PART 543—MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING Authority: 25 U.S.C. 2702(2), 2706(b)(1-4), 2706(b)(10). Source: 77 FR 58712, Sept. 21, 2012, unless otherwise noted. § 543.1 What does this part cover? This part establishes the minimum internal control standards for the conduct of Class II games on Indian lands as defined in 25 U.S.C. 2701 et seq. § 543.2 What are the definitions for this part? The definitions in this section apply to all sections of this part unless otherwise noted. Accountability. Agent. Automated payout. Cage. Cash equivalents. Cashless system. Cashless transaction. Chair. Class II gaming. Class II gaming system. Commission. et seq. Complimentary services and items. Count. Count room. Coupon. Currency cassette. Dedicated camera. Drop box. Drop proceeds. Exception report. Financial instrument. Financial instrument storage component. Gaming promotion. Generally Accepted Accounting Principles (GAAP). Generally Accepted Auditing Standards (GAAS). Governmental Accounting Standards Board (GASB). Independent. Kiosk. Lines of credit. (1) Defer payment of debt; or (2) Incur debt and defer its payment under specific terms and conditions. Manual payout. Marker. MICS. Network communication equipment. Patron. Patron deposit account. Player interface. Prize payout. Promotional progressive pots and/or pools. Shift. Shill. Smart card. Sufficient clarity. Surveillance operation room(s). Surveillance system. SICS (System of Internal Control Standards). Tier A. Tier B. Tier C. TGRA. TICS. Vault. Voucher. Voucher system. [77 FR 58712, Sept. 21, 2012, as amended at 78 FR 63874, Oct. 25, 2013] § 543.3 How do tribal governments comply with this part? (a) Minimum standards. (b) TICS. (1) Evaluation of existing TICS. (2) Compliance date. (c) SICS. (1) Existing gaming operations. (2) New gaming operations. (d) Variances. (e) Computer applications. (f) Determination of tier. (2) Gaming operations moving from one tier to another will have nine months from the date of the independent certified public accountant's audit report to achieve compliance with the requirements of the new tier. The TGRA may extend the deadline by an additional six months if written notice is provided to the Commission no later than two weeks before the expiration of the nine month period. (g) Submission to Commission. (h) Enforcement of Commission MICS. (2) Enforcement action by the Commission will not be initiated under this part without first informing the tribe and TGRA of deficiencies in the TICS or absence of SICS for its gaming operation and allowing a reasonable period of time to address such deficiencies. Such prior notice and opportunity for corrective action are not required where the threat to the integrity of the gaming operation is immediate and severe. § 543.4 Does this part apply to small and charitable gaming operations? (a) Small gaming operations. (1) The TGRA permits the operation to be exempt from this part; (2) The annual gross gaming revenue of the operation does not exceed $3 million; and (3) The TGRA develops, and the operation complies with, alternate procedures that: (i) Protect the integrity of games offered; (ii) Safeguard the assets used in connection with the operation; and (iii) Create, prepare and maintain records in accordance with Generally Accepted Accounting Principles. (b) Charitable gaming operations. (1) All proceeds are for the benefit of a charitable organization; (2) The TGRA permits the charitable organization to be exempt from this part; (3) The charitable gaming operation is operated wholly by the charitable organization's agents; (4) The annual gross gaming revenue of the charitable operation does not exceed $3 million; and (5) The TGRA develops, and the charitable gaming operation complies with, alternate procedures that: (i) Protect the integrity of the games offered; (ii) Safeguard the assets used in connection with the gaming operation; and (iii) Create, prepare and maintain records in accordance with Generally Accepted Accounting Principles. (c) Independent operators. § 543.5 How does a gaming operation apply to use an alternate minimum standard from those set forth in this part? (a) TGRA approval. (2) For each enumerated standard for which the TGRA approves an alternate standard, it must submit to the Chair within 30 days a detailed report, which must include the following: (i) An explanation of how the alternate standard achieves a level of security and integrity sufficient to accomplish the purpose of the standard it is to replace; and (ii) The alternate standard as approved and the record on which it is based. (3) In the event that the TGRA or the tribal government chooses to submit an alternate standard request directly to the Chair for joint government to government review, the TGRA or tribal government may do so without the approval requirement set forth in paragraph (a)(1) of this section. (b) Chair review. (2) If the Chair approves the alternate standard, the Tribe may continue to use it as authorized by the TGRA. (3) If the Chair objects, the operation may no longer use the alternate standard and must follow the relevant MICS set forth in this part. (4) Any objection by the Chair must be in writing and provide reasons that the alternate standard, as approved by the TGRA, does not provide a level of security or integrity sufficient to accomplish the purpose of the standard it is to replace. (5) If the Chair fails to approve or object in writing within 60 days after the date of receipt of a complete submission, the alternate standard is considered approved by the Chair. The Chair may, upon notification to the TGRA, extend this deadline an additional 60 days. (c) Appeal of Chair decision. § 543.6-543.7 [Reserved] § 543.8 What are the minimum internal control standards for bingo? (a) Supervision. (b) Bingo cards. (i) The bingo card inventory can be accounted for at all times; and (ii) Bingo cards have not been marked, altered, or otherwise manipulated. (2) Receipt from supplier. (ii) Bingo card inventory records must include the date received, quantities received, and the name of the individual conducting the inspection. (3) Storage. (ii) For Tier A operations, bingo card inventory may be stored in a cabinet, closet, or other similar area; however, such area must be secured and separate from the working inventory. (4) Issuance and returns of inventory. (A) Issuance of inventory from storage to a staging area; (B) Issuance of inventory from a staging area to the cage or sellers; (C) Return of inventory from a staging area to storage; and (D) Return of inventory from cage or seller to staging area or storage. (ii) [Reserved] (5) Cancellation and removal. (ii) Bingo cards associated with an investigation must be retained intact outside of the established removal and cancellation policy. (6) Logs. (ii) The bingo card inventory record(s) must include: (A) Date; (B) Shift or session; (C) Time; (D) Location; (E) Inventory received, issued, removed, and returned; (F) Signature of agent performing transaction; (G) Signature of agent performing the reconciliation; (H) Any variance; (I) Beginning and ending inventory; and (J) Description of inventory transaction being performed. (c) Bingo card sales. (2) Manual bingo card sales: In order to adequately record, track, and reconcile sales of bingo cards, the following information must be documented: (i) Date; (ii) Shift or session; (iii) Number of bingo cards issued, sold, and returned; (iv) Dollar amount of bingo card sales; (v) Signature, initials, or identification number of the agent preparing the record; and (vi) Signature, initials, or identification number of an independent agent who verified the bingo cards returned to inventory and dollar amount of bingo card sales. (3) Bingo card sale voids must be processed in accordance with the rules of the game and established controls that must include the following: (i) Patron refunds; (ii) Adjustments to bingo card sales to reflect voids; (iii) Adjustment to bingo card inventory; (iv) Documentation of the reason for the void; and (v) Authorization for all voids. (4) Class II gaming system bingo card sales. In order to adequately record, track and reconcile sales of bingo cards, the following information must be documented from the server (this is not required if the system does not track the information, but system limitation(s) must be noted): (i) Date; (ii) Time; (iii) Number of bingo cards sold; (iv) Dollar amount of bingo card sales; and (v) Amount in, amount out and other associated meter information. (d) Draw. (2) Where the selection is made through an electronic aid, certification in accordance with 25 CFR 547.14 is acceptable for verifying the randomness of the draw and satisfies the requirements of paragraph (d)(1) of this section. (3) Controls must be established and procedures implemented to provide a method of recall of the draw, which includes the order and identity of the objects drawn, for dispute resolution purposes. (4) Verification and display of draw. (i) The identity of each object drawn is accurately recorded and transmitted to the participants. The procedures must identify the method used to ensure the identity of each object drawn. (ii) For all games offering a prize payout of $1,200 or more, as the objects are drawn, the identity of the objects are immediately recorded and maintained for a minimum of 24 hours. (e) Prize payout. (i) Identification of the agent authorized (by position) to make a payout; (ii) Predetermined payout authorization levels (by position); and (iii) Documentation procedures ensuring separate control of the cash accountability functions. (2) Verification of validity. (A) Winning card(s); (B) Objects drawn; and (C) The previously designated arrangement of numbers or designations on such cards, as described in 25 U.S.C. 2703(7)(A). (ii) At least two agents must verify that the card, objects drawn, and previously designated arrangement were valid for the game in play. (iii) Where an automated verification method is available, verification by such method is acceptable. (3) Validation. (ii) For automated payouts, the system may serve as the sole validator of the claim. (4) Verification. (ii) For automated payouts, the system may serve as the sole verifier that the pattern has been achieved on the winning card. (5) Authorization and signatures. (ii) Manual prize payouts above the following threshold (or a lower threshold, as authorized by management and approved by TGRA) must require one of the two signatures and verifications to be a supervisory or management employee independent of the operation of Class II Gaming System bingo: (A) $5,000 for a Tier A facility; (B) $10,000 at a Tier B facility; (C) $20,000 for a Tier C facility; or (D) $50,000 for a Tier C facility with over $100,000,000 in gross gaming revenues. (iii) The predetermined thresholds, whether set at the MICS level or lower, must