Administrative Code

Virginia Administrative Code
12/2/2022

Article 3. System Requirements

11VAC15-40-160. Distributed pull-tab system.

A distributed pull-tab system shall be dedicated primarily to electronic accounting, reporting, and the presentation, randomization, and transmission of electronic pull-tabs to the electronic pull-tab devices. It shall also be capable of generating the data necessary to provide the reports required within this article or otherwise specified by the department.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-170. Dispensing of electronic game cards pull-tabs.

A distributed pull-tab system shall dispense, upon request, an electronic pull-tab. All games must be played without replacement, drawing from a single finite game set.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-180. Game set requirements.

Each game set shall meet the following minimum requirements:

1. Each game set shall be made up of a finite number of electronic pull-tabs;

2. The game set shall consist of a maximum of 25,000 electronic pull-tabs;

3. All electronic pull-tabs in a particular game set shall be of the same purchase price;

4. The maximum win amount awarded per any one electronic pull-tab shall not exceed the value set forth for pull-tabs by § 18.2-340.33 of the Code of Virginia;

5. Each game set shall be assigned a unique serial number;

6. After randomization, game sets may be broken into subsets of equal size. If game subsets are used, they shall each be assigned a unique serial number and be traceable to a parent game set; and

7. Game sets shall not be commingled.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-190. Game set definition.

If the system has the capability to create a game set from a predefined set of criteria, the criteria must contain the following information:

1. Game ID;

2. Game set version;

3. Manufacturer;

4. Game name;

5. Paytable ID;

6. Purchase price per electronic pull-tab;

7. Subset size;

8. Total number of subsets; and

9. Prize values with an associated index and frequency.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-200. Data required to be available for each game set.

A. The following data shall be available prior to the opening of a game set for distribution and shall be maintained and be viewable both electronically and, if requested, by printed report, upon demand:

1. A unique serial number identifying each game set and/or subset;

2. A description of the game set sufficient to categorize the game set or subset relative to other game sets;

3. The total number of electronic pull-tabs in the game set;

4. The number of game subsets to be created from the game set and the number of electronic pull-tabs in each subset when applicable;

5. The payout percentage of the entire game set;

6. The purchase price per electronic pull-tab assigned to the game set; and

7. Prize values with an associated index and frequency.

B. The following data shall be available subsequent to the completion of a game set and shall be maintained and viewable both electronically and, if requested, by printed report, upon demand:

1. A unique serial number identifying each game set and/or subset;

2. Description of the game set sufficient to categorize the game set relative to other game sets;

3. The total number of electronic pull-tabs unsold;

4. The total number of electronic pull-tabs purchased;

5. The time and date that the game set and/or each game subset became available for play;

6. The time and date that the game set and/or each game subset was completed or removed from play;

7. Location where game set and/or subset was played;

8. The final payout percentage of the game set when removed from play; and

9. The purchase price per electronic pull-tab assigned to the game set.

C. In order to provide maximum game integrity, no audit or other determination of the status of any game set or any subset, including, but not limited to, a determination of the prizes won or prizes remaining to be won, shall be conducted by anyone while a game set or subset is in play without causing termination of the entire game set or subset. Only upon game set termination shall the details of the associated game set and subsets be revealed to the individual or individuals performing the audit.

D. Once terminated, a game set shall not be able to be reopened.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-210. Security requirements.

A. A distributed pull-tab system computer must be in a locked, secure enclosure with key controls in place.

B. A distributed pull-tab system shall provide a means for terminating the game set if information about electronic pull-tabs in an open game set has been accessed or at the discretion of the department. In such cases, traceability of unauthorized access including time and date, users involved, and any other relevant information shall be available.

C. A distributed pull-tab system shall not permit the alteration of any accounting or significant event information that was communicated from the electronic pull-tab device without supervised access controls. In the event financial data is changed, an automated audit log must be capable of being produced to document the following:

1. Data element altered;

2. Data element value prior to alteration;

3. Data element value after alteration;

4. Time and date of alteration; and

5. Personnel that performed alteration.

D. A distributed pull-tab system must provide password security or other secure means of ensuring data integrity and enforcing user permissions for all system components through the following means:

1. All programs and data files must only be accessible via the entry of a password that will be known only to authorized personnel;

2. The distributed pull-tab system must have multiple security access levels to control and restrict different classes;

3. The distributed pull-tab system access accounts must be unique when assigned to the authorized personnel and shared accounts amongst authorized personnel must not be allowed;

4. The storage of passwords and PINs must be in an encrypted, nonreversible form; and

5. A program or report must be available that will list all registered users on the distributed pull-tab system including their privilege level.

