The Registrar is appointed under the Alcohol, Cannabis and Gaming Regulation and Public Protection Act, 1996 and has powers and duties under the Gaming Control Act, 1992 and its Regulations. Under section 3.8 of the Gaming Control Act, 1992, the Registrar is authorized to establish certain standards and requirements for the conduct, management and operation of Gaming Sites, lottery schemes or businesses related to a Gaming Site or a lottery scheme or for goods or services related to their conduct, management or operation. The Registrar has established these Electronic Raffle Systems Minimum Technical Standards (Minimum Technical Standards) as the minimum standards Electronic Raffle System (ERS) must meet for approval by the Registrar. These Minimum Technical Standards are based on the principles of technical integrity, public interest and security of the ERS, including their accounting capability.
The development and subsequent revisions of these Minimum Technical Standards are based on a vulnerability-risk analysis of Raffle solutions, and review of other jurisdictions’ technical standards. They reflect typical ERS architecture, Raffle Game design and processes. The intent of this document is to provide minimum technical standards ERS must meet, as applicable.
These revised minimum technical standards are effective on March 1, 2021.
From time to time, as necessary, modifications will be made to these minimum technical standards.
These Minimum Technical Standards should be read in conjunction with Electronic Raffle Operational Terms and Conditions.
The Alcohol and Gaming Commission of Ontario (AGCO) is a modern regulator, committed to ensuring that gaming is carried out in the Province of Ontario in keeping with the principles of technical integrity, security, accounting capability, and the public interest.
Recognizing that the gaming industry continues to evolve and that the introduction of new technologies provides opportunities for regulated entities in Ontario, the AGCO affirms its desire to address new technologies affecting the gaming industry in an efficient and open manner.
Therefore, where a Supplier or Charity has questions about the application of these standards to new technologies that seem to fall entirely or in part outside of the standards, the AGCO is open to engaging with Suppliers or Charities to understand the nature of those technologies and how and whether those technologies can be addressed by existing standards, either through their application or through the principles of technical integrity, security, accounting capability, and the public interest.
Suppliers must provide necessary information, training, and tools pertaining to the Electronic Raffle Systems that approval is being requested for to ensure the AGCO will be able to assess, test, and issue approval decisions without delay.
All requests for approval of Electronic Raffle Systems must adhere to the submission requirements, “AGCO Electronic Raffle Systems Submission Requirements”, including being accompanied with fully and accurately completed AGCO submission form(s). This may be most efficiently achieved by Suppliers providing their submissions electronically to the AGCO in a secure fashion, e.g. via sFTP.
The objective of the requirements in this section is to ensure functions typically performed at the POS operate in a manner that maintains technical integrity and security of Raffles.
1.1.1 The integrity and security of all Ticket transactions must be maintained during communication between POS and Backend System, and Raffle Sales Unit (RSU) and printer..
1.1.2 The RSU printer must accurately communicate all error conditions back to RSU.
1.1.3 Significant Events must be communicated from POS to the Backend System in real time or as soon as it becomes technically possible, e.g. when communication is reestablished.
1.1.4 Interruptions in communications must not negatively impact Raffle integrity or security, e.g. any Critical Game Data related to Ticket transactions, and security events must be preserved.
1.1.5 Impacted POS functions must be disabled in case of the loss of communication with the Backend System.
1.2.1 Complete and accurate Raffle Ticket information as set out in 2.3.1 must be clearly presented on all issued Tickets to be valid.
1.2.2 An error condition must be displayed at the POS and logged, if a Ticket is not properly issued.
1.2.3 In case of POS shutdown by the Backend System during Ticket issuance, a valid Ticket must be issued or Cancelled/Voided, and the POS must display an explanatory message if a Ticket has been Cancelled/Voided.
1.2.4 The printer must be automatically disabled when a condition prevents proper operation of the printer.
1.3.1 The POS raffle applications must display information to uniquely identify themselves for verification purposes. Examples include their name, version, and cryptographic hash value.
