Subchapter 06b – sports wagering

section .0100 – general provisions

In addition to defined terms in G.S. 18C-901, G.S. 18C-1001, and 24 NCAC 06A .0101, the following definitions apply in this Subchapter B of the Rules Manual:

(1) "Amateur Sports" has the meaning provided in G.S. 18C-901(1).

(2) "Card" means the list of Sporting Events and Wager Types from which a Player may make selections for a given Pool.

(3) "College Sports" has the meaning provided in G.S. 18C-901(3).

(4) "Collegiate Sporting Event" means a sport or athletic event offered or sponsored by, or played in connection with, a public or private institution that offers educational services beyond the secondary level.

(5) "Collegiate Tournament" means a series of College Sports or athletic events involving four or more collegiate teams that make up a single unit of competition.

(6) "Covered Services" has the meaning provided in G.S. 18C-901(4).

(7) "Data Source" means a Supplier that sells league or event data, participant data or statistics, or team statistics required to enable Sports Wagering.

(8) "eSports" or "Electronic Sports" has the meaning provided in G.S. 18C-901(5).

(9) "eSports Competition" means leagues, competitive circuits, tournaments, or similar competitions where Individuals or teams play video games, typically for spectators, either in-person or online, for the purpose of prizes, money, or entertainment.

(10) "eSports Competition Operator" means a Person which sanctions, regulates, or organizes an eSports Competition.

(11) "Exchange Wagering" means a form of Wagering in which two or more Persons place identically opposing Wagers in a given market, allowing Players to Wager on both winning and non-winning outcomes in the same event.

(12) "Geofencing" has the meaning provided in G.S. 18C-901(6).

(13) "GLI-CMP Guide" means the Gaming Laboratories International, GLI-CMP: Change Management Program Guide, Version 1.0, Published May 6, 2020, including amendments or subsequent editions.

(14) "GLI-33 Standards" means the Gaming Laboratories International, GLI-33: Standards for Event Wagering Systems, Version 1.1, and its appendices, Revised May 14, 2019, including amendments or subsequent editions.

(15) "Gross Wagering Revenue" has the meaning provided in G.S. 18C-901(7).

(16) "High School Sporting Event" means a Sporting Event participated in or offered or sponsored by a public or private institution that offers educational services at the secondary level.

(17) "In-Game Wagering" means placing a Sports Wager after a Sporting Event has started.

(18) "Layoff Wager" means a Sports Wager placed by a Sports Wagering Operator with another Sports Wagering Operator to offset Sports Wagers.

(19) "Motorsports Facility" has the meaning provided in G.S. 18C-901(10d).

(20) "Official League Data" has the meaning provided in G.S. 18C-901(11).

(21) "Pool" means an offering where Players may make selections of outcomes on a set number of Sporting Events and Wager Type on a Card to enter for a chance to win the Prize Pool or a portion thereof.

(22) "Prize Pool" means the prizing available for an Individual tournament, contest, or Pool.

(23) "Professional Golf Tournament" has the meaning provided in G.S. 18C-901(12d).

(24) "Professional Sports" has the meaning provided in G.S. 18C-901(13). Professional Sports do not encompass or include any Amateur Sports, Colleges Sports, Youth Sports, or High School Sporting Event.

(25) "Professional Sports Team" has the meaning provided in G.S. 18C-901(13d).

(26) "Rake" means the fee that is deducted by an Operator from a Wager made for Exchange Wagering or other peer-to-peer Wagering, or entry fees paid by Players who participate in a tournament, contest, or Pool.

(27) "Rake Adjustment" means an adjustment made by an Operator to account for shortfalls in connection with Exchange Wagering or other peer-to-peer Wagering, tournament, contest, or Pool.

(28) "Registered Player" has the meaning provided in G.S. 18C-901(14).

(29) "Service Provider License" means a License issued by the Commission to a Service Provider for Sports Wagering under G.S. 18C-906.

(30) "Shared Liquidity Pool" means a tournament, contest, or Pool being offered in North Carolina and one or more other jurisdictions.

(31) "Sporting Event" has the meaning provided in G.S. 18C-901(16).

(32) "Sports Wagering Brand" has the meaning provided in G.S. 18C-901(20).

(33) "Sports Wagering Network" means the offering of Exchange Wagering or other peer-to-peer Wagering through the linking of Players:

(a) of one or more Sports Wagering Operators in the State; or

(b) that Players may be pooled from multiple Sports Wagering Operators or from a single Sports Wagering Operator in multiple jurisdictions, pursuant to Commission approval.

(34) "Sports Wagering Platform" has the meaning provided in G.S. 18C-901(21).

(35) "Sports Wagering System" means the hardware, software, firmware, Communication Technology, and other equipment used in connection with a Sports Wagering Platform, as well as procedures implemented to allow Player participation in Sports Wagering, and, if supported, the corresponding equipment related to the display of the Wager outcomes, and other similar information required to facilitate Player participation, including Sports Wagering Platforms themselves.

(36) "Supplier License" or "Sports Wagering Supplier License" means a License issued by the Commission to a Supplier under G.S. 18C-907.

(37) "Tier One Sports Wager" has the meaning provided in G.S. 18C-901(23).

(38) "Tier Two Sports Wager" has the meaning provided in G.S. 18C-901(24).

(39) "Virtual Sporting Event" means a Sporting Event where elements of the event, including the results, are generated by a random number generator.

(40) "Wagering Account" or "Account" means an Interactive Account as defined in G.S. 18C-901(8).

(41) "Youth Sports" has the meaning provided in G.S. 18C-901(26).

(42) "Written Designation Agreement" means the written, executed, and complete contractual agreement between an Interactive Sports Wagering Operator or Interactive Sports Wagering Operator Applicant and a non-operator party eligible to enter such agreement, pursuant to G.S. 18C-905(a). A Written Designation Agreement includes all written contracts executed by and between these parties and executed by and between the parties' respective Affiliates.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2A-001;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0102 Incorporation by Reference

(a) For the purpose of the Rules in this Subchapter, the following Rules, standards and other requirements are hereby incorporated by reference, including subsequent amendments and editions:

(1) Gaming Laboratories International, GLI-33: Standards for Event Wagering Systems, Version 1.1, and its appendices, Revised May 14, 2019; and

(2) Gaming Laboratories International, GLI-CMP: Change Management Program Guide, Version 1.0, Published May 6, 2020.

(b) The Rules, standards, and other requirements incorporated by reference in Paragraph (a) of this Rule shall be made available for inspection. Copies of the Rules, standards, and other requirements incorporated by reference in Paragraph (a) of this Rule are available at no charge at www.gaminglabs.com and the Commission's website.

(c) In the event that there is a conflict between the provisions of the Rules, standards, and other requirements incorporated by reference in Paragraph (a) with any other provision of these Rules or the North Carolina General Statutes, then the North Carolina General Statutes shall take precedence over these Rules, and these Rules shall take precedence over the standards.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2A-002;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

Section .0200 – Licensing Provisions

24 NCAC 06B .0201 Sports Wagering Operator Licensing

(a) The Director shall issue a Sports Wagering Operator License after finding that the Applicant meets the requirements of the Act and these Rules.

(b) It shall be unlawful for any Person to offer or accept Sports Wagers in this State without a valid Sports Wagering Operator License issued under G.S. 18C-904 and 24 NCAC 06A .0200.

