1 Contents
1 Contents ... 1
2 Foreword ... 3
3 Practical information ... 4
4 What do the guidelines comprise? ... 5
4.1 Games for which a licence may be obtained ... 5
4.2 Games for which a licence cannot be obtained ... 6
4.3 Games that may be operated without any licence ... 7
5 Who must apply? ... 7
5.1 Subcontractors ... 8
5.2 White labels... 9
5.3 Affiliates... 10
6 Application ... 11
7 Requirements to be met by applicants ... 13
7.1 Requirements on individuals ... 13
7.2 Requirements on companies ... 15
7.3 Requirements on members of the executive and the board of directors ... 15
7.4 Applicants who are resident or established outside EU or EEA countries ... 15
8 Requirements for appropriate professional and financial operation ... 16
8.1 Appropriate financial operation ... 16
8.2 Appropriate professional operation ... 22
8.2.2 Link-up to SAFE and ROFUS ... 24
8.2.3 Requirements for your gambling system ... 25
8.2.4 Registration of customers (players) ... 29
8.2.5 Politically exposed persons residing in another country ... 32
8.2.6 The players' gambling accounts ... 34
8.2.7 Information to the players ... 36
8.2.8 The players' possibility of limiting gambling ... 37
8.2.9 Requirements which only apply to betting licences... 38
9 Issuing licences ... 39
10 The restricted revenue licence ... 40
11 Making changes to a licence ... 42
11.1 Application concerning other games than those mentioned in the licence ... 42
11.2 Transferring a licence ... 43
11.3 Other changes ... 44
12 Further requirements in connection with the provision of gambling services ... 45
12.1 The marketing of games ... 45
12.2 Complaints from players ... 46
12.3 Suspension of a gambling account ... 47
12.4 Selling land-based betting services ... 47
13 Annual fee ... 48
14 Lapse of licences ... 50
15 Withdrawal of a licence ... 50
2 Foreword
These guidelines are intended for citizens and companies who are interested in providing betting and online casino services in Denmark under the Gambling Act (Act No. 848 of 1 July 2010 on Gambling and Act No. 223 of 22 March 2011 for Greenland on Certain Games as later amended) and the associ-ated statutory instruments.
On 22 September 2011, the Gambling Authority published a number of forms, whereupon it is possible to apply for a licence. When publishing the forms, the Authority pointed out that all applications re-ceived by 17 October 2011 at noon will give the applicants the possibility of being on the market as from 1 January 2012.
An application may be submitted in stages if only the complete material has been received in duly filled-in condition before the closing date for application, meaning that it is possible in the process, for instance, to
Submit the application form itself without enclosing Appendix A and/or Appendix B;
Submit the application form itself filled in only partly;
Submit the application form itself plus Appendix A and/or Appendix B.
This approach is recommended in particular, if parts of the application material is actually ready for review by the Gambling Authority before 17 October, or if an applicant is in doubt as to whether the application form and/or Appendix A or B have been correctly completed. This will ensure better oppor-tunities for the Gambling Authority to engage in dialogue with the applicant about the application ma-terial and to get any questions of doubt etc. eliminated, which will allow the applicant to keep within the time limit for application.
If the application material is submitted in stages, each submission must be accompanied by a statement indicating the part of the application which is covered by the submitted documents and the parts of the application which will thus still be outstanding. If an applicant feels in doubt as to whether certain en-closures are adequate, this must also be indicated in the statement.
Applicants must always pay the full application fee before the Gambling Authority assesses the full application or parts of it.
In exceptional circumstances the Gambling Authority may grant an exemption from the time limit and continue to work towards ensuring that applicants will be on the market as from 1 January 2012 if it is estimated, on the basis of a specific assessment, that later submission of minor parts of the application
material will not lead to a greater workload and thus interfere with the assessment of the applications that were received in full before the time limit expired.
In cases in which enclosures have been submitted while the Gambling Authority finds that they are not fully adequate, additional submission will, in principle, not prevent the applicant from being on the market as from 1 January 2012, provided that these enclosures reach the Gambling Authority within a short time – particularly if the applicant has himself called attention to his being in doubt about whether an enclosure is adequate.
These guidelines are dynamic and the Gambling Authority is working on improving them continuously. Thus, they will be updated and further specified on relevant points on an ongoing basis.
3 Practical information
The Guidelines describe the most important rules for citizens and companies who wish to provide bet-ting and online casino services.
The regulatory basis is the gambling acts (the Act on Gambling and the Act for Greenland on Certain Games) as well as the following executive orders:
The Executive Order on Online Casino Services
The Executive Order on Providing Online Betting Services
The Executive Order on Land-based Betting.
