Alcohol and Gaming Commission of Ontario — Registrar's Standards for Internet Gaming
All 140 Ontario standards, organised by risk theme
A searchable, filterable index of every Registrar's Standard for Internet Gaming in Ontario. Each standard is grouped by the risk theme the Registrar has published, tagged editorially for the player-protection categories our team tracks most closely, and presented with its principle and supporting requirements. Use it to orient on the rules that govern Ontario's regulated iGaming market.
Ensure registered operators and gaming-related suppliers maintain sound governance, honest dealings with the Registrar, and a control environment that supports the integrity of Ontario's iGaming market.
22 standards8 player-flagged
36%
player-flagged
Regulatory risks this theme addresses
Operators with weak governance or unclear accountability for compliance outcomes
Poorly screened personnel with access to player funds, data or game controls
Third-party marketers driving traffic to unregistered Ontario gaming sites
Inadequate complaint handling leaving players without recourse
Management Integrity 1
S1.01
Commitment to character, integrity and high ethical values
Applicable personnel must demonstrate character, integrity and high ethical values through attitude and action.
Requirements
Adhere to all applicable laws and regulations
Respond in a timely way to auditor letters and Registrar findings
Maintain a code of conduct addressing conflicts of interest and transparency
Sound Control Environment 3
S1.02
Development and implementation of formal control activities
Operators and suppliers must build formal control activities addressing regulatory risks, with periodic effectiveness reviews and adjustments.
Requirements
Establish periodic reviews and document remediations
Communicate substantial changes to the Registrar
Make controls available to the AGCO on request
S1.03
Documentation of management overrides
Any control activity override must be clearly documented, reported to governance, and approved by at least two senior managers.
Requirements
Minimum two senior-manager approvals
Report each override to the Board or governance structure
Operators must operate controls that ensure financial reports comply with applicable accounting standards and practices.
Organizational Structure and Capabilities 5
S1.05
Personnel security screening
A screening process appropriate to each role must cover directors, officers, employees, agents and consultants.
S1.06
Employee competence and training
Employees must have the competence, skills, experience and training needed to execute their assigned control activities.
Requirements
Train control-activity staff on the control environment and regulatory risks
Ensure staff understand the Standards and Requirements
S1.07
Organizational structure and duty segregation
Structures must promote sound control environments with duty segregation that minimizes collusion and unauthorized activities.
Requirements
Document authority and responsibility with appropriate supervision
Review segregation of duties via internal audit
Maintain current organizational charts for the Registrar
S1.08
Management accountability and authority
Management must understand its accountability and authority for the control environment through appropriate training and knowledge.
S1.09
Information and compliance documentation retention
Compliance logs and related information must be retained for a minimum of three years unless otherwise specified.
Oversight 5
S1.10
Organized compliance documentation and audit access
Standards compliance must be documented and organized so independent oversight functions can review and audit it.
Requirements
Management-approved analysis and review of documentation
Grant auditors access to relevant systems and documentation
Third-party audits may be directed by the Registrar at operator expense
S1.11
Board accountability for compliance
Primary compliance accountability sits with the Board or governance structure, with documented evidence of execution.
Requirements
Stand up an independent compliance oversight function
Internal audit regularly audits the compliance framework
Compliance and audit report directly to the Board with unrestricted access
S1.12
Independent whistleblowing process
An independent anonymous reporting process must let employees raise control deficiencies, non-compliance or legal violations.
Requirements
Whistleblower issues are addressed and communicated to the Board in a timely way
S1.13
Transparent engagement with the Registrar
Registrants must engage transparently with the Registrar on compliance, integrity and operations.
Requirements
Report integrity-affecting incidents per the notification matrix
Report non-compliance with corrective action plans
Make data, information and documents available on request
S1.14
Investigator access to monitor and participate in games
Operators must ensure OPP or Registrar investigators can monitor and participate in games.
