Why doesn’t the AGCO tell Registrants how to meet the Standards?
The Standards are outcomes-based. A standard represents the Registrar’s expectations for a Registrant. Operators and suppliers have the flexibility to develop the best control activities for their business that is able to meet the stated outcome, with the understanding that different organizations will choose different approaches, and that best practices are often evolving.
There are several reasons for this focus on outcomes, including:
- In various sectors – particularly those that deeply integrate technology- prescriptive Standards can quickly become outdated and less effective in meeting regulatory objectives.
- More prescriptive Standards can limit the operational flexibility of individual businesses and whole sectors to respond to changing circumstances. As this approach focuses on the performance of a specifically prescribed activity, it may actually undermine achieving the outcome of reducing the underlying risk itself.
- Prescriptive Standards can result in a “one size fits all” approach that does not reflect an individual organization’s business, innovation, or operational realities.
- Focusing on outcomes enables Registrants to adapt and change control activities as needed for both regulatory and business purposes.
- Because they allow Registrants to design control activities based on their circumstances, outcomes-focused approaches reduce regulatory burden and red tape, allowing Operators to realize efficiencies without jeopardizing operational and compliance effectiveness.
How will I know if my control activities are sufficient to meet the Standards?
All Operators will be required to submit an independently audited document setting out the processes and controls that they have in place to meet all of the outcomes and requirements in the Registrar’s Standards for igaming. This document is commonly referred to as a Control Activity Matrix (CAM). In order to meet the independent audit requirement, Operators may use their internal audit function, where available, or external auditors.
Within six months of commencing operations in the regulated Ontario market, all Operators will be required to provide a demonstration of the controls they have established to address the outcomes and requirements in the Registrar’s Standards for igaming. This competency demonstration will emphasize key compliance priority areas that will be defined for each Operator in advance. The AGCO will provide Operators with enough advance notice for them to adequately prepare before this demonstration.
The information gathered through the CAM and the competency demonstration will feed into ongoing compliance monitoring and management activities. Proactive engagement and transparent dialogue between the AGCO and registrants will be at the core of the compliance program.
Who do these Standards apply to?
Standards and Requirements apply to OLG with respect to its internet gaming site, to iGaming Ontario, and to all registered internet gaming Operators in Ontario. Additionally, certain Standards and Requirements also apply to registered gaming-related suppliers.
Operators are expected to ensure that the Standards related to the operation of their player platform are met, regardless of the entity that is carrying out the related activities. Depending on the circumstance, the Registrar may hold an Operator, a registered supplier, or both, accountable for meeting a particular Standard.
The Registrar may direct any registered supplier to comply with any additional Standards and Requirements, as considered necessary to enhance and preserve the integrity of and public confidence in gaming in Ontario.
If I am a registered gaming-related supplier, how will I know if I need to comply with a certain Standard?
We have provided general guidance within the Standards to indicate which ones would apply to gaming-related suppliers (GRS). Where a Standard is related to the activities undertaken by a Registrant, it would likely be applicable. For example, if you provide games to gaming operators, we would expect that Standards relating to game integrity are met.
What are the Registrar’s reporting expectations?
In multiple places, the Standards make reference to a Notification Matrix. The Notification Matrix is a document that outlines the minimum notification obligations for Registrants to the Registrar, including the timeframe by which the notification must be made and the mode of contact with the AGCO for each type of notification. Some examples of required notifications include instances of non-compliance, or if there is a substantial change to the control environment. You can expect more details about the notification matrix in late Summer 2021.
What might happen if a Registrant doesn’t meet a Standard?
The AGCO is focused on Registrants achieving and maintaining compliance, rather than focusing exclusively on enforcement as a goal. In appropriate circumstances, we will work with registrants to achieve compliance, rather than immediately pursuing a reactive, punitive approach. We know that despite all best efforts, there may be incidences of non-compliance for a variety of reasons. In the case of such incidences, the AGCO expects that:
- Non-compliance is proactively identified by the Registrant.
- Incidents are reported to the AGCO in a transparent manner as per our Notification Matrix
- The root causes of non-compliance are accurately determined and addressed in a timely manner that minimizes the likelihood of recurrence.
