Registrar’s Standards for Gaming: Lottery Sector

Last Updated: 
2023-11-01

Introduction

The registrar’s standards for lottery – composition

This document includes only the Registrar of Alcohol and Gaming’s (Registrar) Standards for Lottery. Due to the distinct nature of the Lottery sector compared to other gaming sectors in Ontario, a number of Standards previously included in the Registrar’s Standards for Gaming have been excluded or modified, and a number of new Standards have been added (Please note: Where a Standard from the Registrar’s Standards for Gaming has been excluded from the Standards for Lottery, it is referenced as “Not applicable to lottery sector”). The document, therefore, should be considered separate from the Registrar’s Standards for Gaming, which applies to Casinos, iGaming and cGaming.

The April 2017 version of the Registrar’s Standards for Gaming: Lottery Sector have been amended, including the addition of new Standards. This iteration of the Registrar’s Standards for Gaming: Lottery Sector, therefore, supersedes all previously issued versions.

The document is divided into two (2) general sections: Definitions and the Registrar’s Standards for Lottery. The Registrar’s Standards for Lottery are divided into the six identified Risk Themes, under which theme-specific Standard and Requirements are provided. The Themes include:

  • Risk Theme 1: Entity
  • Risk Theme 2: Responsible Gambling
  • Risk Theme 3: Prohibiting Access to Designated Groups
  • Risk Theme 4: Ensuring Game Integrity and Player Awareness
  • Risk Theme 5: Public Safety and Protection of Assets
  • Risk Theme 6: Minimizing Unlawful Activity Related to Gaming.

Requirements

For certain Standards, further and more explicit direction is provided through one or more specific “Requirements”. These Requirements establish the minimum obligations a registrant must achieve to fulfill the corresponding Standard.

Guidance

Included as part of a number of the Standards and Requirements is a corresponding section which provides regulatory guidance specific to the given standard or requirement. Guidance serves to provide registrants with greater clarity as to the purpose or intent behind a given Standard or Requirement. 

If, in the future additional guidance is necessary, the AGCO plans to work in collaboration with industry and other key stakeholders, when necessary, to facilitate compliance, ease of application and to ensure a consistent and shared understanding as to the meaning and intent of the Standards and Requirements.

The Standards-Based Approach

Under the Gaming Control Act, 1992 (GCA) and Regulation 78/12, the Registrar is authorized to establish risk-based standards to regulate Ontario’s gaming sector. The objective of a standards-based regulatory model is to shift the focus from requiring registrants to comply with a specific set of rules or processes, which tend to be prescriptive in nature, towards the broader regulatory outcomes or objectives they are expected to achieve. These regulatory outcomes are reflected in the “Standards” established herein. 

In most cases, these Standards are drafted at a high level of generality, with the aim being to capture the purpose behind the rule. This offers greater flexibility for regulated entities to determine the most efficient and effective way of meeting the outcomes required, which in turn helps reduce regulatory burden and support market innovation. Further, the flexibility inherent in a Standards-Based model allows the Alcohol and Gaming Commission of Ontario (AGCO) to focus its resources on key risks and to deliver a modernized approach to gaming regulation in a rapidly evolving industry.

The Standards were developed based on a comprehensive risk assessment conducted in consultation with key stakeholders, including the Ontario Lottery and Gaming Corporation (OLG), and social responsibility groups. The resulting risk themes are outlined in the next section and the risk inventory is attached as Appendix A. Going forward, risk assessments will be conducted periodically to ensure that the Standards continue to be relevant, and that the highest standards of integrity for gaming in Ontario are maintained. 

Registrar’s authority

OLG, Operators, gaming-related suppliers, sellers and gaming assistants are required to comply with the GCA and Regulation 78/12. Specifically, Sections 3.8 and 3.9 of the GCA require registrants, employees and other persons retained by OLG to comply with the Standards and Requirements established by the Registrar. The GCA provides the Registrar with the authority to establish Standards and Requirements for the conduct, management and operation of lottery schemes or businesses related to a lottery scheme or for related goods or services.

To whom the standards apply

Standards and Requirements established by the Registrar will apply to OLG and to all Operators of lottery schemes conducted in Ontario. Additionally, certain Standards and Requirements also apply to gaming-related suppliers, sellers and gaming assistants.

Specifically, the Standards and Requirements concerning registrants other than OLG and Operators are included below.

  • Gaming-Related Suppliers: 
    • 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30, 1.31, 1.32, 1.33, 1.34, 1.35, 1.36, 1.37, 1.38, 1.39, 1.40, 1.41, 1.42, 1.43, 1.44, 1.45, 1.46
    • 2.4, 2.8, 2.8.1, 2.8.2, 2.8.3, 2.11
    • 4.1, 4.4, 4.5, 4.6, 4.6.1, 4.7, 4.8, 4.11, 4.11.3, 4.14, 4.15, 4.16, 4.19.1, 4.19.2, 4.22
    • 5.2, 5.7, 5.8, 5.10
    • 6.1
  • Sellers: 
    • 1.1, 1.17, 1.46, 1.48
    • 2.3, 2.4, 2.5, 2.6, 2.8.1, 2.8.2, 2.8.3, 2.10, 2.14
    • 3.2, 3.2.1, 3.2.2, 3.3
    • 4.1, 4.3, 4.3.1, 4.4, 4.11, 4.11.1, 4.11.2, 4.13, 4.16, 4.19.1, 4.19.2, 4.23, 4.24
    • 5.11, 5.12
    • 6.1
  • Gaming Assistant: 
    • 1.1, 1.17, 1.46, 1.48
    • 2.3, 2.4, 2.5, 2.6, 2.10, 2.14
    • 3.2, 3.2.1, 3.3
    • 4.2, 4.3, 4.3.1, 4.4, 4.11, 4.11.1, 4.11.2, 4.13, 4.16, 4.23, 4.24
    • 5.11
    • 6.1

The Registrar may direct any registered gaming-related suppliers, sellers and gaming assistants to comply with any additional Standards and Requirements as considered necessary to enhance and preserve the integrity of and public confidence in gaming in Ontario. The Registrar may also propose additional terms of registration specific to an Operator or other registrant to give effect to the purposes of the GCA.

These Standards and Requirements will not apply to lottery schemes conducted and managed by charitable organizations in accordance with section 207(1)(b) of the Criminal Code (Canada) or to suppliers, gaming assistants or other persons engaged in such lottery schemes. Existing standards, policies and terms and conditions will continue to apply to such lottery schemes, until such time as the Registrar determines.

Lottery Standards and Requirements for Sport and Event Betting

The AGCO recognizes that sport and event betting is an integrated part of gaming. The AGCO has embedded the standards and requirements for sport and event betting within the Registrar’s Standards for Gaming: Lottery Sector. This integrated structure means that the Registrar’s Standards for Gaming: Lottery Sector will generally apply to sport and event betting. The standards and requirements apply to all sports, esports, novelty, and fantasy sports products, and includes various bet types such as single- event, pool, and parlay. Virtual sports are not recognized as qualifying as an event that can be bet upon.

Registrar’s expectations

An Operator’s control environment and operating principles form an integral part of the standards-based framework. This section includes information from the Registrar to help guide Operators in the development and implementation of their control environment, as well as to establish key operating principles from a forward looking industry perspective. 

