NIGC MICS Update Presented by: Steve Montoya, CPA

Agenda History Applicable NIGC MICS Requirements NIGC MICS Checklists expertise. Agenda History Applicable NIGC MICS Requirements NIGC MICS Checklists Questions

expertise. History Indian Gaming Regulatory Act – was enacted by the United States Congress on October 17, 1988, to regulate the conduct of gaming on Indian Lands. IGRA establishes the NIGC and a regulatory structure for Indian gaming in the United States. – Review IGRA National Indian Gaming Commission (NIGC) – an independent federal regulatory agency established pursuant to the Indian Gaming Regulatory Act of 1988. Code of Federal Regulations Title 25 (25 CFR) – implements the Indian Gaming Regulatory Act (Pub. L. 100-497, 102 Stat. 2467) 25 CFR 542, 543, and 547 – Establishes minimum internal control standards for Class II and Class III gaming

MICS – Part 543 History expertise. August 2005 - CRIT Decision October 2008 - Initial Passing of 543 MICS November 2010 - the NIGC issued a Notice of Inquiry and Notice of Consultation April 2011 - NIGC published a Notice of Regulatory Review Schedule (NRR) February 2012 – Tribal Advisory Committee (TAC) submitted its recommendations on 543

expertise. Regulation On October 22, 2012, the National Indian Gaming Commission (NIGC) published two critical regulations that became effective for Class II gaming: 25 CFR Part 543 Minimum Internal Control Standards (MICS) for Class II Gaming (MICS), and 25 CFR 547 Minimum Technical Standards for Class II Gaming Systems and Equipment The new standards are critical to tribal gaming regulators as the standards provide much needed updates to the control regulations surrounding the Class II gaming environment

Do these changes impact my casino? expertise. Do these changes impact my casino?

Applicable NIGC MICS Standards expertise. Applicable NIGC MICS Standards Class I Class II Class III Tribes 25 CFR 543 25 CFR 547 25 CFR 542

Class I, II and III Definitions expertise. Class I, II and III Definitions Class I Gaming: means social games solely for prizes of minimal value or traditional forms of Indian gaming engaged in by individuals as a part of, or in connection with, tribal ceremonies or celebrations. Class II Gaming: means the game of chance commonly known as bingo, pull-tabs, lotto, punch boards, tip jars, instant bingo, any other games similar to bingo, and card games. Class III Gaming: means all forms of gaming that are not Class I gaming or Class II gaming.

NIGC MICS Requirements Flowchart expertise. NIGC MICS Requirements Flowchart

Exercises – NIGC MICS Requirements expertise. Exercises – NIGC MICS Requirements

expertise. A tribally owned casino offers the following gaming activities: Bingo Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance does not require the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Bingo Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance does not require the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance does not require the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance does not require the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None – No Class II Gaming Activities

expertise. A tribally owned casino offers the following gaming activities: Bingo Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance requires the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following question: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Bingo Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance requires the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance requires the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. A tribally owned casino offers the following gaming activities: Class III Gaming Machines Table Games   The State Gaming Compact and Tribal Gaming Ordinance requires the casino to comply with NIGC regulations for Class III gaming activities. Based on this scenario, what is the best answer to the following questions: What NIGC MICS requirements, if any, is the Tribe required to comply with: Part 542 Part 543 Both None

expertise. Compliance with NIGC MICS Parts 543 and 547 Class II Gaming National Indian Gaming Commission website http://www.nigc.gov

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming Purpose: Establishes the minimum internal control standards for the conduct of Class II games on Indian lands. Tribal Internal Control Standards (TICS): TGRAs must ensure that TICS are established and implemented that provide a level of control that equals or exceeds the applicable standards set forth in this part. Evaluation of Existing TICS: Each TGRA must determine whether and to what extent their TICS require revision to ensure compliance with this part. System of Internal Controls (SICS): Each gaming operation must develop a SICS, as approved by the TGRA, to implement the TICS.

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming Compliance Dates TICS Approval: TICS must be promulgated by October 22, 2013 Implementation Date: Changes necessary to ensure compliance with this part must be implemented at the beginning of the next fiscal year. TGRA may extend an additional six months to come into compliance with the TICS.

