Minimum Internal Control Standards
| Published date | 21 December 2018 |
| Record Number | 2018-27651 |
| Court | National Indian Gaming Commission |
Federal Register, Volume 83 Issue 245 (Friday, December 21, 2018)
[Federal Register Volume 83, Number 245 (Friday, December 21, 2018)]
[Rules and Regulations]
[Pages 65506-65509]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-27651]
=======================================================================
-----------------------------------------------------------------------
DEPARTMENT OF THE INTERIOR
National Indian Gaming Commission
25 CFR Part 543
RIN 3141-AA60
Minimum Internal Control Standards
AGENCY: National Indian Gaming Commission, Interior.
ACTION: Final rule.
-----------------------------------------------------------------------
SUMMARY: The National Indian Gaming Commission (NIGC) amends its
minimum internal control standards for Class II gaming under the Indian
Gaming Regulatory Act to correct an erroneous deletion of the key
control standards and to make other minor edits and additions for
clarity.
DATES: Effective Date: January 22, 2019.
FOR FURTHER INFORMATION CONTACT: Jennifer Lawson at (202) 632-7003 or
by fax (202) 632-7066 (these numbers are not toll free).
SUPPLEMENTARY INFORMATION:
I. Background
The Indian Gaming Regulatory Act (IGRA or Act), Public Law 100-497,
25 U.S.C. 2701 et seq., was signed into law on October 17, 1988. The
Act established the National Indian Gaming Commission (``NIGC'' or
``Commission'') and set out a comprehensive framework for the
regulation of gaming on Indian lands. On January 5, 1999, the NIGC
published a final rule in the Federal Register called Minimum Internal
Control Standards. 64 FR 590. The rule added a new part to the
Commission's regulations establishing Minimum Internal Control
Standards (MICS) to reduce the risk of loss because of customer or
employee access to cash and cash equivalents within a casino. The rule
contains standards and procedures that govern cash handling,
documentation, game integrity, auditing, surveillance, and variances,
as well as other areas.
The Commission recognized from their inception that the MICS would
require periodic review and updates to keep pace with technology and
has substantively amended them numerous times, most recently in late
2013 (78 FR 63873).
II. Development of the Rule
On September 21, 2012, the Commission concluded nearly two years of
consultation and drafting with the publication of comprehensive
amendments, additions, and updates to Part 543, the minimum internal
control standards (MICS) for Class II gaming operations (77 FR 58708).
The regulations require tribes to establish controls and implement
procedures at least as stringent as those described in
[[Page 65507]]
this part to maintain the integrity of the gaming operation. In late
2013, the Commission published a final rule, adding kiosk drop, count,
fill, and surveillance standards to Part 543 (78 FR 63873).
Now, the Commission is finalizing additional revisions, largely
technical in nature, that are meant to correct earlier editing
oversights and to better clarify the intent of the provisions. The
proposed rule was published June 8, 2018 (83 FR 26620), and the comment
period expired July 9, 2018.
III. Review of Public Comments
NIGC received the following comments in response to the proposed
rule:
Comment: One commenter recommended requiring an inventory under
Sec. 543.10(e) if a table is open going into the next gaming day.
Response: The standard requires a count at the end of each shift
and the Commission notes that the majority of operations have shifts
that coincide with their gaming days. Tribes have the option of
requiring an additional count where a shift crosses over from one
gaming day to the next.
Comment: One commenter argued that it is too burdensome to require
a supervisor to count the table inventory in Sec. 543.10(e).
Response: Since its inception, Sec. 543.10(e) has required a
supervisor to count the table inventory. The rule now also requires a
supervisor to count the main card room bank.
Comment: One commenter believed that the amendments eliminated
kiosks from Sec. 543.17(j).
Response: The kiosk provisions remain in the regulations and can be
found at Sec. Sec. 543.17(i) (Kiosk count standards) and (j)(9):
``Controls must be established and procedures implemented to safeguard
the use, access, and security of keys for kiosks.''
Comment: Two commenters expressed concern that Sec. 543.17(j)(4),
which requires the key holder to be independent of those conducting the
drop, would prevent those responsible for drops from having access to
the keys necessary to conduct them. One commenter specifically
identified the need for security personnel's assistance in emergency
drops as problematic under these regulations because the security
department holds the keys.
Response: The term ``custody'' seems to have been confused with
physical use of the key. Typically, security personnel are not used as
drop agents: they only accompany the drop team as they remove Financial
Instrument Storage Components. Occasionally, operations allow card
tables to be dropped by a security agent and the shift supervisor.