be authorized by management, approved by the TGRA, documented, and maintained. (iv) A Class II gaming system may substitute for one authorization/signature verifying, validating or authorizing a winning card, but may not substitute for a supervisory or management authorization/signature. (6) Payout records, including manual payout records, must include the following information: (i) Date and time; (ii) Amount of the payout (alpha & numeric for player interface payouts); and (iii) Bingo card identifier or player interface identifier. (iv) Manual payout records must also include the following: (A) Game name or number; (B) Description of pattern covered, such as cover-all or four corners; (C) Signature of all, but not less than two, agents involved in the transaction; (D) For override transactions, verification by a supervisory or management agent independent of the transaction; and (E) Any other information necessary to substantiate the payout. (f) Cash and cash equivalent controls. (2) Procedures must be implemented to control cash or cash equivalents based on the amount of the transaction. These procedures must include documentation by shift, session, or other relevant time period of the following: (i) Inventory, including any increases or decreases; (ii) Transfers; (iii) Exchanges, including acknowledging signatures or initials; and (iv) Resulting variances. (3) Any change to control of accountability, exchange, or transfer requires that the cash or cash equivalents be counted and recorded independently by at least two agents and reconciled to the recorded amount. (g) Technologic aids to the play of bingo. (1) Shipping and receiving. (i) A communication procedure must be established between the supplier, the gaming operation, and the TGRA to properly control the shipping and receiving of all software and hardware components. Such procedures must include: (A) Notification of pending shipments must be provided to the TGRA by the gaming operation; (B) Certification in accordance with 25 CFR part 547; (C) Notification from the supplier to the TGRA, or the gaming operation as approved by the TGRA, of the shipping date and expected date of delivery. The shipping notification must include: ( 1 ( 2 ( 3 ( 4 ( 5 ( 6 (ii) Procedures must be implemented for the exchange of Class II gaming system components for maintenance and replacement. (iii) Class II gaming system components must be shipped in a secure manner to deter unauthorized access. (iv) The TGRA, or its designee, must receive all Class II gaming system components and game play software packages, and verify the contents against the shipping notification. (2) Access credential control methods. (ii) [Reserved] (3) Recordkeeping and audit processes. (A) Date placed into service; (B) Date made available for play; (C) Supplier; (D) Software version; (E) Serial number; (F) Game title; (G) Asset and/or location number; (H) Seal number; and (I) Initial meter reading. (ii) Procedures must be implemented for auditing such records in accordance with § 543.23, Audit and Accounting. (4) System software signature verification. (ii) An agent independent of the bingo operation must perform system software signature verification(s) to verify that only approved software is installed. (iii) Procedures must be implemented for investigating and resolving any software verification variances. (iv) Internal audits must be conducted as set forth in § 543.23, Audit and Accounting. Such audits must be documented. (5) Installation testing. (A) Communication with the Class II gaming system; (B) Communication with the accounting system; (C) Communication with the player tracking system; (D) Currency and vouchers to bill acceptor; (E) Voucher printing; (F) Meter incrementation; (G) Pay table, for verification; (H) Player interface denomination, for verification; (I) All buttons, to ensure that all are operational and programmed appropriately; (J) System components, to ensure that they are safely installed at location; and (K) Locks, to ensure that they are secure and functioning. (ii) [Reserved] (6) Display of rules and necessary disclaimers. (7) TGRA approval of all technologic aids before they are offered for play. (8) All Class II gaming equipment must comply with 25 CFR part 547, Minimum Technical Standards for Gaming Equipment Used With the Play of Class II Games; and (9) Dispute resolution. (h) Operations Malfunctions. (i) Determination of the event causing the malfunction; (ii) Review of relevant records, game recall, reports, logs, surveillance records; (iii) Repair or replacement of the Class II gaming component; (iv) Verification of the integrity of the Class II gaming component before restoring it to operation; and (2) Removal, retirement and/or destruction. (i) For player interfaces and components that accept cash or cash equivalents: (A) Coordinate with the drop team to perform a final drop; (B) Collect final accounting information such as meter readings, drop and payouts; (C) Remove and/or secure any or all associated equipment such as locks, card reader, or ticket printer from the retired or removed component; and (D) Document removal, retirement, and/or destruction. (ii) For removal of software components: (A) Purge and/or return the software to the license holder; and (B) Document the removal. (iii) For other related equipment such as blowers, cards, interface cards: (A) Remove and/or secure equipment; and (B) Document the removal or securing of equipment. (iv) For all components: (A) Verify that unique identifiers, and descriptions of removed/retired components are recorded as part of the retirement documentation; and (B) Coordinate with the accounting department to properly retire the component in the system records. (v) Where the TGRA authorizes destruction of any Class II gaming system components, procedures must be developed to destroy such components. Such procedures must include the following: (A) Methods of destruction; (B) Witness or surveillance of destruction; (C) Documentation of all components destroyed; and (D) Signatures of agent(s) destroying components attesting to destruction. (i) Vouchers. (i) Verify the authenticity of each voucher redeemed. (ii) If the voucher is valid, verify that the patron is paid the appropriate amount. (iii) Document the payment of a claim on a voucher that is not physically available or a voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher. (iv) Retain payment documentation for reconciliation purposes. (v) For manual payment of a voucher of $500 or more, require a supervisory employee to verify the validity of the voucher prior to payment. (2) Vouchers paid during a period while the voucher system is temporarily out of operation must be marked “paid” by the cashier. (3) Vouchers redeemed while the voucher system was temporarily out of operation must be validated as expeditiously as possible upon restored operation of the voucher system. (4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes. (5) Unredeemed vouchers can only be voided in the voucher system by supervisory employees. The accounting department will maintain the voided voucher, if available. (j) All relevant controls from § 543.20, Information and Technology will apply. (k) Revenue Audit. (l) Variance. § 543.9 What are the minimum internal control standards for pull tabs? (a) Supervision. (b) Pull tab inventory. (1) Access to pull tabs is restricted to authorized agents; (2) The pull tab inventory is controlled by agents independent of pull tab sales; (3) Pull tabs exchanged between agents are secured and independently controlled; (4) Increases or decreases to pull tab inventory are recorded, tracked, and reconciled; and (5) Pull tabs are maintained in a secure location, accessible only to authorized agents, and with surveillance coverage adequate to identify persons accessing the area. (c) Pull tab sales. (2) When pull tab sales are recorded manually, total sales must be verified by an agent independent of the pull tab sales being verified. (3) No person may have unrestricted access to pull tab sales records. (d) Winning pull tabs. (2) The redeemed pull tabs must be defaced so that they cannot be redeemed for payment again. (3) Pull tabs that are uniquely identifiable with a machine readable code (including, but not limited to a barcode) may be redeemed, reconciled, and stored by kiosks without the need for defacing, so long as the redeemed pull tabs are secured and destroyed after removal from the kiosk in accordance with the procedures approved by the TGRA. (4) At least two agents must document and verify all prize payouts above $600, or lower threshold as authorized by management and approved by the TGRA. (i) An automated method may substitute for one verification. (ii) The predetermined threshold must be authorized by management, approved by the TGRA, documented, and maintained. (5) Total payout must be calculated and recorded by shift. (e) Pull tab operating funds. (2) All funds used to operate the pull tab game must be independently counted and verified by at least two agents and reconciled to the recorded amounts at the end of each shift or session. (f) Statistical records. (2) A manager independent of the pull tab operations must review statistical information when the pull tab deal has ended or has been removed from the floor and must investigate any unusual statistical fluctuations. These investigations must be documented, maintained for inspection, and provided to the TGRA upon request. (g) Revenue audit. (h) Variances. § 543.10 What are the minimum internal control standards for card games? (a) Supervision. (1) A supervisor may function as a dealer without any other supervision if disputes are resolved by supervisory personnel independent of the transaction or independent of the card games department; or (2) A dealer may function as a supervisor if not dealing the game. (b) Exchanges or transfers. (2) Exchanges from the main card room bank (or cage, if a main card room bank is not used) to the table banks must be verified by the card room dealer and the runner. (3) Transfers between the main card room bank and the cage must be properly authorized and documented. Documentation must be retained for at least 24 hours. (c) Playing cards. (2) Used playing cards that are not to be re-used must be properly cancelled and removed from service to prevent re-use. The removal and cancellation procedure requires TGRA review and approval. (3) Playing cards associated with an investigation must be retained intact and outside of the established removal and cancellation procedure. (d) Shill funds. (2) Returned shill funds must be recorded and verified by a supervisor. (3) The replenishment of shill funds must be documented. (e) Standards for reconciliation of card room bank. (1) Date; (2) Shift; (3) Table number (if applicable); (4) Amount by denomination; (5) Amount in total; and (6) Signatures of both