Skip to content
Alcohol and Gaming Commission of Ontario — Registrar's Standards for Internet Gaming

All 140 Ontario standards,
organised by risk theme

A searchable, filterable index of every Registrar's Standard for Internet Gaming in Ontario. Each standard is grouped by the risk theme the Registrar has published, tagged editorially for the player-protection categories our team tracks most closely, and presented with its principle and supporting requirements. Use it to orient on the rules that govern Ontario's regulated iGaming market.

140 Standards
210 Requirements
79 Player-flagged
5 Categories
Showing all 140 standards
1
Theme 1

Entity Level

Ensure registered operators and gaming-related suppliers maintain sound governance, honest dealings with the Registrar, and a control environment that supports the integrity of Ontario's iGaming market.

22 standards 8 player-flagged
36%
player-flagged
Regulatory risks this theme addresses
  • Operators with weak governance or unclear accountability for compliance outcomes
  • Poorly screened personnel with access to player funds, data or game controls
  • Third-party marketers driving traffic to unregistered Ontario gaming sites
  • Inadequate complaint handling leaving players without recourse
S1.01

Commitment to character, integrity and high ethical values

Applicable personnel must demonstrate character, integrity and high ethical values through attitude and action.

Requirements
  • Adhere to all applicable laws and regulations
  • Respond in a timely way to auditor letters and Registrar findings
  • Maintain a code of conduct addressing conflicts of interest and transparency
S1.02

Development and implementation of formal control activities

Operators and suppliers must build formal control activities addressing regulatory risks, with periodic effectiveness reviews and adjustments.

Requirements
  • Establish periodic reviews and document remediations
  • Communicate substantial changes to the Registrar
  • Make controls available to the AGCO on request
S1.03

Documentation of management overrides

Any control activity override must be clearly documented, reported to governance, and approved by at least two senior managers.

Requirements
  • Minimum two senior-manager approvals
  • Report each override to the Board or governance structure
  • Retain documentation for audit
S1.04

Controls supporting financial reporting compliance

Operators must operate controls that ensure financial reports comply with applicable accounting standards and practices.

S1.05

Personnel security screening

A screening process appropriate to each role must cover directors, officers, employees, agents and consultants.

S1.06

Employee competence and training

Employees must have the competence, skills, experience and training needed to execute their assigned control activities.

Requirements
  • Train control-activity staff on the control environment and regulatory risks
  • Ensure staff understand the Standards and Requirements
S1.07

Organizational structure and duty segregation

Structures must promote sound control environments with duty segregation that minimizes collusion and unauthorized activities.

Requirements
  • Document authority and responsibility with appropriate supervision
  • Review segregation of duties via internal audit
  • Maintain current organizational charts for the Registrar
S1.08

Management accountability and authority

Management must understand its accountability and authority for the control environment through appropriate training and knowledge.

S1.09

Information and compliance documentation retention

Compliance logs and related information must be retained for a minimum of three years unless otherwise specified.

S1.10

Organized compliance documentation and audit access

Standards compliance must be documented and organized so independent oversight functions can review and audit it.

Requirements
  • Management-approved analysis and review of documentation
  • Grant auditors access to relevant systems and documentation
  • Third-party audits may be directed by the Registrar at operator expense
S1.11

Board accountability for compliance

Primary compliance accountability sits with the Board or governance structure, with documented evidence of execution.

Requirements
  • Stand up an independent compliance oversight function
  • Internal audit regularly audits the compliance framework
  • Compliance and audit report directly to the Board with unrestricted access
S1.12

Independent whistleblowing process

An independent anonymous reporting process must let employees raise control deficiencies, non-compliance or legal violations.

Requirements
  • Whistleblower issues are addressed and communicated to the Board in a timely way
S1.13

Transparent engagement with the Registrar

Registrants must engage transparently with the Registrar on compliance, integrity and operations.

Requirements
  • Report integrity-affecting incidents per the notification matrix
  • Report non-compliance with corrective action plans
  • Make data, information and documents available on request
S1.14

Investigator access to monitor and participate in games

Operators must ensure OPP or Registrar investigators can monitor and participate in games.