Control environment

  1. Operators will have appropriate and effective control activities in place to meet the Standards and Requirements.
  2. Operators will develop control activities based on the regulatory risks identified by the AGCO, taking into account how these risks apply or could manifest in the lottery sector.
  3. Operators will use control activities that can be audited or periodically reviewed for compliance with the Standards and Requirements, and will use systems-based solutions where appropriate.
  4. In developing their control environment, Operators will consider the Standards and Requirements in their entirety, as one control activity may be used to mitigate the risks associated with multiple Standards and Requirements.
  5. Operators shall develop an implementation and compliance plan for review by the Registrar prior to transitioning to a standards-based framework. An Operator’s plan must cover at a minimum the following elements: its process for developing control activities, including any industry standards or good practices it utilizes as part of its compliance framework; its corporate governance structure; the roles and activities of its internal and external auditors; and the timing for each phase of implementation and anticipated full implementation date.
  6. Operators shall develop and ensure an appropriate control environment that allow for Sellers to comply with these Standards and Requirements. Sellers and Gaming Assistants shall adhere to the controls established and implemented by Operators as required.

Utilize established effective practices

  1. Operators are encouraged to adopt industry standards, good practices and governance frameworks established by relevant standards-setting and standards-administering institutes and bodies to support an efficient and effective compliance framework. Similarly, Operators are encouraged to obtain certifications and accreditation, over time, to support continuous improvement of their operations and to contribute a degree of independent validation to their control environment and its design effectiveness.

Oversight and audit

  1. An Operator’s control activities must be reviewed by an independent oversight function for compliance with the Standards and Requirements. Independent oversight practices may vary by Operator depending on a number of factors, including the size, structure and complexity of the Operator’s organization. Whatever the case, the Registrar expects that there will be an appropriate role for both internal and external auditors in assessing the ongoing effectiveness and efficiency of internal controls.
  2. In addition to reviewing controls for compliance with the Standards and Requirements, audits should also take into account whether controls are consistent with appropriate and relevant industry standards, good practices and governance frameworks.

Standards interpretation protocol

The Standards Interpretation Protocol has been established by the AGCO in order to provide registrants and entities participating in the OLG’s Modernization Initiative with a single point of contact for standards-related inquiries and to provide timely, consistent and well-reasoned responses to those inquiries. A dedicated email account has been established (Standards.Coordinator@agco.ca) for the receipt of inquiries.

Definitions

Words and phrases in these Standards and Requirements shall have the same meaning as in the GCA and Regulation 78/12, unless indicated otherwise.

  1. AGCO means the Alcohol and Gaming Commission of Ontario.
  2. A bet is an amount risked in a wager.
  3. Board refers to either the entire Board of Directors of an Operator or gaming-related supplier (as the case may be) or a committee of the Board that has been delegated a particular element of Board oversight (e.g. audit, compliance, etc.). For purposes of clarity, “Board” does not include the OLG Board unless the gaming site is operated by OLG.
  4. Controls or control activities are the individual policies, procedures, business processes, monitoring systems, structures, accountabilities, tools and instruments, etc., that comprise the control environment management establishes to address the regulatory risks identified by the AGCO and achieve the regulatory objectives reflected in the Standards and Requirements.
  5. Draw-based games means any lottery offering where the outcomes are determined by matching a combination of numbers, words, or other symbols, to another combination randomly generated at a predetermined draw time after the purchase of the lottery ticket. 
  6. Eligible individuals are those persons who are not prohibited from accessing gaming sites or playing lottery schemes under Standards 3.1 or 3.2.
  7. eSports are video games played competitively; eSports are considered a sport for the purpose of these Standards.
  8. Fantasy Sports are any pay-to-play sport betting product (fantasy sports contests are considered a type of sport betting for the purpose of these Standards) provided by an operator wherein consumers can assemble a virtual team composed of real players in a given sport and compete against other virtual teams based on the performance of those players in real matches.
  9. Free-to-play games refer to games, typically offered for promotional purposes, that provide players the option to play without paying or betting.
  10. Gaming-related supplier means a person who manufactures, provides, installs, tests, maintains or repairs gaming equipment or who provides consulting or similar services directly related to the playing of a lottery scheme or the operation of a gaming site.
  11. Gaming site means a premises or an electronic channel maintained for the purpose of playing or operating a lottery scheme. 
  12. Gaming supplies refers to gaming equipment that could influence or is integral to the conduct, management or operation of a lottery scheme.
  13. Gaming system includes hardware, software, applications and all associated components of gaming supplies and the technology environment.
  14. GCA means the Gaming Control Act, 1992.
  15. Independent Integrity Monitor is any supplier registered by the Registrar to perform the Independent Integrity Monitor role pursuant to Standard 4.19.1, which provides services to, among others, regulators or operators, and which receives, assesses, and distributes unusual/suspicious betting alerts and has the expertise to analyze an evaluate the accuracy and severity of received unusual/suspicious betting alerts.
  16. Independent oversight function has the meaning ascribed to it in Standard 1.2.
  17. An In-Game Bet is any bet on an event or any element of an event made during the course of the event.
  18. Instant games means any lottery offering where the outcomes are determined by matching a combination of symbols found on the ticket, generated according to an algorithm, to a predetermined combination of symbols.
  19. Lottery draw means a random selection of lottery outcomes by means of a random number generator, either physical or electronic.
  20. Lottery scheme has the same meaning as in subsection 207(4) of the Criminal Code (Canada).
  21. Lottery ticket means a chance to participate in a lottery scheme.
  22. Manual controls are non-system, human-performed control activities.
  23. Novelty Events is any bet placed on a non-sporting event where real-world factual occurrences are the contingency on which an outcome is determined and in accordance with Standard 4.3.1.
  24. OLG means the Ontario Lottery and Gaming Corporation. For purposes of these Standards and Requirements, OLG is also an Operator.
  25. Operator means a person who operates a gaming site, and includes OLG.
  26. Randomness or Chance is observed unpredictability and absence of a pattern in a set of events that have definite probabilities of occurrence.
  27. Registrar means the Registrar of Alcohol and Gaming under the Alcohol and Gaming Commission of Ontario Act, 2019.
  28. Self-excluded persons are individuals who participate in a process established by OLG to exclude themselves voluntarily from gaming sites.
  29. A Seller is a person who sells a lottery ticket. Note: Seller is a category of registrant at the AGCO.
  30. Sensitive inventories are assets that require appropriate access controls to ensure gaming integrity and protection of assets, and include at a minimum cash and cash equivalents, cash boxes, controller chips, activated instant lottery tickets, keys that enable access to sensitive areas of a gaming machine or premises or items that affect the outcome of a game including but not limited to cards, dice, roulette and bingo balls, tiles, bingo paper, and draw balls.
  31. Sport and Event Betting is any bet on occurrences related to sports, competitions, matches, and other types of activities which meet the criteria articulated in Standard 4.3.1, and which excludes games or events where the outcome is determined or controlled by a random number generator, peer-to- peer play, or an operator. Sport and event betting includes:
    • Bets on fantasy sports, esports, and novelty events, but does not include bets on virtual sports.
    • Sport and Event Bets include, but are not limited to, single-game bets, teaser bets, parlays, over-under, moneyline, pools, exchange betting*, in- game betting*, proposition bets, and straight bets.
      *in-game and peer-to-peer bets, including exchange bets, are prohibited in lottery. See Standard 4.3.1. requirement 16.
  32. Sport/Event Government Body is an organization that prescribes final rules and enforces codes of conduct (including prohibitions on betting by insiders on events overseen by the sport governing body) for a sporting event and the participants in the event.
  33. Synthetic Lottery Products are any bets that is part of a scheme operated by a third-party where the outcome is derived from a separate underlying lottery draw operated by a different operator.
  34. System accounts are all accounts that are used to manage the system.
  35. Virtual Sports is a computer-generated presentation of a random number draw that provides sports-like visual presentation for entertainment purposes only. The outcome of the “event” is determined by a random number generator, rather than real-world sport or novelty events or players. Virtual sports are not considered a type of sport and event betting.

