2018-27651. Minimum Internal Control Standards

AGENCY:

National Indian Gaming Commission, Interior.

ACTION:

Final rule.

SUMMARY:

The National Indian Gaming Commission (NIGC) amends its minimum internal control standards for Class II gaming under the Indian Gaming Regulatory Act to correct an erroneous deletion of the key control standards and to make other minor edits and additions for clarity.

DATES:

Effective Date: January 22, 2019.

FOR FURTHER INFORMATION CONTACT:

Jennifer Lawson at [phone] or by fax [phone] (these numbers are not toll free).

SUPPLEMENTARY INFORMATION:

I. Background

The Indian Gaming Regulatory Act (IGRA or Act), Public Law 100-497, 25 U.S.C. 2701 et seq., was signed into law on October 17, 1988. The Act established the National Indian Gaming Commission (“NIGC” or “Commission”) and set out a comprehensive framework for the regulation of gaming on Indian lands. On January 5, 1999, the NIGC published a final rule in the Federal Register called Minimum Internal Control Standards. 64 FR 590. The rule added a new part to the Commission's regulations establishing Minimum Internal Control Standards (MICS) to reduce the risk of loss because of customer or employee access to cash and cash equivalents within a casino. The rule contains standards and procedures that govern cash handling, documentation, game integrity, auditing, surveillance, and variances, as well as other areas.

The Commission recognized from their inception that the MICS would require periodic review and updates to keep pace with technology and has substantively amended them numerous times, most recently in late 2013 (78 FR 63873).

II. Development of the Rule

On September 21, 2012, the Commission concluded nearly two years of consultation and drafting with the publication of comprehensive amendments, additions, and updates to Part 543, the minimum internal control standards (MICS) for Class II gaming operations (77 FR 58708). The regulations require tribes to establish controls and implement procedures at least as stringent as those described in this part to maintain the integrity of the gaming operation. In late 2013, the Commission published a final rule, adding kiosk drop, count, fill, and surveillance standards to Part 543 (78 FR 63873).

Now, the Commission is finalizing additional revisions, largely technical in nature, that are meant to correct earlier editing oversights and to better clarify the intent of the provisions. The proposed rule was published June 8, 2018 (83 FR 26620), and the comment period expired July 9, 2018.

III. Review of Public Comments

NIGC received the following comments in response to the proposed rule:

Comment: One commenter recommended requiring an inventory under § 543.10(e) if a table is open going into the next gaming day.

Response: The standard requires a count at the end of each shift and the Commission notes that the majority of operations have shifts that coincide with their gaming days. Tribes have the option of requiring an additional count where a shift crosses over from one gaming day to the next.

Comment: One commenter argued that it is too burdensome to require a supervisor to count the table inventory in § 543.10(e).

Response: Since its inception, § 543.10(e) has required a supervisor to count the table inventory. The rule now also requires a supervisor to count the main card room bank.

Comment: One commenter believed that the amendments eliminated kiosks from § 543.17(j).

Response: The kiosk provisions remain in the regulations and can be found at §§ 543.17(i) (Kiosk count standards) and (j)(9): “Controls must be established and procedures implemented to safeguard the use, access, and security of keys for kiosks.”

Comment: Two commenters expressed concern that § 543.17(j)(4), which requires the key holder to be independent of those conducting the drop, would prevent those responsible for drops from having access to the keys necessary to conduct them. One commenter specifically identified the need for security personnel's assistance in emergency drops as problematic under these regulations because the security department holds the keys.

Response: The term “custody” seems to have been confused with physical use of the key. Typically, security personnel are not used as drop agents: they only accompany the drop team as they remove Financial Instrument Storage Components. Occasionally, operations allow card tables to be dropped by a security agent and the shift supervisor.

Custody involves more than just physical custody (i.e., stored in security room or other area controlled by security), and includes logical custody (i.e., I.T. controls of lock box). Additionally, the complete inventory records for the keys should be kept with accounting department.