S1.15

Player contact mechanism for issues and complaints

Player Rights

A timely mechanism must let players contact operators about accounts, funds, gameplay or Standards compliance, with Registrar notification per the matrix.

S1.16

Recording and timely resolution of complaints

Player Rights

Player complaints, disputes and inquiries must be recorded and addressed in a timely, fair, transparent and appropriate manner.

Requirements
  • Publish clear service standards accessible to players
  • Resolve disputes under Ontario and Canadian law
S1.17

AGCO information accessibility to players

Player Rights

Relevant information about the AGCO must be displayed and easily accessible to players.

S1.18

Contracting only with reputable suppliers

Affiliate Rules

Operators and suppliers must contract only with reputable counterparties.

S1.19

Operator responsibility for third-party conduct

Affiliate Rules

Operators bear responsibility for third-party actions and must require contractors to comply as if bound by the same laws, regulations and standards.

S1.20

Supplier list maintenance

Affiliate Rules

Operators and suppliers must maintain supplier lists for goods or services related to lottery schemes and make them available to the Registrar on request.

S1.21

Affiliate marketing restrictions

Affiliate Rules

Operators must ensure compensated third-party marketers do not provide direct-to-consumer services for unregistered Ontario gaming sites.

S1.22

Cessation of unregulated activities requiring registration

Affiliate Rules Player Rights

Operators and suppliers must stop unregulated activities that require registration and not contract with unregistered providers of registrable goods or services.

2
Theme 2

Responsible Gambling

Prevent and minimize gambling-related harm through policy, marketing restraints, informed-decision tools, harm-identification monitoring, self-exclusion and game-design constraints that slow play and reveal net position.

27 standards 27 player-flagged
100%
player-flagged
Regulatory risks this theme addresses
  • Marketing that targets minors, high-risk or self-excluded persons
  • Game mechanics that accelerate losses or mask net position
  • Weak self-exclusion programs that fail to prevent excluded players from returning
  • Players unable to set or enforce deposit, loss and time limits
S2.01

Harm identification and prevention policies

RG Critical

Operators must implement policies identifying, preventing and minimizing gaming harms, reviewed regularly and communicated to all staff.

Requirements
  • Integrate RG policies into control activities
  • Evaluate current best practices and employee feedback
  • Consult stakeholders on harm impact
  • Assess staff understanding of policies
S2.02

OLG and iGaming Ontario responsible gambling policies

RG Critical

Provincial agencies must implement policies that identify and prevent player harm across their gaming operations.

S2.03

No targeting of high-risk, underage or self-excluded persons

Bonus & Ads RG Critical

Marketing materials cannot target minors, high-risk persons or self-excluded individuals, and cannot include underage imagery.

Requirements
  • No themes or language appealing primarily to minors
  • No placement near schools or youth venues
  • No cartoons, celebrities or athletes likely to appeal to minors
S2.04

Truthful and non-misleading marketing

Bonus & Ads

All marketing must be truthful and cannot mislead regarding products, odds or outcomes.

Requirements
  • Do not suggest gaming solves problems or fulfills obligations
  • Do not portray gaming as an employment alternative
  • Do not encourage loss recovery through continued play
S2.05

Restrictions on inducement advertising

Bonus & Ads RG Critical

Advertising gambling inducements, bonuses and credits is prohibited except on an operator's gaming site and to consenting direct-marketing recipients.

Requirements
  • Restricted to operator site and direct marketing with active consent
  • No public or algorithm-based advertising of bonuses
S2.06

Inducement and bonus disclosure

Bonus & Ads Player Rights

Any bonus or credit advertising must disclose material conditions prominently and avoid misleading "free" or "risk-free" language.

Requirements
  • Material terms displayed at first presentation; others one click away
  • Cannot claim "free" if player risks own money
  • Cannot claim "risk-free" if player incurs loss or risk
S2.07

Opt-in consent for direct marketing

Bonus & Ads Player Rights

Players must actively opt in to receive inducement marketing and must be able to withdraw consent at any time.

