CWA - REMOTE GAMBLING

8/8/2019 CWA - REMOTE GAMBLING

http://slidepdf.com/reader/full/cwa-remote-gambling 1/30

DRAFT

CEN Workshop Agreement

‘Responsible Remote Gambling Measures’

25 July 2010

Warning

This document is not yet approved. It is distributed for review and comment. It is subject tochange without notice and may not be referred to as a CEN Workshop Agreement.

Recipients of this interim draft are invited to submit their comments and documented supportingsuggestions, using the template provided.

This CEN Workshop Agreement has been drafted and approved by a Workshop of representatives of interested parties,the constitution of which is indicated in the foreword of this Workshop Agreement.

The formal process followed by the Workshop in the development of this Workshop Agreement has been endorsed bythe National Members of CEN but neither the National Members of CEN nor the CEN Management Centre can be heldaccountable for the technical content of this CEN Workshop Agreement or possible conflicts with standards orlegislation.

This CEN Workshop Agreement can in no way be held as being an official standard developed by CEN and itsMembers.

This CEN Workshop Agreement is publicly available as a reference document from the CEN Members NationalStandard Bodies.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark,Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom.



Page 2

Document History:CEN Workshop Agreement for 'Responsible Remote Gambling Measures’

Document Location: To be assigned .Validity: To be assigned .File name: To be assigned

Change History:

Date Version(n.rrr)

Changes

2010-07-25 0.0

Please submit any comments on this document to:

Ms. Charlotte Mosies Standardisation consultantNEN-Consumer Products &ServicesVlinderweg 6

NL-2623 AX DelftThe NetherlandsTel.+ 31 152 690 133

[email protected]

Mr. Andrew Beveridge eCOGRA Limited2/F Berkeley Square HouseBerkeley Square, LondonW1J 6BDUnited KingdomTel: +44 207 887 1480

[email protected]

Mr. Maarten Haijer European Betting and GamingAssociation (EGBA)11, Rond Point Schuman1040 Brussels

Belgium

Tel: +32 2 256 7527

[email protected]

mailto:[email protected]








Page 3

Contents

Contents ......................................................................................................................................... 3 Foreword ........................................................................................................................................ 4 Introduction ..................................................................................................................................... 6 1 Scope .................................................................................................................................... 7 2 Normative References ........................................................................................................... 8 3 Definitions .............................................................................................................................. 9 4 Responsible Remote Gambling Control Measures .............................................................. 13 5 Annex A (Informative) – Non-Exhaustive List of Existing Responsible Gambling

Regulations, Measures and Codes ...................................................................................... 29



Page 4

Foreword

This document is a working document.

The objective of the CEN Workshop on 'Responsible Remote Gambling Measures‟ is to create apolicy tool that can be used by policy makers to address the challenges of developing a safe andsecure remote gambling environment. By its nature, a CEN Workshop Agreement (CWA) is notlegally binding and will therefore be applied on a voluntary basis by participating operators.

Ultimately, the CWA has the potential to inform policy makers of the standards needed to maintaina responsible, safe and secure remote gambling environment and be used as a benchmark forcompliance with best practices by operators, software providers, associated service providers andother relevant industry stakeholders in the field of remote gambling.

This CEN Workshop commenced in May 2010 and held its final meeting in September 2010.

The CWA sets out the measures required to achieve the promotion of responsible remote

gambling.

(It went through a public comment phase from 25th July until 25th of September 2010)

The CEN Workshop included 27 participants from the remote gambling sector. This includesrepresentatives of trade associations, licensing authorities, experts on gaming behaviour,associations of players and operators.

Sigrid Ligne EGBA

Maarten Haijer EGBA

Clive Hawkswood RGA

Andrew Beveridge eCOGRA Limited

Sarah Winterton KW Communications

Charlotte Mosies NEN

Samuel Laurinkari Blueprint

Peter Reynold Party Gaming

Nicolas Gibbon BetFair

Thomas Murphy William Hill Org LTD

Kristoffer Cassel Unibet

Khailid Ali ESSA

Wolfgang Zankl Juranovit

Michael Levi Cardiff University

Ynze Remmers G4

Lisa Lombardi Mangas Gaming



Page 5

Joachim Heusler Bwin

Birgit Bosch Interwetten

George Debrincat Malta Remote Gaming Council

Stella Dalton Gamcare

Joerg Haefeli Hochschule Luzern

Gerhard Buehringer TU Dresden

Melody Morgan-Busher Personal Capacity

Marie Cecile Grisard PMU

Howard Shaffer Harvard Medical School -The Cambridge Health Alliance Divisionon Addictions

Helmut Kafka Automatenverband Austria

Fatma Bensalem AFNOR

Comments or suggestions from the users of the CWA are welcome and should be addressed tothe Secretariat.



Page 6

Introduction

The objective of the CEN Workshop on „Responsible Remote Gambling Measures‟ is to developControl Measures that are capable of adequately protecting customers and ensuring that the

remote gambling operators, software suppliers and associated service providers behaveresponsibly.

The European gambling market has multiple different regulations, directives, standards, codes andrules governing remote gambling and these frequently vary by Member State. In the absence ofpan-European regulation, the objective of this Workshop is to develop evidence-based and otherappropriate control measures, and self-regulation, as an effective complement to nationallegislation in order to develop and maintain - cross border - a safe and secure environment forcustomers throughout the EU.

This document outlines Control Measures that are intended to be reasonably practical andoperationally feasible for effective implementation by operators, software suppliers and associated

service providers. The objective is to enable customers and policy makers to have access to a setof Control Measures that are easily and consistently understood.

Application

The requirements of this CWA are generic and are intended to be applicable to trade associations,licensing authorities, operators, software providers and associated service providers in the field ofremote gambling.

This document does not in itself impose any obligation upon anyone to follow it. However, such anobligation may be imposed, for example, by legislation or by a contract. In order to be able to claim

compliance with this document, the user needs to be able to identify the requirements he/she isobliged to satisfy. The user also needs to be able to distinguish these requirements from otherprovisions where there is a certain freedom of choice.

Contents of the informative Annex shall not in any way be construed as being requirements.

The main activity of a CEN Workshop is the development and publication of the CWA. The CWAis a voluntary standard applicable internationally and does not have the force of regulation.