1. Entity Level

Management Integrity

1.1    There shall be a commitment to character, integrity and high ethical values demonstrated through attitude and actions.

Requirements – At a minimum:

  1. Matters identified in management letters from internal and external auditors and matters identified by the Registrar shall be responded to in a timely manner.
  2. All applicable laws and regulations shall be adhered to.
  3. Operators and gaming-related suppliers shall create and abide by a code of conduct which addresses at a minimum conflicts of interest and transparency in dealings with the Registrar.  The code of conduct must be regularly reviewed by the organization’s senior management.

Sound Control Environment

1.2    Formal control activities shall be submitted to the Registrar which have been assessed by an independent oversight function acceptable to the Registrar for alignment with the Standards and Requirements and authorized by the appropriate level of management.

Requirements – At a minimum:

  1. A process shall be in place to periodically review control activities for effectiveness in fulfilling the Standards and Requirements and to document, remedy and adjust the controls where deficiencies or gaps are found. 
  2. Substantial changes to the control environment shall be communicated to the Registrar in a timely manner.
  3. Control activities must be available to the AGCO (or its designate) for regulatory assurance purposes.

1.3    Operators and gaming-related suppliers shall comply with their control activities and shall have in place measures to monitor compliance and to address failures to comply.

1.4    Employees shall comply with the control activities established by their employer to achieve the Standards and Requirements.

1.5    Operators and gaming-related suppliers are accountable for compliance with control activities by employees and those providing goods and service to operators and gaming-related suppliers, and should have in place measures to monitor compliance and to address failures to comply.  

1.6    Employees shall inform their employer if control activities are ineffective in achieving compliance with the Standards and Requirements.

1.7    Management overrides of the control activities shall be clearly documented and communicated to the Registrar.

Requirements – At a minimum:

  1. Approval from at least two senior-level managers is required in order to override any control activity, and in each instance the override shall be reported to the Board or other governance structure where a Board does not exist. 

Guidance: The intent of this Standard is to allow senior-level management to override controls on a one-off basis in necessary circumstances and to ensure that appropriate documentation is maintained for auditing purposes. This Standard is not intended to address permanent changes to the control environment.

1.8    Operators must establish, implement and maintain controls to support preparation of financial reports which comply with all applicable accounting standards and rules and good practices.

1.9    Employees must have the competence, skills, experience and training required to execute control activities that are relevant to their responsibilities.

Requirements – At a minimum:

  1. Employees involved in performing control activities must be trained and have knowledge of the organization’s control environment, the regulatory risks that the controls are designed to mitigate and the regulatory objectives reflected in the Standards and Requirements.

1.10    Organizational structures shall be designed to promote a sound control environment and proper segregation of duties to ensure that the possibility for collusion or unauthorized or illegal activities is minimized. 

Requirements – At a minimum:

  1. Employees shall be given the appropriate and documented authority and responsibility to carry out their job functions, subject to supervision.  
  2. The adequacy of segregation of duties as they relate to player protection, game integrity and protection of assets shall be regularly reviewed by the organization’s internal audit group or other independent oversight function acceptable to the Registrar.
  3. Operators must provide the Registrar with an organizational chart showing key reporting lines and relationships and shall ensure that it remains up to date.

1.11    Management clearly understands its accountability and authority for the control environment.

Requirements – At a minimum:

  1. Management shall have been trained and have knowledge of the organization’s control environment, the regulatory risks that the controls are designed to mitigate and the regulatory objectives reflected in the Standards and Requirements. 

1.12    Information, including logs, related to compliance with the law, the Standards and Requirements and/or adherence with control activities shall be retained for a minimum of three (3) years, unless otherwise stated.

1.13    All surveillance recordings shall be retained for a minimum period as specified by the Registrar.

Oversight

1.14    Compliance with the Standards and Requirements shall be documented in an organized manner to ensure that the information is capable of being reviewed and audited by an independent oversight function.

Requirements – At a minimum:

  1. Documentation shall be reviewed and analyzed to ensure compliance with the Standards and Requirements, and approved by management.
  2. Internal and external auditors shall be granted access to all relevant systems, documentation (including control activities) and resources for the purpose of conducting an audit.
  3. Where directed, Operators and gaming-related suppliers shall retain an independent auditor acceptable to the Registrar to carry out audits required by the Registrar and provide copies of the audit reports to the Registrar. 
  4. In reviewing control activities for compliance with the Standards and Requirements, internal and external auditors shall take into account the Registrar’s expectations, as articulated herein.

1.15    Primary accountability for compliance resides with the Board, or other governance structure, where a Board does not exist, and there shall be evidence that the Board, or other governance structure, has carried out its responsibility in this respect.

Requirements – At a minimum:

  1. A compliance oversight function shall be established that is independent of the activities it oversees.
  2. An internal audit function shall be established that regularly audits the organization’s control environment and compliance management framework and exercises oversight that is independent from operational management.  The internal audit function shall have the authority to independently review any aspect of the operations.
  3. The compliance oversight function and internal audit or other independent oversight function shall have direct and unrestricted access to the Board, or other governance structure, and shall report on all important issues regarding compliance on a regular basis or as necessary.
  4. The Board, or other governance structure, shall establish a committee or committees to oversee the organization’s compliance and audit oversight functions, with appropriate terms of reference addressing composition and accountabilities.
  5. Members of the Board, or other governance structure, and of any committees established to oversee the organization’s compliance and audit oversight functions shall understand the business’s operations, initiatives and major transactions, and shall have the skills, training, experience and independence to carry out their fiduciary responsibilities.

1.16    There shall be an independent “whistleblowing” process to allow employees to anonymously report deficiencies or gaps in the control environment as well as incidents of possible non-compliance with the controls, Standards and Requirements, or the law.

Requirements – At a minimum: 

  1. Issues raised through the “whistleblowing” process must be addressed and communicated to the Board in a timely manner.

1.17    Registrants shall engage with the Registrar in a transparent way. 

Requirements – At a minimum, Operators shall: 

  1. Provide reports regarding any incident or matter that may affect the integrity or public confidence in gaming, including any actions taken to prevent similar incidents from occurring in the future, in accordance with the established notification matrix.
  2. Provide reports regarding any incident of non-compliance with the law, Standards and Requirements or control activities, including any actions taken to correct the cause of non-compliance, in accordance with the established notification matrix.
  3. Provide periodic reports demonstrating the performance over time of compliance with control activities.
  4. Make available any data, information and documents requested by the Registrar.
  5. Provide reports regarding any public complaints related to compliance with the Standards and Requirements, including any actions taken to resolve the complaints, in accordance with the established notification matrix. 

 

 

Information Technology

1.18    A recognized industry standard framework shall be used to manage the information technology (IT) control environment to support compliance with the Standards and Requirements.

1.19    Users shall be granted access to the gaming system based on business need.

Requirements – At a minimum:

  1. Access privileges are granted, modified and revoked based on employment status and job requirements and all activities associated with these actions are logged.
  2. Access privileges are independently reviewed and confirmed on a periodic basis.