The Gambling Authority is the body that issues licences, collects fees and is charged with controlling and supervising the area. Restricted revenue operatinglicences are not subject to the Executive Orders referred to above. However, the Gambling Authority may specify certain terms.
SKAT (the Danish tax authority) is responsible for registering licence holders and collecting, control-ling and recovering duties.
Gambling for money is exempt from VAT. Gambling operators who provide gambling for money must pay payroll tax according to section 1(1) of the Payroll Tax Act. Further questions about VAT and pay-roll tax may be addressed to SKAT. For further information please refer to www.skat.dk.
You may find further information at the Gambling Authority’s site, www.spillemyndigheden.dk, where you may also find forms and other material to be used in a possible application. If you have any ques-tions, you should not hesitate to contact the Gambling Authority at [email protected] or
telephone +45 72 38 79 13.
4 What do the guidelines comprise?
The Gambling Authority may grant licences for betting and online casino services. Some games may be provided without any licence, even if they may be online casino games, for example, while it is not possible to get a licence for other games even if they are betting or online casino games. This section gives a brief review of the rules.
4.1 Games for which a licence may be obtained
BettingBetting comprises games in which the participants enter their bets for the outcome of an event, such as Oddset and manager games. The concept comprises more than just betting on sports events. For in-stance, betting on what name a new member of the royal family will be given is also a betting game. Betting may be divided into two categories:
Fastodds betting such as Oddset – where the player bets directly against the provider of the bet and knows his possible winnings in advance. The definition also comprises betting exchanges.
Pool betting such as manager games – where the whole gain or part of it is determined by the size of the pool or is divided between the winners.
A licence to provide betting services covers both online and land-based selling of bets. Online betting is when the player and the operator do not meet physically, for instance where bets are sold via the in-ternet, telephone or television. Operators are not allowed to offer betting on sports events reserved for young persons under 18.
A betting licence also comprises land-based betting on the results of electronically simulated sports events.
Betting services may exclusively be provided based on a licence from the Gambling Authority.
Online casino
Online gambling services are those where the player and operator do not meet physically, for instance where games are sold via the internet, telephone or television.
Online casino games include roulette, black jack, baccarat, punto banco, poker and gambling on gam-ing machines offergam-ing cash winngam-ings , i.e. games that are now typically offered by the land-based casi-nos as well.
The concept of ’online casino’ defined in the Gambling Act is broader than the games offered in land-based casinos because it also comprises so-called ’combination games’, which are games in which the outcome is determined by a combination of chance and skill. Games that are determined totally by chance such as lotteries, bingo and the like are not comprised and, similarly, games that are determined by skill exclusively are not comprised either. Skills games are games like chess, for example.
If a game includes both chance and skill, it will be covered by the online casino concept. Examples are backgammon, whist and quizzes. A quiz in which those who have answered a question correctly take part in a draw of lots is therefore an online casino game.
Online casino games may only be provided subject to a licence from the Gambling Authority.
4.2 Games for which a licence cannot be obtained
You cannot apply for a licence to operate a general lottery or a class lottery. A lottery is a game like:
bingo
scratch cards
drawing lots
These games may only be operated by companies with special permission. Permits been granted to Danske Spil A/S and Det Danske Klasselotteri A/S, for instance.
It is, however, possible to apply for a permit for a land-based offering of a charitable lottery, i.e. a lot-tery to fund either a charitable cause or other benevolent objectives. To read more about it, refer to www.spillemyndigheden.dk → Lottery.
About betting in particular
Holders of a betting licence may not provide gambling on:
horse and dog races
pigeon racing
results of lotteries
other randomly created events.
4.3 Games that may be operated without any licence
Betting and online casino games are only subject to gambling legislation in case the players:
Pay stakes or entry fees (money or similar), and
Upon payment of their stakes or entry fees have the chance of winning a prize (all types of priz-es).
If none or only one of the conditions is met, you may operate the game without any licence from the Gambling Authority.
Pure skills games may be offered without any licence even if they fulfil the conditions referred to above. To read more, refer to section 4.1 under Online casino.
What is a stake?
Stakes will typically be money paid by a player for taking part in a game. Membership fees and the like may also serve as stakes if a surcharge must be paid for taking part in the game.
What is a prize?
A prize may be money, goods or other benefits of financial value. There must not necessarily be any correlation between a player’s stakes and the prize players may win. A sponsored prize will therefore also be a prize.