A separation of duties must be established for granting or limiting access to the keys, custody of the keys, and recordkeeping duties for the keys. Each operation is unique and, to maintain independence, security should either be precluded from acting as drop team agents or have limited control over the keys.

Comment: One commenter requested clarification on § 543.17(j)(7), particularly whether it is intended to address emergency drop situations requiring immediate access.

Response: The standard is meant to address emergency drop situations. Use of the keys outside the scheduled time for use includes an emergency drop. Other times can include, but are not limited to, inventory or replacement. The standard is intended to ensure security of the box contents and require proper authorization to issue of keys outside of the scheduled count.

Comment: One commenter asked whether § 543.17(j)(8) applies to manually-controlled key boxes, electronic boxes, or both, and whether removal of the player interface drop and count will need to meet requirements set forth for regularly scheduled drop and count (e.g. § 543.17(e)(4)) in addition to these requirements.

Response: The standard applies to computerized, electronic, and alternative key systems. A manual key system does not have an override key. In the event of power loss or other issue, the emergency manual keys allow access to the key box. These keys should be secured by other means and only accessed in an emergency.

The removal of a financial instrument can occur during a regularly scheduled drop or an emergency drop. Standards are provided for each situation and the operation should determine which are appropriate to follow based on the circumstances.

Comment: One Commenter asked whether § 543.17(j)(8)(i) also applies to financial instrument storage components and drop boxes.

Response: It does not. The standard applies to emergency manual keys. The standard later states at § 543.17(j)(8)(iii) that if the player interface drop and count keys are not accessed, then only two agents are required: Those are the keys used for the financial instrument storage components and drop boxes.

Comment: One commenter expressed a general concern that overly burdensome key controls lead to delay, customer frustration and inefficiency of the gaming operation and noted the need for balance between security and functionality.

Response: The Commission agrees and believes it has done its best to strike a proper balance between protection of tribal assets and efficiency. These standards are consistent with those of other jurisdictions, but also allow some flexibility. Tribes and operation management must establish controls and implement procedures to best fit their needs and manage risks specific to their operations.

Comment: One commenter believes § 543.17(j)(6) is in conflict with § 543.17(d)(4) and the entire key control process needs further clarification.

Response: Without further discussion, it is unclear what conflict the commenter sees. The Commission believes the provisions can be read harmoniously. Section 543.17(j)(6) restricts access to drop box release keys to the count team and authorized agents.

Section 543.17(j)(7) requires anyone using the keys outside of the scheduled drop and count time to be authorized—thereby becoming an authorized agent under (j)(6))—and documented. This allows for an emergency drop to be conducted by authorized agents so the drop team does not need to be called.

Section 543.17 (d)(4) requires drop boxes to be removed only at the time previously designated by the gaming operation and reported to the TGRA, but it specifically allows for emergency drops, which require surveillance and TGRA to be notified.

IV. Regulatory Matters

Regulatory Flexibility Act

The rule will not have a significant impact on a substantial number of small entities as defined under the Regulatory Flexibility Act, 5 U.S.C. 601, et seq. Moreover, Indian Tribes are not considered to be small entities for the purposes of the Regulatory Flexibility Act.

Small Business Regulatory Enforcement Fairness Act

The rule is not a major rule under 5 U.S.C. 804(2), the Small Business Regulatory Enforcement Fairness Act. The rule does not have an effect on the economy of $100 million or more. The rule will not cause a major increase in costs or prices for consumers, individual industries, Federal, State, local government agencies or geographic regions, nor will the proposed rule have a significant adverse effect on competition, employment, investment, productivity, innovation, or the ability of the enterprises, to compete with foreign based enterprises.

Unfunded Mandate Reform Act

The Commission, as an independent regulatory agency, is exempt from compliance with the Unfunded Mandates Reform Act, 2 U.S.C. 1502(1); 2 U.S.C. 658(1).

Takings

In accordance with Executive Order 12630, the Commission has determined that the rule does not have significant takings implications. A takings implication assessment is not required.

Civil Justice Reform

In accordance with Executive Order 12988, the Commission has determined that the rule does not unduly burden the judicial system and meets the requirements of sections 3(a) and 3(b)(2) of the Order.