1.20    Access to gaming information systems shall be monitored, logged and shall be traceable to a specific individual.

Requirements – At a minimum:

  1. All accounts for business users shall be uniquely assigned to an individual.
  2. All system accounts (or other accounts with equivalent privileges) shall be restricted to staff that provide IT support, and mechanisms shall be in place to secure and monitor use of those accounts.

1.21    Processes shall be in place to ensure that only authorized individuals are permitted to open system accounts.

1.22    Industry accepted components, both hardware and software, shall be used where possible.

1.23    Any connection or interface between the gaming system and any other system, whether internal or external third party, shall be monitored, hardened and regularly assessed to ensure the integrity and security of the gaming system.

1.24    Mechanisms shall be in place to ensure the reliability, integrity and availability of the gaming system.

1.25   There shall be a suitably secure physical environment in place to prevent unauthorized access to the gaming system and to ensure the protection of assets.

1.26    Gaming systems, infrastructure, data, activity logs and all other related components shall be protected from threats, vulnerabilities, attacks or breaches. 

Requirements – At a minimum:

  1. All users shall be authenticated.
  2. All components shall be hardened in accordance with industry and technology good practices prior to going live and prior to any changes. 
  3. The appropriateness and effectiveness of steps taken to harden technology components shall be regularly assessed.
  4. Patches to correct any security risks shall be updated regularly.

1.27    Security activities shall be logged in an auditable manner, monitored, promptly analyzed and a report prepared and escalated as appropriate. 

Requirements – At a minimum:

  1. Attempts to attack breach or access gaming system components in an unauthorized manner shall be responded to in a timely and appropriate manner.
  2. Intrusion attempts shall be actively detected and where possible prevented from causing disruption or outage of the gaming system. 
  3. There shall be adequate logging to capture and monitor any attempts to attack, breach or access in an unauthorized manner any components of the gaming system. There shall be an appropriate escalation procedure.

1.28    Independent assessments shall be regularly performed by a qualified individual to verify the adequacy of gaming system security and all of its related components.  

1.29    Operators and gaming-related suppliers shall stay current on security trends, issues and solutions.

Change Management

1.30    A system development lifecycle that considers security and processing integrity shall be in place for gaming system technology developed in-house.

1.31    Due diligence must be performed on all acquired gaming system technology to ensure security and processing integrity requirements are met.

1.32    A testing strategy to address changes in technology shall be in place to ensure that deployed gaming systems operate as intended.  

1.33    All gaming system changes shall be appropriately, consistently and clearly documented, reviewed, tested and approved.

Requirements – At a minimum:

  1. All gaming system technology components are installed and maintained in accordance with the appropriate change management procedures.
  2. Requests for changes and maintenance of the gaming system are standardized and are subject to change management procedures.
  3. Emergency changes are approved, tested, documented, and monitored.
  4. Change management procedures shall account for segregation of duties between development and production.
  5. Only dedicated and specific accounts may be used to make changes.

1.34    The gaming system shall be able to detect unauthorized changes.

Data Governance

1.35    Data governance shall be in place to address data processing integrity and protection of sensitive data.

1.36    Sensitive data, including player information and data relevant to determining game outcomes, shall be secured and protected from unauthorized access or use at all times. 

Requirements – At a minimum:

  1. The gaming system shall ensure that data is appropriately backed up in a manner that allows it to be completely and accurately restored.
  2. Data backups shall be stored off-site in a secure location and in accordance with applicable policies and laws.

1.37    Player information shall be securely protected and its usage controlled by OLG.

Requirements – At a minimum:

  1. Data collection and protection requirements for player personal information shall meet those set out in the Freedom of Information and Protection of Privacy Act.
  2. Player information shall only be used for OLG’s business unless there is prior approval from OLG.

1.38    Removed January 2022

1.39    Communication of sensitive game data shall be protected for integrity.

1.40    Procedures shall be established and documented for IT operations and incident management, including managing, monitoring, and responding to security and processing integrity events.

Requirements – At a minimum:

  1. Proactive monitoring and detection of errors in the gaming system and related components shall be in place. Action shall be immediately taken to correct incidents of non-compliance with the Standards and Requirements or control activities.
  2. There shall be time synchronization of the gaming system environment and related components. 
  3. Event data shall be retained to provide chronological information and logs to enable the reconstruction, review and examination of the time sequences of processing.

1.41    Gaming applications on all portable devices shall be appropriately secured.

Guidance: This Standard is not intended to capture players using their own portable devices such as their smartphones, but rather employees or players using portable devices to access the Operator’s gaming system.

1.42    Operators and gaming-related suppliers shall only contract with reputable suppliers.

1.43    Service levels for management of suppliers shall be established.

Requirements – At a minimum:

  1. Service levels must be documented and enforceable.
  2. Corrective action is taken to address non-compliance with established service levels.

1.44    Operators and gaming-related suppliers shall provide the Registrar with a list of suppliers that provide them with goods or services in relation to lottery schemes and shall ensure that this list is kept up to date.

Compliance; Policies and Procedures

1.45    Operators and gaming-related suppliers shall comply with applicable technical standards issued by the Registrar.

Policies and Procedures 

1.46    All registrants and non-gaming-related suppliers who are exempt from registration will comply with all applicable OLG policies and procedures to the extent that they are consistent with these Standards and Requirements.

1.47    The Operator shall develop policies and procedures regarding Sellers and Sellers’ employees’ roles and responsibilities to achieve the desired outcomes set out in the Standards that apply to Sellers:  

  • 1.1, 1.17, 1.46, 1.48
  • 2.3, 2.4, 2.5, 2.6, 2.10, 2.14
  • 3.2, 3.3
  • 4.1, 4.3, 4.4, 4.11, 4.13, 4.16, 4.23, 4.24
  • 5.11
  • 6.1

1.48    Sellers and Sellers’ employees shall comply with the Operator’s policies and procedures and the Seller’s contract with the Operator.

 

2. Responsible Gambling

2.1    Advertising and marketing materials and communications shall not target underage or self-excluded persons to participate in lottery schemes.

Requirements – At a minimum, materials and communications shall not:

  1. Be based on themes, or use language, intended to appeal primarily to minors.
  2. Appear on billboards or other outdoor displays that are directly adjacent to schools or other primarily youth-oriented locations.
  3. Contain cartoon figures, symbols, role models, and/or celebrity/entertainer endorsers whose primary appeal is to minors.
  4. Use individuals who are, or appear to be, minors to promote gambling.
  5. Appear in media and venues directed primarily to minors, or where most of the audience is reasonably expected to be minors.
  6. Persons depicted as lottery purchasers or players in lottery advertising should not be, nor appear to be, minors.

2.2    Advertising and marketing materials and communications shall not be misleading.

Requirements – At a minimum, materials and communications shall not:

  1. Imply that playing a lottery scheme is required in order to fulfil family or social obligations or solve personal problems. 
  2. Promote playing a lottery scheme as an alternative to employment, as a financial investment, or as a requirement for financial security. 
  3. Contain endorsements by well-known personalities that suggest that playing lottery schemes has contributed to their success.
  4. Encourage play as a means of recovering past gambling or other financial losses.
  5. Be designed so as to make false promises or present winning as the probable outcome. 
  6. Imply that chances of winning increase:
    1. the longer one plays
    2. the more one spends
    3. suggest that skill can influence the outcome (for games where skill is not a factor).

