A Practical Work Programme to either compile or update an eGambling operator’s Internal Control System (ICS) document according to the Commission’s V3.0 (January 2010) Guidelines

For the Cover Page : Suggest that the Licensee’s/Applicant’s ‘brand’ mark or logo is displayed
                                  here, together with a reference to the Alderney 2009 Gambling 
                                  Ordnance.  Also, replace ‘the applicant’ with the name of the 
                                  licensee/applicant.  The Signature to be of the licensee’s/applicant’s 
                                  Compliance Officer.

[Appendix C of the Guidelines becomes Appendix A of the Document]
[Appendix E of the Guidelines becomes Appendix B of the Document]

[As the Table of Contents is mandated by the Commission, all sections that do not reflect specific features of the licensee’s/applicant’s ICS will be answered either in the negative or by reference of the vendor’s ICS in the case of bought-in applications or content]

SECTION 1 : CORPORATE STRUCTURE AND STAFFING

[This material should come form a standard corporate profile of the licensee/applicant produced by them and updated to reflect changes as they occur, as this material is also required by the Isle of Man, Malta and presumably other e-gaming regulators, rating agencies, fund mangers, institutional investors etc.  It should not be necessary to re-research this material for each ICS submission/annual update.]

1.1 Corporate Structure

i) This should be a VISIO (or similar) drawing of the organisation chart of the licensee’s/applicant’s ownership.  If it can be made to fit on an A4 page, and still be legible, do so.  Only compile an Appendix if the ownership structure is unusually complicated.

ii) A WORD table (or equivalent) should be provided, citing each owner who has more than 3% of the total capital invested.  Again, if this can be made to fit an A4 page, do so, only resorting to an Appendix if such investors have complicated ownership structures themselves.

iii) A WORD (or equivalent) table should be provided, citing the identity and amount of each capitalisation scheme applicable to the licensee/applicant.  Again, if this can be made to fit an A4 page, do so.  Only provide an Appendix if one or more of such schemes themselves have a complicated ownership structure.

iv) A WORD (or equivalent) table should be provided, citing the identity and amount of each debt instrument applicable to the licensee/applicant.  Again, only provide an Appendix if any of these instruments have themselves a complicated ownership structure.

1.2 Related Gambling Experience and Exposure

[Again, this information should come from the standard corporate profile compiled and maintained by the licensee/applicant]

For the purposes of daily use of the ICS document, the following information should be cited:-

		Other gambling operations outside the Commission’s jurisdiction, under what
		other jurisdiction and the corresponding ‘brand names’
		All URLs, tabulated with the corresponding jurisdiction and ownership

1.3 Organisational Structure

This is best done as a series of hierarchical VISIO (or equivalent) charts, tying-in with the top-level ownership chart provided in Section 1.1, and starting with the top level of the eGaming departmental structure, each department being, in turn, the subject of it’s own dedicated chart.
Changes may be reflected as part of the annual audit/update of the overall ICS document.

1.4 Job Descriptions

This should contain the identities, job titles and job descriptions of the Key Individual Certificate holders.  Updates will be performed as part of the annual audit/update cycle of the ICS document.

There should be a direct tie-in with the organisation charts given in Section 1.3, describing reporting relationships, titles and job functions and major duties, controls and responsibilities.  This may mean at least one further VISIO (or equivalent) diagram.

There should be a detailed description of the skills, qualifications and operational experience for the position held by each Key Individual Licence holder.  A WORD (or similar) table may be the best way to do this.

1.5 Staff Probity

This section should describe the process undergone when an employee joins the licensee/applicant, the continuing process of probity audit/checks applied to each employee (and by whom), and any checks that may need to be done after an employee has left the licensee/applicant.  The latter is of particular relevance when an employee has committed diplomacy offences, including notifiable (to the Government authorities) information security breaches as well as fraud, ‘insider trading’. etc.

1.6 Staff Training

As a minimum, this section should give details and frequency of training courses given to the licensee’s/applicant’s staff in the following areas:-

		Anti-money-laundering
		Problem Gambling/player protection
		Customer verification and identification recognition
		Fraud and Security
		Regulatory control

It is expected that such courses would be of two kinds : general awareness training given to all employees, and advanced courses given to personnel involved in specific areas of the business, such as payment & fraud and what is generally known as ‘Know Your Customer’ (KYC).

1.7 Compliance Officer

Define the name, place in hierarchy, Company Role and duties of the licensee’s/applicant’s Compliance Officer.

These duties should be recorded as including ensuring continuing compliance with the Commission’s regulations (which may mean heading a formal Compliance Team). Also, a detailed description should be given of the remit of the Compliance Officer, which must include:-

		Maintaining Key Individual Certificates
		Notification of licensee’s/applicant’s ownership changes
		Maintaining both initial and continuing due diligence of all Foreign Business
		Associates of the licensee/applicant and their relationships
		Notifying the Commission of any compliance failures

1.8 Money Laundering and Terrorist Finance

This is now very mush a specialisation in itself, and the amount of material needed tio maintain an ICS section for AML/CFT merit’s a separate document, to be cross referenced here.

This document, best thought of as the Anti-Money Laundering/Countering Terrorist Financing (AML/CFT) Guide, would be drawn up using the Commission’s AML/CFT Guidelines and cover the following ICS sections to a level that satisfies the Commission.

