaming platform. Live games include, but are not limited to, live card games,

live table games, and live play of gaming devices, and other live authorized games.

(q) “Live game environment” means a physical location that utilizes live video streaming

technology to provide live games to a remote player device that permits the

authorized participant to participate in live streamed games, interact with game

attendants, and interact with fellow authorized participants.

(r) “Peer-to-peer gaming” means all gaming activity, such as poker, where authorized

participants are directly competing against each other but not the licensee.

(s) "Prohibited person" means any excluded person, any voluntarily-excluded person,

and all of the following:

(i) An individual who is under the age of 21.

(ii) Any employee of, or appointee to, the Michigan gaming control board.

(iii) Employees of an internet gaming operator. An employee of an internet gaming

operator shall not create an internet wagering account or place an internet wager

with the internet gaming operator for which he or she is employed unless using a

test account under R 432.639a.

(iv) Employees of an internet gaming platform provider. An employee of an internet

gaming platform provider shall not create an internet wagering account or place

an internet wager with the internet gaming operator for which the internet

4

gaming platform provider supplies the internet gaming platform unless using a

test account under R 432.639a.

(v) Employees or appointees of a tribal gaming regulatory agency with jurisdiction

over internet gaming being operated under the tribe’s gaming ordinance and the

Indian gaming regulatory act, 18 USC 1166 to 1168 and 25 USC 2701 to 2721.

(vi) Occupational licensees and applicants. Occupational licensees and applicants

shall not place wagers with the internet gaming operator or internet gaming

platform provider for which they are employed or for which they had to qualify.

(vii) An individual not in an authorized location to make a wager.

(viii)

An individual placing an internet wager on behalf of another

(ix) An individual wagering in violation of state, tribal, or federal law.

(x) Other prohibited persons as determined by the board.

(t) “Publicly traded corporation” means any corporation or other legal entity regulated

by the U.S. Securities and Exchange Commission under the securities exchange act of

1934, 15 USC 78a to 78qq, or securities act of 1933, 15 USC 77a to 77aa.

(u) “Random number generator” or “RNG” means a computational or physical device,

algorithm, or system designed to produce numbers in a manner indistinguishable from

random selection. .

(v) “Remote gaming system” means hardware and software used to provide authorized

internet games to an authorized participant on an internet gaming platform. The

remote gaming system may contain features common to game offerings, game

configurations, the random number generator, and reporting. The remote gaming

system may be a standalone system or integrated within another part of the internet

gaming platform.

(w)“Remote player device” means an authorized participant-owned device that at a

minimum will be used for the execution of game play. Examples of a remote player

device include a personal computer, mobile phone, tablet, etc.

(x) “Secure transaction file” means a file that contains data that cannot be modified

without detection.

(y) “Self-authentication process” means a method used by a system to verify the validity

of software and includes the following:

(i) The method requires the calculation of an output digest that is compared to a

secure embedded value.

(ii) The output digest must be of 128-bit complexity, at a minimum.

(iii) Software is authenticated if the calculated digest equals the secure embedded

value.

(z) "Self-exclusion list" means a list of individuals who voluntarily excluded themselves

from establishing or maintaining an internet wagering account with an internet

gaming operator or internet gaming platform provider.

(aa) “Strong authentication” means a method that has been demonstrated to the

satisfaction of the board to effectively provide higher security than a username and

password alone.

(bb) "Suspended account" means an internet wagering account that has been

temporarily disabled from engaging in wagering activity.

5

(cc) "Targeted mailing" means an advertisement or promotional offer from an internet

gaming operator or an internet gaming supplier directed to an individual on the basis

of specific criteria, such as being a member or former member of a rewards club or a

participant in social games. "Targeted mailing" does not include mass

communication, including mailings or e-mailings, made to an entire area or zip code

or targeted list, nor does it include an advertisement that arrives in a packet of 5 or

more non-gaming advertisements, if the packet of advertisements is addressed to

"resident," "occupant," or some similar wording and not to a specific individual.

"Targeted mailing" further does not include any "pop-up" advertisement that appears

on an individual’s computer or mobile device on the basis of his or her IP Address.

(dd) “Theoretical return to player” or “RTP” means the expected percentage of bets or

wagers that a specific game will return to the player in the long run. The RTP can be

calculated via either a theoretical or simulated approach. The method used for

calculation depends on the game type.

(ee) "Things of value" means anything of value that may be used to place an internet

wager.

(ff) “Voluntarily-excluded person” means any individual whose name is included, at his

or her own request, in the responsible gaming database or on a self-exclusion list, or

both.

R 432.612 Terms defined in act.

Rule 612. Terms defined in the act have the same meaning when used in these rules.

R 432.613 Board duties, jurisdiction, and authority.

Rule 613. (1) To execute and administer the act for the purpose of licensing,

regulating, and enforcing lawful internet gaming, the board may do all of the following:

(a) Determine its practices and internal policies or procedures.

(b) Delegate to the executive director all powers and authority to act in the name of

the board with respect to all reasonable, necessary, and appropriate actions to

administer and carry out the administrative and executive functions of the board

including, but not limited to, the power to do any of the following:

(i) Execute and enter into contracts on behalf of the board.

(ii) Hire and fire employees of the board and administer oaths.

(iii) Issue subpoenas for the attendance of witnesses and the production of

documents.

(iv) Issue and renew licenses.

(v) Register vendors.

(vi) Conduct investigations, inspections, and audits, share information with law

enforcement agencies, conduct hearings, and settle alleged violations of the act and

these rules.

(vii) Engage in other functions necessary to the proper administration and

enforcement of the act and these rules.

(viii) Grant requests and waivers, answer inquiries, issue interpretations, and

otherwise take any action that is reasonably requested by applicants, licensees, and

vendors in furtherance of, and consistent with, the efficient administration and

6

enforcement of the act and these rules, as determined to be necessary or

appropriate by the executive director.

(2) The board may set hiring standards for employees.

(3) The board has general responsibility for the implementation of the act. The board’s

duties include, but are not limited to, all of the following:

(a) Deciding in a reasonable period of time all license applications.

(b) Investigating applicants for licenses or registration. The board may grant licenses

or register persons in accordance with the act and these rules.

(c) Supervising internet wagering authorized by the act.

(d) Investigating alleged violations of the act or these rules and taking appropriate

disciplinary action against a licensee or any other person, or instituting appropriate

legal action for enforcement, or both.

(e) Conducting investigative and contested case hearings, issuing subpoenas, and

administering oaths and affirmations to the witnesses to exercise and discharge the

powers and duties of the board under the act.

(f) Revoking or suspending licenses and registrations, and imposing fines as the board

considers necessary and in compliance with applicable laws of this state.

(g) Imposing fines against individuals, internet gaming operators and internet gaming

suppliers for engaging in a fraudulent practice, for each violation of the act, these

rules, or any resolution or order of the board, or for any other action that the board

determines is a detriment or impediment to internet gaming.

(h) Taking any other action as may be reasonable or appropriate to enforce the act and

these rules.

(4) The board may seek and shall receive the cooperation and assistance of other

departments and agencies in conducting background investigations and in fulfilling its

responsibilities under the act.

R 432.613a Member, employee, or agent of board; conduct generally.

Rule 613a. (1) By January 31 of each year, each member, the executive director, and all

employees of the board shall file 1 or more board disclosure forms. The board shall

determine the contents of the form, but it must include such information as necessary to

ensure the integrity of internet gaming and disclosure of all relevant financial

information. The form may be combined with similar forms required by other acts or

rules.

(2) If a member, the executive director, an employee, or an agent of the board negotiates

for, or acquires by any means, any interest in a licensee, applicant, or person affiliated

with a licensee or applicant, he or she must immediately provide written notice of the

details of the interest to the chairperson. The member, executive director, employee, or

agent of the board must not act on behalf of the board with respect to that licensee,

applicant or person affiliated with the licensee or applicant.

(3) A member, the executive director, an employee, or an agent of the board may enter

into any negotiations for employment with a licensee, applicant or affiliate of a licensee

or applicant. The member, executive director, employee, agent, licensee, applicant, or

affiliate must immediately notify the chairman and the executive director once the

invitation to negotiate has been extended. A potential employer asking if an individual

would be interested in a position or explaining the nature of a position does not constitute

7

negotiations for employment. Further, an individual completing an employment

application does not constitute negotiations for employment. The member, executive

director, employee, or agent of the board must not take any action on behalf of the board

with respect to that licensee, applicant, or person affiliated with a licensee or applicant

while the negotiations are ongoing. All members, the executive director, board

employees, agents, and contractors must, to the maximum extent possible, avoid

situations, relationships, or associations that may represent or lead to an actual or

perceived conflict of interest.

(4) A member, the executive director, an employee, or an agent, or their spouse, may not

accept any gift, gratuity, compensation, travel, lodging, or anything of value, directly or

indirectly, from any licensee, applicant, or an affiliate or representative of an applicant or

licensee, unless the acceptance conforms to a written policy issued by the chairperson.

The chairman may exempt attendance at a reception, and food and drink for immediate

consumption, from this policy. The policy must be publicly available and shared with all

licensees.

(5) A licensee, applicant, or an affiliate or representative of an applicant or licensee, shall

not, directly or indirectly, give or offer to give any gift, gratuity, compensation, travel,

lodging, or things of value to any member, the executive director, an employee, or an

agent of the board that the member, employee, or agent of the board is prohibited from

accepting under subrule (4) of this rule.

(6) A licensee, applicant, or an affiliate or representative of an applicant or licensee must

not engage in ex parte communications with a member of the board. A member of the

board must not engage in any ex parte communications with a licensee, applicant, or

affiliate or representative of an applicant or licensee.

(7) Any member, licensee, applicant, or affiliate or representative of a board member,

licensee, or applicant who receives any ex parte communication in violation of subrule

(6) of this rule, or who is aware of an attempted communication in violation of subrule

(6) of this rule, must immediately report details of the communication or attempted

communication in writing to the chairperson.

(8) A member, the executive director, an employee, or an agent of the board must not

have an internet wagering account or participate in or wager on any internet gaming

conducted in this state except as part of the individual’s surveillance, security, or other

official duty authorized by the board.

(9) Violation of this rule by a licensee, applicant, or affiliate or a representative of a

licensee, applicant, or affiliate, may result in denial of an application for licensure,

revocation or suspension of a license, or other action by the board.

(10) Violation of this rule does not create a civil cause of action.

R 432.614 Denial or non-renewal hearings.

Rule 614. (1) A person whose application for a license or a transfer of ownership has

been denied, whose license has not been renewed, or who has been denied an approval

from the board required in these rules may request a hearing. The hearing must be de

novo.

(2) The person must submit an original hearing request, pleading, or other written

document to the board, serve each party or attorney of record, and provide a proof of

service on each party or attorney of record.

8

R 432.614a Request for hearing.

Rule 614a. (1) A request for hearing must meet all of the following requirements:

(a) Be in writing.

(b) State the name, current address, and current telephone number of the petitioner.

(c) State in detail the reasons why, and the facts upon which the petitioner will rely to

show that, the petitioner's application for a license should not have been denied, the

license should have been renewed, the transfer of ownership should have been

approved, or approval should have been granted.

(d) Be signed, verified, and dated. A petitioner must have the verification notarized

and include a certification stating, "Under the penalty of perjury, the undersigned has

examined this request for hearing and to the best of my knowledge and belief it is

true, complete, and correct."

(2) A request for hearing must be submitted within 21 days after service of the notice of

denial, notice of nonrenewal, or disapproval. A request for a hearing submitted by

certified mail or overnight express mail is considered submitted in a timely manner if it is

postmarked no later than 21 days after service of a notice of denial, notice of nonrenewal,

or disapproval.

(3) A request for a hearing is considered granted unless denied.

(4) A request for a hearing may be withdrawn by the petitioner. If the request for hearing

is withdrawn, then the initial denial, nonrenewal, or disapproval becomes a final board

order.

(5) Unless the board denies a request for hearing, the board shall submit the request for

hearing to the appropriate state agency.

(6) Default judgment or dismissal may result at any stage of the proceeding.

R 432.614b Proceedings.

Rule 614b. (1) The burden of proof is at all times on the petitioner. The petitioner has

the affirmative responsibility of establishing, by clear and convincing evidence, any of

the following:

(a) The petitioner should have been awarded a license.

(b) The license should have been renewed.

(c) The transfer of ownership should have been approved.

(d) Approval should have been granted.

(2) The hearing must be conducted in accordance with the administrative procedures act

of 1969, 1969 PA 306, MCL 24.201 to 24.328, except as otherwise provided in these

rules or the act.

R 432.614c Prohibition on ex parte communication.

Rule 614c. A party or its attorney must not communicate directly or indirectly with the

hearing officer regarding any pending matter, except upon notice and opportunity for all

parties to participate. A party that engages in ex parte communication with the hearing

officer may be subject to sanctions and penalties.

R 432.614d Sanctions and penalties.

9

Rule 614d. (1) The hearing officer may recommend sanctions and penalties if the

hearing officer finds that a party has failed to appear at a scheduled hearing, has acted in

bad faith for the purpose of delay, or has otherwise abused the hearing process.

Sanctions and penalties include, but are not limited to, a fine or default judgment or a

directed finding on 1 or more issues.

(2) If a petitioner refuses to testify on his or her own behalf with respect to any question

propounded to him or her, then the hearing officer may infer that the testimony or answer

would have been adverse to the case of the petitioner.

(3) If the petitioner or attorney of record fails to answer a subpoena or refuses to testify

fully at the request of the board, then the failure may be considered independent grounds

for a finding that the petitioner should have been denied a license or the transfer of

ownership. The hearing officer may also infer from the failure to answer a subpoena or

refusal to testify fully that the testimony would have been adverse to the petitioner.

R 432.614e Recording proceedings; transmittal of record and board action.

Rule 614e. (1) Oral proceedings involving contested issues must be recorded to ensure

the preservation of the testimony. A party may request a transcript of the proceedings.

The requesting party must pay for the transcript.

(2) Unless otherwise specified by the board, the hearing officer, within 60 days after the

conclusion of the hearing, or the submission of post-hearing briefs or proposed findings

of fact, shall issue, to the board and to the parties, written findings of fact,

conclusions of law, and recommendations. Findings of fact must be based exclusively on

testimony, evidence, and matters within the record. The findings of fact must be stated

separately.

(3) Unless otherwise agreed to by the parties or as set by the hearing officer, the

parties have 21 days after the service of the findings of fact, conclusions of law, and

recommendations of the hearing officer to file objections.

(4) Unless otherwise agreed to by the parties or as set by the hearing officer, the parties

may file a response to the objections within 21 days after service of the objections.

(5) After the time period for the parties to file objections and responses to those

objections, the hearing officer must transmit the entire record to the board.

(6) Before issuing a final order, the board must consider the record as a whole.

(7) After considering the record, the board may take any of the following actions:

(a) Affirm the written recommendations, findings of fact, and conclusions of law

submitted by the hearing officer as its final board order.

(b) Issue a final order modifying the written recommendations, findings of fact, and

conclusions of law submitted by the hearing officer.

(c) Issue a final order rejecting the written recommendations, findings of fact, and

conclusions of law submitted by the hearing officer.

(d) Issue an order remanding the matter, with instructions, to the hearing officer for

further proceedings.

(8) The board must serve copies of its orders on the parties.

(9) A board order becomes effective upon service.

R 432.615 Request for declaratory ruling; form; contents.

10

Rule 615. (1) An individual who requests a declaratory ruling from the board as to the

applicability to an actual state of facts of a statute, rule, resolution, or order administered,

promulgated, or issued by the board must do so in writing.

(2) The written request must contain the relevant and material facts along with a

reference to the statute, rule, resolution, or order applicable.

R 432.615a Declaratory ruling; notice of issuance; request for information or arguments;

hearing.

Rule 615a. (1) Within 90 days after the receipt of a request for a declaratory ruling, the

board shall issue a written notification by regular first-class mail to the petitioner and the

petitioner’s legal counsel, if any, stating whether or not a declaratory ruling will be

issued.

(2) If the board decides to issue a declaratory ruling, the board may do any of the

following:

(a) Request more information from the individual.

(b) Request information from other interested parties.

(c) Request information from experts outside the board.

(d) Request oral or written arguments from interested parties.

(e) Hold a hearing upon proper notice to all interested parties.

(f) Decline to issue a declaratory ruling.

R 432.616 Reasons for investigation of, or disciplinary action against, licensee; hearing

procedure.

Rule 616. (1) The board may initiate an investigation or a disciplinary action, or both,

against a licensee if the board has reason to believe that at least 1 of the following

applies:

(a) The licensee is not maintaining suitability for licensure as provided by the act.

(b) The licensee is not complying with licensure conditions.

(c) The licensee is not complying with all laws, rules, orders, and resolutions.

(2) Before initiating disciplinary proceedings, the board must give notice and an

opportunity to show compliance under section 92 of the administrative procedures act of

1969, 1969 PA 306, MCL 24.292.

(3) An internet gaming operator is responsible for the conduct of any licensee it uses to

conduct internet wagering under the act. An internet gaming supplier is also responsible

for its conduct of internet gaming under the act and these rules. Any violation of the act

or the rules by the internet gaming operator in which the internet gaming supplier

participated in the action is also considered a violation by the internet gaming supplier,

and the board may hold both, or either, accountable for the violation.

(4) The board may initiate a disciplinary proceeding by designating a member or the

executive director to conduct a hearing or by initiating proceedings with the appropriate

state agency under the contested case provisions of chapter 4 of the administrative

procedures act of 1969, 1969 PA 306, MCL 24.271 to 24.288, and the rules promulgated

under that chapter.

R 432.616a Actions available to hearing officer.

