Chapter 6

Sports Wagering Accounts

 

Section 1.  Sports Wagering Account Requirements.

 

(a) A patron must have an established sports wagering account with the sports wagering operator or sports wagering vendor to participate in online sports wagering. An account shall only be established in the name of an individual eighteen (18) years of age or older and is non-transferable.

 

 (b) A sports wagering operator or sports wagering vendor must collect the following personal identifying information (PII) from the individual for each patron:

 

(i) The patron's full legal name;

 

(ii) The patron's date of birth;

 

(iii) The patron's principal residential address. A post office box is not acceptable;

(iv) The patron's Social Security number, or the last four (4) digits of the Social Security number, or an equivalent identification number for a noncitizen patron, such as a passport or taxpayer identification number; and

 

(v) Any other information collected from the patron used to verify his or her identity and to prove the patron is at least eighteen (18) years of age.

 

 (c) During the registration process, the patron shall:

  

(i) Be denied the ability to register for a sports wagering account if they submit a birth date which indicates that they are under the age of eighteen (18);

  

(ii) Be informed on the account application which information fields are "required," which are not, and what will be the consequences of not filling in the required fields;

  

(iii) Agree to the terms and conditions and privacy policies of the sports wagering operator or sports wagering vendor;

  

(iv) Acknowledge that they are prohibited from allowing any unauthorized person to access or use their sports wagering account;

  

(v) Consent to the monitoring and recording of the use of their sports wagering account by the sports wagering operator or sports wagering vendor and the Commission; and

 (vi) Affirm that the PII the patron is providing to open the sports wagering account is accurate.

 

(d) Unless otherwise noted on the account application, the address provided on the application to establish the account is deemed the address of record for mailing checks, statements of account, account withdrawals, notices, or other correspondence. It is the responsibility of the patron to notify the sports wagering operator or sports wagering vendor of any address change.

 

 (e) A sports wagering operator or sports wagering vendor must maintain an electronic patron file, which must, at a minimum, include the following for each patron, as applicable:

 

  (i) Unique patron ID and username (if different);

 

  (ii) The information indicated in subsection (b) to register a patron and create the account;

 

  (iii) Encrypted PII, including the government identification number (full or partial social security number, taxpayer identification number, passport number, or equivalent), authentication credential (password, PIN, etc.), and personal financial information (debit instrument numbers, credit card numbers, bank account numbers, etc.);

 

  (iv) The date and method of identity verification, including, where applicable, the document number of the government issued identification credential examined and its date of expiration, if applicable. If a government issued identification credential is not required for registration, the electronic record that details the process used to confirm the patron's identity must be recorded;

 

  (v) The date of patron agreement to the terms and conditions and privacy policies;

 

  (vi) Account details and current balance, including any incentive credits. All restricted wagering credits and unrestricted funds that have a possible expiration shall be maintained separately;

 

(vii) Previous sports wagering accounts, if any, and reason for de-activation;

 

(viii) The date and method from which the sports wagering account was registered;

(ix) The date and time a sports wagering account is accessed by any person, including IP Address; and

 

(x) The current status of the sports wagering account (e.g., active, dormant, closed, suspended, excluded, etc.).

 

(f) A sports wagering operator or sports wagering vendor shall allow the patron to update authentication credentials, registration information and the account used for financial transactions. A multi-factor authentication process shall be employed for these purposes.

 

Section 2.  Age and Identity Verification.

 

(a) Only an individual who is eighteen (18) years of age or older and not a prohibited person may create a sports wagering account, deposit funds, or participate in online sports wagering. The sports wagering operator or sports wagering vendor must deny the ability to create a sports wagering account, deposit funds, or participate in online sports wagering to any individual who is under eighteen (18) years of age or is a prohibited person. This section shall not be construed to prevent a restricted patron from creating a sports wagering account and depositing funds to such an account even if they are prohibited from placing certain wagers.