(c) Except as provided in G.S. 18C-928, the Commission shall only license Sports Wagering Operators who have a Written Designation Agreement, in accordance with G.S. 18C-905, to offer and accept Sports Wagers on Sporting Events.

(d) If an Applicant for a Sports Wagering Operator License is a Sports Facility or team that is a member of a league, association, or organization that prevents the Sports Facility or team from being subject to the regulatory control of the Commission or from otherwise operating under a Sports Wagering Operator License, the Sports Facility or team may contractually appoint a designee approved by the Commission to be responsible for all aspects of Commission oversight and operation.

(e) The holder of a Sports Wagering Operator License shall be deemed also to hold a Service Provider License and Supplier License under the Act and these Rules for services, goods, software, or components provided in-house.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-001;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0202 Service Provider Licensing

(a) The Director shall issue a Service Provider License after finding that an Applicant meets the requirements of the Act and these Rules.

(b) It shall be unlawful for any Person to offer or provide Covered Services to a Sports Wagering Operator in this State without a valid Service Provider License issued under G.S. 18C-906 and 24 NCAC 06A .0200.

(c) The holder of a Service Provider License shall be deemed also to hold a Supplier License under the Act and these Rules for services, goods, software, or components provided in-house.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-002;

Eff. January 8, 2024;

Readoption Eff. March 27, 2024.

24 NCAC 06B .0203 Supplier Licensing

(a) The Director shall issue a Supplier License after finding that an Applicant meets the requirements of the Act and these Rules.

(b) It shall be unlawful for any Person to offer or provide services, goods, software, or components to a Sports Wagering Operator or Service Provider in this State without a valid Supplier License issued under G.S. 18C-907 and 24 NCAC 06A .0200.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-003;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0204 Provisional Supplier License

(a) The Director may issue a Provisional Supplier License to an Applicant whose submitted application facially contains all required information and materials such that the application may be deemed administratively sufficient.

(b) To be eligible to receive a Provisional Supplier License, an Applicant shall:

(1) note its request for a Provisional Supplier License in its application; and

(2) provide in its application written attestations that the Applicant, its Key Persons, and current employees subject to Background Investigations have not been convicted in any jurisdiction of a felony, any gambling offense, a criminal offense involving moral turpitude or obstruction of justice, or any criminal offense involving dishonesty or breach of trust within 10 years of application.

(1) has been subject to sanction, enforcement, or civil penalties by a Sports Wagering or gaming regulatory body of another state;

(2) if a corporate entity, is not registered to do business in the State and in good standing;

(3) is subject to delinquent federal, state, or local taxes; or

(4) is in bankruptcy proceedings.

(d) The Director shall provide a date certain for the expiration of a Provisional Supplier License. The expiration date shall be the sooner of:

(1) 180 Days from the date of the issuance of the provisional License; or

(2) the date the Director approves or denies the Application after completion of the Background Investigation.

(e) After the denial of an application, a Provisional Supplier License shall not be valid during the pendency of an Applicant's request for reconsideration or during the pendency of any appeal.

(f) The holder of a Provisional Supplier License is subject to all Rules and other Commission requirements as if fully-licensed, including all enforcement-related provisions.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-004;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0205 Payment of License Application Fee; Expenses for Denied License Application

(a) Upon filing of an application for a License or renewal, an Applicant shall pay by wire transfer of funds the applicable License application fee:

(1) One million dollars ($1,000,000) for an Operator License;

(2) Fifty thousand dollars ($50,000) for a Service Provider License; or

(3) Thirty thousand dollars ($30,000) for a Supplier License.

(b) An Applicant whose licensure application is denied will have its License application fee returned to it, less five percent for associated expenses incurred by the Commission to conduct the application review.

(c) If a licensure application is denied, remittance of the Applicant's licensing or application fee, less five percent, for associated expenses incurred by the Commission, will issue after the period to seek reconsideration ends or upon the Director's receipt of a signed written statement from the Applicant stating that it will not seek reconsideration or an appeal of the licensing decision. The Commission will retain the License fee of an unsuccessful Applicant during the pendency of any reconsideration or appeal period and during any legal proceeding arising from or related to the denial of the Applicant's licensing application.

(d) If an Applicant voluntarily elects to withdraw its application before the Director denies the application or takes other action that does not constitute an approval of the application, the Director may:

(1) treat such withdrawal as a de facto denial of the application and retain the License application review fee pursuant to Paragraph (b) of this Rule, or

(2) allow the Applicant to withdraw its application and refund the entire License application fee.

(e) The Director shall not have discretion to return the entire License application review fee for a withdrawn application if the Applicant is discovered to have made a materially fraudulent misrepresentation or omission in its submissions to the Commission.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-005;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0206 Written Designation Agreement

(a) In order to qualify for a Sports Wagering Operator License, the Applicant shall enter into and maintain a Written Designation Agreement with a Persons or Persons enumerated under G.S. 18C-905(a).

(b) The Applicant or Sports Wagering Operator shall submit an executed copy of the Written Designation Agreement with its application for licensure or renewal as a Sports Wagering Operator.

(1) All related and ancillary agreements between and among the signatory parties and their respective Affiliates shall be considered part of the Written Designation Agreement, regardless of how such agreements are denominated.

(2) Failure to include all related and ancillary agreements between the parties and their Affiliates with the application for licensure or renewal may be grounds for summary denial of the application or renewal application.

(3) A letter of intent to enter into a Written Designation Agreement is not a substitute for an executed Written Designation Agreement.

(1) The agreement shall be executed by duly authorized Individuals.

(2) The agreement shall state a clear contract term length, with any option to renew being contingent on the renewal of the Sports Wagering Operator's License.

(3) The agreement shall be governed by North Carolina law, with express consent of the parties to submit to the jurisdiction of the North Carolina court system to resolve any disputes that are not otherwise addressed through agreed-upon alternative dispute resolution methods such as arbitration or mediation.

(4) The agreement shall require any place of public accommodation be operated solely by the Licensed Sports Wagering Operator, in accordance with G.S. 18C-905(c) and 18C-926.

(5) The agreement shall not authorize the non-operator party to the Written Designation Agreement to engage in any regulated activity requiring a License under the Act unless it independently obtains a License and only engages in activities authorized by such License.

(6) The agreement shall be terminated if the Licensed Sports Wagering Operator has its License revoked, the Licensed Sports Wagering Operator surrenders its License pursuant to 24 NCAC 06A .0305, or the non-operator party loses its authority to enter a Written Designation Agreement under G.S. 18C-905.

(7) The agreement shall require that the non-operator party's employees be prohibited from Sports Wagering in accordance with G.S. 18C-902(i)(6) or (7), as applicable, and receive appropriate and applicable training about Persons prohibited from engaging in sports Wagering.

(8) The agreement shall be marked "confidential."

(d) The Commission may deny an application for a Sports Wagering Operator License or suspend or revoke a Sports Wagering Operator License if at any time it finds that the Written Designation Agreement would be disadvantageous to the interests of the State of North Carolina. A Written Designation Agreement may, without limitation, be considered disadvantageous to the interests of the State if:

(1) the Commission determines that the Written Designation Agreement would cause a violation of any of the applicable considerations set forth in the Act, Commission Rules, or State, federal, or local law;

(2) the Written Designation Agreement fails to meet one or more of the requirements in Paragraph (c) of this Rule; or

(3) the parties to the Written Designation Agreement fail to fulfill one or more of the requirements in Paragraph (c) of this Rule.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-006;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024;

Amended Eff. June 22, 2024.

