What are Minimum Internal Control Standards?
Online poker, by it’s very nature, will present new challenges for regulators and jurisdictions that are already well on their way to formalizing laws and codes for the industry. Let’s consider another very important reason why Nevada should lead the way and become the hub for online gaming in the United States, and poker in particular – Nevada’s Minimum Internal Control Standards (MICS).
The Nevada Gaming Control Board has established a strong foundation of guidelines and defined terms with the passage of the MICS. System operating standards, player protection, record keeping and security are the predominant subjects covered. Standards are set for items ranging from the maintenance and location of the physical servers that underpin gaming websites, to how player funds are to be segregated and processed during transfers.
The Nevada Online Poker MICS provide very specific rules on the subject of access and remote access to the different layers of the overall system. The layers broadly include: the operating system, computer servers, network infrastructure, application software, databases and other components. The Gaming Control Board is well aware of the complexity of running and maintaining online gaming businesses and understands that this complexity provides ample opportunities for cheating, fraud and theft. Only expressly permitted IT workers and employees are given access to certain facets of the system and detailed access logs are to be maintained. (For example, IT personnel are prohibited from having any administrative access to specific player account info such as deposits, withdrawals and balances.) Random audits will occur to ensure that access rules have been maintained and appropriately logged. These detailed procedures make sense because segregating access among the different parts of the system and maintaining access logs will deter fraud and will make any potential security breaches easier to detect in as short a time as possible.
Default and administrative accounts, which can enable fraud, are controlled and must not be enabled for remote access. This is key since cheaters would need to also bypass physical access controls to use these accounts. Passwords for such accounts must also be changed regularly as prescribed. Modification to software, operating system, network and database applications are subject to the change control process which creates a record of any modifications made and notes the individual responsible for these changes.
Another area of concern for regulators is the management and oversight of player funds maintained by the operator of the site. Obviously no one in the poker world wants to witness a debacle like Full Tilt ever again. But even barring such gross examples of malfeasance there are still potential problems that need to be considered. The MICS stipulate “that funds deposited into an interactive gaming account from a financial institution shall not be transferred out of the” account “to a different financial institution”. Also, transferring funds between authorized players is not allowed. There are also rules governing the transfer of funds between players’ online accounts and accounts maintained at affiliated brick and mortar casinos.
It is, in fact, near the end of this iteration of the MICS in paragraph #159 (out of 163) that the required reserve fund is touched upon. The poker playing public will be interested to know that at least once per quarter, the “interactive gaming account balance summary report” is reviewed to ensure compliance with Regulation 5A.125. This regulation requires that player funds are held in segregated, audited accounts and that the amount of the reserve is equal to or greater than the sum of all player accounts. This alone demonstrates the importance of player protection to the experienced commissioners and regulators in Nevada.
With such a clear head start and its pedigree as the world’s leading authority on all matters related to regulated gaming, Nevada is in a perfect position to lead the way and help foster online poker as a legitimate industry. The details will take a lot of time and work, but interstate compacts will soon be accepted as the best way to grow the industry and maintain high standards for player protection and proper taxation.