Executive order on betting and online casinos_Danish Gaming Authority (DGA) requirements en
1/141. ------IND- 2010 0482 DK- EN- ------ 20100726 --- --- PROJETExecutive order on betting and online casinosThe following is established pursuant to Article 11(4), Article 36(2), Article 41 and Article 60 of ActNo 848 of 1 July 2010 on gaming:Chapter 1Area of application§ 1. The statutory order applies to the provision of land-based betting, online betting and online casinos,see paragraph 2, however.2. Chapters 2-7 only apply to the provision of online casinos and online betting.Chapter 2Registration of players§ 2. To participate in online gaming, a player must be registered as a customer of the licence-holder.The registration must contain information about the player’s name, civil registration number (CPR No),address and a Nemkonto to which transfers of winnings, etc. from the gaming account shall be made.2. Licence-holders must verify the accuracy of the information the player has provided in connectionwith the registration. Licence-holders shall in this connection obtain the necessary documentation forthe accuracy of the information.§ 3. Licence-holders shall keep personal information on a registered player, cf. Article 2(1), for 5 yearsafter the customer relationship has ended and the licence-holder shall then delete the data.Chapter 3Gaming account and payments§ 4. Licence-holders shall set up a gaming account for the registered player. A player may only have onegaming account with a licence-holder.2. The licence-holder shall give the player access to information about the gaming account’s balance,gaming history (including stakes, winnings and losses), deposits and withdrawals and other transactionsrelated thereto. The information shall be available for the player on the gaming account for at least 90days.
2/143. Licence-holders shall, upon request from the player, provide account statements for all transactionson the gaming account for the last 12 months.§ 5. Until the licence-holder has checked the information provided in accordance with Article 2(1), onlya temporary gaming account can be opened for the player, cf. paragraph 4, however.2. If the player has provided false information in connection with the registration or if, after a requestfrom the licence-holder, the player has not submitted the necessary documentation for the correctness ofthe information within 1 month, the licence-holder shall close the temporary gaming account, cf. Article23(2).3. No payments can be made from a temporary gaming account to the player’s Nemkonto.4. A temporary gaming account cannot be set up for a player who is listed in the register of self-excluded persons, cf. Article 17.§ 6. Payments to a gaming account can only be received from a payment account that is connected to apayment service which is established in an EU/EEA country, and which belongs to the registered player.The gaming authority may approve other payment methods that do not meet the requirements inparagraph 1.2. Payments to the gaming account can only be accepted through one of the forms of payment approvedby the gaming authority. Cash deposits cannot be accepted.§ 7. Amounts paid by the player shall be credited to the gaming account immediately after the licence-holder has received the payment.2. Winnings shall be credited to the gaming account immediately.§ 8. A licence-holder may not permit transfers of money, gaming tokens, etc. between gaming accounts.§ 9. The funds on a player’s gaming account are entrusted funds that must be deposited on a setoff-freeaccount in a bank, etc. that shall be kept separate from the licence-holder’s own funds, and which onlythe licence-holder shall have access to. The funds from the account can only be paid to the player andmay not be used therefore to cover claims against the licence-holder. The funds must be secured in thecase of insolvency, etc. of the licence-holder or the bank, etc., where the player’s funds are placed.2. The funds in the setoff-free account shall at all times at least equal the total amount on the players’gaming accounts.
