All 31 Pennsylvania standards,
organised by chapter

Third-party platform operators that provide the technology, brand, or marketing on behalf of a certificate holder must themselves hold a PGCB-issued operator license, with key-employee licensing and disclosure of beneficial ownership above five percent.

Vendors providing ancillary services — payment processing, KYC, geolocation, affiliate marketing, hosting — must be either registered or certified with the PGCB based on their role, with background checks on principals and contract disclosure.

Affiliates driving Pennsylvania traffic must be disclosed to the PGCB and, depending on compensation model, registered as service providers. The certificate holder remains liable for affiliate compliance failures, and content must not target minors or self-excluded persons.

Before accepting any wager, operators must register a player account using verified identity, confirm the player is at least 21, confirm Pennsylvania physical presence, and check the PGCB self-exclusion list in real time. Each person may hold only one account per operator.

Operators must clearly disclose permitted deposit methods, honour withdrawal requests in a reasonable period, keep player funds segregated from operational funds, and hold reserves sufficient to cover aggregate player balances.

Addresses treatment of dormant accounts, unclaimed balances, and player-initiated closures. Players may close an account at any time and withdraw the cleared balance; closed-account data is retained under Chapter 814.

Operators must provide players with real-time balance information and at least twelve months of itemised account history — deposits, withdrawals, wagers, and bonuses — together with a visible dispute-resolution contact.

Advertising must be factually accurate, must not primarily appeal to minors, must not imply that gambling relieves financial problems, and must include the Pennsylvania problem-gambling helpline. Ads must not be placed on or near K-12 schools.

Every bonus offer must clearly disclose wagering requirements, eligible games, maximum bet during play-through, and expiration, in plain language, with full records retained under Chapter 814.

Operators must scrub marketing lists against the PGCB self-exclusion list and must not knowingly send promotional material to minors or self-excluded individuals, including through digital audience-based targeting.

Online poker and casino tournaments must operate under PGCB-approved structures, with buy-ins, rake, payouts, and tiebreak rules published in advance and disconnection protocols disclosed to the player.

Every certificate holder must file and maintain a PGCB-approved responsible-gaming plan covering staff training, player-facing disclosures, RG tools, and funding for the Pennsylvania compulsive-gambling treatment program.

Operators must offer players self-directed daily, weekly, and monthly deposit, wager, loss, and session-time limits, enforced in real time — decreases take effect immediately, while increases are subject to a cooling-off period.

The PGCB maintains the Interactive Gaming Self-Exclusion List, enrolled directly by the player for 1 year, 5 years, or lifetime. Operators must check the list in real time at registration, at login, and periodically during play, block matched accounts, and return balances per PGCB rules.

Every interactive gaming skin must prominently display responsible-gaming messaging, the 1-800-GAMBLER helpline, and visible links to player tools and self-exclusion enrolment, with session time and net-loss indicators available.

Players may impose short-term time-outs — for example from 72 hours up to 30 days — distinct from formal self-exclusion. Cool-off periods cannot be reversed before expiration and suppress marketing during the time-out.

Only games approved by the PGCB — in a published catalogue of slots, table games, and peer-to-peer poker variants — may be offered to Pennsylvania players, with per-game submission and version-controlled deployment.

Complete rules, paytables, and theoretical return must be accessible to the player both before and during play, with no material rule changes mid-session.

Poker platforms must actively detect collusion, bots, and multi-accounting, surface hand histories to the player, disclose rake and fees, and publish disconnection protections.

Operators must provide a documented complaint process, respond in writing with reasoning, and inform the player of the right to file with the PGCB for adjudication where disputes remain unresolved.

Interactive gaming systems, random number generators, and every individual game must be tested by a PGCB-approved independent testing laboratory before deployment, with reports filed with the Board.

Operators must use a PGCB-approved geolocation system to confirm the player is physically within Pennsylvania at wager time, re-verify periodically, block VPN or proxy spoofing, and retain geolocation logs.

Operators must implement an AML and KYC program consistent with federal law and PGCB rules, including enhanced due diligence on high-volume players, transaction monitoring, and appropriate regulatory filings.

Platforms must prevent anyone under 21 from opening an interactive gaming account or placing a wager, and must detect and remediate underage access with voided wagers and incident reporting.

Enhanced penalties apply to violations of self-exclusion, responsible-gaming disclosure, or advertising-to-excluded-persons rules, including corrective action plans and potential restitution to affected players.