Chapter 3772-9 Gaming Supplies, Devices, and Equipment

3772-9-01 Definitions.

The following words and terms, when used in this chapter, shall have the following meanings unless the context indicates otherwise:

(A) "Activated voucher feature" means a feature activated at the slot machine that enables the slot machine to print a gaming voucher redeemable for cash or credits when a patron collects an amount on the slot machine's credit meter and may also enable the slot machine to accept gaming vouchers for wagering.

(B) "Electronic gaming equipment" means all of the following:

(1) Slot machines;

(2) Mechanical, electromechanical or electronic table games;

(3) Any computer systems used in connection with casino gaming, including slot accounting systems, that the commission determines needs to be tested to ensure the integrity of casino gaming;

(4) Redemption kiosks; and

(5) Any other device, software, hardware or other technology that the commission determines may affect the integrity of casino gaming in Ohio.

(C) "Redemption kiosk" means any device that validates and exchanges redeemable vouchers issued from electronic gaming equipment for cash or to provide cash for payment of electronic gaming equipment transactions requiring a manual payout.

Effective: 10/1/2016
Five Year Review (FYR) Dates: 04/01/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.01, 3772.03
Prior Effective Dates: 04/01/2012

3772-9-02 Approval for use in a casino facility.

(A) A casino operator, management company or holding company shall not install, maintain, use or operate any slot machine or other electronic gaming equipment in this state unless such machine or equipment has been approved by the commission and meets the standards in the appendix to this rule.

(B) No casino operator, management company or holding company may use any of the following for casino gaming before the commission authorizes their inclusion in the commission's database of approved items and technologies:

(1) Slot machines and any component parts material to casino gaming activity including, but not limited to, random number generators, all game media, progressive controllers, bill changers and/or bill validators;

(2) Mechanical or electromechanical devices used with live table games and electronic table games including, but not limited to, items using radio frequency identification technology, shuffling devices, and/or progressive controllers;

(3) System-to-system, game-to-system or intra-device communication software, or any equivalent thereof, used in the conduct or monitoring of casino gaming activity, including, but not limited to, accounting systems, promotional systems, bonusing systems, and player tracking systems, except for systems used solely for marketing purposes;

(4) Electromechanical devices used to account for casino gaming assets, including, but not limited to, kiosks capable of distributing or collecting cashless wagering instruments or credits, or both, ticket validation equipment, currency counters and/or chip sorters; and

(5) Any other device, software, hardware or other technology that the commission determines may affect the integrity of casino gaming in this state.

(C) A casino operator, management company or holding company intending to use any device, software, hardware or other technology that is described in paragraph (B) of this rule but that does not appear in the commission's database must seek the commission's approval by requesting, in writing, inclusion of such device, software, hardware or other technology and must identify the following information with specificity:

(1) The device, software, hardware or other technology for which approval is sought;

(2) The gaming-related vendor licensee or applicant that will supply the device, software, hardware or other technology;

(3) The certified independent testing laboratory chosen to scientifically test and technically evaluate the device, software, hardware or other technology;

(4) The date or dates on which the device, software, hardware or other technology was or is expected to be submitted to the certified independent testing laboratory for scientific testing and technical evaluation; and

(5) The results of the scientific testing and technical evaluation performed on the device, software, hardware or other technology by the certified independent testing laboratory.

Click to view Appendix

Effective: 11/26/2016
Five Year Review (FYR) Dates: 07/04/2019
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.31
Prior Effective Dates: 4/1/12; 12/21/13; 7/4/14

3772-9-03 Testing.

(A) To be eligible for approval and inclusion in the commission's database described in rule 3772-9-02 of the Administrative Code, a gaming-related vendor of any device, software, hardware or other technology must submit the device, software, hardware or other technology for scientific testing and technical evaluation by a certified independent testing laboratory to determine compliance with Chapter 3772. of the Revised Code and the rules adopted thereunder.

(B) A gaming-related vendor seeking commission approval and inclusion in the commission's database described in rule 3772-9-02 of the Administrative Code of any device, software, hardware or other technology must comply with the following:

(1) Submit a written request to a certified independent testing laboratory that, at a minimum, specifically references the scientific testing and technical evaluation necessary under Chapter 3772. of the Revised Code and this rule as well as identifies the particular device, software, hardware or other technology at issue;

(2) Submit all necessary items and information to the certified independent testing laboratory;

(3) Pay all costs associated with the scientific testing and technical evaluation performed by the certified independent testing laboratory; and

(4) Engage no more than one certified independent testing laboratory to perform scientific testing and technical evaluation of any particular device, version of software, hardware or other technology to be used in this state without prior written authorization from the commission.