3/14Chapter 4Information for players§ 10. All information, which the licence-holder is required to make available to the player in accordancewith the provisions laid down in the Act and associated regulations, must be available in Danish on thelicence-holder’s website. It must be possible for all other communication between players and thelicence-holder to be in Danish.§ 11. The licence-holder’s website shall1) state that it is not permitted for persons under 18 to participate in gaming,2) provide information on responsible gaming and the potentially deleterious effects of gaming. Theinformation must be produced in cooperation with a treatment centre.3) facilitate access to a self-administered test for gambling addiction, and4) provide information about and a contact address for a Danish helpline where advice is available aboutgambling addiction problems and Danish treatment centres.2. The information in paragraph 1 shall be placed in a prominent area on the licence-holder’s websiteand must be accessible from all pages on the website.§ 12. The front page of licence-holders’ websites must show that the licence-holders have a licence fromand are under the supervision of the gaming authority. Access shall be facilitated to the website of thegaming authority.§ 13. There must be a clock on the licence-holder’s website that allows the player to be aware of thetime spent on the gaming page. The clock must be visible to the player at all times.Chapter 5Responsible gaming§ 14. The licence-holder must make a function available to the player that allows the player to set daily,weekly and monthly deposit limits. A player’s request to set a deposit limit shall be implementedimmediately upon request, cf. paragraph 2, however.2. A player’s request for an increase of a previously fixed deposit limit may not come into force untilafter 24 hours.§ 15. The licence-holder shall make a function available for the player that allows the player to decidethat winnings above a specified amount shall automatically revert to the player’s Nemkonto.
4/14§ 16. Licence-holders shall provide a function for the player, allowing the player to request a temporaryor permanent exclusion from gaming. A player’s request for exclusion must be implementedimmediately upon request.2. A temporary exclusion may not be for less than one month, but the player shall have the possibility tochoose a short break from gaming for 24 hours (cooling-off period). A temporary exclusion and shortbreak from gaming means that the player’s gaming account is deactivated during this period.3. Final exclusion of a player entails that the licence-holder shall close the player’s account. The playermay only register as a player again, cf. Article 2, 1 year after the closure of the gaming account.4. If a player has excluded themselves from participation in a licence-holder’s game, the licence-holdermust inform the player about the option for counselling and treatment of pathological gambling in aDanish treatment centre.§ 17. The gaming authority shall keep a register of players who want temporary or permanent exclusionfrom gaming at all licence-holders. Licence-holders shall provide a function for the player that allowsthe player to be entered on the register at the same time as a request for temporary or permanentexclusion. Entry on the register can also occur by the player contacting the gaming authority. Theplayer must give explicit consent to their inclusion on the register.2. If a player has requested from a licence-holder that they should be entered on the register of excludedpersons, the licence-holder shall immediately forward this information to the gaming authority. Therequest to the gaming authority shall include information about the licence-holder’s name, the player’spersonal registration number and the date and time of the exclusion.3. When setting up a new player, the licence-holder shall consult the register of self-excluded persons inorder to ensure that the player in question is not listed on the register. If a player is listed on the register,the setting up of the player must be refused by the licence-holder.4. The licence-holder shall consult the register once each day in order to ensure that established playershave not been listed on the register of self-excluded players. If a player is listed on the register, theplayer’s gaming account shall be closed, cf. Article 22.5. A player who is listed on the register referred to in paragraph 1, can at any time, though not before 1year after they have been entered on the register, request that a licence-holder or the gaming authorityremove him from the register.§ 18. Licence-holders shall take measures to avoid sending marketing material to players who haveexcluded themselves from participation in gaming temporarily or permanently.
5/14Chapter 6Bonus§ 19. In offers of bonuses by licence-holders, information about all of the terms and conditions shall bestated in a clear and simple manner in direct connection with the offer.§ 20. A bonus from a licence-holder may not be offered in a way that explicitly encourages a player toincrease his gaming activity or to win back a lost stake.2. An offer of a bonus shall not be given to individual players on terms that differ from deals given toother players.§ 21. An offer of a bonus from a licence-holder may not be constructed such that the player must meetthe terms associated with the bonus within a period of less than 90 days.2. Bonuses that are offered to all existing players and consist of full or partial refund of fees (rake) paidto licence-holders or earning points to purchase goods or services that cannot be exchanged for cash ortokens, are not covered by paragraph 1.3. Payment of a bonus to the player shall occur immediately when the conditions are satisfied.Chapter 7Suspension and closure of gaming accounts§ 22. When closing a gaming account, the licence-holder shall, as quickly as possible, and no later than5 business days after closing the account, pay the balance from the player’s gaming account to theplayer. No fee shall be charged for the closure.2. When closing a temporary gaming account, only the remaining deposited funds on the account maybe returned to the player’s Nemkonto. Any winnings shall be retained by the licence-holder.§ 23. The licence-holder may suspend a player’s gaming account, if the player is suspected of havingunlawfully obtained winnings or has violated the provisions in the Act, the present executive order orterms associated with the gaming account. The player must be informed immediately of the reasons forthe suspension. The licence-holder must decide the matter within a reasonable time. During the periodof suspension, the player may not close their gaming account.2. When deciding on confiscation of the player’s funds, only the portion of the funds obtained byimproper means may be confiscated.