Customer Service 3
S1.15
Player contact mechanism for issues and complaints
Player Rights
A timely mechanism must let players contact operators about accounts, funds, gameplay or Standards compliance, with Registrar notification per the matrix.
S1.16
Recording and timely resolution of complaints
Player Rights
Player complaints, disputes and inquiries must be recorded and addressed in a timely, fair, transparent and appropriate manner.
Requirements
Publish clear service standards accessible to players
Resolve disputes under Ontario and Canadian law
S1.17
AGCO information accessibility to players
Player Rights
Relevant information about the AGCO must be displayed and easily accessible to players.
Third-Party Management 4
S1.18
Contracting only with reputable suppliers
Affiliate Rules
Operators and suppliers must contract only with reputable counterparties.
S1.19
Operator responsibility for third-party conduct
Affiliate Rules
Operators bear responsibility for third-party actions and must require contractors to comply as if bound by the same laws, regulations and standards.
S1.20
Supplier list maintenance
Affiliate Rules
Operators and suppliers must maintain supplier lists for goods or services related to lottery schemes and make them available to the Registrar on request.
S1.21
Affiliate marketing restrictions
Affiliate Rules
Operators must ensure compensated third-party marketers do not provide direct-to-consumer services for unregistered Ontario gaming sites.
Unregulated Activities 1
S1.22
Cessation of unregulated activities requiring registration
Affiliate RulesPlayer Rights
Operators and suppliers must stop unregulated activities that require registration and not contract with unregistered providers of registrable goods or services.
2
Theme 2
Responsible Gambling
Prevent and minimize gambling-related harm through policy, marketing restraints, informed-decision tools, harm-identification monitoring, self-exclusion and game-design constraints that slow play and reveal net position.
27 standards27 player-flagged
100%
player-flagged
Regulatory risks this theme addresses
Marketing that targets minors, high-risk or self-excluded persons
Game mechanics that accelerate losses or mask net position
Weak self-exclusion programs that fail to prevent excluded players from returning
Players unable to set or enforce deposit, loss and time limits
Policies and Culture 2
S2.01
Harm identification and prevention policies
RG Critical
Operators must implement policies identifying, preventing and minimizing gaming harms, reviewed regularly and communicated to all staff.
Requirements
Integrate RG policies into control activities
Evaluate current best practices and employee feedback
Consult stakeholders on harm impact
Assess staff understanding of policies
S2.02
OLG and iGaming Ontario responsible gambling policies
RG Critical
Provincial agencies must implement policies that identify and prevent player harm across their gaming operations.
Marketing and Advertising 5
S2.03
No targeting of high-risk, underage or self-excluded persons
Bonus & AdsRG Critical
Marketing materials cannot target minors, high-risk persons or self-excluded individuals, and cannot include underage imagery.
Requirements
No themes or language appealing primarily to minors
No placement near schools or youth venues
No cartoons, celebrities or athletes likely to appeal to minors
S2.04
Truthful and non-misleading marketing
Bonus & Ads
All marketing must be truthful and cannot mislead regarding products, odds or outcomes.
Requirements
Do not suggest gaming solves problems or fulfills obligations
Do not portray gaming as an employment alternative
Do not encourage loss recovery through continued play
S2.05
Restrictions on inducement advertising
Bonus & AdsRG Critical
Advertising gambling inducements, bonuses and credits is prohibited except on an operator's gaming site and to consenting direct-marketing recipients.
Requirements
Restricted to operator site and direct marketing with active consent
No public or algorithm-based advertising of bonuses
S2.06
Inducement and bonus disclosure
Bonus & AdsPlayer Rights
Any bonus or credit advertising must disclose material conditions prominently and avoid misleading "free" or "risk-free" language.
Requirements
Material terms displayed at first presentation; others one click away
Cannot claim "free" if player risks own money
Cannot claim "risk-free" if player incurs loss or risk
S2.07
Opt-in consent for direct marketing
Bonus & AdsPlayer Rights
Players must actively opt in to receive inducement marketing and must be able to withdraw consent at any time.