2.2.1   Advertising and marketing materials that communicate gambling inducements, bonuses and credits related to sport and event betting are prohibited, except in the following:

  1. on OLG’s websites, including the landing page and electronic channel;
  2. a lottery terminal;
  3. signage inside the premises, on the property on which the premises are situated or immediately adjacent to the premises; or
  4. through direct advertising and marketing after receiving active player consent.

Guidance:

  • This standard does not prohibit the use of inducements, bonuses and credits.
  • Except as outlined in the Standard, all public advertising of gambling inducements, bonuses and credits related to sport and event betting is otherwise prohibited, including targeted advertising and algorithm-based ads.
  • Direct marketing and advertising includes but is not limited to: direct messaging via social media, emails, texts, and phone calls.

2.2.2    Permitted advertising and marketing materials that communicate gambling inducements, bonuses and credits must, at a minimum:

  1. Disclose all material conditions and limitations of the offer at its first presentation.
  2. Not be described as free unless the inducement, bonus or credit is free. If the player has to risk or lose their own money or if there are conditions attached to their own money, the offer must disclose those terms and may not be described as free.
  3. Not be described as risk-free if the player needs to incur any loss or risk their own money to use or withdraw winnings from the risk-free bet.

2.2.3   Players must be provided an opt-in process whereby they actively consent to receiving any direct advertising and marketing of inducements, bonuses and credits, and must be provided a method to withdraw their consent at any time, where such marketing and advertising materials are available.

Guidance: direct marketing and advertising includes but is not limited to: direct messaging via social media, emails, texts, and phone calls.

2.3    Information about the risks of gambling and where to obtain additional information or assistance shall be made readily available.

Requirements – At a minimum:

  1. Responsible gambling materials and information about obtaining help, including the number for Connex Ontario, shall be available, visible and accessible.
  2. Information about setting betting limits, if applicable, shall be made available.
  3. Information about self-exclusion programs shall be available, visible and accessible. 
  4. Advertising and marketing materials shall, where effective, contain a responsible gambling message.
  5. All information related to responsible gambling shall be regularly and periodically reviewed and updated to ensure that it is accurate, up to date and in line with industry good practice.

2.4    Meaningful and accurate information shall be available to enable individuals to make informed choices.

Requirements – At a minimum:

  1. Meaningful and accurate information on the rules of play shall be clearly stated and made available.
  2. Meaningful and accurate information on the odds of winning, payout odds or returns shall be clearly stated and made available.
  3. Odds in sport and event betting sometimes change prior to or during an event. Changes in odds must be updated and publicly available to all players. This is not intended to entitle a player who has previously placed a bet to receive new odds on that bet.
  4. For sport and event betting, provide any other information on elements that will affect play (e.g., how the results of pool betting work, and the procedures for confirming the results).
  5. Cash out options and how to redeem winning bets in sport and event betting.

2.5    Support shall be provided to persons showing signs of potentially problematic gambling behavior.

Requirements – At a minimum:

  1. All Operator employees who interact with players as well as Sellers and Sellers’ registered gaming assistants shall receive training in a Registrar-approved program, appropriate for their level of responsibility, designed to identify and respond appropriately to individuals who may be showing signs of problem gambling. 
  2. Individuals shall be provided with easily accessible contact information of at least one organization dedicated to treating and assisting problem gamblers.
  3. OLG shall develop and enforce responsible gambling policies, procedures and training, ensure they are available, kept up to date and relevant, and that the Operator complies with them.
  4. Responsible gambling policies shall be reviewed periodically for effectiveness.

2.6    OLG shall provide a common voluntary self-exclusion program.

Requirements – At a minimum:

  1. At the time of signing up for self-exclusion, individuals shall have the option to be excluded from Casino, cGaming, iGaming and applicable online lottery channels. 
  2. Despite requirement 1, if a player self-excludes from a Casino, the player is not eligible to gamble on OLG’s iGaming site for the duration of the self-exclusion period. 
  3. Individuals shall have the option to sign up for the self-exclusion program at gaming sites or at an off-site location.
  4. Self-exclusions shall have a term of at least six months.
  5. Operators shall take active steps to identify, and if required, remove self-excluded persons when they are found to be in breach of their self-exclusion agreement.

Guidance: OLG’s self-exclusion program may be executed in each of the gaming sectors using different processes and technologies to reflect the distinct operational circumstances of that sector, however, the long term expectation is that OLG will be able to identify, track and prohibit access to self-excluded persons in and between the various gaming sectors.

Lottery-Specific Guidance: At this time, given the operational realities of the lottery sector, the intent of this Standard is not to require OLG to provide a self-exclusion program for lottery products purchased and sold anonymously at a Sellers’ physical site, unlike an online lottery channel. The existing self-exclusion programs at other gaming sites (Casinos, cGaming or iGaming) would prevent self-excluded individuals from accessing lottery products at those sites.

2.7    Individuals who have decided to voluntarily self-exclude shall be removed from mailing lists and shall not receive incentives or promotions for any products and services during the period of self-exclusion. 

2.8    Game designs and features shall be clear and shall not mislead the player. This Standard does not apply to sport and event betting products.

Requirements – At a minimum:

  1. Where a game simulates a physical device, the theoretical probabilities and visual representation of the game shall correspond to the features and actions of the physical device, unless otherwise disclosed to the player.
  2. Game design shall not give the player the perception that speed of play or skill affects the outcome of the game when it does not.
  3. After the selection of game outcome, the game shall not make a variable secondary decision which affects the result shown to the player. If the outcome is chosen that the game will lose then the game shall not substitute a particular type of loss to show to the player (i.e. near miss). 
  4. Where the game requires a pre-determined pattern (for example, hidden prizes on a map), the locations of the winning spots shall not change during play, except as provided for in the rules of play.
  5. Games shall not display amounts or symbols that are unachievable.
  6. Games shall not contain intentionally programmed subliminal messaging.
  7. Where games involve reels:
    1. For single line games, jackpot symbols shall not appear in their entirety more than 12 times on average, adjacent to the pay-line, for every time they appear on the pay-line.
    2. For multi-line games, jackpot symbols shall not appear in their entirety more than 12 times, on average, not on any pay-line, for every time they appear on any pay-line.
  8. Free-to-play games shall not misrepresent or mislead players as to the likelihood of winning or prize distribution of similar games played for money.
  9. The denomination of each credit shall be clearly displayed on game screens.

2.8.1    The method of making bets in sport and event betting must be straightforward and understandable. Information must be made available so that the player is clearly informed of the details of the bet prior to making the bet. All selections in a bet must be displayed made clear to the player.

Requirements – At a minimum:

  1. Bets on multiple events (parlays) must be identified as parlays.
  2. The player must be informed that a bet selected by the player has or has not been accepted.
  3. Where the player has placed a bet and the odds, payout odds, or prices of the bet change prior to the bet being accepted by the operator, the player must have the option of confirming or withdrawing the bet (with refund of the bet).
  4. The option of automatic acceptance of changes in bets by the player is prohibited.
  5. The player must be informed of the period in which bets can be made on an event or series of events and bets cannot be placed after the close of the betting period.
  6. Free to play sport and event betting games must not mislead players about the odds, payouts or any element of a bet for value available in sport and event betting.
  7. All bets and payouts must be expressed in Canadian currency.

2.8.2    Players must be able to access information regarding available sport and event bets without having to place a bet. This information includes:

Requirements – At a minimum:

  1. Information on the bets available;
  2. Odds, payouts and prices for available bets;
  1. In a dynamic betting environment, including those where individuals’ wagers are gathered into pools:
    1. The most up-to-date odds and payouts (not applicable to pools);
    2. The up-to-date total value of the pool for market pools and pool bets that are offered.