6/143. The licence-holder shall send a reasoned decision with documentation to the player. A copy of thedecision shall be sent to the gaming authority.Chapter 8Collusion and employees’ participation in gaming§ 24. The licence-holder shall take measures that are appropriate to reduce the risk of collusion (“match-fixing”) and shall refuse to accept wagers in betting where there are grounds to suspect collusion.§ 25. The licence-holder shall not provide betting on sports events for adolescents under 18.§ 26. The licence-holder shall ensure that his employees, suppliers and other persons associated with thedevelopment of the games do not have access to participate in the licence-holders’ gaming.Chapter 9Gaming systems§ 27. The licence-holder shall comply with the technical requirements for control systems that followfrom Annex 1.§ 28. Gaming systems, which means IT equipment used for the provision of betting and onlinecasinos, and the control data memory (SAFE), which the licence-holder must establish for thestorage of the data that the gaming authority requires for control, cf. Annex 1, shall be located inthis country.2. The gaming authority may give approval for the gaming system and control data storage to be locatedin another country where the licence-holder has a licence for the provision of gaming, if a publicauthority in that country oversees the licence-holder’s provision of gaming and this supervisoryauthority has entered into an agreement with the gaming authority on oversight of the licence-holder’sprovision of gaming in this country.§ 29. Gaming systems used for the provision of betting and online casinos shall have prior approvalfrom the gaming authority, before they may be used to provide gaming.2. The gaming authority may require that gaming systems be certified by an accredited testing companyapproved by the gaming authority. The gaming authority can set terms for the certification.§ 30. No changes may be made to the gaming system without prior approval from the gaming authority.
7/142. The licence-holder shall maintain a list of changes made to the gaming system. The list shall be madeeasily accessible to the gaming authority.§ 31. When a system is approved for use, the gaming authority can, at any time, order the licence-holderto conduct further testing, verification and certification of the system. The costs for this shall be borneby the licence-holder.§ 32. The licence-holder shall keep all data on the provision of betting and online casinos in the gamingsystem for at least 5 years.Chapter 10Complaints§ 33. The licence-holder shall process complaints from players regarding the licence-holder’s provisionof gaming. A complaint shall contain information about the player’s identity and the grounds for thealleged infringement. The complaint can be dismissed if the conditions are not satisfied.2. The licence-holder shall process the complaint as soon as possible. If the complaint is not settledwithin 14 days, the licence-holder shall inform the player about when they can expect a decision in thecase.3. The licence-holder shall retain documents from complaints, including documents in cases of rejectedcomplaints, for a minimum of 2 years and shall forward these to the gaming authority on request.Chapter 11Dispensation§ 34. The gaming authority may, after a concrete assessment, waive the rules of this executive orderwhen this is considered reasonable and if the implementation of all of the provisions laid down in theexecutive order for the provision of gaming is deemed to be unsuitable or impossible to achieve, takinginto account the technical nature of a game, implementation would be unusually burdensome for thelicence-holder, taking into account the expected taxable gaming income, or the nature or extent of thegame do not otherwise require the precautions laid down in the executive order.Chapter 12Sanctions§ 35. Unless a more severe penalty is warranted under other legislation, a person who intentionally orthrough gross negligence violates Articles 2-5, Article 6(1)(1), Articles 7-16, Article 17(1)(2) and (4),
8/14Article 17(2)-(4), Articles 18-20, Article 21(1) and (3), Articles 22-23 and Articles 25-27, Article 28(1),Article 29(1), Article 30 and Articles 32-33 shall be punished by a fine.2. Companies, etc. (legal persons) can be held criminally liable in accordance with the regulations inChapter 5 of the criminal code.Chapter 15Entry into force§ 36. The executive order comes into force on XX.XXXX.
