by David Vialpando
Evolving technology and consumer demand for access to casino gaming outside of traditional brick-and-mortar gaming establishments has resulted in the popularity of mobile casino gaming. Implementation of this technology has created the need for gaming regulators and Tribal Gaming Regulatory Agencies (TGRAs) to develop regulations to ensure the integrity of the activity, allow access to adults only within authorized locations, and protect tribal assets and consumer data.
Mobile casino gaming involves wagering on games of chance and/or skill using an individual’s electronic device, such as a cell phone, computer, or tablet equipped with wireless internet connection capability. Mobile casino gaming can be either Class II gaming where the gaming activity is confined to tribal lands, or Class III gaming where the activity occurs on tribal lands and/or within the exterior boundaries of a state with whom a tribe has established an agreement to offer mobile casino gaming. Games offered on a mobile casino gaming platform can include slot games; bingo; table games such as roulette, blackjack, poker, and baccarat; sports wagering (mobile sports betting); or hybrid chance/skill games. Live studio gaming may be an option offered through a mobile gaming platform.
A casino operator offering mobile casino gaming may enter into contractual agreements with businesses associated with this form of gaming to include a gaming platform provider, casino game content providers, payment processors, an identity verification entity (also referred to as a Know Your Customer [KYC] provider) geolocation service provider, and social media platforms to advertise and market the mobile casino game offerings. A casino may also contract with another casino operating a mobile casino gaming platform to access a portal to the casino’s existing gaming platform personalized with the contracting casino’s name, logo, and unique identifiers. This unique contracting of a casino’s portal is referred to as a skin. For many tribes, mobile sports betting, whether state-wide, on tribal lands, or within brick-and-mortar casinos, is already a regulated activity.
Regardless of the construct of the gaming platform, class of gaming, or games offered through the platform, TGRAs must promulgate regulations to ensure the integrity, accountability, and consumer protection of the mobile casino gaming platform and gaming activity. In some respects, regulating mobile casino gaming can be easier than regulating gaming in a brick-and-mortar environment and in other respects, more challenging.
For tribes who already offer mobile sports wagering, much of the requirements for that activity can be adapted for use in mobile casino gaming, such as KYC, account management, geolocation, system reporting, system security, and change management. Another good starting point for TGRAs developing mobile casino gaming regulations are the regulations promulgated within 25 CFR Section 547A – Additional Standards for Class II Games Played Using Mobile Devices. The areas where TGRAs should consider drafting regulations include:
- The mobile casino gaming IT infrastructure requirements to include a secure independent network, authentication protocols, communication standards, firewalls and unauthorized access prevention requirements, audit logs, failed network access procedures, power supply and redundancy requirements, and consumer information encryption and protection measures.
- Initial and recurring security testing, including technical security controls, penetration testing, and vulnerability assessments.
- Patron identity and age verification requirements (KYC) and anomaly reporting to the TGRA.
- Mobile casino gaming geofencing requirements, required testing and violation reporting to the TGRA.
- Electronic payment account creation and processing requirements.
- Patron mobile wagering account requirements.
- Game content change management and software verification procedures to include review and approval by the TGRA.
- Platform component change management, including requiring programs which align with the GLI-CMP Change Management Program Guide.
- Mobile casino gaming technical standards requirements and independent testing laboratory certification. A good starting point for these is GLI-19 Interactive Gaming Standards, which have already been adopted in the majority of iGaming states, as well as tribes in Michigan and Connecticut.
- Responsible gaming requirements and patron controls, such as deposit limits, spend limits, and time-based limits.
- Patron information access and security protocols.
- Suspicious activity reporting requirements.
- Bank Secrecy Act (BSA)/Title 31 reporting requirements.
- Patron gaming fund access controls.
- TGRA approval procedures for bonus and promotional wagering.
- TGRA-required reconciliation reports, such as patron account summary report, wagering summary report, dormant account report, performance report, etc.
- Initial and recurring internal control review of the areas listed above.
Day-to-day regulation of mobile casino gaming can be easier in some respects than regulating live casino gaming. For instance, a patron who files a complaint regarding an alleged system malfunction in the middle of game play (and denial of winnings) can be easily investigated by reviewing the archived electronic history of the gaming activity. The disputed game can be replayed along with the patron’s wagering activity and system configuration. No need to rely on subjective witness statements or surveillance footage to determine the facts. Frequently, the cause of the problem is the user’s device not meeting the published gaming platform’s interface requirements or an unstable internet connection at the patron’s location.
In other respects, regulating mobile casino gaming can be more challenging. Gaming software upgrades and configuration changes are typically initiated remotely by game content providers, and if the TGRA is not notified, changes happen without TGRA verification and approval. The casino may request specified bonuses or promotions, and a misentered character or programming error can result in 10,000 credits granted rather than the 100 intended, or a failure to specify the minimum amount of play as requested by the casino before a bonus is awarded may result in unintended bonuses being awarded. Thousands of dollars in potential revenue may be lost before the error is identified and corrected. Mobile casino gaming is fertile ground for credit card and identity thieves. The crime can be perpetrated by the criminal outside the reach of law enforcement and unidentifiable by the casino. Extra vigilance is required by the casino operator and TGRA to ensure that the mobile casino gaming platform is not used to victimize people who may not even be casino patrons.
Mobile casino gaming can be extremely profitable for a casino operator and an engaging source of entertainment for the gaming public, if the gaming solution is properly configured, monitored, and regulated. Regulating the new frontiers of casino gaming can be challenging, but extremely rewarding as well.
David Vialpando is Executive Director of the Pala Gaming Commission and Vice-Chairman of Tribal Gaming Protection Network. He can be reached by calling (760) 510-4559 or email [email protected].