Requirements
  • Active consent required before direct marketing
  • Simple method to withdraw consent
S2.08

Systematic dissemination of RG information

RG Critical

Operators must systematically provide accessible information enabling informed responsible-play choices.

Requirements
  • RG materials covering game mechanics, misconceptions, safer behaviours, harms and support
  • Financial and time limit information readily available
  • Self-exclusion information prominent and accessible
S2.09

Registration page RG resources display

RG Critical

Registration pages and pages within the player account must prominently display an RG statement, online link and the ConnexOntario number.

Requirements
  • Link to comprehensive RG resource page
S2.10

Player risk profile monitoring

RG Critical

Operators must monitor player risk profiles and behaviours to detect signs of potential harm.

Requirements
  • Include high-risk player profiles in monitoring systems
S2.11

Readily available assistance for harmed players

RG Critical Player Rights

Help for potentially harmed players must be readily available and systematically delivered.

Requirements
  • Staff knowledgeable about help resources
  • Contact for Ontario harm-treatment services
  • Tailored interventions by harm severity
  • 24/7 live customer support
S2.12

Employee understanding of RG principles

RG Critical

All staff must understand RG's importance and recognize problem-gambling signs.

Requirements
  • Mandatory, regularly refreshed training for all employees
  • Specialized training for player-facing staff
  • Training reflecting best practice research and feedback
S2.13

Breaks in play (short-term)

RG Critical

Players must have access to short-term play breaks separate from formal self-exclusion.

Requirements
  • User-initiated breaks
  • 1-day, 1-week, 1-month, 2-month or 3-month options
  • Wagering prevented during break
S2.14

Voluntary self-exclusion program

RG Critical Player Rights

Operators must offer an accessible, well-promoted voluntary self-exclusion program letting players exclude themselves permanently or temporarily.

Requirements
  • Efficient, support-oriented registration
  • 6-month, 1-year and 5-year exclusion periods
  • Immediate logout and account lockdown on enrollment
  • Marketing prevention during exclusion
  • Active wager refund if excluded before event starts
S2.15

Clear game designs that do not mislead

Game Design RG Critical

Game designs must be clear and truthful, not misleading on outcome determinants or speed-of-play effects.

Requirements
  • No false perception that speed or skill affects outcomes
  • No variable secondary decisions altering displayed results
  • Free-to-play games must match money-play odds
S2.15.1

Straightforward sport and event betting methods

Game Design Player Rights

The method of making bets in sport and event betting must be straightforward and understandable, with clear player communication.

Requirements
  • Parlays clearly identified
  • Player notification of acceptance/rejection
  • Option to confirm or withdraw when odds change pre-confirmation
  • Manual opt-in for automatic change acceptance
S2.15.2

Access to betting information without placing bets

Game Design Player Rights

Players must access betting information without placing bets, including odds, payouts and current pool values.

S2.15.3

Reputable data sources for bet outcomes

Game Design

Reputable and legitimate data sources must be used to determine bet outcomes and must be disclosed on request.

S2.16

Prevent extended and impulsive play

Game Design RG Critical

Game features must prevent extended or impulsive play and encourage lower-risk behaviours.

Requirements
  • No features encouraging loss chasing or increased wagering
  • Auto-play prohibited for slots
  • Individual game commitment required per cycle
S2.17

No simultaneous multiple slots play

Game Design RG Critical

The gaming system must not offer functionality facilitating play of multiple slots games at the same time, including split-screen features.

S2.18

Minimum 2.5-second gap between game cycles

Game Design RG Critical

A minimum of 2.5 seconds must elapse between game cycles; players must consciously initiate each cycle through a button release-and-depress action.

Requirements
  • 2.5-second minimum between cycles
  • Start button release-and-depress required
S2.19

No reducing time to result presentation

Game Design RG Critical

For slots, the gaming system must not permit a customer to reduce the time until the result is presented (no turbo or quick-spin).