Page 7

1 Scope

This CWA specifies the Responsible Remote Gambling Measures for operators, softwareproviders, associated service providers and other relevant industry stakeholders.

The Workshop only concerns remote gaming and betting, and the scope does not include land-based gambling activities. Remote gambling is defined as gaming and betting activities accessedby the customers via the use of the internet, telephone, television and other electronic devicesused for facilitating communication.

The Control Measures contained within this CWA are not intended to replace existing legislation,but rather guide and facilitate future regulatory efforts.



Page 8

2 Normative References

Not applicable.



Page 9

3 Definitions

For the purposes of this CWA the following definitions apply:

Term Definition

“account” Means a record kept by the operator, which record shall at all times beaccessible to the customer, which shows the customer‟s credit against theoperator, taking into account all wagers placed and all prizes won by thecustomer and any other debits or credits as may be permitted by theapplicable terms and conditions.

“affiliate” Means a third party website administrator providing marketing for anoperator for which the affiliate it in turn receives financial gain.

“AML” Means anti-money laundering.

“bonus” Means the provision of additional economic benefits to a customer asencouragement for further customer activity, not necessarily linked to thecustomer‟s transaction history.

“company” Means either an operator or software provider, as applicable.

“complaint” Means a matter of dissatisfaction expressed by a customer and operatorwhich is required to be resolved by the operator.

“compliance officer” Means a person who has been authorised to act on behalf of a company,in a capacity of ensuring compliance with applicable laws and regulations.

“cooling-off” Means the process by which a customer voluntarily requests their own

account be temporarily locked in order to prevent them from further gameplay.

“counter terrorismfinancing”

Means money laundering to support terrorist financing. However terroristfinancing can also occur when money earned legitimately is provided toterrorist groups for an illegitimate purpose.

“cryptographiccontrols”

Means controls to hide or obscure the contents of information transfer.Includes encryption and hash functions

“CTF” Means counter terrorism financing.

“customers” Means any person who is over the legal age of majority, and participates

in remote gambling.

“deposit” Means funding paid by the customer via a payment service provider intothe customer‟s gaming account.

“director” Means a member of the Board of Directors.

“disputes” Means a complaint submitted by a customer which has not been resolvedby the operator to either parties‟ satisfaction and is consequently escalatedto a third party mediator or arbitrator.

“dormant account” Means a customer‟s account that has no transactions initiated by thecustomer for a stipulated period.

“employees” Means all persons actively employed or engaged with a remote gamblingoperation.



Page 10

Term Definition

“FAFT” Means Financial Action Task Force.

“fees” Means the costs levied to a customer as a result of a funding transaction(deposit or withdrawal) from their gaming account.

“financialreconciliation”

Means the matching of transactions with an economic value and notingthose transactions where a corresponding match does not exist, for futureinvestigation.

“free play” Means the participation in games where no deposit was required from thecustomer and no actual monetary value is attributable to the customer.

“full exclusion” Means the process by which a customer‟s own account is permanentlylocked in order to prevent them from further game play.

“gambling software” Means the application from which the customer accesses the games,player account information and payment facilities.

“gambling” Means all types of games involving wagering or betting a stake withmonetary value in games in which participants may win, in full or in part, amonetary prize based, totally or partially, on chance or uncertainty of anoutcome.

“game pay tables” Means the illustration, in tabular format, of the game outcome andassociated payout.

“gambling site” Means the website of the operator from which customers can accessand/or download gambling software.

“inactive customer

account”

See “dormant account”

“jurisdiction” Means the practical authority granted to a formally constituted legal bodyto deal with and make pronouncements on legal matters and, byimplication, to administer justice within a defined area of responsibility.

“licence holder” Means a company that has received explicit permission to operate one orvarious games in a specific territory or jurisdiction by a regulator or by thegovernment.

“media” Means the medium by which the operator distributes communications tocustomers. For example: SMS, email, printed documents, website display,

pop-ups, etc.“money laundering” Means the process(s) by which criminals conceal or attempt to conceal the

origin of the proceeds of their or others‟ criminal activities.

“officer” Means a person who has been authorised to act on behalf of a company,in a capacity of authority.

“operator” Means a company conducting remote gambling activities.

“outstandingbalance”

Means the balance in a customer‟s account of economic value, due to thecustomer.

“payment requests” Means a request submitted by a customer to have funds paid out to himfrom his account.



Page 11

Term Definition

“payout percentage” Means the expected percentage of wagers a specific game will return tothe customer in the long run. The payout percentage can also becalculated via either a theoretical or simulated approach. The method usedfor calculation depends on the game type.

“payout” Means the economic value gained by the customer occurring from afavourable outcome of a game.

“play for gain” See “real money”

“poker robots” Means computer software utilised in a poker game to simulate customeractivity.

“prize” Means credits with an economic value presented to a customer inrecognition of the occurrence of a pre-defined event, in favour of thecustomer.

“products” Means the various types of remote gambling offerings, including, but notlimited to, casino, poker, bingo and sportsbook.

“promotion” Means the provision of additional economic benefits to a customer asencouragement for further customer activity.

“promotionalmaterial”

Means the distribution of information to customers relating to offers andincentives for the customers to gamble at the operator.

“RA” Means Regulatory Authority.

“rake” Means the scaled commission fee taken by an operator operating a pokergame.

“random number generator”

Means a computational or physical device designed to generate asequence of numbers or symbols that lack any pattern.

“real money” Means the participation in games utilising funds and promotionsattributable to the customer.

“registration” Means the process of a customer providing the required information andtaking the appropriate steps in order to open a customer account.

“RegulatoryAuthority”

Means a local, regional or national authority giving explicit permission tooperate one or various games on a specific territory or jurisdiction.

“rules” Means any terms and conditions applicable to a participant of a game.Rules detail the expected action and consequential result of a game.

“self -exclusion” Means the process by which a customer voluntarily requests their ownaccount be locked in order to prevent them from further game play.

“software providers” Means a company which develops and manages the remote gamblingsoftware.

“stake” Means the economic value which the customer, or any third party on hisbehalf, has to commit in order for the customer to participate in a gameand which he can lose, wholly or in part, following the result of the game.

