In addition to Minnesota Statutes, sections 349.12, subdivisions 12b, 12c, and 12d; 349.1721, subdivision 4; and 349.211, subdivision 2a, electronic pull-tab tickets, games, devices, and game systems must meet the requirements contained in this part.
An initial screen displaying a main menu must show:
the manufacturer's logo;
the compulsive gambling hotline telephone number;
all board-approved electronic pull-tab games available for play; and
electronic linked bingo games, if applicable.
The following features are required on an electronic pull-tab flare.
The base game flare must contain the:
game name and serial number, which must be identical to the same information that appears on the tickets in the deal;
unique form number for that game;
prize structure, including the quantity of symbols or numbers for winning tickets by domination with their respective winning symbol or number combinations. The prize amounts may not exceed the limit under Minnesota Statutes, section 349.211; and
The bonus game flare must contain the:
number of bonus plays;
quantity and denominations of bonus plays; and
The summary flare must contain the:
combined total quantity and denominations of tickets and bonus plays; and
If there is no bonus play, the base game flare information is sufficient.
The following features are required on an electronic pull-tab ticket:
manufacturer's name or its board-registered logo;
game name, which must be identical to the game name on the flare for that deal;
game serial number, which must be a minimum of five and a maximum of eight characters, and must not be repeated on gambling equipment of the same form number for 3-1/2 years from the date of the manufacturer's invoice to the distributor. There must not be more than one serial number in a deal;
unique form number for that game;
quantity of winners in each tier, and the respective winning numbers or symbols and prize amount;
ability to access the ticket and base flare;
player account balance;
primary and secondary win indicators;
a defined area on the face of the ticket for the windows or seals covering the numbers or symbols; and
winning numbers or symbols in a straight, consecutive pattern under the windows or seals.
For winning tickets, the symbol combination for each denomination must be identical in the base game for all deals within that form number.
A winning ticket that includes a bonus prize must not exceed statutory prize limits under Minnesota Statutes, section 349.211.
The following features are required on a bonus screen:
manufacturer's name or board-registered logo;
seal or animation;
number of seals to select;
winning prize amounts; and
total win amount from bonus prizes.
Electronic multiple chance games must include a feature where the player must accept the prize or forfeit the prize for a chance of a prize greater than, equal to, or less than the qualifying winning ticket being forfeited.
Electronic multiple chance games must indicate how a player makes a selection on the screen showing the chance and that the chance may contain a prize greater than, equal to, or less than the qualifying winning ticket. The chance screen must provide for random selection of the chance.
Potential chance prizes must be available as shown on the flare, which must state that chances may contain a prize greater than, equal to, or less than the qualifying winning ticket.
All application software must be owned by the manufacturer. Software developed by the manufacturer must also meet the requirements of this subpart.
For purposes of this subpart, application software is developed by the manufacturer if the manufacturer designs the central system, database, user interface, the program architecture, and programs the source code.
A licensed manufacturer may jointly develop application software for an electronic linked bingo system or an electronic pull-tab system with a licensed linked bingo game provider if the jointly developed application software permits the operation of electronic linked bingo or electronic pull-tab games on the same electronic linked bingo or electronic pull-tab device.
Any application software to be used by the manufacturer must be wholly owned free and clear and without any further obligation or condition by any entity other than the licensed manufacturer.
The electronic pull-tab game system manufacturer must provide documentation establishing ownership of the intellectual property rights to the entire game application software and system.
If there is any change in software or hardware by a manufacturer, the manufacturer must assign a new version or code build number and must submit the new software version or code build number to the board for approval. The new version or code build number must be approved by a certified independent testing laboratory.
A manufacturer's electronic pull-tab devices must operate on the same version of all installed software. When upgrading pull-tab device software, all devices must be on the same version of all installed software within seven days of the first installed upgrade.
All pull-tab game systems must automatically close and update all site activity from the previous day to the central server by 2:30 a.m. central standard time.
Electronic monitoring of the operation of the electronic pull-tab system by the board will be limited to read-only access of transaction logs and status of the system. The board is not allowed to alter any data or game play.
An electronic pull-tab game system must provide secured data transmission to all participating locations.
If there is a change in the version or code build number of a system or game, the manufacturer must assign a new version or code build number for any changes or upgrades to the electronic pull-tab system or game to indicate a change of the version or code build number of the system or game according to standard practices.