11

Rule 616a. (1) A hearing officer may recommend sanctions and penalties if the hearing

officer finds that a party has failed to appear for a scheduled hearing, acted in bad faith

for the purpose of delay, or has otherwise abused the hearing process.

(2) If a respondent fails to testify on the respondent's own behalf with respect to any

question propounded to the respondent, the hearing officer may infer that the testimony

or answer would have been adverse to the case of the respondent.

(3) If the respondent or attorney of record fails to answer a subpoena or refuses to testify

fully at the request of the board, the failure may be considered independent grounds for a

finding that the respondent should be disciplined. The hearing officer may also infer that

the testimony would have been adverse to the respondent.

R 432.616b Actions available to the board.

Rule 616b. The board may take any of the following disciplinary actions against a

licensee:

(a) Suspend, revoke, restrict, or place conditions on the license of a licensee.

(b) Require the removal of a licensee or the removal of an employee of a licensee.

(c) Impose a civil penalty for each violation of the act, rules, orders, or resolutions.

(d) Impose against an occupational licensee, for each violation of the act or these rules, a

civil penalty of not more than $10,000.00 as a result of the violation or attempted

violation of the act or these rules.

(e) Any other action considered necessary by the board to ensure compliance with the act

or these rules.

R 432.617 Special proceedings.

Rule 617. (1) The board may suspend a license without notice or hearing if the board

determines that the safety or health of persons or employees or the integrity of internet

gaming is jeopardized by continuing an operation or that the action is necessary for the

immediate preservation of the integrity of internet gaming, public peace, health, safety,

morals, good order, or general welfare.

(2) The suspension may remain in effect until the board determines that the cause for

suspension has been abated.

(3) Following a hearing, the board may revoke the license upon a determination that

satisfactory progress toward abating the hazard has not been made.

R 432.618 Waiver of requirements.

Rule 618. The board may, in writing, waive, restrict, or alter any requirement or

procedure set forth in these rules, if the board determines any of the following:

(a) That the requirement or procedure is impractical or burdensome.

(b) That the waiver, restriction, or alteration is in the best interest of the public and

the internet gaming.

(c) That the waiver, restriction, or alteration is not outside the technical requirements

necessary to serve the purpose of the requirement or procedure.

PART 2. LICENSING: OPERATOR, SUPPLIER, OCCUPATIONAL; VENDOR

REGISTRATION

12

R 432.621 Required notification of anticipated or actual changes in key person of

internet gaming operator and internet gaming supplier.

Rule 621. An internet gaming operator applicant or licensee must notify the board

before any anticipated or actual change in key person. An internet gaming supplier

applicant or licensee must notify the board of any change in key person within 30 days

after appointment.

R 432.621a Notification of new financial sources of internet gaming platform providers.

Rule 621a. An internet gaming platform provider applicant or licensee must notify the

board, in writing, as soon as practicable, after it becomes aware that it intends to enter

into a transaction related in any way to its development and operations that may result in

any new financial backers, investors, mortgagees, bondholders, or holders of indentures,

notes, or other evidences of indebtedness of the applicant or licensee. A publicly traded

corporation is considered to have complied with this rule if it has complied with the

reporting requirements in R 432.621d.

R 432.621b Notification by applicants or licensees required.

Rule 621b. (1) An internet gaming operator or internet gaming supplier applicant or

licensee, affiliate that has control of an internet gaming operator applicant or licensee, or

other person that has control of an internet gaming operator or internet gaming supplier

applicant or licensee must notify the board, as soon as practicable after it becomes aware

that, with regard to any such company, any person or individual has:

(a) Beneficially acquired more than 5% of any class of the company's equity securities.

(b) The ability to control the company.

(c) The ability to elect 1 or more directors of the company.

(2) To the extent known by the internet gaming operator license or internet gaming

supplier license applicant or licensee, the required notification must include the name,

business address, phone number, and other personal identification information for each

person.

(3) A person applying for or holding an internet gaming operator license or internet

gaming supplier license must report to the board the election or appointment of a director

or officer of that applicant or licensee or a holding company of that applicant or licensee

who is actively and directly engaged in the administration or supervision of that

applicant’s or licensee’s internet gaming operation.

(4) A person who applies for or holds an internet gaming operator license and all other

persons covered by this part must file any other document requested by the board to

ensure compliance with the act or this part within 30 days after the board request or at

another time established by the board.

(5) A publicly traded corporation is considered to have complied with this rule if it has

complied with the reporting requirements in R 432.621d.

R 432.621c Required notification of formation, dissolution, or transfer of subsidiaries.

Rule 621c. (1) An internet gaming operator or internet gaming supplier applicant or

licensee, affiliate that has control of an internet gaming operator applicant or licensee, or

13

other person that has control of an internet gaming operator or internet gaming supplier

applicant or licensee, must report, in writing, to the board, as soon as practicable, the

formation or dissolution of, or any transfer of, a nonpublicly traded or publicly traded

interest in an internet gaming operator or internet gaming supplier applicant or licensee,

affiliate that has control of an internet gaming operator applicant or licensee, or other

person that has control of an internet gaming operator or internet gaming supplier

applicant or licensee.

(2) A publicly traded corporation is considered to have complied with this rule if it has

complied with the reporting requirements in R 432.621d.

R 432.621d Publicly traded corporation reporting requirements.

Rule 621d. (1) A publicly traded corporation or other person that applies for or holds an

internet gaming operator license or internet gaming supplier license who is a public

reporting company under the securities exchange act of 1934, 15 USC 78a to 78qq, or

the securities act of 1933, 15 USC 77a to 77aa, must submit a copy of all submissions

required by the U.S. Securities and Exchange Commission to the board in a format

prescribed by the board. The submissions are due within 14 days of the filing dates

required by the U.S. Securities and Exchange Commission.

(2) If a publicly traded corporation or other person that applies for or holds an internet

gaming operator license or internet gaming supplier license receives any material

document filed with the U.S. Securities and Exchange Commission by any other person

relating to the publicly traded corporation, the person must file 1 copy of the document

with the board within 14 days after receipt of the material.

(3) A publicly traded corporation or other person that applies for or holds an internet

gaming operator license or internet gaming supplier license must file a list of record

holders of its voting securities with the board annually.

R 432.621e Exemption for institutional investors.

Rule 621e. (1) An institutional investor who acquires beneficial ownership of a person

that has applied for or holds an internet gaming operator license or internet gaming

supplier license must notify the board within 14 days after the institutional investor

acquires the interest or files form 13-D or 13-G with the U.S. Securities and Exchange

Commission, or both, and must provide additional information, and may be subject to a

finding of suitability, as required by the board.

(2) An institutional investor who acquires and holds a less than 25% interest for

investment purposes only in a person that has applied for or holds an internet gaming

operator license or internet gaming supplier license in this state may, in a manner and

form prescribed by the board, file an exemption form to establish exemption from the

eligibility and suitability requirements of the act.

(3) The licensee in whom the institutional investor acquires the interest must file an

application for approval of the transfer within 30 days after the transfer. Within the same

time period, the institutional investor must file either an exemption form if the

institutional investor holds the interest for investment purposes only or an application and

disclosure forms as part of the licensee’s application if the institutional investor does not

hold the interest for investment purposes only.

14

(4) The board may require that any person, including an institutional investor, seeking

approval to hold ownership interests subject to this part apply for a finding of suitability

in accordance with this rule if the board considers the finding of suitability necessary to

ensure compliance with the act and these rules. If the board denies a request for an

institutional investor exemption, the institutional investor must, within 30 days, either

divest itself of the interest or file application and disclosure forms as part of the relevant

licensee’s license.

(5) The following activities are considered to be consistent with holding equity securities

for investment purposes only under this rule:

(a) Voting, directly or indirectly, through the delivery of a proxy furnished by the

board of directors, on all matters voted on by the holders of the voting securities.

(b) Serving as a member of a committee of creditors or security holders formed in

connection with a debt restructuring.

(c) Nominating a candidate for election or appointment to the board of directors in

connection with a debt restructuring.

(d) Accepting appointment or election as a member of the board of directors in

connection with a debt restructuring and serving in that capacity until the conclusion

of the member's term.

(e) Making financial and other inquiries of management of the type normally made by

securities analysts for information purposes and not to cause a change in its

management, policies, or operations.

(f) Other activities that the board determines to be consistent with the investment

intent.

(6) If an institutional investor acquires 25% or more ownership interest of a licensee, the

institutional investor must notify the board within 14 days of acquiring the ownership

interest.

R 432.621f Applicability of part; transfer of ownership interest; limitation.

Rule 621f. (1) An interest in a person applying for or holding an internet gaming

operator license or internet gaming supplier license may only be transferred in

accordance with this part.

(2) The following persons must provide notice to the board no later than 30 days after

execution of the transfer:

(a) Except for an internet gaming platform provider, a person that transfers or acquires

greater than a 5% interest in a person that has applied for or holds an internet

gaming operator license or an internet gaming supplier license in this state.

(b) Except for an internet gaming platform provider, a person who, as a result of an

acquisition, has acquired an interest totaling greater than 5% in a person that has

applied for or holds an internet gaming operator license or an internet gaming

supplier license in this state.

(3) Except as stated in subrules (5) and (6) of this rule, the following persons must

provide notice to the board 30-days before execution of a transfer:

(a) A person that intends to transfer or acquire greater than a 5% interest in a person

that has applied for or holds an internet gaming operator license or internet gaming

platform provider in this state.

15

(b) A person who, as a result of an acquisition, will acquire an interest totaling greater

than 5% in a person that has applied for or holds an internet gaming operator

license or is an internet gaming platform provider in this state.

(4) The board must determine whether the person acquiring the interest is eligible and

suitable under the standards set forth in the act and these rules, unless the board grants the

person an institutional-investor exemption under these rules or under section 6(11) or

8(10) of the act, MCL 432.306 and 432.308. Once the board determines that the person

acquiring the interest is eligible and suitable under the standards set in the act and these

rules, the executive director may approve the transfer.

(5) A transfer of interest to an institutional investor that acquires or will have acquired,

upon completion of the transfer, less than 25% of the equity securities of a person that

applies for or holds an internet gaming operator license or internet gaming supplier

license may occur without first receiving executive director approval if the equity

securities are held for investment purposes only but is subject to other requirements of

this part.

(6) A transfer of interest in an internet gaming operator or internet gaming supplier

licensee may occur if the transfer is between persons the board has found eligible and

suitable for licensure during the licensing period in which the transfer occurs. In those

cases, approval of the transfer must be requested no later than 30 days after the transfer,

and the executive director may decide the application.

(7) If approval of the transfer of interest is denied by the executive director or the person

acquiring the interest is found unsuitable by the board, the transferee must divest itself of

the interest within 30 days after the date of the order denying approval.

R 432.621g Application for transfer of ownership.

Rule 621g. (1) A person desiring to acquire an ownership interest in a person applying

for or holding an internet gaming operator license or internet gaming supplier license

must complete and submit application and disclosure forms, in the manner and form

prescribed by the board.

(2) A person desiring to acquire an interest in a person applying for or holding an internet

gaming operator license or internet gaming supplier license must present evidence that

the person desiring to acquire the interest is eligible and suitable under the standards and

criteria for licensure set forth in the act and these rules.

(3) A person applying for or holding an internet gaming operator license or internet

gaming supplier license that is attempting to transfer an ownership interest must submit

any information or documentation considered necessary by the board to ensure

compliance with the act and these rules.

R 432.621h Transfer investigative costs and fees.

Rule 621h. An investigation fee may be assessed to the extent that there are costs

directly associated with the background investigation relating to the person desiring to

acquire an interest in an internet gaming operator or internet gaming supplier. Unless

otherwise determined by the board, approval may be withheld until full payment of the

background investigation fees.

R 432.621i Denials.

16

Rule 621i. If an application for a transfer of interest is denied, a notice of denial must

be issued.

R 432.621j Review of information at licensee’s or applicant’s premises; costs to internet

gaming operator and internet gaming supplier.

Rule 621j. (1) The board may review, at the premises of the custodian of the

information, any information that the act or these rules provide for from any of the

following entities:

(a) A license applicant.

(b) A licensee.

(c) A key person.

(2) If information is reviewed at the premises of the custodian of the information, the

license applicant or licensee must, as soon as practicable, reimburse the board for all

licensure investigation expenses incurred in performing the review at the premises of

the custodian of the information, including travel, food, and lodging that exceed the

amount of the application fee.

R 432.621k Applicant/licensee disclosure of representatives to act on their behalf before

the board.

Rule 621k. (1) An applicant or licensee must file, with the board, a list of persons

authorized to act on the applicant's or licensee's behalf as to any matter before the board.

An attorney appearing on behalf of an applicant or licensee in a matter before the board

must promptly file an appearance identifying his or her client and the matter in which the

attorney will appear.

(2) A person holding or applying for a license must establish and identify a representative

for the purpose of accepting service of process, notices, and other forms of

communication from the board for the person holding or applying for a license.

R 432.622 License classifications.

Rule 622. (1) The following licenses may be issued under the act and these rules:

(a) Internet gaming operator license.

(b) Internet gaming supplier license.

(2) The following persons are eligible to hold an internet gaming operator license:

(a) A person that holds a casino license under the Michigan Gaming Control and

Revenue Act, 1996 IL 1, MCL 432.201 to 432.226.

(b) An Indian tribe that lawfully conducts class III gaming in a casino located in this

state under a facility license issued in accordance with a tribal gaming ordinance

approved by the chair of the National Indian Gaming Commission.

(3) A person that provides goods or services that directly affect wagering, play, and

results of internet games to internet gaming operators is required to hold an internet

gaming supplier license. As used in this subrule, "internet gaming supplier" includes, but

is not limited to, the following:

(a) Internet gaming platform providers.

(b) Geofence providers.

(c) Providers of software that directly affect wagering, play, the results of an internet

game, or the integrity of internet gaming.

17

(d) Providers hosting live internet gaming data.

(e) Affiliate marketers that have an agreement based on the sharing of customer

revenue.

(f) Unless otherwise determined by the board, any other person that meets 1 or more

of the following criteria:

(i) The person manufactures, supplies, or distributes devices, machines,

equipment, items, or articles that meet any of the following provisions:

(A)Are specifically designed for use in the conduct of internet gaming.

(B) Have the capacity to affect the outcome of an internet wager.

(C) Have the capacity to affect the calculation, storage, collection, or control

of gross receipts.

(ii) The person services or repairs internet gaming wagering devices, machines,

equipment, items, or articles impacting the integrity of internet gaming.

(iii) The person provides services directly related to the operation, security,

surveillance, or management of internet gaming.

(iv) The person provides other goods or services determined by the board to be so

utilized in, or incidental to, the operation of an internet gaming operator that

the person must be licensed as an internet gaming supplier to protect the

public and enhance the credibility and integrity of internet gaming in this

state.

(4) A person must be licensed as an internet gaming supplier before providing goods,

software, or services as an internet gaming supplier to an internet gaming operator.

R 432.623 Occupational licensing.

Rule 623. (1) An individual must have an occupational license if his or her duties

directly impact the integrity of internet gaming as determined by the board in its sole

discretion, subject to the following:

(a) The board shall exercise its discretion with respect to any internet gaming

operator applicant or licensee that is an Indian tribe consistent with limitations

prescribed in the act.

(b) An internet gaming operator or internet gaming supplier may provide an

explanation, such as a job description, to support an allegation that a position

should not require an occupational license.

(c) Elected or appointed officials of a federally recognized Indian tribe located within

this state are exempt from any occupational licensing requirement unless they are

employees of the tribe’s internet gaming operation.

(2) The following individuals when employed by an internet gaming operator or

internet gaming supplier are considered by the board to directly impact the

integrity of internet gaming:

(a) An individual who has the capability to directly affect the outcome of an

internet wager or game.

(b) An individual who has the capability of affecting a payout to an authorized

participant.

(3) An individual applying for an occupational license must complete an application

in the manner and form prescribed by the board and submit it together with the

18

required application fee and a written statement from an internet gaming operator

or internet gaming supplier indicating that it has employed or will employ the

individual if the individual is licensed.

(4) If a preliminary review of the application and criminal history check does not

uncover or indicate any circumstance that may require denial of the application

under the licensing standards established in this rule, a temporary occupational

license may be issued. The temporary occupational license authorizes the

individual to perform the employment duties for which the license is sought,

pending action on the license application. A temporary license is valid until the

occupational license application is withdrawn or denied, the temporary license is

suspended or revoked, or the license is issued by the board.

(5) An individual has the burden to establish by clear and convincing evidence his or her

suitability as to character, reputation, integrity, and responsibility.

(6) The board may, in its discretion, deny an occupational license to an individual who is

or does any of the following:

(a) Fails to disclose or states falsely any information requested in the application.

(b) Has been convicted of a criminal offense involving gambling, dishonesty, theft, or

fraud in any jurisdiction. However, the board may waive this requirement if the

conviction occurred more than 5 years before the applicant applies for a license

and the board is convinced that the applicant does not pose a threat to the integrity

of internet gaming and the applicant otherwise meets the requirements of this rule.

(c) Has a history of noncompliance with any regulatory requirements in this state or

any other jurisdiction.

(d) Lacks the requisite suitability as to integrity and character as determined by the

board.

(e) Has had a prior gambling related license or license application suspended,

restricted, revoked, or denied for just cause in any other jurisdiction.

(7) The board shall decide whether to grant or deny the application for an occupational

license. The decision must not be arbitrary or capricious.

(8) Upon granting the application for an occupational license and payment of the

licensing fee, the executive director shall issue the occupational license.

(9) The occupational license is not transferable to another individual.

(10) An occupational licensee must have on his or her person the license while

working for the applicable internet gaming operator or internet gaming supplier in

this state during work hours.