		General Guidance (ICS Guidelines Section 1.8.1)
		Money Laundering Reporting Officer (MLRO) (Section 1.8.2)
		Business Risk Assessment (Section 1.8.3)
		Monitoring of Customer Transactions (Section 1.8.4)
		Report of Suspicious Transactions (Section 1.8.5)
		Recording of MLRO Activity (Section 1.8.6)

1.9 External Consultants and Associates

[Note : the AML/CFT aspects of the licensee’s/applicant’s dealings with External Consultants and Associates would be dealt with in the AML/CFT Guide]

This ICS section must include, as a minimum:-

		All parts of the licensee’s/applicant’s eGambling operation contracted out to 
		third parties (if there are none, say so)
		Management and/or Service level Agreements - include these as ICS 
		Appendices, and cross-refer to them.  A  list given here of External 
		Consultants and Associates would be useful.

1.10 Due Diligence of Foreign Business Associates

This section to include, as a minimum:-

		Licensee’s/applicant’s use of services provided by Foreign Business 
		Associates (FBAs), including role, service(s) provided and the business 
		relationship
		Licensee’s/applicant’s controls on the activities of all FBAs engaged
		Refer to due diligence documents (provided separately) compiled for FBAs
		Not operating in the Commission’s jurisdiction
		Description of the continuing due diligence process for each FBA engaged
		by the licensee/applicant
		Description of the business function provided by each FBA, and cross-
		reference with the appropriate ICS section

1.11 Internal Audit Function

This ICS section should describe the licensee’s applicant’s Internal Audit function in terms of:-

		Reporting Structure
		Processing
		Operations
		Responsibilities
		Scope
		Review and Appraisal of the Internal Audit function with respect to
		Commission’s Regulation 18b (Compliance)

An Internal Audit section of the AML/CFT Guide would describe how the incense’s/applicant’s AML/CFT programme meets the Commission’s Regulation 18b in terms of:-

		Business Risk Assessment accuracy and relevance to current operations
		Level of compliance with AML/CFT procedures
		Reporting of non-compliance with the AML/CFT programme to the 
		appropriate level of the licensee’s/applicant’s organisation
		Reporting of any weakness in the licensee’s/applicant’s organisation that 			impacts AML/CFT principles
		Improvements to the licensee’s/applicant’s AML/CFT programme top remedy 
		these weaknesses

1.12 Premises

Identify the hosting providers of the licensee’s/applicants eGambling operations.  Where these are internal to the organisation, as opposed to Cable and Wireless, for example, say so, including the address.

Where such providers are Business Associates, describe then in accordance with Ordnance 4 of Part 3 of the Commission’s eGambling Regulations, including the address.

Describe the security and Access Control procedures ]work with the licensee’s/applicant’s Information Security Team to achieve this, or, if necessary, cross-reference with the licensee’s/applicant’s PCI-DSS accreditation] for the eGambling operation’s premises, where this is not a Commission-certified provider such as Cable & Wireless.

1.13 Disaster Recovery

Provide a detailed description of the licensee’s/applicant’s Business Continuity/Disaster Recovery (BC/DR) plan for their eGambling operation.  

[The source material for such a description should already be available from the licensee’s/applicant’s BC/DR Analyst]

This must include:-

		Protection of customer entitlements
		Audit trail up to point of disruption
		Mitigation of lost data risks [through data mirroring?]
		BC/DR Officer in Charge, who maintains and updates the BC/DR plans
		Emergency procedures
		Fallback and relocation procedures [to Backup Data Centre?]
		Resumption Procedures [to Primary Data Centre?]
		Review & Testing of BC/DR Plans
		Procedure for timely and orderly closedown of the IT system [presumably if
		the backup data centre fails], including bet refunds and account balance 
		Repayment
		Source code backup [presumably at the backup data centre]
		Minimising disruption of customer services [seamless cutover to BDC?]
		Preservation of data in order to facilitate resumption of normal eGambling 
		Services [again, data mirroring?]

Provide a detailed description of how to ensure Alderney operations are resumed within the Bailiwick of Guernsey [Combination of C.I. And mainland data centres as per Gala Coral?]

Provide a detailed description of the mitigation of the risk of unlicensed operators under extreme conditions [Does this mean “hacking” bringing the system down or even hijacking it?]

If BC/DR business operation resumption within the C.I. Is unavailable, describe the regulatory transfer [to such as to the UK Gambling Commission, for example] process.

SECTION 2 : ACCOUNTING SYSTEMS

[Much of this information ought to be available form a ‘corporate profile document maintained by the licensee/applicant for distribution to interested parties.  If this is not available, as well as where necessary, work with the	licensee’s/applicant’s Accounting staff to compile the information for this ICS section]

2.1 Accounting Systems

Quote form the licensee’s/applicant’s corporate profile the following:-

		Basis of Accounting
		Depreciation
		Foreign Currencies
		R&D
		Pension Costs
		Leases

2.2 Chart of Accounts

[This should be available from the licensee’s/applicants corporate profile or Annual Report]

[It should be the latest available, and must be replaced as part of the annual audit/update process]

2.3 Internal Accounting Controls

i) A copy of the complete scheme from the licensee’s/applicant’s corporate profile.  This should, in practice, meet the Commission’s requirements in this area.

ii) Describe the periodic internal accounting control review procedure [again, from the corporate profile].  Describe the procedure for reporting internal accounting controls’ weaknesses, and to whom [again, from the corporate profile].

