Summary of Compliance Requirements of Government of Malta

Malta Lotteries & Gaming Authority (LGA) E-Gaming Governance

The Government of Malta regulates electronic gaming under the provisions of their Remote Gaming Regulations, which have been issued as a Legal Notice of their Lotteries and Other Gaming Act of 2001, Article 78.

The Operator will have to demonstrate the following to the Government of Malta, before requesting certification:-

a) Financial resources that are adequate to ensure that viability of the operators E-Gaming
   operation, and that these resources are from legal sources.
b) Staff that have appropriate experience to ensure the proper and successful conduct of the
    E-Gaming operation under consideration.
c) An approved Control System, presumably signed off by an approved Certification Authority.
d) A remote gaming offering that the Operator is permitted to provide under the jurisdiction of 
   the Government of Malta.
e) A control system for administrative and accounting procedures which is set-up and
    incorporated in Malta.  This implies that the servers etc. are in a Malta data centre and 
   office, but software development may still be in the UK.
f) An electronic gaming system comprised of a computer network by means of which remote
   gaming is conducted, including all associated components, OS and applications.
g) An Operator’s Licence granted by the Malta LGA.
h)The Operator must be a Limited Liability Company registered in Malta.
i) The Licence Application will be supported by the following information about the Operator:-
	I) Corporate background information
	Ii) Financial Information
	Iii) Participation in legal activities, including interest or equity in any other commercial
                 activity.
	Iv) Criminal Record information
	V) Equity and other interests in the Operator; I.e., the Operators ownership structure.
	Vi) Details of all shareholders with more than a 5% interest in the Operator

Note : the above bears great similarity to the requirements of the AGCC and IoM regulator.
          This implies the compilation of a standard ‘corporate profile’ for all E-Gaming regulators.

E-Gaming Licences issued by the Malta LGA run for five years, and may be renewed forf another five years at any point within that period.

The Malta LGA defines Licence Fee and Renewal procedures that are very similar to those of the AGCC.

The defined grounds for non-issue, withdrawal and on-renewal of an E-Gaming Licence are very similar as well.

The Licence may have additional conditions attached covering the following:-
a) Proper operation of the interactive games.
b) Player protection
c) AML/CFT
d) “Exigencies of public interest” - we would need to find out what this means in practice.

Notification of changes to the personnel and corporate structure (including winding-up) of the Operator are to be notified to the Malta LGA in a very similar way to the AGCC.

The Malta LGA “Key Official” provisions (Part IV and Clause 15 of the Regulations) are very similar to the Key Individual Licence provisions maintained by both the AGCC and UKGC, including the role of the ‘key official’.

The Malta LGA expects the Operator to implement a “control system” covering the following:-

a) Remote gaming operation
b) General procedures to be followed for the operation of remote gaming
c) Computer software
d) Procedures for recording and paying prizes won in remote gaming
e) Accounting system and procedures
f) Procedures to be followed in playing a game
g) Procedures and standards for the maintenance, security, storage and transportation of 
   equipment to be used in remote gaming.
h) Procedures for the setting-up and maintenance of secure facilities including general
    compliance and internal controls relating to access to the control system.
I) BC/DR Plans
j) Data Backup system
k) Anything else that the Malta LGA may require

Note : Again, very similar to the AGCC’s requirements which implies that the compilation of a 
          generic “ICS” document - so one only needs to change the Regulator’s name!

The Malta LGA’s audit and approval procedures appear to be very similar to those of the AGCC.  The time period between such audits and approvals is not explicit.

To approve the Operator’s e-gaming system, the LGA must be satisfied that the system has been independently tested in the previous six months (again, same as the AGCC) as having met the standard set in the Third Schedule in the Malta LGA Regulations.

The Certification Document must provide the following:-

	Software Owner
	Name of Testing Organisation
	All companies involved and their credentials
	Process, rules and parameters of the games
	Server and communication protocols and other parts of the games system 
	architecture
	System security information
	Impact on processes, rules and parameters of each gamed of sources code changes
	All other information that is of material importance to the specific software
	Detailed description of the set-up and functionality of the application and system 
	architectures

The Malta LGA requires a Change Control process and may order random software re-tests.