Requirements
Active consent required before direct marketing
Simple method to withdraw consent
Supporting Informed Decision Making 2
S2.08
Systematic dissemination of RG information
RG Critical
Operators must systematically provide accessible information enabling informed responsible-play choices.
Requirements
RG materials covering game mechanics, misconceptions, safer behaviours, harms and support
Financial and time limit information readily available
Self-exclusion information prominent and accessible
S2.09
Registration page RG resources display
RG Critical
Registration pages and pages within the player account must prominently display an RG statement, online link and the ConnexOntario number.
Requirements
Link to comprehensive RG resource page
Identifying and Assisting Individuals Experiencing Harm 2
S2.10
Player risk profile monitoring
RG Critical
Operators must monitor player risk profiles and behaviours to detect signs of potential harm.
Requirements
Include high-risk player profiles in monitoring systems
S2.11
Readily available assistance for harmed players
RG CriticalPlayer Rights
Help for potentially harmed players must be readily available and systematically delivered.
Requirements
Staff knowledgeable about help resources
Contact for Ontario harm-treatment services
Tailored interventions by harm severity
24/7 live customer support
Employee Training 1
S2.12
Employee understanding of RG principles
RG Critical
All staff must understand RG's importance and recognize problem-gambling signs.
Requirements
Mandatory, regularly refreshed training for all employees
Specialized training for player-facing staff
Training reflecting best practice research and feedback
Self-Exclusion and Breaks in Play 2
S2.13
Breaks in play (short-term)
RG Critical
Players must have access to short-term play breaks separate from formal self-exclusion.
Requirements
User-initiated breaks
1-day, 1-week, 1-month, 2-month or 3-month options
Wagering prevented during break
S2.14
Voluntary self-exclusion program
RG CriticalPlayer Rights
Operators must offer an accessible, well-promoted voluntary self-exclusion program letting players exclude themselves permanently or temporarily.
Requirements
Efficient, support-oriented registration
6-month, 1-year and 5-year exclusion periods
Immediate logout and account lockdown on enrollment
Marketing prevention during exclusion
Active wager refund if excluded before event starts
Game Design and Features 11
S2.15
Clear game designs that do not mislead
Game DesignRG Critical
Game designs must be clear and truthful, not misleading on outcome determinants or speed-of-play effects.
Requirements
No false perception that speed or skill affects outcomes
No variable secondary decisions altering displayed results
Free-to-play games must match money-play odds
S2.15.1
Straightforward sport and event betting methods
Game DesignPlayer Rights
The method of making bets in sport and event betting must be straightforward and understandable, with clear player communication.
Requirements
Parlays clearly identified
Player notification of acceptance/rejection
Option to confirm or withdraw when odds change pre-confirmation
Manual opt-in for automatic change acceptance
S2.15.2
Access to betting information without placing bets
Game DesignPlayer Rights
Players must access betting information without placing bets, including odds, payouts and current pool values.
S2.15.3
Reputable data sources for bet outcomes
Game Design
Reputable and legitimate data sources must be used to determine bet outcomes and must be disclosed on request.
S2.16
Prevent extended and impulsive play
Game DesignRG Critical
Game features must prevent extended or impulsive play and encourage lower-risk behaviours.
Requirements
No features encouraging loss chasing or increased wagering
Auto-play prohibited for slots
Individual game commitment required per cycle
S2.17
No simultaneous multiple slots play
Game DesignRG Critical
The gaming system must not offer functionality facilitating play of multiple slots games at the same time, including split-screen features.
S2.18
Minimum 2.5-second gap between game cycles
Game DesignRG Critical
A minimum of 2.5 seconds must elapse between game cycles; players must consciously initiate each cycle through a button release-and-depress action.