Custody involves more than just physical custody (i.e., stored in
security room or other area controlled by security), and includes
logical custody (i.e., I.T. controls of lock box). Additionally, the
complete inventory records for the keys should be kept with accounting
department.
A separation of duties must be established for granting or limiting
access to the keys, custody of the keys, and recordkeeping duties for
the keys. Each operation is unique and, to maintain independence,
security should either be precluded from acting as drop team agents or
have limited control over the keys.
Comment: One commenter requested clarification on Sec.
543.17(j)(7), particularly whether it is intended to address emergency
drop situations requiring immediate access.
Response: The standard is meant to address emergency drop
situations. Use of the keys outside the scheduled time for use includes
an emergency drop. Other times can include, but are not limited to,
inventory or replacement. The standard is intended to ensure security
of the box contents and require proper authorization to issue of keys
outside of the scheduled count.
Comment: One commenter asked whether Sec. 543.17(j)(8) applies to
manually-controlled key boxes, electronic boxes, or both, and whether
removal of the player interface drop and count will need to meet
requirements set forth for regularly scheduled drop and count (e.g.
Sec. 543.17(e)(4)) in addition to these requirements.
Response: The standard applies to computerized, electronic, and
alternative key systems. A manual key system does not have an override
key. In the event of power loss or other issue, the emergency manual
keys allow access to the key box. These keys should be secured by other
means and only accessed in an emergency.
The removal of a financial instrument can occur during a regularly
scheduled drop or an emergency drop. Standards are provided for each
situation and the operation should determine which are appropriate to
follow based on the circumstances.
Comment: One Commenter asked whether Sec. 543.17(j)(8)(i) also
applies to financial instrument storage components and drop boxes.
Response: It does not. The standard applies to emergency manual
keys. The standard later states at Sec. 543.17(j)(8)(iii) that if the
player interface drop and count keys are not accessed, then only two
agents are required: Those are the keys used for the financial
instrument storage components and drop boxes.
Comment: One commenter expressed a general concern that overly
burdensome key controls lead to delay, customer frustration and
inefficiency of the gaming operation and noted the need for balance
between security and functionality.
Response: The Commission agrees and believes it has done its best
to strike a proper balance between protection of tribal assets and
efficiency. These standards are consistent with those of other
jurisdictions, but also allow some flexibility. Tribes and operation
management must establish controls and implement procedures to best fit
their needs and manage risks specific to their operations.
Comment: One commenter believes Sec. 543.17(j)(6) is in conflict
with Sec. 543.17(d)(4) and the entire key control process needs
further clarification.
Response: Without further discussion, it is unclear what conflict
the commenter sees. The Commission believes the provisions can be read
harmoniously. Section 543.17(j)(6) restricts access to drop box release
keys to the count team and authorized agents.
Section 543.17(j)(7) requires anyone using the keys outside of the
scheduled drop and count time to be authorized--thereby becoming an
authorized agent under (j)(6))--and documented. This allows for an
emergency drop to be conducted by authorized agents so the drop team
does not need to be called.
Section 543.17 (d)(4) requires drop boxes to be removed only at the
time previously designated by the gaming operation and reported to the
TGRA, but it specifically allows for emergency drops, which require
surveillance and TGRA to be notified.
IV. Regulatory Matters
Regulatory Flexibility Act
The rule will not have a significant impact on a substantial number
of small entities as defined under the Regulatory Flexibility Act, 5
U.S.C. 601, et seq. Moreover, Indian Tribes are not considered to be
small entities for the purposes of the Regulatory Flexibility Act.
Small Business Regulatory Enforcement Fairness Act
The rule is not a major rule under 5 U.S.C. 804(2), the Small
Business Regulatory Enforcement Fairness Act. The rule does not have an
effect on the economy of $100 million or more. The rule will not cause
a major increase in costs or prices for consumers, individual
industries, Federal, State,
[[Page 65508]]
local government agencies or geographic regions, nor will the proposed
rule have a significant adverse effect on competition, employment,
investment, productivity, innovation, or the ability of the
enterprises, to compete with foreign based enterprises.
Unfunded Mandate Reform Act
The Commission, as an independent regulatory agency, is exempt from
compliance with the Unfunded Mandates Reform Act, 2 U.S.C. 1502(1); 2
U.S.C. 658(1).