 

 (b) The sports wagering operator or sports wagering vendor shall employ electronic verification with respect to each patron's name, date of birth and Social Security number, or the last four (4) digits of the Social Security number, or an equivalent identification number for a noncitizen patron, such as a passport or taxpayer identification number, at the time of account establishment by a Commission-approved national independent reference company or another independent technology approved by the Commission which meets or exceeds the reliability, security, accuracy, privacy and timeliness provided by individual reference service companies.

 

(c) The sports wagering operator or sports wagering vendor shall refuse to establish an account if it is found that any of the information supplied is untrue or incomplete.

 

(d) A sports wagering operator or sports wagering vendor must use commercially available and demonstrable standards to confirm that an individual attempting to create a sports wagering account is not a prohibited person.

 

(e) A sports wagering operator or sports wagering vendor must periodically re-verify a patron's identification upon reasonable suspicion that the patron's identification has been compromised.

 

Section 3.  Terms and Conditions and Privacy Policies for Sports Wagering Accounts.

 

(a) All terms and conditions and privacy policies for sports wagering accounts must be included in the internal controls of the sports wagering operator or sports wagering vendor  and shall be readily accessible to the patron before and after registration and noticed when materially updated (i.e. beyond any grammatical or other minor changes).  

 

 (b) All terms and conditions for sports wagering accounts must address all aspects of the online sports wagering operation, including, but not limited to all of the following:

 

(i) A statement that only individuals over the age of eighteen (18) and located in the authorized geographic boundaries within the state of Wyoming can participate in online sports wagering;

 

(ii) Advice to the patron to keep their authentication credentials (e.g., password and username) secure;

 

(iii) All processes for dealing with lost authentication credentials, forced password changes, password strength and other related items as required by the Commission;

 

(iv) Full explanation of all rules applicable to dormant sports wagering accounts, including the conditions under which an account is declared dormant and what actions will be undertaken on the account once this declaration is made;

 

(v) Actions that will be taken on the patron's pending wagers placed prior to any exclusion or suspension, including the return of all wagers, or settling all wagers, as appropriate;

 

(vi) Information about timeframes and limits regarding deposits to and/or withdrawals from the sports wagering account, including a clear and concise explanation of all fees, if applicable; and

 

(vii) Statements indicating that the sports wagering operator or sports wagering vendor has the right to:

 

(A) Refuse to establish a sports wagering account for what it deems good and sufficient reason;

 

(B) Refuse deposits to and/or withdrawals from sports wagering accounts for what it deems good and sufficient reason; and

 

(C) Unless there is a pending investigation or patron dispute, suspend or close any sports wagering account at any time pursuant to the terms and conditions between the sports wagering operator and the patron.

 

(c) All privacy policies for sports wagering accounts must address all aspects of the personal identifying information (PII) protection, including, but not limited to all of the following:

(i) The personal identifying information (PII) required to be collected;

 

(ii) The purpose and legal basis for PII collection;

 

(iii) The period in which the PII is stored, or, if no period can be possibly set, the criteria used to set this;

 

(iv) The conditions under which PII may be disclosed;

 

(v) An affirmation that measures are in place to prevent the unauthorized or unnecessary disclosure of the PII; and

 

(vi) Any other privacy requirements specified by the Commission.

 

Section 4.  Patron Protection Information. A sports wagering operator or sports wagering vendor must provide a Commission-approved patron protection information page that must be readily accessible to each patron. The patron protection page must contain, at a minimum, all of the following:

 

 (a) Information about potential risks associated with excessive wagering, and a direct link to the National Council on Problem Gambling as well as links to local assistance; 

 

 (b) Notification that underage gambling is a criminal offense and that anyone who facilitates an individual under the age of eighteen (18) to place an online sports wager has committed a criminal offense and must be prohibited from online sports wagering;

 

 (c) A list of the available patron protection measures that can be invoked by the patron, such as self-imposed limits, and information on how to invoke those measures;

 

 (d) Mechanisms in place for patrons to detect unauthorized use of their sports wagering account, such as the patron reviewing financial statements against known deposits;

 

 (e) Method for filing a complaint with the sports wagering operator or sports wagering vendor; and

 

 (f) Method for filing with the Commission an unresolved complaint after all reasonable means to resolve the complaint with the sports wagering operator or sports wagering vendor have been exhausted utilizing forms and in the manner prescribed by the Commission.

