This document includes only the Registrar of Alcohol and Gaming’s (Registrar) Standards for Lottery. Due to the distinct nature of the Lottery sector compared to other gaming sectors in Ontario, a number of Standards previously included in the Registrar’s Standards for Gaming have been excluded or modified, and a number of new Standards have been added (Please note: Where a Standard from the Registrar’s Standards for Gaming has been excluded from the Standards for Lottery, it is referenced as “Not applicable to lottery sector”). The document, therefore, should be considered separate from the Registrar’s Standards for Gaming, which applies to Casinos, iGaming and cGaming.
The April 2017 version of the Registrar’s Standards for Gaming: Lottery Sector have been amended, including the addition of new Standards. This iteration of the Registrar’s Standards for Gaming: Lottery Sector, therefore, supersedes all previously issued versions.
The document is divided into two (2) general sections: Definitions and the Registrar’s Standards for Lottery. The Registrar’s Standards for Lottery are divided into the six identified Risk Themes, under which theme-specific Standard and Requirements are provided. The Themes include:
For certain Standards, further and more explicit direction is provided through one or more specific “Requirements”. These Requirements establish the minimum obligations a registrant must achieve to fulfill the corresponding Standard.
Included as part of a number of the Standards and Requirements is a corresponding section which provides regulatory guidance specific to the given standard or requirement. Guidance serves to provide registrants with greater clarity as to the purpose or intent behind a given Standard or Requirement.
If, in the future additional guidance is necessary, the AGCO plans to work in collaboration with industry and other key stakeholders, when necessary, to facilitate compliance, ease of application and to ensure a consistent and shared understanding as to the meaning and intent of the Standards and Requirements.
Under the Gaming Control Act, 1992 (GCA) and Regulation 78/12, the Registrar is authorized to establish risk-based standards to regulate Ontario’s gaming sector. The objective of a standards-based regulatory model is to shift the focus from requiring registrants to comply with a specific set of rules or processes, which tend to be prescriptive in nature, towards the broader regulatory outcomes or objectives they are expected to achieve. These regulatory outcomes are reflected in the “Standards” established herein.
In most cases, these Standards are drafted at a high level of generality, with the aim being to capture the purpose behind the rule. This offers greater flexibility for regulated entities to determine the most efficient and effective way of meeting the outcomes required, which in turn helps reduce regulatory burden and support market innovation. Further, the flexibility inherent in a Standards-Based model allows the Alcohol and Gaming Commission of Ontario (AGCO) to focus its resources on key risks and to deliver a modernized approach to gaming regulation in a rapidly evolving industry.
The Standards were developed based on a comprehensive risk assessment conducted in consultation with key stakeholders, including the Ontario Lottery and Gaming Corporation (OLG), and social responsibility groups. The resulting risk themes are outlined in the next section and the risk inventory is attached as Appendix A. Going forward, risk assessments will be conducted periodically to ensure that the Standards continue to be relevant, and that the highest standards of integrity for gaming in Ontario are maintained.
OLG, Operators, gaming-related suppliers, sellers and gaming assistants are required to comply with the GCA and Regulation 78/12. Specifically, Sections 3.8 and 3.9 of the GCA require registrants, employees and other persons retained by OLG to comply with the Standards and Requirements established by the Registrar. The GCA provides the Registrar with the authority to establish Standards and Requirements for the conduct, management and operation of lottery schemes or businesses related to a lottery scheme or for related goods or services.
Standards and Requirements established by the Registrar will apply to OLG and to all Operators of lottery schemes conducted in Ontario. Additionally, certain Standards and Requirements also apply to gaming-related suppliers, sellers and gaming assistants.
Specifically, the Standards and Requirements concerning registrants other than OLG and Operators are included below.
The Registrar may direct any registered gaming-related suppliers, sellers and gaming assistants to comply with any additional Standards and Requirements as considered necessary to enhance and preserve the integrity of and public confidence in gaming in Ontario. The Registrar may also propose additional terms of registration specific to an Operator or other registrant to give effect to the purposes of the GCA.