agents. (f) Posted rules. (g) Promotional progressive pots and pools. (i) The payout may be in the form of personal property, such as a car. (ii) A combination of a promotion and progressive pool may be offered. (2) The conditions for participating in current card game promotional progressive pots and/or pools must be prominently displayed or available for patron review at the gaming operation. (3) Individual payouts for card game promotional progressive pots and/or pools that are $600 or more must be documented at the time of the payout to include the following: (i) Patron's name; (ii) Date of payout; (iii) Dollar amount of payout and/or nature and dollar value of any non-cash payout; (iv) The signature of the agent completing the transaction attesting to the disbursement of the payout; and (v) Name of contest/tournament. (4) If the cash (or cash equivalent) payout for the card game promotional progressive pot and/or pool is less than $600, documentation must be created to support accountability of the bank from which the payout was made. (5) Rules governing current promotional pools must be conspicuously posted in the card room and/or available in writing for patron review. The rules must designate: (i) The amount of funds to be contributed from each pot; (ii) What type of hand it takes to win the pool; (iii) How the promotional funds will be paid out; (iv) How/when the contributed funds are added to the pools; and (v) Amount/percentage of funds allocated to primary and secondary pools, if applicable. (6) Promotional pool contributions must not be placed in or near the rake circle, in the drop box, or commingled with gaming revenue from card games or any other gambling game. (7) The amount of the pools must be conspicuously displayed in the card room. (8) At least once each day that the game is offered, the posted pool amount must be updated to reflect the current pool amount. (9) At least once each day that the game is offered, agents independent of the card room must reconcile the increases to the posted pool amount to the cash previously counted or received by the cage. (10) All decreases to the pool must be properly documented, including a reason for the decrease. (11) Promotional funds removed from the card game must be placed in a locked container. (i) Agents authorized to transport the locked container are precluded from having access to the contents keys. (ii) The contents key must be maintained by a department independent of the card room. (iii) At least once a day, the locked container must be removed by two agents, one of whom is independent of the card games department, and transported directly to the cage or other secure room to be counted, recorded, and verified, prior to accepting the funds into cage accountability. (h) Variances. [77 FR 58712, Sept. 21, 2012, as amended at 83 FR 65508, Dec. 21, 2018] § 543.11 [Reserved] § 543.12 What are the minimum internal control standards for gaming promotions and player tracking systems? (a) Supervision. (b) Gaming promotions. (1) The rules of play; (2) The nature and value of the associated prize(s) or cash award(s); (3) Any restrictions or limitations on participant eligibility; (4) The date(s), time(s), and location(s) for the associated promotional activity or activities; (5) Any other restrictions or limitations, including any related to the claim of prizes or cash awards; (6) The announcement date(s), time(s), and location(s) for the winning entry or entries; and (7) Rules governing promotions offered across multiple gaming operations, third party sponsored promotions, and joint promotions involving third parties. (c) Player tracking systems and gaming promotions. (2) All other changes to the player tracking system must be appropriately documented. (d) Variances. § 543.13 What are the minimum internal control standards for complimentary services or items? (a) Supervision. (b) Complimentary services or items. (1) Agents authorized to approve the issuance of complimentary services or items, including levels of authorization; (2) Limits and conditions on the approval and issuance of complimentary services or items; (3) Making and documenting changes to conditions or limits on the approval and issuance of complimentary services or items; (4) Documenting and recording the authorization, issuance, and redemption of complimentary services or items, including cash and non-cash gifts; (i) Records must include the following for all complimentary items and services equal to or exceeding an amount established by the gaming operation and approved by the TGRA: (A) Name of patron who received the complimentary service or item; (B) Name(s) of issuer(s) of the complimentary service or item; (C) The actual cash value of the complimentary service or item; (D) The type of complimentary service or item (i.e., food, beverage); and (E) Date the complimentary service or item was issued. (ii) [Reserved] (c) Complimentary services and items records must be summarized and reviewed for proper authorization and compliance with established authorization thresholds. (1) A detailed reporting of complimentary services or items transactions that meet an established threshold approved by the TGRA must be prepared at least monthly. (2) The detailed report must be forwarded to management for review. (d) Variances. § 543.14 What are the minimum internal control standards for patron deposit accounts and cashless systems? (a) Supervision. (b) Patron deposit accounts and cashless systems. (2) Establishment of patron deposit accounts. (i) The patron must appear at the gaming operation in person, at a designated area of accountability, and present valid government issued picture identification; and (ii) An agent must examine the patron's identification and record the following information: (A) Type, number, and expiration date of the identification; (B) Patron's name; (C) A unique account identifier; (D) Date the account was opened; and (E) The agent's name. (3) The patron must sign the account documentation before the agent may activate the account. (4) The agent or cashless system must provide the patron deposit account holder with a secure method of access. (c) Patron deposits, withdrawals and adjustments. (2) Adjustments made to the patron deposit accounts must be performed by an agent. (3) When a deposit, withdrawal, or adjustment is processed by an agent, a transaction record must be created containing the following information: (i) Same document number on all copies; (ii) Type of transaction, (deposit, withdrawal, or adjustment); (iii) Name or other identifier of the patron; (iv) The unique account identifier; (v) Patron signature for withdrawals, unless a secured method of access is utilized; (vi) For adjustments to the account, the reason for the adjustment; (vii) Date and time of transaction; (viii) Amount of transaction; (ix) Nature of deposit, withdrawal, or adjustment (cash, check, chips); and (x) Signature of the agent processing the transaction. (4) When a patron deposits or withdraws funds from a patron deposit account electronically, the following must be recorded: (i) Date and time of transaction; (ii) Location (player interface, kiosk); (iii) Type of transaction (deposit, withdrawal); (iv) Amount of transaction; and (v) The unique account identifier. (5) Patron deposit account transaction records must be available to the patron upon reasonable request. (6) If electronic funds transfers are made to or from a gaming operation bank account for patron deposit account funds, the bank account must be dedicated and may not be used for any other types of transactions. (d) Variances. § 543.15 What are the minimum internal control standards for lines of credit? (a) Supervision. (b) Establishment of lines of credit policy. (i) A process for the patron to apply for, modify, and/or re-establish lines of credit, to include required documentation and credit line limit; (ii) Authorization levels of credit issuer(s); (iii) Identification of agents authorized to issue lines of credit; (iv) A process for verifying an applicant's credit worthiness; (v) A system for recording patron information, to include: (A) Name, current address, and signature; (B) Identification credential; (C) Authorized credit line limit; (D) Documented approval by an agent authorized to approve credit line limits; (E) Date, time and amount of credit issuances and payments; and (F) Amount of available credit. (vi) A process for issuing lines of credit to: (A) Verify the patron's identity; (B) Notify the patron of the lines of credit terms, including obtaining patron's written acknowledgment of the terms by signature; (C) Complete a uniquely identified, multi-part, lines of credit issuance form, such as a marker or counter check, which includes the terms of the lines of credit transaction; (D) Obtain required signatures; (E) Determine the amount of the patron's available lines of credit; (F) Update the credit balance record at the time of each transaction to ensure that lines of credit issued are within the established limit and balance for that patron; and (G) Require the agent issuing the lines of credit to be independent of the agent who authorized the lines of credit. (vii) A policy establishing credit line limit exceptions to include the following: (A) Identification of the agent(s) authorized to permit a credit line limit to be exceeded; (B) Authorization thresholds; and (C) Required documentation. (viii) A policy governing increases and decreases to a patron's lines of credit account balances to include the following: (A) Documentation and record keeping requirements; (B) Independence between the department that receives the payment and the department that maintains custody of the credit balance for payments made by mail; (C) Collections; (D) Periodic audits and confirmation of balances; and (E) If a collection agency is used, a process to ensure documentation of increases and decreases to the lines of credit account balances. (ix) A policy governing write-offs and settlements to include: (A) Identification of agent(s) authorized to approve write-offs and settlements; (B) Authorization levels for write-offs and settlements of lines of credit instruments; (C) Required documentation for write-offs and settlements; (D) Independence between the agent who established the lines of credit and the agent writing off or settling the lines of credit instrument; and (E) Necessary documentation for the approval of write-offs and settlements and transmittal to the appropriate department for recording and deductibility. (c) Variances. § 543.16 [Reserved] § 543.17 What are the minimum internal control standards for drop and count? (a) Supervision. (b) Count room access. (1) Count team agents may not exit or enter the count room during the count except for emergencies or scheduled breaks. (2) Surveillance must be notified whenever count room agents exit or enter the count room