5 Who must apply?
The Gambling Act sets out the requirements that an individual or company must meet to obtain a li-cence to offer gambling services, but it does not contain a precise definition specifying what a lili-cence holder is.
Obligations, responsibility and rights
Basically, all individuals and companies offering betting and/or online casino services must hold a li-cence. If a gambling operator has decided, in reality, to offer the various games comprised by one brand from several different companies, all the companies must in principle hold a licence.
The licence holder is responsible for ensuring that the operation of the games offered complies with Danish legislation. The licence holder’s rights and obligations include the following:
1. Responsibility, risk and managerial prerogative relating to the operation of games. 2. Contracting with players.
3. Ownership of player data, including registration of players. 4. Player support.
5. Ownership of intellectual property rights relating to games.
6. Ownership of website/game client.
7. Operating the gambling system, including maintenance of hardware.
8. Owner or renter of the greater part of the gambling system (gambling infrastructure). 9. Control of colluding etc., money laundering and combat of the financing of terrorism. 10.Payment transfer services and underpinning of payment instruments.
11.Marketing of trademarks and/or games.
5.1 Subcontractors
A licence holder may use subcontractors for some of the tasks referred to above. The number of tasks that may be handled by subcontractors will depend on a specific assessment. However, in principle, the greater part of the services must be provided by the licence holder. The use of subcontractors is not contrary to the prohibition against delegating rights as set out in section 11.2 as long as it involves a minor part of the operation. The licence holder must keep in mind that using subcontractors will not allow the licence holder to disclaim liability vis-a-vis the regulators for the work that is not carried out by the licence holder himself. Subcontractors may not be entrusted with performing the work set out in items 1 and 3.
A subcontractor may not be a white label buyer from a gambling operator if it provides services to that operator.
Network platforms
Network platforms are platforms used for games in which players play against each other (peer-to-peer games) and where exclusively such games are facilitated. Customers are redirected via the licence holder to a network platform, on which the customer may take part in games against or with players from other gambling operators and other countries.
Network platforms must not, in principle, have a licence to operate gambling in Denmark if the licence holders who use the platform have a licence. It is not a requirement that all gambling opertors linked to the network are licence holders in Denmark. Customers from Denmark must, however, always access the network via Danish licence holders.
Network platforms will be considered as subcontractors to the extent that the network platform does not have or carry out the greater part of the tasks listed under Obligations, Responsibility and Rights. The interaction with the licence holder may lead to the occurrence of overlap, but the network platform may, as a subcontractor, solely handle a minor part of the tasks involved.
The network platform must have a licence if, in addition to operating the platform, it is a white labeller or gambling operator.
As the network platform is not required to have a licence, it means that the licence holder who redirects the customer to the platform will hold the responsibility for the game facilitated via the platform.
5.2 White labels
In general, the white label concept is defined as a game produced by a company (white labeller) which is marketed by another or several other companies (white labels), making it appear as if the white label operates the product. This will allow almost identical products to be sold in a way that makes it look like a unique brand several times.
Online gambling services may be permitted in white label structures and are not contrary to the prohibi-tion against delegating rights provided that the requirements set out below in secprohibi-tion 11.2 are met.
White labeller
The white labeller, i.e. the product owner, must, in relation to the operation of games, observe the obli-gations and hold the rights set out in section 5.1. The white labeller must accordingly be a licence hold-er.
A white labeller may use subcontractors as referred to above. A subcontractor may not be a white label buyer (from the white labeller) or an affiliate.
The licence holder is responsible, irrespective of the white label structure, for ensuring that games are operating in accordance with current legislation or the terms stipulated in the licence.
White label buyer
It is solely the marketing of the site and the associated games that may be carried out by the white label buyer (company 1, 2 and 3). The companies or individuals who have bought the white label solution may not have any access to gambling accounts and the operation in general. A white label buyer
Licence holder
Supplier and
opera-tion
White labeller
Gambling site
White label
Company 1
Gambling site
White label
Company 2
Gambling site
White label
Company 3
May not have any relations to registered players other than the relation necessary for marketing the game. The prohibition against relations applies only in respect of the gambling activity. If the white label buyer has relations to registered players because of the operation of its normal area of business (other than gaming), this will not constitute circumvention of the prohibition.
May solely have access to the information in the customer database that is required for market-ing purposes.
May not hold the ownership of the database of registered players or the gambling system. The white label buyer may under contract take over the ownership of the database when its coopera-tion with the white labeller is terminated.
If the white label buyer has any influence on operations or gambling accounts, the structure will no longer qualify for being considered as a white label structure.
A white label buyer cannot be a subcontractor to a white labeller.