Six month extension illustration: expertise. Six month extension illustration: Fiscal Year Begins Establish TICS Establish SICS/ Implementation expected by Implementation may be extended to January 1 October 22, 2013 January 1, 2014 July 1, 2014 October 1 October 1, 2014 April 1, 2015

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming Compliance Based Upon Tier: Tier A Gaming Operation: Gaming operations with annual gross gaming revenues of more than $3 million but not more than $8 million Tier B Gaming Operation: Gaming operations with annual gross gaming revenues of more than $8 million but not more than $15 million Tier C Gaming Operation: Gaming operations with annual gross gaming revenues of more than $15 million.

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming Determination of Tier: Based upon the annual gross gaming revenues reported in audited financial statements. Gaming operations moving from one tier to another shall have nine months from the date of the independent CPA audit report to achieve compliance with the requirements of the new tier. Gaming Operations: Each gaming operation shall develop and implement an internal control system that, at a minimum, complies with TICS.

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming NIGC provides MICS checklists for the following areas: Bingo Cage, Vault, Kiosk, Cash, and Cash Equivalents Information Technology and Information Technology Data Auditing & Accounting Pull Tabs Card Games Complimentary Services or Items Lines of Credit Drop and Count Surveillance Auditing Revenue (Previously included in Accounting) Patron Deposit Accounts and Cashless Systems (New) Gaming Promotions & Player Tracking Systems (New)

Applicable NIGC MICS Standards (continued) expertise. Areas 543 547 542 Bingo x Audit & Accounting Information technology (IT) and IT data Pull tabs   Card games Drop and Count Complimentary services or items Surveillance Cage, vault, and cash & cash equivalents Credit Kiosk Gaming promotions and player tracking systems Keno Pari-mutuel wagering Table games Gaming machines Applicable NIGC MICS Standards (continued)

MICS – Part 543 Class II Gaming – Bingo expertise. MICS – Part 543 Class II Gaming – Bingo Traditional and Electronic Gaming Device Bingo Major areas include: Supervision Bingo Cards Bingo Card Sales Draw Prize Payout Cash and Cash Equivalent Controls Technologic aids to the play of bingo (Expanded) Operations Vouchers Variances Areas no longer included: Standards for Players Accounts (Now Patron Deposit Accounts and Cashless Systems) Computer Applications

MICS – Part 543 Class II Gaming – Bingo expertise. MICS – Part 543 Class II Gaming – Bingo Draw: Electronic aid – certification in accordance with 547.14 Variance Establish a threshold level for reviews Reviews must be documented Technologic aids to the play of bingo: Safeguarding the integrity of the technology Shipping and receiving Suppliers Restricted Access Recordkeeping and audit process Signature verification Installation Dispute resolution Operation must establish, as approved by the TGRA, the threshold level at which a variance, including deviations from the mathematical expectations required by 25 CFR 547.4, will be reviewed to determine the cause. Any such review must be documented

MICS – Part 543 Class II Gaming – Cage expertise. MICS – Part 543 Class II Gaming – Cage Major areas include: Supervision Check Cashing Cage and Vault Accountability Kiosks Patron Deposited Funds Promotional Payments, drawings and giveaways Chips and tokens Vouchers (Used to be in gaming machines) Cage and Vault Access Variances Areas no longer included: Coupon Standards Computer applications NIGC Fees

MICS – Part 543 Class II Gaming – Cage expertise. MICS – Part 543 Class II Gaming – Cage Kiosks: Accountability and Independence Cash counts and reconciliation Physical security Promotional Payments, drawings and giveaways: Supporting documentation Approval Vouchers: Authenticity and validity Expired/ stolen/ lost vouchers Voided vouchers Cage and Vault Access: Restricted access

MICS – Part 543 Class II Gaming – IT expertise. MICS – Part 543 Class II Gaming – IT Major areas include: Supervision Class II gaming systems logical and physical Physical Security Logical Security User Controls Installation and/or modification Remote Access Incident monitoring and reporting Data Backups Software downloads Verify downloads Areas no longer included: Gaming program changes Remote dial-up

MICS – Part 543 Class II Gaming – IT expertise. MICS – Part 543 Class II Gaming – IT Class II gaming systems logical and physical controls: Restricted access Storage media Independence Gaming system - any computerized system that is integral to the gaming environment, including the server and peripherals for Class II gaming system, accounting, surveillance, essential phone system, and door access and warning systems. Software downloads: Performed in accordance with 25 CFR 547.12 Class II gaming system. All components, whether or not technologic aids in electronic, computer, mechanical, or other technologic form, that function together to aid the play of one or more Class II games, including accounting functions mandated by these regulations or part 547 of this chapter.