 

Section 5.  Patron Access.

 

(a) The sports wagering system shall utilize authentication credentials, such as a username (or similar) and a password or a secure alternative means to assure that only the patron has access to the sports wagering account. The sports wagering system shall also utilize multi-factor authentication or a similar authentication method for each new device. Allowable authentication credentials are subject to the discretion of the Commission as necessary. The requirement does not prohibit the option for more than one method of authentication being available for a patron to access their account.  After a successful login with multi-factor authentication or a similar authentication method for a specific device, the patron is not required to utilize multi-factor authentication or a similar authentication method to access their account from that device for a period of fourteen (14) days.

 

 (b) If the system does not recognize the authentication credentials when entered, an explanatory message shall be displayed to the patron which prompts the patron to try again. The error message shall be the same regardless of which authentication credential is incorrect.

 

 (c) Where a patron has forgotten their authentication credentials, a multi-factor authentication process shall be employed for the retrieval or reset of their forgotten authentication credentials.

 

 (d) Current account balance information, including any restricted wagering credits and unrestricted funds, and transaction options shall be available to the patron once authenticated. All restricted wagering credits and unrestricted funds that have a possible expiration shall be indicated separately.

 

 (e) The system shall support a mechanism that allows for an account to be locked in the event that suspicious activity is detected, such as three consecutive failed access attempts in a 30-minute period. A multi-factor authentication process shall be employed for the account to be unlocked.

 

Section 6.  Financial Transactions. The sports wagering system shall provide confirmation/denial of every financial transaction initiated, including:

 

(a) The type of transaction (deposit/withdrawal);

 

(b) The transaction value; and

 

(c) For denied transactions, a descriptive message as to why the transaction did not complete as initiated.

 

Section 7.  Deposits to a Sports Wagering Account.

 

(a) A patron's sports wagering account may be funded using approved methods which shall produce a sufficient audit trail for verification of the source of the wagers.

 

(b) Approved methods for funding sports wagering accounts include:

 

(i) Travelers checks;

 

(ii) Foreign currency and coin;

 

(iii) Certified checks, cashier's checks and money orders;

 

(iv) Personal checks and drafts;

 

(v) Digital, crypto and virtual currencies;

 

(vi) Online and mobile payment systems that support electronic fund transfers (EFTs);

 

(vii) Credit cards and debit cards;

 

(viii) Prepaid access instruments;

 

(ix) Bonus or promotional credit;

 

(x) Winnings;

 

(xi) Adjustments made by the sports wagering operator or sports wagering vendor with documented notification to the patron; and

 

(xii) Any other means approved by the Commission including those which are initiated with cash.

 

 (c) The sports wagering account shall be credited for any deposit in accordance with the internal controls as submitted by the sports wagering operator or sports wagering vendor and approved by the Commission.

 

 (d) For credit cards or debit cards and EFTs, the patron may be liable for any charges imposed by the transmitting or receiving sports wagering operator or sports wagering vendor and the charges may be deducted from the patron's account.

 

Section 8.  Failed EFT Transactions. Where financial transactions are conducted through EFT, the sports wagering operator shall have security measures and controls to prevent EFT fraud. A failed EFT attempt is not considered fraudulent if the patron has successfully performed an EFT on a previous occasion with no outstanding chargebacks. Otherwise, the sports wagering operator or sports wagering vendor shall do all of the following:

 

 (a) Temporarily block the patron's sports wagering account for investigation of fraud after 5 consecutive failed EFT attempts within a 10-minute period. If there is no evidence of fraud, the block may be vacated; and

 

(b) Suspend the patron's sports wagering account after five (5) additional consecutive failed EFT attempts within a 10-minute period.

 

Section 9.  Withdrawals from a Sports Wagering Account.

 

(a) A patron must be allowed to withdraw the funds maintained in his or her sports wagering account, whether the account is open or closed, except as otherwise provided in these rules, or any other applicable state or federal laws.