Any changes to the electronic pull-tab game or system must be approved by the director before the game or system is placed into operation.
Any changes in a version or code build number that have an effect on the outcome of a previously approved game must be retested by a certified independent testing laboratory.
Connections between all components and access points of the electronic game system must only be through the use of secure communication protocols that are designed to prevent unauthorized access or tampering, employing:
Advanced Encryption Standard (AES) specifications as defined by the National Institute of Standards and Technology (NIST); and
IEEE 802.11 standards contained in the Wi-Fi Protected Access II (WPA2) authentication protocols.
The electronic pull-tab game system and all devices that communicate with the electronic pull-tab game system must have the ability to allow for an independent verification check of the system's software from an authorized source approved by the board. The independent verification check ability is required for all application software that the board determines may affect the integrity of the game. The verification check must provide a means for on-site and off-site field verification of the software and applicable device to identify and validate the program. All Minnesota board-approved games must be identical to the games presented to a certified independent testing laboratory.
Electronic accounting data must be at least ten digits in length and must be maintained in credit units equal to dollars and cents.
The system must record value of cash in, tickets played, credits won, credits played, cash out, and unredeemed credits.
Local and central servers and electronic pull-tab devices must not be capable of being used as stand-alone units for the purposes of engaging in any function or use not permitted by these standards at any time.
External ports on the device, if any, will be secured or disabled from unauthorized use.
Local and central servers must have nonvolatile backup memory or its equivalent, which must be maintained in a secure compartment on each local and central server for the purpose of storing and preserving a redundant set of critical data which include:
error corrections that may have occurred on electronic pull-tab devices or local and central servers, such as an invalid PIN or a game interrupt;
program error check and verification and authentication of any mismatch;
recall of all wagers and other play information associated with the last 100 plays on each device, including the electronic pull-tab ticket and the serial number of the game;
electronic accounting data capturing the record of transactions for electronic pull-tab devices in use for each local and central server including:
electronic device and game configuration data;
software state (the last normal state or last status before interruption); and
a log of the last 100 transactions on each device;
comprehensive checks of critical memory for each device in operation following game initiation but prior to display of game outcome to the player; an unrecoverable corruption of critical memory must result in an error notification and cause all electronic pull-tab devices in play to cease further function. An unrecoverable critical memory error report must be immediately generated to the Gambling Control Board and must include the name of the authorized person who performs any recapture or memory clear of the local or central server;
the system must have the ability to immediately, accurately, and securely cash out all players who have funds in the system in the event of power or communications network loss or other time of game or play interruption; and
all game play records must be kept for 3-1/2 years.
An electronic pull-tab game system must use randomizing procedures in the distribution of electronic pull-tabs. The randomizing process for each pull-tab game must take place prior to the use of the game at the sales location. As used in this part, unless the context requires a different meaning, "pull-tab position" means the first pull-tab dealt, second pull-tab dealt, in sequential order. Any random number generation, shuffling, or randomization of outcomes used in connection with an electronic pull-tab system must be by use of a random number generation application that has successfully passed standard tests for randomness and unpredictability as defined in part 7861.0210, subpart 44.
Prior to the commencement of an electronic pull-tab game, the following data must be maintained and be viewable electronically on the electronic pull-tab game system device:
a unique form number identifying each game;
a description of the game sufficient to categorize the game relative to other games;
the number of total electronic tickets in the game;
the overall payout percentage for the game and the number of electronic tickets at each award amount;
the purchase price per electronic ticket assigned to the game;
flare information listing quantity and denominations of winning tickets for the base game and bonus games, and a total for the game; and
bonus play, if any.
Upon request from a pull-tab device, the electronic pull-tab system must display an electronic facsimile of a pull-tab ticket. Once dispensed, such ticket must not be reused.
The communications network system must be available for and have the capability of being tested by the board on site.
The system must include on-demand remote access at all times by the board to all electronic reporting data without participation of the manufacturer or the distributor.
Only upon the game termination shall the finite details of that game be revealed to the persons performing the game audit or status check.
If an audit or other game determination is conducted while a game is in play, termination of the entire game must immediately occur. An audit or game determination includes a determination of the individual prizes won or individual prizes remaining to be won.