(11) The board may exempt an individual from any or all of the occupational licensing

requirements if any of the following apply:

(a) The individual is licensed under the Michigan Gaming Control and Revenue

Act, 1996 IL 1, MCL 432.201 to MCL 432.226.

(b) The individual is licensed under the lawful sports betting act, 2019 PA 149,

MCL 432.401 to MCL 432.419.

(c) The individual is licensed by another governmental agency.

(d) The board determines, in its sole discretion, that licensing is not considered

necessary to protect the public interest or accomplish the policies of the act.

(12)

An individual exempted from occupational licensing may be required to

register with the board using a form prescribed by the board.

19

(13) The board may suspend, revoke, summarily suspend, or refuse to renew a license

for just cause.

(14) An occupational license is valid for 2 years and must be renewed as prescribed by

the board. If the occupational licensee files a renewal request and pays the

licensing fee in a timely manner and in the manner and form prescribed by the

board, the licensee’s existing occupational license does not expire until a decision

on the application for renewal is made.

R 432.624 Fees, fines, taxes, payments, and assessments.

Rule 624. (1) All fees, fines, taxes, payments, and assessments provided for under the

act and these rules must be timely submitted to the board by a payment method

acceptable to the board, such as a certified check, cashier's check, money order made

payable to "State of Michigan," or electronic transfer of funds.

(2) An internet gaming operator must remit the tax or payment imposed by the act to the

board by an electronic transfer of funds. An internet gaming operator licensee must

maintain an account at a designated financial institution that is capable of handling

electronic fund transfers.

(3) The following nonrefundable license application fees must be submitted to the board,

together with the required license application form or forms, for the corresponding

license classification to which the fees relate:

(a) Internet gaming operator license application: $50,000.00.

(b) Internet gaming supplier license application: $2,500.00.

(c) Occupational license application: $250.00.

(4) The license application fee will be used by the board to conduct an appropriate

background investigation of the applicant as prescribed by the board, the act, and these

rules. No portion of a remitted application fee will be refunded.

(5) An additional background investigation charge may be assessed to the extent the

board's direct investigative costs exceed the applicant's application fee. Unless otherwise

determined by the board, a license may not be issued until payment of the additional

assessed charge for completion of the background investigation is received by the board.

(6) A licensee may also be assessed the board's direct investigative costs arising from a

background investigation for renewal of a license to the extent the costs exceed the

application fees. The board may deny a renewal application if the licensee does not pay

the additional assessed costs by a date set by the board.

(7) The following license fees must be submitted to the board by the applicant upon

initial issuance of the license under the act and these rules:

(a) Internet gaming operator license: $100,000.00.

(b) Internet gaming supplier license: $5,000.00.

(c) Occupational license: $250.00.

(8) The following license fees must be submitted to the board by the licensee after the

initial license is issued under the act and these rules:

(a) Internet gaming operator license annual fee: $50,000.00

(b) Internet gaming supplier license annual fee: $2,500.00.

(c) Occupational license biennial fee: $250.00.

R 432.624a Deposit of fees, fines, taxes, payments, and assessments.

20

Rule 624a. Except as provided in sections 15 and 15a of the act, MCL 432.315 and

432.315a, all fees, fines, taxes, payments, and assessments imposed by this state under

the act and these rules must be deposited into the internet gaming fund.

R 432.625 Investigation process for internet gaming operators and internet gaming

suppliers.

Rule 625. The board shall conduct a background investigation on an applicant subject

to the limitations of section 6 of the act, MCL 432.306, when the applicant is an Indian

tribe. The board shall also use the information provided in the application and disclosure

form or forms as a basis for a background investigation and to evaluate and determine the

eligibility and suitability of the applicant to receive an internet gaming operator license or

internet gaming supplier license under the licensing standards and criteria provided in the

act and these rules. A misrepresentation or omission in the application is cause for the

denial, suspension, restriction, or revocation of an internet gaming operator license or

internet gaming supplier license by the board.

R 432.625a Persons required to be found eligible and suitable.

Rule 625a. (1) The board shall not issue or renew an internet gaming operator license or

internet gaming supplier license unless every person required by the act and these rules as

part of the application for issuance or renewal of the license has first been determined by

the board to be eligible and suitable in accordance with the relevant licensing standards

set forth in the act and these rules.

(2) Unless otherwise prescribed by the board, the following persons are required to be

found eligible and suitable as part of the application for the issuance, or request for

renewal, of an internet gaming operator license or internet gaming supplier license:

(a) A person who is required to apply for an internet gaming operator license or

internet gaming supplier license under the act and these rules.

(b) A person who is included in the term “applicant” as defined in section 3 of the

act, MCL 432.303.

(c) A person who is a key person.

(3) A person required to be found eligible and suitable as part of the application for

issuance or renewal of an internet gaming operator license or internet gaming

supplier license must complete and file with the board an application and required

disclosure forms in the manner and form prescribed by the board.

(4) A person that applies for or holds an internet gaming operator or internet gaming

supplier license must ensure that all persons who are required by the act and these

rules to establish their eligibility and suitability as part of the applicant's

application for the issuance, or the licensee's maintenance or renewal, of the

internet gaming operator license or internet gaming supplier license have filed,

with the board, all required applications, reports, and disclosure forms in the

manner and form prescribed by the board.

R 432.625b License issuance by the board—standards and criteria.

Rule 625b. (1) Except to the extent the board may require different or additional

procedures, an applicant for an internet gaming operator license or internet gaming

supplier license is subject to all of the following before licensing:

21

(a) Application

(b) Background investigation

(c) Action and decision by the board on the application.

(2) A person that is required to be licensed as an internet gaming operator or internet

gaming supplier under the act and these rules must, before issuance of an internet

gaming operator’s or internet gaming supplier’s license, produce information,

documentation, and assurances to establish all of the following by clear and

convincing evidence:

(a) Its suitability as to character, reputation, integrity, business probity, and financial

ability.

(b) Its willingness to be subject to the jurisdiction of the board.

(c) That the applicant has adequate capitalization and the financial ability and the

means to develop, construct, operate, and maintain the applicant’s internet

gaming operator or internet gaming supplier business in accordance with the act

and these rules.

(d) That the applicant has adequate capitalization and the financial ability to

responsibly pay its secured and unsecured debts in accordance with its financing

agreements and other contractual obligations.

(e) That the applicant’s compliance with casino or casino-related licensing

requirements or compacts with this state or any other jurisdiction.

(f) That the applicant and all other persons required to be found eligible and suitable

as part of the application are eligible and suitable for licensure under the

licensing standards, criteria, and requirements.

(g) That the applicant, if an individual, and all other individuals required to be found

eligible and suitable as part of the application are not less than 21 years of age,

unless otherwise approved by the board.

(h) That the applicant and all other persons required to be found eligible and suitable

as part of the application have not been convicted of any criminal offense

involving gaming, theft, dishonesty, or fraud in any jurisdiction. However, the

board may waive this requirement if the conviction occurred more than 5 years

before the applicant applies for a license and the board is convinced that the

applicant does not pose a threat to the integrity of internet gaming and the

applicant otherwise meets the requirements of this rule.

(i) That the applicant and all other persons required to be found eligible and suitable

as part of the application do not appear on the exclusion list of any jurisdiction.

(j) That the applicant and all other persons required to be found eligible and suitable

as part of the application are in substantial compliance with all local, state, and

federal laws.

(k) That the applicant has the financial ability to purchase and maintain adequate

liability and casualty insurance and to provide an adequate surety bond.

(3) Subrule (2) of this rule does not apply to an Indian tribe except to the extent

authorized by the act. To the extent a non-tribal applicant or licensee will be providing

goods and services to an internet gaming operator who is an Indian tribe, that applicant or

licensee shall provide information relative to its relationship with the internet gaming

operator to determine if it is an arm of the tribe. Arm of the tribe means a tribally-created

economic entity owned in part or in whole by the Indian tribe which was intended by the

22

Indian tribe to share in its sovereign immunity and satisfies any relevant legal criteria

under federal Indian law for establishing arm of the tribe status.

(4) Once licensed, a person must comply with the act and these rules. Failure to comply

may result in disciplinary action.

R 432.625c Provisional licenses for internet gaming suppliers.

Rule 625c. (1) Upon written request of a person applying for an internet gaming

supplier’s license, the executive director may issue a provisional license to the applicant

and permit the applicant to conduct business transactions with, and provide goods and

services to, internet gaming operators, if all of the following provisions are complied

with:

(a) A completed application, an application fee, and all required disclosure forms and

other required written documentation and materials have been submitted by the

applicant.

(b) Preliminary review of the application and a criminal history check does not reveal

that the applicant or the applicant’s affiliate or key person has been convicted of a

felony or misdemeanor involving gambling, theft, dishonesty, or fraud, or may

otherwise be ineligible or unsuitable to permit licensure under the act or these

rules.

(c) There is no other apparent deficiency in the application that may require denial of

the application.

(d) The applicant has a letter of intent to provide goods or services to an internet

gaming operator or the applicant shows good cause for being granted a

provisional license.

(2) A provisional license issued under this rule expires on the date provided by the board.

(3) If the internet gaming supplier’s provisional license expires, or is suspended or

revoked, the executive director shall forward the applicant’s application for an internet

gaming supplier license to the board at the conclusion of the background investigation for

action on the application.

(4)The board may, at its discretion, waive any or all of the provisions listed in subrule (1)

of this rule if the applicant is licensed by the board under the Michigan Gaming Control

and Revenue Act, 1996 IL 1, MCL 432.201 to 432.226, or the lawful sports betting act,

2019 PA 149, MCL 432.401 to 432.419.

R 432.626 Denials.

Rule 626. (1) If the board denies an application for a license, it shall direct the

executive director to issue a notice of denial.

(2) An applicant, including an individual applying for an occupational license, who is

served with a notice of denial under these rules may request a contested case hearing

as set forth in these rules.

(3) The notice of denial is a finding that the person is ineligible or unsuitable for

licensure or is otherwise in violation of the licensing requirements of the act or these

rules. When the board denies an application for a license, the person is prohibited

from conducting business that would otherwise require licensure.

23

(4) A person whose application for a license has been denied may not reapply for a

period of 1 year from the date on which the board voted to deny the application unless

otherwise approved by the board.

(5) A person whose application for a license was denied may seek leave of the board to

reapply within the 1-year period by addressing the request to the board. The board

may require the person to present oral or written argument outlining why an

exception should be made.

R 432.627 Renewal of a license.

Rule 627. (1) An internet gaming operator or internet gaming supplier license when

issued is valid for a 5-year period.

(2) An internet gaming operator or internet gaming supplier licensee may renew its

license every 5 years after receiving its initial license.

(3) An internet gaming operator or internet gaming supplier licensee intending to renew

its license must, at least 30 days before expiration of its license, submit the annual

license renewal fee and application in the manner and form required by the board.

(4) If the board denies the application for renewal, it shall direct the executive director to

issue the licensee a notice of nonrenewal.

(5) An internet gaming operator or internet gaming supplier licensee who is served with a

notice of nonrenewal under this rule may request a contested case hearing as set forth

in these rules.

(6) The notice of nonrenewal is a finding that the internet gaming operator or internet

gaming supplier licensee is ineligible or unsuitable for licensure or is otherwise in

violation of the licensing requirements of the act or these rules. When the board

denies an application for renewal, the person is prohibited from conducting business

that would otherwise require licensure.

R 432.628 Application explained; applicant to demonstrate eligibility and suitability.

Rule 628. (1) An application for a license under the act and these rules is a request by

the applicant seeking a revocable privilege. A license must be granted by the board if the

applicant meets the licensing requirements of the act and these rules.

(2) An applicant for a license under the act and these rules, at all times, has the burden of

demonstrating to the board, by clear and convincing evidence, that the applicant is

eligible and suitable to be granted and retain the license for which application is made

under the applicable licensing standards and requirements of the act and these rules.

(3) A license issued by the board under the act and these rules is a revocable privilege

granted by the board. A person who holds a license does not acquire, and must not be

considered to have acquired, a vested property right or other right in the license.

(4) An applicant or licensee must accept any risk of adverse publicity, public notice,

notoriety, embarrassment, criticism, financial loss, or other unfavorable or harmful

consequences that may occur in connection with, or as a result of, the application and

licensing process or the public disclosure of information submitted to the board with a

license application or at the board's request under the act and these rules.

(5) An applicant or licensee may claim any privilege afforded by the Constitution or laws

of the United States or of this state in refusing to answer questions or provide

information requested by the board. However, a claim of privilege with respect to any

24

testimony or evidence pertaining to the eligibility or suitability of an applicant or

licensee to be granted or hold a license under the act and these rules may constitute

cause for denial, suspension, revocation, or restriction of the license.

(6) An applicant and licensee have a continuing duty to do all of the following:

(a) Notify the board of a material change in the information submitted in the license

application submitted by the applicant or licensee or a change in circumstance that

may render the applicant or licensee ineligible or unsuitable to hold the license

under the licensing standards and requirements of the act and these rules.

(b) Maintain the applicant's or licensee's eligibility and suitability to be issued and

hold the license held or applied for under the act and these rules.

(c) Provide any information or records requested by the board relating to licensing or

regulation; cooperate with the board in investigations, inspections, audits,

hearings, and enforcement and disciplinary actions; allow access to its facilities

relevant to Michigan internet gaming operation; and comply with all conditions,

restrictions, requirements, orders, and rulings of the board in accordance with the

act and these rules.

R 432.628a Eligibility and suitability of new key person.

Rule 628a. An individual required to be found eligible and suitable or licensed under

the act or these rules by virtue of his or her position with an internet gaming operator

licensee must not perform any duties or exercise any powers of the position until he or

she is determined to be eligible and suitable and is licensed by the board.

R 432.628b Duty to disclose violation of licenses.

Rule 628b. An internet gaming operator and an internet gaming supplier must

immediately notify the board, in writing, if it becomes aware that an internet gaming

operator, internet gaming supplier, or occupational licensee involved in its internet

gaming operations under the act has acted contrary to the act or these rules.

R 432.628c Contracts.

Rule 628c. The internet gaming operator must maintain all contracts that relate to its

Michigan internet gaming operations for 5 years following its expiration. The board must

be allowed access to any contract related to its Michigan internet gaming operations

entered into by an internet gaming operator upon demand. The internet gaming operator

may be required by the board to promptly submit copies of any such contract upon

request of the board.

R 432.629 Vendors.

Rule 629. (1) All of the following apply regarding vendor registration:

(a) A vendor who provides goods or services, or both, directly or indirectly, to an

internet gaming operator or internet gaming platform provider in connection with

its Michigan internet gaming operation may be required to register with the board.

Vendors requiring registration include, but are not limited to, the following:

(i) Affiliate marketers that do not have an agreement based on the sharing of

customer revenue. In connection with its vendor registration, the affiliate

marketer must certify it does not promote or market, or both, illegal online

25

gaming sites to individuals located in Michigan. An illegal online gaming site

is one that is not licensed to accept wagers from customers located in

Michigan or any other state.

(ii) Payment processors.

(iii)A person that provides over $100,000.00 worth of goods or services, or both,

to any internet gaming operator or internet gaming platform provider in

connection with its Michigan internet gaming operations in a calendar year.

(iv)Data centers providing physical security and infrastructure.

(v) Any other person as considered necessary by the board.

(b) Unless otherwise provided for by the board, a person must be registered as a

vendor before providing goods or services, or both, as a vendor to an internet

gaming operator or internet gaming platform provider.

(c) An internet gaming operator or an internet gaming platform provider is prohibited

from using an unregistered vendor to provide goods or services that require a

vendor registration.

(d) Unless otherwise provided for by the board, the following persons are not

required to register as a vendor:

(i) Insurance companies.

(ii) A person or entity that provides legal services.

(iii) Entities providing medical related services.

(iv) Michigan public institutions of higher education.

(v) Public utilities regulated by the Michigan public service commission.

(vi) A Michigan or federally chartered depository financial institution.

(vii) A person or business that provides goods or services as a result of the

licensee’s employees engaging in business travel, including transportation,

lodging, food, and fuel providers.

(viii) A person who provides employee training or professional development to a

licensee.

(ix) A person who provides conferences, seminars, publications, or memberships

that will directly contribute to the work performance or professional

development of the licensee’s employees.

(e) To register, a vendor must complete and file with the board an application for

registration and required disclosure forms in the manner and form prescribed by

the board. An application for registration and required disclosure forms must be

submitted to the board, together with a nonrefundable application fee of $200.00

by a payment method acceptable to the board, such as a certified check, cashier’s

check, money order made payable to “State of Michigan”, or electronic fund

transfer.

(2) All of the following apply regarding renewal of a vendor registration:

(a) A vendor must renew its registration every 5 years after initial registration.

(b) A vendor intending to renew its registration must, at least 30 days before

expiration of its registration, submit the annual registration fee and application in

the manner and form required by the board.

(3) All of the following apply regarding vendor conduct:

26

(a) A vendor must, at all times, conduct itself in a manner that does not compromise

the integrity of internet gaming or violate any applicable provisions of the act and

these rules.

(b) The board may conduct an investigation to determine if a vendor has acted in a

manner that does or could compromise the integrity of internet gaming in this

state. The following may be considered during an investigation:

(i) Criminal records.

(ii) Suspension of licenses, registration certificates, or their equivalent, or any

other adverse actions in other jurisdictions.

(iii) Business reputation.

(iv) Associations with businesses and individuals.

(v) Compliance with gaming laws and regulations in Michigan and other

jurisdictions.

(vi) Any other information considered appropriate by the board.