National Environmental Policy Act

The Commission has determined that the rule does not constitute a major federal action significantly affecting the quality of the human environment and that no detailed statement is required pursuant to the National Environmental Policy Act of 1969, 42 U.S.C. 4321, et seq.

Paperwork Reduction Act

The information collection requirements contained in this rule were previously approved by the Office of Management and Budget as required by 44 U.S.C. 3501, et seq., and assigned OMB Control Number 3141-0009. The OMB control number expires on November 30, 2018.

Tribal Consultation

The National Indian Gaming Commission is committed to fulfilling its tribal consultation obligations—whether directed by statute or administrative action such as Executive Order (E.O.) 13175 (Consultation and Coordination with Indian Tribal Governments)—by adhering to the consultation framework described in its Consultation Policy published July 15, 2013. The NIGC's consultation policy specifies that it will consult with tribes on Commission Action with Tribal Implications, which is defined as: Any Commission regulation, rulemaking, policy, guidance, legislative proposal, or operational activity that may have a substantial direct effect on an Indian tribe on matters including, but not limited to the ability of an Indian tribe to regulate its Indian gaming; an Indian tribe's formal relationship with the Commission; or the consideration of the Commission's trust responsibilities to Indian tribes.

The key control language proposed here is the most substantive of all the changes and was the subject of extensive consultation in 2012 (77 FR 58708). The language has not changed since initially adopted. It was inadvertently written over with the addition of kiosk controls in 2013, and this rule is to include the controls back into the regulations. The remaining changes are all technical in nature, correcting numbering and adding minor clarifications.

List of Subjects in 25 CFR Part 543

• Accounting
• Administrative practice and procedure
• Gambling
• Indian—Indian lands
• Reporting and recordkeeping requirements

For the reasons discussed in the Preamble, the Commission amends 25 CFR part 543 as follows:

PART 543—MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING

1. The authority citation for part 543 continues to read as follows:

Authority: 25 U.S.C. 2702(2), 2706(b)(1-4), 2706(b)(10).

2. Amend § 543.10 by revising paragraph (e) to read as follows:

§ 543.10

What are the minimum internal control standards for card games?

* * * * *

(e) Standards for reconciliation of card room bank. Two agents—one of whom must be a supervisory agent—must independently count the main card room bank and table inventory at the end of each shift and record the following information:

(1) Date;

(2) Shift;

(3) Table number (if applicable);

(4) Amount by denomination;

(5) Amount in total; and

(6) Signatures of both agents.

* * * * *

3. Amend § 543.17 by revising paragraphs (d), (i)(4)(i), and (j) to read as follows:

§ 543.17

What are the minimum internal control standards for drop and count?

* * * * *

(d) Card game drop standards. Controls must be established and procedures implemented to ensure security of the drop process. Such controls must include the following:

(1) Surveillance must be notified when the drop is to begin so that surveillance may monitor the activities.

(2) At least two agents must be involved in the removal of the drop box, at least one of whom is independent of the card games department.

(3) Once the drop is started, it must continue until finished.

(4) All drop boxes may be removed only at the time previously designated by the gaming operation and reported to the TGRA. If an emergency drop is required, surveillance must be notified before the drop is conducted and the TGRA must be informed within a timeframe approved by the TGRA.

(5) At the end of each shift:

(i) All locked card game drop boxes must be removed from the tables by an agent independent of the card game shift being dropped;

(ii) For any tables opened during the shift, a separate drop box must be placed on each table, or a gaming operation may utilize a single drop box with separate openings and compartments for each shift; and

(iii) Card game drop boxes must be transported directly to the count room or other equivalently secure area by a minimum of two agents, at least one of whom is independent of the card game shift being dropped, until the count takes place.

(6) All tables that were not open during a shift and therefore not part of the drop must be documented.

(7) All card game drop boxes must be posted with a number corresponding to a permanent number on the gaming table and marked to indicate game, table number, and shift, if applicable.

* * * * *

(i) * * *

(4) * * *

(i) The count of each box must be recorded in ink or other permanent form of recordation.