Daily reports will be made available to the licensed organization's authorized personnel which contain data relating to gross ticket sales and gross prizes paid on a per-game basis.
An electronic pull-tab game system must allow for the early termination of games as determined by the licensed organization's authorized personnel.
All game definition files must contain the following information:
purchase price per electronic ticket;
game ticket count; and
prize values with an associated index and frequency associated with how many of that particular prize exist.
The electronic pull-tab game system must be located in Minnesota and in a secure location with limited, authorized access.
Any system elements that hold game data, other than the electronic pull-tab devices, must be in a locked area or in a locked case or compartment with access limited to designated personnel.
The manufacturer must register employees having authorized system access with the board.
The system must be in a secure location and provide electronic security for the games against alteration, tampering, or unauthorized access.
The system must allow the board and other authorized state representatives real-time access to data and equipment, including all accounting for sales, prizes, and credits per device, per site.
The electronic pull-tab game system must not permit the alteration of any accounting or significant event log information that was communicated from the electronic pull-tab device without board-approved access controls. In the event financial data is changed, the electronic pull-tab system must be able to produce an automated audit log documenting the:
data element altered;
data element value prior to alteration;
data element value after alteration;
time and date of alteration; and
user log-in of personnel that performed alteration.
An electronic pull-tab system must have a separate physical medium for securely storing games on the computer, which must be backed up in real time by a backup medium.
A disaster recovery plan detailing the system backup features including physical location for medium storage and procedures for periodic testing and recovery must be provided to the board as a condition of equipment approval.
All data required to be available or reported by this provision must be retained for a period of not less than 3-1/2 years.
All storage of critical data must use error checking and be stored on a nonvolatile physical medium.
The database must be stored on redundant media so that no single failure of any portion of the system would result in the loss or corruption of data.
In the event of a catastrophic failure when the electronic pull-tab game system cannot be restarted in any other way, it must be possible to reload the electronic pull-tab game system from the last viable backup point and fully recover the contents of that backup, to consist of at least the following information:
all date and time indicators associated with data failure and pull-tab game system reload;
all accounting information;
auditing information, including all open games and the summary of completed games; and
employee files with access levels.
The manufacturer must maintain password access for the manufacturer; the distributor must maintain password access for the distributor; and the organization must maintain password access for the gambling manager and sellers.
The operating system software and application software must have multiple security access levels to control and restrict different classes of access to the system. The accounts for the access levels must be unique when assigned to the authorized personnel and only one user per account is allowed.
The manufacturer, the distributor, and the organization must register employees with authorized system access with the board.
The operating system software and application software must provide comprehensive password security or other secure means of ensuring data integrity and enforcing user permission. It is required that:
all programs and data files must only be accessible via the entry of passwords, that will be known only to the manufacturer, distributor, and gambling manager, based on respective level-of-access criteria;
the storage of passwords must be in an encrypted, nonreversible form;
a program must be available that will list all registered users on the system including their privilege level;
the password must have a length of at least six alphanumeric characters; and
the system must automatically log out after a period of inactivity in excess of five minutes.
System log-in and log-out requirements apply to manufacturers, distributors, gambling managers, assistant gambling managers, and sellers.
The operating system and any local and central servers must have a password log-in with two level codes comprising of a personal identification code and a personal password.
The system must include log-in and log-out procedures for system and point of sale devices.
The time signature generated by the electronic device, the local server, and the central server must be identical.
One or more electronic accounting systems must perform reporting and other functions in support of the electronic pull-tab game system. The electronic accounting system must not interfere with the outcome of any gaming function.
A permanent record of daily transactions played on the electronic pull-tab system and device must be maintained by the electronic pull-tab game system on a database other than on the local server. The database and central server must be accessible to the Gambling Control Board at all times.
The electronic pull-tab game system must provide the following reports to the Gambling Control Board and the Department of Revenue.
An electronic pull-tab game report must be available to the board on demand for each game currently in play. The report must contain the following information:
a unique serial number identifying each game;
a description of the game sufficient to categorize the game relative to other games;
the total number of electronic pull-tab tickets in the game;
the actual payout percentage of the entire game;
cost per electronic pull-tab ticket assigned to the game;
the time and date that the game became available for play; and
the location where the game is being played.