(c) Vendors agree to be subject to the jurisdiction of the board; have a continuing

duty to provide information or records requested by the board; must cooperate

with the board in any investigation, inspection, audit, or inquiry; and must allow

the board access to its facilities that are relevant to Michigan internet gaming

operations.

(d) If the investigation reveals a vendor’s conduct could or does compromise the

integrity of internet gaming in this state, the board may issue a cease and desist

order, obtain injunctive relief, or take any other action necessary to protect the

integrity of internet gaming in this state, or all 3.

(e) Vendors have a continuing duty to notify the board of any change in information

previously submitted to the board.

PART 3. TECHNICAL STANDARDS

R 432.631 Geofence requirements.

Rule 631. (1) All internet wagering transactions must be initiated and received or

otherwise made by an authorized participant located in this state or, if the act allows the

board to enter into agreements to facilitate, administer, and regulate multijurisdictional

internet gaming, another jurisdiction authorized by a multijurisdictional internet gaming

agreement. An authorized participant located in another jurisdiction authorized by a

multijurisdictional internet gaming agreement must only be allowed to place internet

wagers on internet games authorized by the board under the multijurisdictional internet

gaming agreement.

(2) To prevent the unauthorized placement of an internet wager by an individual or

authorized participant not within this state, the internet gaming operator and its

internet gaming platform provider must utilize a geofencing system to reasonably

detect the physical location of an individual or authorized participant attempting to

access the internet gaming platform and place an internet wager and to monitor and

block unauthorized attempts to access the internet gaming platform to place an

27

internet wager when an individual or authorized participant is not within the

permitted boundary.

(3) The geofencing system must ensure that an individual or authorized participant is

located within the permitted boundary when placing an internet wager, and must be

equipped to dynamically monitor the individual’s or authorized participant’s

location and block unauthorized attempts to access the internet gaming platform to

place an internet wager throughout the duration of the internet gaming authorized

participant session.

(4) The board shall approve all technical specifications for geofencing and any specific

requirements related to geofencing technology that is commercially available.

R 432.632 Approval of internet gaming platform and games.

Rule 632. (1) Except as otherwise determined by the board in writing, an internet

gaming platform provider or internet gaming supplier must not distribute an internet

gaming platform or internet game to an internet gaming operator unless the item has been

approved by the board.

(2) An internet gaming platform provider may seek approval of its internet gaming

platform by submitting an application to the board in the manner and form prescribed

by the board.

(3) If an internet gaming operator does not utilize an internet gaming platform provider

and, instead, develops its own internet gaming platform or internet game, the internet

gaming operator will be considered both an internet gaming operator and an internet

gaming platform provider for the purposes of this part.

R 432.632a Internet gaming platform and internet game submission and approval

process.

Rule 632a. (1) Each internet gaming platform provider must submit its internet gaming

platform proposed for use by an internet gaming operator to the board or to an

independent lab approved by the board for evaluation. The internet gaming platform

provider must provide all information the board requests including, but not limited to, all

of the following:

(a) A complete, comprehensive, and technically accurate description and explanation

of the internet gaming platform and its intended use in both technical and lay

language. The document must be signed under penalty of perjury.

(b) Detailed operating procedures or service manuals, or both, of the internet gaming

platform.

(c) A summary description of internet game play, system features, and fault

conditions.

(d) Details of all tests performed on the internet gaming platform, the conditions and

standards under which the tests were performed, the test results, and the identity

of the individual who conducted each test.

(e) A description of all hardware devices.

(f) A description of all software including software version.

(g) A description of all wagering communications.

(h) A description of all third-party integrated systems.

(i) Any equipment that is required to perform testing.

28

(j) A detailed description of the risk management framework including, but not

limited to:

(i) User access controls for all internet gaming personnel.

(ii) Information regarding segregation of duties.

(iii) Information regarding automated risk management procedures.

(iv) Information regarding fraud detection.

(v) Controls for ensuring regulatory compliance.

(vi) Description of anti-money laundering compliance standards.

(2) An internet gaming platform provider or internet gaming supplier must submit all

internet games, including, but not limited to, slot machine, table, live games,

progressives, and peer-to-peer games proposed for use by any internet gaming

operator to the board or to an independent lab approved by the board for evaluation.

(3) The internet gaming platform provider or internet gaming supplier must provide all

information the board requests, including, but not limited to, all the following:

(a) A complete, comprehensive, and technically accurate description and explanation

of the internet game and its intended use in both technical and lay language. The

document must be signed under penalty of perjury.

(b) Detailed operating procedures.

(c) A description of internet game play, system features, and fault conditions.

(d) A description of all software including software version.

(e) Complete paytable information including paytable identification and date code.

(f) Detailed information on the RNG.

(g) Return to player (RTP) calculation sheet.

(h) Rake percentage.

(i) Rules of the game.

(4) All internet game software used to conduct internet gaming must be designed with a

method to permit the validation of software using a gaming authentication tool or

other method approved by the board.

(5) A submission for board approval of progressive software to be used on an internet

gaming platform must also include all of the following at a minimum:

(a) Software controlling the internet jackpot.

(b) A mechanism to authenticate the software.

(c) Rules that will be displayed to the individual or authorized participant that apply

to the progressive jackpot.

(d) The internet games that are common to a single progressive.

(e) The odds of hitting the progressive amount.

(f) The reset value of the progressive.

(g) The rate of progression for the progressive amount.

(h) How the rate of progression is split between the various progressive components.

(i) Other information considered necessary and requested in writing by the board to

ensure compliance with the act and this part.

(6) All the following provisions apply to calculation sheets:

(a) For each internet game program submitted, the internet gaming platform provider

or internet gaming supplier requesting approval must supply calculation sheets

that determine the RTP percentage, including base game, bonus games or

features, free games, double-up options, progressives, and any other game

29

features included in the RTP calculation.

(b) Where different player options such as number of credits, lines bet, or player

strategy cause the pay table to vary, a separate calculation for each option is

required.

(7) The internet gaming platform provider or internet gaming supplier must submit all

internet game source code and any special tool, computer equipment, compiling

program, or other technical assistance necessary to compile the submitted software.

The result of the compiled source code must be identical to that in the storage

medium submitted for evaluation.

(8) The internet gaming platform provider or internet gaming supplier must provide the

board with a method to compensate for or resolve any differences between the

compiled program and the submitted program. The internet gaming platform

provider or internet game supplier may employ other equivalent methods that ensure

the results of the complied source code are identical to the storage medium submitted

for evaluation upon written request and approval of the board.

(9) Except where the board has provided written notification that approval is not

required, an internet gaming operator must install or use an internet gaming platform

or internet game, or both that has been approved by the board. An internet gaming

operator must not alter the manner in which the internet gaming platform or internet

game operates without the prior written approval of the board.

(10) After evaluating the internet gaming platform or internet game, the board shall

advise the internet gaming platform provider or internet gaming supplier, in writing,

of the determination.

R 432.632b Procedures and notification requirements after approval.

Rule 632b. (1) If another gaming jurisdiction revokes or otherwise directs

discontinuance of the internet gaming platform, any component of the internet gaming

platform, an internet game, or an internet game component that has been approved by the

board, the internet gaming operator, internet gaming platform provider, or internet

gaming supplier must advise the board in writing of the discontinuance within 21 days of

the revocation or direction of discontinuance.

(2) An internet gaming operator, internet gaming operator license applicant, internet

gaming platform provider, or internet gaming supplier must immediately notify the

board, in writing, of any defects or malfunctions of the internet gaming platform, any

component of the internet gaming platform, an internet game, or an internet game

component that adversely affects the integrity or conduct of internet wagering or

proper reporting of adjusted gross receipts, or that materially affects the operation or

safety of, or wagering on, any internet gaming platform, any component of the

internet gaming platform, any internet game, or any component of an internet game

that has been approved by the board and is utilized by the internet gaming operator or

internet gaming operator license applicant.

(3) An internet gaming operator, internet gaming platform provider, or internet gaming

supplier must maintain all records required under this rule for a minimum of 5 years.

(4) The board may require an internet gaming operator to discontinue use of the internet

gaming platform, any component of the internet gaming platform, an internet game,

or any component of an internet game for any of the following reasons:

30

(a) The internet gaming platform, platform component, internet game, or internet

game component does not perform in the manner described in the application and

related submission documentation.

(b) The internet gaming platform, platform component, internet game, or internet

game component is defective or malfunctions frequently.

(c) The internet gaming platform, platform component, internet game, or internet

game component has a detrimental impact on the conduct or integrity of internet

gaming.

(d) The internet gaming platform, platform component, internet game, or internet

game component improperly computes adjusted gross receipts.

(5) The board shall provide written notification to the internet gaming operator, internet

gaming platform provider, and the internet gaming supplier if the internet gaming

platform, platform component, internet game, or internet game component is no

longer approved for use.

R 432.633 Internet gaming platform and internet games technical standards.

Rule 633. (1) An internet gaming platform or internet game, or both, for use to conduct

internet gaming must meet the specifications set forth in these rules or other technical

specifications as prescribed by the board. Failure to comply with the approved

specifications, internal controls, or technical specifications may result in disciplinary

action by the board.

(2) Internet gaming operators, internet gaming platform providers, and internet gaming

suppliers must comply with, and the board adopts and incorporates by reference,

Gaming Laboratories International, LLC Standard GLI-19: Standards for Interactive

Gaming Systems, version 3.0, released July 17, 2020, which is available for

inspection and distribution at no cost, as of the time of adoption of these rules, at the

board’s office located at 3062 W. Grand Blvd., Suite L-700, Detroit, Michigan

48202-6062 or Gaming Laboratories International website at https://gaminglabs.com

and does not include any later amendments or editions. GLI-19 standards are

intended to supplement rather than supplant other technical standards and

requirements under these rules. Where GLI-19 standards conflict with other

requirements provided under these rules, these rules shall control unless otherwise

determined by the board.

(3) Before conducting internet gaming, and as otherwise required by the board, an internet

gaming platform provider must submit the internet gaming platform used in

conjunction with the internet gaming operation to the board or an independent testing

laboratory approved by the board for certification testing.

(4) If the internet gaming platform meets or exceeds the technical standards adopted in

subrule (2) of this rule, the board or independent testing laboratory approved by the

board shall certify the internet gaming platform. Internet gaming operators and internet

gaming platform providers are prohibited from offering internet gaming in Michigan

without such certification. The internet gaming platform provider is responsible for all

costs associated with testing and obtaining such certifications.

(5) All internet games for proposed use must meet or exceed the technical standards

adopted in subrule (2) of this rule. Internet gaming operators, internet gaming

platform providers, and internet gaming suppliers are prohibited from offering any

31

internet game without written approval by the board. An internet gaming platform

provider and internet gaming supplier is responsible for all costs associated with

testing and obtaining such approvals.

R 432.633a Additional internet gaming software and platform technical standards.

Rule 633a. (1) Software utilized for internet gaming must either:

(a) Continuously display the current time in the time zone where the game server is

physically located and the time elapsed that an authorized participant has been in

the current internet gaming authorized participant session, or

(b) Cause a pop-up notification, at least every half-hour, to be prominently displayed

on the remote player device advising the authorized participant of the current time

and the amount of time elapsed since his or her log on.

(2) An internet gaming platform must not induce an authorized participant to continue

placing internet wagers when play is in session, when the authorized participant

attempts to end an internet gaming authorized participant session, or when the

authorized participant wins or loses an internet wager.

(3) No auto play feature will be permitted in internet game software unless authorized by

the board.

(4) All internet games must operate in accordance with the game rules and internet

wagering account terms and conditions approved by the board.

R 432.633b Additional standards for approval of internet games.

Rule 633b. (1) Each house-banked internet game that requires an internet wager must

have an RTP equal to or greater than 80% but not more than 100% unless otherwise

authorized by the board. The RTP must be calculated using both the highest and lowest

level of skill, where player skill impacts the RTP.

(2)

An house-banked internet game must comply with all odds-related requirements

prescribed in the technical standards adopted in R 432.633(2), including those prescribed

in section 4.7.3 of the referenced technical standards, except that the odds of achieving

the highest advertised award that is based solely upon chance must occur at least once in

every 50 million games

(3)

The RTP of a house-banked internet game must not decrease by more than 1/100

of a percentage point with an increased internet wager unless the aggregate total of the

decreases in RTP for plays offered by the house-banked internet game is no more than

1/2 of 1 percent.

(4) The projected contribution from a progressive award may not count toward the RTP

of a house-banked internet game in order to achieve the minimum RTP as approved by

the board.

R 432.634 Location of servers, security, and cloud storage.

Rule 634. (1) Unless otherwise approved by the board in writing, an internet gaming

operator and its internet gaming platform provider must place a server or other equipment

that is capable of receiving internet wagers in this state. The location selected must have

32

adequate security, protections, and controls over the servers or other equipment that is

capable of receiving internet wagers, including those adopted in R 432.633(2). The

internet gaming operator and its internet gaming platform provider must provide the

board with information on the location of all servers and other equipment.

(2) The board may approve of the use of cloud storage for duplicate data upon written

request of an internet gaming operator or internet gaming platform provider.

R 432.635 Communication standards.

Rule 635. (1) All internet gaming platforms authorized by the board under these rules

must be designed to ensure the integrity and confidentiality of all individual and

authorized participant communications and ensure the proper identification of the sender

and receiver of all communications.

(2) If communications are performed across a public or third-party network, the internet

gaming platform must either encrypt the data packets or utilize a secure

communications protocol to ensure the integrity and confidentiality of the

transmission.

(3) Internet gaming platform providers must meet or exceed all communication standards

prescribed by the board.

(4) Internet gaming platform providers or internet gaming operators, or both must address

all communication requirements in the internet gaming platform and internal controls

submitted to the board for approval.

R 432.636 Internet gaming data logging standards.

Rule 636. (1) Internet gaming platforms must employ a mechanism capable of

maintaining a separate copy of all information the board requires to be logged. Except as

otherwise provided in subrule (2) of this rule, the information must be maintained on a

separate and independent logging device capable of being administered by an employee

with no incompatible function.

(2) If the internet gaming platform can be configured such that any logged data is

contained in a secure transaction file, a separate logging device is not required.

(3) Internet gaming platform providers must meet or exceed all internet gaming data

logging standards prescribed by the board. Internet gaming platform providers or internet

gaming operators, or both must address all internet gaming data logging requirements in

the internet gaming platform and internal controls submitted to the board for approval.

(4) The internet gaming platform must provide a mechanism for the board to query and

export, in a format required by the board, all internet gaming platform data related to

internet gaming conducted under the act.

R 432.637 Self-monitoring of internet gaming platform critical components.

Rule 637. An internet gaming platform must, at least once every 24 hours, perform a

self-authentication process on all software used to offer, record, and process internet

wagers conducted under this act that is identified by the board as a critical component to

ensure there have been no unauthorized modifications. If there is an authentication

failure, the internet gaming platform must immediately notify the internet gaming

operator, internet gaming platform provider, and the board within 24 hours. The results of

33

all self-authentication attempts must be retained by the internet gaming platform for not

less than 90 days.

R 432.637a Change approval.

R. 637a. (1) Any change or modification to the internet gaming platform that impacts a

regulated feature of an approved internet gaming platform, unless otherwise permitted by

the board, requires submission to and approval by the board before the implementation of

the change or modification. Regulated feature includes, but is not limited to, internet

gaming platform and internet game software that is validated using a gaming

authentication tool or other method approved by the board and all critical component

software.

(2) The internet gaming operator and its internet gaming platform provider must submit

change control processes that detail evaluation procedures for all updates and changes to

equipment and the internet gaming platform to the board for approval. These processes

must include details for identifying the criticality of updates and determining the updates

that must be submitted to the board or a board approved independent testing laboratory

for review and certification.

R 432.638 Internet gaming platform assessment.

Rule 638. (1) Each internet gaming operator or internet gaming platform provider shall,

within 90 days after commencing operations, and annually thereafter, perform an internet

gaming platform integrity and security assessment of the internet gaming platform

conducted by an independent professional selected by the internet gaming operator or

internet gaming platform provider and subject to approval of the board. The scope of the

internet gaming platform integrity and security assessment is subject to approval of the

board and must include, at a minimum, all of the following:

(a) A vulnerability assessment of internal, external, and wireless networks with the

intent of identifying vulnerabilities of all devices, the internet gaming platform,

and applications connected to or present on the networks.

(b) A penetration test of all internal, external, and wireless networks to confirm if

identified vulnerabilities of all devices, the internet gaming platform, and

applications are susceptible to compromise.

(c) A policy and procedures review against the current ISO 27001 standard or another

similar standard approved by the board.

(d) Any other specific criteria or standards for the internet gaming platform integrity

and security assessment as prescribed by the board.

(2) The full independent professional's report on the assessment must be submitted to the

board and must include all the following:

(a) Scope of review.

(b) Name and company affiliation of the individual or individuals who conducted the

assessment.

(c) Date of assessment.

(d) Findings.

(e) Recommended corrective action, if applicable.

(f) Internet gaming operator’s or internet gaming platform provider’s response to the

findings and recommended corrective action.

34

R 432.639 Internet gaming operators and internet gaming platform provider technical

and security standards (controls).

Rule 639. (1) An internet gaming operator or its internet gaming platform provider, or

both must adopt, implement, and maintain technical security standards (controls) that

meet or exceed those adopted in R 432.633(2). The technical security standards must

apply, at a minimum, to all the following critical components of the internet gaming

platform:

(a) Components that record, store, process, share, transmit, or retrieve sensitive

information (e.g., validation numbers, personal identification numbers (PIN), and

individual and authorized participant data).

(b) Components that generate, transmit, or process random numbers used to

determine the outcome of games or virtual events.

(c) Components that store results or the current state of an authorized participant’s

internet wager.