If the white label buyer owns the trademark which is used to market its gambling site, this will not be contrary to the rules.
The licence holder is responsible for ensuring that games are carried through in accordance with cur-rent legislation and the terms of the licence. Therefore, a situation in which a white label buyer is sponsible for the operation of games cannot normally arise. The licence holder cannot disclaim its re-sponsibility. However, the white label buyer may beheld responsible, for example in case one or more companies (company 1, 2 and 3) have had influence on the operation of the games, etc., or if they know or ought to know of contravention of legislation or licensing terms.
A white label buyer (company 1, 2 and 3) may also be held responsible if it acts contrary to general marketing practices or consumer protection rules and the relevant provisions of the Gambling Act. Even if the white label buyer will typically be in charge of the greater part of the marketing of the gam-bling site, nothing will prevent marketing by the use of affiliates as well.
5.3 Affiliates
An ’affiliate’ is an individual or company that carries out work to market another entity’s products or services.
Gambling providers often use this type of affiliate marketing to market their sites and the games they offer, for example by means of links or banner advertising and also articles, etc. which are not in the nature of editorial cover.
Though affiliates are typically used in electronic communication the use is not restricted to this. Also hotels, cafes and other offline channels may be used in connection with marketing.
Affiliates do not need a licence if they merely market the gambling operator’s services and thus do not:
• have any relations to players.
• own gambling data.
• own rights associated with the trademarks and sites they are marketing.
• own parts of the gambling system used for the game or the site they are marketing.
The general consumer protection and marketing rules and the Gambling Act’s provisions on marketing and promotion apply to affiliates as well. They may incur liability according to these rules.
6 Application
It is possible to apply for four types of licence: 1) A betting licence
2) An online casino licence.
3) A betting licence for a fixed term of one year with a gross gambling revenue limit of DKK 1 million (restricted revenue licence).
4) An online casino licence for a fixed term of one year with a gross gambling revenue limit of DKK 1 million (restricted revenue licence).
Forms
Applicants should use form no. 29.064 to apply for a betting or online casino licence. You will find the form on the site www.spillemyndigheden.dk → Forms. You must use the same form no matter the li-cence you wish to apply for.
The key persons of your company (please refer to section 7.1 for the requirements to be met by indi-viduals) must, in addition, fill in form no. 29.065. Furthermore, you must submit information about the games to be offered in Appendix B – form no. 29.066. Some of the requirements in the area of the gambling system etc. cannot be fulfilled, however, unless the gambling system has been established. Please contact the Gambling Authority if you wish to postpone the fulfilment of the technical require-ments, for example, for information about how to file such an application and the requirements for such a process. It is only possible to be granted postponement in connection with information to be
submit-ted in Appendix B. Applications that involve postponement may be expecsubmit-ted to require a longer period to be assessed.
If you wish to apply for a restricted revenue licence, you have to fill in application form no. 29.064 and Appendix A. Unlike other applications, this type of application will include items in the application itself or the associated appendices which you will not be able to fill in due to the special characteristics of the restricted revenue licences. Appendix A must always be filled in and submitted with all enclo-sures attached. Appendix B must not be filled in. Instead, you have to submit a detailed description of the intended offering of games, an account of your administration/business processes and a description of the technical equipment.
In connection with its assessment of the application the Gambling Authority will be entitled to demand further information and possibly call you to a meeting. It will depend on the characteristics of the game and the measures which the Gambling Authority finds necessary in order to protect players.
Application fee
Before you file the application you must pay the fee. The account number to which the fee must be paid is shown on the application form.
As of 1 January 2011 the fee is:
DKK 250,000 for an application for a betting or an online casino licence.
DKK 350,000 for an application for a combined betting and online casino licence.
DKK 50,000 for an application for a restricted revenue licence for either betting or online casi-no operations.
The fee must have been paid when you file the application to the Gambling Authority and proof of the payment must be enclosed.
The fee will not, in principle, be returned – even if you are not granted a licence.
To read more about fees and the current rates of fees, you may check www.spillemyndigheden.dk.
Filing an application
Applications must be sent by regular mail in an electronic format in two copies, for example two CD-ROMs or two USB keys, each containing the filled-in application form, appendices and other relevant enclosures. All documents must be in separate named files in a standardised electronically readable file format such as pdf.
It is not possible to file applications in hard copy.
Applications may also be filed by e-mail if the material in the case is of a limited extent, for instance applications for a restricted revenue licence. If the application is forwarded by secure e-mail, you should be advised that the Gambling Authority can only receive up to 20 MB per e-mail, including files attached.