 

 (b) A sports wagering system must employ a mechanism that can detect and prevent any withdrawal activity initiated by a patron that would result in a negative balance of the sports wagering account.

 

 (c) A sports wagering operator or sports wagering vendor shall not allow a sports wagering account to be overdrawn unless caused by payment processing issues outside the control of the sports wagering operator.

 

 (d) A sports wagering operator or sports wagering vendor must honor the patron's request to withdraw funds within five (5) business days after the request, unless the conditions set forth in subsection (e) are met.

  

(e) The sports wagering operator or sports wagering vendor may decline to honor a patron's request to withdraw funds only if the sports wagering operator or sports wagering vendor believes in good faith that the patron engaged in either fraudulent conduct or other conduct that would put the sports wagering operator or sports wagering vendor in violation of the statutes and these rules. In such cases, the sports wagering operator or sports wagering vendor must do all of the following:

 

(i) Provide notice to the patron of the nature of the investigation of the sports wagering account; and

 

(ii) Conduct its investigation in a reasonable and expedient fashion, providing the patron additional written notice of the status of the investigation every tenth (10th) business day starting from the day the original notice was provided to the patron.

   

(f) For purposes of this rule, a request for withdrawal is considered honored if it is processed by the sports wagering operator or sports wagering vendor notwithstanding a delay by a payment processor, credit card issuer, or the custodian of a financial account.

 

Section 10.  Sports Wagering Account Review Requirements. All adjustments to sports wagering accounts for amounts of five hundred dollars ($500.00) or less must be periodically reviewed by supervisory personnel as set forth in the sports wagering operator's or sports wagering vendor's internal controls. All other adjustments must be authorized by supervisory personnel before being entered.

 

Section 11.  Sports Wagering Account Information. Upon request of the patron, the sports wagering operator or sports wagering vendor shall provide a statement detailing account activity for the past year. Unless the sports wagering operator or sports wagering vendor receives written notice disputing the statement within fourteen (14) calendar days of the date the statement is forwarded, it shall be deemed to be correct.

 

Section 12.  Responsible Gaming Limits.

 

(a) A sports wagering operator or sports wagering vendor shall allow the account holder to set the following responsible gaming limits set forth below. Any decrease to these limits shall be effective immediately or at the point in time (e.g., next login, next day) that was clearly indicated to the player. Any increase to these limits shall become effective only after the time period of the previous limit (e.g., day, week, month, etc.) has expired and the player reaffirms the requested increase.

 

 (b) A deposit limit, which shall be offered on a daily, weekly and monthly basis and shall specify the maximum amount of money a patron may deposit into his or her sports wagering account during a particular period of time.

 

(c) A wager limit, which shall be offered on a daily, weekly and monthly basis and shall specify the maximum amount of patron funds that may be put at risk during a particular period of time.

 

Section 13.  Suspension and Restoration of Sports Wagering Accounts.

 

(a) A sports wagering system must employ a mechanism that places a sports wagering account in a suspended mode.

 

 (b) The suspended mode shall be activated under the following conditions:

 

(i) When requested by the patron for a specified period of time, which must not be less than seventy-two (72) hours;

 

(ii) When required by the Commission;

 

(iii) Upon a determination that a patron is a prohibited person; or

 

(iv) When initiated by a sports wagering operator or sports wagering vendor that has evidence that indicates any of the following:

 

   (A) Illegal activity;

   

(B) A negative sports wagering account balance; or

   

(C) A violation of the sports wagering account terms and conditions has taken place on a patron's sports wagering account.

 (c) When a sports wagering account is in a suspended mode, the sports wagering system must do all of the following:

  

(i) Prevent the patron from making online sports wagers;

  

(ii) Prevent the patron from depositing funds unless the account is suspended due to having a negative sports wagering account balance but only to the extent the sports wagering account balance is brought back to zero dollars;

  

(iii) Prevent the patron from withdrawing funds from his or her sports wagering account, provided that the sports wagering operator or sports wagering vendor acknowledges that the funds have cleared, and that the reason(s) for exclusion would not prohibit a withdraw;

  

(iv) Prevent the patron from making changes to his or her sports wagering account;

 

(v) Prevent the removal of the sports wagering account from the sports wagering system; and

 

(vi) Prominently display to the patron that the sports wagering account is in a suspended mode, the restrictions placed on the sports wagering account, and any further course of action needed to remove the suspended mode.