“system-wideregression test”

Means any type of software testing that seeks to uncover software errorsby partially retesting a modified program. The intent of regression testingis to provide a general assurance that no additional errors were introduced



Page 12

Term Definition

in the process of fixing other problems.

“territories” Means an area marked off for administrative or other purposes under the jurisdiction of a governing body.

“theoretical statisticalreturn percentage”

Means the expected payout percentage from a game to a customer usingoptimal strategy.

“timeout receipts” Means deposits made by a customer where the payment processorexperienced a communication error while the transaction was pending.The customer‟s deposit has been deducted from their funding account butdoes not reflect on the recipient account.

“uncontested funds” Means funding with an economic value in a customer‟s account for whichthe operator has no claim in favour of these funds.

“underage

individuals”

Means any person who is not over the legal of age majority and who takes

part in remote gambling.

“users” Means operators, software providers and participants supporting andsubscribing to these Control Measures.

“verification” Means the process of obtaining evidence, often identificationdocumentation, substantiating an individual‟s claims of identity.

“virus” Means a software program capable of reproducing itself and usuallycapable of causing great harm to files or other programs on the samecomputer.

“winnings” Means monetary and non-monetary rewards in favour of the customer,

arising from remote gambling activity.

“wins” See “payout”.

“withdrawal” Means the funding withdrawn by a customer from their gambling accountto be paid by the operator in favour of the customer.



Page 13

4 Responsible Remote Gambling Control Measures

The Control Measures are allocated to 9 different Control Objectives relating to responsibleremote gambling.

Control Objectives are statements of the desired result or purpose to be achieved by the effectiveimplementation of the Control Measures.

The Control Objectives contained within this document are referred to below.

1. The protection of vulnerable customers

The users of this document are committed to promoting socially responsible gambling, andworking with customers, employees and relevant industry stakeholders to help manage andcontrol problem gambling. Users should ensure that proper controls are established, implemented

and enforced, and that gambling takes place in a responsible environment.

2. The prevention of underage gambling

The users of this document should seek to implement all reasonable measures that preventunderage individuals from accessing gambling products. Users should ensure these measuresaddress appropriate age verification and know-your-customer controls, and with help from industrystakeholders and governments, continuously improve the coverage, quality and effectiveness ofreal-time verification.

3. Zero tolerance of fraudulent and criminal behaviour

Users should not tolerate fraud or criminal behaviour, and strict security measures and gamblingsupervision should be implemented and enforced to prevent fraudulent activity and anytransactions suspected of being potentially connected to money laundering or other criminalactivity.

4. Protection of customer privacy and safeguarding of information

Users should ensure that the privacy and confidentiality of all customer information submitted at

any point in time is maintained and protected from unauthorised or unnecessary disclosure.

5. Prompt and accurate customer payments

Users should ensure prompt and accurate processing of winnings and payment requests, subjectto appropriate and necessary checks and verification.

6. Fair gaming

Users are committed to ensuring that gambling products are subjected to continuous and rigorousindependent assessment to ensure products continue to operate in a fair and random manner, andin accordance with published rules.



Page 14

7. Ethical and responsible marketing

Users should endeavour to employ well balanced advertising and marketing campaigns in line withresponsible gambling good practices.

8. Commitment to customer satisfaction and support

Users are committed to providing customers with an enjoyable gaming experience with access to24/7 support, where they can be assured of timely resolution of complaints and disputes.

9. Secure, safe and reliable operating environment

Users should operate gambling products within an internal control environment that is in line withbest practice and which supports the objectives of a secure, safe and reliable environment.

The draft Control Measures are presented in the table below:

1. The protection of vulnerable customers

1.01 The homepage of operator websites should contain a clear link to the responsiblegambling page, which should contain the following:

1.01.01 A brief statement of the operator‟s commitment to responsible gaming.

1.01.02 A warning that gambling could be harmful if not controlled and kept in moderation.

1.01.03 Advice on responsible gambling, and a link to sources of help, including helplinenumbers.

1.01.04 An accepted and simple self-assessment process to determine risk potential.

1.01.05 A list of customer protection measures that are available on the site and details of howto access to these measures.

1.01.06 Links to problem gambling information and qualified advisory services where availablein those territories where the operator actively markets its products.

1.02 Messages of an operator‟s support for the provision of problem gaming treatment,research or education initiatives should not be misleading.

1.03 Information about responsible gambling practices have to cover the following topics:description of gaming types and procedures offered to customers; average andmaximum losses per game and in a defined time unit.

1.04 Consumer ...[protection] measures have to cover: a named individual responsible forgambling protection measures independent from the licence holder administration. Allmeasures have to be confirmed by the RA, and the RA may request theimplementation of new evidence based or best practice protection measures.

1.05 The homepage of operator websites should contain a clear link to the website of atleast one organisation qualified to assist problem gamblers.



Page 15

1.06 All links to problem gaming counselling services provided by third parties should betested and maintained by the operator. Records of tests should be established andmaintained.

1.07 Gambling software should contain a clear reminder to the customer about responsiblegambling and a link to the responsible gambling page.

1.08 Warnings and Links about Risks Associated with Remote Gaming. The operatorshould display, on the login screen, a link to responsible gaming advice. The linkshould have the same importance as other content offered on the login screen. Thelogin screen should also include text advising the player that the site contains links tocompetent problem gaming counselling service providers.

1.09 Promotional material should not be displayed on the operator‟s responsible gamblingpage.

1.10 Direct communication with the customer should carry a responsible gamblingmessage, where practical.

1.11 Free play games websites should provide links to the same age restriction,responsible gambling, and customer protection information as the real money sites.

1.12 In an attempt to mitigate problem gambling, customers should be able to request thesetting of wagering/deposit limits.

1.13 Customers should be able to request the setting of their own deposit limits per day,week and month.

1.14 There should be a clear link from the deposit page to the facility to set deposit limits oras a minimum, to the Responsible Gaming page.

1.15 The customer should be introduced to the opportunity to set a deposit limit eitherduring registration or at first deposit.

1.16 The company should enable the customer to set and review their deposit limit throughthe site and/or through contact with customer services. If there is a delay when acustomer sets a deposit limit the company should confirm to the customer from whenthe limit will take effect.