1.3.2 The POS applications must provide sufficient information and messaging to instruct sellers and players, respectively how to complete the transactions of Raffle Tickets successfully.
1.3.3 It must not be possible to alter Critical Game Data or Critical Software at any time from the POS interface.
Guidance: The intent is for the Charity to conduct and manage Raffles without having any influence from POS interface.
1.3.4 POS application must be secured to prevent unauthorized access to Critical Software and Critical Game Data to ensure integrity and security of Raffle Game operations.
1.3.5 The Critical Game Data on mobile RSU devices must be protected from alterations by non-Raffle applications or corruption.
1.4.1 Raffle displays must accurately show players the Raffle Prize, and related event information, such as winning Raffle Number after a Draw.
1.4.2 Raffle Prize displays must be synchronized with the Backend System.
The objective of the requirements in this section is to ensure technical integrity of Raffles is embedded in Game design.
2.1.1 Game designs and features must be clear and must not mislead the player.
2.1.2 The electronic Raffle Game must be designed and played in a manner that is as consistent as technically possible with the associated non-electronic, paper Raffles.
Guidance: This standard is intended to avoid discrepancies in Game play causing confusion for players, while still maintaining Game fairness. For example, “must go” Draw of Catch the Ace must produce a winner in one or more re-draws until Ace of Spades is revealed.
2.2.1 The ERS must provide a mechanism for Charities to communicate the rules of play to players, such as: ticket messaging, digital signage and URL links.
Note: Raffle rules of play are considered through the licencing of Raffle events.
2.2.2 Players must be provided with clear, meaningful and accurate information to enable them to make informed choices (e.g. price discounts for purchasing multiple Raffle Numbers in one Ticket, or the 50-50 Raffle Prize to be 50% of sales and as estimated Raffle Prize).
2.2.3 Non-gaming-related information displayed on Raffle displays, such as advertisements or entertainment, must be clearly distinguishable from Game-related information and must not mislead Players nor negatively impact Raffles.
2.3.1 Raffle Tickets must display the following information, at a minimum:
2.3.2 ERS must not generate duplicate Raffle Numbers or Raffle Tickets for the same Draw. If reprint is supported, such a Ticket must be clearly marked as “reprint”.
2.3.3 Each Raffle Ticket must be uniquely identifiable, e.g. if Ticket Validation Number is implemented, it must be unique (no duplicates).
2.4.1 The design of a Progressive Raffle and the method used to award an accumulating Prize must not disadvantage any player participating in the Game..
2.4.2 ERS must provide accurate and clear Progressive Prize amount that includes current contributions and any amounts transferred from previous Draw(s).
2.4.3 The following information to support Progressive Raffle audits must be captured in ERS, at a minimum:
2.5.1 ERS solution must have a mechanism to lockup configurations of Raffle features and Critical Game Options to prevent changes from being made that could impact the integrity of a live Raffle event.
2.5.2 ERS solution must have a mechanism to disable or remove configurable Raffle features and Critical Game Options such that Raffle events can be prevented from being deployed with features and options that are not permitted.
2.5.3 Configuration lockups and disabling or removal of Raffle features and Critical Game Options from 2.5.1 and 2.5.2 respectively may only be possible through Restricted Technical Procedures or operational controls.
Guidance: The expectations are the ERS solution as provided by suppliers will technically mitigate all Raffle integrity risks pertaining to Configurable Raffle Features and Critical Game Options. Any exceptions where this mitigation is handled through operational controls will be assessed on a case-by-case basis.
2.5.4 Any and all settings or changes to Raffle configurations in reference to Configurable Raffle Features and Critical Game Options from 2.5.1 and 2.5.2 must be logged sufficiently for audit purposes, including: user, date/time and details of the change.
The objective of the requirements in this section is to ensure technical integrity and security of raffle processes within the ERS.