The Player Registration procedures specified by the Malta LGA are very similar, in principle, to those of the AGCC.

The Malta LGA’s Players Accounts and Registration if Winnings requirements appear to be very similar to those of the AGCC and UKGC.

The Malta LGA’s requirements for aborted and miscarried games appear to be similar to those of the AGCC, so something similar to the original GCG implementation of these functions should satisfy these requirements.

The Operator’s website homepage must contain the following information:-

	Registered Name of Operator
	Operator’s Registered Office Address
	LGA Licence No. & Issue Date
	Statement of Regulation by LGA
	Approved Problem Gambling Site Hyperlinks
	Game Rules and Player Registration
	Malta LGA Kitemark, which is also a Malta LGA website hyperlink
	Any other information the Malta LGA considers appropriate

Note : the layout of the website must be agreed with the Malta LGA

The requirements of the Malta LGA are also equivalent to the AGCC and UKGC in the following areas:-

	Keeping of Records and Accounts
	Enforcement of the LGA’s Remote Gaming Regulations, including the inspection
	regime
	Handling of Complaints
	Financial provisions - taxes paid to the Malta Government (albeit at a different rate)
	Offences and Penalties (Malta part of Eurozone?)
	Advertising
	
Certification of E-Gaming Operator with LGA

The Operator will be expected to, in order to be certified:-

a) Operate in accordance with the Control System agreed with the LGA
b) Operate in accordance with the LGA’s remote gaming regulations and any other Licence
    conditions the LGA sets
c) Be adequately protected against known information security risks

The Malts LGA Certification process will apply to:-

a) All operators in possession of Provisional Licences
b) All operators in possession of Letters of Intent
c) All operators who make major changes to their Control System agreed with the LGA and/or Gaming System.  Re-certification would therefore appear to be part of the Change Control process.
d) Any operator subjected to the LGA’s Certification process

Certification is to be completed after the operator has commenced operations, but within six months of receipt of the operator’s Letter of Intent.

To begin the certification process, the operator will select from the Malta LGA’s list of approved Certification authorities (CAs).

The Operator and the CA will then agree the Certification scope, timings, deliverables and fees.

The Operator and CA will then agree on the course of action, contact personnel and timings.

Question : Would the AGCC or IoM regulator figure on the Malta LGA’s list of approved CAs?

The operator will provide as part of the certification process the following:-

a) Control System, with appropriate Controls
b) Information Security Policies
c) Terms & Conditions, with appropriate Game Rules
d) Data Protection Notification
e) Incident Response Procedure
f) User Management Procedures - presumably complaints etc.
g) BC/DR Plan
h) AML/CFT procedures
I) Change Management procedures
j) Back-up procedures

The above list appears to the very similar to the requirements of the AGCC and IoM regulator, which implies the compilation of a standard ‘profile’ to be submitted to any regulator.

The CA will require access to the Operator’s remote gaming system (accounts, electronic funds, etc.) to carry out testing, along with access to personnel who know the system.

The Malta LGA will expect the CA to pay special attention to the following:-

a) Control System
b) Documentation of Policies and Procedures
c) System Documentation
d) BC/DR Plan
e) User lists/system access (access privileges of Operator’s personnel)
f) Information Security to meet ISO17799
g) Identity and access level of Operator’s key officials

The Malta LGA will expect the following to be provided by the Operator in association with the CA:-

a) Key personnel should have copies of system documentation, be trained on the system, 
   have appropriate access rights, etc.
b) Provide documented records of everything
c) Have formal policies and procedures on the following:-
	Change Management
	Incident Response
	BC/DR
	Unauthorised Access (Access Control Policies)
	Malicious code

Again, this is very similar to the requirements of the AGCC, PCI, IoM Regulator  etc., so would imply a standard ‘package’ of such documentation.