9/14Annex 1. Technical requirements for controlsystemA IntroductionThis document presents the technical elements that must be complied with by a gaming providerwho applies for a licence to provide betting and online casinos.The conditions described in the document must be established and documented before anapplication can be approved.B. Abbreviations and definitionsSPM: The Danish gaming authoritySAFE: The data storage that the licence-holder shall establish for the storage of the datathat SPM requires for oversight.RNG: Random Number Generator.Gaming system: The IT platform on which the licence-holder operates their gaming (operatorplatform = frontend and backend).SFTP: Secure File Transfer Protocol.XSD: XML Standard Definition.XML: Extensible Markup Language.C. Requirements for data (standard records)This section contains a description of the data that the licence-holder shall send to SAFE. Thefollowing gaming types are operated:• Pools gaming.• Fixed-odds gaming.• Single-player internet gaming (playing alone against the gaming provider).• Multi-player internet gaming (games where several players play against each other).The gaming authority shall publish a technical description of the data format in which data shall besent to SAFE (standard record). The technical description includes conceptual models and fielddefinitions.
10/14D. Requirements for SAFED.1 Storage of standard recordsSAFE shall be established on a separate server physically separated from the licence-holder’sgaming system. It is a requirement that data on SAFE shall be separated logically and securelyfrom any other data.• The licence-holder shall store data on SAFE for 12 consecutive months. Data from a further48 months shall be stored on a digitally readable medium.• Licence-holders shall ensure that SPM has online access to retrieve data (standard records)from SAFE. Licence-holders shall establish access to SAFE via an SFTP access for use forSPM’s control.• Licence-holders shall ensure the necessary backup of all data. SAFE and backup of SAFEmust be geographically separated. Data storage on digitally readable media must also begeographically separated from backup of the data.• Licence-holders must document that SAFE complies with the stated requirements.D.2 Transferring data from the gaming system to SAFEThere is an anti-tamper token included in the data transmission from the gaming system to SAFE(see the illustration below).The token is used to encrypt the package so that SPM can verify the token and checksum uponreceipt, thereby ensuring that the contents of the package have not been changed since the tokenwas issued.The anti-tampering token shall be issued daily. The frequency may be adjusted after a concreteassessment. SPM sets up the server to issue tokens.The illustration below shows how SAFE shall be established in relation to the other components inthe overall gaming system.
11/14A copy of the data from the gaming system is stored on SAFE immediately (near real time) afterevery transaction (game) is implemented.The transfer of data must be on a secure line (anti-tamper token via web service, which isdescribed in a service catalogue) and it is the responsibility of the licence-holder to document thatthe data transmission is performed safely and securely.Data shall be transferred in accordance with the requirements set by SPM for standard records (cf.section C). It is the licence-holder’s responsibility and task to secure this data transfer.D.3 Directory structure on SAFEThe directory structure on SAFE shall be structured according to the following model.• Game type: This could include: pools betting, fixed-odds gaming, single-player internetgaming, multi-player internet gamingLand-based gamingvenues (DK)Licence-holdersTamperToken The token is onlyretrievedoccasionally, e.g.once each daySAFE (FILESERVER) Data for12 consecutivemonthsData onelectronicallyreadable mediumfor 48 monthsBACKUPGamblingaddictionregister The licence-holder shallperform a search in LURwhen setting up a newaccount.When registering avoluntary self-exclusion,the licence-holder shallsend an update to LURimmediately.The licence-holder shallcheck LUR daily toensure that no registeredplayers have been listedin LUR.SFTPSFTPTamper-tokenServerDATABASEReporting dataGamingauthority/SKATGaming addictionregister (LUR)GUI for updatingInterface betweenlicence-holder andthe gaming authorityPlayers
12/14• Date: Date for completion of the game (after the bet has been entered into in the case ofpools betting) [syntax: YYYY-MM-DD]• Time: Classification by time is an option, if the file system cannot handle the number of xmlfiles [syntax: HH:MM:SS]The illustration below shows an example of the directory structure.E. Continuous verification of compliance with the terms of the licenceE.1 Requesting of dataThe licence-holder shall, on request, be able to provide archived data from the digitally readablemedia named above in Section D.1 to the SPM within 5 working days.E.2 Requesting other informationIn addition to the data mentioned in Section E, the licence-holder must be able to generateinformation from his gaming system and any associated systems, including e.g.:• Information on interactive games, such as the cards played in poker. Regardless of whethergaming occurs via a network where players participate from several different gamingproviders, SPM may require information relating to all participants in the hand.• Information on player identity• Information on gaming accounts• Statistical information.• Extracts from actual registrations on the licence-holder’s gaming system.