If you wish to encrypt the information, the Gambling Authority’s public key (certificate)may be down-loaded from www.certifikat.dk
You should send the application to the Gambling Authority at: Spillemyndigheden Helgeshøj Allé 9 DK-2630 Taastrup
or
7 Requirements to be met by applicants
Both individuals and companies may apply for a licence to offer gambling services. There is no re-quirement that the applicant must be a resident of or established in Denmark. Persons or companies who apply for a restricted revenue licence to offer either betting or online casino games in Greenland must be established in Greenland, however.
7.1 Requirements on individuals
You must satisfy four objective and three subjective requirements before you can be granted a licence. An objective requirement means that the conditions involved can be easily verified, so that, in princi-ple, the Gambling Authority must not conduct any evaluation.
The objective requirements are:
You must have turned 21 years.
You must not be under guardianship or requested guardianship (samværgemål).
You must not have filed a petition for restructuring, bankruptcy or debt relief or be subject to restructuring, bankruptcy or debt relief proceedings.
o Owing money to public authorities which is outstanding means that the deadline for payment has been transgressed and that the debt has been passed to the debt recovery authority, which is the Tax Authority Recovery Centre (SKATs Inddrivelsescenter).
o Debts will not affect your possibility of obtaining a licence if
1) You have entered into a payment agreement,
2) You have provided full security for the debt, or
3) If there is disagreement between you and SKAT (the tax authority) on the existence or amount of the debt and SKAT has informed you that the debt will not be recov-ered until the disagreement has been clarified.
Subjective requirements mean that the Gambling Authority must assess whether you meet them. The subjective requirements are:
You must not have been convicted of a crime in Denmark and/or another country that may
in-volve a risk that you will misuse the access to working with gambling activities.
You must meet the requirement for appropriate professional operation.
You must meet the requirement for appropriate financial operation.
Requirement What does the requirement mean?
You may not have been convicted of a crime in Denmark and/or another country that may involve a risk that you will mis-use the access to working with gambling activities.
The Gambling Authority must assess whether con-travention of legislation etc. may involve a signifi-cant probability that you will misuse the access to working with gambling activities. All sentences may be relevant but it will always be considered what type of crime you have committed and when it happened in relation to the time of application and if it involved repetition or systematic contravention. Also contravention of tax and excise duty laws may be of importance for the assessment of you. The ac-ceptance of fines etc. is also a reflection of a sen-tence.
You must offer gambling on an appropri-ate financial basis.
In its assessment the Gambling Authority takes into account, among other things, that
The operator is in a position to pay out all potential winnings,
The budgets are consistent with the targets defined in the business plan,
Sufficient funds have been allocated to the running of the business.
To read more, refer to section 8.1. You must offer gambling on an
appropri-ate professional basis.
In its assessment the Gambling Authority takes into account, among other things, your prior experience in the areas of business operation and gambling ac-tivity. If you have no prior experience, the Authority will assess your education background and other experience.
In addition it will be assessed if the games to be of-fered, the gambling system, etc. meet the require-ments of the Act and executive orders.
To read more, refer to section 8.2.
7.2 Requirements on companies
The requirements to be met by companies are the same as those applying to individuals.
However, the age requirement and the requirement that a person may not be under any type of guardi-anship do not apply.
7.3 Requirements on members of the executive and the board of directors
Members of the company’s executive board and its board of directors must meet the same requirements as individuals.
7.4 Applicants who are resident or established outside EU or EEA
coun-tries
If you are resident or your company is established outside the EU or EEA, it is a requirement that you have a representative in Denmark. The representative, who must be approved by the Gambling Au-thority, may be either an individual or a company.
At the website www.Skat.dk you may find a survey of EU and EEA countries under Borger → Aktier, pension og spil → Spil → Poker → EU- og EØS lande [in Danish only].
Your representative must be able to represent you as licence holders in areas of administrative law and in procedural and criminal law matters, as the duties of this individual or company will include day-to-day communication with the Gambling Authority.
If the representative is an individual, the representative must meet the same requirements as the appli-cant; see requirements on individuals in section 7.1. In addition, the representative must be resident in Denmark.
If the representative is a company the representative must meet the same requirements as the applicant, see requirements on companies in section 7.2. In addition, the company must be established in Den-mark.
8 Requirements for appropriate professional and financial
oper-ation
To obtain a licence to operate gambling services in Denmark, you must render it probable that the op-eration of the gambling activity will take place on an appropriate professional and financial basis. The two concepts will be described separately below. The distinction between the two concepts may be floating, however.