2.4 Management Accounts

	2.4.1 Internal Reporting

	         The licensee’s/applicants corporate profile should provide the following:-

		i) Internal management reporting procedures

		ii) Example [replaced annually] of internal accounts, plus the timetables and 
		   procedures for their review

	2.4.2 External Reporting

	        Describe the procedures [work with the licensee’s/applicants Accounting staff to 
	        achieve this] to provide:-

		Monthly Schedule 17 Reports

		Quarterly Schedule Reports

		Quarterly Schedule 19 Reports (where appropriate)

	2.4.3 Financial Ratios

		Describe the procedure to produce monthly Schedule 20 Reports

		Capital adequacy [should come form the corporate profile]

		Demonstrate capital adequacy [the balance sheets, receipts etc. should be
		available form the corporate profile]

2.5 Budgets

      Recording, preparatory approval and review-update procedures for the licensee’s/ 
      applicant’s eGambling operating budgets

2.6 External Audit

	The following should be available form the corporate profile:-

		Appointed external auditor
		Fiscal year end date
		Annual audit timescale

	 [Double-check R246 and R247 provisions with the licensee’s/applicants Accounting 
               staff]

2.7 Accounting Software

	Whose?
	Backup/Recovery Procedure for data?
	Short-tern and Long-term storage?

	[this may be available form the corporate profile]

	2.7.1 Standard Forms

		Document Control procedure?

	2.7.2 Computer Controls

		Who has access?
		How? Passwords?
		Access Rights Grand/Remove?
		Access Rights Review procedure?

		{licensee’s/applicant’s Information Security personnel should know this]

2.8 Record Retention Policy
	      
	For accounting, banking, corporate and customer records
	      In what form?
	      Where?
	      For how long?

	[again, likely corporate profile material]

2.9 Bank Accounts

	Authorisation?
	Purpose?
	Maintenance procedure?
	Reconciliation/Approval process?

	[again, likely corporate profile material]

	2.9.1 Account Signatories

		Who?
		Appointment/Removal?

		[again, likely corporate profile material]

	2.9.2 Customer Funds

		Segregated/protected Status?  {presumes corporate profile material]
		Information security concerns on segregation/protection status?

		Bank Account Statements [ICS Appendix, replaced annually]

		Bank Account Controls:-

			Transfer Controls?
			Transfer Regularity?
			Reconciliation?
			Independent Review?
			No offsets?  No securities liability?

		[Again, the above to be likely corporate profile material]

2.10 Bad Debts 

	Review?
	Bad Debt Recovery?
	Write-offs? When?

	[Again, likely corporate profile material]

2.11 Agency Arrangements

	With Whom?
	Receipt?
	Payment?
	Recovery?
	Reconciliation?

	[Again, likely corporate profile material, if not necessarily identifying specific 
	 business associates]

2.12 Asset Classification and Control

	[One would expect to find this in the corporate profile document]

	2.12.1 Accounting For Assets

		Asset Inventory Maintenance Procedure

	2.12.2 Information Classification

		Security/protection for :

			Customer records
			Accounting information
			Statistics
			Transaction histories

		[licensee’s/applicants Information Security staff would be the 
			 alternative source for this information]

2.13 Jackpot Accounting

	Accounting Controls?
	Audits for both jackpot and diversion pools?
	Daily Reconciliation procedures?

	i) Ensure jackpot/RTP calculations; calculations not assimilated into revenue

	ii) Non promotional jackpot reconciliation procedures?

		a) must have been paid out as prizes
		b) displayed as part of prizes
		c) Held in separate accounts?

2.14 Registers

What form are these in?

Hard copy production procedures?

These registers must contain:-

	a) All contracts over £15,000 made in the last 12 months
	b) Charity contributions, broken down into categories of source for a given calendar 
                 year.

SECTION 3 : CUSTOMER REGISTRATION, VERIFCATION, BANKING AND MANAGEMENT

[The content of this Section will be provided by the Payment & Fraud/KYC Team of the licensee/applicant.  It will be a reflection of the actual procedures in place at the time of ICS publication/re-submission as part the annual audit.  Advantage should be taken of existing internal documentation produced/maintained by the licensee/applicant, to save time and effort.  If it necessary to produce the while section of the ICS, allow for this in the ICS drafting/update project.]

	3.1 Terms Covering Customers’ Accounts

[This sub-section should describe the Customer Registration procedure, as a new customer would encounter it, including the appropriate screens - perhaps taken from the actual transaction?]

The Customer Registration process, as described, must include:-

3.1.2 Terms & Conditions

	   [Copy of the T’s and C’s as an ICS Appendix]

3.1.3 Terms & Conditions for Promotional Programmes

	   [Cite appropriate sections/clauses as shown in the T’s and C’s ICS 
           Appendix]

3.1.4 Privacy

	   [Licensee’s/Applicant’s eGambling Privacy and Data Protection polices
	    - may mean another ICS Appendix]

	3.2 Customer Verification and Identification

	      3.2.1 Customer Due Diligence

	  [Process, with screens and procedures, as carried out by licensee’s/ 
          applicant’s Payment & Fraud/KYC Team]

3.2.2 Customer Extended Due Diligence

	  [Process, with screens and procedures, as carried out by licensee’s/ 
          applicant’s Payment & Fraud/KYC Team]

3.2.3 Third Party Verification process

	  [Process, with screens and procedures, as carried out by licensee’s/ 
          applicant’s Payment & Fraud/KYC Team]

3.2.4 Jurisdictional/Location Controls on Registration

         i) [Risk Assessment procedure - as actually carried out]

         ii) [International trade controls 	  [Process, with screens and procedures, as
              carried out by licensee’s/applicant’s Payment & Fraud/KYC Team]

3.2.5 Multiple Customer Accounts

         [Describe the licensee’s/applicant’s Multiple Accounts process, with screens 
          and procedures, as carried out by licensee’s/applicant’s Payment & 
          Fraud/KYC Team.  If multiple accounts not allowed, say so.]