These Standards and Requirements will not apply to lottery schemes conducted and managed by charitable organizations in accordance with section 207(1)(b) of the Criminal Code (Canada) or to suppliers, gaming assistants or other persons engaged in such lottery schemes. Existing standards, policies and terms and conditions will continue to apply to such lottery schemes, until such time as the Registrar determines.
The AGCO recognizes that sport and event betting is an integrated part of gaming. The AGCO has embedded the standards and requirements for sport and event betting within the Registrar’s Standards for Gaming: Lottery Sector. This integrated structure means that the Registrar’s Standards for Gaming: Lottery Sector will generally apply to sport and event betting. The standards and requirements apply to all sports, esports, novelty, and fantasy sports products, and includes various bet types such as single- event, pool, and parlay. Virtual sports are not recognized as qualifying as an event that can be bet upon.
An Operator’s control environment and operating principles form an integral part of the standards-based framework. This section includes information from the Registrar to help guide Operators in the development and implementation of their control environment, as well as to establish key operating principles from a forward looking industry perspective.
The Standards Interpretation Protocol has been established by the AGCO in order to provide registrants and entities participating in the OLG’s Modernization Initiative with a single point of contact for standards-related inquiries and to provide timely, consistent and well-reasoned responses to those inquiries. A dedicated email account has been established (Standards.Coordinator@agco.ca) for the receipt of inquiries.
Words and phrases in these Standards and Requirements shall have the same meaning as in the GCA and Regulation 78/12, unless indicated otherwise.
1.1 There shall be a commitment to character, integrity and high ethical values demonstrated through attitude and actions.
Requirements – At a minimum:
1.2 Formal control activities shall be submitted to the Registrar which have been assessed by an independent oversight function acceptable to the Registrar for alignment with the Standards and Requirements and authorized by the appropriate level of management.
Requirements – At a minimum:
1.3 Operators and gaming-related suppliers shall comply with their control activities and shall have in place measures to monitor compliance and to address failures to comply.
1.4 Employees shall comply with the control activities established by their employer to achieve the Standards and Requirements.
1.5 Operators and gaming-related suppliers are accountable for compliance with control activities by employees and those providing goods and service to operators and gaming-related suppliers, and should have in place measures to monitor compliance and to address failures to comply.
1.6 Employees shall inform their employer if control activities are ineffective in achieving compliance with the Standards and Requirements.
1.7 Management overrides of the control activities shall be clearly documented and communicated to the Registrar.
Requirements – At a minimum:
Guidance: The intent of this Standard is to allow senior-level management to override controls on a one-off basis in necessary circumstances and to ensure that appropriate documentation is maintained for auditing purposes. This Standard is not intended to address permanent changes to the control environment.
1.8 Operators must establish, implement and maintain controls to support preparation of financial reports which comply with all applicable accounting standards and rules and good practices.
1.9 Employees must have the competence, skills, experience and training required to execute control activities that are relevant to their responsibilities.
Requirements – At a minimum:
1.10 Organizational structures shall be designed to promote a sound control environment and proper segregation of duties to ensure that the possibility for collusion or unauthorized or illegal activities is minimized.
Requirements – At a minimum:
1.11 Management clearly understands its accountability and authority for the control environment.
Requirements – At a minimum:
1.12 Information, including logs, related to compliance with the law, the Standards and Requirements and/or adherence with control activities shall be retained for a minimum of three (3) years, unless otherwise stated.
1.13 All surveillance recordings shall be retained for a minimum period as specified by the Registrar.
1.14 Compliance with the Standards and Requirements shall be documented in an organized manner to ensure that the information is capable of being reviewed and audited by an independent oversight function.
Requirements – At a minimum:
1.15 Primary accountability for compliance resides with the Board, or other governance structure, where a Board does not exist, and there shall be evidence that the Board, or other governance structure, has carried out its responsibility in this respect.
Requirements – At a minimum:
1.16 There shall be an independent “whistleblowing” process to allow employees to anonymously report deficiencies or gaps in the control environment as well as incidents of possible non-compliance with the controls, Standards and Requirements, or the law.