during the count. (3) The count team policy, at a minimum, must address the transportation of extraneous items such as personal belongings, tool boxes, beverage containers, etc., into or out of the count room. (c) Count team. (1) For Tier A and B operations, all counts must be performed by at least two agents. For Tier C operations, all counts must be performed by at least three agents. (2) For Tier A and B operations, at no time during the count can there be fewer than two count team agents in the count room until the drop proceeds have been accepted into cage/vault accountability. For Tier C operations, at no time during the count can there be fewer than three count team agents in the count room until the drop proceeds have been accepted into cage/vault accountability. (3) For Tier A and B operations, count team agents must be rotated on a routine basis such that the count team is not consistently the same two agents more than four days per week. This standard does not apply to gaming operations that utilize a count team of more than two agents. For Tier C operations, count team agents must be rotated on a routine basis such that the count team is not consistently the same three agents more than four days per week. This standard does not apply to gaming operations that utilize a count team of more than three agents. (4) Functions performed by count team agents must be rotated on a routine basis. (5) Count team agents must be independent of the department being counted. A cage/vault agent may be used if they are not the sole recorder of the count and do not participate in the transfer of drop proceeds to the cage/vault. An accounting agent may be used if there is an independent audit of all count documentation. (d) Card game drop standards. (1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the activities. (2) At least two agents must be involved in the removal of the drop box, at least one of whom is independent of the card games department. (3) Once the drop is started, it must continue until finished. (4) All drop boxes may be removed only at the time previously designated by the gaming operation and reported to the TGRA. If an emergency drop is required, surveillance must be notified before the drop is conducted and the TGRA must be informed within a timeframe approved by the TGRA. (5) At the end of each shift: (i) All locked card game drop boxes must be removed from the tables by an agent independent of the card game shift being dropped; (ii) For any tables opened during the shift, a separate drop box must be placed on each table, or a gaming operation may utilize a single drop box with separate openings and compartments for each shift; and (iii) Card game drop boxes must be transported directly to the count room or other equivalently secure area by a minimum of two agents, at least one of whom is independent of the card game shift being dropped, until the count takes place. (6) All tables that were not open during a shift and therefore not part of the drop must be documented. (7) All card game drop boxes must be posted with a number corresponding to a permanent number on the gaming table and marked to indicate game, table number, and shift, if applicable. (e) Player interface and financial instrument storage component drop standards. (2) At least two agents must be involved in the removal of the player interface storage component drop, at least one of whom is independent of the player interface department. (3) All financial instrument storage components may be removed only at the time previously designated by the gaming operation and reported to the TGRA. If an emergency drop is required, surveillance must be notified before the drop is conducted and the TGRA must be informed within a timeframe approved by the TGRA. (4) The financial instrument storage components must be removed by an agent independent of the player interface department, then transported directly to the count room or other equivalently secure area with comparable controls and locked in a secure manner until the count takes place. (i) Security must be provided for the financial instrument storage components removed from player interfaces and awaiting transport to the count room. (ii) Transportation of financial instrument storage components must be performed by a minimum of two agents, at least one of whom is independent of the player interface department. (5) All financial instrument storage components must be posted with a number corresponding to a permanent number on the player interface. (f) Card game count standards. (i) Authorized members of the drop and count teams; and (ii) In an emergency, authorized persons for the resolution of a problem. (2) The card game count must be performed in a count room or other equivalently secure area with comparable controls. (3) Access to the count room during the count must be restricted to members of the drop and count teams, with the exception of authorized observers, supervisors for resolution of problems, and authorized maintenance personnel. (4) If counts from various revenue centers occur simultaneously in the count room, procedures must be in effect to prevent the commingling of funds from different revenue centers. (5) Count equipment and systems must be tested, with the results documented, at minimum before the first count begins to ensure the accuracy of the equipment. (6) The card game drop boxes must be individually emptied and counted so as to prevent the commingling of funds between boxes until the count of the box has been recorded. (i) The count of each box must be recorded in ink or other permanent form of recordation. (ii) For counts that do not utilize a currency counter, a second count must be performed by a member of the count team who did not perform the initial count. Separate counts of chips and tokens must always be performed by members of the count team. (iii) Coupons or other promotional items not included in gross revenue must be recorded on a supplemental document by either the count team members or accounting personnel. All single-use coupons must be cancelled daily by an authorized agent to prevent improper recirculation. (iv) If a currency counter interface is used: (A) It must be restricted to prevent unauthorized access; and (B) The currency drop figures must be transferred via direct communications line or computer storage media to the accounting department. (7) If currency counters are utilized, a count team member must observe the loading and unloading of all currency at the currency counter, including rejected currency. (8) Two counts of the currency rejected by the currency counter must be recorded per table, as well as in total. Posting rejected currency to a nonexistent table is prohibited. (9) Card game drop boxes, when empty, must be shown to another member of the count team, to another agent observing the count, or to surveillance, provided that the count is monitored in its entirety by an agent independent of the count. (10) Procedures must be implemented to ensure that any corrections to the count documentation are permanent and identifiable, and that the original, corrected information remains legible. Corrections must be verified by two count team agents. (11) The count sheet must be reconciled to the total drop by a count team member who may not function as the sole recorder, and variances must be reconciled and documented. (12) All count team agents must sign the count sheet attesting to their participation in the count. (13) A final verification of the total drop proceeds, before transfer to cage/vault, must be performed by at least two agents, one of whom is a supervisory count team member, and one a count team agent. (i) Final verification must include a comparison of currency counted totals against the currency counter/system report, if any counter/system is used. (ii) Any unresolved variances must be documented, and the documentation must remain part of the final count record forwarded to accounting. (iii) This verification does not require a complete recount of the drop proceeds, but does require a review sufficient to verify the total drop proceeds being transferred. (iv) The two agents must sign the report attesting to the accuracy of the total drop proceeds verified. (v) All drop proceeds and cash equivalents that were counted must be submitted to the cage or vault agent (who must be independent of the count team), or to an agent independent of the revenue generation source and the count process, for verification. The agent must certify, by signature, the amount of the drop proceeds delivered and received. Any unresolved variances must be reconciled, documented, and/or investigated by accounting/revenue audit. (14) After verification by the agent receiving the funds, the drop proceeds must be transferred to the cage/vault. (i) The count documentation and records must not be transferred to the cage/vault with the drop proceeds. (ii) The cage/vault agent must have no knowledge or record of the drop proceeds total before it is verified. (iii) All count records must be forwarded to accounting or secured and accessible only by accounting agents. (iv) The cage/vault agent receiving the transferred drop proceeds must sign the count sheet attesting to the verification of the total received, and thereby assume accountability of the drop proceeds, ending the count. (v) Any unresolved variances between total drop proceeds recorded on the count sheet and the cage/vault final verification during transfer must be documented and investigated. (15) The count sheet, with all supporting documents, must be delivered to the accounting department by a count team member or an agent independent of the cage/vault. Alternatively, it may be secured so that it is only accessible to accounting agents. (g) Player interface financial instrument count standards. (i) Authorized members of the drop and count teams; and (ii) In an emergency, authorized persons for the resolution of a problem. (2) The player interface financial instrument count must be performed in a count room or other equivalently secure area with comparable controls. (3) Access to the count room during the count must be restricted to members of the drop and count teams, with the exception of authorized observers, supervisors for resolution of problems, and authorized maintenance personnel. (4) If counts from various revenue centers occur simultaneously in the count room, procedures must be in effect that prevent the commingling of funds from different revenue centers. (5) The count team must not have access to amount-in or bill-in meter amounts until after the count is completed and the drop proceeds are accepted into the cage/vault accountability. (6) Count equipment and systems must be tested, and the results documented, before the first count begins, to ensure the accuracy of the equipment. (7) If a currency counter interface is used: (i) It