543.7—What are the minimum internal control standards for bingo?
(a) Bingo Cards—
(1) Inventory of bingo paper.
The bingo paper inventory must be controlled so as to assure the integrity of the bingo paper being used as follows:
(A)
When received, bingo paper must be inventoried and secured by an authorized agent(s) independent of bingo sales;
(B)
The issue of bingo paper to the cashiers must be documented and signed for by the authorized agent(s) responsible for inventory control and a cashier. The bingo control log must include the series number of the bingo paper;
(C)
The bingo control log must be utilized by the gaming operation to verify the integrity of the bingo paper being used; and
(D)
Once each month, an authorized agent(s) independent of both bingo paper sales and bingo paper inventory control must verify the accuracy of the ending balance in the bingo control log by reconciling it with the bingo paper inventory.
(D)
Sales transaction identifiers, which may be the unique card identifier(s) sold or when electronic bingo card faces are sold, the unique identifiers of the card faces sold;
(G)
Signature, initials, or identification of the agent or device who conducted the bingo sales; and
(H)
When bingo sales are recorded manually, total sales are verified by an authorized agent independent of the bingo sales being verified and the signature, initials, or identification of the authorized agent who verified the bingo sales is recorded.
(iv)
An authorized agent independent of the seller must perform the following standards for each seller at the end of each session:
(A)
Reconcile the documented total dollar amount of cards sold to the documented quantity of cards sold;
(3) Voiding bingo cards.
(i)
Procedures must be established and implemented to prevent the voiding of card sales after the start of the calling of the game for which the bingo card was sold. Cards may not be voided after the start of a game for which the card was sold.
(B)
The authorization of the void, by an authorized agent independent of the original sale transaction (supervisor recommended), must be recorded either by signature on the bingo card or by electronically associating the void authorization to the sale transaction of the voided bingo card.
(4) Reissue of previously sold bingo cards.
When one or more previously sold bingo cards need to be reissued, the following controls must apply: the original sale of the bingo cards must be verified; and the reissue of the bingo cards must be documented, including the identity of the agent authorizing reissuance.
(b) Draw—
(1) Verification and display.
Procedures must be established and implemented to ensure the identity of each object drawn is accurately recorded and transmitted to the participants. The procedures must identify the method used to ensure the identity of each object drawn.
(ii)
For all games offering a prize payout of $1,200 or more, as the objects are drawn, the identity of the objects must be immediately recorded and maintained for a minimum of 24 hours.
(iii)
Controls must be present to assure that all objects eligible for the draw are available to be drawn prior to the next draw.
(c) Manual payouts and short pays.
(1)
Procedures must be established and implemented to prevent unauthorized access or fraudulent transactions using manual payout documents, including:
(i)
Payout documents must be controlled and completed in a manner that is intended to prevent a custodian of funds from altering the dollar amount on all parts of the payout document subsequent to the manual payout and misappropriating the funds.
(ii)
Payout documents must be controlled and completed in a manner that deters any one individual from initiating and producing a fraudulent payout document, obtaining the funds, forging signatures on the payout document, routing all parts of the document, and misappropriating the funds. Recommended procedures of this standard include but are not limited to the following:
(A)
Funds are issued either to a second verifier of the manual payout (i.e., someone other than the agents who generated/requested the payout) or to two agents concurrently (i.e., the generator/requestor of the document and the verifier of the manual payout). Both witness the manual payout; or
(B)
The routing of one part of the completed document is under the physical control (e.g., dropped in a locked box) of an agent other than the agent that obtained/issued the funds and the agent that obtained/issued the funds must not be able to place the document in the locked box.
(iii)
Segregation of responsibilities. The functions of sales and prize payout verification must be segregated, if performed manually. Agents who sell bingo cards on the floor must not verify bingo cards for prize payouts with bingo cards in their possession of the same type as the bingo card being verified for the game. Floor clerks who sell bingo cards on the floor are permitted to announce the identifiers of winning bingo cards.
(iv) Validation.
Procedures must be established and implemented to determine the validity of the claim prior to the payment of a prize (i.e., bingo card was sold for the game played, not voided, etc.) by at least two persons.
(v) Verification.
Procedures must be established and implemented to ensure that at least two persons verify the winning pattern has been achieved on the winning card prior to the payment of a prize.
(vi) Authorization and signatures.
(A)
A Class II gaming system may substitute as one authorization/signature verifying, validating or authorizing a winning card of less than $1,200 or other manual payout. Where a Class II gaming system substitutes as an authorization/signature, the manual payout is subject to the limitations provided in this section.