8.1 Appropriate financial operation
A gambling business must be operated on an appropriate financial basis. Therefore, when applying for a licence, you must enclose documentation that will enable the Gambling Authority to assess your company’s financial position, etc.
The Gambling Authority attaches importance to ensuring, for instance, that
The company will be in a position to pay out all potential winnings,
The budgets are consistent with the targets defined in the business plan, and
Sufficient funds have been allocated to operating your company.
The Gambling Authority will send a considerable part of the financial information to a firm of account-ants, who will assist the Authority in its assessment. The accounting firm is under a duty of secrecy. The accounting firm will not make the final decision as to whether an applicant is assessed to be able to
carry out gambling operations on an appropriate financial basis. The Gambling Authority will make the final assessment based on recommendations from the accounting firm.
The application form must be accompanied by the following enclosures, which will be passed on to the Gambling Authority’s accounting firm:
Financial situation, internal controls and financial capacity
The applicant’s financial statements for the past five years
The applicant’s funding plan See the section ’the applicant’s risk profile’
below. The applicant’s operating budget for the 12 months
ahead with management’s comments
An operating budget for the 12 months ahead broken down by expected revenue per type of game, expected costs by main cost categories such as payroll, selling costs, administrative costs, amortisation and depreciation, service charges to group companies, net interest ex-penses and income taxes accompanied by management comments including budget as-sumptions.
Documentation providing an overview of the appli-cant’s largest accounts receivable at the time of ap-plication.
A list of debtors broken down by age, with the particular accounts broken down by the following maturity categories:
Not due
More than one month overdue
More than three months overdue
More than six months overdue
More than nine months overdue
The list must show the names of debtors and the amount of each account outstanding. Information showing who the applicant’s owners
are
Owners should be defined on the basis of qualified shareholdings. Please state the names, addresses and registration numbers of
all owners who are characterised by pos-sessing qualified shareholdings of 10 per cent or above.
The ultimate parent’s financial statements for the past five years
An ultimate parent is defined as the owner(s) who, in total, possesses a qualified sharehold-ing above 50%. Please enclose financial statements for the past five years from the top group company/companies presented accord-ing to generally accepted principles (Financial Statements Act, IFRS, US GAAP, etc.). If the ultimate owner is an individual, corre-sponding accounting data should be submit-ted, for instance annual accounts, statements of capital or similar data.
The ultimate parent’s operating budget for the 12 months ahead
The operating budget for 12 months ahead of the top group company/companies, showing expected revenues, costs, net interest expens-es and corporate income taxexpens-es accompanied by management comments, including signifi-cant budget assumptions.
Internal controls
The applicant is requested to submit a copy of its compliance and ethics programmes (codes of eth-ics).
A compliance and ethics programme com-prises descriptions of the establishment and implementation of rules and principles deal-ing, for instance, with fraud exclusion, fair-ness conduct, money laundering, acceptance and exclusion of customers, problem gam-bling, etc.
Copies of written procedures for:
1. General policies for the applicant’s in-ternal controls
2. Framework for internal controls such as COSO
Re 1: Written business procedures for the company’s internal controls. Internal controls may for example be concerned with the fol-lowing areas:
3. Implementation of risk assessments in the areas: a) Setoff-free account, b) IT, c) Book-keeping, d) Reconciliation of customer funds, e) Financing procedures and f) Mathematical models.
4. Assessment of all major risks under-pinned by the associated risk handling policies. Book-keeping Reconciliation Setoff account Salary determination Bonus calculation
List of persons authorised to sign, in-cluding access to liquid bank ac-counts.
IT security.
Re 2: The Committee Of Sponsoring Organi-sations (COSO) is a generally recognised framework that describes an internal control system based on the following phases: - Internal environment - Objective settings - Event identification - Risk Assessment - Risk Response - Control Activities
- Information & Communication - Monitoring
The framework is recommended only, and the particular company may have established its own control system based on other similar principles.
Re 3: Documentation proving that the appli-cant has identified risks associated with the mentioned areas and that the applicant has implemented compensatory controls or simi-lar to counter the risks identified.
Re 4: Management’s specific description of all significant risks and description of coun-teracting controls.
A copy of the applicant’s policy for accepting cus-tomers from areas covered by OFAC restrictions
OFAC relates to companies in the financial sector. It may, however, be relevant to gam-bling-related companies. OFAC publishes a list regularly by which they ‘red flag’ a num-ber of countries, companies, individuals, etc. The applicant may have defined policies relat-ing to this list, makrelat-ing monthly data with-drawals, for example, to compare the OFAC list with its own payment flow to make sure that it does not make payments to any ’red flagged’ entities or individuals.