S2.20

Audio/visual win effects only for net wins

Game Design RG Critical

For slots, winning audio and visual effects cannot accompany returns equal to or less than the wager amount.

S2.21

Display net session position for slots

Game Design RG Critical

For slots, gaming sessions must clearly display the customer's net position (total winnings minus total losses since session start).

S2.22

Time passage tracking

Game Design RG Critical

Players must have a visible means to track elapsed time during gaming sessions.

S2.23

Easy deposit and time-based limit setting

RG Critical Player Rights

Players must easily set financial and time-based limits at registration and at any time afterwards.

Requirements
  • Loss and deposit limit options during registration
  • Deposit, loss and time-based limit options
  • Duration options including 24 hours, 7 days, 1 month
S2.24

Cooling-off for relaxing limits

RG Critical Player Rights

Any player request to relax or remove a limit requires a 24-hour minimum cooling-off period before implementation.

Requirements
  • No limit modification without explicit player request
  • 24-hour waiting period enforced
3
Theme 3

Player Account Management

Restrict gaming to eligible individuals in Ontario, collect and validate registration data, authenticate players before play, maintain auditable account records, and provide deactivation and fund-recovery rights.

23 standards 13 player-flagged
57%
player-flagged
Regulatory risks this theme addresses
  • Minors or self-excluded persons obtaining accounts
  • Players accessing iGaming from outside Ontario
  • Insider betting by athletes, officials or governing-body personnel
  • Players unable to deactivate accounts or recover funds
S3.01

Restriction to eligible individuals

RG Critical Player Rights

Only eligible individuals are permitted to create a player account; only valid account holders are permitted to log on and gamble.

Requirements
  • Minors under 19 cannot play (18+ for lottery tickets); self-excluded prohibited
  • Court-ordered restrictions and AGCO exclusions enforced
  • Officers, board members, AGCO/OLG employees restricted
  • Ineligible individuals cannot claim prizes (except self-excluded)
S3.01.1

Prohibited insider betting

Operators must actively prevent individuals with insider information or decision-making authority from betting on events they influence, and meet sport-governing-body integrity standards.

Requirements
  • Persons with non-public information or influence cannot bet on relevant events
  • Athletes, coaches, managers, owners, referees prohibited from betting on sport-governing-body events
  • 10%+ owners of governing bodies or teams cannot bet on related events
  • Inform integrity monitors and governing authorities of violations
S3.02

Gaming limited to Ontario

Games on gaming sites may only be provided within Ontario, unless conducted jointly with another provincial government.

Requirements
  • Dynamic location detection; block unverified out-of-province play
  • Reasonable-interval location re-checks
  • Detection of software circumventing location verification
S3.03

Re-verification against prohibited lists

RG Critical

When prohibited/excluded lists change, all registered players must be re-verified for continued eligibility and removed if necessary.

Requirements
  • Re-verify players against updated lists
  • Prevent ineligible players from continuing to play
  • Periodically review accuracy of maintained lists
S3.04

Collection and validation of player information

Player Rights

Relevant player information must be collected and saved upon registration and demonstrated to be complete, accurate and validated before a player account is created.

Requirements
  • Collect name, date of birth, address, identification method, contact information
  • Gather AML/CTF-required information
  • Validate all information before account creation
S3.05

Player affirmation of information accuracy

Player Rights

Players must confirm that all registration information provided is complete and accurate before account creation.

S3.06

Maintain complete and accurate player information

Player information must be kept complete and accurate.

Requirements
  • Processes to maintain current, accurate player records
S3.07

Player fitness-for-play affirmation

RG Critical

Players must confirm they are fit to participate before engaging in gameplay.

S3.08

Unique account identifiability

All player accounts must be uniquely identifiable.

S3.09

One account per player

RG Critical

Players may have only one player account per gaming site.

Requirements
  • System prevents creation of multiple accounts per player per site
S3.10

Auditable account event trails

There must be an auditable, logged trail of events relating to account creation, activation, deactivation and changes.