E. All components of a distributed pull-tab system that allow access to users, other than end-users for game play, must have a password sign-on with two-level codes comprising the personal identification code and a personal password.

1. The personal identification code must have a length of at least six ASCII characters; and

2. The personal password must have a minimum length of six alphanumeric characters, which should include at least one nonalphabetic character.

F. A distributed pull-tab system must have the capability to control potential data corruption that can be created by multiple simultaneous log-ons by system management personnel.

1. A distributed pull-tab system shall specify which of the access levels allow for multiple simultaneous sign-ons by different users and which of the access levels do not allow for multiple sign-ons, and, if multiple sign-ons are possible, what restrictions, if any, exist; or

2. If a distributed pull-tab system does not provide adequate control, a comprehensive procedural control document must be drafted for the department's review and approval.

G. Distributed pull-tab system software components/modules shall be verifiable by a secure means at the system level. A distributed pull-tab system shall have the ability to allow for an independent integrity check of the components/modules from an outside source, and an independent integrity check is required for all control programs that may affect the integrity of the distributed pull-tab system. This must be accomplished by being authenticated by a third-party device, which may be embedded within the distributed pull-tab system software or having an interface or procedure for a third-party application to authenticate the component. This integrity check will provide a means for field verification of the distributed pull-tab system components.

H. A distributed pull-tab system may be used to configure and perform security checks on electronic pull-tab devices, provided such functions do not affect the security, integrity, or outcome of any game and meets the requirements set forth in this regulation regarding program storage devices.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012; amended, Virginia Register Volume 33, Issue 4, eff. November 17, 2016.

11VAC15-40-220. Backup and recovery.

A. A distributed pull-tab system computer shall have a separate physical medium for securely storing game sets or subsets on the computer, which shall be mirrored in real time by a backup medium.

B. All data required to be available or reported by this chapter must be retained for a period of not less than three years from the close of the fiscal year.

C. All storage of critical data shall utilize error checking and be stored on a nonvolatile physical medium.

D. The database shall be stored on redundant media so that no single failure of any portion of the system would result in the loss or corruption of data.

E. In the event of a catastrophic failure when the distributed pull-tab system cannot be restarted in any other way, it shall be possible to reload the distributed pull-tab system from the last viable backup point and fully recover the contents of that backup, to consist of at least the following information:

1. All significant events;

2. All accounting information;

3. Auditing information, including all open game sets and the summary of completed game sets; and

4. Employee files with access levels.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-230. Electronic accounting and reporting.

A. One or more electronic accounting systems shall be required to perform reporting and other functions in support of distributed pull-tab system. The electronic accounting system shall not interfere with the outcome of any gaming function.

B. The following reporting capabilities must be provided by the electronic accounting system:

1. Electronic pull-tab game set report – game sets in play. An electronic pull-tab game set report must be available on demand for each game set currently in play. Game cards, outcomes, or prizes must not be revealed. The report must contain the following information:

a. A unique serial number identifying each game set and/or subsets;

b. A description of the game set sufficient to categorize the game set or subset relative to other game sets;

c. The total number of electronic pull-tabs in the game set;

d. The number of game subsets to be created from the game set and the number of electronic pull-tabs in each subset when applicable;

e. The theoretical payout percentage of the entire game set;

f. The purchase price per electronic pull-tab assigned to the game set;

g. The time and date that the game set and/or each game subset became available for play; and

h. Location where the game set and/or subset is being played.

2. Electronic pull-tab game set report – completed game set. An electronic pull-tab game set report must be available on demand, for each completed game set. The report must contain the following information:

a. A unique serial number identifying each game set and/or subset;

b. Description of the game set sufficient to categorize the game set relative to other game sets;

c. The total number of electronic pull-tabs unsold;

d. The total number of electronic pull-tabs purchased;

e. The time and date that the game set and/or each game subset became available for play;

f. The time and date that the game set and/or each game subset was completed or removed from play;

g. Location where game set and/or subset was played;

h. The final payout percentage of the game set when removed from play; and

i. The purchase price per electronic pull-tab assigned to the game set.

3. A report that shall indicate all prizes that exceed the threshold that triggers additional procedures to be followed for the purpose of compliance with federal tax reporting requirements. At a minimum, on a daily and monthly basis, the report shall provide the following information per electronic pull-tab device:

a. The date and time won;

b. Location of prize award; and

c. Amount of each prize occurrence.

4. Liability report. A liability report shall provide a summary of the outstanding funds that carry from business day to business day. At a minimum, this report shall include:

a. Amount of prizes and/or vouchers that were awarded in dollars and cents, but have not yet been claimed that have not yet expired; and

b. Summary of all outstanding accounts.