Requirements
2.5-second minimum between cycles
Start button release-and-depress required
S2.19
No reducing time to result presentation
Game DesignRG Critical
For slots, the gaming system must not permit a customer to reduce the time until the result is presented (no turbo or quick-spin).
S2.20
Audio/visual win effects only for net wins
Game DesignRG Critical
For slots, winning audio and visual effects cannot accompany returns equal to or less than the wager amount.
S2.21
Display net session position for slots
Game DesignRG Critical
For slots, gaming sessions must clearly display the customer's net position (total winnings minus total losses since session start).
S2.22
Time passage tracking
Game DesignRG Critical
Players must have a visible means to track elapsed time during gaming sessions.
Limit Setting Features 2
S2.23
Easy deposit and time-based limit setting
RG CriticalPlayer Rights
Players must easily set financial and time-based limits at registration and at any time afterwards.
Requirements
Loss and deposit limit options during registration
Deposit, loss and time-based limit options
Duration options including 24 hours, 7 days, 1 month
S2.24
Cooling-off for relaxing limits
RG CriticalPlayer Rights
Any player request to relax or remove a limit requires a 24-hour minimum cooling-off period before implementation.
Requirements
No limit modification without explicit player request
24-hour waiting period enforced
3
Theme 3
Player Account Management
Restrict gaming to eligible individuals in Ontario, collect and validate registration data, authenticate players before play, maintain auditable account records, and provide deactivation and fund-recovery rights.
23 standards13 player-flagged
57%
player-flagged
Regulatory risks this theme addresses
Minors or self-excluded persons obtaining accounts
Players accessing iGaming from outside Ontario
Insider betting by athletes, officials or governing-body personnel
Players unable to deactivate accounts or recover funds
Eligibility 4
S3.01
Restriction to eligible individuals
RG CriticalPlayer Rights
Only eligible individuals are permitted to create a player account; only valid account holders are permitted to log on and gamble.
Requirements
Minors under 19 cannot play (18+ for lottery tickets); self-excluded prohibited
Court-ordered restrictions and AGCO exclusions enforced
Operators must actively prevent individuals with insider information or decision-making authority from betting on events they influence, and meet sport-governing-body integrity standards.
Requirements
Persons with non-public information or influence cannot bet on relevant events
Athletes, coaches, managers, owners, referees prohibited from betting on sport-governing-body events
10%+ owners of governing bodies or teams cannot bet on related events
Inform integrity monitors and governing authorities of violations
S3.02
Gaming limited to Ontario
Games on gaming sites may only be provided within Ontario, unless conducted jointly with another provincial government.
Requirements
Dynamic location detection; block unverified out-of-province play
Reasonable-interval location re-checks
Detection of software circumventing location verification
S3.03
Re-verification against prohibited lists
RG Critical
When prohibited/excluded lists change, all registered players must be re-verified for continued eligibility and removed if necessary.
Requirements
Re-verify players against updated lists
Prevent ineligible players from continuing to play
Periodically review accuracy of maintained lists
Registration and Account Creation 2
S3.04
Collection and validation of player information
Player Rights
Relevant player information must be collected and saved upon registration and demonstrated to be complete, accurate and validated before a player account is created.
Requirements
Collect name, date of birth, address, identification method, contact information
Gather AML/CTF-required information
Validate all information before account creation
S3.05
Player affirmation of information accuracy
Player Rights
Players must confirm that all registration information provided is complete and accurate before account creation.
Player Account Maintenance and Transactions 11
S3.06
Maintain complete and accurate player information
Player information must be kept complete and accurate.
Requirements
Processes to maintain current, accurate player records
S3.07
Player fitness-for-play affirmation
RG Critical
Players must confirm they are fit to participate before engaging in gameplay.
S3.08
Unique account identifiability
All player accounts must be uniquely identifiable.
S3.09
One account per player
RG Critical
Players may have only one player account per gaming site.