(d) Points of entry to and exit from the components provided for in subdivisions (a) to

(c) of this subrule and other systems that are able to communicate directly with

core critical internet gaming platform components.

(e) Communication networks that transmit sensitive information involving internet

gaming under the act.

(2) The following technical security standards are the minimum standards an internet

gaming operator or internet gaming platform provider must incorporate into its internal

controls:

(a) Technical security standards addressing internet gaming platform operations and

security include, but are not limited to all of the following:

(i) Internet Gaming Platform Operations and Security. The internet gaming

operator or internet gaming platform provider must adopt, implement, and

maintain procedures for, at a minimum, the following:

(A)Monitoring the critical components and the transmission of data of the

entire internet gaming platform.

(B) Maintenance of all aspects of security of the internet gaming platform to

ensure secure and reliable communications.

(C) Defining, monitoring, documenting, reporting, investigating, responding

to, and resolving security incidents.

(D)Monitoring and adjusting resource consumption and maintaining a log of

the internet gaming platform performance.

(E) Investigating, documenting, and resolving malfunctions.

(ii) Physical Location of Servers and Security. The internet gaming platform

must be housed in secure locations. Internet gaming operators and their

internet gaming platform providers must provide the board with information

on the location of all internet gaming platform servers. The secure locations

must have sufficient protection from unauthorized access and physical and

environmental hazards and be equipped with surveillance and security

systems that meet or exceed industry standards.

(iii)Internet Gaming Platform Logical Access Controls. The internet gaming

platform must be logically secured against unauthorized access.

35

(iv)Internet Gaming Platform User Authorization. The internet gaming platform

must be subject to user authorization requirements as required by the board.

(v) Server Programming. The internet gaming platform must be sufficiently

secure to prevent any user-initiated programming capabilities on the server

that may result in unauthorized modifications to the database.

(vi)Verification Procedures. Procedures must be in place for verifying on demand

that the critical control program components of the internet gaming platform

in the production environment are identical to those approved by the board.

(vii) Electronic Document Retention System. The internet gaming operator or

internet gaming platform provider must establish procedures that ensure that

all reports required under the act and these rules are stored in an electronic

document retention system.

(viii) Asset Management. All assets that house, process, or communicate

sensitive information, including those comprising the operating environment

of the internet gaming platform or its components, or both, must be accounted

for and have a nominated owner or designated management official that is

responsible for each asset.

(b) The technical security standards addressing data security and backup recovery

include, but are not limited to, all of the following:

(i) Data Security. The internet gaming platform must provide a logical means for

securing individual and authorized participant data and wagering data,

including accounting, reporting, significant event, or other sensitive

information, against alteration, tampering, or unauthorized access.

(ii) Data Alteration. The alteration of any accounting, reporting, or significant

event data relating to internet wagering under the act is not permitted without

supervised access controls. If any data is changed, all information required by

the board must be documented or logged.

(iii)Backup Frequency. Backup scheme implementation relating to information

involving internet wagering under the act must occur at least once every day

or as otherwise specified by the board.

(iv)Storage Medium Backup. Audit logs, internet gaming platform databases, and

any other pertinent individual and authorized participant data and wagering

data must be stored using reasonable protection methods. The internet gaming

platform must be designed to protect the integrity of this data if there is a

failure. Redundant copies of this data must be kept on the internet gaming

platform with open support for backups and restoration, so that no single

failure of any portion of the internet gaming platform would cause the loss or

corruption of the data.

(v) Internet Gaming Platform Failure. The internet gaming platform must have

sufficient redundancy and modularity so that if any single component or part

of a component fails, the functions of the internet gaming platform and the

process of auditing those functions can continue with no critical data loss. If 2

or more components are linked, the process of all internet gaming operations

between the components must not be adversely affected by restart or recovery

of either component and upon restart or recovery, the components must

immediately synchronize the status of all transactions, data, and

36

configurations with one another.

(vi)Accounting and Master Resets. The internet gaming operator or internet

gaming platform provider must be able to identify and properly handle the

situation where a master reset has occurred on any component that affects

internet gaming under the act.

(vii) Recovery Requirements. If there is a catastrophic failure when the

internet gaming platform cannot be restarted in any other way, it must be

possible to restore the internet gaming platform from the last backup point and

fully recover. The contents of that backup must contain critical information as

required by the board.

(viii) Uninterrupted Power Supply (UPS) Support. All internet gaming platform

components must be provided with adequate primary power. If the server is a

stand-alone application, it must have a UPS connected and must have

sufficient capacity to permit a methodical shut-down that retains all individual

and authorized participant data and wagering data during a power loss. It is

acceptable that the internet gaming platform may be a component of a

network that is supported by a network-wide UPS if the server is included as a

device protected by the UPS. There must be a surge protection system in use

if not incorporated into the UPS itself.

(ix)Business Continuity and Disaster Recovery Plan. A business continuity and

disaster recovery plan must be in place to recover internet gaming operations

conducted under the act if the internet gaming platform’s production

environment is rendered inoperable.

(c) Technical security standards addressing communications include, but are not

limited to, all of the following:

(i) Connectivity. Only authorized devices are permitted to establish

communications between any internet gaming platform components.

(ii) Communication Protocol. Each component of the internet gaming platform

must function as indicated by a documented secure communication protocol.

(iii)Communication Over Internet/Public Network. Communications between

internet gaming platform components must be secure. Individual and

authorized participant data, sensitive information, internet wagers, results,

financial information, and individual and authorized participant transaction

information related to internet gaming conducted under the act must always be

encrypted and protected from incomplete transmissions, misrouting,

unauthorized message modification, disclosure, duplication, or replay.

(iv)Wireless Local Area Network (WLAN) Communications. The use of WLAN

communications must adhere to applicable requirements specified for wireless

devices and is subject to approval by the board.

(v) Network Security Management. Networks must be logically separated to

ensure that there is no network traffic on a network link that cannot be

serviced by hosts on that link.

(vi) Mobile Computing and Communications. Formal policies shall be in place,

and appropriate security measures shall be adopted to protect against the risk

of using mobile computing and communication facilities. Telecommuting

shall not be permitted except under circumstances where the security of the

37

endpoint can be guaranteed.

(d) Technical security standards addressing third party service providers include, but

are not limited to, all of the following:

(i) Third-Party Service Communications. Where communications related to

internet gaming conducted under the act are implemented with third-party

service providers, the internet gaming platform must securely communicate

with all third-party service providers utilizing encryption and strong

authentication, ensure that all login events are recorded to an audit file, and

ensure that all communications do not interfere or degrade normal internet

gaming platform functions.

(ii) Third-Party Services. The roles and responsibilities of each third-party

service provider engaged by the internet gaming operator or internet gaming

platform provider must be defined and documented in a manner approved by

the board. The internet gaming operator or internet gaming platform provider

must have policies and procedures in place for managing third-party service

providers and monitoring their adherence to relevant security requirements.

(e) Technical security standards addressing technical controls include, but are not

limited to, all of the following:

(i) Domain Name Service (DNS) Requirements. An internet gaming operator or

internet gaming platform provider must establish requirements that apply to

servers used to resolve DNS queries used in association with the internet

gaming platform.

(ii) Cryptographic Controls. An internet gaming operator or internet gaming

platform provider must establish and implement a policy for the use of

cryptographic controls that ensures the protection of information.

(iii)Encryption Key Management. The management of encryption keys must

follow defined processes established by the internet gaming operator or

internet gaming platform provider and approved by the board.

(f) The technical security standards addressing remote access and firewalls include,

but are not limited to, all of the following:

(i) Remote Access Security. Remote access, if approved by the board, must be

performed via a secured method, must have the option to be disabled, may

accept only the remote connections permissible by the firewall application and

internet gaming platform settings, and must be limited to only the application

functions necessary for users to perform their job duties.

(ii) Remote Access and Guest Accounts Procedures. Remote access and guest

accounts procedures must be established that ensure that remote access is

strictly controlled.

(iii)Remote Access Activity Log. The remote access application must maintain

an activity log that updates automatically and records and maintains all remote

access information.

(iv)Firewalls. All communications, including remote access, must pass through at

least 1 approved application-level firewall. This includes connections to and

from any non-internet gaming platform hosts used by the internet gaming

operator or internet gaming platform provider.

(v) Firewall Audit Logs. The firewall application must maintain an audit log and

38

must disable all communications and generate an error if the audit log

becomes full. The audit log must contain, at a minimum, all the following

information:

(A) All changes to configuration of the firewall.

(B) All successful and unsuccessful connection attempts through the firewall.

(C) The source and destination IP Addresses, Port Numbers, Protocols, and,

where possible, MAC Addresses.

(vi) Firewall Rules Review. The firewall rules must be periodically reviewed by

the internet gaming operator or internet gaming platform provider to verify the

operating condition of the firewall and the effectiveness of its security

configuration and rule sets and must be performed on all the perimeter

firewalls and the internal firewalls.

(g) Technical security standards addressing change management include, but are not

limited to, all of the following:

(i) Program Change Control Procedures. Program change control procedures

must ensure that only authorized versions of programs are implemented on the

production environment.

(ii) Software Development Life Cycle. The acquisition and development of new

software must follow defined processes established by the internet gaming

operator or internet gaming platform provider and subject to review by the

board.

(iii) Patches. All patches should be tested, as applicable, in a development and

test environment configured to match the target production environment

before being deployed into production. Permitted exceptions and related

procedures and controls must be fully addressed.

(h) Technical security standards addressing periodic security testing include, but are

not limited to, all of the following:

(i) Technical Security Testing. Periodic technical security tests on the production

environment must be performed quarterly or as required by the board to

guarantee that no vulnerabilities putting at risk the security and operation of

the internet gaming platform exist.

(ii) Vulnerability Assessment. The internet gaming operator or the internet

gaming platform provider must conduct vulnerability assessments. The

purpose of the vulnerability assessment is to identify vulnerabilities, which

could be later exploited during penetration testing by making basic queries

relating to services running on the internet gaming platform concerned.

(iii)Penetration Testing. The internet gaming operator or the internet gaming

platform provider must conduct penetration testing. The purpose of the

penetration testing is to exploit any weaknesses uncovered during the

vulnerability assessment on any publicly exposed applications or internet

gaming platform hosting applications processing, transmitting, or storing

sensitive information.

(iv)Information Security Management System (ISMS) Audit. An audit of the

ISMS will be periodically conducted, including all the locations where

sensitive information is accessed, processed, transmitted, or stored. The ISMS

will be reviewed against common information security principles in relation to

39

confidentiality, integrity, and availability.

(v) Cloud Service Audit. An internet gaming operator and its internet gaming

platform provider that utilizes a cloud service provider (CSP), if approved by

the board, to store, transmit, or process sensitive information must undergo a

specific audit as required by the board. The CSP must be reviewed against

common information security principles in relation to the provision and use of

cloud services, such as ISO/IEC 27017 and ISO/IEC 27018, or equivalent.

(3) The internet gaming operator or its internet gaming platform provider, or both must

include the technical security standards (controls) in the internal controls and internet

gaming platform submitted to the board for approval.

(4) The technical security standards (controls) must:

(a) Have a provision requiring review when changes occur to the internet gaming

platform.

(b) Be approved by the internet gaming operator’s or internet gaming platform

provider’s senior management.

(c) Be communicated to all affected employees and relevant external parties.

(d) Undergo review at planned intervals.

(e) Delineate the responsibilities of the internet gaming operator’s staff, the internet

gaming platform provider’s staff, and the staff of any third parties for the

operation, service, and maintenance of the internet gaming platform or its

components, or both.

R 432.639a Test accounts.

Rule 639a. (1) An internet gaming operator or internet gaming platform provider may

establish test accounts to be used to test the various components and operation of an

internet gaming platform pursuant to internal controls adopted by the internet gaming

operator or internet gaming platform provider, which, at a minimum, must address all or

the following:

(a) The procedures for issuing funds used for testing, including the identification of

who may issue the funds and the maximum amount of funds that may be issued.

(b) The procedures for assigning each test account for use by only 1 individual.

However, an internet gaming operator may establish a specific scenario or

instance of a test account that may be shared by multiple users if each user's

activities are separately logged.

(c) The maintenance of a record for all test accounts, to include when they are

active, to whom they are issued, and the employer of the individual to whom

they are issued.

(d) The procedures for auditing testing activity by the internet gaming operator or

internet gaming platform provider to ensure the accountability of funds used for

testing and proper adjustments to gross receipts.

(e) The procedures for authorizing and auditing out-of-state test activity.

(2) Peer-to-peer games may be tested by a user with multiple test accounts if authorized

participants are not involved in game play.

R 432.639b Live games.

40

Rule 639b. (1) An internet gaming operator or its internet gaming platform provider

must obtain written board approval to conduct live games or other similar type games.

Unless otherwise approved by the board in writing, the live game environment used to

conduct live games or similar games must be located in this state in a location approved

by the board.

(2) The live game service provider may be an internet gaming operator, internet

gaming platform provider, or an internet gaming supplier if approved by the

board . The live game service provider, shall adopt, implement, and maintain all

technical standards adopted in R 432.633(2) including the live game service

provider requirements contained in Appendix C.6 of the referenced technical

standards

R 432.639c Progressive jackpots.

Rule 639c. (1) An internet gaming operator or its internet gaming platform provider

may offer a progressive jackpot that increases uniformly in value as the internet game is

played based upon an approved rate of progression and is awarded for a specific outcome

or event.

(2) The rules governing the award and the value of the progressive award must be readily

available to individuals and authorized participants.

(3) An internet gaming operator or its internet gaming platform provider must obtain

approval from the board in the form and manner prescribed by the board before

offering, modifying, or transferring a progressive jackpot on software approved by

the board under these rules.

(4) Two or more linked internet games offering the same progressive jackpot may be of

different denominations or have different minimum internet wagers required to win

the progressive jackpot, or both, if the probability of winning the progressive jackpot

is directly proportional to the minimum internet wager required to win that jackpot.

For example, if on the same link, a nickel game requires 20 credits (a $1.00 wager), a

quarter game requires 8 credits (a $2.00 wager), and a dollar game requires 3 credits

(a $3.00 wager) to win the progressive jackpot, the probability of a winning internet

wager must be 3 times more likely on a linked dollar game than on the linked nickel

game, and twice as likely on a linked quarter game than on the linked nickel game.

Similarly, if among 3 linked quarter denomination games, the first required 2 credits

(a 50 cent wager), the second required 4 credits (a $1.00 wager), and the third

required 8 credits (a $2.00 wager) to play for the progressive jackpot, on each wager,

the probability of winning the jackpot would be twice as likely on the second game

than on the first game, and 4 times more likely on the third game than on the first

game.

(5) The internet gaming operator or its internet gaming platform provider, or both must

ensure that progressive jackpot awards that have a reset amount greater than

$5,000.00 are reconciled at least once a month in accordance with approved internal

controls unless otherwise required by the board.

(6) An internet gaming operator or its internet gaming platform provider, or both must

maintain a detailed record of the monthly reconciliation. An internet gaming operator

or its internet gaming platform provider, or both must also reconcile a progressive

jackpot before a transfer or modification.

41

(7) The internet gaming operator or its internet gaming platform provider, or both must

investigate the reason for any progressive amount variance exceeding $100.00 and

file an incident report with the board that must include corrective actions proposed or

taken to resolve the variance.

(8) An internet gaming operator or its internet gaming platform provider, or both must

remove or make the progressive game unavailable to individuals and authorized

participants for all occurrences in which a game malfunctions or if otherwise required

by the board.

(9) The internet gaming operator or its internet gaming platform provider, or both that

chooses to restore a progressive jackpot previously made unavailable pursuant to this

rule, must restore the entire progressive jackpot amount. The amount restored must

include the entire jackpot, including the seed amount and all previously collected

authorized participant contributions.

(10) An internet gaming operator may remove or transfer a progressive jackpot upon

obtaining board approval as provided for in this rule and after notification to

individuals and authorized participants, which notification must be given not less than

10 days before a transfer or not less than 30 days before a removal.

(11) If a wide area progressive offered on the internet is removed, it must be restored or

transferred by the internet gaming platform provider or internet gaming supplier as

applicable. The amount restored or transferred must include the entire jackpot,

including the seed amount and all previously collected authorized participant

contributions.

R 432.639d Internet gaming networks.

Rule 639d. (1) With the approval of the board, 1 or more internet gaming operators may

participate in an internet gaming network as set forth in a written agreement that has been

executed by each internet gaming operator. The agreement must include all provisions

required by the board.

(2) Each party to an agreement for an internet gaming network must be jointly and

severally liable for acts, omissions, and violations of the act or these rules.

PART 4. AUTHORIZED PARTICIPANT INTERNET WAGERS

R 432.641 Authorized participant complaints.

Rule 641. (1) An internet gaming operator or internet gaming platform provider must

include on its internet gaming platform a clear mechanism to advise authorized

participants of their right to make a complaint against the internet gaming operator, the

internet gaming platform provider, or another authorized participant (when collusion is

suspected or when an authorized participant is disruptive or abusive), including

information explaining how complaints can be filed, how complaints are resolved, and

how the authorized participant may submit a complaint to the board.

(2) An internet gaming operator or internet gaming platform provider must attempt to

resolve all complaints with the authorized participant.

42

(3) An internet gaming operator or internet gaming platform provider must investigate

each complaint and provide a response to the authorized participant within 10

calendar days after receipt of the complaint.

(4) In its response, the internet gaming operator or internet gaming platform provider

must advise the authorized participant of his or her right to submit the complaint to

the board in the form and manner prescribed by the board.

(5) The complaint and the internet gaming operator’s or internet gaming platform

provider’s response must be made in writing.