Effective: 04/01/2012
R.C. 119.032 review dates: 04/01/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.31

3772-9-04 Testing results.

(A) No device, software, hardware or other technology will be included in the commission's database described in rule 3772-9-02 of the Administrative Code unless the certified testing laboratory concludes, subject to the approval of the commission, that the item at issue complies with Chapter 3772. of the Revised Code and the rules adopted thereunder.

(B) If the commission determines that the device, software, hardware or other technology at issue is approved and will be included on the commission's database described in rule 3772-9-02 of the Administrative Code, the commission, through the executive director or a designee thereof, shall provide written notification of such approval and inclusion to the gaming-related vendor.

(C) If the commission does not approve of the device, software, hardware or other technology at issue, the commission, through the executive director or a designee thereof, shall provide written notification that the item is not approved with a listing of deficiencies that require correction and, that it will not be included in the commission's database described in rule 3772-9-02 of the Administrative Code, and that it may not be distributed to casino operator, management company or holding company licensees in this state.

Effective: 04/01/2012
R.C. 119.032 review dates: 04/01/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.31

3772-9-05 Transportation of electronic gaming equipment to and from a casino facility.

(A) All electronic gaming equipment, except software, shall only be transported in accordance with this rule. All casino operators and gaming-related vendors must comply with this rule before any of the following occur:

(1) Electronic gaming equipment is transported from any point outside of this state into the state;

(2) Electronic gaming equipment is transported from any point within this state to any point outside of the state; or

(3) Electronic gaming equipment is transported within this state.

(B) Transportation notification under this rule is not required for the movement of electronic gaming equipment on the casino floor or within a casino facility.

(C) Electronic gaming equipment, except software, may not be delivered to a casino operator unless a member of the commission staff is present at point of delivery. The casino operator is responsible for ensuring that a member of the commission staff is present at the point of delivery.

(D) Prior to the transportation of any electronic gaming equipment, except software, into, out of, or within this state, the casino operator or gaming-related vendor shall first notify the executive director of the proposed shipment at least seven days in advance, unless a time is otherwise approved by the executive director. The notice shall include the following information:

(1) The full name and address of the person or persons shipping or moving the electronic gaming equipment;

(2) The full name and address of the person who owns the electronic gaming equipment, if different from the person(s) shipping or moving the electronic gaming equipment;

(3) The full name(s) and address(es) of any new owner(s) in the event ownership is being changed in conjunction with the shipment or movement;

(4) The method of shipment or movement and the name and address of the common carrier or carriers, if applicable;

(5) The full destination address for the electronic gaming equipment;

(6) The quantity of electronic gaming equipment being shipped to each location if more than one destination;

(7) The manufacturer's serial number of each piece of electronic gaming equipment;

(8) The expected date and time of delivery to any authorized location or to any port of entry or exit, if the origin or destination of the slot machine is outside the continental United States; and

(9) The reason for transporting or moving the electronic gaming equipment.

(E) The casino operator or gaming-related vendor shipping or moving any electronic gaming equipment shall provide to the common carrier or to the operator of the transporting conveyance, and the commission, documentation of shipment, of which at least one copy shall be kept with the electronic gaming equipment at all times during the shipment process, containing the following information:

(1) The manufacturer's serial number of the electronic gaming equipment being transported;

(2) The full name and address of the person from whom the electronic gaming equipment was obtained;

(3) The full name(s) and address(es) of the person(s) to whom the electronic gaming equipment is being sent; and

(4) The dates of shipment.

(F) An applicant prior to the shipment of any electronic gaming equipment into, within or out of this state shall have the prior written approval of the executive director or his/her authorized designee and shall comply with any conditions therein.

(G) Nothing in this rule shall prohibit the shipment of electronic gaming equipment going to different destinations from being transported by the same carrier simultaneously, provided each shipment is physically segregated in a manner approved by the commission and the notice required by this rule above clearly distinguishes which machines are being sent to each location.

(H) All EPROMs, compact flash cards, or other program storage device, which is defined as media or an electronic device that contains the critical control program components, shall be transported separately from the shipment of electronic gaming equipment . If electronic gaming equipment is not being utilized by the casino operator and is being stored off of the casino floor, the EPROM, compact flash card or other program storage device shall be stored separately in a locked safe or the equivalent as approved by the commission.