Requirements
System prevents creation of multiple accounts per player per site
S3.10
Auditable account event trails
There must be an auditable, logged trail of events relating to account creation, activation, deactivation and changes.
Requirements
Log identification and verification activities
Log player contracts and account modifications
S3.11
Terms acknowledgment and acceptance
Player Rights
Players must acknowledge and accept the account and gameplay terms before account creation, and accept material changes when logging in.
Requirements
Acknowledgment before account creation
Acceptance of material changes on login
Terms comply with Standards and Ontario law
S3.12
Player authentication and MFA option
Player Rights
All players must be authenticated before accessing their account and gambling; third parties may not access a player's account.
Requirements
Authentication required before account access
Multi-factor authentication offered to players
S3.13
Complete transaction recording
All player account transactions must be recorded and logged accurately and completely.
S3.14
Player access to account information
Player Rights
Player account information must be made readily available to the player.
S3.15
Clear transaction information availability
Player Rights
Players must easily access clear information about all account transactions and activities.
Requirements
Deposit/withdrawal history and current balance
Payment method, source of funds, login details
Gaming history, bets, settlement dates (sports)
Session and period-based wagering/winning/losing totals
S3.16
Unique and traceable transaction identification
All player account transactions must be uniquely identifiable and traceable to a single player account.
Deactivation and Dormant Accounts 6
S3.17
Notification of funds in dormant accounts
Player Rights
Reasonable efforts must be made to inform players of player funds remaining in dormant accounts.
S3.18
Player-initiated deactivation
RG CriticalPlayer Rights
Players may deactivate their account at any time; once elected, the account is deactivated.
Requirements
Enable immediate deactivation on player request
S3.19
Operator-initiated deactivation authority
Operators may deactivate accounts when necessary for compliance or protection purposes.
Requirements
Document criteria and processes for operator-initiated deactivation
S3.20
Registrar-requested deactivation
Accounts must be deactivated upon Registrar direction.
S3.21
Information retention after removal
Removed player information must be retained per Standard 1.09 or other applicable retention requirements.
S3.22
Dormant/deactivated balance recovery
Player Rights
Players whose accounts become dormant or are deactivated must be able to recover the balance owing to them.
Requirements
Provide mechanisms for balance recovery
4
Theme 4
Game Integrity and Player Awareness
Ensure games are fair, honest and independently verifiable; that players get accurate pre-wager information; that outcomes are random, recoverable and settled per stated terms; and that betting integrity risks, faults and peer-to-peer manipulation are actively managed.
39 standards28 player-flagged
72%
player-flagged
Regulatory risks this theme addresses
Games with uncertified RNGs or unverifiable outcomes
Speed, turbo and time-compression features that encourage impulsive play
Insider betting, match-fixing or coordinated peer-to-peer collusion
Fault-handling policies that favour the operator over the player
Game Integrity 16
S4.01
Fair, honest and independently verifiable gaming
Game Design
Gaming must be conducted fairly, honestly and independently verifiable through continuous monitoring.
Requirements
Continuous independent monitoring of lottery schemes and cash handling
Continuous logs for critical gaming systems covering accounting and game state
S4.02
Appropriate records of transactions and game state
Complete and accurate records must support investigations, dispute resolution and complaint handling.
Requirements
Records support Registrar investigations and dispute resolution
Track player information, gaming sessions and significant system events
S4.03
Compensating controls for logging interruption
When logging fails, compensating manual controls must be used where technically feasible.
S4.04
Custom and on-demand reporting
Gaming systems must provide flexible reporting capabilities to regulators in appropriate formats.
S4.05
Documented game specifications
Game Design
Game specifications must document objectives, wagers, operation methods, winning odds and operator advantage.
S4.06
Sufficient pre-wager player information
Game DesignPlayer Rights
Players need comprehensive information about chances, gameplay and payouts before wagering.
In-play information must not misrepresent games or encourage harmful play patterns.