3.2.6 Customer Account Access

         [Describe the licensee’s/applicants Customer Account Access process, with
          Screens and procedures.  Also, cite all security measures, including lost ID
          /password procedures.  Process to include direct and indirect customer 
          access]

3.2.7 Change In Details

	  [Describe the licensee’s/applicants Change In Details process, with screens 
          and procedures, as carried out by licensee’s/applicant’s Payment & 
          Fraud/KYC Team.]

3.2.8 Ongoing Customer Due Diligence

	  [Describe the licensee’s/applicant’s Ongoing Customer Due Diligence 
          process, with screens and procedures, as carried out by licensee’s/ 
          applicant’s Payment & Fraud/KYC Team]

	3.3 Customer Funds On Account

	      3.3.1 Currency Selection

		  [Cite currencies accepted by the licensee/applicant]

		  [Cite exchange rate process, with screens and procedures, for dealing 
		    with other currencies offered by customers]

	      3.3.2 Deposits

		  [Cash must not be accepted - check!]

	  [Describe the licensee’s/applicant’s Deposit Monitoring process, with 
	   screens and procedures, as carried out by licensee’s/applicant’s Payment & 
         Fraud/KYC Team]

	  [Describe deposit mechanisms : Credit Card, Debit Card, wire transfer,
	   Certified Banker’s Draft, etc.]

	  [Describe the deposit mechanism AML/CFT controls - cross-reference with 
          the AML/CFT Guide]

	  [Describe the licensee’s/applicant’s Multiple Deposit mechanism - process, 
          with screens and procedures, as carried out by licensee’s/applicant’s 
          Payment & Fraud/KYC Team]

	  [Describe the licensee’s/applicant’s Customer Accounts with funds audit
          process, with screens and procedures, as carried out by licensee’s/
          applicant’s Payment & Fraud/KYC Team]

	  [Describe the licensee’s/applicant’s Unconditional Deposit of Conditioned
          funds process, with screens and procedures, as carried out by 
          licensee’s/applicant’s Payment & Fraud/KYC Team]

3.3.3 Credit Extended to Customers

         [If credit not extended to customers - say so!]

         [Otherwise, describe the licensee’s/applicant’s credit allotment process, 
          with screens and procedures, as carried out by licensee’s/applicant’s 
          Payment & Fraud/KYC Team]

         [Also, describe the process preventing customers “going overdrawn” on their
          accounts, with the screens and procedures, as carried out by the 
          licensee’s/applicant’s Payment & fraud/KYC Team]

3.3.4 Account Management

	  [Describe the licensee’s/applicant’s Wager Debiting process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
          Fraud/KYC Team]

	  [Describe the licensee’s/applicant’s Prize/Winnings/Jackpot auditing
          process,  with screens and procedures, as carried out by 
          licensee’s/applicant’s Payment & Fraud/KYC Team]

	  [Describe the licensee’s/applicant’s Accounting process,  with screens 
         and procedures, for transferring customer funds between business 
         associates, as carried out by the licensee’s/applicant’s Payment & 
         Fraud/KYC Team.  This may mean an ICS Appendix if there are several 
         such business associates]

         [Describe the nature and location of the financial transactions audit log]
         [Do not forfeit customer funds in a customer account - describe how this is
          prevented, with procedures and screens if necessary]

         [Describe the licensee’s/applicant’s Unfulfilled Bonus Awards process,  with
          screens and procedures, as carried out by licensee’s/applicant’s Payment &
          Fraud/KYC Team]

         [Cite any ‘passed on’ transaction costs - this may be a specific process.  If 
          so, give the screens and procedures, as carried out by the licensee’s/ 
          applicant’s Payment & Fraud/KYC Team]

3.3.5 Withdrawals from Customer’s Funds

	  [Describe the licensee’s/applicant’s Withdrawal process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team]

        [State limits on withdrawals, with any procedures, screens, etc. as carried out
         by the licensee’s/applicant’s Payment & Fraud/KYC Team]

        [State any transaction charges and fees, with any accompanying  screens 
         and procedures, as actually carried out by the licensee’s/applicant’s 
         Payment & Fraud/KYC Team]

        [State the time limit after which a customer may not cancel a withdrawal]
	  [Describe the licensee’s/applicant’s Customer Funmds Transfers process,  
         with screens and procedures, as carried out by licensee’s/applicant’s 
         Payment & Fraud/KYC Team.  Include any specific security measures]

3.3.6 Rejected Transactions

	  [Describe the licensee’s/applicant’s Rejected Transactions process,  with 
	   screens and procedures, as carried out by licensee’s/applicant’s Payment &
          Fraud/KYC Team]

3.3.7 Customer Activity Statement

         [Describe the process, with any screens and procedures, for the production 
          of such Statements by the licensee’s/applicant’s Payment & Fraud/KYC 
          Team.  Also, include the customer transactions needed to initiate the 
          production of such a Statement.   Include the hard copy production 
          process.]