(6) Unless otherwise directed by the board, for complaints related to internet wagering

accounts, game outcomes, or illegal activity related to internet gaming that cannot be

resolved to the satisfaction of the authorized participant, the internet gaming operator

or internet gaming platform provider must promptly notify the board of the complaint

and the internet gaming operator’s or internet gaming platform provider’s response.

(7) On receipt of a complaint from an authorized participant or notification of an

unresolved complaint from an internet gaming operator or internet gaming platform

provider, the board may conduct any investigation the board considers necessary and

may direct an internet gaming operator or internet gaming platform provider to take

any corrective action the board considers appropriate.

(8) An internet gaming operator or internet gaming platform provider must maintain

records related to authorized participant complaints for a minimum of 5 years and

must provide the records to the board on request.

R 432.642 Bank secrecy act compliance.

Rule 642. (1) An internet gaming operator or internet gaming platform provider must

comply with all provisions of the bank secrecy act of 1970, 31 USC 5311 to 5332,

applicable to the internet gaming operator’s or internet gaming platform provider’s

internet gaming operation.

(2) An internet gaming operator or internet gaming platform provider must, with regard

to its internet gaming operation, maintain records related to its compliance with the

bank secrecy act of 1970, 31 USC 5311 to 5332, including all currency transaction

reports, suspicious activity reports, and any supporting documentation, for a

minimum of 5 years. The internet gaming operator or internet gaming platform

provider must provide the records to the board and any appropriate law enforcement

agencies on request consistent with the authorization prescribed in the bank secrecy

act of 1970, 31 USC 5311 to 5332, and applicable regulations.

(3) An internet gaming operator or internet gaming platform provider must provide a

written notice to the board as soon as the internet gaming operator or internet gaming

platform provider becomes aware of a compliance review that is conducted by the

Internal Revenue Service under the bank secrecy act of 1970, 31 USC 5311 to 5332,

and involves or impacts the internet gaming operator’s or internet gaming platform

provider’s internet gaming operation. The internet gaming operator or internet

gaming platform provider must provide a copy of the compliance review report or the

equivalent to the board within 10 days after the receipt of the report by the internet

gaming operator or internet gaming platform provider.

R 432.643 Integrity monitoring/suspicious behavior.

43

Rule 643. (1) An internet gaming operator or internet gaming platform provider must

employ personnel responsible for ensuring the operation and integrity of internet gaming

and reviewing all reports of suspicious behavior. Unless otherwise directed by the board,

an internet gaming operator or internet gaming platform provider must immediately

notify the board upon detecting or becoming aware of any of the following:

(a) Any person participating in internet wagering who is engaging in or attempting to

engage in, or who is reasonably suspected of, cheating, theft, embezzlement,

collusion, use of funds derived from illegal activity, money laundering, or any

other illegal activities, including those activities prohibited in section 13 of the act,

MCL 432.313.

(b) Any person who is reasonably suspected of misrepresenting their identity or using

false identification to establish or attempt to establish an internet wagering

account.

(c) Suspected criminal activity related to any aspect of internet gaming.

(d) Any criminal or disciplinary proceedings commenced against the internet gaming

operator or internet gaming platform provider in connection with its internet

gaming.

(e) Any suspicious internet wagering activity or patterns that indicate a concern

regarding the integrity of an internet game or internet wagering.

(f) Any other conduct that corrupts the outcome of an internet game or internet wager.

(g) Any internet wagers that violate any applicable state or federal law.

(2) An internet gaming platform provider must promptly notify any affected internet

gaming operators on behalf of which it accepts internet wagers of any issues impacting

the integrity of internet gaming.

(3) The board may require an internet gaming operator or internet gaming platform

provider to provide any hardware or software necessary to the board, or to an

independent lab approved by the board, for evaluation of its internet gaming offering or

to conduct further monitoring of data provided by its internet gaming platform.

(4) An internet gaming operator or internet gaming platform provider must maintain

records demonstrating its compliance with this rule, including all reports of suspicious

behavior and any supporting documentation, for a minimum of 5 years and must provide

the records to the board on request.

R 432.644 Reserve requirement.

Rule 644. (1) An internet gaming operator or internet gaming platform provider must

maintain a reserve in the amount necessary to ensure the security of funds held in internet

wagering accounts. The reserve must be in the form of:

(a) Cash or cash equivalents maintained in a U.S. bank account segregated from the

internet gaming operator’s or internet gaming platform provider’s operational

funds.

(b) An irrevocable letter of credit.

(c) A bond.

(d) Any other form acceptable to the board.

(e) Any combination of the allowable forms described in subdivisions (a) to (d) of

this subrule.

(2) The reserve must be not less than the sum of the following:

44

(a) The daily ending cashable balance of all authorized participants’ internet

wagering accounts.

(b) Pending withdrawals.

(c) The sum of all pending internet wagers, funds transferred to an internet game not

yet wagered, and pending wins.

(3) Funds held in internet wagering accounts must not be automatically transferred by an

internet gaming operator or internet gaming platform provider. An internet gaming

operator or internet gaming platform provider must not require an authorized

participant to transfer funds from his or her internet wagering account, in order to

circumvent this rule.

(4) Amounts available to authorized participants for play that are not redeemable for

cash may be excluded from the reserve computation.

(5) On request, the board may allow an internet gaming operator or internet gaming

platform provider to combine the reserve for all of its Michigan internet gaming, or

all of its Michigan internet sports betting conducted under the lawful sports betting

act, 2019 PA 149, MCL 432.401 to 432.419, or both.

(6) An internet gaming operator or internet gaming platform provider must have access

to all internet wagering account and transaction data to ensure the amount of its

reserve is sufficient. Unless otherwise directed by the board, an internet gaming

operator or internet gaming platform provider must file a monthly attestation with

the board, in the form and manner prescribed by the board, that funds have been

safeguarded under this rule.

(7) The board may audit an internet gaming operator’s or internet gaming platform

provider’s reserve at any time and may direct an internet gaming operator or internet

gaming platform provider to take any action necessary to ensure the purposes of this

rule are achieved, including but not limited to requiring the internet gaming operator

or internet gaming platform provider to modify the form of its reserve or increase the

amount of its reserve.

R 432.645 Voiding of internet wagers.

Rule 645. An internet gaming operator or internet gaming platform provider may not

void a completed internet wager without board approval unless a void is necessary to

resolve an internet gaming platform or internet game error or malfunction.

R 432.647 Negative internet wagering account balance prohibited.

Rule 647. An internet gaming platform must employ a mechanism that can detect and

prevent any internet wagering or withdrawal activity initiated by an authorized

participant that would result in a negative balance of the internet wagering account.

R 432.648 Minimum and maximum internet wager.

Rule 648. Unless otherwise prescribed by the board, there must be no limitation as to

the minimum or maximum internet wager an internet gaming operator or internet gaming

platform provider may accept. This rule does not preclude an internet gaming operator or

internet gaming platform provider from establishing its own minimum or maximum

internet wagers or limiting an authorized participant’s internet wager for reasons

45

considered necessary or appropriate by the internet gaming operator or internet gaming

platform provider.

R 432.649 Tournaments/contests and bonus and promotional wagering.

Rule 649. (1) An internet gaming operator or internet gaming platform provider may

conduct an internet gaming tournament or contest on an authorized game subject to all of

the following:

(a) No internet gaming tournament or contest will be conducted unless the internet

gaming operator or internet gaming platform provider, before the first time a

tournament or contest type is offered, files written notice with the board of its

intent to offer that tournament or contest type. The internet gaming operator or

internet gaming platform provider may file a master tournament list with the

board to satisfy this requirement.

(b) Each internet gaming operator or internet gaming platform provider must

maintain a record of each tournament or contest type it offers, which must

address, at a minimum, all of the following:

(i) Internet game type (for example, hold 'em poker).

(ii) Rules concerning tournament or contest play and participation.

(iii)Entry fee amount or amounts per participant.

(iv)Funding source amount or amounts comprising the prize pool (for example,

buy-ins, re-buys, or add-ons).

(v) Prize structure on payout.

(vi)Methodology for determining winner or winners.

(2) An internet gaming operator or internet gaming platform provider may conduct

internet gaming bonus and promotional wagering offers subject to all of the

following:

(a) An internet gaming operator or internet gaming platform provider must

maintain a record of all bonus and promotional wagering offers related to

internet gaming in an electronic file that is readily available to the board.

(b) All bonus and promotional wagering offers must be stated in clear and

unambiguous terms and must be accessible by the authorized participant

after the offer is accepted and before completion.

(c) Offer terms and the record of all offers must include all of the following at

a minimum:

(i) The date and time the offer is active and expires.

(ii) Authorized participant eligibility, including any limitations on

participation.

(iii)Any restriction on withdrawals of funds.

(iv)Wagering requirements and limitations by type of internet game.

(v) The order in which funds are used for internet wagers.

(vi)Eligible internet games.

(vii) Rules regarding cancellation.

(3) An internet gaming platform or internet gaming platform provider must provide a

clear and conspicuous method for an authorized participant to cancel his or her

participation in a bonus or promotional wagering offer that utilizes restricted gaming

credits that cannot be cashed out until a wagering requirement or other restrictions

46

associated with the credits is met. If an authorized participant elects to proceed with

cancellation, unrestricted funds remaining in an internet wagering account must be

returned according to the terms and conditions.

(4) Once an authorized participant has met the terms of a bonus or promotional wagering

offer, an internet gaming operator or internet gaming platform provider must not limit

winnings earned while participating in the offer.

(5) Internet gaming operators or internet gaming platform providers may utilize celebrity

authorized participants or other authorized participants to participate in peer-to-peer

games for advertising or publicity purposes. Such authorized participants may have their

internet wagering account funded in whole or in part by an internet gaming operator or

internet gaming platform provider.

(6) An internet gaming operator or internet gaming platform provider may pay a fee to

the celebrity authorized participant. If a celebrity authorized participant is utilized and the

celebrity authorized participant generates winnings that the internet gaming operator or

internet gaming platform provider does not permit the celebrity authorized participant to

retain, the winnings must be included in gross receipts in a manner approved by the

board.

PART 5. INTERNET WAGERING ACCOUNTS

R 432.651 Single wagering account in use for internet wagering.

Rule 651. (1) An internet gaming operator or internet gaming platform provider shall

limit each authorized participant to one internet wagering account and username. Each

internet wagering account must be all of the following:

(a) Non-transferable.

(b) Unique to the authorized participant who establishes the internet wagering account.

(c) Distinct from any other account number that the authorized participant may have

established with the internet gaming operator or internet gaming platform provider

except as set forth in subrule (2).

(2) An internet wagering account must be separate and distinct from an internet sports

betting account established under the lawful sports betting act, 2019 PA 149, MCL

432.401 to MCL 432.419. Notwithstanding the foregoing, an internet wagering account

may be integrated with an internet sports betting account, subject to all of the following

conditions:

(a) Internet gaming transactions must be identified, recorded, accounted for, and

reported separately and distinctly from internet sports betting transactions

conducted under the lawful sports betting act, 2019 PA 149, MCL 432.401 to

MCL 432.419.

(b) An internet gaming operator or internet gaming platform provider must

comply with all applicable provisions of the act and these rules and any other

conditions considered appropriate by the board.

(3) An internet gaming operator or internet gaming platform provider must implement

internal controls and publish procedures to terminate all accounts of any individual who

47

establishes or seeks to establish multiple active internet wagering accounts, whether

directly or by use of another individual as a proxy.

R 432.651a Age and identity verification.

Rule 651a. (1) An internet gaming operator or internet gaming platform provider must

verify an individual’s identity before allowing that individual to create an internet

wagering account and place an internet wager.

(2) Only an individual who is 21 years of age or older and not a prohibited person may

create an internet wagering account, deposit funds, or participate in internet wagering.

The internet gaming operator or internet gaming platform provider must deny the ability

to create an internet wagering account, deposit funds, or participate in internet wagering

to any individual who is under 21 years of age or is a prohibited person. This subrule

shall not be construed to prevent an individual from creating an internet gaming account

and depositing funds to such an account even if they are prohibited from placing certain

wagers.

(3) An internet gaming operator or internet gaming platform provider must use

commercially available and demonstrable standards to confirm that an individual

attempting to create an internet wagering account is not a prohibited person.

(4) Third-party service providers may be used for age and identity verification of

individuals attempting to create internet wagering accounts.

R 432.651b Data security of age and identity verification information.

Rule 651b. Details of the age and identity verification process must be kept by the

internet gaming operator or internet gaming platform provider in a secure manner

approved by the board.

R 432.651c Handling of internet wagering accounts found to be used in fraudulent

manner.

Rule 651c. An internet gaming operator or internet gaming platform provider must have

a documented system of internal controls for the handling of authorized participants or

other individuals discovered to be using internet wagering accounts in a fraudulent

manner, including, but not limited to the following:

(a) The maintenance of information about any authorized participant’s activity or other

individual’s activity, such that if fraudulent activity is detected, the internet gaming

operator or internet gaming platform provider and the board have all of the necessary

information to take appropriate action.

(b) The suspension of any internet wagering account discovered to be providing

fraudulent access to prohibited persons.

(c) The treatment of deposits, internet wagers, and wins associated with a prohibited

person’s fraudulent use of an account and the confiscation of any winnings and things of

value of a prohibited person in accordance with part 7 of these rules.

R 432.652 Terms and conditions for internet wagering accounts.

Rule 652. (1) All terms and conditions for internet wagering accounts must be included

in the internal controls of the internet gaming operator or internet gaming platform

48

provider and address all aspects of the internet wagering, including, but not limited to all

of the following:

(a) Name of the party or parties with whom the individual is entering into a

contractual relationship, including any licensee.

(b) Individual's consent to have the internet gaming operator or internet gaming

platform provider confirm the individual's age and identity.

(c) Rules and obligations applicable to the authorized participant including, but not

limited to, all of the following:

(i) Prohibition from allowing any other individual to access or use his or her

internet wagering account.

(ii) Prohibition from engaging in internet wagering activity unless physically

present in Michigan or another jurisdiction authorized under a

multijurisdictional internet gaming agreement entered into in accordance

with the act.

(iii)Prohibition from placing an internet wager while physically present in

another jurisdiction on an internet game not authorized by the act and a

multijurisdictional internet gaming agreement.

(iv)Consent to the monitoring and recording by the internet gaming operator,

internet gaming platform provider, or the board, or all 3 of any internet

wagering communications and geographic location information.

(v) Consent to the jurisdiction of this state to resolve any disputes arising out of

internet wagering.

(vi)Prohibition against utilizing automated computerized software or other

equivalent mechanism, such as a "bot," to engage in play.

(d) Full explanation of all fees and charges imposed upon an authorized participant

related to internet wagering transactions.

(e) Availability of internet wagering account statements detailing the authorized

participant’s internet wagering account activity.

(f) Privacy policies, including information access.

(g) Legal age policy, including a statement that it is a criminal offense to allow an

individual who is under the age of 21 to participate in internet wagering.

(h) Full explanation of all rules applicable to dormant internet wagering accounts.

(i) Authorized participant’s right to set responsible gaming limits and to self-

exclude.

(j) Authorized participant’s right to suspend his or her internet wagering account

for a period of no less than 72 hours.

(k) Actions that will be taken if an authorized participant becomes disconnected

from the internet gaming platform during game play.

(l) Notice that a malfunction voids all pays.

(m)Estimated time period for withdrawal of funds from an internet wagering

account.

(2) If the internet gaming terms and conditions are changed, the internet gaming

operator or internet gaming platform provider shall require the authorized participant

to acknowledge acceptance of the change. Unless otherwise authorized by the board,

the authorized participant’s acknowledgement must be date and time stamped by the

internet gaming platform.

49

R 432.653 Authorized participant protections.

Rule 653. (1) An internet gaming operator or internet gaming platform provider must

provide an authorized participant protection information page that must be readily

accessible to each authorized participant. The authorized participant protection page must

be accessible to an authorized participant throughout an authorized participant session.

The authorized participant protection page must contain, at a minimum, all of the

following:

(a) Method for changing or retrieving a password or other approved access security

feature and the ability to choose "strong authentication" login protection.

(b) Method for filing a complaint with the internet gaming operator or internet

gaming platform provider.

(c) Method for filing with the board an unresolved complaint after all reasonable

means to resolve the complaint with the internet gaming operator or internet

gaming platform provider have been exhausted utilizing forms and in the manner

prescribed by the board.

(d) Method for obtaining a copy of the internet wagering terms and conditions

agreed to when establishing an internet wagering account.

(e) Method for the authorized participant to obtain his or her internet wagering

account and game history from the internet gaming operator or internet gaming

platform provider.

(f) Notification that underage gambling is a criminal offense and that anyone who

facilitates an individual under the age of 21 to place an internet wager has

committed a criminal offense and must be prohibited from internet gaming.

(g) Notification that the authorized participant is responsible for configuring his or

her terminal's auto-lock feature to protect the terminal from unauthorized use.

(h) Notification that an authorized participant is prohibited from allowing any other

individual to access or use his or her internet wagering account.

(i) Information about potential risks associated with excessive participation in

internet wagering, and where to get help related to gaming responsibly.

(j) A list of the available authorized participant protection measures that can be

invoked by the authorized participant, such as self-imposed limits, and

information on how to invoke those measures.

(k) Mechanisms in place for authorized participants to detect unauthorized use of

their internet wagering account, such as the authorized participant reviewing

credit card statements against known deposits.

(l) Other authorized participant protections authorized by the board.

(2) Authorized participants must be provided with an easy and obvious method to impose

limitations for internet wagering parameters including, but not limited to, deposits,

wagers, and time-based limitations. The self-imposed limitation method must provide

the following functionality:

(a) Upon receiving any self-imposed limitation order, the internet gaming operator

or internet gaming platform provider must ensure that all specified limits are

correctly implemented immediately or at the time that was clearly indicated to

the authorized participant.