Requirements
No unachievable outcomes or "winning is probable" framing
No implication that chances increase with continued play
S4.08
Approval or certification of games and systems
Game Design
All games and RNG systems must be Registrar-approved or certified by an independent testing lab prior to provision.
S4.09
Secure provision and maintenance of gaming systems
Game Design
Gaming systems must be provided and maintained to ensure integrity, safety and security.
Requirements
Only approved/certified games and remote gaming servers
Immediately notify Registrar of integrity or security issues
Monitor, test and preserve logs throughout system lifespan
S4.10
Unavailability of games with suspected faults
Player Rights
Games with suspected fairness faults must be unavailable until resolved, with fair and reasonable decisioning.
S4.11
Logical separation of environments
Production, testing and development systems must be logically separated.
S4.12
Game outcome recoverability
Player Rights
Game outcomes should be recoverable where technically possible to enable fair player settlement.
S4.13
Defined fair-treatment fault policies
Player Rights
Operators must have defined, fair policies for treating players when faults occur.
Requirements
Policies are communicated clearly
S4.14
Game recreation to last communicated state
Games must be recreatable to their last communicated state to resolve incomplete transactions.
Requirements
Log elements and outcomes before display
Capture info to continue partially complete games
S4.15
Clear and timely display of bets and outcomes
Game DesignPlayer Rights
Bets and outcomes must be clearly displayed with sufficient time for player review.
S4.16
Accurate and timely game payout
Player Rights
Games must pay out accurately, completely and within reasonable time after winning.
Collusion and Cheating 3
S4.17
Mechanisms to deter, prevent and detect collusion
Operators must have mechanisms to appropriately deter, prevent and detect collusion and cheating.
S4.18
Logging of detection activities
All detection activities must be logged for regulatory review and investigation.
S4.19
Clear player reporting process for cheating
Player Rights
Players need a clear, accessible process to report suspected cheating, collusion or bot activity.
Requirements
Simple, accessible reporting process
Investigate player complaints about unfair treatment
Make suspension/recovery policies available on request
Speed and Interruption 2
S4.20
Fair play despite system performance
Player Rights
Where interaction speed affects winning chances, operators must prevent unfair disadvantage from performance issues.
S4.21
Service interruption response
Player Rights
Service interruptions must be handled without disadvantaging players.
Requirements
Inform players that connection speed may affect games
Recover promptly; void bets where appropriate
Pay players the better outcome (winnings or refund)
Peer-to-Peer Games 2
S4.22
Measures to deter and detect bot use
Game Design
Operators must prevent the use of automated software providing unfair play advantages.
Requirements
Deter, prevent and detect bot software
Notify players that bot use constitutes cheating
S4.23
Fair treatment of peer-to-peer players
Player Rights
Peer-to-peer games must ensure players are treated fairly without disadvantage.
Requirements
Deter unfair behaviour, collusion and cheating
Prevent access to other players' information and self-play
Inform players accounts may close for cheating
Determination of Game Outcomes 5
S4.24
Game operation per specifications and terms
Game Design
Games must operate exactly as specified and bets settled per stated terms.
Requirements
Outcomes align with specifications and terms
All possible outcomes available unless clearly explained
S4.25
Bet commitment prior to outcome determination
Game Design
Bets must be committed before outcome determination; later wagers are voided and refunded.
S4.25.1
Fair and compliant sport/event bet settlement
Player Rights
Sport and event bets must settle fairly per terms and rules available to players when placed.
Requirements
Provide clear, prompt explanations for settlement decisions
S4.25.2
Results provision and account updates
Player Rights
Bet results and changes must be provided and account balances updated.
S4.25.3
Sport/event results data controls
Controls must ensure accuracy and timeliness of results data used for settlement.
Randomness of Game Outcomes 2
S4.26
Random selection mechanism for game elements
Game Design
A mechanism must randomly select game elements determining outcomes, independently and without correlation to play style or system load.
