Chapter 3770:3-6 | Information Technology Requirements for Type C Sports Gaming Proprietors

Rule 3770:3-6-01 | Sports gaming systems.

• Effective: October 27, 2022
• Promulgated Under: 119.03

(A) Type C sports gaming proprietors must use a sports gaming system approved by the director. No wagers may be accepted in the event of a system failure or unavailability.

(B) Type C sports gaming proprietors must use a sports gaming system designed to prevent and detect the following:

(1) Unauthorized use of an account by someone other than the account holder;

(2) Unauthorized withdrawals from patron accounts;

(3) Wagering by persons under the age of twenty-one;

(4) Wagering by members of the involuntary or voluntary exclusion lists; and

(5) Wagering by other prohibited persons.

(C) Type C sports gaming proprietors must have procedures governing its sports gaming system. The procedures must include:

(1) ) A description of, and the inter-relationships and dependencies of, the sports gaming system, hardware, software, and all integrated supplier modules;

(2) A description of physical and logical security of the sports gaming servers;

(3) How it will respond to a failure of the sports gaming system;

(4) Risk management procedures;

(5) Change management procedures;

(6) Procedures for complying with the data match requirements and procedures of section 3770.07 of the Revised Code; and

(7) Procedures for the prevention and detection of attempts to launder currency.

(D) Each Type C sports gaming proprietor must provide read-only remote access to its sports gaming systems and any hardware or software required to facilitate this access to the Ohio lottery commission in a manner prescribed by the director. All costs associated with providing this access are the sole responsibility of the sports gaming proprietor.

(E) Each Type C sports gaming proprietor must test the recovery procedures of the sports gaming system on a sample basis at least annually. The results must be documented and available to the Ohio lottery commission upon request.

Last updated October 28, 2022 at 5:07 AM

Supplemental Information

Authorized By: 3770.03, 3770.23, 3770.24, 3770.25
Amplifies: 3770.01, 3770.02, 3770.03, 3770.06, 3770.21
Five Year Review Date: 10/27/2027

Rule 3770:3-6-02 | Information technology.

• Effective: September 25, 2022
• Promulgated Under: 119.03

(A) Type C sports gaming proprietors must maintain an information technology department that is responsible for the quality, reliability, and accuracy of all electronic systems used in the operation.

(B) Type C sports gaming proprietors must ensure that duties in the information technology department are adequately segregated and monitored to detect procedural errors, unauthorized access to financial transactions and assets, and to prevent the concealment of fraud.

(C) The information technology environment and infrastructure must be maintained in a secured physical location that is restricted to authorized employees.

(D) Type C sports gaming proprietors must adopt procedures for responding to, monitoring, investigating, resolving, documenting, and reporting security incidents associated with information technology systems.

Last updated September 26, 2022 at 8:45 AM

Supplemental Information

Authorized By: 3770.03, 3770.23, 3770.24, 3770.25
Amplifies: 3770.01, 3770.02, 3770.03, 3770.06, 3770.21
Five Year Review Date: 9/25/2027

Rule 3770:3-6-03 | Lottery sports gaming equipment approval and testing.

• Effective: October 27, 2022
• Promulgated Under: 119.03

(A) Type C sports gaming proprietors are not permitted to operate any Ohio lottery commission sports gaming equipment unless such equipment is approved by the director. All Ohio lottery commission sports gaming equipment must be evaluated by a certified independent testing laboratory prior to approval, unless otherwise approved by the director.

(B) When Ohio lottery commission sports gaming equipment is required to be tested by a certified independent testing laboratory, the type C sports gaming proprietor making the submission must adhere to the following:

(1) Submit a written request to a certified independent testing laboratory that, at a minimum, specifically references the scientific testing and technical evaluation necessary to determine compliance with Chapters 3770. and 3775. of the Revised Code and the rules adopted thereunder, as well as the applicable standards in the appendix to this rule, and identifies the sports gaming equipment at issue;

(2) Submit all necessary items and information to the certified independent testing laboratory;

(3) Pay all costs associated with the scientific testing and technical evaluation performed by the certified independent testing laboratory;

(4) Engage no more than one certified independent testing laboratory to perform scientific testing and technical evaluation of any particular version of sports gaming equipment software, hardware, or other technology without prior written authorization from the director; and

(5) Submit any items or information pertaining to the Ohio lottery commission sports gaming equipment to the director, if requested.