(B)
For manual prize payouts of $1,200 or more and less than a predetermined amount not to exceed $50,000, at least two agents must authorize, sign and witness the manual prize payout.
(1) Manual prize payouts over a predetermined amount not to exceed $50,000 must require one of the two signatures and verifications to be a supervisory or management employee independent of the operation of bingo.
(2) This predetermined amount, not to exceed $50,000, must be authorized by management, approved by the tribal gaming regulatory authority, documented, and maintained.
(i)
Manual payouts and short-pays exceeding $10 must be documented on a two-part form, of which a restricted system record can be considered one part of the form, and documentation must include the following information:
(C)
Dollar amount paid (both alpha and numeric) or description of personal property awarded, including fair market value. Alpha is optional if another unalterable method is used for evidencing the amount paid;
(E)
Game outcome (e.g., patterns, symbols, bingo card identifier/description, etc.) for manual prize payouts, external bonus description, reason for short pay, etc.;
(ii)
For short-pays of $10 or less, the documentation (single-part form or log is acceptable) must include the following information:
(C)
Dollar amount paid (both alpha and numeric). Alpha is optional if another unalterable method is used for evidencing the amount paid;
(iii)
In other situations that allow an agent to input a prize payout or change the dollar amount of the prize payout by more than $1 in a Class II gaming system that has an automated prize payout component, two agents, one of which is a supervisory employee, must be physically involved in verifying and witnessing the prize payout.
(iv)
For manually paid promotional prize payouts, as a result of the play of a game and where the amount paid is not included in the prize schedule, the documentation (single-part form or log is acceptable) must include the following information:
(C)
Dollar amount paid (both alpha and numeric). Alpha is optional if another unalterable method is used for evidencing the amount paid;
(D)
The signature of at least one agent verifying and witnessing the manual promotional prize payout of $599 or less and two agents verifying and witnessing the manual promotional prize payout exceeding $599;
(F)
Total amount of manual promotional prize payouts must be recorded by shift, session or other relevant time period.
(v)
When a controlled manual payout document is voided, the agent completing the void must clearly mark “void” across the face of the document, sign across the face of the document and all parts of the document must be retained for accountability.
(d) Operational controls.
(1)
Procedures must be established and implemented with the intent to prevent unauthorized access to or fraudulent transactions involving cash or cash equivalents.
(2)
Cash or cash equivalents exchanged between two persons must be counted independently by at least two persons and reconciled to the recorded amounts at the end of each shift or if applicable each session. Unexplained variances must be documented and maintained. Unverified transfers of cash or cash equivalents are prohibited.
(3)
Procedures must be established and implemented to control cash or cash equivalents in accordance with this section and based on the amount of the transaction. These procedures include, but are not limited to, counting and recording on an accountability form by shift, session or relevant time period the following:
(4)
Any change of control of accountability, exchange or transfer must require the cash or cash equivalents be counted and recorded independently by at least two persons and reconciled to the recorded amount.
(e) Gaming equipment.
(1)
Procedures must be established and implemented with the intention to restrict access to agents for the following:
(ii)
Random number generator software. (Additional information technology security standards can be found in § 543.16 of this part.)
(2)
The game software components of a Class II gaming system will be identified in the test laboratory report. When initially received, the software must be verified to be authentic copies, as certified by the independent testing laboratory.
(3)
Procedures must be established relating to the periodic inspection, maintenance, testing, and documentation of a random sampling of gaming equipment/components, including but not limited to:
(i)
Software related to game outcome must be authenticated semi-annually by an agent independent of bingo operations by comparing signatures against the test laboratory letter on file with the tribal gaming regulatory authority for that version.
(ii)
Class II gaming system interfaces to external systems must be tested annually for accurate communications and appropriate logging of events.
(4)
Records must be maintained for each player interface that indicate the date the player interface was placed into service or made available for play, the date the player interface was removed from service and not available for play, and any changes in player interface identifiers.
(f) Voucher systems.
(1)
The voucher system must be utilized to verify the authenticity of each voucher or coupon redeemed.
(3)
Procedures must be established and implemented to document the payment of a claim on a voucher that is not physically available or a voucher that cannot be validated (e.g., mutilated, expired, lost, stolen, etc.).
(ii)
Payment of a voucher for $50 or more, a supervisory employee must review the applicable voucher system, player interface or other transaction history records to verify the validity of the voucher and initial the voucher or documentation prior to payment.
(4)
Vouchers redeemed must remain in the cashier's accountability for reconciliation purposes. The voucher redemption system reports must be used to ensure all paid vouchers have been validated.