Takings
In accordance with Executive Order 12630, the Commission has
determined that the rule does not have significant takings
implications. A takings implication assessment is not required.
Civil Justice Reform
In accordance with Executive Order 12988, the Commission has
determined that the rule does not unduly burden the judicial system and
meets the requirements of sections 3(a) and 3(b)(2) of the Order.
National Environmental Policy Act
The Commission has determined that the rule does not constitute a
major federal action significantly affecting the quality of the human
environment and that no detailed statement is required pursuant to the
National Environmental Policy Act of 1969, 42 U.S.C. 4321, et seq.
Paperwork Reduction Act
The information collection requirements contained in this rule were
previously approved by the Office of Management and Budget as required
by 44 U.S.C. 3501, et seq., and assigned OMB Control Number 3141-0009.
The OMB control number expires on November 30, 2018.
Tribal Consultation
The National Indian Gaming Commission is committed to fulfilling
its tribal consultation obligations--whether directed by statute or
administrative action such as Executive Order (E.O.) 13175
(Consultation and Coordination with Indian Tribal Governments)--by
adhering to the consultation framework described in its Consultation
Policy published July 15, 2013. The NIGC's consultation policy
specifies that it will consult with tribes on Commission Action with
Tribal Implications, which is defined as: Any Commission regulation,
rulemaking, policy, guidance, legislative proposal, or operational
activity that may have a substantial direct effect on an Indian tribe
on matters including, but not limited to the ability of an Indian tribe
to regulate its Indian gaming; an Indian tribe's formal relationship
with the Commission; or the consideration of the Commission's trust
responsibilities to Indian tribes.
The key control language proposed here is the most substantive of
all the changes and was the subject of extensive consultation in 2012
(77 FR 58708). The language has not changed since initially adopted. It
was inadvertently written over with the addition of kiosk controls in
2013, and this rule is to include the controls back into the
regulations. The remaining changes are all technical in nature,
correcting numbering and adding minor clarifications.
List of Subjects in 25 CFR Part 543
Accounting, Administrative practice and procedure, Gambling,
Indian--Indian lands, Reporting and recordkeeping requirements.
For the reasons discussed in the Preamble, the Commission amends 25
CFR part 543 as follows:
PART 543--MINIMUM INTERNAL CONTROL STANDARDS FOR CLASS II GAMING
0
1. The authority citation for part 543 continues to read as follows:
Authority: 25 U.S.C. 2702(2), 2706(b)(1-4), 2706(b)(10).
0
2. Amend Sec. 543.10 by revising paragraph (e) to read as follows:
Sec. 543.10 What are the minimum internal control standards for card
games?
* * * * *
(e) Standards for reconciliation of card room bank. Two agents--one
of whom must be a supervisory agent--must independently count the main
card room bank and table inventory at the end of each shift and record
the following information:
(1) Date;
(2) Shift;
(3) Table number (if applicable);
(4) Amount by denomination;
(5) Amount in total; and
(6) Signatures of both agents.
* * * * *
0
3. Amend Sec. 543.17 by revising paragraphs (d), (i)(4)(i), and (j) to
read as follows:
Sec. 543.17 What are the minimum internal control standards for drop
and count?
* * * * *
(d) Card game drop standards. Controls must be established and
procedures implemented to ensure security of the drop process. Such
controls must include the following:
(1) Surveillance must be notified when the drop is to begin so that
surveillance may monitor the activities.
(2) At least two agents must be involved in the removal of the drop
box, at least one of whom is independent of the card games department.
(3) Once the drop is started, it must continue until finished.
(4) All drop boxes may be removed only at the time previously
designated by the gaming operation and reported to the TGRA. If an
emergency drop is required, surveillance must be notified before the
drop is conducted and the TGRA must be informed within a timeframe
approved by the TGRA.
(5) At the end of each shift:
(i) All locked card game drop boxes must be removed from the tables
by an agent independent of the card game shift being dropped;
(ii) For any tables opened during the shift, a separate drop box
must be placed on each table, or a gaming operation may utilize a
single drop box with separate openings and compartments for each shift;
and
(iii) Card game drop boxes must be transported directly to the
count room or other equivalently secure area by a minimum of two
agents, at least one of whom is independent of the card game shift
being dropped, until the count takes place.
(6) All tables that were not open during a shift and therefore not
part of the drop must be documented.
(7) All card game drop boxes must be posted with a number
corresponding to a permanent number on the gaming table and marked to
indicate game, table number, and shift, if applicable.