24 NCAC 06B .0207 Written Designation Agreement Breach, Discontinuance, or Other Cessation

(a) A Sports Wagering Operator shall promptly report to the Commission as soon as practicable, but at a minimum within five Days of the following with respect to the Written Designation Agreement:

(1) any modifications, changes, or alterations; or

(2) any breach, discontinuance, or other cessation.

(b) As contemplated by G.S. 18C-908(a), a Sports Wagering Operator's five-year License shall expire upon the earlier of five years or a breach, discontinuance, or other cessation of the Written Designation Agreement required under G.S. 18C-905. In the event the License expires for reason of breach, discontinuance, or other cessation, the Sports Wagering Operator shall engage in timely and complete efforts to wind up its operations and ensure payments and refunds are provided to Registered Players.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-007;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0208 Duties of the Operator and Service Providers

The Operator and its Service Providers shall make commercially reasonable efforts to meet G.S. 18C-910(a).

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2B-008;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

Section .0300 – Standards for Sports Wagering

24 NCAC 06B .0301 Authorized and Prohibited Sporting Events and Wager Types

(a) Sporting events that may be Wagered on include those listed in G.S. 18C-904(a). Of those events, only those categories of Sporting Events and their Wager Type authorized by the Commission and posted on the Commission's website may be offered for Sports Wagering by an Operator.

(b) Wagers of Wager Types approved by the Commission, on Sporting Events sanctioned by a Sports Governing Body or equivalent that is approved by the Commission, which comply with the following criteria, and do not involve criteria listed in Paragraph (c) of this Rule, are generally approved, and do not need specific approval subject to Rule .0302 of this Subchapter, prior to being offered by an Operator:

(1) the wager is based on statistical results which may be verified by a Data Source, box score, aggregation of box scores, or other statistical analysis;

(2) the wager is based on the performance of a single or group of rostered or otherwise registered participants; and

(3) the wager is based on the result of an outcome on the field of play, including the virtual field of play for eSports Competitions.

(1) eSports Competitions that:

(A) are not sanctioned by an approved Sports Governing Body or equivalent; or

(B) have not been endorsed by the Commission pursuant to the Rules set forth in Rule .0302 of this Subchapter;

(2) Virtual Sporting Events unless:

(A) a random number generator, certified by an Independent Testing Laboratory, is used to determine the outcomes;

(B) a visualization of the Virtual Sporting Event is offered to Players which displays an accurate representation of the results of the Virtual Sporting Event; and

(3) occurrences of injuries or penalties;

(4) whether officiating decisions will be upheld or reversed after replay review;

(5) disciplinary proceedings against a participant in a Sporting Event;

(6) High School Sporting Events or other Youth Sports;

(7) Fantasy Contests;

(8) Sporting Events or Wager Types in which the outcome has already been determined and is publicly known;

(9) Pari-Mutuel Wagering; and

(10) other categories of Sporting Event or Wager Type until the Sporting Event or Wager Type has been approved by the Commission in accordance with Rule .0302 of this Subchapter.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-001;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0302 Petition for a Category of Sporting Event or Wager Type

(a) The Director shall have authority to review and approve proposed Wager Types and categories of Sporting Events before an Operator is permitted to offer the Wager to the public. A petitioner may petition the Director for approval of a new category of Sporting Event or Wager Type.

(b) A proposed new Sporting Event or Wager Type may be a variation of an authorized Sporting Event or Wager Type, a composite of authorized Sporting Events or Wager Type, or a new Sporting Event or Wager Type.

(c) A petition for a proposed new Sporting Event or Wager Type shall be in writing and shall include the following information:

(1) the names and addresses of petitioners;

(2) the name of the Sporting Event or Wager Type;

(3) whether the Sporting Event or Wager Type is a variation of an authorized Sporting Event or Wager Type, a composite of authorized Sporting Events or Wager Type, or a new Sporting Event or Wager Type;

(4) the name of the Operator serving as a sponsor of the proposed Sporting Event or Wager Type petition;

(5) a complete and detailed description of the Sporting Event or Wager Type for which approval is sought, including:

(A) a summary of the Sporting Event or Wager Type and how Sports Wagers would be placed and winning Sports Wagers would be determined;

(B) a draft of the proposed Wagering Rules, including a description of technology that would be used to offer the Sporting Event or Wager Type;

(C) Rules or voting procedures related to the Sporting Event or Wager Type, or existing Wagering Rules that would apply; and

(D) assurance that the Sporting Event or Wager Type meets the requirements of Paragraph (d) of this Rule;

(6) for the approval of an eSports Competition, complete information about:

(A) the proposed locations of the eSports Competition;

(B) the video game used for the eSports Competition, including, without limitation, the key role of game publishers as creators of the underlying video game;

(C) the eSports Competition Operator, whether the eSports Competition Operator is approved to host events by the video game publisher, and whether the eSports Competition Operator has an affiliation with the video game publisher;

(D) how the eSports Competition is conducted by the eSports Competition Operator, including, without limitation, eSports Competition rules; and

(E) an explanation on how the eSports Competition meets the event integrity requirements of the Commission;

(7) the name of the Sports Governing Body or equivalent;

(8) to the extent known by the Operator, a description of its policies and procedures regarding event integrity; and

(9) other information or material requested by the Director.

(d) The Sporting Event or Wager Type being requested shall meet the following criteria before the request may be approved:

(1) the outcome may be verified;

(2) the outcome may be generated by a reliable and independent process;

(3) the Sporting Event generating the outcome is conducted in a manner that ensures sufficient Integrity Monitoring controls exist so that the outcome may be trusted;

(4) the outcome is not likely to be affected by a Sports Wager placed; and

(5) the Sporting Event is conducted in conformity with applicable laws.

(e) The Director shall approve or reject requests of categories of Sporting Events and wager types not later than 14 Days after the request is made. The Director will consider the request, materials and relevant input from the Sports Governing Body or equivalent, or the conductor of the Sporting Event , prior to authorizing a Sporting Event or Wager Type.

(f) The Director may require an appropriate test or experimental period before granting final approval to a Sporting Event or Wager Type. The Director may subject technology that would be used to offer a Sporting Event or Wager Type to testing, investigation, and approval.

(g) The Director may grant, deny, limit, restrict, or condition a request made pursuant to this Rule. The Director may issue an order revoking, suspending, or modifying an approval of a Sporting Event or Wager Type granted under this Rule for a cause the Director considers reasonable.

(h) The Director shall notify Operators of additions, deletions, or changes regarding authorized Sporting Events and Wager Types. Once a particular category of Sporting Event or Wager Type is approved for its first use, it may be used on multiple events without further approval. The Commission may issue general approval for Operators to offer Wagers on enumerated categories of Sporting Events and Wager Types. Publishing an update to the Commission's Event Catalog on the Commission's website shall suffice for notice purposes.