2.8.3    Reputable and legitimate data source(s) must be used to determine the outcome of a bet. These data source(s) shall be made available to the player upon request.

2.9   Free-to-play games shall provide the same responsible gambling and player protection information as games played for money.

2.10    Only eligible individuals are permitted to play free-to-play games.

2.11    Games shall not encourage players to chase their losses, or increase the amount they have decided to gamble, or continue to gamble after they have indicated that they want to stop.

2.12    Not applicable to lottery sector.

2.13    Games shall not appeal primarily to underage individuals.

2.14    Credit shall not be extended or lent to individuals to gamble.

Guidance: This standard does not prohibit the use of credit cards for the purchase of lottery tickets.

3. Prohibiting Access to Designated Groups

Last Updated: 
2023-11-01

3.1    Not applicable to lottery sector

3.2    Only eligible individuals are permitted to play a lottery scheme.

Lottery-Specific Requirements – At a minimum:

  1. No person who is authorized to sell lottery tickets, and no person acting on such a person’s behalf, shall sell a lottery ticket to an individual under 18 years of age.
  2. A Seller shall not sell a lottery ticket to any of the following individuals: 
    1. individuals who appear to be intoxicated. 
    2. officers, directors or partners of the Seller. 
    3. registered gaming assistants of the Seller employed at the gaming site where the Seller sells lottery tickets.
    4. executives or staff of a trade union who represent or negotiate on behalf of employees employed at the gaming site where the seller sells lottery tickets. 
    5. employees of registered suppliers who maintain or repair gaming equipment at the gaming site where the Seller sells lottery tickets. 
    6. members or employees of the AGCO
  3. An Operator of a gaming site and, if the OLG operates a gaming site, the OLG shall not permit the following individuals to play a lottery scheme in the site: 
    1. individuals who appear to be intoxicated if the site is physical premises.
    2. an individual who the Operator or the OLG has reason to believe has been excluded from the site under subsection 3.6 (1) of the GCA
    3. every individual who advises the Operator or the OLG that the individual is participating in a self-exclusion process established by the OLG that applies to the site. 
    4. officers, directors or partners of the Operator. 
    5. registered gaming assistants of an Operator or the OLG employed at any gaming site operated by the Operator or the OLG
    6. executives or staff of a trade union who represent or negotiate on behalf of employees employed at the site. 
    7. employees of registered suppliers who maintain or repair gaming equipment at the site. 
    8. members or employees of the Commission. 
    9. officers, directors or employees of the OLG

Guidance: Despite requirement 3i, an operator of a gaming site, other than the OLG, may permit employees of the OLG to play a lottery scheme in the site if, (a) they are gaming assistants registered as category 2 gaming assistants; or (b) under the  GCA or Ontario Regulation 78/12, they are not required to register as gaming assistants in order to act as employees of the OLG

  1. Individuals described in paragraphs 2.b to f and paragraphs 3.b and 3.d to i shall not be permitted to win prizes.

3.2.1    Operators and sellers shall not knowingly permit an individual to engage in any of the following prohibited activities and shall take steps to actively monitor and prevent such prohibited activity from occurring:

  • An individual with access to non-public information related to an event or an individual who may impact the outcome of an event or bet type is prohibited from betting on any event overseen by the relevant sport/event governing body.
  • Athletes, coaches, managers, owners, referees, and anyone with sufficient authority to influence the outcome of an event are prohibited from betting on events overseen by the relevant sport or event governing body.
  • Owners (any person who is a direct or indirect legal or beneficial owner of 10 percent or greater) of a sport governing body or member team are prohibited from betting on any event overseen by the sport governing body or any event in which a member team of that sport or event governing body participates.
  • Those involved in a sport or event may not be involved in compiling betting odds for the competition in which they are involved.

Requirements – At a minimum:

  1. Operators must make reasonable efforts to inform any entity with which they have an information sharing relationship, including independent integrity monitors, sport betting operators, the appropriate governing authority for the sport or event, and any other organizations or individuals identified by the Registrar if an individual is found to have engaged in prohibited activity under Standard 3.2.1.
  2. Individuals found to have engaged in prohibited activity in Standard 3.2.1 shall not be eligible for prizes.

3.2.2    The Operator of a gaming site with a self-serve lottery terminal and Sellers working in a gaming site with a self-serve lottery terminal shall not permit individuals described in 3.2 to play a lottery scheme.

Requirements – At a minimum:

  1. The Operator shall ensure that the self-serve lottery terminal is installed within a direct line of sight of the Seller and Sellers’ employees of the premises. 
  2. The Operator shall develop responsible gambling policies, procedures and training, including about prohibiting access to designated groups.
  3. The Operator shall ensure that its responsible gambling policies, procedures, and training in Requirement 2 are available to a Seller and a Seller’s employees, kept up to date and relevant, and that a Seller complies with them.
  4. A Seller with a self-serve lottery terminal shall effectively monitor, in-person, all player activity and transactions.
  5. The Operator shall ensure that a self-serve lottery terminal is equipped with a disablement mechanism.
  6. The Seller shall use the disablement mechanism where an ineligible person attempts to access the self-serve lottery terminal.

3.3    Lottery schemes shall be provided only within Ontario, unless the lottery scheme is conducted in conjunction with the government of another province.

4. Ensuring Game Integrity and Player Awareness

Last Updated: 
2023-11-01

4.1    All gaming activities and financial transactions shall be conducted fairly and honestly, and must be independently verifiable. 

Lottery-Specific Guidance: Given the operational nature of the lottery sector, not all aspects of lottery activities and transactions will be independently verifiable, but it is expected that they will be where possible.

4.2    Rules of play, including any subsequent modifications, shall be submitted to the Registrar for approval.

Requirements – At a minimum, the rules of play shall contain:

  1. Odds of winning, payout odds or returns to players.
  2. A description of how the game is played.
  3. Circumstances in which a game can be declared void.

Lottery-Specific Guidance: For lottery, rules of play encompass game conditions and as such shall be submitted for Registrar approval, but fact sheets are not required to be submitted.

Due to the nature of sports betting in Ontario, the “Odds of winning, payout odds or returns to players” for sports games are typically indicated on the ticket, not within the rules of play. As well, returns for players can vary depending upon the amount of a given wager. Sports games, therefore, are excluded from Requirement 1.

4.3    Lottery schemes must be conducted in accordance with the approved rules of play. Sport and event betting must be conducted fairly, honestly and in accordance with the terms of the bet placed by the player.

Requirements – At a minimum:

  1. All bets shall be accepted, processed and settled in accordance with the approved rules of play.
  2. Adequate supervision of the lottery scheme is in place to ensure adherence to required procedures.
  3. Devices that compromise or affect the integrity of lottery schemes shall not be permitted.
  4. Sport and event bets shall be accepted, processed, and settled in accordance with the terms of the bet placed by the player, including any applicable betting rules.