Requirements
  • Log identification and verification activities
  • Log player contracts and account modifications
S3.11

Terms acknowledgment and acceptance

Player Rights

Players must acknowledge and accept the account and gameplay terms before account creation, and accept material changes when logging in.

Requirements
  • Acknowledgment before account creation
  • Acceptance of material changes on login
  • Terms comply with Standards and Ontario law
S3.12

Player authentication and MFA option

Player Rights

All players must be authenticated before accessing their account and gambling; third parties may not access a player's account.

Requirements
  • Authentication required before account access
  • Multi-factor authentication offered to players
S3.13

Complete transaction recording

All player account transactions must be recorded and logged accurately and completely.

S3.14

Player access to account information

Player Rights

Player account information must be made readily available to the player.

S3.15

Clear transaction information availability

Player Rights

Players must easily access clear information about all account transactions and activities.

Requirements
  • Deposit/withdrawal history and current balance
  • Payment method, source of funds, login details
  • Gaming history, bets, settlement dates (sports)
  • Session and period-based wagering/winning/losing totals
S3.16

Unique and traceable transaction identification

All player account transactions must be uniquely identifiable and traceable to a single player account.

S3.17

Notification of funds in dormant accounts

Player Rights

Reasonable efforts must be made to inform players of player funds remaining in dormant accounts.

S3.18

Player-initiated deactivation

RG Critical Player Rights

Players may deactivate their account at any time; once elected, the account is deactivated.

Requirements
  • Enable immediate deactivation on player request
S3.19

Operator-initiated deactivation authority

Operators may deactivate accounts when necessary for compliance or protection purposes.

Requirements
  • Document criteria and processes for operator-initiated deactivation
S3.20

Registrar-requested deactivation

Accounts must be deactivated upon Registrar direction.

S3.21

Information retention after removal

Removed player information must be retained per Standard 1.09 or other applicable retention requirements.

S3.22

Dormant/deactivated balance recovery

Player Rights

Players whose accounts become dormant or are deactivated must be able to recover the balance owing to them.

Requirements
  • Provide mechanisms for balance recovery
4
Theme 4

Game Integrity and Player Awareness

Ensure games are fair, honest and independently verifiable; that players get accurate pre-wager information; that outcomes are random, recoverable and settled per stated terms; and that betting integrity risks, faults and peer-to-peer manipulation are actively managed.

39 standards 28 player-flagged
72%
player-flagged
Regulatory risks this theme addresses
  • Games with uncertified RNGs or unverifiable outcomes
  • Speed, turbo and time-compression features that encourage impulsive play
  • Insider betting, match-fixing or coordinated peer-to-peer collusion
  • Fault-handling policies that favour the operator over the player
S4.01

Fair, honest and independently verifiable gaming

Game Design

Gaming must be conducted fairly, honestly and independently verifiable through continuous monitoring.

Requirements
  • Continuous independent monitoring of lottery schemes and cash handling
  • Continuous logs for critical gaming systems covering accounting and game state
S4.02

Appropriate records of transactions and game state

Complete and accurate records must support investigations, dispute resolution and complaint handling.

Requirements
  • Records support Registrar investigations and dispute resolution
  • Track player information, gaming sessions and significant system events
S4.03

Compensating controls for logging interruption

When logging fails, compensating manual controls must be used where technically feasible.

S4.04

Custom and on-demand reporting

Gaming systems must provide flexible reporting capabilities to regulators in appropriate formats.

S4.05

Documented game specifications

Game Design

Game specifications must document objectives, wagers, operation methods, winning odds and operator advantage.

S4.06

Sufficient pre-wager player information

Game Design Player Rights

Players need comprehensive information about chances, gameplay and payouts before wagering.

Requirements
  • Accessible "how to play" pages
  • Odds, winning outcomes, restrictions, prize values
  • Circumstances for void games
S4.07

Accurate, non-misleading player information

Game Design RG Critical

In-play information must not misrepresent games or encourage harmful play patterns.