(5)
Vouchers paid during a period while the voucher system is temporarily out of operation must be marked “paid”, initialed and dated by the cashier. If the voucher is greater than a predetermined amount approved (not to exceed $500), a supervisory employee must approve the payment and evidence that approval by initialing the voucher prior to payment.
(7)
Upon restored operation of the voucher system, vouchers redeemed while the voucher system was temporarily out of operation must be validated as expeditiously as possible.
(8)
Unredeemed vouchers can only be voided in the voucher system by supervisory employees. The supervisory employee completing the void must clearly mark “void” across the face of the voucher and sign across the face of the voucher, if available. The accounting department will maintain the voided voucher, if available.
(g) Patron accounts and cashless systems.
(1)
All smart cards (i.e., cards that possess the means to electronically store or retrieve data) that maintain the only source of account data are prohibited.
(B)
Record the type of identification credential examined, the credential number, the expiration date of credential, and the date credential was examined. (Note: A patron's driver's license is the preferred method for verifying the patron's identity. A passport, non-resident alien identification card, other government issued identification credential or another picture identification credential normally acceptable as a means of identification when cashing checks, may also be used.);
(C)
Record the patron's name and may include another identifier (e.g., nickname, title, etc.) of the patron, if requested by patron;
(ii)
Patron deposit accounts must be established for patrons at designated areas of accountability and the creation of the account must meet all the controls of paragraph (g)(2)(i) of this section when the patron makes an initial deposit of cash or cash equivalents.
(iii)
If patron deposit account adjustments may be made by the operation, the operation must be authorized by the account holder to make necessary adjustments. This requirement can be met through the collection of a single authorization that covers the life of the patron deposit account.
(iv) Patron deposits & withdrawals.
(A)
Prior to the patron making a withdrawal from a patron deposit account, the cashier must verify the identity of the patron and availability of funds. Reliance on a secured PIN entered by the patron is an acceptable method of verifying patron identity.
(B)
A multi-part deposit/withdrawal record must be created when the transaction is processed by a cashier, including;
(1) Same document number on all copies;
(2) Type of transaction, deposit or withdrawal;
(3) Name or other identifier of the patron;
(4) At least the last four digits of the account identifier;
(5) Patron signature for withdrawals, unless a secured PIN is utilized by the patron;
(6) Date of transaction;
(7) Dollar amount of transaction;
(8) Nature of deposit or withdrawal (e.g., cash, check, chips); and
(9) Signature of the cashier processing the transaction.
(C)
A copy of the transaction record must be secured for reconciliation of the cashier's bank for each shift. All transactions involving patron deposit accounts must be accurately tracked.
(D)
The copy of the transaction record must be forwarded to the accounting department at the end of the gaming day.
(E)
When a cashier is not involved in the deposit/withdrawal of funds, procedures must be established that safeguard the integrity of the process used.
(v) Patron deposit account adjustments.
(A)
Adjustments to the patron deposit accounts must be performed by an agent.
(1) Unique transaction identifier;
(2) Type of transaction, adjustment;
(3) Name or other identifier of the patron;
(4) At least the last four digits of the account identifier;
(5) Date of transaction;
(6) Dollar amount of transaction;
(7) Reason for the adjustment; and
(8) Signature or unique identifier for the agent who made the adjustment.
(C)
The transaction record must be forwarded to the accounting department at the end of the gaming day.
(vi)
Where available, systems reports that indicate the dollar amount of transactions for patron deposit accounts (e.g., deposits, withdrawals, account adjustments, etc.) that should be reflected in each cashier's accountability must be utilized at the conclusion of each shift in the reconciling of funds.
(vii)
Cashless transactions and electronic funds transfers to and from patron deposit accounts must be recorded and maintained at the end of the gaming operations specified 24-hour accounting period.
(viii)
Procedures must be established to maintain a detailed record for each patron deposit account that includes the dollar amount of all funds deposited and withdrawn, account adjustments made, and the transfers to or from player interfaces.
(ix)
Detailed patron deposit account transaction records must be available to the patron upon reasonable request and to the tribal gaming regulatory authority upon request.
(x)
Only dedicated gaming operation bank accounts must be used to record electronic funds transfers to or from the patron deposit accounts. Gaming operation bank accounts dedicated to electronic funds transfers to or from the patron deposit accounts must not be used for any other types of transactions.
(A)
In the absence of the patron, modifications to balances on a promotional or other account must be made under the authorization of supervisory employees and must be sufficiently documented (including substantiation of reasons for modification). Modifications are randomly verified by independent agents on a quarterly basis. This standard does not apply to the deletion of balances related to inactive or closed accounts through an automated process.