(i) The Commission and Director reserve the right to prohibit the acceptance of Sports Wagers and may order the cancellation of Sports Wagers and require refunds on a Sporting Event or Wager Type for which Wagering would be contrary to the public policies of the State.

(j) If it is determined that an Operator has offered an unauthorized or prohibited Sporting Event or Wager Type, the Operator shall immediately cancel and refund Sports Wagers associated with the unauthorized or Prohibited Sporting Event or Wager Type. The Operator shall notify the Commission promptly after canceling and refunding the Sports Wagers. This notice shall include, without limitation, which Sports Wagers were canceled or refunded and the reasons for the cancellations or refund.

(k) The Director may use information it considers appropriate, including, but not limited to, information received from a Sports Governing Body or equivalent, to determine whether to authorize or prohibit Wagering on a particular Sporting Event or Wager Type.

(l) The Director may restrict, limit, or exclude Wagering on a Sporting Event or Wager Type if the Director determines that the restriction, limitation, or exclusion is required to ensure the integrity of the Operator.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-002;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0303 Limitations on Certain Sports Wagering for Good Cause

A Sports Governing Body or equivalent may submit to the Director in writing a request to restrict, limit, or exclude a certain type, form, or category of Sports Wagering with respect to Sporting Events of the body, if the Sports Governing Body or equivalent believes that the type, form, or category of Sports Wagering with respect to Sporting Events of the body may undermine the integrity or perceived integrity of the body or Sporting Events of the body.

(1) The request shall be submitted in the form and manner prescribed by the Director and shall include:

(a) the identity of the Sports Governing Body or equivalent and contact information for an Individual who will be the primary point of contact for questions related to the request;

(b) a description of the Sports Wagering information, Sporting Event, or Wager Type that is the subject of the request;

(c) information explaining why granting the request is required to protect the integrity of the event, or public confidence in the integrity of the event, that is the subject of the request. This may include, but is not limited to, information regarding credible threats to the integrity of the event that are beyond the control of the Sports Governing Body or equivalent to preemptively remedy or mitigate; and

(d) other information required by the Director.

(2) To ensure proper consideration, the request shall be sent to the Director at least 14 Days before the particular Sporting Event . At any time, however, a Sports Governing Body or equivalent may report information to the Director if it causes or results in allegations of Event Corruption, Match Fixing, the manipulation of an event, misuse of inside information, or other prohibited activity.

(3) Regarding requests received under this Rule, the Director shall review and seek comments from the Operators. The notification shall include the date by which written comments shall be submitted.

(4) After giving due consideration to comments received, the Director shall, after a demonstration of good cause from the requestor that the type, form, or category of Sports Wagering is likely to undermine the integrity or perceived integrity of the body or Sporting Events of the body, grant the request.

(5) The Director shall respond to a request concerning a particular event before the start of the event, or if it is not feasible to respond before the start of the event, not later than seven Days after the request is made.

(6) If the Director determines that the requestor is more likely than not to prevail in successfully demonstrating good cause for its request, the Director may provisionally grant the request of the Sports Governing Body or equivalent.

(7) Absent a provisional grant by the Director, Operators may continue to offer Sports Wagering on Sporting Events that are the subject of a request during the pendency of the Director's consideration of the applicable request.

(8) The Director may reconsider its decision if there is a material change in the circumstances related to the original request.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-003;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0304 Data Sources for Sports Wagering

(a) An Operator shall report to the Commission and Director the Data Sources that it uses to resolve Sports Wagers. The Commission may disapprove of a Data Source for any reason.

(b) Data Sources shall be subject to the following conditions:

(1) The Data Source and corresponding data shall be complete, accurate, reliable, timely, and available.

(2) The Data Source shall be appropriate to settle the category of Sporting Events and Wager Types for which it is used.

(3) The proprietor or manager of a Data Source that provides data directly to an Operator shall be Licensed by the Commission as a Supplier.

(4) The Data Source and corresponding data shall meet other conditions set by the Commission.

(1) the results of Tier One Sports Wagers on Sporting Events of an organization whether headquartered in the United States or elsewhere; or

(2) the results of Tier Two Sports Wagers on Sporting Events of organizations that are not headquartered in the United States.

(d) A Sports Governing Body headquartered in the United States may notify the Commission that it desires Operators to use Official League Data to settle Tier Two Sports Wagers on Sporting Events of the Sports Governing Body. Notification shall be made in the form and manner as the Commission may require and shall include:

(1) identification information for the Sports Governing Body;

(2) identification and contact information for an Individual who will be the primary point of contact for issues related to the provision of Official League Data and compliance with the Act and these Rules;

(3) identification and contact information for designees that are or will be expressly authorized by the Sports Governing Body to provide Official League Data in North Carolina;

(4) copies of contracts relevant to the provision of Official League Data in North Carolina, including:

(A) copies of contracts between the Sports Governing Body and designees that are or will be expressly authorized by the Sports Governing Body to provide Official League Data in North Carolina;

(B) copies of contracts between the Sports Governing Body or its designees and Sports Wagering Operators in North Carolina; and

(5) other information required by the Commission.

(e) A Sports Governing Body may not submit a notification under Paragraph (d) of this Rule unless the Commission has authorized Operators to accept Tier Two Sports Wagers on athletic events of the Sports Governing Body.

(f) The Director shall notify Operators of a Sports Governing Body's notification within five Days of the Commission's receipt of the notification. If a Sports Governing Body does not so notify the Commission, an Operator is not required to use Official League Data for determining the results of Tier Two Sports Wagers on Sporting Events of that Sports Governing Body.

(g) Within 60 Days of the Commission notifying Operators of a Sports Governing Body notification to the Commission, or longer period as may be agreed between the Sports Governing Body and the applicable Operator, Operators shall use only Official League Data to determine the results of Tier Two Sports Wagers on Sporting Events of that Sports Governing Body, unless:

(1) the Sports Governing Body or its designee cannot provide a data feed of Official League Data to determine the results of a particular type of Tier Two Sports Wager, in which case Operators are not required to use Official League Data for determining the results of the applicable Tier Two Sports Wager until a data feed becomes available from the Sports Governing Body on commercially reasonable terms and conditions;

(2) an Operator demonstrates to the Commission that the Sports Governing Body or its designee will not provide a data feed of Official League Data to the Operator on commercially reasonable terms and conditions; or

(3) the designee of the Sports Governing Body does not obtain a Supplier License from the Commission to provide Official League Data to Operators to determine the results of Tier Two Sports Wagers, if and to the extent required by law.

(h) Beyond the 60 Day period referenced in Paragraph (g), an Operator may demonstrate at any time that the Sports Governing Body or its designee will not provide a data feed of Official League Data to the Operator on commercially reasonable terms and conditions, provided the parties have engaged in good-faith negotiations in connection with Official League Data and the Operator provides prior written notice to the Sports Governing Body.

(i) During the pendency of the Commission's determination as to whether a Sports Governing Body or its designee will provide a data feed of Official League Data on commercially reasonable terms, an Operator is not required to use Official League Data for determining the results of Tier Two Sports Wagers. The Commission's determination shall be made within 60 Days of the Operator providing the Commission with documentation that the Operator believes demonstrates that the Sports Governing Body or its designees will not provide a data feed of Official League Data to the Sports Wagering Operator on commercially reasonable terms. The following is a non-exclusive list of factors the Commission may consider in evaluating whether Official League Data is being offered on commercially reasonable terms and conditions for purposes of this Rule:

(1) The extent to which Operators have purchased the same or similar Official League Data on the same or similar terms, particularly in jurisdictions where a purchase was not required by law, or was required by law, but only if offered on commercially reasonable terms.