50

(b) The self-imposed limitations set by an authorized participant must not override

more restrictive internet gaming operator or internet gaming platform provider-

imposed limitations. The more restrictive limitations must take priority.

(c) Once established by an authorized participant and implemented by the internet

gaming platform, it must only be possible to reduce the severity of self-imposed

limitations upon 24 hours’ notice, or as required by the board.

(d) Self-imposed limitations must not be compromised by internal status events,

such as self-imposed exclusion.

(3) The self-imposed limitations must be available to the authorized participant

immediately after the internet wagering account is created, when placing a deposit

into his or her internet wagering account, and upon logging into his or her internet

wagering account.

R 432.654 Responsible gaming.

Rule 654. Each internet gaming operator’s website or internet gaming platform must

display a responsible gaming logo in a manner approved by the board to direct an

authorized participant to the internet gaming operator’s website or internet gaming

platform responsible gaming page. The responsible gaming page must be accessible to an

authorized participant during an authorized participant session and must contain, but is

not limited to, the following:

(a) A prominent message, that states "If you or someone you know has a gambling

problem and wants help, call the Michigan Department of Health and Human

Services Gambling Disorder Help-line at: 800-270-7117”.

(b) A direct link to the Michigan Gaming Control Board Compulsive/Problem

Gambling website (https://www.michigan.gov/mgcb/0,4620,7-351-79256-231582-

-,00.html ) and other organizations based in the United States dedicated to helping

people with potential gambling problems.

(c) A clear statement of the internet gaming operator’s or internet gaming platform

provider’s policy and commitment to responsible gaming.

(d) Other responsible gaming measures required by the board.

R 432.655 Internet wagering account requirements.

Rule 655. To establish an internet wagering account, an internet gaming operator or

internet gaming platform provider must do all of the following:

(a) Create an electronic authorized participant file, which must, at a minimum, include

the following:

(i) The authorized participant’s legal name.

(ii) The authorized participant’s date of birth.

(iii) The authorized participant’s Social Security number, or the last 4 digits of the

Social Security number, or an equivalent identification number for a noncitizen

authorized participant, such as a passport or taxpayer identification number.

(iv) The authorized participant’s internet wagering account number or username.

(v) The authorized participant’s residential address. A post office box is not

acceptable.

(vi) The authorized participant’s electronic mail address.

(vii) The authorized participant’s telephone number.

51

(viii) Any other information collected from the authorized participant used to verify

his or her identity.

(ix) The method used to verify the authorized participant’s identity.

(x) The date of verification.

(b) Encrypt all of the following information contained in an electronic authorized

participant file:

(i) Any portion of the authorized participant’s Social Security number or equivalent

identification number for a noncitizen authorized participant, such as a passport or

taxpayer identification number.

(ii) The authorized participant’s passwords and PINs.

(iii) The authorized participant’s personal financial information.

(c) Verify the authorized participant’s age and identity and record the date of verification

in accordance with any of the following:

(i) Reliable forms of personal identification specified in the internet gaming

operator’s or internet gaming platform provider’s internal controls.

(ii) Other methodology for remote multi-source authentication, which may include

third-party and governmental databases, as approved by the board.

(d) Record the document number of the government issued identification credential

examined, if applicable. If a government issued identification credential is not required

for registration, the electronic record that details the process used to confirm the

authorized participant’s identity must be recorded.

(e) Require the authorized participant to establish a password or other access security

feature as approved by the board and advise the authorized participant to utilize strong

authentication login protection.

(f) Record the authorized participant’s acceptance of the internet gaming operator’s or

internet gaming platform provider’s internet wagering terms and conditions to participate

in internet gaming through the internet gaming operator’s or internet gaming platform

provider’s website.

(g) Record the authorized participant’s certification that the information provided to the

internet gaming operator or internet gaming platform provider is accurate.

(h) Record the authorized participant’s acknowledgment that the legal age for internet

wagering is 21, and that he or she is prohibited from allowing any other individual to

access or use his or her internet wagering account.

(i) Notify the authorized participant of the establishment of the account via electronic

mail.

R 432.655a Internet wagering account funding.

Rule 655a. An authorized participant’s internet wagering account may be funded

through the use of any of the following:

(a) An authorized participant’s credit or debit card.

(b) An authorized participant’s deposit of cash or cash equivalent at a cashiering location

approved by the board.

(c) An authorized participant’s reloadable prepaid card, which has been verified as being

issued to the authorized participant and is non-transferable.

(d) Promotional credit.

(e) Winnings.

52

(f) Adjustments made by the internet gaming operator or internet gaming platform

provider with documented notification to the authorized participant.

(g) ACH transfer, provided that the internet gaming operator or internet gaming platform

provider has security measures and controls to prevent ACH fraud regarding failed

ACH deposits.

(h) Wire transfer.

(i) Any other means approved by the board.

R 432.655b Failed ACH deposits.

Rule 655b. A failed ACH deposit attempt is not considered fraudulent if the authorized

participant has successfully deposited funds via an ACH transfer on a previous occasion

with no outstanding chargebacks. Otherwise, the internet gaming operator or internet

gaming platform provider shall do all of the following:

(a) Temporarily block the authorized participant’s internet wagering account for

investigation of fraud after 5 consecutive failed ACH deposit attempts within a 10-

minute period. If there is no evidence of fraud, the block may be vacated.

(b) Suspend the authorized participant’s internet wagering account after 5 additional

consecutive failed ACH deposit attempts within a 10-minute period.

R 432.655c Transfer of funds prohibited.

Rule 655c. An internet gaming operator or internet gaming platform provider must not

permit an authorized participant to transfer funds from one authorized participant’s

internet wagering account to another authorized participant’s internet wagering account

or any other wagering account belonging to another authorized participant.

R 432.655d Authorized participant account withdrawal.

Rule 655d. (1) An authorized participant must be allowed to withdraw the funds

maintained in his or her internet wagering account, whether the account is open or closed,

except as otherwise provided in these rules, or any other applicable state or federal law.

(2) An internet gaming operator or internet gaming platform provider must honor the

authorized participant's request to withdraw funds within 10 business days after the

request, unless the conditions set forth in subrule (3) of this rule are met.

(3) The internet gaming operator or internet gaming platform provider may decline to

honor an authorized participant’s request to withdraw funds only if the internet gaming

operator or internet gaming platform provider believes in good faith that the authorized

participant engaged in either fraudulent conduct or other conduct that would put the

internet gaming operator or internet gaming platform provider in violation of the act and

these rules. In such cases, the internet gaming operator or internet gaming platform

provider must do all of the following:

(a) Provide notice to the authorized participant of the nature of the investigation of the

internet wagering account.

(b) Conduct its investigation in a reasonable and expedient fashion, providing the

authorized participant additional written notice of the status of the investigation

every tenth business day starting from the day the original notice was provided to

the authorized participant.

53

(4) For purposes of this rule, a request for withdrawal is considered honored if it is

processed by the internet gaming operator or internet gaming platform provider

notwithstanding a delay by a payment processor, credit card issuer, or the custodian of a

financial account.

R 432.655e Internet wagering account review requirements.

Rule 655e. All adjustments to internet wagering accounts for amounts of $500.00 or

less must be periodically reviewed by supervisory personnel as set forth in the internet

gaming operator’s or internet gaming platform provider’s internal controls. All other

adjustments must be authorized by supervisory personnel before being entered.

R 432.656 Internet wagering account information.

Rule 656. (1) An internet gaming platform must provide an account statement with

account details to an authorized participant on demand, which must include detailed

account activity for at least 6 months. In addition, an internet gaming platform must,

upon request, be capable of providing a summary statement of all authorized participant

activity during the past 2 years. Information provided on the summary statement must

include, but not be limited to, the following:

(a) Deposits to the internet wagering account.

(b) Withdrawals from the internet wagering account.

(c) Win or loss statistics.

(d) Beginning and ending internet wagering account balances.

(e) Self-imposed limit history, if applicable.

(2) An internet gaming operator or internet gaming platform provider must periodically

re-verify an authorized participant’s identification upon reasonable suspicion that the

authorized participant’s identification has been compromised.

R 432.657 Internet wagering account closure.

Rule 657. An internet gaming platform must provide a conspicuous and readily

accessible method for an authorized participant to close his or her internet wagering

account through the account management or similar page or through the internet gaming

platform customer support team. Any balance remaining in an internet wagering account

closed by an authorized participant shall be refunded pursuant to the internet gaming

operator’s or internet gaming platform provider’s internal controls.

R 432.658 Internet wagering dormant accounts.

Rule 658. An internet gaming operator or internet gaming platform provider shall

consider an internet wagering account to be dormant if the authorized participant has not

logged into the internet wagering account for at least 3 years. A dormant internet

wagering account must be closed by the internet gaming operator or internet gaming

platform provider. Any balance remaining in a dormant internet wagering account must

be refunded or escheated in accordance with the internet gaming operator’s or internet

gaming platform provider’s internal controls.

R 432.659 Suspension and restoration of internet wagering accounts.

54

Rule 659. (1) An internet gaming platform must employ a mechanism that places an

internet wagering account in a suspended mode under any of the following conditions:

(a) When requested by the authorized participant for a specified period of time, which

must not be less than 72 hours.

(b) When required by the board.

(c) Upon a determination that an authorized participant is a prohibited person.

(d) When initiated by an internet gaming operator or internet gaming platform

provider that has evidence that indicates any of the following:

(i) Illegal activity.

(ii) A negative internet wagering account balance.

(iii) A violation of the internet wagering account terms and conditions has taken

place on an authorized participant’s internet wagering account.

(2) When an internet wagering account is in a suspended mode, the internet gaming

platform must do all of the following:

(a) Prevent the authorized participant from internet wagering.

(b) Prevent the authorized participant from depositing funds unless the account is

suspended due to having a negative internet wagering account balance but only to

the extent the internet wagering account balance is brought back to zero dollars.

(c) Prevent the authorized participant from withdrawing funds from his or her

suspended account, unless the suspended mode was initiated by the authorized

participant.

(d) Prevent the authorized participant from making changes to his or her internet

wagering account.

(e) Prevent the removal of the internet wagering account from the internet gaming

platform.

(f) Prominently display to the authorized participant that the internet wagering

account is in a suspended mode, the restrictions placed on the internet wagering

account, and any further course of action needed to remove the suspended mode.

(3) A suspended account may be restored for any of the following reasons:

(a) Upon expiration of the time period established by the authorized participant.

(b) If authorized by the board.

(c) When the authorized participant is no longer a prohibited person.

(d) When the internet gaming operator or internet gaming platform provider has lifted

the suspended status.

PART 6. AUDIT AND INTERNAL CONTROLS

R 432.661 Internal control standards applicability of part.

Rule 661. This part applies to internet gaming operators and internet gaming platform

providers.

R 432.662 Purpose.

Rule 662. The procedures of the internal control standards are designed to ensure all of

the following:

55

(a) Assets are safeguarded.

(b) The financial records of the internet gaming operator and internet gaming platform

provider are accurate and reliable.

(c) The transactions of the internet gaming operator and internet gaming platform

provider are performed only in accordance with the act and these rules.

(d) The transactions are recorded adequately to permit the proper recording of the

adjusted gross receipts, fees, and all applicable taxes and payments.

(e) Accountability of assets is maintained pursuant to generally accepted accounting

principles.

(f) Only authorized personnel have access to assets.

(g) Internet wagering account balances are complete and accurate, and appropriate action

is taken with respect to discrepancies.

(h) Internet wagering accounts and personal identifiable information are adequately

protected.

(i) The functions, duties, and responsibilities are appropriately segregated and performed

pursuant to sound practices by competent, qualified personnel and that no employee of

the internet gaming operator, the internet gaming platform provider, a supplier, a

registered vendor, or a third-party provider is in a position to perpetuate and conceal

errors or irregularities in the normal course of the employee’s duties.

(j) Internet gaming is conducted with integrity and in accordance with the act and these

rules.

R 432.663 Board approval of internal control standards and requirements.

Rule 663. (1) Unless otherwise provided for by the board, before beginning internet

gaming, an internet gaming operator or internet gaming platform provider, or both, must

submit its administrative and accounting procedures in detail in a written system of

internal control for board review and written approval. A written system of internal

controls must include a detailed narrative description of the administrative and

accounting procedures designed to satisfy the requirements of these rules.

(2) The written system of internal controls must address the following items, at a

minimum:

(a) Procedures for responding to a failure of the internet gaming platform (i.e.,

game, system, communications, or platform malfunction), including procedures

for restoring internet gaming. The internet gaming operator or internet gaming

platform provider, or both, must also file with the board an incident report for

each significant platform failure and document the date, time, and reason for the

failure along with the date and time the system is restored.

(b) User access controls for all internet gaming personnel.

(c) Segregation of duties.

(d) Automated and manual risk management procedures.

(e) Procedures for identifying and reporting fraud and suspicious conduct.

(f) Procedures to prevent wagering by prohibited persons.

(g) Procedures for internet gaming operator-imposed or internet gaming platform

provider-imposed exclusion of authorized participants, including the following:

56

(i) Providing a notification containing operator-imposed or internet gaming

platform provider-imposed exclusion status and general instructions for

resolution.

(ii) Ensuring that immediately upon executing the operator-imposed or internet

gaming platform provider-imposed exclusion order, no new wagers or

deposits are accepted from the authorized participant, until such time as the

operator-imposed or internet gaming platform provider-imposed exclusion

has been revoked.

(iii) Ensuring that the authorized participant is not prevented from withdrawing

any or all of his or her account balance, if the internet gaming operator or

internet gaming platform provider acknowledges that the funds have

cleared, and that the reason or reasons for exclusion would not prohibit a

withdrawal.

(h) Description of anti-money laundering compliance standards.

(i) Process for submitting or receiving approval of all types of internet games and

wagers available.

(j) Description of process for accepting wagers and issuing payouts, plus any

additional controls for accepting wagers and issuing payouts in excess of

$10,000.00.

(k) Description of process for voiding or cancelling wagers and refunding the

authorized participant in accordance with these rules.

(l) Description of process for accepting multiple wagers from one authorized

participant in a 24-hour cycle, including process to identify authorized

participant structuring of wagers to circumvent recording and reporting

requirements.

(m) Procedure for the recording of and reconciliation of internet gaming transactions.

(n) Procedures for issuance and acceptance of promotional funds for internet

gaming.

(o) Description of all integrated third-party platforms.

(p) Procedures for identifying and restricting prohibited persons.

(q) Description of process to close out dormant accounts.

(r) Procedures for making adjustments to an internet wagering account, providing a

method for an authorized participant to close out an account and how an

authorized participant will be refunded after the closure of an account or how

funds will be escheated.

(s) Procedures to verify each authorized participant's physical location pursuant to

part 3 of these rules.

(t) Procedures for the security and sharing of personal identifiable information of an

authorized participant, funds or financial information in an internet wagering

account, and other information as required by the board. The procedures must

include the means by which an internet gaming operator or internet gaming

platform provider, or both, will provide notice to an authorized participant

related to the sharing of personal identifiable information.

(u) Detailed responsible gaming measures.

(v) Method for securely implementing the responsible gaming database.

57

(w) Methods for securely issuing, modifying, and resetting an authorized

participant’s account password, personal identification number (PIN), or other

approved security feature, if applicable. Any method must include notification

to the authorized participant following any modification via electronic or regular

mail, text message, or other manner approved by the board. Such methods must

include, at a minimum, one of the following:

(i) Proof of identity, if in person.

(ii) The correct response to 2 or more challenge questions.

(iii) Strong authentication.

(x) Procedures for receiving, investigating, and responding to all authorized

participant complaints.

(y) In detail, the location of the internet gaming servers, including any third-party

remote location servers, and what controls will be in place to ensure security of

the internet gaming servers.

(z) Technical security standards (controls) required by these rules.

(aa) Procedures for registration of authorized participants and establishing internet

wagering accounts, including a procedure for authenticating the age, identity,

and physical address of an applicant for an internet wagering account and

whether the applicant is prohibited from establishing or maintaining an account

under applicable laws or regulations.

(bb) Procedures for terminating an internet wagering account and the return of any

funds remaining in the internet wagering account to the authorized participant or

confiscation of funds in accordance with these rules.

(cc) Procedures for the logging in and authentication of an authorized participant to

enable the authorized participant to commence internet gaming and the logging

off of the authorized participant when the authorized participant has completed

play, including a procedure to automatically log an authorized participant out of

the internet wagering account after a specified period of inactivity.

(dd) Procedures for the crediting and debiting of an internet wagering account.

(ee) Procedures for withdrawing funds from an internet wagering account by the

authorized participant.

(ff) Procedures for the protection of an authorized participant’s funds, including the

segregation of an authorized participant’s funds from operating funds of the

internet gaming operator or internet gaming platform provider, or both.

(gg) Procedures and security for the calculation and recording of gross receipts,

adjusted gross receipts, and winnings.

(hh) Procedures and security standards as to receipt, handling, and storage of internet

gaming equipment.

(ii) Procedures and security standards to protect and respond to an individual's

suspected or actual hacking of or tampering with the internet gaming operator’s

or internet gaming platform provider’s internet gaming website or internet

gaming devices and associated equipment.

(jj) Procedures and appropriate measures implemented to deter, detect, and, to the

extent possible, prevent cheating, including collusion, and use of cheating

devices, including the use of software programs that make bets according to

algorithms.

58

(kk) Procedures to govern emergencies, including suspected or actual cyber-attacks

on, hacking of, or tampering with the internet gaming platform, internet gaming

website or internet gaming devices and associated equipment. The procedures

must include the process for the reconciliation or repayment of an authorized

participant's internet wagering account.