4.3.1    The Operator offering sport and event betting products shall ensure that all bets offered meet the following criteria:

  1. The outcome of the event being bet on can be documented and verified;
  2. The outcome of the event being bet on can be generated by a reliable and independent process;
  3. The outcome of the event being bet on is not affected by any bet placed;
  4. The majority of participants in the event or league are 18 years of age or older; event shall be broadly defined as assessing total participants in the event/league, rather than in a particular heat, game, match or final contest in the overall sporting event;
  5. For sporting events being bet on, the event must be effectively supervised by a sport governing body which must, at minimum, prescribe final rules and enforces codes of conduct that include prohibitions on betting by insiders (not applicable to novelty bets);
  1. There are integrity safeguards in place which are sufficient to mitigate the risk of match-fixing, cheat-at-play, and other illicit activity that might influence the outcome of bet upon events;
  2. The bet is not on a past event for which the outcome is publicly known;
  3. The bet is not reasonably objectionable;
  4. The event being bet on does not involve animal fighting or cruelty;
  5. Bets on assets and financial markets (e.g., stocks, bonds, currencies, real property) are prohibited;
  6. Bets which expose players to losses greater than the amount wagered are prohibited;
  7. Bets which mimic the structure of financial instruments, products, or markets are prohibited;
  8. Bets on synthetic lottery products and bets on lottery outcomes are prohibited;
  9. The event being bet on is conducted in conformity with all applicable laws;
  10. Bets on minor league sports in Canada, including the Canadian Hockey League (CHL), are prohibited.
  11. In-game and peer-to-peer bets are prohibited.
  12. Individual bets over $100 are prohibited, except for the Pools products, for which bets over $500 are prohibited.

Guidance:

  • For the purpose of Req. 8, reasonably objectional bets include bets on events which are unethical, allow entertainment to be derived from human suffering or death or involve non-consensual violence or injury.
  • Req. 12 applies to contracts for difference including spread betting.

4.3.2    The Operator may only offer Draw-Based games and Instant games through a Self-Serve Lottery Terminal.

Guidance: Permissible games do not include:

  1. sport and event betting
  2. card games,
  3. table games
  4. slots, or
  5. any game that offers real-time play, except instant games.

4.4    Removed, April 2017.

4.5    All gaming systems and gaming supplies, including any subsequent modifications, shall be submitted to the Registrar for assessment and approval, at the expense of the supplier, prior to being provided to any gaming site.

Requirement:

  1. At a minimum, in accordance with the established notification matrix, approval by the AGCO is required prior to putting a gaming system or gaming supply in play.

Lottery-Specific Guidance: For the purposes of this Standard instant game tickets are not required to be submitted for assessment.

4.6    Gaming systems and gaming supplies shall be provided, installed, configured, maintained, repaired, and operated in a way that ensures the integrity, safety and security of the approved gaming supplies and systems, and in accordance with the Registrar’s approval. 

Requirements – At a minimum:

  1. Only gaming systems and gaming supplies approved by the Registrar shall be used at a gaming site.
  2. Any problem with the integrity or security of the gaming system or gaming supplies shall be reported in accordance with the established notification matrix.
  3. Monitoring and testing shall be performed throughout the life of the gaming system and gaming supplies to ensure they are operating as approved.  
  4. In the event of any suspected integrity or security problem with a gaming system or gaming supply, the current state of the gaming system and gaming supply, and any supportive evidence shall be preserved until investigators (OPP or AGCO) have provided direction.

4.6.1    Where there are suspected game or system faults that may impact game integrity or fairness including the integrity or fairness of sport and event betting (e.g., influencing a player’s chances of winning or the return to players), Operators shall make the game unavailable to players until the issue has been resolved. In the case of sport and event betting, making a game unavailable may include the suspension of betting, the withholding of funds, and the refund of any bet until a gaming system fault has been resolved. Operator decisions must be fair, reasonable, and made in good faith.

4.7    Production, testing and development systems shall be logically separated.

4.8    Moved to Electronic Lottery Systems Minimum Technical Standards.

4.9    Where game outcomes or sport and event betting transactions are not recoverable, Operator shall have clearly defined policies in respect of treating the player fairly when resolving the player’s transactions. These policies and processes shall be made available to players upon request.

4.10   Not applicable to lottery sector.

4.11   A player’s bet and the outcome of the game shall be clearly communicated and easy to understand.

4.11.1    In sport and event betting, details on placed bets shall be made readily available and clear to the player.

Requirements – At a minimum, the betting system or lottery ticket shall give the player the following information:

  1. The gaming site or brand with which the bet was made.
  2. The event and outcome upon which the bet was placed.
  3. The date and time of the bet and information about the outstanding bet.
  4. The payout odds and total monies bet.

4.11.2    In sport and event betting, bets must be settled fairly and in accordance with the terms of the bet placed by the player and any applicable betting rules that were available to the player when the bet was placed. Where raised, the reasons for the settlement must be clearly and promptly provided to the player.

4.11.3    The results of bets on sporting or other events must be provided to players making bets on the events. Any change of results must be made available.

4.11.4    The operator shall have controls in place to ensure the accuracy and timeliness of sport and event results data.

4.12   Complaints and any inquiries related to game integrity must be recorded and addressed in a timely and appropriate manner.

4.13   Games shall pay out accurately, completely and within a reasonable time of winning, subject to checks and verifications.

Requirement - At a minimum:

  1. The Operator shall have mechanisms in place to ensure that prizes are paid to the rightful person and only to eligible individuals.

Lottery-Specific Requirements – At a minimum, the Operator shall:

  1. Ensure that additional verifications take place to determine the rightful owner and/or eligibility for:
    1. all major prize claims (over a threshold as approved by the Registrar)
    2. irregular or suspicious claims
    3. claims by insiders or other designated persons.
  2. Have mechanisms in place at Seller locations to ensure that prizes are paid out to the proper person, including:
    1. a maximum level of prize redemption permitted at Seller locations
    2. a clear indication of the prize validation outcome provided
    3. winning number information made available to members of the public.
  3. Have in place an escalation process for prize claim issue resolution.
  4. Not allow players to redeem or claim any prizes or portion of a prize through the self-serve lottery terminal, except a prize or the portion of the prize that is in the form of one or more lottery tickets valued at $300 or less.
  5. Not allow players to purchase more than $300 of lottery products per transaction on an self-serve lottery terminal.

4.14   Operators and gaming-related suppliers shall have mechanisms in place to appropriately deter, prevent and detect collusion and cheating.

4.15   All relevant activities related to the detection of collusion and cheating shall be logged.

4.16   Individuals must be able to easily and readily report activities related to collusion and cheating.

4.17   There shall be mechanisms in place to ensure the integrity, security and fairness of lottery draws.

Requirements – At a minimum:

  1. Draw machines shall be tested to ensure randomness.
  2. All draws must be verified by an independent oversight function acceptable to the Registrar.
  3. Physical draws shall be video recorded and recordings must be kept for a period of time as specified by the Registrar.
  4. A record of all electronic draws must be kept for a period of time as specified by the Registrar.
  5. Winner selection processing and winning share values shall be independently validated.

4.18   In the event that the Operator suspends, recalls, withdraws, or cancels all or part of a lottery scheme, the Operator shall have clearly defined policies in respect of treating the player fairly when resolving the player’s transactions.

4.19   There shall be documented procedures for setting and updating the odds for sports games, taking into account market forces.