3.1.1 The ERS must issue valid Ticket(s) once the purchase has been accepted and successfully completed at the ERS.
3.1.2 The ERS must support cancellation of Ticket sale and voiding of sold Tickets prior to the close of the Raffle sales.
3.1.3 Cancelled and Voided Tickets must be logged, fully auditable, and any completed payments for these Tickets must be refunded to the player.
3.1.4 Voiding Raffle Tickets may only be performed by authorized personnel.
3.1.5 Raffle Numbers and corresponding Ticket Validation Numbers from Voided Tickets must not be possible to reissue or sell again for the same Raffle Draw.
3.1.6 When e-payment is integrated into the ERS, the payment processor and ERS must be compliant with current Payment Card Industry’s Data Security Standards (PCI DSS).
3.2.1 The ERS must employ a mechanism to ensure Ticket sales are taking place within Ontario.
3.2.2 The ERS solution must ensure that tickets are only sold to players who are eligible to play before a sale takes place.
Note: An individual under 18 years of age must not be permitted to play. When the Charity is offering liquor items as Prize, the minimum age is 19.
3.2.3 Sufficient player information to uniquely identify a player for the purpose of Raffle sales, distribution and audit of Prizes must be collected and securely stored. The following information must be collected, at a minimum:
Method of identification for subsequent log on, if player account is implemented
3.2.4 The ERS must require that players acknowledge the acceptance of Raffle rules of play before sales take place.
3.2.5 ERS supporting Online sales must provide full audit trail of player information and Tickets, and it must meet all applicable security and personal information storage standards in Ontario.
3.3.1 If player account functionality is available, the ERS must support secure player account creation.
3.3.2 Only eligible individuals are permitted to create a player account and log on to their account.
3.3.3 All player accounts must be uniquely identifiable.
3.4.1 RSU may sell Tickets when not communicating with the Backend System, provided all Ticket transactions are securely stored on the RSU. Upon the re-establishment of communication, the sale must be transmitted to the Backend System and be available for Draw.
3.4.2 The RSU functions that handle Raffle Tickets must perform as intended and without compromising the integrity of Raffles.
3.4.3 Improper activation of various RSU functions must not compromise the integrity of Raffle. For example, button inputs must function as designed.
3.5.1 Raffle Numbers Draw may only be conducted after:
3.5.2 The Raffle Draw must be conducted through a random selection process.
3.5.3 The Draw must include all sold valid Raffle Numbers, and exclude all invalid Raffle Numbers. The Raffle Numbers from unsold Tickets, Voided Tickets and Cancelled Tickets (whose Raffle Numbers that are not returned to the sale pool) are invalid, and must not be included in the draw.
3.5.4 A winning Raffle Number must be drawn for each advertised Prize.
3.5.5 Backend System must accurately and securely log information related to 3.5.1 and 3.5.4 for each Raffle Draw.
3.6.1 The ERS must provide the ability to independently verify the results of each Raffle Draw, if the Draw outcome and recording of winning Tickets is not a fully automated process. At a minimum, the following must be possible to reconcile independently for each Draw prior to distributing the Prizes:
The objective of the requirements in this section is to ensure technical integrity is embedded in ERS design, audit, security, monitoring and accounting capability that enable Charities to conduct and manage Raffles while maintaining the public interest.
4.1.1 All ERS components critical to the outcome of Raffles must reside in Ontario.
4.1.2 Mechanisms must be in place to ensure the reliability, integrity and availability of the ERS.
4.1.3 The ERS components must have synchronized time when providing the following, at a minimum:
4.1.4 The ERS must validate inputs before being processed to prevent risks to Raffle integrity or security.
Guidance: This requirement is intended to ensure that inappropriate inputs do not compromise integrity or security of Raffles. For example, player inputs at Online POS must be validated to prevent malicious data injection, or Charity Raffle administration fields must be validated to be meaningful, e.g. numbers not accepted for letters.
4.1.5 ERS must be designed and tested to operate with integrity under anticipated load (total volume of sales and picks of Raffle Ticket transactions per minute) and communication bottlenecks in production environment.