(C)
Patron identification is required when redeeming values. Reliance on a secured PIN by the patron is an acceptable method of verifying patron identification.
(h) Promotions.
(1)
The conditions for participating in promotional programs, including drawings and giveaway programs must be approved and available for patron review at the gaming operation.
(2)
Changes to the player tracking systems, promotional accounts, promotion and external bonusing system parameters which control features such as the awarding of bonuses, the issuance of cashable credits, non-cashable credits, coupons and vouchers, must be performed under the authority of supervisory employees, independent of the department initiating the change. Alternatively, the changes may be performed by supervisory employees of the department initiating the change if sufficient documentation is generated and the propriety of the changes are randomly verified by supervisory employees independent of the department initiating the change on a monthly basis.
(i) Accounting—
(1) Accounting/audit standards.
Accounting/auditing procedures must be performed by agents who are independent of the persons who performed the transactions being reviewed.
(ii)
All accounting/audit procedures and actions must be documented (e.g., log, checklist, investigations and notation on reports), maintained for inspection and provided to the tribal gaming regulatory authority upon request.
(iii)
Accounting/audit procedures must be performed reviewing transactions for relevant accounting periods, including a 24-hour accounting period and reconciled in total for those time periods.
(iv)
Accounting/audit procedures must be performed within seven days of the transaction's occurrence date being reviewed.
(v)
Accounting/audit procedures must be in place to review variances related to bingo accounting data, which must include at a minimum any variance noted by the Class II gaming system for cashless transactions in and out, electronic funds transfer in and out, external bonus payouts, vouchers out and coupon promotion out.
(vi)
At least monthly, an accounting/audit agent must confirm that the appropriate investigation has been completed for the review of variances.
(i)
Records of bingo card sales must be reviewed for proper authorization, completion and accurate calculations.
(ii)
Manual payout summary report, if applicable, must be reviewed for proper authorizations, completion, accurate calculations, and authorization confirming manual payout summary report totals.
(iii)
A random sampling of records of manual payouts must be reviewed for proper authorizations and completion for manual payouts less than $1,200.
(iv)
Records of all manual prize payouts of $1,200 or more must be reviewed for proper authorizations and completion.
(v)
Where manual payout information is available per player interface, records of manual payouts must be reviewed against the recorded manual payout amounts per player interface.
(vi)
Manual payout forms must be reconciled to each cashier's accountability documents and in total for each relevant period (e.g., session, shift, day, etc.).
(x)
Where bingo sales are available per player interface, bingo sales must be reviewed for reasonableness.
(xi)
Amount of financial instruments accepted per financial instrument type and per financial instrument acceptor must be reviewed for reasonableness, to include but not limited to zero amounts.
(xii)
Where total prize payouts are available per player interface, total prize payouts must be reviewed for reasonableness.
(xiii)
Amount of financial instruments dispensed per financial instrument type and per financial instrument dispenser must be reviewed for reasonableness, to include but not limited to zero amounts.
(xiv)
For a random sampling, foot the vouchers redeemed and trace the totals to the totals recorded in the voucher system and to the amount recorded in the applicable cashier's accountability document.
(xv)
Daily exception information provided by systems used in the operation of bingo must be reviewed for propriety of transactions and unusual occurrences.
(xvi)
Ensure promotional coupons which are not financial instruments are properly cancelled to prevent improper recirculation.
(xvii)
Reconcile all parts of the form used to document transfers that increase/decrease the inventory of an accountability (includes booths and any other accountability areas).
(xviii)
Reconcile voucher liability (e.g., issued-voided-redeemed-expired = unpaid) to the voucher system records.
(A)
A report must be generated that details each day's beginning and ending balance of patron deposit accounts, adjustments to patron deposit accounts, and all patron deposit account transactions.
(B)
Reconcile the beginning and ending balances to the summary of manual deposit/withdrawal and account adjustment documentation to the patron deposit account report.
(xx)
Reconcile each day's patron deposit account liability (e.g., deposits ± adjustments−withdrawals = total account balance) to the system records.
(xxi)
Reconcile electronic funds transfers to the cashless system records, the records of the outside entity which processed the transactions and the operations dedicated cashless account bank records.
(xxii)
Accounting data used in performance analysis may only be altered to correct amounts that were determined to be in error. When correcting accounting data, the correct amount must be indicated in any Class II gaming system exception reports generated.
(xxiii)
Accounting/auditing agents must reconcile the audited bingo totals report to the audited bingo accounting data for each day.