A copy of the areas of work for the internal audit, compliance group or other monitoring bodies
If the applicant has set up an internal audit function, compliance group or another inde-pendently monitoring body, the applicant is requested to enclose documentation which proves it. It may be a description of these de-partments, their managerial position in the organisation, reporting channels, responsibili-ties and reviews completed.
A copy of the past 12 months’ risk management reports to the executive and board of directors
A report containing a prioritised overview of significant risks associated with the appli-cant’s business and the games operated by the applicant. The report will typically include a description of risks and the measures taken to counter these risks, and a description of whether the risk management of the particular risks works as intended or requires improve-ment.
A copy of the applicant’s procedures and controls designed to ensure that the applicant has sufficient funds to pay out all potential winnings.
A funding plan containing a specific descrip-tion of mathematical calculadescrip-tions of financial risks and the funding of such risks. Financial risks include currency risk, interest rate risk and gambling risk, for example.
descrip-uments how it will ensure correlation between its system for monitoring net positions and the actual funding.
tion of mathematical calculations of financial risks and the funding of such risks. Financial risks include currency risk, interest rate risk and gambling risk, for example.
Financial capacity
A copy of the guarantee provider’s credit rating of the applicant
If guarantees to cover the applicant’s financial risk or similar have been provided by a third party to the applicant, documentation that proves it must be submitted. If an official credit rating has been issued, for example by S&P (Standard and Poor’s Credit Rating Agency), this must be submitted.
Documentation of software that continuously moni-tors and reconciles all customer accounts to a set-off-free bank account held in the applicant’s name. The software system must be tested on an ongoing basis.
A copy of guarantees issued to third parties. In case the applicant has provided guarantees
to a third party, the applicant should submit documentation of such guarantees.
Organisation
The company’s history and documentation of its company registration.
For instance a transcript from the Commerce and Companies Agency or similar.
Management history underpinned by statements from authorities
For instance a transcript from the Commerce and Companies Agency or similar with com-ments on significant and/or frequent changes of management.
Corporate structure
An overview of the applicant’s corporate and group affiliation supported by official certificates
A group chart or other description of the group’s structure, indicating shareholdings, using the definition of a group set out in the Financial Statements Act or another relevant definition (IFRS, US GAAP etc.).
Official certificates may be transcripts from the Commerce and Companies Agency, certi-fying the company’s registration.
A description of the applicant’s or associated com-panies’ present gambling activities (if possible in all countries)
A survey of the company structure in Denmark A description of planned activities in Denmark, in-cluding other activities than those for which the applicant has applied to date.
The applicant’s risk profile
The applicant’s financing plan/funding plan A funding plan containing a specific
descrip-tion of mathematical calculadescrip-tions of financial risks and the funding of such risks. Financial risks include currency risk, interest rate risk and gambling risk, for example.
The setoff-free account
To protect the players’ funds you must have a setoff-freeaccount at a bank, which must be kept sepa-rate from other funds. The funds in the account may solely be payable to players and they must be pro-tected in case of the licence holder’s insolvency.
The amount held in the account must always be equal to the total amount deposited on the players’ gambling accounts. In practice, this requirement is difficult to observe. Your accounting system must therefore be organised in a way that makes it possible at any time to obtain a correct indication of the deposits held in the players’ accounts. The setoff-free account must be updated once every 24 hours to ensure that the two amounts will match.
8.2 Appropriate professional operation
The Gambling Authority’s evaluation of applicants will comprise the requirements set out in section 5.1 as well as the relevant Acts and Executive Orders, and it will be based on the information you sub-mit with the application.
For the purpose of the evaluation, one of the documents you must enclose is a business plan. In the application you should state the staff members who are responsible for:
Gambling software and operating games
IT security
System changes
Monitoring of money laundering of proceeds and the financing of terrorism (only in the case of an application for an online casino licence – not in an application for a restricted revenue licence)
Financial affairs.
In principle, the staff responsible should be employed by the licence holder’s company, but the Gam-bling Authority will accept persons employed in the same group, for instance, if it can be guaranteed that they are empowered to establish measures and carry through changes that may be necessary. These persons must also provide and account for all information and documentation which the Gambling Au-thority may need.
These persons may in no case be employed by subcontractors or companies that are not part of the same group as the applicant.
The application must be accompanied by one or more CVs that illustrate each responsible profession-al‘s level of experience. It must not necessarily be different persons.