(C) The director may require previously approved Ohio lottery commission sports gaming equipment to be evaluated or re-evaluated by a certified independent testing laboratory if it is determined that the equipment fails to meet any of the requirements of Chapters 3770. and 3775. of the Revised Code or the rules adopted thereunder or jeopardizes the integrity of sports gaming in any way.

(D) Sports gaming equipment tested by a certified independent testing laboratory will not be included in the Ohio lottery commission's database unless the director approves the test results.

(E) Sports gaming equipment software components deemed to be critical must be capable of verification utilizing a verification method approved by the director.

Last updated February 27, 2024 at 12:08 PM

Supplemental Information

Authorized By: 3770.03, 3770.23, 3770.24, 3770.25
Amplifies: 3770.01, 3770.02, 3770.03, 3770.06, 3770.21
Five Year Review Date: 10/27/2027

Rule 3770:3-6-04 | Type C sports gaming proprietor equipment for hosts.

• Effective: October 27, 2022
• Promulgated Under: 119.03

(A) Sports gaming equipment supplied by a type C sports gaming proprietor to a type C sports gaming host must comply with technical standards as set forth in rule 3770:3-6-03 of the Administrative Code.

(B) A type C sports gaming proprietor is responsible for all costs associated with the acquisition, maintenance, repair, and service of the sports gaming equipment and sports gaming systems as necessary and as required in order to ensure continued operation of lottery sports gaming.

(C) A type C sports gaming proprietor must notify the Ohio lottery commission prior to installation of equipment at a type C sports gaming host location.

(D) A type C sports gaming proprietor must operate a technical support program to support type C sports gaming hosts, as approved by the director. This will include the ability for the type C sports gaming host to report machine performance issues, dispatch repairs, request clerk training and any other needed support. A type C sports gaming proprietor may be required to report on the field service program including type C sports gaming host complaints, resolution, and dispatch response times to the Ohio lottery commission.

(E) A type C sports gaming proprietor must provide ticket stock, bet sheets, and other consumables to support lottery sports gaming.

Last updated October 28, 2022 at 5:07 AM

Supplemental Information

Authorized By: 3770.03, 3770.23, 3770.24, 3770.25
Amplifies: 3770.01, 3770.02, 3770.03, 3770.06, 3770.21
Five Year Review Date: 10/27/2027

Rule 3770:3-6-05 | Incident Reporting.

• Effective: October 27, 2022
• Promulgated Under: 119.03

(A) Type C sports gaming proprietors must immediately report, in a manner prescribed by the director, any information in the sports gaming proprietors' possession related to any of the following incidents:

(1) Any wager in violation of Chapters 3770. and 3775. of the Revised Code or the rules adopted thereunder or of federal law;

(2) Any conduct that corrupts a betting outcome of a sporting event for purposes of financial gain;

(3) Any IT security breach or other compromising IT risk;

(4) Any breaches of confidentiality of a player's personal information;

(5) Any physical security breach or other compromising risk to players, employees, or the Ohio lottery commission; and

(6) Any other incident type required by the director.

(B) Type C sports gaming proprietors must have procedures to prevent, detect, and report to the director attempts to launder money through any of its Ohio licensed sports gaming offerings.

Last updated October 28, 2022 at 5:07 AM

Supplemental Information

Authorized By: 3770.03, 3770.23, 3770.24, 3770.25
Amplifies: 3770.01, 3770.02, 3770.03, 3770.06, 3770.21
Five Year Review Date: 10/27/2027