Requirements – At a minimum:
1.17 Registrants shall engage with the Registrar in a transparent way.
Requirements – At a minimum, Operators shall:
1.18 A recognized industry standard framework shall be used to manage the information technology (IT) control environment to support compliance with the Standards and Requirements.
1.19 Users shall be granted access to the gaming system based on business need.
Requirements – At a minimum:
1.20 Access to gaming information systems shall be monitored, logged and shall be traceable to a specific individual.
Requirements – At a minimum:
1.21 Processes shall be in place to ensure that only authorized individuals are permitted to open system accounts.
1.22 Industry accepted components, both hardware and software, shall be used where possible.
1.23 Any connection or interface between the gaming system and any other system, whether internal or external third party, shall be monitored, hardened and regularly assessed to ensure the integrity and security of the gaming system.
1.24 Mechanisms shall be in place to ensure the reliability, integrity and availability of the gaming system.
1.25 There shall be a suitably secure physical environment in place to prevent unauthorized access to the gaming system and to ensure the protection of assets.
1.26 Gaming systems, infrastructure, data, activity logs and all other related components shall be protected from threats, vulnerabilities, attacks or breaches.
Requirements – At a minimum:
1.27 Security activities shall be logged in an auditable manner, monitored, promptly analyzed and a report prepared and escalated as appropriate.
Requirements – At a minimum:
1.28 Independent assessments shall be regularly performed by a qualified individual to verify the adequacy of gaming system security and all of its related components.
1.29 Operators and gaming-related suppliers shall stay current on security trends, issues and solutions.
1.30 A system development lifecycle that considers security and processing integrity shall be in place for gaming system technology developed in-house.
1.31 Due diligence must be performed on all acquired gaming system technology to ensure security and processing integrity requirements are met.
1.32 A testing strategy to address changes in technology shall be in place to ensure that deployed gaming systems operate as intended.
1.33 All gaming system changes shall be appropriately, consistently and clearly documented, reviewed, tested and approved.
Requirements – At a minimum:
1.34 The gaming system shall be able to detect unauthorized changes.
1.35 Data governance shall be in place to address data processing integrity and protection of sensitive data.
1.36 Sensitive data, including player information and data relevant to determining game outcomes, shall be secured and protected from unauthorized access or use at all times.
Requirements – At a minimum:
1.37 Player information shall be securely protected and its usage controlled by OLG.
Requirements – At a minimum:
1.38 Removed January 2022
1.39 Communication of sensitive game data shall be protected for integrity.
1.40 Procedures shall be established and documented for IT operations and incident management, including managing, monitoring, and responding to security and processing integrity events.
Requirements – At a minimum:
1.41 Gaming applications on all portable devices shall be appropriately secured.
Guidance: This Standard is not intended to capture players using their own portable devices such as their smartphones, but rather employees or players using portable devices to access the Operator’s gaming system.
1.42 Operators and gaming-related suppliers shall only contract with reputable suppliers.
1.43 Service levels for management of suppliers shall be established.
Requirements – At a minimum:
1.44 Operators and gaming-related suppliers shall provide the Registrar with a list of suppliers that provide them with goods or services in relation to lottery schemes and shall ensure that this list is kept up to date.
1.45 Operators and gaming-related suppliers shall comply with applicable technical standards issued by the Registrar.
1.46 All registrants and non-gaming-related suppliers who are exempt from registration will comply with all applicable OLG policies and procedures to the extent that they are consistent with these Standards and Requirements.
1.47 The Operator shall develop policies and procedures regarding Sellers and Sellers’ employees’ roles and responsibilities to achieve the desired outcomes set out in the Standards that apply to Sellers:
1.48 Sellers and Sellers’ employees shall comply with the Operator’s policies and procedures and the Seller’s contract with the Operator.
2.1 Advertising and marketing materials and communications shall not target underage or self-excluded persons to participate in lottery schemes.