(ll) Policies and procedures in connection with the internal audit function of its

internet gaming operations.

(mm) Establishing policies and procedures with respect to credit.

(nn) Any other items considered necessary by the board.

(3) To the extent a third-party is involved in or provides any of the internal controls

required in these rules, the internet gaming operator’s or internet gaming platform

provider’s internal controls, or the controls of both of them, must document the roles and

responsibilities of the third-party and must include procedures to evaluate the adequacy

of and monitor compliance with the third-party’s internal control procedures.

R 432.663a Amendments to internal controls.

Rule 663a. Unless otherwise provided by the board, all of the following provisions

apply to amendments to the internal control procedures:

(a) Amendments to any portion of the internal control procedures must be submitted to

the board for approval. If within 30 days the board has not approved, denied, or

otherwise provided written notice, an internet gaming operator or internet gaming

platform provider, or both, may implement the amended internal controls as submitted

with the board retaining its authority to require further amendment, approval, or denial.

(b) The board may, in writing, approve, deny, or require a revision to the amendment to

the internal control procedures. If the internet gaming operator or internet gaming

platform provider, is notified of a required revision, the internet gaming operator or

internet gaming platform provider must work with the board to address the revision.

(c) If the board requests additional information, clarification, or revision of an

amendment to an internal control and the internet gaming operator or internet gaming

platform provider, or both, fail to satisfy the request within 30 days after the board

request, the board shall consider the amendment denied and it cannot be implemented

or, if previously implemented under subdivision (a) of this rule, the internet gaming

operator or internet gaming platform provider has 15 days to cease implementation of

that amendment. If the internet gaming operator or internet gaming platform provider

subsequently wants to pursue the amendment, it must resubmit the request along with

the additional information previously requested by the board.

R 432.663b Emergency procedures.

Rule 663b. (1) In the event of an emergency, the internet gaming operator or internet

gaming platform provider, or both, may temporarily amend an internal control procedure.

The executive director or his or her designee must be notified that an emergency exists

before temporarily amending an internal control procedure.

(2) An internet gaming operator or internet gaming platform provider, or both, must

submit the temporary emergency amendment of the internal control procedures to the

executive director or his or her designee within 3 days of the amendment. The

submission must include the detailed emergency procedures that will be implemented

59

and the time period the emergency procedures will be temporarily in place. Any

concerns the board has with the submission must be addressed with the internet

gaming operator or internet gaming platform provider, or both.

(3) As soon as the circumstances necessitating the emergency amendment to the internal

control procedures abate, an internet gaming operator or internet gaming platform

provider, or both, shall resume compliance with the approved internal control

procedures.

R 432.663c Failure to comply with requirements.

Rule 663c. If the board determines that the administrative or accounting procedures or

written internal control procedures of the internet gaming operator or internet gaming

platform, or both, do not comply with the requirements of these rules or require

improvement, the board shall notify the internet gaming operator or internet gaming

platform provider, or both, in writing. Within 15 days after receiving the notification, the

internet gaming operator or internet gaming platform provider must amend its procedures

and written internal control procedures accordingly and must submit, for board approval,

a copy of the written internal control procedures, as amended, and a description of any

other remedial measure taken.

R 432.664 Compliance with internal controls.

Rule 664. (1) Internet gaming operators and internet gaming platform providers must

comply with all internal controls.

(2) If an internet gaming operator or internet gaming platform provider fails to comply

with any provision of its internal controls, the board may initiate a disciplinary action.

R 432.665 Accounting records.

Rule 665. (1) An internet gaming operator and internet gaming platform provider must

maintain complete, accurate, and legible records of all transactions related to their

internet gaming, including transactions pertaining to revenues, expenses, assets,

liabilities, and equity in conformance with generally accepted accounting principles.

(2) The board may direct an internet gaming operator and internet gaming platform

provider to alter the manner in which the records are maintained if the internet gaming

operator’s and internet gaming platform provider’s records are not in accordance with

generally accepted accounting principles or if the records are not in sufficient detail.

(3) The accounting records must be maintained using a double entry system of

accounting with transactions recorded on the accrual basis and supported by detailed

subsidiary records.

(4) The detailed subsidiary records must include, at a minimum, all of the following:

(a) Detailed general ledger accounts identifying all revenue, expenses, assets,

liabilities, and equity.

(b) A record of all investments, advances, loans, and accounts receivable balances

due the establishment.

(c) A record of all loans and other accounts payable.

(d) A record of all accounts receivable written off as uncollectible.

(e) Journal entries prepared.

(f) Tax work papers used in preparation of any state or federal tax return if applicable.

60

(g) Records supporting the accumulation of the costs for complimentary services and

items. A complimentary service or item provided to individuals in the normal course

of an internet gaming business must be recorded in an amount based upon the full

retail price normally charged for the service or item or as is otherwise consistent with

generally accepted accounting principles.

(h) Records required by the internal control system.

(i) Other records that the board requires to be maintained.

(5) The internet gaming operator and internet gaming platform provider must maintain all

records supporting the adjusted gross receipts.

(6)If an internet gaming operator or internet gaming platform provider, or both, fails to

maintain the records used by it to calculate the adjusted gross receipts, the board may

compute and determine the amount upon the basis of an audit conducted by the board

using available information.

R 432.665a Annual audits and annual compliance reports.

Rule 665a. (1) All of the following provisions apply to annual and special audits and

other reports:

(a) The board requires an annual audit of the financial condition of the internet

gaming operator’s and internet gaming platform provider’s total internet gaming

operations. For an internet gaming operator licensed as a casino under the Michigan

Gaming Control and Revenue Act, the audit prepared pursuant to section 14 of the

Michigan Gaming Control and Revenue Act, 1996 IL 1, MCL 432.214, satisfies this

requirement. An independent certified public accountant must perform the annual

audit.

(b) The annual audit must be performed and presented in accordance with generally

accepted accounting principles and contain the opinion of the independent certified

public accountant as to its fair preparation and presentation in accordance with

generally accepted accounting principles.

(c) To assure the integrity of internet gaming and compliance with the act and these

rules, the board may require a special audit of an internet gaming operator or an

internet gaming platform provider, or both, to be conducted by board personnel or an

independent certified public accountant. The board shall establish the scope,

procedures, and reporting requirements of a special audit. For an internet gaming

operator who is an Indian tribe, the scope of the special audit must be limited to the

internet gaming operator’s internet gaming operations.

(2) The board shall require annual compliance reports to be prepared by the internet

gaming operator or the internet gaming platform provider, or both, and submitted in a

manner and form prescribed by the board. The annual compliance report must address all

of the following areas:

(a) Compliance with procedures to ascertain that adjusted gross receipts are

determined and state and local taxes or payments are paid, in conformity with the act

and these rules.

(b) Compliance with applicable ordinances and agreements with other governmental

authorities.

(c) Compliance with internal control procedures, accounting procedures, credit

procedures, dispute procedures, and board-imposed security and safety requirements.

61

(d) A material deviation from the internal control procedures, accounting procedures,

credit and dispute procedures, and board-imposed security and safety requirements.

(e) Corrective action taken to resolve deficiencies observed in subdivisions (a) to (d)

of this subrule.

(f) Other matters required by the board to measure compliance with the act and these

rules.

(3) The board shall determine the date of filing and the number of copies of audits or

reports required under this rule. The audits or reports must be received by the board or

postmarked no later than the required filing date.

(4) The reporting year-end of the internet gaming operator and internet gaming platform

provider is December 31 unless otherwise approved by the board.

R 432.665b Board access to platform data.

Rule 665b. The internet gaming operator or internet gaming platform provider must

provide access to internet gaming platform related data as considered necessary by the

board and in a manner approved by the board.

R 432.666 Records retention.

Rule 666. (1) Each internet gaming operator or internet gaming supplier must maintain,

in a place secure from theft, loss, or destruction, adequate records of its business and

accounting operations. An internet gaming operator or internet gaming supplier must

make the records available to the board, upon request, within a time provided for by the

board. An internet gaming operator or internet gaming supplier must hold the records for

not less than 5 years. The records must include, but not be limited to, all of the following:

(a) All correspondence with, or reports to, the board or any local, state, tribal, or

federal governmental agency.

(b) All correspondence concerning the business of an internet gaming operator or

internet gaming supplier.

(2) An internet gaming operator or internet gaming supplier must keep and maintain, in a

manner and form required by the board, accurate, complete, and legible records of

any books, records, or documents pertaining to, prepared in, or generated by, the

internet gaming operator or internet gaming supplier, including, but not limited to, all

of the following:

(a) Forms.

(b) Reports.

(c) Accounting records.

(d) Ledgers.

(e) Subsidiary records.

(f) Computer generated data.

(g) Internal audit records.

(h) Correspondence.

(i) Personnel records.

(3) An internet gaming operator or internet gaming supplier must keep and maintain the

books, records, or documents in a manner and form approved or required by the board.

62

(4) An internet gaming operator or internet gaming supplier must organize and index all

required records in a manner that enables the board to locate, inspect, review, and analyze

the records with reasonable ease and efficiency.

(5) For an internet gaming operator that is an Indian tribe, records required to be

maintained under this rule are limited to those records related to the internet gaming

operator’s internet gaming operations.

R 432.667 Taxes and payments.

Rule 667. (1) The internet gaming platform must be able to generate reports supporting

adjusted gross receipts, wagering liability, winnings, and any other reports considered

necessary by the board or as required by the internal controls. The reporting must be

done on a form and in the manner prescribed by the board.

(2) An internet gaming operator who fails to remit to the board the tax or payment

imposed under the act is liable for payment of a fine, as determined by the board of up to

25% per month of the amounts ultimately found to be due, to be recovered by the board.

R 432.668 Write-offs/amounts returned/disputed credit or debit charges.

Rule 668. (1) An internet gaming operator shall not receive a deduction from gross

receipts unless written approval is granted by the board for the following:

(a) Amounts returned to an authorized participant because of a game, platform, or

system malfunction or because the internet wager must be voided because of

concerns regarding integrity of the wager or game that were previously included

in the computation of gross receipts.

(b) Uncollectible markers or successfully disputed credit or debit card charges that

were previously included in the computation of gross receipts. Discretionary

write-offs by the internet gaming operator do not constitute an uncollectible

marker.

(2) An internet gaming operator must submit for board review and approval a written

request, including all supporting documentation, of the deductions it would like to

take against gross receipts.

PART 7. RESPONSIBLE GAMING; PROHIBITED PERSON

R 432.671 Establishment and maintenance of the responsible gaming database.

Rule 671. (1) The board shall establish a responsible gaming database that contains a

list of individuals who are prohibited from establishing an internet wagering account or

participating in internet wagering offered by an internet gaming operator.

(2) The executive director may place an individual’s name in the responsible gaming

database for any of the following reasons:

(a) The individual has been convicted in any jurisdiction of a felony, a crime of moral

turpitude, or a crime involving gaming.

(b) The individual has violated the act or another gaming-related law.

63

(c) The individual has performed an act or has a notorious or unsavory reputation

such that the individual's participation in internet wagering under the act would

adversely affect public confidence and trust in internet gaming.

(d) The individual's name is on a valid and current exclusion list maintained by this

state or another jurisdiction in the United States.

(e) A court has ordered the placement of an individual’s name in the responsible

gaming database.

(f) The internet gaming operator or internet gaming platform provider has requested

an individual’s name be included in the responsible gaming database.

(g) Any other reason the executive director considers appropriate to protect the

integrity of internet gaming under the act and these rules.

(3) An internet gaming operator or internet gaming platform provider may request an

individual’s name be included in the responsible gaming database. The request must be

done in the manner and form prescribed by the executive director, but must at a minimum

include all of the following:

(a) The individual’s name and other identifying information.

(b) The reason why the internet gaming operator or internet gaming platform provider

believes the individual should be included.

(c) Any evidence that supports the request.

(d) Any other information requested by the executive director.

(4) If the executive director places an individual in the responsible gaming database, it

shall notify the individual. This notification must include the basis for the individual’s

placement in the responsible gaming database and explain that the individual is

prohibited from establishing an internet wagering account or making an internet wager as

authorized by the act and these rules.

(5) An excluded person may request a hearing under these rules to contest placement in

the responsible gaming database. It is the excluded person’s responsibility to prove by

clear and convincing evidence why he or she should not be in the responsible gaming

database.

(6) Involuntary placement in the responsible gaming database is permanent, unless

removed by the executive director. The executive director shall only remove an excluded

person from the responsible gaming database if the excluded person no longer satisfies

the criteria for placement.

R 432.672 Voluntary placement in the responsible gaming database.

Rule 672. (1) An individual may have his or her name placed in the responsible gaming

database for a period of 1 or 5 years by submitting a request in the manner and form

prescribed by the executive director.

(2) An individual seeking voluntary placement in the responsible gaming database must

agree to release the state, the board and its employees and agents, the internet gaming

operator, the internet gaming platform provider, and each of their respective officers,

directors, employees, and agents from any harm, monetary or otherwise, that may arise as

a consequence of placing his or her name in the responsible gaming database.

(3) The executive director shall not include an individual in the responsible gaming

database until the individual has provided all necessary information.

64

(4) If an internet gaming operator or internet gaming platform provider prohibits a

voluntarily-excluded person in the responsible gaming database from engaging in other

forms of gaming authorized by law in this state or in another jurisdiction, the limitation

shall only be for the 1 or 5 year placement chosen by the voluntarily-excluded person.

R 432.673 Distribution of the responsible gaming database.

Rule 673. (1) The executive director shall provide the internet gaming operator and

internet gaming platform provider with information the executive director considers

necessary to carry out the purposes of the act and these rules.

(2) Internet gaming operators and internet gaming platform providers may only use the

information as provided for in the internal controls and as is consistent with the act and

these rules.

(3) Use of information from the responsible gaming database for a purpose other than

what is provided for in the act or these rules may result in disciplinary action by the board

against the licensee or a civil fine. Nothing in this part is intended to preclude the

disclosure of such information pursuant to subpoena or other legal process.

R 432.674 Self-exclusion list.

Rule 674. (1) Each internet gaming operator and internet gaming platform provider

must establish and maintain a self-exclusion list as prescribed in the act, in these rules, by

direction of the executive director, and in accordance with internal controls.

(2) The self-exclusion list must be designed to safeguard the confidentiality of the

information.

(3) An individual may have his or her name added to the self-exclusion list maintained

by the internet gaming operator or internet gaming platform provider if he or she agrees

to release the state, the board and its employees and agents, the internet gaming operator,

the internet gaming betting platform provider, and each of their respective officers,

directors, employees, and agents from any harm, monetary or otherwise, that may arise as

a consequence of placing his or her name in the responsible gaming database or self-

exclusion list.

(4) Any individual requesting placement in the self-exclusion list must submit through

his or her internet wagering account or by another means authorized by the board, a

completed request for self-exclusion.

(5) An internet gaming operator or internet gaming platform provider may disclose the

names of voluntarily-excluded persons on the self-exclusion list to a person licensed or

registered by the board for the purpose of allowing the third-party to remove the names of

such individuals from a targeted mailing or other advertising or promotion to be made on

behalf of an internet gaming operator or internet gaming platform provider.

(6) A licensed or registered third-party that obtains the self-exclusion list from an

internet gaming operator or internet gaming platform provider is permitted to use the list

solely to exclude names and other information from targeted mailings or other advertising

or promotion made on behalf of the internet gaming operator or internet gaming platform

provider. The third-party to whom the information is disclosed shall not distribute or

disclose the information to the public or any other person. Disclosure may result in

disciplinary action or civil fine.

65

R 432.675 Prohibited persons.

Rule 675. (1) An internet gaming operator and an internet gaming platform provider

must make reasonable efforts to prevent a prohibited person from establishing an internet

wagering account and not permit the prohibited person to place an internet wager based

on the most current information available to the internet gaming operator and internet

gaming platform provider. This subrule shall not be construed to prevent an individual

from creating an internet gaming account and depositing funds to such an account even if

they are prohibited from placing certain wagers.

(2) If an internet gaming operator or internet gaming platform provider detects, or is

notified of, an individual suspected of being a prohibited person who had engaged or is

engaging in prohibited internet wagering, the internet gaming operator or internet

gaming platform provider, or both, must use reasonable measures to verify whether the

individual is prohibited or not. If the internet gaming operator or internet gaming

platform provider cannot establish by reasonable measures that the individual is

prohibited, the individual is presumed to not be a prohibited person for the purposes of

this rule.

(3) Upon verification of a prohibited status, the internet gaming operator or internet

gaming platform provider, or both, must do both of the following:

(a) Immediately prohibit access to the individual’s internet wagering account.

(b) Seize from the individual any winnings or things of value obtained from engaging

in internet wagering.

(4) The internal controls of an internet gaming operator or internet gaming platform

provider must contain procedures for processing any winnings or things of value

confiscated or withheld from a prohibited person.

R 432.676 Duty of internet gaming operator and internet gaming platform provider.

Rule 676. (1) An internet gaming operator and internet gaming platform provider must

make reasonable efforts to prohibit a prohibited person from establishing an internet

wagering account and from participating in internet wagering offered under the act and

these rules. This subrule shall not be construed to prevent an individual from creating an

internet gaming account and depositing funds to such an account even if they are

prohibited from placing certain wagers.

(2) If an internet gaming operator or internet gaming platform provider becomes aware

that a prohibited person has established an internet wagering account or has participated

in internet wagering, the internet gaming operator or internet gaming platform provider

must provide written notice to the executive director. Any wager made by a prohibited

person must be cancelled and the internet wagering account used to place the wager must

be suspended or closed.