* * * * *
(i) * * *
(4) * * *
(i) The count of each box must be recorded in ink or other
permanent form of recordation.
* * * * *
(j) Controlled keys. Controls must be established and procedures
implemented to safeguard the use, access, and security of keys in
accordance with the following:
(1) Each of the following requires a separate and unique key lock
or alternative secure access method:
(i) Drop cabinet;
(ii) Drop box release;
(iii) Drop box content; and
(iv) Storage racks and carts used for the drop.
(2) Access to and return of keys or equivalents must be documented
with the date, time, and signature or other
[[Page 65509]]
unique identifier of the agent accessing or returning the key(s).
(i) For Tier A and B operations, at least two (2) drop team agents
are required to be present to access and return keys. For Tier C
operations, at least three (3) drop team agents are required to be
present to access and return keys.
(ii) For Tier A and B operations, at least two (2) count team
agents are required to be present at the time count room and other
count keys are issued for the count. For Tier C operations, at least
three (two for card game drop box keys in operations with three tables
or fewer) count team agents are required to be present at the time
count room and other count keys are issued for the count.
(3) Documentation of all keys, including duplicates, must be
maintained, including:
(i) Unique identifier for each individual key;
(ii) Key storage location;
(iii) Number of keys made, duplicated, and destroyed; and
(iv) Authorization and access.
(4) Custody of all keys involved in the drop and count must be
maintained by a department independent of the count and the drop agents
as well as those departments being dropped and counted.
(5) Other than the count team, no agent may have access to the drop
box content keys while in possession of storage rack keys and/or
release keys.
(6) Other than the count team, only agents authorized to remove
drop boxes are allowed access to drop box release keys.
(7) Any use of keys at times other than the scheduled drop and
count must be properly authorized and documented.
(8) Emergency manual keys, such as an override key, for
computerized, electronic, and alternative key systems must be
maintained in accordance with the following:
(i) Access to the emergency manual key(s) used to access the box
containing the player interface drop and count keys requires the
physical involvement of at least three agents from separate
departments, including management. The date, time, and reason for
access, must be documented with the signatures of all participating
persons signing out/in the emergency manual key(s);
(ii) The custody of the emergency manual keys requires the presence
of two agents from separate departments from the time of their issuance
until the time of their return; and
(iii) Routine physical maintenance that requires access to the
emergency manual key(s), and does not involve accessing the player
interface drop and count keys, only requires the presence of two agents
from separate departments. The date, time, and reason for access must
be documented with the signatures of all participating agents signing
out/in the emergency manual key(s).
(9) Controls must be established and procedures implemented to
safeguard the use, access, and security of keys for kiosks.
* * * * *
0
4. Amend Sec. 543.18 by revising paragraph (d)(6)(v) to read as
follows:
Sec. 543.18 What are the minimum internal control standards for the
cage, vault, kiosk, cash and cash equivalents?
* * * * *
(d) * * *
(6) * * *
(v) Dollar amount per financial instrument redeemed;
* * * * *
0
5. Amend Sec. 543.23 by revising paragraph (c)(1)(viii) to read as
follows:
Sec. 543.23 What are the minimum internal control standards for audit
and accounting?
* * * * *
(c) * * *
(1) * * *
(viii) Drop and count standards, including supervision, count room
access, count team, card game drop standards, player interface and
financial instrument drop standards, card game count standards, player
interface financial instrument count standards, collecting currency
cassettes and financial instrument storage components from kiosks,
kiosk count standards, and controlled keys;
* * * * *
0
6. Amend Sec. 543.24 by revising paragraphs (a) and (d)(5) to read as
follows:
Sec. 543.24 What are the minimum internal control standards for
auditing revenue?
(a) Supervision. Supervision must be provided as needed for revenue
audit by an agent(s) with authority equal to or greater than those
being supervised.
* * * * *
(d) * * *
(5) Complimentary services or items. At least monthly, review the
reports required in Sec. 543.13(c). These reports must be made
available to those entities authorized by the TGRA or by tribal law or
ordinance.
* * * * *
Washington, DC.
Dated: December 12, 2018.
Jonodev O. Chaudhuri,
Chairman.
Dated: December 12, 2018.
Kathryn Isom-Clause,
Vice Chair.
Dated: December 17, 2018.
E. Sequoyah Simermeyer,
Associate Commissioner.
[FR Doc. 2018-27651 Filed 12-20-18; 8:45 am]
BILLING CODE 7565-01-P