Requirements – At a minimum, materials and communications shall not:
2.2 Advertising and marketing materials and communications shall not be misleading.
Requirements – At a minimum, materials and communications shall not:
2.2.1 Advertising and marketing materials that communicate gambling inducements, bonuses and credits related to sport and event betting are prohibited, except in the following:
Guidance:
2.2.2 Permitted advertising and marketing materials that communicate gambling inducements, bonuses and credits must, at a minimum:
2.2.3 Players must be provided an opt-in process whereby they actively consent to receiving any direct advertising and marketing of inducements, bonuses and credits, and must be provided a method to withdraw their consent at any time, where such marketing and advertising materials are available.
Guidance: direct marketing and advertising includes but is not limited to: direct messaging via social media, emails, texts, and phone calls.
2.3 Information about the risks of gambling and where to obtain additional information or assistance shall be made readily available.
Requirements – At a minimum:
2.4 Meaningful and accurate information shall be available to enable individuals to make informed choices.
Requirements – At a minimum:
2.5 Support shall be provided to persons showing signs of potentially problematic gambling behavior.
Requirements – At a minimum:
2.6 OLG shall provide a common voluntary self-exclusion program.
Requirements – At a minimum:
Guidance: OLG’s self-exclusion program may be executed in each of the gaming sectors using different processes and technologies to reflect the distinct operational circumstances of that sector, however, the long term expectation is that OLG will be able to identify, track and prohibit access to self-excluded persons in and between the various gaming sectors.
Lottery-Specific Guidance: At this time, given the operational realities of the lottery sector, the intent of this Standard is not to require OLG to provide a self-exclusion program for lottery products purchased and sold anonymously at a Sellers’ physical site, unlike an online lottery channel. The existing self-exclusion programs at other gaming sites (Casinos, cGaming or iGaming) would prevent self-excluded individuals from accessing lottery products at those sites.
2.7 Individuals who have decided to voluntarily self-exclude shall be removed from mailing lists and shall not receive incentives or promotions for any products and services during the period of self-exclusion.
2.8 Game designs and features shall be clear and shall not mislead the player. This Standard does not apply to sport and event betting products.
Requirements – At a minimum:
2.8.1 The method of making bets in sport and event betting must be straightforward and understandable. Information must be made available so that the player is clearly informed of the details of the bet prior to making the bet. All selections in a bet must be displayed made clear to the player.
Requirements – At a minimum:
2.8.2 Players must be able to access information regarding available sport and event bets without having to place a bet. This information includes:
Requirements – At a minimum:
2.8.3 Reputable and legitimate data source(s) must be used to determine the outcome of a bet. These data source(s) shall be made available to the player upon request.
2.9 Free-to-play games shall provide the same responsible gambling and player protection information as games played for money.
2.10 Only eligible individuals are permitted to play free-to-play games.
2.11 Games shall not encourage players to chase their losses, or increase the amount they have decided to gamble, or continue to gamble after they have indicated that they want to stop.
2.12 Not applicable to lottery sector.
2.13 Games shall not appeal primarily to underage individuals.
2.14 Credit shall not be extended or lent to individuals to gamble.
Guidance: This standard does not prohibit the use of credit cards for the purchase of lottery tickets.
3.1 Not applicable to lottery sector
3.2 Only eligible individuals are permitted to play a lottery scheme.
Lottery-Specific Requirements – At a minimum:
Guidance: Despite requirement 3i, an operator of a gaming site, other than the OLG, may permit employees of the OLG to play a lottery scheme in the site if, (a) they are gaming assistants registered as category 2 gaming assistants; or (b) under the GCA or Ontario Regulation 78/12, they are not required to register as gaming assistants in order to act as employees of the OLG.
3.2.1 Operators and sellers shall not knowingly permit an individual to engage in any of the following prohibited activities and shall take steps to actively monitor and prevent such prohibited activity from occurring:
Requirements – At a minimum:
3.2.2 The Operator of a gaming site with a self-serve lottery terminal and Sellers working in a gaming site with a self-serve lottery terminal shall not permit individuals described in 3.2 to play a lottery scheme.
Requirements – At a minimum:
3.3 Lottery schemes shall be provided only within Ontario, unless the lottery scheme is conducted in conjunction with the government of another province.