Effective: 9/26/2015
Five Year Review (FYR) Dates: 06/30/2015 and 09/26/2020
Promulgated Under: 119.03
Statutory Authority: 3772.03, 3772.033
Rule Amplifies: 3772.03, 3772.29
Prior Effective Dates: 4/1/12, 12/22/12, 6/1/14

3772-9-06 Possession and storage of slot machines.

(A) The following persons and any employee or agent acting on their behalf may, subject to any terms and conditions imposed by the commission, possess slot machines in this state for the purposes provided herein, provided that the machines are kept only in such locations as may be specifically approved in writing by the commission and that any machines located outside of a licensed casino facility not be used for gaming activity:

(1) An applicant for or holder of:

(a) A casino operator, management company or holding company license at a casino facility to conduct casino gaming;

(b) A gaming related vendor license, for the purpose of distributing, repairing or servicing slot machines;

(2) An employee or agent of the commission, for the purpose of fulfilling official duties or responsibilities;

(3) A common carrier, for the purpose of transporting such slot machines; or

(4) Any other person the commission may approve after finding that possession of slot machines by such person in this state is necessary and appropriate to fulfill the goals and objectives of Chapter 3772. of the Revised Code and the rules adopted thereunder.

(B) Each casino operator, management company and holding company licensee shall file, prior to the commencement of casino gaming and every thirty days thereafter, at the office of the commission's agent in the casino facility comprehensive lists of:

(1) The slot machines and bill validators and/or bill changers on its casino floor (the "Slot Machine Master List");

(2) The slot machines possessed by the licensee in restricted areas off the casino floor but on the premises of its casino facility;

(3) The slot machines possessed by the licensee at locations in this state but off the premises of its casino facility.

(C) At a minimum, each list of slot machines required by paragraph (B) of this rule shall contain the following information, as applicable, for each slot machine and any accompanying bill validator and/or bill changer on the "Slot Machine Master List," in consecutive order by location number:

(1) The date on which the list was prepared;

(2) A description of each slot machine by:

(a) Slot machine model and serial number;

(b) Computer program number;

(c) Denomination;

(d) Manufacturer and machine type, noting with particularity whether the machine has a bill validator or bill changer attached or is a progressive machine;

(e) Whether the slot machine has an activated electronic funds transfer (EFT) feature; and

(f) Whether the slot machine has an activated voucher feature;

(3) A cross reference for each slot machine by zone and serial number;

(4) The restricted casino area within the casino facility where the slot machine is located for each slot machine included on the list required by paragraph (C)(2) of this rule;

(5) The address of the slot machine storage facility where the slot machine is located; and

(6) Such other information as the commission may require.

(D) Any building located outside of a casino facility where slot machines will be kept shall meet, at a minimum, the following requirements:

(1) All access doors and windows must be locked and alarmed;

(2) Access is restricted to those individuals permitted to maintain slot machines pursuant to this rule; and

(3) Any other requirements as deemed appropriate by the commission.

Effective: 04/01/2012
R.C. 119.032 review dates: 04/01/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03

3772-9-07 Transportation of electronic gaming equipment to and from a certified independent testing laboratory located in this state.

(A) A certified independent testing laboratory located in this state may, solely for the purpose of conducting or otherwise providing scientific testing or technical evaluation, directly receive from and ship to a gaming-related vendor licensee or applicant any electronic gaming equipment and any device, software, hardware or other technology necessary for conducting or otherwise providing such testing and evaluation without being subject to the requirements contained in rules 3772-9-05 and 3772-9-06 of the Administrative Code.

(B) Except as otherwise provided, nothing in this rule shall be construed as exempting a certified independent testing laboratory located in this state; a casino operator, management company or holding company licensee or applicant; or a gaming-related vendor licensee or applicant from complying with Chapters 2915., 3769., 3770. and 3772. of the Revised Code or any rules adopted thereunder.

Effective: 03/31/2012
R.C. 119.032 review dates: 03/31/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03, 3772.31

3772-9-08 Movement of electronic gaming equipment within a casino facility.

(A) A casino operator shall maintain a log of all movements, installation, and removal of electronic gaming equipment. The log shall include, but is not limited to:

(1) The electronic gaming equipment manufacturer's serial number;

(2) The electronic gaming equipment's asset number;

(3) The date and time of movement of the equipment;

(4) The location from which the equipment was moved; and

(5) The location to which the equipment was moved;

(B) All required logs shall be maintained in accordance with the record retention requirements contained in rule 3772-3-05 of the Administrative Code.