1.17 If a customer wants to increase a deposit limit previously set, a minimum waitingperiod of 24 hours should apply.

1.18 A request to decrease a deposit limit should be implemented immediately.

1.19 Operators should have systems in place to deal with deposit limit requests in timelymanner.

1.20 The company should ensure that an appropriately robust system is in place to ensurethat deposit limits are enforced. On reaching the set limit the customer should not beable to make further deposits during the specified time period.

1.21 The customer has the possibility to set stake limits related to a defined time unit(day/week/month) separated into the type of game.

1.22 Consumer ...[protection] measures have to cover: limits of daily and monthly ... losses

1.23 After each hour of continuous play a message should be displayed advising the

customer of the length of time they have been playing. (Casino)

1.24 Where time session limits are available the customer should have an option to set alimit on the amount of time they spend participating in casino games in any 24 hour



Page 16

period. (Casino)

1.25 On completion of the last wager within the previously set time limit the customershould be presented with a message clearly informing them of the length of time theyhave been playing. The customer should be required to acknowledge the messageand agree to continue playing or stop. (Casino)

1.26 Operators‟ procedures for self -exclusion and temporary cooling-off should be clearlycommunicated on the website. Procedures should clearly state the conditions of self-exclusion.

1.27 Easy to use options of self-exclusion, separated into the type of game and for accountclosure for a minimum duration of 3 months and up to 2 years, are available for thecustomer.

1.28 Enable players to „self -exclude‟. An operator should provide the player with the optionto self-exclude himself for a definite or indefinite period of time from: a particulargaming type (e.g. Poker, fixed odds, casino, etc.); and/or the gaming site.

1.29 The operator should set up a policy on self-exclusion which should be madeaccessible to the player. As a minimum, the policy should provide for a set of pre-defined time-frames increasing with every subsequent self-exclusion up to the timewhen the indefinite self-exclusion is invoked. The policy should also include thehandling of outstanding balances and bets.

1.30 The period of self exclusion must be for a minimum of six months. The customershould, in addition, be able to identify a longer period of time for the exclusion withinoperator defined increments (such as 1 year, 2 years or 5 years).

1.31 Customers should be given the opportunity to self-exclude or cool-off by contactingcustomer services or requesting self-exclusion, or cooling off via the operator‟s

website.

1.32 Once the customer has selected the self-exclusion option, the account should belocked and any funds in the account paid out.

1.33 Operators should offer customers the ability to self-exclude from gambling activity andbest endeavours should be made to prevent marketing to these customers.

1.34 Once a customer has requested to be excluded ... the customer should also beprovided with contact information for accessible help services, (such as GamCare)and encouraged to seek support should they recognise that their gambling isproblematic for them.

1.35 Operators should offer customers a “cooling-off” exclusion period from gamblingactivity, and best endeavours should be made to prevent marketing to thesecustomers.

1.36 The site may also provide a shorter-term cooling-off period as well as a full exclusion.The cooling off period may be made available for 24 hours and/or 7 days.

1.37 A third party making an application for a customer‟s exclusion should be properlyidentified. Based on the circumstances and merit, the appropriate manager may givedue consideration to the course of action.

1.38 The provider of its own [accord] closes accounts of gamers ... based on conspicuous

gaming behaviour and further information ... [assuming] that the placed stakes ... arenot in an appropriate rake to his financial situation.



Page 17

1.39 According to defined indicators based on the monitoring of the individual gamingbehaviour the licence holder will exclude a consumer for certain time periods orlifelong from all future gaming activities of the company, in order to protect vulnerableconsumers. These indicators and the exclusion process ought to be confirmed by theRA, and the RA may request the implementation of new or modified exclusionindicators and processes.

1.40 The provider [should make] ... data of customers who excluded themselves fromgaming due to problematic gaming behaviour or were blocked by the provideravailable to a third party organization [while] maintaining privacy policies. ...A self-exclusion database with other providers compliant with CEN standards, can be ...[established].

1.41 Licence holders should have, and provide to Regulatory Authority defined systems inplace to enable customers to request to be self excluded. Such requests should be adeliberate and considered action by the customer and should be implemented by thelicence holder within two hours and in compliance with the defined procedure.Implementation should include confirming receipt of the request to self exclude via an

identified e-mail account or the means of correspondence/communication used by thecustomer. Confirmation should include specific information on the process andconsequences of self exclusion, including the point at which self exclusion hascommenced.

1.42 Licence holders are expected co-operate with the Regulatory Authority, GamblingCommissioner and other licence holders to develop techniques to identify anddiscourage problem gambling.

1.43 Training should be provided to customer service employees to ensure the prompt andefficient handling of correspondence relating to self-exclusion and cooling off.

1.44 Operators should not provide credit to customers - specifically, operators may notpermit a customer to wager, win and receive a payout where the funding of that wageris obtained from the operator other than through existing client funds or the provisionof a promotion or bonus.

1.45 A player should not be given credit or allowed a negative balance unless adequatemeasures have been taken to establish the financial liquidity and standing of theplayer, and the player has clearly consented to honour consequential debts.

1.46 A clearly visible clock should be available for use by the customer at all times.

1.47 The denomination of each credit should be clearly displayed on the games screen.

1.48 The currency unit of the amount wagered should be clearly displayed on the gamesscreen.

1.49 If the site gives a customer the option of not displaying their balance, this should notbe set as default.

1.50 Customers should be provided with remote access to their account history dating backfor a minimum period of 60 days, and offline access dating back for a minimum periodof 6 months, including all deposits, withdrawals and wagers.

1.51 Maintain accessible and reliable player gaming accounts. Player balances on gamingaccounts should, without undue delays, accurately reflect the player‟s deposits, bets,wins, withdrawals, fees and any bonuses.

1.52 Records of player‟s credits should be established and maintained.



Page 18

1.53 Training should be provided to appropriate employees on the issues of problemgambling, and refresher courses should be undertaken as and when needed.

1.54 A designated senior management staff member should be appointed by eachoperator to assume responsibility for the implementation and monitoring ofresponsible gambling practices.

1.55 Relevant third party and business partner contractual terms and conditions shouldprovide the operator the right to terminate the contract where that third party‟s conductconflicts with the operator‟s responsible gambling program.