4.1.6 The ERS must be designed for immunity against security attacks, such as security in depth (multiple layers of security, so that if one layer is bypassed, the attack still has to get through the next layer, and so on.
4.1.7 Sensitive data must be secured and protected from unauthorized access or use at all times using industry good practices.
4.1.8 ERS components must not have access to nor be accessible from the internet beyond what is required by the ERS to support Raffle solution.
4.2.1 The ERS must be recoverable so that there is no impact on the integrity of the Raffle or the ability to audit the Raffle.
4.3.1 The ERS must restrict users’ access based on business needs to the following, at a minimum:
4.3.2 Any changes to user access privileges must be logged, along with the user performing the change and time of the change. The following changes to user access privileges must be logged, at a minimum:
4.3.3 A secure authenticator that meets industry good practices, e.g. strong password must be used to identify a user and his or her account to ensure that only authorized individuals are permitted to access their ERS account.
4.3.4 The ERS must automatically lock out accounts should identification and authorization requirements not be met after a defined number of attempts.
4.3.5 Logical access to the ERS must be fully auditable and all related events must be logged.
4.3.6 The ERS must prevent unauthorized access to sensitive database files/tables, including stored procedures and passwords, and prevent their unauthorized alterations.
4.4.1 Only authorized personnel, Raffle Administrator/Manager may be permitted to configure the Raffle Game and Ticket information.
4.4.2 The ERS must not allow Raffle configuration changes that would adversely affect the security or integrity of the Raffle or any gaming-related information, once the sale of Raffle Tickets has commenced.
4.4.3 ERS, data, activity logs and all other related components must be protected from threats, vulnerabilities, attacks or breaches to ensure the integrity and security of the ERS, as follows, at a minimum:
4.4.4 Functions performed by Raffle Administrator/Manager at the Backend System must be technically restricted and not be possible to perform from POS.
4.4.5 The Backend System must have the ability to monitor and manage all RSUs and functions performed by Raffle sellers at the RSU, as follows, at a minimum:
4.5.1 Security activities must be logged in an auditable manner and monitored, as follows, at a minimum:
4.6.1 Appropriate, accurate and complete records of Ticket transactions and Raffle event information must be kept for the purposes of audits and other regulatory purposes.
4.6.2 The Backend Systems must record and store complete data from Tickets and financial transactions (e.g. cash floats & collections), Draw accounting data for all valid and Voided Tickets and player data, including at a minimum:
4.6.3 Adjustments and corrections to Critical Game Data are permitted by authorized individuals, provided the following information is recorded in unalterable logs:
4.7.1 The ERS must provide at a minimum the following information for audit trail in on-demand generated reports with settable time periods and specific activities for each Raffle event:
Significant Events Log - At minimum the last 100 events with the appropriate time stamp.
The objective of this section is to ensure the outcome of Raffles is random.
The following requirements are applicable to software Random Number Generators and their implementation.
5.1.1 The outputs provided by software RNG must pass applicable statistical tests of Randomness to demonstrate:
5.1.2 The range of random numbers used for statistical tests must correspond to the complete set of possible Raffle Game outcomes, as provided to the player, and to include both high and low end of Raffle sales. The 99% confidence interval is applicable for Game specific statistical tests, including but not limited to frequency test, runs test and serial correlation test.
5.1.3 Valid RNG output must be used for Raffle Game outcome without alteration or secondary decision by the ERS.
Guidance: The RNG output includes all necessary scaling performed such that the output is usable by the Raffle Game.
5.1.4 Where the Draw process of winning Raffle Numbers is interrupted, the original selection must be preserved until full ERS recovery.
5.1.5 The ERS must use secure communication protocols to protect RNG and random selection process.
5.1.6 Pools of Raffle Numbers must be stored securely.
5.2.1 Physical randomizers that use the laws of physics to determine winning Raffle Ticket, must ensure Raffle Game integrity and Randomness of Raffle Draws (e.g. shuffling of Tickets).