Requirements
Select seed values ensuring randomness
Uninfluenced by wager amount, play style or system load
Impervious to outside influences; failures detected quickly
S4.27
Monitoring and inspection of randomness mechanisms
Game Design
RNG mechanisms must be capable of being monitored and inspected to verify integrity.
Game Management 3
S4.28
Unchanging terms during sessions
Game DesignPlayer Rights
Play terms must not change mid-session unless players are aware before wagering.
Requirements
Limit player-initiated interface changes
Display multi-state info; update jackpots and odds
Communicate odds changes (not retroactively)
S4.29
Secured and authenticated game sessions
Game sessions must be secured and verified as authentic.
S4.30
Player activity time-out
RG Critical
Automatic session time-outs must protect inactive players.
Downloadable Game Content 1
S4.31
Critical functions independent of end-user device
Game Design
All critical functions, including game outcome generation, must originate from the gaming system, not end devices.
Sport and Event Betting Integrity 3
S4.32
Risk management for betting integrity
Operators must mitigate integrity risks including insider betting and event manipulation.
Requirements
Controls identifying unusual/suspicious betting; report to monitors
Monitors disseminate reports to operators
Notify relevant entities on suspicious activity
S4.33
Authority to suspend betting or withhold funds
Player Rights
Operators may suspend betting or withhold funds for events with suspicious activity reports, fairly and reasonably.
S4.34
Sport and event betting criteria
Game Design
Only bets meeting criteria for outcome verification and integrity safeguards are permitted.
Requirements
Documentable, independently generated outcomes
Majority of participants 18+; supervised by sport body
No past-event, financial-market or synthetic-lottery bets
Exclude CHL minor-league sports
Live Dealer Game Integrity 2
S4.35
Restricted access to live dealer supplies
Access to live dealer gaming supplies must be restricted to those with a business need.
Requirements
Grant, modify, revoke access by employment and role with logging
Periodic independent review of privileges
S4.36
Controls preventing dealer compromise of integrity
Game Design
Controls must prevent live dealer presenters from compromising game integrity.
5
Theme 5
Information Security and Protection of Assets
Protect gaming data, systems and assets through an industry-standard IT control environment: access management, authentication, encryption, logging, change and incident response, resilience, and periodic assurance.
25 standards3 player-flagged
12%
player-flagged
Regulatory risks this theme addresses
Unauthorized access to gaming systems or player data
Inadequate encryption of player PII or payment information
Service outages without tested disaster recovery or business continuity
A recognized industry-standard framework must be used to manage the IT control environment and support compliance with the Standards.
S5.02
Users access management
System access is limited to individuals with legitimate business need, with grants, modifications and revocations logged.
Requirements
Privileges granted by role with logging
Periodic independent review of privileges
All access-change activities logged
S5.03
Access monitoring and traceability
All system access is monitored, logged and traceable to specific individuals via unique accounts.
S5.04
Encryption of sensitive data
Player Rights
Sensitive data must be encrypted both in transit and at rest to prevent unauthorized access.
Requirements
Encryption protocols comply with recognized industry standards
Encryption keys are securely managed
S5.05
Authentication and access controls
System access requires robust authentication mechanisms to verify user identity before granting entry.
Requirements
MFA for administrative accounts
Access restricted by job function and business need
S5.06
Monitoring and logging of system access
All system access attempts and activities must be logged for audit and investigation.
Requirements
Retain logs per Standard 1.09 (minimum 3 years)
Protect log files from unauthorized modification
S5.07
Network security
Gaming systems must be protected from unauthorized external access and network-based threats.
Requirements
Deploy firewalls and intrusion detection
Conduct regular security assessments
Data Protection and Operations 10
S5.08
Data backup and recovery
Critical gaming data must be regularly backed up with tested recovery procedures.
Requirements
Backups at intervals set by data criticality
Regularly test recovery procedures
S5.09
Patch management
Gaming systems must receive timely security patches and updates to address known vulnerabilities.