1.56 Foreign language websites should provide all information concerning age limits,responsible gambling, and customer protection in the relevant foreign language.

1.57 No slots game should be quicker than 3 seconds between plays. Options to increasethe speed of play where „turbo‟ or like is selected should not lead to less than 3seconds between plays. (Casino)

2. The prevention of underage gambling

2.01 The homepage of the operator‟s websites should prominently display a „no under 18‟s‟or „no under 21‟s‟ sign (as appropriate for the jurisdiction concerned), which linksthrough to a clear message about underage play.

2.02 The operator‟s website ter ms and conditions should state that no customer below thelegal age of gambling is permitted to participate in remote gambling activities.

2.03 Best endeavours by the operators should be made to prevent advertising in mediathat is targeted towards underage individuals, and should not portray anyoneunderage in any gambling adverts or promotional material.

2.04 The registration process should include a clear message regarding underage play.

2.05 If registration is required prior to potential customers being allowed to “Play for Free”,the operator‟s registration process should include confirmation of age.

2.06 The operator‟s responsible gambling page should provide a link to a recognisedfiltering programme to enable customers/parents to prevent minors from accessinggambling sites.

2.07 Operators should have a clear documented policy which is applicable in the event thatan underage individual is identified.

2.08 Operators should work with "leading" verification service providers to improvecoverage and quality of verification services available.

2.09 Age and customer verification should be conducted in accordance with a formaldocumented process, and should include operator and third party verification checks,where feasible and available.

2.10 Licence holders are expected to take all defined steps to prevent persons under theminimum permitted age from using their gambling facilities. For online gambling,these should include a positive action by the applicant to acknowledge the age limit,as well as providing date of birth and other necessary registration details.

2.11 Customer registration should require the customer to provide the following minimuminformation: name, age, address and unique username and password details.



Page 19

2.12 Consumer ...[protection] measures have to cover: a 72 hours waiting period for newlyregistered consumers after the first deposit payment

2.13 Any free play customer winning a cash prize ought to be age verified prior towithdrawal of winnings.

2.14 Underage gambling should be regularly monitored by conducting frequent checks ofcustomers to ensure compliance with age restrictions.

2.15 Operators should immediately close the account of any underage or suspectedunderage person found to have accessed its services.

2.16 The company should have in place an appropriate system for refunding the value ofall deposits should a customer, subsequent to registration, be identified as underage.

2.17 Training should be provided to all employees involved in the operator‟s ageverification process, including training on the process to follow in the event thatinstances of a need for additional verification are identified.

2.18 The provider establishes an independent registration office which parents and othereligible persons can turn to if they suspect that minors have access to the gamingsite. This information is available on the provider‟s website.

2.19 Licence holders have to provide regular evaluations by independent third parties ofthe effectiveness of their age verification systems and to report the results of thesemeasures to the R.A.

3. Zero tolerance of fraudulent and criminal behaviour

3.01 All operators should be aware of and adhere to any laws that are applicable in the

jurisdictions where they are licensed. This includes money laundering regulations.

3.02 Operators should implement an anti-money laundering policy approved and supportedby its senior management which will provide reasonable security measures to preventtransactions which are potentially connected to money laundering.

3.03 Operators should appoint a person or persons with responsibility for implementing andensuring effectiveness of anti-money laundering systems.

3.04 Anti-money laundering policies and procedures should cater for the identification,escalation and reporting of unusual or suspicious activities, including investigatingmaterial or unusual deposits, withdrawals and customer accounts where little or no

gambling activity takes place.3.05 The operator‟s anti-money laundering practices should include the provision of

suspicious transaction reports to the relevant national financial investigation unit andinternational institutions.

3.06 The fraud and anti-money laundering practices implemented by operators shouldmake provision for appropriate know your customer verification and/or customer duediligence processes.

3.07 Training and guidance should be provided to employees on the operator‟s policy toensure the prompt identification, escalation and reporting of fraud and anti-moneylaundering practices.

3.08 Money laundering control requirements between operators and service providersshould be clearly defined.



Page 20

3.09 No deposits or payouts should be made to a customer‟s account where there isreason to suspect money laundering or terrorist activity or where the deposit or payoutexceeds €2,000 (whether in a single transaction or a series of transactions whichappear to be linked) unless the customer has been properly identified.

3.10 Records of customer financial transactions that individually or cumulatively exceed

€2,000 should be retained in accordance with the retention requirements of theoperator‟s jurisdiction.

3.11 All information regarding changes to customer details should be logged andappropriate verification documentation should be requested for significant changes(e.g. changes to customers‟ names and banking details).

3.12 Funds should be remitted by the operator to the player only to the same account fromwhich the funds originated, except in special circumstances detailed by the operatorand submitted to the regulator. This would minimise the risks from winnings orcashed out losses simply being transferred elsewhere beyond the effective reach ofthe banking system.

3.13 Customer verification documents should be retained in accordance with the retentionrequirements of the operator‟s jurisdiction.

3.14 No physical cash or non-electronic methods of payment should be used to fund anaccount.

3.15 Transfers of funds between customer accounts should be conducted through a formaldocumented process in compliance with the operator‟s anti-money laundering policy.

3.16 The operator‟s terms and conditions should declare controls applicable over fundstransferred between customers.

3.17 A legal disclaimer should be displayed on the operator‟s web site stating that anycriminal or suspicious activities may be reported.

3.18 Director, officer and employee contracts should contain a clause prohibiting “tippingoff” in the event that criminal or suspicious activities are identified.

4. Protection of customer privacy and safeguarding of information

4.01 Confidential customer information submitted at any point in time should be protectedfrom unauthorised or unnecessary disclosure.

4.02 Customer credit card numbers stored on the system should be secured fromunauthorised use.

4.03 Operators should display and maintain a privacy policy on their websites.

4.04 Any change to the published policy should be notified to all players at the login screenuntil the player confirms acceptance of the new policy.

4.05 The operator‟s privacy policy should state the minimum information that is required tobe collected, the purpose for information collection, the conditions under whichinformation may be disclosed and the controls in place to prevent the unauthorised orunnecessary disclosure of the information.