must be adequately restricted to prevent unauthorized access; and (ii) The currency drop figures must be transferred via direct communications line or computer storage media to the accounting department. (8) The financial instrument storage components must be individually emptied and counted so as to prevent the commingling of funds between storage components until the count of the storage component has been recorded. (i) The count of each storage component must be recorded in ink or other permanent form of recordation. (ii) Coupons or other promotional items not included in gross revenue may be recorded on a supplemental document by the count team members or accounting personnel. All single-use coupons must be cancelled daily by an authorized agent to prevent improper recirculation. (9) If currency counters are utilized, a count team member must observe the loading and unloading of all currency at the currency counter, including rejected currency. (10) Two counts of the currency rejected by the currency counter must be recorded per interface terminal as well as in total. Rejected currency must be posted to the player interface from which it was collected. (11) Storage components, when empty, must be shown to another member of the count team, to another agent who is observing the count, or to surveillance, provided that the count is monitored in its entirety by an agent independent of the count. (12) Procedures must be implemented to ensure that any corrections to the count documentation are permanent, identifiable and the original, corrected information remains legible. Corrections must be verified by two count team agents. (13) The count sheet must be reconciled to the total drop by a count team member who may not function as the sole recorder, and variances must be reconciled and documented. This standard does not apply to vouchers removed from the financial instrument storage components. (14) All count team agents must sign the report attesting to their participation in the count. (15) A final verification of the total drop proceeds, before transfer to cage/vault, must be performed by the at least two agents, one of whom is a supervisory count team member and the other a count team agent. (i) Final verification must include a comparison of currency counted totals against the currency counter/system report, if a counter/system is used. (ii) Any unresolved variances must be documented and the documentation must remain a part of the final count record forwarded to accounting. (iii) This verification does not require a complete recount of the drop proceeds but does require a review sufficient to verify the total drop proceeds being transferred. (iv) The two agents must sign the report attesting to the accuracy of the total drop proceeds verified. (v) All drop proceeds and cash equivalents that were counted must be turned over to the cage or vault cashier (who must be independent of the count team) or to an agent independent of the revenue generation and the count process for verification. Such cashier or agent must certify, by signature, the amount of the drop proceeds delivered and received. Any unresolved variances must be reconciled, documented, and/or investigated by accounting/revenue audit. (16) After certification by the agent receiving the funds, the drop proceeds must be transferred to the cage/vault. (i) The count documentation and records must not be transferred to the cage/vault with the drop proceeds. (ii) The cage/vault agent must not have knowledge or record of the drop proceeds total before it is verified. (iii) All count records must be forwarded to accounting secured and accessible only by accounting agents. (iv) The cage/vault agent receiving the transferred drop proceeds must sign the count sheet attesting to the verification of the total received, and thereby assuming accountability of the drop proceeds, and ending the count. (v) Any unresolved variances between total drop proceeds recorded on the count room report and the cage/vault final verification during transfer must be documented and investigated. (17) The count sheet, with all supporting documents, must be delivered to the accounting department by a count team member or agent independent of the cashiers department. Alternatively, it may be adequately secured and accessible only by accounting department. (h) Collecting currency cassettes and financial instrument storage components from kiosks. (1) Surveillance must be notified prior to the financial instrument storage components or currency cassettes being accessed in a kiosk. (2) At least two agents must be involved in the collection of currency cassettes and/or financial instrument storage components from kiosks and at least one agent should be independent of kiosk accountability. (3) Currency cassettes and financial instrument storage components must be secured in a manner that restricts access to only authorized agents. (4) Redeemed vouchers and pulltabs (if applicable) collected from the kiosk must be secured and delivered to the appropriate department (cage or accounting) for reconciliation. (5) Controls must be established and procedures implemented to ensure that currency cassettes contain the correct denominations and have been properly installed. (i) Kiosk count standards. (i) Authorized agents; and (ii) In an emergency, authorized persons for the resolution of a problem. (2) The kiosk count must be performed in a secure area, such as the cage or count room. (3) If counts from various revenue centers and kiosks occur simultaneously in the count room, procedures must be in effect that prevent the commingling of funds from the kiosks with any revenue centers. (4) The kiosk financial instrument storage components and currency cassettes must be individually emptied and counted so as to prevent the commingling of funds between kiosks until the count of the kiosk contents has been recorded. (i) The count of each box must be recorded in ink or other permanent form of recordation. (ii) Coupons or other promotional items not included in gross revenue (if any) may be recorded on a supplemental document. All single-use coupons must be cancelled daily by an authorized agent to prevent improper recirculation. (5) Procedures must be implemented to ensure that any corrections to the count documentation are permanent, identifiable, and the original, corrected information remains legible. Corrections must be verified by two agents. (j) Controlled keys. (1) Each of the following requires a separate and unique key lock or alternative secure access method: (i) Drop cabinet; (ii) Drop box release; (iii) Drop box content; and (iv) Storage racks and carts used for the drop. (2) Access to and return of keys or equivalents must be documented with the date, time, and signature or other unique identifier of the agent accessing or returning the key(s). (i) For Tier A and B operations, at least two (2) drop team agents are required to be present to access and return keys. For Tier C operations, at least three (3) drop team agents are required to be present to access and return keys. (ii) For Tier A and B operations, at least two (2) count team agents are required to be present at the time count room and other count keys are issued for the count. For Tier C operations, at least three (two for card game drop box keys in operations with three tables or fewer) count team agents are required to be present at the time count room and other count keys are issued for the count. (3) Documentation of all keys, including duplicates, must be maintained, including: (i) Unique identifier for each individual key; (ii) Key storage location; (iii) Number of keys made, duplicated, and destroyed; and (iv) Authorization and access. (4) Custody of all keys involved in the drop and count must be maintained by a department independent of the count and the drop agents as well as those departments being dropped and counted. (5) Other than the count team, no agent may have access to the drop box content keys while in possession of storage rack keys and/or release keys. (6) Other than the count team, only agents authorized to remove drop boxes are allowed access to drop box release keys. (7) Any use of keys at times other than the scheduled drop and count must be properly authorized and documented. (8) Emergency manual keys, such as an override key, for computerized, electronic, and alternative key systems must be maintained in accordance with the following: (i) Access to the emergency manual key(s) used to access the box containing the player interface drop and count keys requires the physical involvement of at least three agents from separate departments, including management. The date, time, and reason for access, must be documented with the signatures of all participating persons signing out/in the emergency manual key(s); (ii) The custody of the emergency manual keys requires the presence of two agents from separate departments from the time of their issuance until the time of their return; and (iii) Routine physical maintenance that requires access to the emergency manual key(s), and does not involve accessing the player interface drop and count keys, only requires the presence of two agents from separate departments. The date, time, and reason for access must be documented with the signatures of all participating agents signing out/in the emergency manual key(s). (9) Controls must be established and procedures implemented to safeguard the use, access, and security of keys for kiosks. (k) Variances. [77 FR 58712, Sept. 21, 2012, as amended at 78 FR 63874, Oct. 25, 2013; 83 FR 65508, Dec. 21, 2018] § 543.18 What are the minimum internal control standards for the cage, vault, kiosk, cash and cash equivalents? (a) Supervision. (b) Check cashing. (i) Verify the patron's identity; (ii) Examine the check to ensure it includes the patron's name, current address, and signature; (iii) For personal checks, verify the patron's check cashing authority and record the source and results in accordance with management policy; however (iv) If a check guarantee service is used to guarantee the transaction and the procedures required by the check guarantee service are followed, then the above requirements do not apply. (2) When counter checks are issued, the following must be included on the check: (i) The patron's name and signature; (ii) The dollar amount of the counter check; (iii) Patron's bank name, bank routing, and account numbers; (iv) Date of issuance; and (v) Signature of the agent approving the counter check transaction. (3) Checks that are not deposited in the normal course of business, as established by management, (held checks) are subject to § 543.15 lines of credit standards. (4) When traveler's checks or other guaranteed drafts, such as cashier's checks, are presented, the cashier must comply with the examination and documentation procedures as required by the issuer. (5) If