C. A distributed pull-tab system shall be capable of providing an electronic file in a format specified by the department on a periodic basis to a location specified by the department. The data to be reported will contain, at a minimum, the following items per session:

1. Organization identification;

2. Session date;

3. Total cash in;

4. Total cash out;

5. Total cash played;

6. Total cash won;

7. For all game sets on the system in play or in inventory:

a. Serial number;

b. Description;

c. Ticket price;

d. Number of subsets if applicable;

e. Number of tickets or number of tickets per subset;

f. Theoretical return percentage; and

g. Date game set was opened for play, when applicable; and

8. For all game sets completed or closed since the previous reporting date:

a. Serial number;

b. Description;

c. Ticket price;

d. Number of subsets, if applicable;

e. Number of tickets or number of tickets per subset;

f. Theoretical return percentage;

g. Date game set was opened;

h. Date game set was closed;

i. Total tickets sold;

j. Total dollars in;

k. Total prizes paid; and

l. Actual return percentage.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-240. Randomization.

A. As used in this section, unless the context requires a different meaning:

"Card position" means the first card dealt, second card dealt in sequential order.

"Number position" means the first number drawn in sequential order.

B. A distributed pull-tab system shall utilize randomizing procedures in the creation of game sets for electronic pull-tabs or externally generated randomized game sets that have been created using a method previously approved by the department.

C. Any random number generation, shuffling, or randomization of outcomes used in connection with a distributed pull-tab system must be by use of a random number generation application that has successfully passed standard tests for randomness and unpredictability including but not limited to:

1. Each card position or number position satisfies the 99% confidence limit using the standard chi-squared analysis. "Chi-squared analysis" is the sum of the ratio of the square difference between the expected result and the observed result to the expected result.

2. Each card position or number position does not produce a significant statistic with regard to producing patterns of occurrences. Each card position or number position will be considered random if it meets the 99% confidence level with regard to the "run test" or any similar pattern testing statistic. The "run test" is a mathematical statistic that determines the existence of recurring patterns within a set of data.

3. Each card position or number position is independently chosen without regard to any other card or number drawn within that game play. This test is the "correlation test." Each pair of card positions or number positions is considered random if it meets the 99% confidence level using standard correlation analysis.

4. Each card position or number position is independently chosen without reference to the same card position or number position in the previous game. This test is the "serial correlation test." Each card position or number position is considered random if it meets the 99% confidence level using standard serial correlation analysis.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-250. Communications and network requirements.

A. Where the distributed pull-tab system components are linked with one another in a network, communication protocols shall be used that ensure that erroneous data or signals will not adversely affect the operations of any such system components.

B. All data communication shall incorporate an error detection and correction scheme to ensure the data is transmitted and received accurately.

C. Connections between all components of the distributed pull-tab system shall only be through the use of secure communication protocol(s) that are designed to prevent unauthorized access or tampering, employing Advanced Encryption Standard (AES), or equivalent encryption.

D. A firewall or equivalent hardware device configured to block all inbound and outbound traffic that has not been expressly permitted and is not required for continued use of the distributed pull-tab system must exist between the distributed pull-tab system and any external point of access.

E. The minimum width (size) for encryption keys is 112 bits for symmetric algorithms and 1024 bits for public keys.

F. There must be a secure method implemented for changing the current encryption key set. It is not acceptable to only use the current key set to "encrypt" the next set.

G. There must be a secure method in place for the storage of any encryption keys. Encryption keys must not be stored without being encrypted themselves.

H. If a wireless network is used, wireless products used in conjunction with any gaming system or system component must meet the following minimum standards:

1. Employ a security process that complies with the Federal Information Processing Standard 140-2 (FIPS 140-2); or

2. Employ an alternative method, as approved by the department.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-260. Significant events.

The following significant events, if applicable, shall be collected from the electronic pull-tab device or point of sale and communicated to the system for storage and a report of the occurrence of the significant event must be made available upon request:

1. Power resets or power failure.

2. Communication loss between an electronic pull-tab device and any component of the distributed pull-tab system.

3. Electronic pull-tab device jackpot (any award in excess of the single win limit of the electronic pull-tab device).

4. Door openings (any external door that accesses a critical area of the electronic pull-tab device).

5. Bill validator errors:

a. Stacker full (if supported); and

b. Bill jam.

6. Printer errors:

a. Printer empty; and

b. Printer disconnect or failure.

7. Corruption of the electronic pull-tab device RAM or program storage device.

8. Any other significant events as defined by the protocol employed by the distributed pull-tab system.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-270. Validation system and redemption.

A distributed pull-tab system may utilize a voucher validation system to facilitate gaming transactions. The validation system may be entirely integrated into a distributed pull-tab system or exist as a separate entity.