4.19.1    The operator shall have risk management measures in place to mitigate the betting integrity risk associated with sport and event betting, including insider betting and event manipulation. (Also applicable to Gaming-Related Suppliers)

Requirements – At a minimum:

  1. The Operator shall establish controls to identify unusual or suspicious betting activity and report such activity to an independent integrity monitor. Unusual betting activity is a betting pattern that deviates, including statistically, from the activity otherwise exhibited by patrons and reasonably expected by an operator or independent integrity monitor, which may indicate potential suspicious activity in the betting or the underlying sport or other event. Unusual betting activity may include the size of a patron’s wager or increased wagering volume on a particular event or wager type.
    Suspicious betting activity is unusual betting activity that cannot be explained and is indicative of match fixing, the manipulation of an event, misuse of inside information, or other illicit activity.
  2. Independent integrity monitors shall not have any perceived or real conflicts of interests in performing the independent integrity monitor role, including such as acting as an operator or as an oddsmaker.
  3. Independent integrity monitors shall promptly disseminate reports of unusual betting activity to all member sport betting operators.
  4. All sport and event betting operators shall review such reports and notify their independent integrity monitor of whether they have experienced similar activity.
  5. If an independent integrity monitor finds that previously reported unusual betting activity rises to the level of suspicious activity, they shall immediately notify any entity with which they have an information sharing relationship, including independent integrity monitors, sport betting operators, the appropriate governing authority for the sport or event, and any other organizations or individuals identified by the Registrar.
  6. All independent integrity monitors receiving such a report shall share such report with their member sport betting operators.
  7. Independent integrity monitors shall facilitate collaboration and information sharing to enable the investigation of and response to prohibited activity associated with the suspicious betting activity as directed by the Registrar.
  8. Independent integrity monitors shall provide, in accordance with the notification matrix, the Registrar with:
    1. All reports of unusual betting activity;
    2. If the activity was determined to be suspicious; and
    3. The actions taken by the independent integrity monitor.

Guidance: The Registrar will publish a list of registered independent integrity monitors.

4.19.2    An operator receiving a report of suspicious activity under Standard 4.19.1 may suspend or cancel sport and event betting on events related to the report or withhold associated customer funds. To this end, an Operator must ensure that it has reserved itself the authority to suspend betting, void bets, and withhold associated customer funds. The Operator’s decision to suspend or cancel sport and event betting, or withhold associated customer funds, on events related to the report must be fair, reasonable, and made in good faith.

4.20   The results for sport games shall be verified using credible sources and according to industry good practices.

4.21   The Operator shall have clearly defined policies and procedures in place to address unclaimed prizes.

4.22   Winning instant game tickets shall be randomly generated during printing. 

4.23   The Operator shall maintain an accurate, complete, and auditable list of all individuals involved in the handling of lottery tickets at Seller locations.

Requirements – At a minimum:

  1. Sellers must ensure that the Operator has an up-to-date list of all individuals involved in the handling of lottery tickets at the Seller’s location.

4.24   Sellers and Seller’s employees may only conduct a player’s lottery transactions when that player is present at the Seller’s location.

5. Public Safety and Protection of Assets

5.1    Not applicable to lottery sector.

5.2    Only authorized individuals shall be permitted access to sensitive areas.

Lottery-Specific Requirements – At a minimum, Operators and gaming-related suppliers shall:

  1. Identify sensitive areas, including areas containing sensitive inventories.
  2. Restrict access to sensitive areas based on business function and process requirements. 

Guidance: Each site is unique and should define its sensitive areas as it deems appropriate. The Registrar, however, retains the authority to direct an Operator or gaming-related supplier to adopt a certain form of access authorization for a certain area or equipment, as deemed necessary.

5.3    Not applicable to lottery sector.

5.4    Not applicable to lottery sector.

5.5    Not applicable to lottery sector.

5.6    There shall be site emergency procedures to protect the public from personal harm and limit the damage to or loss of gaming-related assets.

Requirements – At a minimum:

  1. Employees or persons retained by the Operator shall be competent in implementing site emergency procedures. 
  2. Emergencies shall be reported in accordance with the established notification matrix. 

5.7    Security and surveillance shall be in place to protect gaming-related assets.

Lottery-Specific Requirements – At a minimum:

  1. Surveillance plans must include activities that address camera coverage and control systems. 
  2. Any interruption of monitoring activities shall be immediately reported in accordance with the established notification matrix.
  3. Continuous independent monitoring must be provided as specified by the Registrar. 
  4. video/digital recordings shall be made and retained for a minimum period as specified by the Registrar.
  5. Destruction of sensitive inventories, whether performed on the premises or at another site, shall be supervised and independently verified. 

5.8    There shall be timely and accurate maintenance of gaming-related financial transactions, accounting information and data. 

5.9    Not applicable to lottery sector.

5.10   There shall be a mechanism in place to track instant game tickets.

Guidance: The intent of this Standard is to ensure the tracking of instant game tickets from the point of printing to the point of activation, and when tickets are validated or returned to the OLG.

5.11   Sellers shall ensure that access to gaming supplies and sensitive inventories is appropriately controlled.

5.12   The Seller shall immediately take action to prevent, whether by remote disablement or other means, suspected tampering or similar misuse of a self-serve terminal.

6. Minimizing Unlawful Activity Related to Gaming

6.1    Mechanisms shall be in place to reasonably identify and prevent unlawful activities related to lottery schemes.

Lottery-Specific Requirements – At a minimum, the Operator shall:

  1. Conduct periodic risk assessments to determine the potential for unlawful activities, including money laundering, fraud, theft and cheat at play.
  2. Ensure that all relevant individuals involved in the handling of lottery tickets, including production, distribution, activation, selling, validation, or redemption, remain current in the detection of techniques or methods (as appropriate) that may be used for the commission of unlawful activities related to lottery schemes.
  3. Appropriately monitor transactions related  to,
    1. lottery tickets and analyze suspicious transactions for possible unlawful activity.
    2. sport and event betting to detect individuals attempting to circumvent the betting limit thresholds established in Standard 4.3.1(17).

  4. Report suspicious behaviour, cheating at play and unlawful activities in accordance with the established notification matrix.

6.2    Not applicable to lottery sector.

6.3    The Operator shall have anti-money laundering policies and procedures in place.

Guidance: It is not intended for these mechanisms to include FINTRAC reporting, as the Proceeds of Crime (Money Laundering) and Terrorist Financing Act do not apply to lottery.

Appendix A – Regulatory Risks

Risk Theme Regulatory Risk
Entity Level
  • Lack of appreciation and understanding of critical elements of a risk based control environment
  • Lack of defined Board mandate and independent oversight of management
  • No mechanism for reporting wrong doing
  • Inadequately documented management policies and procedures to define and align accountability skills and competence
  • Lack of understanding about expected ethical behavior
  • Lack of transparency in decision making
    • Individual knowingly fails to comply
Responsible Gambling      
  • Inappropriate advertising practices targets minors
  • Advertising is false and misleadingly deceptive to attract the public
  • Advertising deemed to promote excessive play
  • Players allowed to play excessively
  • Responsible gaming controls not designed into environment and product
  • Players are unaware of risks to problem gambling and options to self-control

Prohibiting Access to Designated Groups

  • Individuals prohibited from games of chance have access
  • Selling product outside jurisdiction
Ensuring Gaming integrity and Player Awareness
  • Inability to regulate all components
  • Related parties winning at a higher relative percentage than the public
  • Players have insufficient information to make an informed choice
  • Game and system design lack integrity
  • Game procedures are not followed
  • Game and systems fail
  • Compromising betting markets through activities such as insider betting or game manipulation 

Public Safety and Protection of Assets
  • People are not safe
  • Assets and customer information are not safe-guarded
  • Unauthorized individuals have access to prohibited areas
Minimizing Unlawful Activity Related to Gaming
  • Gaming used as a vehicle for money laundering
  • Gaming used as a vehicle for fraud or theft
  • Internal theft is occurring
  • Cheat at play materializes within the gaming environment