13/14The information shall be delivered to SPM within 5 days.E.3 On-site verificationOn-site verification of the gaming system, company and SAFE shall be performed by SPM and/or incooperation with a third party appointed by SPM.F. Requirements for the licence-holder’s controls, business procedures andorganisationThe licence-holder shall draw up, document and implement regular checks of whether theapplicable requirements are being consistently respected by both the licence-holder and hiscooperation partners. These shall include as a minimum:• Daily inspection performed by staff and management (as far as possible incorporated intobusiness procedures and systems).• Periodic and random sample internal audit.• External audit, when this proves necessary to achieve a satisfactory level of documentationthat the applicable requirements are satisfied.• Processing and archiving of control results.• Immediate reporting to SPM in the event of the discovery of errors or infringements, andfor suspicions of errors or infringements by the licence-holder and/or by his cooperationpartners. The reporting shall include the licence-holder’s assessment of the consequencesof the error or infringement.The licence-holder is responsible for preparing, documenting and following relevant businessprocedures intended to provide support and ensure that both the licence-holder and anycooperation partners continuously comply with the applicable requirements. The businessprocedures shall include as a minimum:• The licence-holder shall ensure monitoring of all components and data transmissions in theoverall gaming system, including data lines, data packages, networks, SAFE, RNG, thegaming system, etc. (also components and data transmissions at any involved third party)in order to ensure both reliability and accessibility.• The licence-holder shall ensure that there are back-up and restoration procedures toprevent the loss of data.• The licence-holder shall ensure maintenance and safety procedures to ensure secure andreliable operations.
14/14The licence-holder shall be suitably organised and adequately staffed in relation to offering itsproducts in accordance with the intention of the Gaming Act and with the requirements laid downby SPM.In addition to the requirements relating to roles and personnel that the law lays down for theissuing of licences, the licence-holder shall, as a minimum, establish the following organizationalroles. The roles shall always be occupied by named individuals who will be responsible for theirrespective area as indicated in the title role below:• Responsible for gaming software and gaming operations, including ensuring that all gamingis structured and operated properly and reliably without errors and cheating, including byany cooperation partners that the licence-holder may have.• Responsible for IT security, including ensuring that all forms of IT hardware, software andnetworks used by the licence-holder (and any cooperation partners that the licence-holdermay have) are operated in a properly secure manner.• Responsible for finances, including ensuring that SKAT always receives the correct share ofthe gross gaming income.The individuals must possess the necessary qualifications and the necessary experience to assumethe role and responsibility. The licence-holder shall ensure that the individuals have the authorityto establish measures and implement necessary changes in order to ensure that the licence-holdercomplies with the requirements.These individuals will be the direct contact points in connection with inspections and controls. Itmust therefore always be possible for the individuals to provide and account for all informationand documentation which SPM may require within their respective areas.