MICS – Part 543 Class II Gaming – Accounting expertise. MICS – Part 543 Class II Gaming – Accounting Major areas include: Conflict of standards Accounting Internal audit Annual requirements Areas no longer included: Gross gaming revenue computations (included in Auditing Revenue) Periodic payments Wide area payouts Cash-out tickets Credit Write off credit

MICS – Part 543 Class II Gaming – continued expertise. MICS – Part 543 Class II Gaming – continued Annual Requirements Agreed-upon procedures, a CPA must be engaged to perform an assessment to verify whether the gaming operation is in compliance with the MICS and/or TICS. A CPA must determine compliance by the gaming operation with the internal audit requirements by: Completing the internal audit checklist. Ensuring that the internal auditor completed all applicable checklists. Verifying that any areas of non-compliance have been identified. Ensuring that audit reports are completed and include responses from management. Verifying that appropriate follow-up on audit findings have been conducted and corrective measures have been taken to effectively mitigate risk. (1) Agreed upon procedures. A CPA must be engaged to perform an assessment to verify whether the gaming operation is in compliance with these MICS, and/or the TICS or SICS if they provide at least the same level of controls as the MICS. The assessment must be performed in accordance with agreed upon procedures and the most recent versions of the Statements on Standards for Attestation Engagements and Agreed-Upon Procedures Engagements (collectively “SSAEs”), issued by the American Institute of Certified Public Accountants. (ii) If the CPA determines that the internal audit procedures performed during the fiscal year have been properly completed, the CPA may rely on the work of the internal audit for the completion of the MICS checklists as they relate to the standards covered by this part.

MICS – Part 543 Class II Gaming – continued expertise. MICS – Part 543 Class II Gaming – continued Annual Requirements – continued The Tribe must submit two copies of the AUP report and the annual financial audit report to the NIGC within 120 days of the gaming operation’s fiscal year-end. If the CPA determines that the internal audit procedures performed during the fiscal year have been properly completed, the CPA may rely on the work of the internal audit for the completion of the MICS checklists. All noted instances of noncompliance must be documented in the report with a narrative description, the number of exceptions and sample size tested.

What about Class III Reporting Requirements? expertise. What about Class III Reporting Requirements? CPA Testing includes 3 Options: (1) CPA completes all applicable NIGC MICS checklists. (2) CPA tests compliance with the Tribal Internal Control Standards. (3) Reliance on the Internal Auditor - Unannounced drop and count. - Re-perform 3% of gaming machines and table games - Re-perform 5% of all other Checklists.

MICS – Part 543 Class II Gaming – Pull Tabs expertise. MICS – Part 543 Class II Gaming – Pull Tabs Major areas include: Supervision Pull tab inventory Pull tab sales Winning pull tabs Pull tab operating funds Statistical records Variances Areas no longer included: Accountability form Electronic equipment Computer applications

MICS – Part 543 Class II Gaming – Card Games expertise. MICS – Part 543 Class II Gaming – Card Games Major areas include: Supervision Exchanges or transfers Standards for playing cards Shill Funds Standards for reconciliation of card room bank Posted Rules Promotional progressive pots and pools Variances Areas no longer included: Standards for drop and count (Included in drop and count) Plastic cards Computer applications

MICS – Part 543 Class II Gaming – Complimentary Services and Items expertise. MICS – Part 543 Class II Gaming – Complimentary Services and Items Major areas include: Supervision Complimentary services and items Complimentary service and items records Variances Areas no longer included: NONE

MICS – Part 543 Class II Gaming – Line of Credit expertise. MICS – Part 543 Class II Gaming – Line of Credit Major areas include: Supervision Credit standards Variances Areas no longer included: Accounting/ auditing standards (included in Auditing and Accounting) Computer applications