4.06 Foreign language websites should display the operator‟s privacy policy in the relevantforeign language.



Page 21

4.07 Terms and conditions that require acceptance from customers during registrationshould clearly state the operator‟s privacy policy. Customer consent of the terms andconditions is required prior to successful registration.

4.08 Customers should be provided access to their confidential information and should bepermitted to request changes to inaccurate information.

4.09 The operator should take all reasonable steps to ensure that any information suppliedby customers is kept up to date.

4.10 Director, officer and employee contracts should contain a “confidentiality” clauseprohibiting the unauthorised or unnecessary disclosure of customer information.

5. Prompt and accurate customer payments

5.01 Registration, deposit and withdrawal procedures and conditions should be clearlycommunicated to customers.

5.02 The operator‟s website terms and conditions should state that only customers legallypermitted by their jurisdiction can participate in gambling activities.

5.03 Operators should keep a secure list of all registered customers.

5.04 Customers should only be permitted to open one account.

5.05 Operators should ensure prompt and accurate processing of payments subject toappropriate and necessary checks and verifications.

5.06 Payments to and from customers should be conducted according to a formaldocumented process.

5.07 Payments to customers should be conducted within 7 days of receipt of the requestand verification.

5.08 The detection and correction of timeout receipts should be conducted in accordancewith a formal documented process.

5.09 All information regarding receipts and payments should be logged and retained by theapplicable parties.

5.10 Financial reconciliations performed for payments and receipts should be reviewed andapproved.

5.11 Customer account related queries should be promptly addressed.

5.12 The locking of customer accounts should be conducted through a formal documentedprocess.

5.13 Any uncontested funds left in an account, previously de-activated by the operator,should be remitted to the owner of the funds, upon request and subject to publishedterms and conditions.

5.14 The operator‟s liability for customer balances should be separately identifiable on amonthly basis.

5.15 Operators‟ customer balances at any time ought to be covered by liquid funds.

5.16 The client account/s balance/s should be maintained with funds the value of whichshould exceed or be equivalent to the total of player balances held with the operator.



Page 22

5.17 The operator should demonstrate a clear ability to pay all prizes and outstandingplayer balances.

5.18 In games of chance, all prizes offered to players should be backed by sufficientoperator means.

5.19 The operator should ensure that own funds are adequate for the financing of bonusesand allocation of credit to players.

5.20 A procedure should be established and maintained to set up and manage clientaccount/s including any interest accrued and to record all transactions.

5.21 Client account/s should be kept and operated separately from Operator ownedaccounts. Funds in the clients accounts should not be put at risk in any way. Alltransactions made by the operator and having an effect on the balance in the clientaccount/s should be documented. Records of transactions should be maintained.

5.22 If the operator adopts a policy of clearing inactive customer accounts, then customersshould be informed prior to clearing of the account, and this policy should be clearly

stated in the operator‟s terms and conditions.

5.23 Records should be maintained for all customer accounts that have been cleared, andany customer requesting a cashout from an account that has been cleared should besettled according to the operator‟s terms and conditions.

6. Fair gaming

6.01 Operators should implement a product testing policy, approved and supported by itssenior management, which will provide for the testing of all products for fairness andrandomness.

6.02 The policy should make provision for the internal and external testing of productfairness and randomness.

6.03 Testing of fairness and randomness of products should be conducted prior to, andsubsequent to the operation of the games and/or betting products.

6.04 All major changes should be individually tested and a system-wide regression testshould be completed annually.

6.05 Random number generators used in products should be tested at minimum, annually.

6.06 The results of games ought to be random, except where clearly disclosed if differentgame-rules apply.

6.07 The output obtained through the use of the random number generator (“RNG”) ingames should be proven to be:

6.07.01 Statistically independent.

6.07.02 Uniformly distributed over their range.

6.08 Significant wins for slot games should be verified and distributed among anacceptable population of customers.

6.09 Where a game simulates a physical device:

6.09.01 The visual representation of the device ought to correspond to the features of thephysical device.



Page 23

6.09.02 The probability of any event occurring should be as for the actual physical deviceexcept where deviations are clearly displayed to the customers.

6.10 Where the game simulates multiple physical devices that would be expected to beindependent of one another, each simulated device should be independent of theother simulated device.

6.11 Where the game simulates physical devices that have no memory of previous events,the behaviour of the simulations should be independent of the behaviour of previoussimulations.

6.12 The financial data log files should be reconciled to movements on theoperator/customer accounts to ensure data completeness.

6.13 The theoretical statistical return percentage for a particular game type should be noless than that of the equivalent game in free play mode.

6.14 Game rules should be available to the customer, and should be tested on an annualbasis.

6.15 The rules of the game or games should be documented and maintained inclusive ofissue date and version number. The rules should be made accessible to players at alltimes.

6.16 The game pay tables should be available to the player during games of chance.

6.17 Any change to the published rules or pay tables should be notified to all players attheir next login after the change.

6.18 The design and operation of games should be strictly in accordance with the specifiedgame rules, and should not deviate from those rules.

6.19 Changes to rules and pay tables should not be retrospective in their effect.

6.20 Preventative and detective controls or technology should be in place to ensure thatthe prospect of cheating through collusion (external exchange of information betweendifferent customers) is prevented.

6.21 Poker rooms should not utilise software (for example poker robots that play pokeronline with no or minimal human intervention) or other means to simulate increasedcustomer activity or provide misleading information about a site‟s popularity.

6.22 Poker rooms should not permit the use of robots or other devices by customers with aview to providing them with an advantage over other customers, and should be

vigilant in monitoring and stopping the use of these robots and devices.6.23 Effective risk control mechanisms should be in place for managing events offered, bet

sizes and prices, taking into consideration available liquid funds.

6.24 Payout percentage reviews should be conducted on a monthly basis to verify theactual return to the customer against the theoretical/estimated return.

6.25 Foreign language websites should aim to provide assistance and guidance to allcustomers on foreign language related queries, where possible.

6.26 "Near-miss" game results should not be falsely displayed by substituting one losingoutcome with a different losing outcome.

6.27 “Play for free” offerings should not mislead customers. A operator offering both “playfor free” and “play for gain” games should ensure that the “play for free” reflects the



Page 24

odds, rules and behaviour of the “play for gain”.