Replaces: 3772-9-08

Effective: 10/1/2016
Five Year Review (FYR) Dates: 10/01/2021
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03
Prior Effective Dates: 5/19/12; 6/1/14

3772-9-09 Installation or removal of electronic gaming equipment.

(A) A casino operator shall obtain written approval from the executive director of the commission, or the executive director's designee, before installing or removing electronic gaming equipment from the gaming floor.

(B) Access within the secure area of electronic gaming equipment for the purpose of installation or removal shall be logged, except for access associated with the scheduled removal of the equipment's bill validator canister. The log shall include, but is not limited to:

(1) The electronic gaming equipment manufacturer's serial number;

(2) The electronic gaming equipment's asset number;

(3) Name of the employee who opened the secure area;

(4) Gaming license number of the employee who opened the secure area;

(5) Date and time of entry; and

(6) The reason for entry.

(C) Critical program storage media shall be verified and sealed by a commission employee before any electronic gaming equipment is placed into service at a casino facility, unless otherwise approved by the executive director of the commission or the executive director's designee.

(D) The following must occur before removing electronic gaming equipment from the gaming floor:

(1) The commission seal must be removed, unless otherwise approved by the executive director of the commission or the executive director's designee. Seals may only be removed by a commission employee;

(2) The equipment's bill validator canister is removed and transported to the count room;

(3) All meters are read and recorded in conformity with the casino operator's internal control standards; and

(4) Any credits, cashable or non-cashable, remaining on the equipment are removed in accordance with the casino operator's internal control standards.

(E) All required logs shall be maintained in accordance with the record retention requirements contained in rule 3772-3-05 of the Administrative Code.

Replaces: 3772-9-09

Effective: 10/1/2016
Five Year Review (FYR) Dates: 10/01/2021
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03
Prior Effective Dates: 5/19/12

3772-9-10 Electronic gaming equipment maintenance, repair or other servicing standards.

(A) Electronic gaming equipment may not be placed into operation at a casino facility unless the equipment is in a suitable operating condition.

(B) Critical program storage media shall be verified and sealed by a commission employee before any electronic gaming equipment is placed into operation at a casino facility, unless otherwise approved by the executive director of the commission or the executive director's designee.

(C) A casino operator shall notify the commission about, and remove from operation, any electronic gaming equipment that becomes unsuitable for operation at a casino facility due to an unexplainable malfunction. The electronic gaming equipment shall remain out of operation until a report is provided to the commission detailing the issue with the equipment and describing how it was resolved..

(D) Any maintenance, repair or other type of servicing of electronic gaming equipment that is to be or has been placed into operation at a casino facility must occur in a secure location approved by the commission.

(E) Access within the secure area of electronic gaming equipment for the purpose of maintenance, repair, or other service shall be logged, except for access associated with the scheduled removal of the equipment's bill validator canister. The log shall include, but is not limited to:

(1) The electronic gaming equipment manufacturer's serial number;

(2) The electronic gaming equipment's asset number;

(3) Name of the employee who opened the secure area;

(4) Gaming license number of the employee who opened the secure area;

(5) Date and time of entry; and

(6) The reason for entry.

(F) A casino operator shall maintain a log of electronic gaming equipment undergoing any maintenance, repair or other type of servicing. The log shall include, but is not limited to:

(1) Name of the person(s) involved in the maintenance, repair or other type of servicing;

(2) Date of the maintenance, repair or other type of servicing;

(3) Description of the maintenance, repair or other type of servicing;

(4) The electronic gaming equipment manufacturer's serial number; and

(5) The electronic gaming equipment's asset number.

(G) All required logs shall be maintained in accordance with the record retention requirements contained in rule 3772-3-05 of the Administrative Code.

Replaces: 3772-9-10

Effective: 10/1/2016
Five Year Review (FYR) Dates: 10/01/2021
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03
Prior Effective Dates: 5/19/12

3772-9-11 Remote systems access.

(A) In emergency situations or as an element of technical support, an employee of a licensed gaming-related vendor may perform analysis of, or render technical support with regard to, a licensed casino operator, management company or holding company's electronic gaming monitoring system, casino management system, player tracking system, external bonusing system, cashless funds transfer system, wide-area progressive system, ticket-in ticket-out system or other approved system from a remote location.