An electronic pull-tab game report must be available to the board on demand for each completed game. The report must contain the following information:
a unique serial number identifying each game;
a description of the game sufficient to categorize the game relative to other games;
the total number of unsold electronic pull-tab tickets per game;
the total number of electronic pull-tabs purchased;
the time and date that the game became available for play;
the time and date that the game was completed or removed from play;
the location where the game was played;
the final payout percentage of the game when removed from play; and
the purchase price per electronic pull-tab ticket assigned to the game.
Other electronic pull-tab game reports that must be available to the board on demand are:
active site reports:
site name, address, and telephone number;
licensed organization name and license number;
premises permit number and number of devices at site; and
must be able to distinguish sites that are not active;
daily activity by site, by organization, and for all sites;
site name and license number;
premises permit number;
number of devices in use at the site;
pull-tab tickets sold and the gross receipts;
actual cash sales (dollar amount);
actual cash redeemed (dollar amount); and
unredeemed cash credits;
month-end reports for each site totaling all daily sales activity, detail of all games closed during the month, and status of games remaining in play;
current site inventory, if any, including games in play, unplayed games, and closed games; and
month-end reports for each site showing games received, put into play, and removed from play;
games purchased, sold, and maintained by distributor;
real-time site activity report with the ability to:
view live activity at site;
view each active device noting the device number, current credits, and game being played; and
view each transaction with date and time stamp, including seller log-in and log-off, device load, game play, device redeemed, and any malfunction;
system user list:
full name of sellers, assistant gambling managers, and gambling managers;
position (seller, assistant gambling manager, gambling manager, distributor, manufacturer, or Gambling Control Board investigator);
site name, organization name, or other description;
user ID of all persons with system access;
access level; and
contact telephone number and e-mail; and
Other statistical and activity reports as required by the board and maintained by the manufacturer and the distributor must be provided in a format prescribed by the board upon request.
Manufacturers must provide a test system and equipment to the Gambling Control Board, at the manufacturer's expense, to test pending and approved games.
Manufacturers must provide identical software to the board as part of system approval by an independent testing laboratory and must disable the ability to write to the hard drive.
Manufacturers must allow regulatory test software to be added to an electronic game system to verify approved product.
Each component of an electronic game system must function as indicated by the communication protocol implemented by the licensed manufacturer of the electronic pull-tab game system.
All communication between a server and the electronic pull-tab devices must use authentication and encryption protection employing Advanced Encryption Standard (AES) specifications as defined by the National Institute of Standards and Technology (NIST) to provide secure authentication of the device and the server, ensuring the integrity of the data communicated, and for confidentiality.
The communicated data must be encrypted. All systems must require virtual private network (VPN) or secure sockets layer (SSL) encrypted tunneling protocols unless otherwise approved by the board. The certified testing laboratory must examine each submitted electronic game system to ensure that the proposed field configuration is secure. The certified testing laboratory may provide additional security recommendations to maintain the integrity of the configuration.
The electronic game system must be capable of being tested by the board to verify approved product.
The electronic game system security must be designed or programmed in such a way that it may only communicate with authorized electronic devices using a nonbroadcasting encrypted system.
The electronic game system security must include the ability to automatically disable an electronic pull-tab device if the device goes beyond a physical property restriction at a sales location. The device must remain disabled until reactivated at the point of sale.
The electronic game system must be secure from all other site communication systems and users at a gambling site.
Communications must pass through at least one application-level firewall recognized by the certified testing laboratory. Alternative network paths are allowed if equally protected by a firewall. The firewall application must maintain an audit log of the following information and must disable all communications if unauthorized access is detected:
all changes to configuration of the firewall;
all successful and unsuccessful connection attempts through the firewall; and
the source and destination IP addresses and port numbers.
Where permitted by the board, remote access must authenticate all computer systems based on the authorized settings or firewall application. The following are additional requirements:
no unauthorized remote user administration functionality;
no unauthorized access to any database other than information retrieval using existing functions;
no unauthorized access to the operating system and application software; and
maintenance of an activity log that includes:
the IP address where any change originated;
time and date the connection was made;
duration of connections;
activity while logged in, including the specific areas accessed and changes made; and
accurate time and date on all components of each system at each site.
This subpart applies to board approval of electronic gambling equipment, conformance with standards for previously approved electronic gambling equipment, and independent laboratory testing required for certain electronic gambling equipment.