MICS – Part 543 Class II Gaming – Drop and Count expertise. MICS – Part 543 Class II Gaming – Drop and Count Major areas include: Supervision Count room access Count team Card game drop standards Player interface and financial instrument storage component drop standard Card game standards Player interface financial instrument count standards Controlled keys (New) Variances (New) Areas no longer included: All standards related to table games and gaming machines

MICS – Part 543 Class II Gaming – Drop and Count expertise. MICS – Part 543 Class II Gaming – Drop and Count Card game drop standards: Security and surveillance Dual control Emergency drops Shift changes Player interface and financial instrument storage component drop standard: Surveillance Transportation

MICS – Part 543 Class II Gaming – Drop and Count expertise. MICS – Part 543 Class II Gaming – Drop and Count Card game count standards: Restricted access Separation of multiple revenue centers Documentation and Verification Currency counter interface Manual counting Variances and corrections Player interface financial instrument count standards: Documentation a Verification

MICS – Part 543 Class II Gaming – Surveillance expertise. MICS – Part 543 Class II Gaming – Surveillance Major areas include: Supervision Surveillance equipment and control room Additional surveillance requirements Reporting requirements Recording retention Logs Areas no longer included: General Keno Pari-mutuel Table games Progressive table games Gaming machines Fills and credits Change booths

MICS – Part 543 Class II Gaming expertise. MICS – Part 543 Class II Gaming NIGC provides MICS checklists for the following new areas: Patron Deposit Accounts and Cashless Systems Auditing Revenue Gaming Promotions & Player Tracking Systems

expertise. MICS – Part 543 Class II Gaming – Patron Deposit Accounts and Cashless Systems Major areas include: Supervision Patron deposit accounts and cashless systems Patron deposits, withdrawals, and adjustments Variances Supervision: Provided during operations Patron deposit accounts and cashless systems: Data backup Establishment of an account Account signature Access Patron deposits, withdrawals, and adjustments: Verification Documentation Availability Variances: Threshold for review

MICS – Part 543 Class II Gaming – Auditing Revenue expertise. MICS – Part 543 Class II Gaming – Auditing Revenue Major areas include: Supervision Independence Documentation Operational Areas Supervision: Provided during operations Independence: Independent of the transactions Documentation: Maintenance of documentation Operational Areas: Controls established and procedures implemented Accuracy Variances Documentation Threshold for review Reconciliations

expertise. MICS – Part 543 Class II Gaming – Gaming Promotions & Player Tracking Systems Major areas include: Supervision Gaming promotions Player tracking systems and gaming promotions Variances Supervision: Provided during operations Gaming promotions: Readily available Approval Rules Prizes and value Documentation of activity Player tracking systems and gaming promotions: Independence OR Documentation and random verification Variances: Threshold for review Documentation

Compliance with MICS Part 547 Class II Gaming Systems & Equipment expertise. Compliance with MICS Part 547 Class II Gaming Systems & Equipment

expertise. Part 547-Minimum Technical Standards For Class II Gaming Systems and Equipment Section 547 – Background and How to Comply Overview of Section 547 requirements

Why is 547 applicable? expertise. The Indian Gaming Regulatory Act (IGRA), 25 U.S.C. 2703(7)(A)(i), permits the use of electronic, computer, or other technologic aids in connection with the play of Class II games. This part establishes the minimum technical standards governing the use of such aids. IGRA established a regulatory scheme that includes the NIGC as well as Tribes

547.3 Responsibility for implementing these standards? expertise. 547.3 Responsibility for implementing these standards? Section 547 are the minimum requirements. TGRA may establish and implement additional technical standards that do not conflict with the standards set out in this part. This part should not be interpreted to limit the use of technology or to preclude the use of technology not specifically referenced. Only applicable standards apply Nothing in this part should be construed to grant to a state jurisdiction over Class II gaming or to extend a state's jurisdiction over Class III gaming

547.4 General application (Class II gaming) expertise. 547.4 General application (Class II gaming) Fairness No gaming system may cheat or mislead users All prizes advertised must be available to win during the game A test laboratory must calculate and/or verify the mathematical expectations of game play in accordance with the manufacturer stated submission. Approved gaming equipment and software only All gaming equipment and software used with gaming systems must be identical in all respects to a prototype reviewed and tested by a testing laboratory and approved for use by the TGRA Proper functioning All gaming equipment and software must perform according to the manufacturer’s design and operating specifications