4.1 All gaming activities and financial transactions shall be conducted fairly and honestly, and must be independently verifiable.
Lottery-Specific Guidance: Given the operational nature of the lottery sector, not all aspects of lottery activities and transactions will be independently verifiable, but it is expected that they will be where possible.
4.2 Rules of play, including any subsequent modifications, shall be submitted to the Registrar for approval.
Requirements – At a minimum, the rules of play shall contain:
Lottery-Specific Guidance: For lottery, rules of play encompass game conditions and as such shall be submitted for Registrar approval, but fact sheets are not required to be submitted.
Due to the nature of sports betting in Ontario, the “Odds of winning, payout odds or returns to players” for sports games are typically indicated on the ticket, not within the rules of play. As well, returns for players can vary depending upon the amount of a given wager. Sports games, therefore, are excluded from Requirement 1.
4.3 Lottery schemes must be conducted in accordance with the approved rules of play. Sport and event betting must be conducted fairly, honestly and in accordance with the terms of the bet placed by the player.
Requirements – At a minimum:
Sport and event bets shall be accepted, processed, and settled in accordance with the terms of the bet placed by the player, including any applicable betting rules.
4.3.1 The Operator offering sport and event betting products shall ensure that all bets offered meet the following criteria:
Guidance:
4.3.2 The Operator may only offer Draw-Based games and Instant games through a Self-Serve Lottery Terminal.
Guidance: Permissible games do not include:
4.4 Removed, April 2017.
4.5 All gaming systems and gaming supplies, including any subsequent modifications, shall be submitted to the Registrar for assessment and approval, at the expense of the supplier, prior to being provided to any gaming site.
Requirement:
Lottery-Specific Guidance: For the purposes of this Standard instant game tickets are not required to be submitted for assessment.
4.6 Gaming systems and gaming supplies shall be provided, installed, configured, maintained, repaired, and operated in a way that ensures the integrity, safety and security of the approved gaming supplies and systems, and in accordance with the Registrar’s approval.
Requirements – At a minimum:
4.6.1 Where there are suspected game or system faults that may impact game integrity or fairness including the integrity or fairness of sport and event betting (e.g., influencing a player’s chances of winning or the return to players), Operators shall make the game unavailable to players until the issue has been resolved. In the case of sport and event betting, making a game unavailable may include the suspension of betting, the withholding of funds, and the refund of any bet until a gaming system fault has been resolved. Operator decisions must be fair, reasonable, and made in good faith.
4.7 Production, testing and development systems shall be logically separated.
4.8 Moved to Electronic Lottery Systems Minimum Technical Standards.
4.9 Where game outcomes or sport and event betting transactions are not recoverable, Operator shall have clearly defined policies in respect of treating the player fairly when resolving the player’s transactions. These policies and processes shall be made available to players upon request.
4.10 Not applicable to lottery sector.
4.11 A player’s bet and the outcome of the game shall be clearly communicated and easy to understand.
4.11.1 In sport and event betting, details on placed bets shall be made readily available and clear to the player.
Requirements – At a minimum, the betting system or lottery ticket shall give the player the following information:
4.11.2 In sport and event betting, bets must be settled fairly and in accordance with the terms of the bet placed by the player and any applicable betting rules that were available to the player when the bet was placed. Where raised, the reasons for the settlement must be clearly and promptly provided to the player.
4.11.3 The results of bets on sporting or other events must be provided to players making bets on the events. Any change of results must be made available.
4.11.4 The operator shall have controls in place to ensure the accuracy and timeliness of sport and event results data.
4.12 Complaints and any inquiries related to game integrity must be recorded and addressed in a timely and appropriate manner.
4.13 Games shall pay out accurately, completely and within a reasonable time of winning, subject to checks and verifications.
Requirement - At a minimum:
Lottery-Specific Requirements – At a minimum, the Operator shall:
4.14 Operators and gaming-related suppliers shall have mechanisms in place to appropriately deter, prevent and detect collusion and cheating.