(2) The nature and quantity of the Official League Data, including its speed, accuracy, reliability, and overall quality, as compared to comparable non-official data.

(3) The quality and complexity of the process used to collect and distribute the Official League Data as compared to comparable non-official data.

(4) The availability of a Sports Governing Body's Tier Two Official League Data to an Operator from more than one authorized source.

(5) Market information, including price and other terms and conditions, regarding the purchase by Operators of comparable data to settle Sports Wagers in this State and other jurisdictions.

(6) The extent to which Sports Governing Bodies or their designees have made data used to settle Tier Two Sports Wagers available to Operators and terms and conditions relating to the use of that data.

(7) Other information the Commission considers relevant.

(j) At any time, a Sports Governing Body may give written notification to the Commission and Operators to which the Sports Governing Body or its designee provides Official League Data that the Sports Governing Body intends to stop providing Official League Data. The written notification shall specify in the date on which the Sports Governing Body shall stop providing Official League Data. The date shall be no fewer than seven Days later than the date of the written notification. On receipt of the written notification, an Operator may use any Data Source that meets the requirements of Paragraph (b) of this Rule to determine the results of Tier Two Sports Wagers on athletic events of the Sports Governing Body.

(k) A Sports Governing Body on whose Sporting Events Sports Wagering is authorized may enter into commercial agreements with Operators or other entities in which the Sports Governing Body may share in the amount bet from Sports Wagering on Sporting Events of the Sports Governing Body. A Sports Governing Body is not required to obtain a License or another approval from the Commission to lawfully accept these amounts.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-004;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0305 Cooperation with Investigations; Confidentiality of Certain Reported Information

(a) The Commission and Responsible Parties shall cooperate with investigations conducted by law enforcement agencies, Sports Governing Bodies or the equivalent, using commercially reasonable efforts to provide or facilitate the provision of Account-level Sports Wagering information. Disclosures under this Rule are subject to a Responsible Party's obligations to comply with federal, state, and local laws and regulations, including those relating to privacy and Personal Information.

(b) If a Sports Governing Body or the equivalent notifies the Commission that real-time information sharing for Wagers placed on its Sporting Events is required and desirable, Operators shall share with that Sports Governing Body or the equivalent or its designee in real-time, at the Account level:

(1) anonymized information regarding an Individual who places a Wager;

(2) the amount and Wager Type;

(3) the time the Wager was placed;

(4) relevant location information, including the Internet Protocol address if applicable;

(5) the outcome of the Wager; and

(6) records of Abnormal Wagering Activity.

(c) For purposes of Paragraph (b) of this Rule, "real-time information sharing" means the sharing of information at a commercially and technologically reasonable periodic interval of not less than once every 72 hours.

(d) A Sports Governing Body or the equivalent may use the information described by Paragraph (b) of this Rule solely for Sports Wagering integrity purposes.

(e) An Operator shall maintain the confidentiality of information provided by a Sports Governing Body or the equivalent to the Operator unless disclosure is required by this Chapter, the Commission, Director, law, or court order.

(f) The Commission, Director, Sports Governing Bodies or the equivalent, and Operators shall maintain the confidentiality of information described in Paragraph (b) of this Rule unless disclosure is required by these Rules, other law, or court order, or as authorized by the relevant Sports Governing Body or equivalent.

(g) The Commission shall maintain the confidentiality of information provided by Responsible Parties for compliance purposes unless disclosure is required by these Rules, other law, or court order.

(h) The Commission, Director, and Responsible Parties may disclose confidential information to another Responsible Party, a Sports Governing Body or the equivalent, a Sports Wagering regulating entity, a law enforcement entity, or other party to prevent or investigate potential Event Corruption.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-005;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0306 Contents of Wagering Rules

The Wagering Rules, required by 24 NCAC 06A .0501, shall address the following items regarding Wagers:

(1) types of Wagers accepted;

(2) minimum and maximum Wagers;

(3) the method for calculation and payment of winning Wagers;

(4) the effect of schedule changes for a Wagering Event;

(5) the method of notifying Players of odds or proposition changes;

(6) acceptance of Wagers at terms other than those posted;

(7) circumstances under which the Operator will void a Wager; and

(8) treatment of errors, late bets, and related contingencies;

(9) description of the process for handling incorrectly posted Wagering Events, odds, Wagers, or results;

(10) procedures related to pending winning Wagers;

(11) method of contacting the Operator for questions and disputes;

(12) description of Ineligible Persons;

(13) methods of funding a Wager;

(14) maximum payouts; however, limits shall only be established through limiting the amount of a Wager and cannot be applied to reduce the amount paid to a Player as a result of a winning Wager;

(15) a policy, in accordance with Rule .0307 of this Subchapter, by which the Operator may cancel Wagers for obvious errors pursuant to the Operator's Internal Controls, which shall include a definition and procedures for obvious errors;

(16) parlay Wager related rules;

(17) what is to occur when an event or a component of an event on which Wagers are accepted is canceled, including the handling of Wagers with multiple selections, for example parlays, where one or more of these selections is canceled; and

(18) other rule and related information the Commission or Director determines is required.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-006;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0307 Canceled or Voided Wagers

(a) Wagers shall not be canceled or voided without prior approval of the Director, unless the Wagers are canceled or voided by an authorized supervisory employee of the Operator, in accordance with this Rule or as provided for in an Operator's approved Internal Controls or Wagering Rules.

(b) Cancellation of an otherwise validly placed Wager by an Operator shall be nondiscretionary. An Operator may cancel or void a Wager without prior authorization of the Director only as provided for in an Operator's approved Internal Controls, Wagering Rules, or under the following circumstances:

(1) a Wager where after a Player has placed a Wager, the Wagering Event is canceled, postponed or rescheduled to a different date prior to completion of the Wagering Event;

(A) in the case of a Wager on a portion of a Wagering Event, that Wager shall be valid when the event is canceled, postponed, or rescheduled if the outcome of the affected portion was determined prior to the cancellation, postponement, or rescheduling; or

(B) an Operator may establish a timeframe in which an event may be rescheduled or postponed without canceling the Wager. This timeframe shall be tied to specific Wagering Events, subject to the approval of the Commission, and documented in the Wagering Rules;

(2) a change in the venue where a Wagering Event was scheduled to be held occurs after a Player has placed a Wager;

(3) a Wager when an Individual participant fails to participate in a Wagering Event and the outcome of the Wager is solely based on that Individual participant's performance;

(4) a Wager received for an act, or set of acts, to be performed during a Wagering Event when an act or acts does not occur and the ability to Wager on the non-occurrence of the event was not offered;

(5) a Wager received on whether a team will qualify to participate in post-season competitions when the number of teams allowed to participate in the post-season changes after a Player has placed a Wager;

(6) changes to rules by a Sports Governing Body or equivalent regarding the format or number of participants scheduled to participate in a defined phase of a Wagering Event or in the event that a defined phase is not played at all;

(7) when, prior to the start of the Wagering Event, a Player requests a Wager be canceled or voided due to an error in communicating the type, amount or parameters of the Wager; or

(8) when authorized or ordered by the Commission pursuant to this Rule.