Requirements
Document all patches applied
Test patches before production deployment
S5.10
Malware protection
Systems must be protected against malicious software through detection and prevention.
Requirements
Anti-malware software installed and current
Regular scans on all systems
S5.11
Third-party security
Gaming-related suppliers and contractors must maintain equivalent security standards.
Requirements
Contracts include security and audit-rights terms
Regular audits of third-party systems
S5.12
Change management
All changes to gaming systems must be controlled, documented and tested before deployment.
Requirements
Formal change management process
Changes approved before implementation
S5.13
Incident response
Procedures must detect, respond to and document security incidents promptly.
Requirements
Documented incident response plan
Incidents reported per notification matrix
S5.14
Physical security
Physical access to gaming equipment and critical systems must be restricted and monitored.
Requirements
Access to server rooms restricted
Surveillance of critical areas
S5.15
Personnel security
Staff with system access must be vetted and trained on security obligations.
Requirements
Background screening for sensitive access
Regular security training
S5.16
Vendor management
Contracts with technology vendors must include security and compliance obligations.
Requirements
SLAs specify security and response times
Vendor compliance verified via assessments
S5.17
Data retention and disposal
Player Rights
Player information and gaming records must be securely retained and appropriately disposed of.
Requirements
Retention per laws and Standards
Disposal ensures data is unrecoverable
Continuity and Assurance 8
S5.18
Segregation of systems
Development, testing and production systems must be logically and physically separated.
S5.19
Business continuity planning
Player Rights
Operators must maintain plans to continue critical gaming operations during disruptions.
Requirements
Documented BCP, regularly tested
Recovery time objectives for critical systems
S5.20
Disaster recovery
Systems must be capable of recovering from significant outages or data loss events.
Requirements
DR procedures documented, tested annually
Backup facilities available
S5.21
Security assessment
Regular independent assessments must evaluate the effectiveness of security controls.
Requirements
Periodic internal or external assessments
Findings documented and remediated
S5.22
Vulnerability management
Identified security weaknesses must be tracked and remediated in a timely manner.
Requirements
Vulnerability tracking process documented
Remediation timelines tied to risk severity
S5.23
Configuration management
Gaming system configurations must be documented, controlled and protected from unauthorized changes.
Requirements
Baseline-documented, version-controlled
Changes follow change management
S5.24
Documentation of controls
IT security controls must be fully documented for audit and compliance verification.
Requirements
Describe purpose, design and operating procedures
Available to auditors and Registrar
S5.25
Regular review of IT controls
IT security controls must be periodically reviewed to ensure continued effectiveness and alignment with evolving threats.
Requirements
Reviews at least annually
Control effectiveness tested and documented
6
Theme 6
Minimizing Unlawful Activity
Protect the integrity of Ontario's iGaming market from money laundering, terrorist financing and other unlawful activity through federal AML/CTF compliance, player identity verification, transaction monitoring and record retention.
4 standards
0%
player-flagged
Regulatory risks this theme addresses
Money laundering or terrorist financing through gaming accounts
Failure to verify player identity against government-issued ID
Suspicious transaction patterns going undetected
Insufficient record retention for FINTRAC and Registrar inspection
Anti-Money Laundering and Fraud Prevention 4
S6.01
AML and terrorist-financing compliance
Operators must comply with federal anti-money-laundering legislation and implement suspicious-transaction reporting.
Requirements
Compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act
Suspicious transaction reporting to FINTRAC
S6.02
Player identification and verification
Operators must verify player identity using government-issued identification to prevent unlawful activity.
Requirements
Verify using government-issued ID
Verification before account activation
S6.03
Transaction monitoring
Operators must monitor transactions for patterns indicative of money laundering or other illicit activity.
Requirements
Monitoring systems identify suspicious patterns
Reports submitted to authorities
S6.04
Record retention for AML purposes
Documentation supporting AML compliance must be retained for regulatory review.