6.28 For sports betting there should be procedures for identifying suspicious bettingtransactions and patterns which might identify a threat to the sport‟s integrity or anoffence of cheating. Where a threat is identified there should be a procedure fornotifying the relevant sport or gambling regulator.

7. Ethical and responsible marketing

7.01 Advertisements should contain factually correct information and should not be false ormisleading, particularly with regard to customer winnings.

7.02 Advertisements should not entice the underage to gamble or bet, and should not bedisplayed in media that is clearly targeted at the underage.

7.03 Customers should not be encouraged to chase their losses or re-invest their winnings.

7.04 An operator should ensure that advertising does not imply or convey a message thatone's status, general abilities and social success can be attributable to gaming

7.05 Advertisements and promotional content should be within the spirit of responsiblegambling.

7.06 At no time should it be suggested that gambling is a means of solving financialdifficulties.

7.07 Advertisements should not contain a misrepresentation that is likely to cause damageto the business or goodwill of another person.

7.08 Advertising and promotions ought to be compliant with the relevant regulatory and

advisory codes of practice.

7.09 The operator should establish and maintain a documented procedure to manage andcontrol sales promotions and marketing campaigns. The terms and conditions of anycampaign should be established and communicated. Financial aspects of salespromotion and marketing campaigns should be adequately managed. Records ofsales promotion and marketing campaigns should be maintained.

7.10 A operator should not knowingly engage in the distribution of unsolicitedadvertisement (i.e. SPAM) either directly or through a third party.

7.11 Player contact details should not be used for direct marketing purposes unless priorconsent has been obtained from the player.

7.12 Email, SMS and bonus advertisements should have an unsubscribe, or opt out,facility.

7.13 The operator should not exploit its relationship with the player by any unauthorisedactivity on the player‟s computer system.

7.14 Terms and conditions applicable to promotional activities should be clearly displayedand should not be unreasonably altered subsequent to the wagering activity.

7.15 Promotional terms and conditions should include the last date and time published.

7.16 Operators should ensure that an affiliate and/or third party performing advertisements

on their behalf is aware of and takes appropriate steps to abide by the ControlMeasures.



Page 25

7.17 If the operator becomes aware of an affiliate and/or third party behaving in a mannerthat contravenes these Control Measures, the operator should take reasonable stepsto ensure that the affiliate ceases that behaviour or that the affiliate and/or third partycontract is terminated.

7.18 Direct advertisements and promotional communication with the customer should carry

a no under 18‟s or no under 21‟s warning where practical.

8. Commitment to customer satisfaction and support

8.01 Contact information for complaints and dispute resolution should be readily accessibleon the operator websites.

8.02 Customers should be able to log complaints and disputes on a 24/7 basis.

8.03 Foreign language websites should aim to provide assistance and guidance to allcustomers on foreign language related complaints and disputes, where possible

8.04 The resolution and escalation of customer complaints should be conducted inaccordance with a formal documented process.

8.05 Operators should keep records of all customer correspondence relating to a complaintand dispute.

8.06 The operator should establish and maintain a procedure for obtaining and handlingcustomer feedback. Records of feedback and actions taken should be maintained.

8.07 An independent third party should be available for mediation or resolution of disputesreceived from operators or their customers.

8.08 The third party should be required to keep record of all customer correspondencerelating to a dispute.

9. Secure, safe and reliable operating environment

9.01 Operators should appoint a Compliance Officer, who will assume ultimateresponsibility for compliance with the controls specified within the Control Measures.

9.02 Providers report to the independent third party (audit) especially about theimplementation of Responsible Gaming measures and the results. Providers committhemselves to an annual audit by an independent third party that audits compliance

with CEN standards. The independent third party annually reports the compliancewith standards to its members.

9.03 The appointed Compliance Officer should ensure that training and awarenessprogrammes, specified within the Control Measures, are conducted on an annualbasis or more frequently if required within the operator organisation.

9.04 The operator should commission internal audits of their financial statement/s atplanned intervals (not more than a year apart) following appropriate audit procedures.Auditors should not audit their own work.

9.05 Operators should commit to an annual audit of financial statements and accountsperformed by a reputable external Audit Firm.

9.06 Operators should keep records in a manner that will allow the timely preparation and



Page 26

audit of financial statements and accounts.

9.07 Operators should keep financial transaction records in accordance with the retentionrequirements of the relevant jurisdiction.

9.08 Operator websites should display the name of the operator and the address of its

registered office.

9.09 Operators should have a legal operating license from a reputable European regulatoryauthority.

9.10 Operator websites should prominently display the licensing jurisdiction from whichgambling activities are conducted.

9.11 Operators should appoint a Compliance Officer, who will assume ultimateresponsibility for compliance with the licensing jurisdiction‟s requirements, asnecessary.

9.12 Operator websites should prominently display the contractual terms and conditions

applicable to gambling activities.

9.13 Provision of “Terms and Conditions”. General “Terms and Conditions” should beavailable at and after registration and should be made available to print or downloadat any time.

9.14 Contractual terms and conditions applicable to gambling activities should include thelast date published.

9.15 Security policies and procedures should be documented and communicated torelevant employees, and reviewed at least annually or in the event of materialchanges.

9.16 Security policies and procedures should be implemented. Risk-based internal andexternal security reviews should be conducted at least annually or in the event ofmaterial changes.

9.17 Physical security perimeters (such as gates and walls) should be in place to ensurerestricted access to authorised personnel to areas that contain information andinformation processing facilities.

9.18 MSA EN ISO IEC 27001:2005 Annex A.9.2.1 Equipment should be sited or protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access.

9.19 MSA EN ISO IEC 27001:2005 Annex A.6.1.6 Appropriate contacts with relevant authorities should be maintained.

MSA EN ISO IEC 27001:2005 Annex A.6.1.7 Appropriate contacts with special interest groups or other specialist security forums and professional associations should be maintained.

9.20 Relevant third party and business partner contractual terms and conditions shouldcover all appropriate security requirements.

9.21 Virus scanners and/or detection programs should be installed on all pertinentinformation systems. These programs should be updated regularly to scan for newstrains of viruses.

9.22 Controls should be in place for changes to information processing facilities andsystems in order to reduce the risk of security or system failures.