(c) Where the Operator has a reasonable basis to believe there was an obvious error in the placement or acceptance of the Wager, the Operator may use its discretion to cancel the Wager without prior authorization from the Director. Obvious errors shall be defined in the Operator's Wagering Rules. Such errors include, but are not limited to:

(1) human error in the placement of the Wager;

(2) the Ticket does not correctly reflect the Wager; or

(3) equipment failure rendering a Ticket unreadable.

(d) An Operator may cancel or void a Wager for a material change in circumstances for a given Wagering Event or Wager Type occurs, provided:

(1) the Director approves the material change;

(2) the Operator documents the material change in its Wagering Rules; and

(3) the Operator displays what constitutes a material change to a Player at the time of placement of the Wager.

(e) Any cancellation of Wagers under this Rule shall be reported to the Director.

(f) For circumstances that are not set forth in Paragraphs (b), (c), or (d) of this Rule, an Operator may request that the Director authorize the cancellation or voiding of Wagers of a specific type, kind, or subject. An Operator shall submit its request to cancel or void the Wager in writing, and the request shall contain:

(1) a description of the type, kind, or subject of Wager the Operator is requesting to cancel or void;

(2) a description of facts relevant to the request; and

(3) an explanation why cancelling or voiding the Wager is in the best interests of the State or ensures the integrity of the Sports Wagering industry.

(g) When an Operator requests that the Director authorize the cancellation or voiding of one or more wagers, wagers related to the request shall be placed in a pending status until the Director rules on the request.

(h) The Operator shall provide any additional information requested by the Director to review and approve a request to cancel or void one or more wagers.

(i) The Director shall issue a written order granting or denying the request to cancel or void the Wager. In determining whether to grant or deny the request, the Director shall consider relevant factors, including whether:

(1) the alleged facts or other information provided to the Director implicate the integrity of the Wagering Event subject to the Wager or the Sports Wagering industry;

(2) the alleged facts or other information provided to the Director implicate possible illegal activity relating to the Wagering Event or the Sports Wagering industry;

(3) allowing the Wager would be unfair to Players; or

(4) allowing the Wager is contrary to public policy.

(j) No Wager subject to the request to cancel or void shall be redeemed, canceled, or voided, until the Director issues an order granting or denying the request to cancel.

(k) If the Director grants the request to cancel or void, the Operator shall make commercially reasonable efforts to notify Players of the cancellation or voiding of the Wager.

(l) The Director has discretion to order Operators to cancel or void Wagers on a specific Wagering Event or Wagers of a specific type or kind on a specific Wagering Event. In exercising its discretion, the Director shall apply the same factors described in Paragraphs (b), (c), and (d) of this Rule.

(m) A Player may request that the Director review Wagers declared canceled or voided by an Operator. If the Director concludes there is no reasonable basis to believe there was obvious error in the placement or acceptance of the Wager, and the reason for cancellation is not otherwise set out in Paragraphs (b), (c), or (d) of this Rule, the Director may order the Operator to honor the Wager.

(n) A Wager shall not be declared canceled or voided without the approval of an authorized supervisory employee of the Operator, unless the Director has issued an order requiring the Wager to be canceled or voided.

(o) If a Wager is declared canceled or voided, the Wager shall be refunded to the Player and that amount shall be deducted from the Gross Wagering Revenue.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-007;

Eff. January 8, 2024;

Readoption Eff. March 27, 2024.

24 NCAC 06B .0308 Tournaments, Contests, and Pools

(a) No Sports Wagering tournament, contest, or Pool shall be conducted unless the Operator, before the first time a tournament, contest, or Pool type is offered, files written notice with the Director of its intent to offer that tournament, contest, or Pool type and obtains approval from the Director.

(b) The Operator's request shall provide a detailed description of the tournament, contest, or Pool type and shall include the rules of the tournament, contest, or Pool, the requirements for entry, the entry fees, the Rake, and potential payouts. The request shall also indicate whether the proposed type involves a Shared Liquidity Pool available to Players in North Carolina and other jurisdictions with the Prize Pool being comprised of entry fees collected from Players in multiple jurisdictions.

(c) The request shall be submitted to the Director in writing via electronic mail. Requests shall be submitted at least 14 Days prior to start date of the tournament, contest, or Pool.

(d) Once an Operator receives approval to offer a tournament, contest, or Pool type the Operator shall not be required to seek additional approvals from the Director for subsequent types of tournament, contest, or pool offerings that differ from the approved request only with respect to the size, number of entries permitted, entry fee, or prize structure, or other minor variations as allowed by the Director.

(e) The Operator shall maintain a record of tournaments, contests, or Pools it offers, which shall address the:

(1) name or identification of the tournament, contest, or Pool;

(2) date and time the tournament, contest, or Pool occurred or will occur, if known;

(3) Sporting Events and Wager Type;

(4) rules concerning tournament, contest, or Pool play and participation; and

(5) for participating Players:

(A) unique Player identification;

(B) amount of entry fee collected, including promotional or bonus credits, and the date collected;

(D) amount of payouts paid, including promotional or bonus credits, and the date paid;

(6) total amount of entry fees collected, including promotional or bonus credits;

(7) total amount of payouts paid to Players, including promotional or bonus credits;

(8) total Rake, takeout, or fees collected;

(9) funding source amount or amounts comprising the Prize Pool;

(10) prize structure on payout;

(11) methodology for determining winner or winners; and

(12) current status of the tournament, contest, or Pool.

(f) The Operator shall be responsible for determining the Rake. The Operator's Rake collected from Players that enter a contest, tournament, or Pool while located in the State less any Rake Adjustment, if applicable, shall be considered, without any other deductions, Gross Wagering Revenue and is subject to tax requirements outlined in the Act and these Rules.

(1) At no time shall the calculation resulting from a Rake or Rake Adjustment be negative.

(2) For a contest, tournament, or Pool which uses shared liquidity available to Players in North Carolina and other jurisdictions, the Rake rate shall be the same for each of the jurisdictions participating.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-008;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0309 Managing Risk

An Operator may use systems that offset loss or manage or layoff risk in the operation of Sports Wagering pursuant to the Act and these Rules, including through liquidity pools, exchanges, or similar mechanisms in another approved jurisdiction in which the Operator, or an Affiliate or other third-party also holds a License or the equivalent, if adequate protections are continuously maintained to ensure sufficient funds are available to pay Winnings.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-009;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0310 Layoff Wagers

An Operator may accept Layoff Wagers placed by other Operators and place Layoff Wagers with other Operators to offset Sports Wagers.

(1) The Operator placing a Layoff Wager shall inform the Operator accepting the Wager that the Wager is being placed by an Operator and shall disclose their identity.

(2) The Operator may decline to accept a Layoff Wager in its sole discretion.

(3) Layoff Wagers shall be reported in writing to the Director within 72 hours.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-010;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0311 Exchange Wagering and Other Peer-to-Peer Wagering

Prior to offering Exchange Wagering or other peer-to-peer Wagering, an Operator shall obtain approval from the Director.

(1) The Rake taken on these Wagers shall be considered, without any deductions therefrom, Gross Wagering Revenue and is subject to tax requirements outlined in the Act and these Rules.