 

 (d) A suspended account may be restored for any of the following reasons:

  

(i) Upon expiration of the time period established by the patron;

 

  (ii) If authorized by the Commission;

 

  (iii) When the patron is no longer a prohibited person; or

 

  (iv) When the sports wagering operator or sports wagering vendor has lifted the suspended status.

 

 (e) Each sports wagering operator or sports wagering vendor shall, on a monthly basis, provide the Commission with a list of suspended accounts, including the reasons why the account is in suspended mode.

 

Section 14.  Sports Wagering Account Closure. A sports wagering system must provide a conspicuous and readily accessible method for a patron to close his or her sports wagering account through the account management or similar page or through the sports wagering system customer support team. Any balance remaining in a patron's sports wagering account closed by a patron must be refunded pursuant to the sports wagering operator's or sports wagering vendor's internal controls.

 

Section 15.  Sports Wagering Dormant Accounts. The sports wagering operator or sports wagering vendor may suspend or close an account. Any account with no activity for at least three (3) years may be closed. When an account is closed the sports wagering operator or sports wagering vendor shall issue any funds, less processing fees, within five (5) business days to the patron.

 

Section 16.  Proceeds from a Deceased Patron. If a patron is deceased, the sports wagering operator or sports wagering vendor shall release the funds in the account to the decedent's legal representative upon receipt of a copy of a probate court authorization or other documents as required by applicable Wyoming or other state laws.

 

Section 17.  Anti-Money Laundering (AML) Monitoring.  The sports wagering operator or sports wagering vendor shall develop and implement AML procedures and policies that adequately address the risks posed by online sports wagering for the potential of money laundering and terrorist financing. Additional requirements for AML procedures and policies may be specified by the Commission through the issuance of Commission Directives.

 

Section 18.  Sports Wagering Account Payment Processors. Requirements for payment processors may be specified by the Commission through the issuance of Commission Directives.

 

Section 19.  Personal Identifying Information (PII) Security.

 

(a) Any information obtained in respect to the sports wagering account, including PII and authentication credentials, shall be done in compliance with the privacy policies and local privacy regulations and standards observed by the Commission. Both PII and the patron funds shall be considered as critical assets for the purposes of risk assessment.

 

(b) No employee or agent of the sports wagering operator or sports wagering vendor shall divulge any PII related to a sports wagering account, the placing of any wager or any other sensitive information related to the operation of the sports wagering system without the consent of the patron, except as required by this section, the Commission, and as otherwise required by state or federal law. This includes, but is not limited to:

 

(i) The amount of money credited to, debited from, or present in any particular patron's sports wagering account;

 

(ii) The amount of money wagered by a particular patron on any event or series of events;

 

(iii) The unique patron ID or username and authentication credentials that identify the patron;

 

(iv) The identities of particular events on which the patron is wagering or has wagered; and

 

(v) Unless otherwise authorized by the patron, the name, address, and other information in possession of the sports wagering operator or sports wagering vendor that would identify the patron to anyone other than the Commission, sports wagering operator or sports wagering vendor.

 

(c) There shall be procedures in place for the security and sharing of PII, funds in a sports wagering account and other sensitive information as required by the Commission, including, but not limited to:

 

(i) The designation and identification of one or more employees having primary responsibility for the design, implementation, and ongoing evaluation of such procedures and practices;

 

(ii) The procedures to be used to determine the nature and scope of all information collected, the locations in which such information is stored, and the storage devices on which such information may be recorded for purposes of storage or transfer;

 

(iii) The measures to be utilized to protect information from unauthorized access; and

 

(iv) The procedures to be used if a breach of data security has occurred, including required notification to the Commission.

 

(d) Additional requirements for PII security may be specified by the Commission through the issuance of Commission Directives.