Where regulatory expectations are not met, the AGCO may use a full spectrum of compliance responses, including: education, warnings, financial penalties, suspensions, and, in the most serious cases, revocations. With the goal of re-establishing and maintaining Registrant compliance, the AGCO will generally deploy a progressive approach to sanctions. In cases where severe incidents occur, the AGCO will act proportionately to ensure the public is protected.
What can I expect next?
Now that the standards have been finalized, what can I do to start preparing to enter the market?
One of the first steps to entering the market will be applying for a registration from the AGCO. At the time of application, Operators/Suppliers will be required to confirm that they will comply with the Registrar’s Standards for igaming, including that goods, services, and technology deployed by or provided by the applicant will comply with the Registrar’s Standards for igaming. Operators will also be required to submit an analysis identifying gaps that you will need to address related to platforms, products, processes and/or their control environment in order to comply with the Registrar’s Standards for igaming, including the steps that will be taken to address those gaps. Operators/Suppliers can start getting ready for the application process now by familiarizing themselves with the Standards and Operators can start preparing a gap analysis so that they are ready to submit it at the time of application. Note that a gap analysis may also be required for Gaming Related Suppliers depending on the nature of goods, services and technology provided (eg. player platform).
More information about commercial agreements
More information about the commercial agreements with iGaming Ontario will be coming over the course of Summer 2021. There will be terms in a number of areas, including anti-money laundering and player registration requirements, customer service and dispute resolution, type of games permitted, responsible gambling, financial reconciliation and data management.
More information about the regulatory approach & sports betting Standards
Over the course of Summer 2021, there will be more information provided on the registration process to help prospective registrants understand what they will need to do to be prepared and facilitate a timely registration. We will also be providing more information about the compliance approach that will be in place post-launch.
In June 2021, the Senate of Canada passed Bill C-218, also known as the Safe and Regulated Sports Betting Act, to amend the Criminal Code of Canada to legalize single-event sports betting. As a result, the AGCO is working to develop Standards meant specifically to mitigate the risks that are particular to single-event sports betting. More information, including a stakeholder engagement process, will follow over the course of Summer 2021.
Many Standards require that a “mechanism be in place” to achieve a specific outcome. What does this mean?
When a Standard requires that a mechanism be in place, it means that the registrant must have a clear, documented process or system that has been effectively implemented to achieve the desired outcome. The registrant has the flexibility to determine what type of mechanism is best for the situation at hand – whether it is a technical control, a manual process, or a mix of activities.
For example, Standard 1.15 states “A mechanism shall be in place to allow players to contact the Operator in a timely fashion with issues and complaints relating to their player account, funds management, game play or any matter related to compliance with the Standards and Requirements.” The mechanism itself is up to the Operator, as long as the desired outcome—the ability of players to contact the Operator in a timely fashion—is achieved.
How can I be expected to be responsible for the actions of third-party suppliers?
Operators are responsible for ensuring that their gaming sites are operated in accordance with the Standards and any other applicable laws and regulations, and are expected to have some oversight over the activities of their third-party suppliers. Registrants are not permitted to sub-contract their way out of regulatory and legal obligations, and we expect that there are controls in place to ensure that third parties meet any applicable Standards.
How do we identify if an account should be dormant?
Dormant accounts are defined as “a player account which has been temporarily frozen due to inactivity and made unavailable for player log on and use”. It is up to each operator to define an appropriate time period for labelling an account as dormant.
How will the Registrar evaluate the Standards, including in relation to terminology that is subjective in nature? (e.g., reputable supplier, appealing primarily to minors, periodic review)
The Registrar administers and assesses compliance with the Standards in an objective way. Nevertheless, a key element of the outcomes-based approach is that registrants have the ability to evaluate and manage the risks that are particular to their business, within the regulatory framework. If deficiencies in the control environment are noted, the AGCO will work with or respond to a registrant to achieve compliance.
When will I need to start participating in a centralized self-exclusion program? How much notice will be given?
The exact timing for implementing the centralized self-exclusion program has not yet been determined; however, it is anticipated that the Registrar will provide adequate notice so that Operators, OLG, and iGaming Ontario have time to prepare.