(B) All remote access to these systems shall be performed in accordance with the following procedures:

(1) A casino operator shall establish a unique system account for each gaming-related vendor providing technical support from a remote location;

(2) All system access afforded pursuant to this rule shall meet the following requirements:

(a) Be restricted in a manner that requires the casino operator's management information systems department, or the equivalent thereof, to receive prior notice from the licensed gaming-related vendor of that vendor's intent to remotely access a designated system;

(b) Require the casino operator to take affirmative steps, for each instance of access, to activate the licensed gaming-related vendor's access privileges; and

(c) Be designed to appropriately limit the ability of any person authorized under this rule to deliberately or inadvertently interfere with the normal operation of the system or its data.

(3) Separate logs shall be maintained, and kept in accordance with rule 3772-3-05 of the Administrative Code, by the licensed gaming-related vendor and casino operator's management information systems department, or the equivalent thereof, and include, at a minimum, the following information:

(a) The system accessed, including manufacturer, and version number;

(b) The type of connection;

(c) The name of the employee remotely accessing the system or tracking number assigned by the licensed gaming-related vendor for the service request;

(d) The name and license number of the employee in the management information systems department, or the equivalent thereof, activating the vendor's access to the system;

(e) The date, time and duration of the connection;

(f) The reason for the remote access, including a description of the symptoms or malfunction prompting the need for remote access to the system; and

(g) Any action taken or further action required.

(4) All communications between the licensed gaming-related vendor and any of the systems identified in paragraph (A) of this rule shall occur using a dedicated and secure communication facility that may consist of a leased line approved in writing by the executive director of the commission.

(C) Each casino operator authorizing access to a system by a licensed gaming-related vendor under this rule shall implement a system of access protocols and other controls over the physical integrity and the remote access process of that system sufficient to ensure appropriately limited access to software and the system-wide reliability of data.

Effective: 9/26/2015
Five Year Review (FYR) Dates: 06/30/2015 and 09/26/2020
Promulgated Under: 119.03
Statutory Authority: 3772.03
Rule Amplifies: 3772.03
Prior Effective Dates: 5/19/12

3772-9-12 Game authentication.

(A) Casino operators and gaming related vendors shall ensure their electronic gaming equipment supports a port and protocol, referred to as game authentication terminal (GAT), for gaming equipment verification.

(B) Electronic gaming equipment submitted for approval on or after December 1, 2012 shall provide the following support for authenticating critical program storage media (CPSM):

(1) Employ a verification mechanism, approved by the commission, which authenticates all CPSM. The authentication mechanism shall:

(a) Be accessible by a communication port and protocol approved by the commission;

(b) Possess an approved communication port located within the locked electronic gaming equipment cabinet and be accessible without requiring access to the locked logic compartment;

(c) Provide on-demand authentication of electronic gaming equipment CPSM. This function shall not require the electronic gaming equipment power to be cycled and the execution time shall not exceed twenty minutes;

(d) Generate a unique signature for each CPSM utilizing secure hashing algorithm-1 (SHA-1) with hash-based message authentication code (HMAC), as defined by the "National Institute of Standards and Technology (NIST), Federal Information Processing Standards Publication 180-4: Secure Hash Standard (March 2012)"; and

(e) Provide support for escrowing verification results. Verification results shall be preserved and retrievable pending a subsequent verification request or a loss of power; and

(2) Provide means for the use of third party authentication tools approved by the commission.

(C) All electronic gaming equipment submitted for approval before December 1, 2012 which offers a communication port, shall comply with the requirements in paragraph (B), except paragraph (B)(1)(b) of this rule, upon the installation of new CPSM, and shall comply with this rule by December 1, 2012, unless otherwise approved in writing by the executive director or designee.

(D) Electronic gaming equipment submitted for approval before December 1, 2012 which do not offer a communication port are excluded from this rule.

Effective: 12/22/2012
R.C. 119.032 review dates: 12/22/2017
Promulgated Under: 119.03
Statutory Authority: 3772.03, 3772.033
Rule Amplifies: 3772.03

3772-9-13 Redemption kiosks.

(A) Procedures for access to redemption kiosks shall be detailed in the casino operator's internal controls.

(B) The maximum voucher value that can be paid out by a redemption kiosk shall be detailed in the casino operator's internal controls.

(C) If a redemption kiosk contains insufficient funds to break an inserted bill or redeem an inserted voucher, the inserted bill or voucher shall be rejected.

Replaces: 3772-9-13

Effective: 10/1/2016
Five Year Review (FYR) Dates: 10/01/2021
Promulgated Under: 119.03
Statutory Authority: 3772.03 ; 3772.033
Rule Amplifies: 3772.03
Prior Effective Dates: 12/22/12; 12/21/13