(2) One or more Operators may, with prior approval of the Commission, participate in a Sports Wagering Network in accordance with a written agreement that has been executed by the Operators. The agreement shall:

(a) designate the party responsible for the operation and administration of the network;

(b) identify and describe the role, authority, and responsibilities of the participating Operators;

(c) include a description of the process by which significant decisions that affect the operation of the network are approved and implemented by the participating Operators; and

(d) allocate the Gross Wagering Revenue and tax liability between the participating Operators to ensure the accurate reporting thereof.

(3) Parties to an agreement to participate in a Sports Wagering Network as set forth in Subparagraph (a)(2) of this Rule shall be jointly and severally liable for acts or omissions in violation of the Act, these Rules, or the policies of the Commission.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-011;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0312 Daily Summary

The Operator shall provide to the Director a daily summary of Sports Wagering Activity within the State, detailing transactions processed through the Sports Wagering System, provided in a format required by the Director, after the close of the Gaming Day within a time determined by the Director.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2C-012;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

section .0400 – Technical Requirements and Oversight

24 NCAC 06B .0401 Sports Wagering Standards

An Operator shall use a Sports Wagering System to offer, conduct, or operate Sports Wagering in accordance with applicable laws and these Rules. Only an Operator may process, accept, offer, or solicit Sports Wagers.

(1) The Operator shall comply with, and the Commission adopts and incorporates by reference, the GLI-33 Standards. The GLI-33 Standards are intended to supplement rather than supplant other technical standards and requirements under these Rules.

(2) A Sports Wagering System used to conduct Sports Wagering shall meet the specifications set forth in these Rules or other technical specifications as prescribed by the Commission. Failure to comply with the approved specifications, Internal Controls, or technical specifications may result in Disciplinary Action by the Commission.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-001;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0402 Testing, Certification, and Approval of Sports Wagering System

Prior to conducting Sports Wagering, and annually thereafter, the Sports Wagering System shall be submitted to an Independent Testing Laboratory. An operator shall not offer or use a Sports Wagering System to conduct Sports Wagering until after laboratory certification and Director approval. The Operator or Service Provider is responsible for costs associated with testing and obtaining certifications and approval.

(1) Unless otherwise authorized by the Commission or Director, the Independent Testing Laboratory shall be provided access to the Sports Wagering System's critical controlled software source code along with the means to verify compilation of the source code. The result of the compiled source code shall be identical to that in the software submitted for evaluation.

(2) If the Sports Wagering System meets or exceeds the specifications set forth in the Act, these Rules, and other technical specifications as prescribed by the Commission and Director, the Independent Testing Laboratory shall certify the Sports Wagering System. Operators and Service Providers are prohibited from offering Sports Wagering in North Carolina without certification.

(3) An Operator or its Service Provider may submit to the Director an alternative certification report of an Independent Testing Laboratory of a system in operation in another jurisdiction in the United States where the Operator or its Service Provider is Licensed or permitted, provided the following requirements are met:

(a) The alternative certification report shall certify the system to either the GLI-33 Standards, or, at the discretion of the Director, a standard considered to be the equivalent of the GLI-33 Standards.

(b) This alternative certification report shall include a list of critical files and associated signatures and an appendix which lists the differences of controlled items or processes required to be certified in North Carolina which were not certified in the jurisdiction in which the report was issued.

(c) On review of the alternative certification report, the Director will decide on whether to accept the certification or require additional information or documentation or testing.

(d) Where an alternative certification report is accepted by the Director:

(i) field testing of geolocation as described by Rule .0405 of this Subchapter shall still be conducted prior to commencing operations in North Carolina; and

(ii) certification against the specifications set forth in the Act, these Rules, and other technical specifications as prescribed by the Commission shall be required within 90 Days after commencing operations in North Carolina.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-002;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0403 Integration Requirements

(a) The Operator shall be responsible for the Sports Wagering realized through other Service Providers and Suppliers, and other Operators where applicable.

(b) The servers and other equipment of Service Providers and Suppliers critical to the Operator's sports wagering platform and operations will be considered as part of the Operator's Sports Wagering System and shall comply with the specifications provided in these Rules.

(c) The Operator shall guarantee that an integration with the critical servers and other equipment of another Operator is realized in a way that complies with the specifications provided in these Rules.

(d) An Independent Testing Laboratory shall conduct integration testing and certification for the critical services which comprise the Operator's Sports Wagering System prior to its deployment and as requested by the Commission or Director.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-003;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0404 Change Management Processes

(a) The Operator shall submit change management processes to the Director for approval. Documented change management processes shall describe evaluation procedures for identifying the criticality of updates and determining the updates that the Operator shall submit to an Independent Testing Laboratory for review and certification. These change management processes shall be:

(1) developed in accordance with the GLI-CMP Guide;

(2) approved by the Commission prior to their deployment; and

(3) audited at an annual interval by an Independent Testing Laboratory.

(b) The Operator shall submit quarterly change reports to the Independent Testing Laboratory for review to ensure risk is being assessed according to the change management processes and that documentation for changes is complete.

(c) At least once annually, the Operator shall have their products operating under the approved change management processes evaluated by an Independent Testing Laboratory. In order for the Operator to continue to offer the products as described above, the Operator's products shall be fully certified to the specifications set forth in these Rules and other technical specifications as prescribed by the Commission or Director and with formal certification documentation from the Independent Testing Laboratory. For good cause, the Operator shall be allowed to seek approval for extension beyond the annual approval if hardship is demonstrated. Whether to grant a hardship extension is in the sole discretion of the Director.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-004;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0405 Geolocation Requirements

Sports Wagers shall be initiated, received, and otherwise placed in the authorized geographic boundaries within the State of North Carolina and may not be intentionally placed or routed outside the State. The authorized geographic boundaries shall be made available by the Director and shall not include Indian Lands. Consistent with the intent of the United States Congress as articulated in the Unlawful Internet Gambling Enforcement Act of 2006, 31 U.S.C. 5361, the intermediate routing of electronic data relating to intrastate Sports Wagering authorized under the Act and these Rules shall not determine the location in which Sports Wagers are initiated and received.

(1) The Operator shall use geolocation services to:

(a) ensure that the Registered Player is located in the authorized geographic boundaries within the State of North Carolina when placing a Sports Wager;

(b) monitor and block unauthorized attempts to place Sports Wagers when an Individual or Player is physically outside the authorized geographic boundaries of the State of North Carolina at the time the Sports Wager is placed; and

(c) provide the Director with access to real-time geofence data, including any equipment or software necessary to view the real-time geofence data. The method, format, and equipment to access the real-time geofence data shall be approved by the Director. Operator may facilitate the Director's access to geofence data in conjunction with its geolocation Services Provider.

(2) The Operator shall trigger:

(a) a geolocation check prior to the placement of the first Wager after login and after a change of IP address; and

(b) recurring periodic geolocation checks prior to the placement of Wagers as follows:

(i) for static connections, at least every 20 minutes or 5 minutes if within 1 mile of the border of the authorized geographic boundaries; and

(ii) for mobile connections, at intervals to be based on a Player's proximity to the border of the authorized geographic boundaries with an assumed travel velocity of 70 miles per hour or a demonstrated average velocity of a roadway or path. This interval shall not exceed 20 minutes.