Page 27

9.23 All customers should be verified through the use of an account identifier/passwordpair, or by any other means that provide equal or greater security (e.g. digitalcertificates), prior to being permitted to participate in gambling activities..

9.24 All system users should have their identity verified with an account identifier/passwordpair, or by any other means that provide equal or greater security, prior to being

permitted to access the system.

9.25 All customer deposit, withdrawal or adjustment transactions should be subject to strictsecurity control and should be maintained in a system audit log.

9.26 MSA EN ISO IEC 27001:2005 Annex A.10.9.2 Information involved in on-line transactions should be protected to prevent incomplete transmission, mis-routing,unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay.

9.27 MSA EN ISO IEC 27001:2005 Annex A.11.7.1 A formal policy should be in place, and appropriate security measures should be adopted to protect against the risks of using

mobile computing and communication facilities.9.28 MSA EN ISO IEC 27001:2005 Annex A.12.3.1 A policy on the use of cryptographic

controls for protection of information should be developed and implemented.

9.29 Backup and recovery procedures should be in place to ensure data and information(e.g. logs and financial information) are backed up on a regular basis and can berestored in the event of a disaster.

9.30 Backup and disaster recovery responsibilities and procedures between softwareproviders and operators should be clearly defined.

9.31 The system should enable customers to complete interrupted games, within a

reasonable timeframe, whether from loss of communication with the end-player deviceor an event on the system.

9.32 A development methodology for software and applications should be defined,documented and implemented.

9.33 All documentation relating to software and application development should beavailable and retained for the duration of its lifecycle.

9.34 Change control procedures should be implemented in line with the changemanagement policy and should cater for the following:

9.34.01 Approval procedures for changes to software.

9.34.02 A policy addressing emergency change procedures.

9.34.03 Procedures for testing and migration of changes.

9.34.04 Segregation of duties between the developers, quality assurance team, the migrationteam and users.

9.34.05 Procedures to ensure that technical and user documentation is updated as a result ofa change.

9.34.06 Procedures to ensure that security control requirements are specified for newinformation systems, or enhancements to existing information systems.

9.35 The appointed Compliance Officer should have the required authority within theoperator organisation to ensure processes, policies and procedures required for



Page 28

compliance are established, implemented and maintained.

9.36 The appointed Compliance Officer should have the responsibility and authority toannually report compliance with the Control Measures to senior management.

9.37 Critical data and information should be backed-up and secured off-site on a daily

basis.

9.38 All information required for completing an incomplete game should be recoverable bythe system.

9.39 All transactions involving customer funds should be recoverable by the system in theevent of a failure or malfunction.

9.40 If a operator has reason to believe or to suspect that an interruption has been caused,or a transaction affected by illegal activity, the operator may withhold paymentpending further investigation.

9.41 The test environment ought to be isolated physically and logically from the live

operational systems.



Page 29

5 Annex A (Informative) – Non-Exhaustive List of ExistingResponsible Gambling Regulations, Measures and

CodesUnited Kingdom Gambling Commission Codes of Practice (see link)

Isle of Man Online Gambling Regulations (see link)

Malta Lotteries and Gaming Authority Remote Gaming Regulations (see link)

Maltese Standard MSA1600:2008 “Remote Gaming – Operators Management System – Requirements”.

Gibraltar Code of Practice for the Gambling Industry (see link)

Swedish Presidency Progress Report ´Legal framework for gambling and betting in theMember States of the European Union´, doc 16571/09 (see link)

EGBA Standards (see link)

RGA Social Responsibility Code (see link)

eCOGRA‟s Generally Accepted Practices (eGAP) (see link)

European Lotterieso Responsible Gaming Standards (see link) o Code of Conduct on Sportsbetting (see link)

IAGRA eGambling Guidelines (see link)

Interactive Gaming Councilo Code of Conduct (see link) o Responsible Gambling Guidelines (see link) o Advertising Code of Practice (see link)

Ehrenkodex VEWU

ESSA Code of Conduct (see link)

Global Gambling Guidance Group (G4), e-Gambling Code of Practice (see link)

http://www.gamblingcommission.gov.uk/pdf/LCCP%20-%20Oct%202008.pdf

http://www.gov.im/gambling/regulatory.xml

http://www.lga.org.mt/lga/content.aspx?id=87374

http://www.gra.gi/sites/gambling/downloads/215/generic_code_v1.0.2009.pdf

http://register.consilium.europa.eu/pdf/en/09/st16/st16571.en09.pdf

http://www.egba.eu/pdf/EGBA_Standards_March_2009_EN.pdf

http://www.rga.eu.com/data/files/rga_sr_code___final_final_14_11_07.pdf

http://www.ecogra.org/egap


https://www.european-lotteries.org/data/info_1137/Gaming_Standards_A.pdf

https://www.european-lotteries.org/data/info_1138/Code_SB_A.pdf

http://www.iagr.org/docs/2008IAGRGuidelines.pdf

http://www.igcouncil.org/content/view/20/37/



http://www.eu-ssa.org/CodeofConduct/tabid/57/Default.aspx

http://www.gx4.com/files/COP/e-gambling_COP_080708.pdf

http://www.gx4.com/files/COP/e-gambling_COP_080708.pdf

http://www.eu-ssa.org/CodeofConduct/tabid/57/Default.aspx




http://www.iagr.org/docs/2008IAGRGuidelines.pdf

https://www.european-lotteries.org/data/info_1138/Code_SB_A.pdf

https://www.european-lotteries.org/data/info_1137/Gaming_Standards_A.pdf


http://www.rga.eu.com/data/files/rga_sr_code___final_final_14_11_07.pdf

http://www.egba.eu/pdf/EGBA_Standards_March_2009_EN.pdf

http://register.consilium.europa.eu/pdf/en/09/st16/st16571.en09.pdf

http://www.gra.gi/sites/gambling/downloads/215/generic_code_v1.0.2009.pdf

http://www.lga.org.mt/lga/content.aspx?id=87374

http://www.gov.im/gambling/regulatory.xml

http://www.gamblingcommission.gov.uk/pdf/LCCP%20-%20Oct%202008.pdf

CWA - REMOTE GAMBLING

Documents

Transcript of CWA - REMOTE GAMBLING