Requirements
  • No unachievable outcomes or "winning is probable" framing
  • No implication that chances increase with continued play
S4.08

Approval or certification of games and systems

Game Design

All games and RNG systems must be Registrar-approved or certified by an independent testing lab prior to provision.

S4.09

Secure provision and maintenance of gaming systems

Game Design

Gaming systems must be provided and maintained to ensure integrity, safety and security.

Requirements
  • Only approved/certified games and remote gaming servers
  • Immediately notify Registrar of integrity or security issues
  • Monitor, test and preserve logs throughout system lifespan
S4.10

Unavailability of games with suspected faults

Player Rights

Games with suspected fairness faults must be unavailable until resolved, with fair and reasonable decisioning.

S4.11

Logical separation of environments

Production, testing and development systems must be logically separated.

S4.12

Game outcome recoverability

Player Rights

Game outcomes should be recoverable where technically possible to enable fair player settlement.

S4.13

Defined fair-treatment fault policies

Player Rights

Operators must have defined, fair policies for treating players when faults occur.

Requirements
  • Policies are communicated clearly
S4.14

Game recreation to last communicated state

Games must be recreatable to their last communicated state to resolve incomplete transactions.

Requirements
  • Log elements and outcomes before display
  • Capture info to continue partially complete games
S4.15

Clear and timely display of bets and outcomes

Game Design Player Rights

Bets and outcomes must be clearly displayed with sufficient time for player review.

S4.16

Accurate and timely game payout

Player Rights

Games must pay out accurately, completely and within reasonable time after winning.

S4.17

Mechanisms to deter, prevent and detect collusion

Operators must have mechanisms to appropriately deter, prevent and detect collusion and cheating.

S4.18

Logging of detection activities

All detection activities must be logged for regulatory review and investigation.

S4.19

Clear player reporting process for cheating

Player Rights

Players need a clear, accessible process to report suspected cheating, collusion or bot activity.

Requirements
  • Simple, accessible reporting process
  • Investigate player complaints about unfair treatment
  • Make suspension/recovery policies available on request
S4.20

Fair play despite system performance

Player Rights

Where interaction speed affects winning chances, operators must prevent unfair disadvantage from performance issues.

S4.21

Service interruption response

Player Rights

Service interruptions must be handled without disadvantaging players.

Requirements
  • Inform players that connection speed may affect games
  • Recover promptly; void bets where appropriate
  • Pay players the better outcome (winnings or refund)
S4.22

Measures to deter and detect bot use

Game Design

Operators must prevent the use of automated software providing unfair play advantages.

Requirements
  • Deter, prevent and detect bot software
  • Notify players that bot use constitutes cheating
S4.23

Fair treatment of peer-to-peer players

Player Rights

Peer-to-peer games must ensure players are treated fairly without disadvantage.

Requirements
  • Deter unfair behaviour, collusion and cheating
  • Prevent access to other players' information and self-play
  • Inform players accounts may close for cheating
S4.24

Game operation per specifications and terms

Game Design

Games must operate exactly as specified and bets settled per stated terms.

Requirements
  • Outcomes align with specifications and terms
  • All possible outcomes available unless clearly explained
S4.25

Bet commitment prior to outcome determination

Game Design

Bets must be committed before outcome determination; later wagers are voided and refunded.

S4.25.1

Fair and compliant sport/event bet settlement

Player Rights

Sport and event bets must settle fairly per terms and rules available to players when placed.

Requirements
  • Provide clear, prompt explanations for settlement decisions
S4.25.2

Results provision and account updates

Player Rights

Bet results and changes must be provided and account balances updated.

S4.25.3

Sport/event results data controls

Controls must ensure accuracy and timeliness of results data used for settlement.

S4.26

Random selection mechanism for game elements

Game Design

A mechanism must randomly select game elements determining outcomes, independently and without correlation to play style or system load.