(xxiv)
Accounting/auditing agents must ensure each day's bingo accounting data used in performance reports has been audited and reconciled.
(xxv)
If the Class II gaming system produces exception reports they must be reviewed on a daily basis for propriety of transactions and unusual occurrences.
(i)
Financial instrument acceptor data must be recorded immediately prior to or subsequent to a financial instrument acceptor drop. The financial instrument acceptor amount-in data must be recorded at least weekly. The time between recordings may extend beyond one week in order for a recording to coincide with the end of an accounting period only if such extension is for no longer than six additional days.
(ii)
When a player interface is removed from the floor, the financial instrument acceptor contents must be protected to prevent the misappropriation of stored funds.
(iii)
When a player interface is permanently removed from the floor, the financial instrument acceptor contents must be counted and recorded.
(iv)
For currency interface systems, accounting/auditing agents must make appropriate comparisons of system generated count as recorded in the statistical report at least one drop period per month. Discrepancies must be resolved prior to generation/distribution of reports.
(v)
For each drop period, accounting/auditing agents must compare the amount-in per financial instrument accepted by the financial instrument acceptors to the drop amount counted for the period. Discrepancies must be resolved before the generation/distribution of statistical reports.
(vi)
Investigation must be performed for any one player interface having an unresolved drop variance in excess of an amount that is both more than $25 and at least three percent (3%) of the actual drop. The investigation performed and results of the investigation must be documented, maintained for inspection, and provided to the tribal gaming regulatory authority upon request.
(vii)
The results of a variance investigation, including the date and personnel involved in any investigation, will be documented in the appropriate report and retained. The results will also include any corrective action taken (e.g., accounting data storage component replaced, interface component repaired, software debugged, etc.). The investigation will be completed and the results documented within seven days of the day the variance was noted, unless otherwise justified.
(viii)
Procedures must be established and implemented to perform the following on a regular basis, at a minimum of monthly, and using predetermined thresholds:
(A)
Where the Class II gaming system is capable of providing information per player interface, identify and investigate player interfaces with total prize payouts exceeding bingo sales;
(B)
Where bingo sales is available per player interface, investigate any percentage of increase/decrease exceeding a predetermined threshold, not to exceed 20%, in total bingo sales as compared to a similar period of time that represents consistency in prior performance.
(C)
Investigate any exception noted in paragraphs (i)(3)(viii)(A) and (B) of this section and document the findings. The investigation may include procedures to review one or more of the following:
(1) Verify days on floor are comparable.
(2) Non-prize payouts for authenticity and propriety.
(3) Player interface out of service periods.
(4) Unusual fluctuations in manual payouts.
(D)
If the investigation does not identify an explanation for exceptions then a physical check procedure must be performed, as required by paragraph (i)(3)(viii)(E) of this section.
(E)
Document any investigation of unresolved exceptions using a predefined player interface physical check procedure and checklist, to include a minimum of the following as applicable:
(1) Verify game software;
(2) Verify player interface configurations;
(3) Test amount in accounting data for accuracy upon insertion of financial instruments into the financial instrument acceptor;
(4) Test amount out accounting data for accuracy upon dispensing of financial instruments from the financial instrument dispenser;
(5) Record findings and repairs or modifications made to resolve malfunctions, including date and time, player interface identifier and signature of the agent performing the player interface physical check, and additional signatures as required; and
(6) Maintain player interface physical check records, either in physical or electronic form, for the period prescribed by the procedure.
(ix)
For Class II gaming systems, procedures must be performed at least monthly to verify that the system accounting data is accurate.
(A)
Financial instruments accepted at a kiosk must be removed and counted by at least two agents; and
(xi)
At the conclusion of a promotion, accounting/audit agents must perform procedures (e.g., interviews, review of payout documentation, etc.) to ensure that promotional prize payouts, drawings, and giveaway programs are conducted in accordance with the rules provided to the patrons.
(4) Inter-tribal prize pools.
Procedures must be established and implemented to govern the participation in inter-tribal prize pools, which at a minimum must include the review, verification and maintenance of the following records, which must be made available, within a reasonable time of the request, to the tribal gaming regulatory authority upon request:
(5) Performance analysis.
(i)
Bingo performance data must be recorded at the end of the gaming operations specified 24-hour accounting period. Such data must include:
(B)
The total value of all financial instruments accepted by the Class II gaming system by each financial instrument acceptor and by each financial instrument type.
(C)
The total value of all financial instruments dispensed by the Class II gaming system and by each financial instrument type.
(ii)
Procedures must be established and implemented that ensure the reliability of the performance data.