(3) Mechanisms shall be in place to detect software, programs, virtualization, and other technology that may obscure or falsify the Player's physical location to place Sports Wagers.

(4) The geolocation services used by an Operator shall be certified by an Independent Testing Laboratory, including applicable field testing, before its deployment.

(5) At least every 90 Days, an Operator shall review the functionality of the geolocations services to ensure the system detects and mitigates existing and emerging location fraud risks.

(6) Neither the location of the Registered Player nor the location of the Registered Player's device shall be checked or tracked when the Registered Player is not attempting to access an Operator's website or mobile application.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-005;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0406 Records of Sports Wagers

(a) For three years after a Sporting Event occurs, the Operator shall maintain records on all of the following for each Sports Wager as logged by the Sports Wagering System:

(1) the identity of the Registered Player placing the Sports Wager, if known; and

(2) the amount, type, time, location, and outcome of the Sports Wager, including the IP address, if available.

(b) The Operator shall disclose the records described in Paragraph (a) of this Rule to the Commission upon request.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-006;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0407 Location of Servers, Security, and Cloud Storage

Unless otherwise approved by the Director in writing, an Operator shall place servers or other information technology equipment directly related to the placement or resolution of a Sports Wager, other than back-up servers, in secure locations within the authorized geographic boundaries of the State of North Carolina on land that is not Indian Lands.

(1) The location of other technology and servers used by an Operator in connection with Sports Wagering shall be approved by the Director.

(2) For good cause shown, the Director may approve of the use of Internet or cloud-based hosting of duplicate data or data not related to transactional Wagering data upon written request of an Operator.

(3) Upon request, an Operator shall make accessible to the Commission, the Director, the Department of Revenue, and law enforcement its servers and other information technology equipment, whether or not the equipment is in North Carolina or another location out of state.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-007;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0408 Integrity and Security Assessments

Operators shall, within 90 Days after commencing operations in North Carolina, and annually thereafter, have integrity and security assessments of the Sports Wagering System conducted by a third-party contractor experienced in security procedures, including, without limitation, computer security and systems security. The third-party contractor shall be selected by the Operator and shall be subject to approval by the Director.

(1) Integrity and security assessments shall include a review of network vulnerability, application vulnerability, website vulnerability, wireless security, security policy and processes, security and privacy program management, technology infrastructure and security controls, security organization and governance, and operational effectiveness.

(2) The scope of the integrity and security assessments is subject to approval of the Director and shall include:

(a) a vulnerability assessment of digital platforms, Internet websites, mobile applications, internal, external, and wireless networks with the intent of identifying vulnerabilities or potential vulnerabilities of devices, the Sports Wagering System, and applications transferring, storing, or processing Personal Information or other Sensitive Information connected to or present on the networks;

(b) a penetration test of digital platforms, Internet websites, mobile applications, and internal, external, and wireless networks to confirm if identified vulnerabilities of devices, the Sports Wagering System, and applications are susceptible to compromise;

(c) a review of the firewall rules to verify the operating condition of the firewall and the effectiveness of its security configuration and rule sets performed on the perimeter firewalls and the internal firewalls;

(d) a security control assessment against the provisions adopted in these Rules, including those standards adopted in the technical security controls of the GLI-33 Standards, with generally accepted professional standards and as approved by the Director;

(e) if a cloud Service Provider is in use, an assessment performed on the access controls, account management, logging and monitoring, and over security configurations of their cloud tenant;

(f) an evaluation of information security services, payment services, geolocation services, and other services which may be offered directly by the Operator or involve the use of Service Providers or Suppliers; and

(g) other specific criteria or standards for the documented system security testing as prescribed by the Commission.

(3) To qualify as a third-party contractor, the third-party contractor shall:

(a) have relevant education background or in other ways provide relevant qualifications in assessing Sports Wagering Systems;

(b) obtain and maintain certifications sufficient to demonstrate proficiency and expertise as a network penetration tester by recognized certification boards, either nationally or internationally;

(d) meet other qualifications as prescribed by the Director.

(4) The full third-party contractor's security audit report containing the overall evaluation of Sports Wagering in terms of aspects of security shall be presented to the Director not later than 30 Days after the assessment is conducted and shall include:

(a) scope of review;

(b) name and company affiliation, contact information, and qualifications of the Individual or Individuals who conducted the assessment;

(d) findings, including identified or potential vulnerabilities;

(e) recommended corrective action, if applicable; and

(f) the Operator's response to the findings and recommended corrective action.

(5) It is acceptable for the audit report to leverage the results of prior assessments within the past year conducted by the same third-party contractor against standards, for example, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, the NIST Cybersecurity Framework (CSF), the Payment Card Industry Data Security Standards (PCI-DSS), or the equivalent. This leveraging shall be noted in the third-party contractor's security audit report. This leveraging does not include critical components of a Sports Wagering System unique to the State which will require fresh assessments.

(6) If the third-party contractor's security audit report recommends corrective action, the Operator shall provide the Director with a remediation plan and risk mitigation plans which detail the Operator's actions and schedule to implement the corrective action.

(a) The remediation and risk mediation plans shall be presented within a time period prescribed by the Director, which shall be based on:

(i) the severity of the problem to be corrected;

(ii) the complexity of the problem to be corrected; and

(iii) the risks associated with the problem to be corrected.

(b) If an Operator does not implement critical corrective actions within the prescribed timeline, then it may be subject to Disciplinary Action, including Summary Suspension under 24 NCAC 06A .0335. Before seeking to institute Disciplinary Action, the Director shall evaluate the Operator's efforts to implement available or potential mitigating controls regarding the critical items, including the timeliness of Operator's efforts, its compliance with internal controls and relevant audit report recommendations, and the scope of relevant remediation and risk plans.

(c) Once any corrective action has been completed, the Operator shall provide the Director with documentation evidencing completion.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-008;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.

24 NCAC 06B .0409 Quarterly Vulnerability Scans

(a) Either a qualified employee of the Operator or a qualified third-party contractor selected by the Operator and subject to approval of the Director shall run internal and external network vulnerability scans at least quarterly and after significant changes to the Sports Wagering System or network infrastructure.

(b) Testing procedures shall verify that 4 quarterly internal and external scans took place in the past 12 months and that re-scans occurred until "High Risk" or "Critical" vulnerabilities were resolved or accepted via a formal risk acceptance program.

(1) The Operator shall submit their documented vulnerability management program that describes their risk acceptance program to the Director.

(2) Internal scans shall be performed from an authenticated scan perspective. External scans may be performed from an uncredentialed perspective.

(c) Verification of scans shall be submitted to the Director on a quarterly basis and within 30 Days of running the scan. The scan verifications shall include a remediation plan and risk mitigation plans for those vulnerabilities not able to be resolved. The severity of the vulnerabilities may be adjusted by the Operator if adhering to a formal, accepted vulnerability management plan.

(d) The Commission or Director may impose Disciplinary Action in the event of critical unresolved vulnerabilities or vulnerabilities that continue unabated that are not a result of the implementation of mitigating control.

History Note: Authority G.S. 18C-114(a)(14);

Previously adopted as Rule 2D-009;

Eff. January 8, 2024;

Readopted Eff. March 27, 2024.