	3.4 Closing Accounts

3.4.1 Inactive Accounts

	  [Describe the licensee’s/applicant’s Inactive Accoiunt process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
          Fraud/KYC Team]

3.4.2 Deactivating or Closing a Customer’s Account

	  [Describe the licensee’s/applicant’s Deactivating/Closing a Customer’s 
          Account process,  with screens and procedures, as carried out by 
          licensee’s/applicant’s Payment & Fraud/KYC Team]

        [This should be a withdrawal process - check when compiling the ICS doc.!]

3.4.3 Seized Accounts

	  [Describe the licensee’s/applicant’s Seized Account process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
          Fraud/KYC Team]

3.5 Customers At Risk

3.5.1 Minors

	  [Describe the licensee’s/applicant’s process for preventing Minors gambling,
          with screens and procedures, as carried out by licensee’s/applicant’s 
          Payment & Fraud/KYC Team.  Also check that this process deals with 
          cases where Minors are posing as over 18s in order to gamble.]

3.5.2 Problem Gambling

	  [Describe the licensee’s/applicant’s Problem Gambling process,  with 
         screens and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team.  Check that adherence to GAMCARE and similar 
         organisations is in place.]

3.5.3 Licence Limitation of a Customer’s Gambling Activity

	  [Describe the licensee’s/applicant’s process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team.  Also check that House Limits and Involuntary Exclusion 
         controls are in place.]

3.5.4 Customer Self-Exclusion

	  [Describe the licensee’s/applicant’s Customer Self-Exclusion process,  with 
         screens and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team.  Ensure that player protection and self-imposed limits are 
         included.] 

3.5.5 Player Protection Limitation

	  [Describe the licensee’s/applicant’s Player protection limitation process,  with 
         screens and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team.  Include links to external Player Protection organisations]

3.5.6 Promotion of Treatment, Research and Education concerning Problem 
         Gambling

         [Cite the licensee’s/applicant’s policies in this area]

	  [Describe the licensee’s/applicant’s processes in these areas, intended to 
          implement these Policies,  with screens and procedures, as carried out by 
          licensee’s/applicant’s Payment & Fraud/KYC Team]

         [Cite the licensee’s/applicant’s nominated charities, and the corresponding 
          charitable donations]

3.6 Accepting Wagers

3.6.1 Real Play

	  [Describe the licensee’s/applicant’s Real Play process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team]

3.6.2 Fun Play

	  [Describe the licensee’s/applicant’s Fun Play process,  with screens 
         and procedures, as carried out by licensee’s/applicant’s Payment &
         Fraud/KYC Team]

3.7 Customer Complaints

Describe the licensee’s/applicant’s Customer Complaints process,  with screens, procedures and management reporting ’lines’ as carried out by licensee’s/applicant’s Payment & Fraud/KYC Team.  This may mean a VISIO (or equivalent) diagram and an ICS Appendix if the process is a complicated one.

3.8 Registers

Describe the licensee’s/applicants Gambling Information registers, in terms of what they are and where they are held.  Also describe any access control mechanisms and other information security measures, in view of the sensitivity of much of this material.

SECTION 4 eGAMBLING

	4.1 Hosting Premises

	      [Cite Commission-approved premises in terms of name and provider’s premises]

	      [Full description of non-Commission-approved premises : name, contractor and
	       Certification status.  This may mean access controls as well.]

	4.2 Alderney Branding

	      [Show licensee’s/applicant’s Home Page, and highlight Commission’s logo with
	       ‘circle and pointer’]

	4.3 Random Number Generator (RNG) Requirements

[Form a temporary joint team with the licensee’s/applicant’s Games Development Staff, and quote available information on the following]

4.3.1 General

	   [Cite RNG used]

4.3.2 RNG Suitability

	  [Cite available information on the following]

		Statistical independence
		Uniform distribution
		Tests taken and passed
		Verifiable unpredictability
		Verifiable outcomes

4.3.3 Failure

	   [Cite licensee’s/applicants procedures for dealing with RNG failure]

4.3.4 RNG Seeding

	   [Cite licensee’s/applicant’s seed set generation and re-seeding policies, with
           processes, screens and procedures]

4.3.5 Mapping and Seeding Algorithms
	
	  [Describe licensee’s/applicants algorithms used to achieve Guidelines’ 
         objectives]

4.3.6 Information on Return to Player

         [Cite Game Rules section for each game offered by licensee/applicant that
	    states the RTP percentage]

	4.4 Customer Game Session

4.4.1 Customer Game Session

         [Describe the game session control mechanism used by the licensee/ 
         applicant, if one exists.  If not, state what alternative method is used, and
         why not!]