4.15 All relevant activities related to the detection of collusion and cheating shall be logged.
4.16 Individuals must be able to easily and readily report activities related to collusion and cheating.
4.17 There shall be mechanisms in place to ensure the integrity, security and fairness of lottery draws.
Requirements – At a minimum:
4.18 In the event that the Operator suspends, recalls, withdraws, or cancels all or part of a lottery scheme, the Operator shall have clearly defined policies in respect of treating the player fairly when resolving the player’s transactions.
4.19 There shall be documented procedures for setting and updating the odds for sports games, taking into account market forces.
4.19.1 The operator shall have risk management measures in place to mitigate the betting integrity risk associated with sport and event betting, including insider betting and event manipulation. (Also applicable to Gaming-Related Suppliers)
Requirements – At a minimum:
Guidance: The Registrar will publish a list of registered independent integrity monitors.
4.19.2 An operator receiving a report of suspicious activity under Standard 4.19.1 may suspend or cancel sport and event betting on events related to the report or withhold associated customer funds. To this end, an Operator must ensure that it has reserved itself the authority to suspend betting, void bets, and withhold associated customer funds. The Operator’s decision to suspend or cancel sport and event betting, or withhold associated customer funds, on events related to the report must be fair, reasonable, and made in good faith.
4.20 The results for sport games shall be verified using credible sources and according to industry good practices.
4.21 The Operator shall have clearly defined policies and procedures in place to address unclaimed prizes.
4.22 Winning instant game tickets shall be randomly generated during printing.
4.23 The Operator shall maintain an accurate, complete, and auditable list of all individuals involved in the handling of lottery tickets at Seller locations.
Requirements – At a minimum:
4.24 Sellers and Seller’s employees may only conduct a player’s lottery transactions when that player is present at the Seller’s location.
5.1 Not applicable to lottery sector.
5.2 Only authorized individuals shall be permitted access to sensitive areas.
Lottery-Specific Requirements – At a minimum, Operators and gaming-related suppliers shall:
Guidance: Each site is unique and should define its sensitive areas as it deems appropriate. The Registrar, however, retains the authority to direct an Operator or gaming-related supplier to adopt a certain form of access authorization for a certain area or equipment, as deemed necessary.
5.3 Not applicable to lottery sector.
5.4 Not applicable to lottery sector.
5.5 Not applicable to lottery sector.
5.6 There shall be site emergency procedures to protect the public from personal harm and limit the damage to or loss of gaming-related assets.
Requirements – At a minimum:
5.7 Security and surveillance shall be in place to protect gaming-related assets.
Lottery-Specific Requirements – At a minimum:
5.8 There shall be timely and accurate maintenance of gaming-related financial transactions, accounting information and data.
5.9 Not applicable to lottery sector.
5.10 There shall be a mechanism in place to track instant game tickets.
Guidance: The intent of this Standard is to ensure the tracking of instant game tickets from the point of printing to the point of activation, and when tickets are validated or returned to the OLG.
5.11 Sellers shall ensure that access to gaming supplies and sensitive inventories is appropriately controlled.
5.12 The Seller shall immediately take action to prevent, whether by remote disablement or other means, suspected tampering or similar misuse of a self-serve terminal.
6.1 Mechanisms shall be in place to reasonably identify and prevent unlawful activities related to lottery schemes.
Lottery-Specific Requirements – At a minimum, the Operator shall:
sport and event betting to detect individuals attempting to circumvent the betting limit thresholds established in Standard 4.3.1(17).
6.2 Not applicable to lottery sector.
6.3 The Operator shall have anti-money laundering policies and procedures in place.
Guidance: It is not intended for these mechanisms to include FINTRAC reporting, as the Proceeds of Crime (Money Laundering) and Terrorist Financing Act do not apply to lottery.
Risk Theme | Regulatory Risk |
---|---|
Entity Level |
|
Responsible Gambling |
|
Prohibiting Access to Designated Groups |
|
Ensuring Gaming integrity and Player Awareness |
|
Public Safety and Protection of Assets |
|
Minimizing Unlawful Activity Related to Gaming |
|