1. A distributed pull-tab system may allow voucher out only; vouchers shall not be inserted, scanned, or used in any way at the electronic pull-tab device for redemption.

2. The validation system must process voucher redemption correctly according to the secure communication protocol implemented.

3. The algorithm or method used by the validation system or distributed pull-tab system to generate the voucher validation numbers must guarantee an insignificant percentage of repetitive validation numbers.

4. The validation system must retrieve the voucher information correctly based on the secure communication protocol implemented and store the voucher information in a database. The voucher record on the host system must contain, at a minimum, the following voucher information:

a. Validation number;

b. Date and time the electronic pull-tab device printed the voucher;

c. Value of voucher in dollars and cents;

d. Status of voucher;

e. Date and time the voucher will expire;

f. Serial number of electronic pull-tab device; and

g. Location name or site identifier.

5. The validation system or distributed pull-tab system must have the ability to identify the following occurrences and notify the cashier when the following conditions exist:

a. Voucher cannot be found on file;

b. Voucher has already been paid; or

c. Amount of voucher differs from amount on file (requirement may be met by display of voucher amount for confirmation by cashier during the redemption process).

6. If the connection between the validation system and the distributed pull-tab system fails, an alternate method or procedure of payment must be available and shall include the ability to identify duplicate vouchers and prevent fraud by redeeming vouchers that were previously issued by the electronic pull-tab device.

7. The following reports related to vouchers shall be generated on demand:

a. Voucher Issuance Report shall be available from the validation system that shows all vouchers generated by an electronic pull-tab device; and

b. Voucher Redemption Report shall detail individual vouchers, the sum of the vouchers paid by the validation terminal or point of sale by session, and include the following information:

(1) The date and time of the transaction;

(2) The dollar value of the transaction;

(3) Validation number;

(4) A transaction number; and

(5) Point-of-sale identification number or name.

8. The validation system database must be encrypted and password-protected and should possess a nonalterable user audit trail to prevent unauthorized access.

9. The normal operation of any device that holds voucher information shall not have any options or method that may compromise voucher information. Any device that holds voucher information in its memory shall not allow removal of the information unless it has first transferred that information to the ticketing database or other secured component or components of the validation system.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

11VAC15-40-280. Point of sale; validation terminal.

A. A distributed pull-tab system may utilize a point-of-sale or validation terminal that is capable of facilitating the sale of the organization's pull tab outcomes or used for the redemption of credits from player accounts or vouchers. The point of sale may be entirely integrated into a distributed pull-tab system or exist as a separate entity.

B. Point-of-sale use is only permissible when the device is linked to an approved validation system or distributed pull-tab system.

C. If a distributed pull-tab system utilizes a point of sale, it shall be capable of printing a receipt for each sale, void, or redemption. The receipt shall contain the following information:

1. Date and time of the transaction;

2. Dollar value of the transaction;

3. Validation number, if applicable;

4. Quantity of associated products, if applicable;

5. Transaction number;

6. Account number, if applicable; and

7. Point-of-sale identification number or name.

D. The following point-of-sale or validation terminal reports shall be generated on demand:

1. Sales transaction history report shall show all sales and voids by session and include the following information:

a. Date and time of the transaction;

b. Dollar value of the transaction;

c. Quantity of associated products;

d. Transaction number; and

e. Point of sale identification number or name.

2. Voucher redemption report shall detail individual voucher redemptions paid by the validation terminal or point of sale by session and include the following information:

a. Date and time of the transaction;

b. Dollar value of the transaction;

c. Validation number;

d. Transaction number; and

e. Point of sale identification number or name.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012; amended, Virginia Register Volume 33, Issue 4, eff. November 17, 2016.

11VAC15-40-290. Location of equipment.

All equipment used to facilitate the distribution, play, or redemption of electronic pull-tab games must be physically located within the boundaries of the Commonwealth of Virginia. This includes but is not limited to the distributed pull-tab system, electronic pull-tab devices, redemption terminals, and point-of-sale stations.

Statutory Authority

§ 18.2-340.15 of the Code of Virginia.

Historical Notes

Derived from Virginia Register Volume 29, Issue 3, eff. November 7, 2012.

Website addresses provided in the Virginia Administrative Code to documents incorporated by reference are for the reader's convenience only, may not necessarily be active or current, and should not be relied upon. To ensure the information incorporated by reference is accurate, the reader is encouraged to use the source document described in the regulation.

As a service to the public, the Virginia Administrative Code is provided online by the Virginia General Assembly. We are unable to answer legal questions or respond to requests for legal advice, including application of law to specific fact. To understand and protect your legal rights, you should consult an attorney.