a third party check cashing or guarantee service is used, the examination and documentation procedures required by the service provider apply, unless otherwise provided by tribal law or regulation. (c) Cage and vault accountability. (2) Increases and decreases to the total cage inventory must be verified, supported by documentation, and recorded. Documentation must include the date and shift, the purpose of the increase/decrease, the agent(s) completing the transaction, and the person or department receiving the cage funds (for decreases only). (3) The cage and vault inventories (including coin rooms) must be counted independently by at least two agents, attested to by signature, and recorded in ink or other permanent form at the end of each shift during which the activity took place. These agents must make individual counts to compare for accuracy and maintain individual accountability. All variances must be documented and investigated. (4) The gaming operation must establish and comply with a minimum bankroll formula to ensure the gaming operation maintains cash or cash equivalents (on hand and in the bank, if readily accessible) in an amount sufficient to satisfy obligations to the gaming operation's patrons as they are incurred. (d) Kiosks. (2) Currency cassettes must be counted and filled by an agent and verified independently by at least one agent, all of whom must sign each cassette. (3) Currency cassettes must be secured with a lock or tamper resistant seal and, if not placed inside a kiosk, must be stored in a secured area of the cage/vault. (4) The TGRA or the gaming operation, subject to the approval of the TGRA, must develop and implement physical security controls over the kiosks. Controls should address the following: forced entry, evidence of any entry, and protection of circuit boards containing programs. (5) With regard to cashless systems, the TGRA or the gaming operation, subject to the approval of the TGRA, must develop and implement procedures to ensure that communications between the kiosk and system are secure and functioning. (6) The following reconciliation reports must be available upon demand for each day, shift, and drop cycle (this is not required if the system does not track the information, but system limitation(s) must be noted): (i) Starting balance dollar amount per financial instrument; (ii) Starting balance number of items per financial instrument; (iii) Dollar amount per financial instrument issued; (iv) Number of items per financial instrument issued; (v) Dollar amount per financial instrument redeemed; (vi) Number of items per financial instrument redeemed; (vii) Dollar amount per financial instrument increases; (viii) Number of items per financial instrument increases; (ix) Dollar amount per financial instrument decreases; (x) Number of items per financial instrument decreases; (xi) Ending balance dollar amount per financial instrument; and (xii) Ending balance number of items per financial instrument. (e) Patron deposited funds. (1) The receipt or withdrawal of a patron deposit must be documented, with a copy given to the patron and a copy remaining in the cage. (2) Both copies of the document of receipt or withdrawal must contain the following information: (i) Same receipt number on each copy; (ii) Patron's name and signature; (iii) Date of receipt and withdrawal; (iv) Dollar amount of deposit/withdrawal (for foreign currency transactions include the US dollar equivalent, the name of the foreign country, and the amount of the foreign currency by denomination); (v) Nature of deposit/withdrawal; and (vi) Name and signature of the agent who conducted the transaction. (3) Procedures must be established and complied with for front money deposits to: (i) Maintain a detailed record by patron name and date of all funds on deposit; (ii) Maintain a current balance of all patron deposits that are in the cage/vault inventory or accountability; and (iii) Reconcile the current balance with the deposits and withdrawals at least daily. (f) Promotional payments, drawings, and giveaway programs. (1) All payments must be documented to support the cage accountability. (2) Payments above $600 (or lesser amount as approved by TGRA) must be documented at the time of the payment, and documentation must include the following: (i) Date and time; (ii) Dollar amount of payment or description of personal property; (iii) Reason for payment; and (iv) Patron's name and confirmation that identity was verified (drawings only). (v) Signature(s) of at least two agents verifying, authorizing, and completing the promotional payment with the patron. For computerized systems that validate and print the dollar amount of the payment on a computer generated form, only one signature is required. (g) Chip(s) and token(s). (1) Purchase; (2) Receipt; (3) Inventory; (4) Storage; and (5) Destruction. (h) Vouchers. (i) Verify the authenticity of each voucher redeemed. (ii) If the voucher is valid, verify that the patron is paid the appropriate amount. (iii) Document the payment of a claim on a voucher that is not physically available or a voucher that cannot be validated such as a mutilated, expired, lost, or stolen voucher. (iv) Retain payment documentation for reconciliation purposes. (v) For manual payment of a voucher of $500 or more, require a supervisory employee to verify the validity of the voucher prior to payment. (2) Vouchers paid during a period while the voucher system is temporarily out of operation must be marked “paid” by the cashier. (3) Vouchers redeemed while the voucher system was temporarily out of operation must be validated as expeditiously as possible upon restored operation of the voucher system. (4) Paid vouchers must be maintained in the cashier's accountability for reconciliation purposes. (5) Unredeemed vouchers can only be voided in the voucher system by supervisory employees. The accounting department will maintain the voided voucher, if available. (i) Cage and vault access. (1) Restrict physical access to the cage to cage agents, designated staff, and other authorized persons; and (2) Limit transportation of extraneous items such as personal belongings, tool boxes, beverage containers, etc., into and out of the cage. (j) Variances. [77 FR 58712, Sept. 21, 2012, as amended at 83 FR 65509, Dec. 21, 2018] § 543.19 [Reserved] § 543.20 What are the minimum internal control standards for information technology and information technology data? (a) Supervision. (2) The supervisory agent must be independent of the operation of Class II games. (3) Controls must ensure that duties are adequately segregated and monitored to detect procedural errors and to prevent the concealment of fraud. (4) Information technology agents having access to Class II gaming systems may not have signatory authority over financial instruments and payout forms and must be independent of and restricted from access to: (i) Financial instruments; (ii) Accounting, audit, and ledger entries; and (iii) Payout forms. (b) As used in this section only, a system is any computerized system that is integral to the gaming environment. This includes, but is not limited to, the server and peripherals for Class II gaming system, accounting, surveillance, essential phone system, and door access and warning systems. (c) Class II gaming systems' logical and physical controls. Controls must be established and procedures implemented to ensure adequate: (1) Control of physical and logical access to the information technology environment, including accounting, voucher, cashless and player tracking systems, among others used in conjunction with Class II gaming; (2) Physical and logical protection of storage media and its contents, including recovery procedures; (3) Access credential control methods; (4) Record keeping and audit processes; and (5) Departmental independence, including, but not limited to, means to restrict agents that have access to information technology from having access to financial instruments. (d) Physical security. (2) Access devices to the systems' secured physical location, such as keys, cards, or fobs, must be controlled by an independent agent. (3) Access to the systems' secured physical location must be restricted to agents in accordance with established policies and procedures, which must include maintaining and updating a record of agents granted access privileges. (4) Network Communication Equipment must be physically secured from unauthorized access. (e) Logical security. (i) Systems' software and application programs; (ii) Data associated with Class II gaming; and (iii) Communications facilities, systems, and information transmissions associated with Class II gaming systems. (2) Unused services and non-essential ports must be disabled whenever possible. (3) Procedures must be implemented to ensure that all activity performed on systems is restricted and secured from unauthorized access, and logged. (4) Communications to and from systems via Network Communication Equipment must be logically secured from unauthorized access. (f) User controls. (2) Management personnel or agents independent of the department being controlled must assign and control access to system functions. (3) Access credentials such as passwords, PINs, or cards must be controlled as follows: (i) Each user must have his or her own individual access credential; (ii) Access credentials must be changed at an established interval approved by the TGRA; and (iii) Access credential records must be maintained either manually or by systems that automatically record access changes and force access credential changes, including the following information for each user: (A) User's name; (B) Date the user was given access and/or password change; and (C) Description of the access rights assigned to user. (4) Lost or compromised access credentials must be deactivated, secured or destroyed within an established time period approved by the TGRA. (5) Access credentials of terminated users must be deactivated within an established time period approved by the TGRA. (6) Only authorized agents may have access to inactive or closed accounts of other users, such as player tracking accounts and terminated user accounts. (g) Installations and/or modifications. (2) Records must be kept of all new installations and/or modifications to Class II gaming systems. These records must include, at a minimum: (i) The date of the installation or modification; (ii) The nature of the installation or change such as new software, server repair, significant configuration modifications; (iii) Evidence of verification that the installation or the modifications are approved; and (iv) The identity of the agent(s) performing the installation/modification. (3) Documentation must be maintained, such as manuals and user guides, describing the systems in use and the operation, including hardware. (h) Remote access. (i) Name of agent