Requirements
  • Select seed values ensuring randomness
  • Uninfluenced by wager amount, play style or system load
  • Impervious to outside influences; failures detected quickly
S4.27

Monitoring and inspection of randomness mechanisms

Game Design

RNG mechanisms must be capable of being monitored and inspected to verify integrity.

S4.28

Unchanging terms during sessions

Game Design Player Rights

Play terms must not change mid-session unless players are aware before wagering.

Requirements
  • Limit player-initiated interface changes
  • Display multi-state info; update jackpots and odds
  • Communicate odds changes (not retroactively)
S4.29

Secured and authenticated game sessions

Game sessions must be secured and verified as authentic.

S4.30

Player activity time-out

RG Critical

Automatic session time-outs must protect inactive players.

S4.31

Critical functions independent of end-user device

Game Design

All critical functions, including game outcome generation, must originate from the gaming system, not end devices.

S4.32

Risk management for betting integrity

Operators must mitigate integrity risks including insider betting and event manipulation.

Requirements
  • Controls identifying unusual/suspicious betting; report to monitors
  • Monitors disseminate reports to operators
  • Notify relevant entities on suspicious activity
S4.33

Authority to suspend betting or withhold funds

Player Rights

Operators may suspend betting or withhold funds for events with suspicious activity reports, fairly and reasonably.

S4.34

Sport and event betting criteria

Game Design

Only bets meeting criteria for outcome verification and integrity safeguards are permitted.

Requirements
  • Documentable, independently generated outcomes
  • Majority of participants 18+; supervised by sport body
  • No past-event, financial-market or synthetic-lottery bets
  • Exclude CHL minor-league sports
S4.35

Restricted access to live dealer supplies

Access to live dealer gaming supplies must be restricted to those with a business need.

Requirements
  • Grant, modify, revoke access by employment and role with logging
  • Periodic independent review of privileges
S4.36

Controls preventing dealer compromise of integrity

Game Design

Controls must prevent live dealer presenters from compromising game integrity.

5
Theme 5

Information Security and Protection of Assets

Protect gaming data, systems and assets through an industry-standard IT control environment: access management, authentication, encryption, logging, change and incident response, resilience, and periodic assurance.

25 standards 3 player-flagged
12%
player-flagged
Regulatory risks this theme addresses
  • Unauthorized access to gaming systems or player data
  • Inadequate encryption of player PII or payment information
  • Service outages without tested disaster recovery or business continuity
  • Third-party suppliers operating below equivalent security standards
S5.01

Industry-standard IT control framework

A recognized industry-standard framework must be used to manage the IT control environment and support compliance with the Standards.

S5.02

Users access management

System access is limited to individuals with legitimate business need, with grants, modifications and revocations logged.

Requirements
  • Privileges granted by role with logging
  • Periodic independent review of privileges
  • All access-change activities logged
S5.03

Access monitoring and traceability

All system access is monitored, logged and traceable to specific individuals via unique accounts.

S5.04

Encryption of sensitive data

Player Rights

Sensitive data must be encrypted both in transit and at rest to prevent unauthorized access.

Requirements
  • Encryption protocols comply with recognized industry standards
  • Encryption keys are securely managed
S5.05

Authentication and access controls

System access requires robust authentication mechanisms to verify user identity before granting entry.

Requirements
  • MFA for administrative accounts
  • Access restricted by job function and business need
S5.06

Monitoring and logging of system access

All system access attempts and activities must be logged for audit and investigation.

Requirements
  • Retain logs per Standard 1.09 (minimum 3 years)
  • Protect log files from unauthorized modification
S5.07

Network security

Gaming systems must be protected from unauthorized external access and network-based threats.

Requirements
  • Deploy firewalls and intrusion detection
  • Conduct regular security assessments
S5.08

Data backup and recovery

Critical gaming data must be regularly backed up with tested recovery procedures.

Requirements
  • Backups at intervals set by data criticality
  • Regularly test recovery procedures
S5.09

Patch management

Gaming systems must receive timely security patches and updates to address known vulnerabilities.

Requirements
  • Document all patches applied
  • Test patches before production deployment
S5.10

Malware protection

Systems must be protected against malicious software through detection and prevention.