547.5 How to comply with this part? expertise. 547.5 How to comply with this part? 547 technical standards were designed to protect the security and integrity of gaming systems NIGC originally implemented a five-year “grandfather period” for eligible systems Some existing Class II gaming systems might not meet all the requirements of 547 within five years The Commission received numerous comments related to the five-year grandfather provisions due to potential significant economic and practical consequences Grandfather systems must be brought into compliance by November 10, 2018

expertise. 547.6 – 547.17 Enrolling and enabling Class II gaming system components Hardware standards applicable to Class II gaming systems Class II gaming system accounting functions Class II gaming system critical events Money and credit handling for a Class II gaming system Downloading information on a Class II gaming system Program storage media for a Class II gaming system Electronic random number generation (547.14) Electronic date communication between system components Game artwork, glass and rules How gaming regulatory authorities can apply to implement an alternative minimum standard to those required by this part

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #51 - Is the selection (of bingo balls/numbers) made through an electronic aid? (Certification in accordance with 25 CFR 547.14 acceptable for verifying the randomness of the draw and satisfies the requirements of paragraph (d)(1) of this section (as applicable)). (Observation and inquiry) (N/A and YES answers only) … 547.14(b) Statistical randomness (1) Numbers or other designations produced by a random number generator (RNG) must be statistically random individually and in the permutations and combinations used in the application under the rules of the game. …

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #96 - Shipping and receiving: - Is a communication procedure established between the supplier, the gaming operation, and the TGRA to properly control the shipping and receiving of all software and hardware components do such procedures include the following: Certification in accordance with 25 CFR part 547? (As applicable). (N/A and YES answers only) (Inquiry and review SICS)

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #117 - System software signature verification - Are procedures implemented for system software verifications and do the procedures include the following: Comparing signatures generated by the verification programs required by 25 CFR 547.8, to the signatures provided in the independent test laboratory letter for the software version? (Review supporting documentation) … (f) Software signature verification. The manufacturer or developer of the Class II gaming system must provide to the testing laboratory and to the TGRA an industry-standard methodology, acceptable to the TGRA, for verifying the Class II gaming system game software. For example, for game software stored on rewritable media, such methodologies include signature algorithms and hashing formulas such as SHA-1. …

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #133 - Does the TGRA or the operation verify that all game rules and disclaimers are displayed at all times or made readily available to the player upon request, as required by 25 CFR part 547? (Inquiry and review SICS) Rules, instructions, and prize schedules “Malfunctions void all prizes and plays” or equivalent

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #135 - Does all Class II gaming equipment comply with 25 CFR part 547, Minimum Technical Standards for Gaming Equipment Used With the Play of Class II Games? (Inquiry and review supporting documentation) Certification

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Bingo Checklist Question #167 - Has the operation established a threshold level at which a variance including deviations from the mathematical expectations required by 25 CFR 547.4, must be reviewed? (Inquiry) State the variance level or percentage_______________ (and include in Comment Section). … 25 CFR 547.4 (a) Fairness. No Class II gaming system may cheat or mislead users. All prizes advertised must be available to win during the game. A test laboratory must calculate and/or verify the mathematical expectations of game play, where applicable, in accordance with the manufacturer stated submission

543 MICS Checklist Questions expertise. 543 MICS Checklist Questions Information Technology and Information Technology Data Question #61 - Are downloads, either automatic or manual, performed in accordance with 25 CFR 547.12, which are as follows: Must use secure methodologies that will deliver the download data without alteration or modification Must be performed in a manner that will not affect game play Must maintain integrity of accounting data System must be able to provide the time, date, components and versions downloaded (software signature), outcome of download (success or failure), name and ID number of individual conducting or scheduling the download, and must be capable of being verified

expertise. Resources: National Indian Gaming Commission website – http://www.nigc.gov Stephen A. Montoya, CPA Audit and Consulting Senior Manager D: 505.998.3275 | C: 505.331.2969 | smontoya@redw.com

expertise. QUESTIONS?