* * * * *

(j) Controlled keys. Controls must be established and procedures implemented to safeguard the use, access, and security of keys in accordance with the following:

(1) Each of the following requires a separate and unique key lock or alternative secure access method:

(i) Drop cabinet;

(ii) Drop box release;

(iii) Drop box content; and

(iv) Storage racks and carts used for the drop.

(2) Access to and return of keys or equivalents must be documented with the date, time, and signature or other unique identifier of the agent accessing or returning the key(s).

(i) For Tier A and B operations, at least two (2) drop team agents are required to be present to access and return keys. For Tier C operations, at least three (3) drop team agents are required to be present to access and return keys.

(ii) For Tier A and B operations, at least two (2) count team agents are required to be present at the time count room and other count keys are issued for the count. For Tier C operations, at least three (two for card game drop box keys in operations with three tables or fewer) count team agents are required to be present at the time count room and other count keys are issued for the count.

(3) Documentation of all keys, including duplicates, must be maintained, including:

(i) Unique identifier for each individual key;

(ii) Key storage location;

(iii) Number of keys made, duplicated, and destroyed; and

(iv) Authorization and access.

(4) Custody of all keys involved in the drop and count must be maintained by a department independent of the count and the drop agents as well as those departments being dropped and counted.

(5) Other than the count team, no agent may have access to the drop box content keys while in possession of storage rack keys and/or release keys.

(6) Other than the count team, only agents authorized to remove drop boxes are allowed access to drop box release keys.

(7) Any use of keys at times other than the scheduled drop and count must be properly authorized and documented.

(8) Emergency manual keys, such as an override key, for computerized, electronic, and alternative key systems must be maintained in accordance with the following:

(i) Access to the emergency manual key(s) used to access the box containing the player interface drop and count keys requires the physical involvement of at least three agents from separate departments, including management. The date, time, and reason for access, must be documented with the signatures of all participating persons signing out/in the emergency manual key(s);

(ii) The custody of the emergency manual keys requires the presence of two agents from separate departments from the time of their issuance until the time of their return; and

(iii) Routine physical maintenance that requires access to the emergency manual key(s), and does not involve accessing the player interface drop and count keys, only requires the presence of two agents from separate departments. The date, time, and reason for access must be documented with the signatures of all participating agents signing out/in the emergency manual key(s).

(9) Controls must be established and procedures implemented to safeguard the use, access, and security of keys for kiosks.

* * * * *

4. Amend § 543.18 by revising paragraph (d)(6)(v) to read as follows:

§ 543.18

What are the minimum internal control standards for the cage, vault, kiosk, cash and cash equivalents?

* * * * *

(d) * * *

(6) * * *

(v) Dollar amount per financial instrument redeemed;

* * * * *

5. Amend § 543.23 by revising paragraph (c)(1)(viii) to read as follows:

§ 543.23

What are the minimum internal control standards for audit and accounting?

* * * * *

(c) * * *

(1) * * *

(viii) Drop and count standards, including supervision, count room access, count team, card game drop standards, player interface and financial instrument drop standards, card game count standards, player interface financial instrument count standards, collecting currency cassettes and financial instrument storage components from kiosks, kiosk count standards, and controlled keys;

* * * * *

6. Amend § 543.24 by revising paragraphs (a) and (d)(5) to read as follows:

§ 543.24

What are the minimum internal control standards for auditing revenue?

(a) Supervision. Supervision must be provided as needed for revenue audit by an agent(s) with authority equal to or greater than those being supervised.

* * * * *

(d) * * *

(5) Complimentary services or items. At least monthly, review the reports required in § 543.13(c). These reports must be made available to those entities authorized by the TGRA or by tribal law or ordinance.

* * * * *

Washington, DC.

Dated: December 12, 2018.

Jonodev O. Chaudhuri,

Chairman.

Dated: December 12, 2018.

Kathryn Isom-Clause,

Vice Chair.

Dated: December 17, 2018.

E. Sequoyah Simermeyer,

Associate Commissioner.