authorizing the access; (ii) Name of agent accessing the system; (iii) Verification of the agent's authorization; (iv) Reason for remote access; (v) Description of work to be performed; (vi) Date and time of start of end-user remote access session; and (vii) Date and time of conclusion of end-user remote access session. (2) All remote access must be performed via a secured method. (i) Incident monitoring and reporting. (2) All security incidents must be responded to within an established time period approved by the TGRA and formally documented. (j) Data backups. (i) Daily data backup of critical information technology systems; (ii) Data backup of critical programs or the ability to reinstall the exact programs as needed; (iii) Secured storage of all backup data files and programs, or other adequate protection; (iv) Mirrored or redundant data source; and (v) Redundant and/or backup hardware. (2) Controls must include recovery procedures, including, but not limited to, the following: (i) Data backup restoration; (ii) Program restoration; and (iii) Redundant or backup hardware restoration. (3) Recovery procedures must be tested on a sample basis at specified intervals at least annually. Results must be documented. (4) Backup data files and recovery components must be managed with at least the same level of security and access controls as the system for which they are designed to support. (k) Software downloads. (l) Verifying downloads. § 543.21 What are the minimum internal control standards for surveillance? (a) Supervision. (b) Surveillance equipment and control room(s). (1) For Tier A, the surveillance system must be maintained and operated from a secured location, such as a locked cabinet. For Tiers B and C, the surveillance system must be maintained and operated from a staffed surveillance operation room(s). (2) The surveillance operation room(s) must be secured to prevent unauthorized entry. (3) Access to the surveillance operation room(s) must be limited to surveillance agents and other authorized persons. (4) Surveillance operation room(s) access logs must be maintained. (5) Surveillance operation room equipment must have total override capability over all other satellite surveillance equipment. (6) Power loss to the surveillance system: (i) For Tier A, in the event of power loss to the surveillance system, alternative security procedures, such as additional supervisory or security agents, must be implemented immediately. (ii) For Tier B and C, in the event of power loss to the surveillance system, an auxiliary or backup power source must be available and capable of providing immediate restoration of power to the surveillance system to ensure that surveillance agents can observe all areas covered by dedicated cameras. (7) The surveillance system must record an accurate date and time stamp on recorded events. The displayed date and time must not significantly obstruct the recorded view. (8) All surveillance agents must be trained in the use of the equipment, games, and house rules. (9) Each camera required by the standards in this section must be installed in a manner that will prevent it from being readily obstructed, tampered with, or disabled. (10) The surveillance system must: (i) Have the capability to display all camera views on a monitor; (ii) Include sufficient numbers of recording devices to record the views of all cameras required by this section; (iii) Record all camera views; and (iv) For Tier B and C only, include sufficient numbers of monitors to simultaneously display gaming and count room activities. (11) A periodic inspection of the surveillance systems must be conducted. When a malfunction of the surveillance system is discovered, the malfunction and necessary repairs must be documented and repairs initiated within seventy-two (72) hours. (i) If a dedicated camera malfunctions, alternative security procedures, such as additional supervisory or security agents, must be implemented immediately. (ii) The TGRA must be notified of any surveillance system and/or camera(s) that have malfunctioned for more than twenty-four (24) hours and the alternative security measures being implemented. (c) Additional surveillance requirements. (1) Surveillance of the progressive prize meters for Class II gaming systems at the following thresholds: (i) Wide area progressives with a reset amount of $1 million; and (ii) In-house progressives with a reset amount of $250,000. (2) Manual bingo: (i) For manual draws, the surveillance system must monitor the bingo ball drawing device or mechanical random number generator, which must be recorded during the course of the draw by a dedicated camera to identify the numbers or other designations drawn; and (ii) The surveillance system must monitor and record the activities of the bingo game, including drawing, and entering the balls, numbers or other designations drawn. (3) Card games: (i) Except for card game tournaments, a dedicated camera(s) with sufficient clarity must be used to provide: (A) An overview of the activities on each card table surface, including card faces and cash and/or cash equivalents; (B) An overview of card game activities, including patrons and dealers; and (C) An unobstructed view of all posted progressive pool amounts. (ii) For card game tournaments, a dedicated camera(s) must be used to provide an overview of tournament activities, and any area where cash or cash equivalents are exchanged. (4) Cage and vault: (i) The surveillance system must monitor and record a general overview of activities occurring in each cage and vault area with sufficient clarity to identify individuals within the cage and patrons and staff members at the counter areas and to confirm the amount of each cash transaction; (ii) Each cashier station must be equipped with one (1) dedicated overhead camera covering the transaction area; and (iii) The cage or vault area in which exchange and transfer transactions occur must be monitored and recorded by a dedicated camera or motion activated dedicated camera that provides coverage with sufficient clarity to identify the chip values and the amounts on the exchange and transfer documentation. Controls provided by a computerized exchange and transfer system constitute an adequate alternative to viewing the amounts on the exchange and transfer documentation. (5) Count rooms: (i) The surveillance system must monitor and record with sufficient clarity a general overview of all areas where cash or cash equivalents may be stored or counted; and (ii) The surveillance system must provide coverage of count equipment with sufficient clarity to view any attempted manipulation of the recorded data. (6) Kiosks: The surveillance system must monitor and record a general overview of activities occurring at each kiosk with sufficient clarity to identify the activity and the individuals performing it, including maintenance, drops or fills, and redemption of wagering vouchers or credits. (d) Reporting requirements. (e) Recording retention. (1) All recordings required by this section must be retained for a minimum of seven days; and (2) Suspected crimes, suspicious activity, or detentions by security agents discovered within the initial retention period must be copied and retained for a time period, not less than one year. (f) Logs. (1) Compliance with the storage, identification, and retention standards required in this section; (2) Each malfunction and repair of the surveillance system as defined in this section; and (3) Activities performed by surveillance agents as required by the controls in this section. [77 FR 58712, Sept. 21, 2012, as amended at 78 FR 63875, Oct. 25, 2013] § 543.22 [Reserved] § 543.23 What are the minimum internal control standards for audit and accounting? (a) Conflicts of standards. (b) Accounting. (1) Prepares accurate, complete, legible, and permanent records of all transactions pertaining to gaming revenue and activities for operational accountability. (2) Prepares general accounting records on a double-entry system of accounting, maintaining detailed, supporting, subsidiary records, and performs the following activities: (i) Record gaming activity transactions in an accounting system to identify and track all revenues, expenses, assets, liabilities, and equity; (ii) Record all markers, IOU's, returned checks, held checks, or other similar credit instruments; (iii) Record journal entries prepared by the gaming operation and by any independent accountants used; (iv) Prepare income statements and balance sheets; (v) Prepare appropriate subsidiary ledgers to support the balance sheet; (vi) Prepare, review, and maintain accurate financial statements; (vii) Prepare transactions in accordance with the appropriate authorization, as provided by management; (viii) Record transactions to facilitate proper recording of gaming revenue and fees, and to maintain accountability of assets; (ix) Compare recorded accountability for assets to actual assets at periodic intervals, and take appropriate action with respect to any variances; (x) Segregate functions, duties, and responsibilities; (xi) Prepare minimum bankroll calculations; and (xii) Maintain and preserve all financial records and relevant supporting documentation. (c) Internal audit. (1) Internal auditor(s) perform audits of each department of a gaming operation, at least annually, to review compliance with TICS, SICS, and these MICS, which include at least the following areas: (i) Bingo, including supervision, bingo cards, bingo card sales, draw, prize payout; cash and equivalent controls, technologic aids to the play of bingo, operations, vouchers, and revenue audit procedures; (ii) Pull tabs, including, supervision, pull tab inventory, pull tab sales, winning pull tabs, pull tab operating funds, statistical records, and revenue audit procedures; (iii) Card games, including supervision, exchange or transfers, playing cards, shill funds, reconciliation of card room bank, posted rules, and promotional progressive pots and pools; (iv) Gaming promotions and player tracking procedures, including supervision, gaming promotion rules and player tracking systems; (v) Complimentary services or items, including procedures for issuing, authorizing, redeeming, and reporting complimentary service items; (vi) Patron deposit accounts and cashless systems procedures, including supervision, patron deposit accounts and cashless systems, as well as patron deposits, withdrawals and adjustments; (vii) Lines of credit procedures, including establishment of lines of credit policy; (viii) Drop and count standards, including supervision, count room access, count team, card game drop standards, player interface and financial instrument drop standards, card game count standards, player interface financial instrument count standards, collecting currency cassettes and financial instrument storage components from kiosks, kiosk count standards, and controlled