4.4.2 Terminating a Customer Game Session

	   [Describe how this is done, and the specific method used]

4.4.3 Transaction Logging

	   [Describe the licensee’s/applicant’s offsite transaction logging process : how 
           when and where, and in relation to daily backups]

	4.5 Malfunctioning and Non-Responsive Games

4.5.1 Malfunction
	   
	   [Describe the licensee’s applicant’s Malfunctioning Game process, including 
           voiding bets and returning customers’ funds]

4.5.2 Non-Responsive Games

	   [Describe the licensee’s/applicants Non-Responsive Game process 
           /procedures.  This may include voiding bets and returning customers’ 
          funds]

	4.6 Foreign Business Associates (Connecting to External Gaming Systems)

[Provide as an ICS Appendix, citing the business relationship, technical implementation and information security measure appropriate to each Foreign Business Associate of the licensee/applicant]

	4.7 eGambling Requirements

[This will need to be drawn up with in close consultation with the Games Development staff of the licensee/applicant.  This will mean a temporary joint team assigned to this task, as the consultation and drafting will be extensive and prolonged, particularly when compiling a ‘new’ ICS document from available information]

[The following subjects must be covered, as set out in the ICS Guidelines]

4.7.1 Game Fairness

4.7.2 Game Play Duration

4.7.3 Non-Adaptive Behaviour by Games

4.7.4 No Forced Game Play

	4.8 Game Design

[This depends on how much internally-generated game content os being offered by the licensee/applicant.  For bought-in content, cite the appropriate ICS section of the supplier]

[For internally-generated content, form (or continue) a temporary team with the Games Development staff of the licensee/applicant and work through the following ICS headings as shown in the Guidelines]

4.8.1 General

4.8.2 Instructions and Information

4.8.3 Game Disable

4.8.4 Incomplete Games

	4.9 Requirements For Games Against the House (not P2P)

[Again, form or continue a temporary joint team with the licensee’s/applicant’s Game Development Staff where appropriate for internally-generated content.   For bought-in content, again cite the appropriate section of the vendor’s ICS]

4.9.1 Multi-Customer games

4.9.2 Multi-Operator Games

	4.10 Game Artwork (Information Displayed)

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.10.1 Game Display Requirements

4.10.2 Bet Display

4.10.3 Result Display

4.10.4 Wheel (Reel) Requirements Symbol-Price Relationship

[NB : GUIDELINES NUMBERING INCORRECT FROM HERE ONWARDS UNTIL SECTION 4.12]

4.10.5 Number of Symbols Required For a Prize

4.10.6 Shared Pay Scales

4.10.7 Mixed Or Grouped Symbols

4.10.8 Tabulated Prize For Multiple Credits Staked

4.10.9 Winning Line Plays (Pay Lines)

4.10.11 Staggered Plays

4.10.12 Scatters

[NB : WHAT HAS HAPPENED TO SECTION 4.11 - WHEEL REQUIREMENTS?]

	4.12 Positioning, Size, Colour and Shape

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.12.1 One Symbol/Prize Instructions

4.12.2 Global Instructions

4.12.3 Colour of Message

4.12.4 Shape of Symbols

4.12.5 Reference to Symbols

	4.13 Substitutes

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.13.1 Substitute Symbols

4.13.2 Substitutes and Coinciding Wins

4.13.3 Substitutes Participating in Scattered Wins

4.13.4 Unusual Substitutes

4.13.5 Change of Substitutes

4.13.6 Substitutes and Extra Pays

	4.14 Winning Patterns

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.14.1 Patterns

4.14.2 Scatters Patterns

4.14.3 Potential Winning Patterns

4.14.4 Difficult Patterns

4.14.5 Standard Line Wins

4.14.6 Extra Lines

4.14.7 Displaying Pay Lines

4.14.8 Coinciding Winner Rules

4.14.9 Miscellaneous Symbols

	4.15 Features

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.15.1 Feature Trigger Patterns

4.15.2 Feature Re-Triggers

4.15.3  Tokens Accumulation

4.15.4 Free Games

4.15.5 Re-Spins/Held Reels

4.15.6 Bonus Prizes

4.15.7 Metamorphic Sequences

4.15.8 Held Reel Games

	4.16 Keno and Bingo Artwork Requirements

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.17 Card game Artwork Requirements

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.18 Gamble Option Artwork Standards

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.18.1 Limits

4.18.2 Automatic Exit

4.18.3 References

4.18.4 Conditions

4.18.5 Choices of Multipliers

	4.19 Roulette

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.20 Dice Games

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.21 Simulated Wagering

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.22 Scratch Ticket

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.23	Video Poker

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.24 Blackjack

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.25 Live Gambling Studio Control Guidelines and Standards

[This may have already been covered, perhaps as an ICS Appendix if this facility is provided by a Business Associate.  If so, refer to the relevant Appendix and sub-heading(s) here]

[The following headings must be covered if the licensee/applicant’s Live Gambling facility or facilities are an internally generated offering]

4.25.1 Live Gambling Equipment (LGE)

4.25.2 Cards

4.25.3 Card Games

4.25.4 Roulette

4.25.6 Customer interface

4.25.7 Surveillance and Security System Environment

4.25.8 Reports and Records

4.25.9 Studio and Pit Controls

	4.26 Event Based Wagering

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[If the EBW is a bought-in facility, refer to the relevant section opf the vendor’s ICS, whereas if the EBW is an internally-generated facility he following ICS Guideline sub-headings must be covered]

[NB : Numbering here deviates from the published ICS Guidelines in order to provide a more legible and hence usable document]

4.26.1 [Technology]

4.26.2 [Security Risks]

4.26.3 [Products and Services]

4.26.4 [List of Main Events]

4.26.5 [Internal Financial Risk Management]

4.26.6 [Licensee’s Commission Structure]

4.26.7 [In-Running Betting Processes]

4.26.8 [Event-Based Fraud Management]

	    [Fill-in this sub-section in association with the licensee’s/applicant’s 
           Payment & Fraud Team]

4.26.9 [Results Publication]