Requirements
  • Anti-malware software installed and current
  • Regular scans on all systems
S5.11

Third-party security

Gaming-related suppliers and contractors must maintain equivalent security standards.

Requirements
  • Contracts include security and audit-rights terms
  • Regular audits of third-party systems
S5.12

Change management

All changes to gaming systems must be controlled, documented and tested before deployment.

Requirements
  • Formal change management process
  • Changes approved before implementation
S5.13

Incident response

Procedures must detect, respond to and document security incidents promptly.

Requirements
  • Documented incident response plan
  • Incidents reported per notification matrix
S5.14

Physical security

Physical access to gaming equipment and critical systems must be restricted and monitored.

Requirements
  • Access to server rooms restricted
  • Surveillance of critical areas
S5.15

Personnel security

Staff with system access must be vetted and trained on security obligations.

Requirements
  • Background screening for sensitive access
  • Regular security training
S5.16

Vendor management

Contracts with technology vendors must include security and compliance obligations.

Requirements
  • SLAs specify security and response times
  • Vendor compliance verified via assessments
S5.17

Data retention and disposal

Player Rights

Player information and gaming records must be securely retained and appropriately disposed of.

Requirements
  • Retention per laws and Standards
  • Disposal ensures data is unrecoverable
S5.18

Segregation of systems

Development, testing and production systems must be logically and physically separated.

S5.19

Business continuity planning

Player Rights

Operators must maintain plans to continue critical gaming operations during disruptions.

Requirements
  • Documented BCP, regularly tested
  • Recovery time objectives for critical systems
S5.20

Disaster recovery

Systems must be capable of recovering from significant outages or data loss events.

Requirements
  • DR procedures documented, tested annually
  • Backup facilities available
S5.21

Security assessment

Regular independent assessments must evaluate the effectiveness of security controls.

Requirements
  • Periodic internal or external assessments
  • Findings documented and remediated
S5.22

Vulnerability management

Identified security weaknesses must be tracked and remediated in a timely manner.

Requirements
  • Vulnerability tracking process documented
  • Remediation timelines tied to risk severity
S5.23

Configuration management

Gaming system configurations must be documented, controlled and protected from unauthorized changes.

Requirements
  • Baseline-documented, version-controlled
  • Changes follow change management
S5.24

Documentation of controls

IT security controls must be fully documented for audit and compliance verification.

Requirements
  • Describe purpose, design and operating procedures
  • Available to auditors and Registrar
S5.25

Regular review of IT controls

IT security controls must be periodically reviewed to ensure continued effectiveness and alignment with evolving threats.

Requirements
  • Reviews at least annually
  • Control effectiveness tested and documented
6
Theme 6

Minimizing Unlawful Activity

Protect the integrity of Ontario's iGaming market from money laundering, terrorist financing and other unlawful activity through federal AML/CTF compliance, player identity verification, transaction monitoring and record retention.

4 standards
0%
player-flagged
Regulatory risks this theme addresses
  • Money laundering or terrorist financing through gaming accounts
  • Failure to verify player identity against government-issued ID
  • Suspicious transaction patterns going undetected
  • Insufficient record retention for FINTRAC and Registrar inspection
S6.01

AML and terrorist-financing compliance

Operators must comply with federal anti-money-laundering legislation and implement suspicious-transaction reporting.

Requirements
  • Compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act
  • Suspicious transaction reporting to FINTRAC
S6.02

Player identification and verification

Operators must verify player identity using government-issued identification to prevent unlawful activity.

Requirements
  • Verify using government-issued ID
  • Verification before account activation
S6.03

Transaction monitoring

Operators must monitor transactions for patterns indicative of money laundering or other illicit activity.

Requirements
  • Monitoring systems identify suspicious patterns
  • Reports submitted to authorities
S6.04

Record retention for AML purposes

Documentation supporting AML compliance must be retained for regulatory review.

Requirements
  • Records maintained per federal law
  • Available to Registrar on inspection