Note: The Randomness and implementation of physical randomizers will be assessed on a case-by-case basis.
The objective of the requirements in this section is to ensure technical integrity of the Critical Software and Critical Game Data during Raffle operations and that only approved software is installed.
6.1.1 A mechanism that meets industry good practices must be built into the ERS to verify the integrity of the Critical Software in production, in order to ensure the approved software is being used (no unauthorized changes) and Raffles operates as intended.
At a minimum, ERS must be successfully authenticated:
6.1.2 If the self-authentication fails, the software that fails authentication must enter an error condition, safely stop operation and notify the Charity.
6.1.3 The results of each authentication must be recorded in an unalterable report. This report must include a pass/fail condition with details on which software did not pass the authentication.
6.2.1 Backend System must initiate independent verification on any client device or RSU Critical Software upon initial establishment of a connection with the system. When a threshold of unsuccessful verification attempts is reached, such client device or RSU must be disabled.
6.3.1 The ERS must accurately maintain the integrity of Critical Game Data to ensure the Raffle Game operates as expected and is auditable.
6.3.2 The ERS must employ methods to detect corruption and unauthorized alteration to its Critical Game Data to prevent integrity issues from occurring.
6.3.3 Detection of corrupted or unauthorized alteration of Critical Game Data that cannot be recovered must cause Raffle sales to be halted immediately and must cause the POS enter into an error condition, and not resume Raffle sales until the condition has been addressed.
6.3.4 The integrity of RSU Critical Game Data must be maintained by methodology that enables failure detection, backup and recovery of Critical Game Data.
6.3.5 It must be possible to extract RSU Critical Game Data through Restricted Technical Procedures without contaminating the data in the original storage media.
The objective of this section is to link environmental and deployment requirements to ERS design.
71.1 Communication protocol among ERS components over network infrastructure must be secure and must maintain Raffle Game integrity.
71.2 Network components must have synchronized time to preserve logging and auditing capability.
71.3 All gaming related network traffic exposed to public network lines must be secured using an industry standard method proven to prevent any security threats.
7.1.4 Network architecture must be designed in a way to prevent that a large volume of communications causes an integrity issue.
7.2.1 Any remote access methods and associated procedures must limit access to authorized users and systems to perform specific tasks only through a secure link.
7.2.2 Remote access to ERS may only be granted to either the Charity or the Supplier from their respective secure business location by a method, such as VPN client with two-factor authentication, provided it is monitored and the following records were made, at a minimum:
7.3.1 Publicly exposed ERS (e.g. Web applications accessible through public networks) must be protected with adequate security measures to prevent any integrity or security issues.
7.3.2 New ERS that are publicly exposed must be assessed in accordance with industry good practices security frameworks by qualified individuals to ensure that security vulnerabilities are identified and assessed, and risks are confirmed to be negligible through security/penetration testing, as applicable.
7.3.3 Modifications to publicly exposed ERS may require assessment, as well, depending on the complexity and number of changes. These will be assessed on a case-by-case basis.
7.4.1 Suppliers or Charity must provide necessary information, training and tools pertaining to the Electronic Raffle Systems for which the approval is being requested to help facilitate AGCO assessment, testing, and issuing decisions in a timely manner.
Note: As per AGCO Info Bulletin No. 89 from November 30, 2018, Charities have the flexibility to develop and use their own ERS solution.
7.4.2 All requests for approval of Electronic Raffle Systems must adhere to the submission requirements, “AGCO Electronic Raffle Systems Submission Requirements”, including being accompanied with fully and accurately completed AGCO submission form(s).
Note: Submission materials may be most efficiently provided via a secure electronic mechanism, e.g. sFTP.
7.5.1 Suppliers and Charities must promptly notify the Registrar per Notification Matrix – Electronic Raffles of any integrity, security or accounting capability concerns with the approved Electronic Raffle Systems.