4.26.10 [Wager Settlement Process]

	      [Again, this sub-section to be completed in association with the licensee’s/ 
             applicant’s Payment & Fraud/KYC Team]

4.26.11 [Corporate Client Wager Management]

             [Again,  this sub-section to be completed in association with the  
              licensee’s/applicant’s Payment & Fraud/KYC Team]

4.26.12 [General Risk Management Programme]

	4.27 Other Games

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

	4.28 Peer-to-Peer Games (P2P)

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

[The author has departed from the numbering suggested in the Guidelines here, in order to produce a more usable numbering scheme from a practical day-to-day usage viewpoint]

4.28.1 Games Room

4.28.2 Jurisdictional Configuration

4.28.3 P2P Room Management

4.28.4 P2P Game Room

4.28.5 Customer Management

          [Complete this in association with the licensee’s/applicant’s Payment & 
           Fraud /KYC Team]

4.28.6 Table & Game Management

4.28.7 Rake and Fees

          [Again, complete this in association with the licensee’s/applicant’s Payment 
           & Fraud/KYC Team]

4.28.8 P2P Security

	    [Complete this in association with the licensee’s/applicant’s Payment &  
           & Fraud/KYC Team.  Cross reference where necessary with AML/CFT 
           Guide]

4.28.9 Proposition Players

4.28.10 Bots and Other Automation

4.28.11 Specific Forms of P2P Gambling

	      4.28.11.1 P2P Books, Pari-Mutuel Books or Bet Exchanges

	      4.28.11.2 Poker

	4.29 Jackpots and Promotional Jackpots

[Again, a subject for a joint team formed with the Games Development Team of the licensee/applicant.  Detailed descriptions within this ICS Section should only apply to internally-generated content, as bought-in material may be covered by referring to the relevant section of the vendor’s ICS]

[The following ICS Guideline sub-headings must be covered]

4.29.1 Jackpot Fairness

4.29.2 Jackpot Wins

4.29.3 Notification of the Jackpot Amount

4.29.4 Jackpot Game Rules

4.29.5 Jackpot Parameter Changes

4.29.6 Promotional Jackpots

4.29.7 Partial Jackpot Redirection

4.29.8 Jackpot Financial Liability Documentation

           [This will need to be completed in association with the licensee’s/ 
            Applicant’s Accounting and Legal Staff]

4.29.10 Jackpot Recovery

4.29.11 Multi-Operator Jackpots

4.29.12 Jackpot Controller

	4.30 Registers

[Describe the nature of the essential gambling information registers, and where they are held.  In view of the sensitivity of this information, the access control processes will need to be documented]

[Describe the update procedure]

[Describe the hard-copy production procedure]

[Describe the Commission’s oversight procedures form the licensee’s/ applicant’s viewpoint]

[Confirm the list oif contents as defined in the ICS Guidelines]

SECTION 5 : COMPUTER CONTROLS

[This will require the formation of a temporary team with one or more members of the licensee’s/applicant’s Operations and Information Security staff to answer/correct the points raised by this Section of the ICS Guidelines]

	5.1 Computer Controls

Need to describe:-

	Each class of Computer Account used to operate the IGS

	The Access Control List, with privileges in terms of area and degree of 
       Access, for each person involved in the licensee’s/applicant’s IGS operations.

	Recurrent IT Procedures, as implemented by the licensee’s/applicant’s IT 
      Operations staff.

Provide a diagram (which should already be in existence) of all the servers comprising the licensee’s/applicant’s IGS as an ICS Appendix, labelled accordingly [A3 size].

Provide a diagram (which also should already be in existence) of the network on which the licensee’s/applicant’s IGS is built upon, showing the IP addresses, as an [A3 size] Appendix to the ICS.

	5.2 Information Security 

5.2.1 Information Security Policy Document

	   [ICS Document Appendix - licensee’s/applicant’s Information Security staff 
          to provide]

5.2.2 Data Destruction Policy 

	   [Copy of licensee’s/applicant’s current Policy document, provided as an 
          Appendix to the ICS, by the Information Security staff]

5.2.3 Information Security Infrastructure

	   [Provide a description of the complete Information Security infrastructure of 
           the licensee/applicant. Diagram to be provided as an Appendix to the ICS 
           document, to which reference will be made.  This material should already 
           have been compiled by the licensee‘s/applicant‘s Information Security staff]

5.2.4 Security of Remote Access

	   [Provide a copy of the licensee’s/applicant’s Remote Computer Use Policy]

	   [Provide further information in terms of employment, contracts (such as 
          service contracts) and security checks for non-employees.  This information 
          to be provided by the licensee’s/applicant’s Information Security staff]

5.2.5 Outsourcing

	   [Licensee’s/applicant’s Information Security staff to provide details of the 
          security measure taken to mitigate the risks posed by outsourcing parts of 
          the licensee’s/applicant’s eGambling operation]

	   [Provide as copy of the Policy document in this area]

5.2.6 Personnel Security

	  [Licensee’s/applicant’s Information Security staff tp provide details of the 
          measures taken to ensure Security and job definition and user training]

	   [Provide a copy of the Policy document]

5.2.7 Responding to Security Incidents and Malfunctions

	   [Provide a copy of the licensee’s/applicant’s Computer Security incident 
          Response Team (CSIRT) Charter]

	   [Provide a copy of corresponding Policy document]