keys; (ix) Cage, vault, cash and cash equivalent procedures, including supervision, cash and cash equivalents, personal checks, cashier's checks, traveler's checks, payroll checks, and counter checks, cage and vault accountability, kiosks, patron deposited funds, promotional payouts, drawings, and giveaway programs, chip and token standards, and cage and vault access; (x) Information technology, including supervision, class II gaming systems' logical and physical controls, independence, physical security, logical security, user controls, installations and/or modifications, remote access, incident monitoring and reporting, data back-ups, software downloads, and verifying downloads; and (xi) Accounting standards, including accounting records, maintenance and preservation of financial records and relevant supporting documentation. (2) Internal auditor(s) are independent of gaming operations with respect to the departments subject to audit (auditors internal to the operation, officers of the TGRA, or outside CPA firm may perform this function). (3) Internal auditor(s) report directly to the Tribe, TGRA, audit committee, or other entity designated by the Tribe. (4) Documentation such as checklists, programs, reports, etc. is prepared to evidence all internal audit work and follow-up performed as it relates to compliance with TICS, SICS, and these MICS, including all instances of noncompliance. (5) Audit reports are maintained and made available to the Commission upon request and must include the following information: (i) Audit objectives; (ii) Audit procedures and scope; (iii) Findings and conclusions; (iv) Recommendations, if applicable; and (v) Management's response. (6) All material exceptions identified by internal audit work are investigated and resolved and the results are documented. (7) Internal audit findings are reported to management, responded to by management stating corrective measures to be taken, and included in the report delivered to management, the Tribe, TGRA, audit committee, or other entity designated by the Tribe for corrective action. (8) Follow-up observations and examinations is performed to verify that corrective action has been taken regarding all instances of non-compliance. The verification is performed within six (6) months following the date of notification of non-compliance. (d) Annual requirements. (2) The tribe must submit two copies of the agreed-upon procedures report to the Commission within 120 days of the gaming operation's fiscal year end in conjunction with the submission of the annual financial audit report required pursuant to 25 CFR part 571. (3) Review of internal audit. (A) Completing the internal audit checklist; (B) Ensuring that the internal auditor completed checklists for each gaming department of the operation; (C) Verifying that any areas of non-compliance have been identified; (D) Ensuring that audit reports are completed and include responses from management; and (E) Verifying that appropriate follow-up on audit findings has been conducted and necessary corrective measures have been taken to effectively mitigate the noted risks. (ii) If the CPA determines that the internal audit procedures performed during the fiscal year have been properly completed, the CPA may rely on the work of the internal audit for the completion of the MICS checklists as they relate to the standards covered by this part. (4) Report format. [77 FR 58712, Sept. 21, 2012, as amended at 83 FR 65509, Dec. 21, 2018] § 543.24 What are the minimum internal control standards for auditing revenue? (a) Supervision. (b) Independence. (c) Documentation. (d) Controls must be established and procedures implemented to audit of each of the following operational areas: (1) Bingo. (ii) Daily, reconcile supporting records and documents to summarized paperwork or electronic records ( e.g. (iii) At least monthly, review variances related to bingo accounting data in accordance with an established threshold, which must include, at a minimum, variance(s) noted by the Class II gaming system for cashless transactions in and out, electronic funds transfer in and out, external bonus payouts, vouchers out and coupon promotion out. Investigate and document any variance noted. (iv) At least monthly, review statistical reports for any deviations from the mathematical expectations exceeding a threshold established by the TGRA. Investigate and document any deviations compared to the mathematical expectations required to be submitted per § 547.4. (v) At least monthly, take a random sample, foot the vouchers redeemed and trace the totals to the totals recorded in the voucher system and to the amount recorded in the applicable cashier's accountability document. (2) Pull tabs. (ii) At the end of each month, verify the accuracy of the ending balance in the pull tab control log by reconciling the pull tabs on hand. Investigate and document any variance noted. (iii) At least monthly, compare for reasonableness the amount of pull tabs sold from the pull tab control log to the amount of pull-tab sales. (iv) At least monthly, review statistical reports for any deviations exceeding a specified threshold, as defined by the TGRA. Investigate and document any large and unusual fluctuations noted. (3) Card games. (ii) At least monthly, review all payouts for the promotional progressive pots, pools, or other promotions to verify payout accuracy and proper accounting treatment and that they are conducted in accordance with conditions provided to the patrons. (iii) At the conclusion of each contest/tournament, reconcile all contest/tournament entry and payout forms to the dollar amounts recorded in the appropriate accountability document. (4) Gaming promotions and player tracking. (ii) At least monthly, for computerized player tracking systems, perform the following procedures: (A) Review authorization documentation for all manual point additions/deletions for propriety; (B) Review exception reports, including transfers between accounts; and (C) Review documentation related to access to inactive and closed accounts. (iii) At least annually, all computerized player tracking systems must be reviewed by agent(s) independent of the individuals that set up or make changes to the system parameters. The review must be performed to determine that the configuration parameters are accurate and have not been altered without appropriate management authorization Document and maintain the test results. (5) Complimentary services or items. (6) Patron deposit accounts. (ii) At least weekly, review manual increases and decreases to/from player deposit accounts to ensure proper adjustments were authorized. (7) Lines of credit. (A) Select a sample of line of credit accounts; (B) Ascertain compliance with credit limits and other established credit issuance procedures; (C) Reconcile outstanding balances of both active and inactive (includes write-offs and settlements) accounts on the accounts receivable listing to individual credit records and physical instruments. This procedure need only be performed once per year for inactive accounts; and (D) Examine line of credit records to determine that appropriate collection efforts are being made and payments are being properly recorded. (E) For at least five (5) days during the review period, subsequently reconcile partial payment receipts to the total payments recorded by the cage for the day and account for the receipts numerically. (ii) At least monthly, perform an evaluation of the collection percentage of credit issued to identify unusual trends. (8) Drop and count. (ii) At least quarterly, unannounced weigh scale and weigh scale interface (if applicable) tests must be performed, and the test results documented and maintained. This test may be performed by internal audit or the TGRA. The result of these tests must be documented and signed by the agent(s) performing the test. (iii) For computerized key security systems controlling access to drop and count keys, perform the following procedures: (A) At least quarterly, review the report generated by the computerized key security system indicating the transactions performed by the individual(s) that adds, deletes, and changes users' access within the system ( i.e., (B) At least quarterly, review the report generated by the computerized key security system indicating all transactions performed to determine whether any unusual drop and count key removals or key returns occurred; and (C) At least quarterly, review a sample of users that are assigned access to the drop and count keys to determine that their access to the assigned keys is appropriate relative to their job position. (iv) At least quarterly, an inventory of all controlled keys must be performed and reconciled to records of keys made, issued, and destroyed. Investigations must be performed for all keys unaccounted for, and the investigation documented. (9) Cage, vault, cash, and cash equivalents. (ii) At least monthly, trace the amount of cage deposits to the amounts indicated in the bank statements. (iii) Twice annually, a count must be performed of all funds in all gaming areas ( i.e. (A) Counts must be observed by an individual independent of the department being counted. It is permissible for the individual responsible for the funds to perform the actual count while being observed. (B) Internal audit may perform and/or observe the two counts. (iv) At least annually, select a sample of invoices for chips and tokens purchased, and trace the dollar amount from the purchase invoice to the accountability document that indicates the increase to the chip or token inventory to ensure that the proper dollar amount has been recorded. (v) At each business year end, create and maintain documentation evidencing the amount of the chip/token liability, the change in the liability from the previous year, and explanations for adjustments to the liability account including any adjustments for chip/token float. (vi) At least monthly, review a sample of returned checks to determine that the required information was recorded by cage agent(s) when the check was cashed. (vii) At least monthly, review exception reports for all computerized cage systems for propriety of transactions and unusual occurrences. The review must include, but is not limited to, voided authorizations. All noted improper transactions or unusual occurrences identified must be investigated and the results documented. (viii) Daily, reconcile all parts of forms used to document increases/decreases to the total cage inventory, investigate any variances noted, and document the results of such investigations. (10) Inventory. (ii) Periodically perform minimum bankroll calculations to ensure that the gaming operation maintains cash in an amount sufficient to satisfy the gaming operation's obligations. [77 FR 58712, Sept. 21, 2012, as amended at 83 FR 65509, Dec. 21, 2018] §§ 543.25-543.49 [Reserved]