Current through Register Vol. 54, No. 49, December 7, 2024
Section 461b.3 - Gaming vouchers(a) A gaming voucher may not expire. The value of gaming vouchers that have not been redeemed within 3 years of the date of issuance or other period as specified under the Disposition of Abandoned and Unclaimed Property Act (72 P.S. §§ 1301.1-1301.29) shall be forwarded to the State Treasurer along with a report containing the information required under subsection (b)(1)-(4).(b) Each gaming voucher must be designed and manufactured with sufficient graphics or other security measures, to permit, to the greatest extent possible, the proper verification of the voucher. Notwithstanding the forgoing, each gaming voucher must contain the following information:(1) The name or trade name of the slot machine licensee, and if the slot machine licensee is affiliated with a casino licensee in any other jurisdiction with an identical or similar name or trade name, the name of the Pennsylvania location must be evident on the voucher.(2) The date and time of issuance.(3) The value of the voucher, in both numbers and words.(4) A unique serial number, which is automatically generated by the system in accordance with this part and technical standards adopted by the Board.(5) The asset number of the slot machine dispensing the voucher.(6) At least one anticounterfeiting measure, which appears on one or both sides of the voucher.(7) The locations where the voucher may be redeemed and any restriction regarding redemption.(8) A bar code or magnetic strip which enables the system to identify the numeric information in paragraphs (1)-(5) when the voucher is subsequently presented for redemption.(c) A gaming voucher system may not be configured to issue a gaming voucher exceeding $10,000 unless approved by the Board's Executive Director.(d) Any system of internal controls over the issuance and redemption of gaming vouchers must provide for the following:(1) Upon the presentation of a gaming voucher for redemption, the slot cashier or slot machine shall use the gaming voucher system to verify the validity of the serial number and value of the voucher, and if valid, the system must immediately cancel the voucher electronically and permit the redemption of the voucher for the value printed thereon. Prior to the redemption of a gaming voucher, the complete serial number of the unredeemed gaming voucher must only be available to the system.(2) The slot machine licensee shall maintain a record of all transactions in the gaming voucher system for at least 210 days from the date of the transaction.(3) Notwithstanding paragraph (2), the slot machine licensee shall maintain an unredeemed gaming voucher record containing the information required in subsection (b)(1)-(5), for gaming vouchers that have been issued but not redeemed. The record shall be stored in the system for a period of time approved by the Board, which must be at least 3 years from the date of issuance of the gaming voucher, provided that:(i) Any unredeemed gaming voucher record removed from the system after 3 years in accordance with subsection (a) shall be stored and controlled in a manner approved by the Board.(ii) Any unredeemed gaming voucher record removed from the system is subject to the standard record retention provisions of this part.(e) Each gaming voucher system must perform the following functions to control logical access to the system: (1) Generate daily monitoring logs of user access, security incidents and unusual transactions, and immediately notify the information technology department of critical security incidents and unusual transactions.(2) Be capable of assigning rights and privileges to each user, including: (i) The secure administration of a unique system account for each user to provide an adequate segregation of duties.(ii) Adequate password parameters such as lockout, minimum length and expiration interval.(3) Use appropriate access permissions to restrict unauthorized users from viewing, changing or deleting critical files and directories.(4) Utilize encryption for files and directories containing critical or sensitive data, which must include the unredeemed gaming voucher record. Notwithstanding the foregoing, in lieu of utilizing encryption for files and directories containing critical or sensitive data, the slot machine licensee shall design and implement internal controls to restrict users from viewing the contents of such files and directories, which internal controls shall provide for the following:(i) The effective segregation of duties and responsibilities with regard to the system in the information technology department.(ii) The automatic monitoring and recording by the system of access by any person to the files and directories.(f) Each gaming voucher system must perform the following functions to control system operations: (1) Generate daily monitoring logs and alert messages for system performance, hardware problems and software errors.(2) Authenticate the identity of a slot machine or other redemption location from which a transmission of data is received.(3) Ensure that all data sent through a transmission is completely and accurately received.(4) Detect the presence of corrupt or lost data packets and, as necessary, reject the transmission.(5) Utilize an appropriate cryptographic system for critical transmissions of data, such as: (i) Transmissions that include a gaming voucher serial number.(ii) Slot machine meter information.(iii) Other information used in the calculation or verification of gross revenue.(g) Each gaming voucher system must perform the following functions to control the integrity of data:(1) Cause a unique serial number to be generated for each gaming voucher which series number must: (i) Be comprised of at least 18 numbers, symbols or characters.(ii) Contain at least three numbers, symbols or characters, randomly generated in a manner approved by the Board, designed to prevent a person from being able to predict the serial number of any other gaming voucher.(iii) Contain at least one number, symbol or character unique to gaming vouchers, to visually differentiate gaming vouchers from coupons.(iv) Be printed in at least two locations on each gaming voucher.(2) Validate the data type and format of all inputs to critical fields and reject any corrupt data.(3) Provide for the automatic and independent recordation of critical data upon gaming voucher generation and redemption including the details required to be printed on a gaming voucher under this part.(4) Provide for verification of the information contained on a gaming voucher presented for redemption and the unredeemed gaming voucher record to a source that separately records and maintains transaction data, such as an automated transaction log, or other compensating procedure as approved by the Board. The procedure must: (i) Independently verify the accuracy of the gaming voucher serial number and value prior to redeeming the gaming voucher.(ii) Not be used to satisfy other requirements of this chapter.(5) Segregate all security critical system programs, files and directories from other programs and files and directories contained in the system.(h) Each gaming voucher system must be equipped with the following to address continuity: (1) Data redundancy, such as disk mirroring, which writes a complete and duplicate copy of all data on the primary disk to a secondary disk as it occurs, to permit a complete and prompt recovery of all information in the event of any malfunction.(2) Environmental protection, such as an uninterruptible power supply, and fireproof and waterproof materials designed to protect critical hardware from a natural disaster.(3) A backup capability, which enables the slot machine licensee to create periodic backup copies of files and data on a removable storage device, such as magnetic tape, which is separate from the devices required in accordance with paragraph (1).(i) The Board may waive one or more of the technical standards applicable to gaming vouchers adopted by the Board upon a determination that the gaming voucher system as configured nonetheless meets the operational integrity requirements of the act, this part and technical standards adopted by the Board.The provisions of this § 461b.3 amended January 18, 2008, effective 1/19/2009, 38 Pa.B. 354; corrected August 16, 2013, effective 4/5/2008, 43 Pa.B. 4744; amended November 22, 2019, effective 11/23/2019, 49 Pa.B. 6957. This section cited in 58 Pa. Code § 461a.8 (relating to gaming vouchers); and 58 Pa. Code § 1407a.6 (relating to ticket/voucher requirements).