5.2.8 Equipment Security

	   [Licensee’s/applicant’s Information Security staff to provide details of:-

		Firewall/Intrusion Detection system
		Security measures applied to information storage
		Continuing penetration testing/perimeter security programme]

5.2.9 System Maintenance Controls

	   [Licensee’s/applicant’s Information Security staff to provide details of:-

		Implementation of security controls that accompany a software 
                   Upgrade
		Authentication and validity checks within the IGS
		Data encryption and other cryptographic controls
		Secure maintenance of all files, including source code for in-house-
                   generated content
		Maintenance and support arrangements for the gaming software - 
                   cross reference with the vendors’ ICS for bought-in content
		Third Party arrangements and accompanying security requirements
		Malicious software protection, in detail
		Audit controls
		Record retention policy, with Policy document (an ICS Appendix) and 
                   supporting information in terms of duration and nature of records 
                   kept]

5..2.10 Access Controls

	    [Provide Access Control Policy document as an ICS Appendix]

	    [Licensee’s/applicant’s Information Security staff to provide additional 
            information for:-

		Password and other access controls to the IGS
		Differing levels and rights of access to the IGS
		User obligation for their access rights
		Network access controls
		Prevention of unauthorised access to the IGS
		Access to individual parts of the IGS]

5.2.11 Operating System Security 

	   [Licensee’s/applicant’s Information Security staff to provide full details of 
           their Operating System Security Policy, with a copy of the Policy document 
           (as an ICS Appendix) and supporting information regarding access 
           controls to the IGS operating system]

5.2.12 Architectural/Physical Controls

	   [Licensee’s/applicant’s Information Security staff to provide details of the 
          security measures taken in this area, with the Policy document as an ICS 
          Appendix.]

5.2.13 Application Level Firewalls

	   [Licensee’s/applicant’s Information Security staff to provide details of:-

		Risk Analysis
		Design - fulfilment of defence-in-depth principles
		Prevention of alternative portals that circumvent the firewalls
		Implementation of stand-alone firewall IT system
		Configuration of firewall ‘rules’
		Firewall audit logs, and accompanying communications cut-out
                   if these logs become full]

5.2.14 Self-Monitoring

	   [Licensee’s/applicant’s Information Security staff to provide details of the 
          self-monitoring system applied to the IGS under consideration]

5.2.15 Network Encryption

	   [Licensee’s/applicant’s Information Security staff to provide details of the 
          network encryption scheme applied to the IGS under consideration]

5.2.16 Encryption Key Handling

	   [Licensee’s/applicant’s Information Security staff to provide details of the 
          encryption key handling policies, process and procedures applied to the 
          IGS under consideration]

	5.3 Software Development, Testing, Maintenance and Approval

[This will require a temporary joint team with the licensee’s/applicant’s Games Development, Software Testing and Compliance Teams]

[These teams of licensee/applicant staff must provide the processes and procedures in the following areas of in-house-developed content.  For bought-in content, cross-reference with the vendors’ ICS documents]

5.3.1 Source Code

5.3.2 Development Environment

	  [Must be separated from the ‘production’ environment - check for this!]

5.3.3 System Testing and Validation

5.3.4 Fault Reporting

	   [Include description of Help Desk processes]

5.3.5 Problem Reporting and Management Processes

	   [Include procedure for linking the Help Desk to enhancement and ‘bug fix’ 
          release procedures]

5.3.6 Approval of Gambling Equipment

	   [Include procedure to submit ‘bug fixes’ to the Commission for final release
          and installation on licensee’s/applicants IGS.]

	   [Describe Change Control Board (or equivalent) procedure]

	5.4 Equipment

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

5.4.1 Location

5.4.2 Hardware Reliability	[*GUIDELIES NUMBERING CORRECTED HERE*]

5.4.3 Operating System Reliability

	5.5 Network

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

5.5.1 Network Power Supply

5.5.2 Self Monitoring

5.5.3 Accounting of Master Resets

	5.6 Domain Name System (DNS) Requirements

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

[Provide IP Address/DNS Name Mapping Chart]

[Provide Primary DNS Server process/procedures/screens]

[Provide Secondary DNS Server process/procedures/screens]

[Provide Zone Transfer process/procedures/screens]

	5.7 Communications

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

5.7.1 Repeat Play

5.7.2 Message Authentication

5.7.3 High Level Protocol

5.7.4 Time Stamps

5.7.5 High Level Interface with Lower Level Protocols

5.7.6 User Inactivity Timeout

5.7.7 Requirement For Authentication

	5.8 Database and Information

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

5.8.1 Data Recovery

5.8.2 Recordable Events

5.8.3 Significant Events

5.8.4 Information To be Maintained

5.8.5 System and Offsite Logger

	   Encrypted Audit Logger

	   Off Site Data Logger

	5.9 External Wagering System

[The licensee’s/applicant’s Operations Team will need to provide this information, form a temporary joint team accordingly]

[The information provided must cover the sub-headings below]

5.9.1 Interface With External Wagering System

5.9.2 Wagering Process

5.9.3 Winner Update	[*GUIDELINES NUMBERING CORRECTED*]	

5.9.4 Wagering Information	[*GUIDELINES NUMBERING CORRECTED*]

	5.10 Registers

The licensee/applicant will supply details of each Register of the hardware/ software/operating system/applications/communications equipment described in this Section of the ICS.  Define the nature of these Registers (spreadsheets?), the access controls, responsible personnel. Physical location and backuip procedures.]