Before the sale, lease, or distribution of any electronic gambling equipment in Minnesota, a manufacturer must obtain prior board approval for the electronic gambling equipment. The manufacturer must provide to the director at no charge the following:
the list of proposed equipment in an electronic format or other format approved by the board;
the electronic pull-tab games and flare information; and
the electronic pull-tab game test system and equipment to be used to determine compliance with this part.
Electronic pull-tab deals submitted for approval of a new family of games proposed for production or already in production but not yet approved for sale in Minnesota or new members to a previously approved family of games must include:
the front of the flare, prize pool board if any, ticket for each game, and any cumulative or progressive jackpot flare;
the inside of the ticket showing the symbols in the boxes and the win indicators;
the winning and losing symbols;
the payout structure; and
for new members of a previously approved family of games, the date when that family of games was previously approved by the board.
Electronic gambling equipment must be received by the board on or before the 15th day of the month to ensure consideration at the board's meeting the following month. The manufacturer must include information on any equipment that will be sold or leased on an exclusive basis according to part 7864.0240, subpart 1a.
The board must notify the manufacturer in writing no later than five days after a board meeting of the board's decision on whether the product is approved for sale in Minnesota.
For changes to the payout structure or ticket count for any approved game or for any game within a family of games, the manufacturer must assign a new game form number and submit the game to the board for approval before being offered for sale in Minnesota.
For changes to approved electronic gambling equipment, the manufacturer must submit the changes to the director for review and, if required by the director, the equipment must be submitted for review and approval by the board. Electronic gambling equipment approved prior to June 16, 2014, must become compliant within 180 days of June 16, 2014.
Within 14 days of receipt of a deal, the director must notify the manufacturer in writing of the director's decision to recommend approval or recommend denial of a game.
The written notice of the director's recommended denial must state the basis for the director's recommendation of denial. Within 14 days of receipt of a notice of the director's recommended denial, the manufacturer may request a contested case hearing under Minnesota Statutes, chapter 14.
The written notice of the board's denial must state the basis for the board's denial.
Manufacturers are in compliance if the electronic gambling equipment is approved by the board and is produced in compliance with the manufacturing standards prescribed in this part. Once approved, a manufacturer may not change the equipment without prior approval of the board, in compliance with this part.
The board may withdraw its approval if it determines that the electronic gambling equipment was not manufactured in such a manner to be tamper-resistant. If the board decides that its approval should be withdrawn, the board will notify the manufacturer of its right to request a contested case hearing under Minnesota Statutes, chapter 14.
Electronic gambling equipment, including electronic bingo devices, electronic pull-tab devices, electronic systems, and programmable electronic devices, that are submitted for approval must consist of the following:
a copy of the manufacturer's catalog or brochure illustrating that the item meets board-prescribed manufacturing standards for the equipment; and
a description of the item and its features.
The board may require the manufacturer to make the equipment available to the board for inspection.
In addition to the requirements of subitems (1) and (2), manufacturers submitting electronic bingo devices, electronic pull-tab devices, electronic systems, or programmable electronic devices for approval must also include a certification from an independent testing laboratory approved by the board to perform testing services, stating that the equipment has been tested and analyzed and meets the standards required in this chapter. The board may require that a programmable electronic device must be tested and certified by an independent testing laboratory approved by the board.
Independent testing requirements for electronic gambling equipment when required by the board shall include a certification from a board-approved testing laboratory that the electronic gambling equipment tested meets the manufacturing standards and requirements as established in Minnesota Statutes and Minnesota Rules and in conformance with game procedures as provided by the manufacturer. The certification must include:
a detailed description of the equipment and related software applications that were tested, including applicable model numbers of specific equipment and the software version of the application used for testing;
the specific reference to the standard being tested and a statement that the equipment meets the standard; and
any additional findings or issues of concern that might affect the performance or play of the equipment.
Independent testing of electronic gambling equipment includes:
electronic pull-tab systems;
electronic pull-tab devices;
programmable electronic devices;
upgrades or changes to previously approved and tested equipment;
other technical hardware devices used in conjunction with lawful gambling equipment; and
software applications and version upgrades used in conjunction with lawful gambling equipment.
38 SR 1613; 41 SR 137
August 18, 2016