The CVs of the responsible professionals must illustrate to the Gambling Authority that they are quali-fied for their jobs. Thus, it is not necessary to include personal details about family situation etc. in the CV. It must give a true and fair view of the person’s track record and a description of his professional competency to take on the responsibility.
Appendix A must be accompanied by a CV of each member of the company’s executive and board of directors. These CVs should be more detailed than the one referred to above. However, in principle, the Gambling Authority does not need to receive personal information like family situation details.
In cases in which a person in a member’s family or circle of close persons may be considered to have the capacity to exert controlling influence on the member of the executive or the board of directors, and if certain types of information about the person, such as a criminal record, may be relevant for the Gambling Authority to know, such information must be submitted.
8.2.1 Control of gambling data, etc.
Schedule 1 to the Executive Orders requires the establishment of a SAFE and use of the Tamper Token. In addition, operators who provide games online must be linked with the Gambling Authority’s register of self-excluded players (ROFUS).
SAFE is your own data storage (a file server) where you are required to store data - in accordance with standard records - for all games hosted by you. All licence holders are required to establish a SAFE. It must be possible for the Gambling Authority to get online access to the licence holder’s data storage.
Tamper Token
Tamper Token is a security system which is aimed to ensure that the data saved by the licence holder in its SAFE remain unchanged while stored by you.
Tamper Token will be implemented in the Gambling Authority’s system and handle:
Creation of keys (tokens) used for the calculation of identification codes.
Storage of identification codes for later control.
Continuous control to check that the fixed period of time for terminating tokens is observed.
Verification that a retrieved series of data has not been changed in relation to the identification code received.
ROFUS
The Register of Self-Excluded Persons (ROFUS) is a register of all players in Denmark who have vol-untarily requested exclusion - temporarily or permanently - from playing online games in Denmark. The register is located at the Gambling Authority, which is also responsible for keeping the register. If a player wants to be registered on the Register, you must arrange access to the Gambling Authority’s website, from where exclusion may be effected.
For a further description of ROFUS, please refer to section 8.2.8, Exclusion from gambling by the Gambling Authority.
For a more detailed technical description of the above-mentioned systems, please refer to
www.Spillemyndigheden.dk, where under the item: ‘Technical requirements and service descriptions’ you may find further information.
8.2.2 Link-up to SAFE and ROFUS
You must carry through a number of tests of these systems. The link-up process consists of two stages:
Testing of access to your SAFE
The Gambling Authority must be able to access your SAFE to retrieve data. You must disclose a user name, password and end point to your SAFE. This information must be given to the Gambling Authori-ty in the application form (Appendix B).
Approval of standard records
1. A number of specifically defined standard records. All records must be packed with Tamper Token and be placed in your SAFE.
2. A description of your understanding of each data element included in the standard records. The applicant must describe its understanding of the field, including any choices made in connection with the implementation.
The material must be sent to the Gambling Authority along with Appendix B or no later than within 14 days from the date the application was submitted.
The document ’Testing of standard records’, which describes the requirements is accessible at www. Spillemyndigheden.dk.
Tamper Token and ROFUS
You must demonstrate correct use of Tamper Token and show that it is possible to communicate with the ROFUS register.
If you wish to gain access to Tamper Token and ROFUS, you should contact the Gambling Authority at the address: [email protected]. Please report your applicant name, contact person and the con-tact person’s e-mail address.
The Gambling Authority will then send a form with a user name and password and the tests to be run and the test civil reg. numbers (CPR numbers) you must use to run the test.
Concluding assessment
When you have completed the required testing, you should send the completed test sheets and the asso-ciated documentation to the Gambling Authority, whereupon an overall assessment of the process will be conducted and you will be informed of the result.
For a more detailed description of the link-up process please refer to the guidelines: ’Description of the connection process’, which is available in Danish under the item ’Technical requirements and service descriptions’ in the Gambling Authority’s website.
8.2.3 Requirements for your gambling system
What does the concept of gambling system comprise?
The Gambling Authority defines the gambling system as electronic or other equipment used by or on behalf of licence holders, including equipment which
is used to store information concerning a person's participation in gambling, including historical data, as well as outcome data,
Determines the outcome of a game or calculates whether the player has won or lost in the game. The illustration below shows the components (normally) used to operate gambling online and which of these components are considered to be part of the gambling system. Payment transmission services and the SAFE are not part of the gambling system.
Description of the various components:
Front End is the word meaning the part of a system with which the customer interacts, which is the
gambling site, including the server on/from which the site is operated; and client software installed on the customer’s computer and/or mobile telephone (Falls under item 1.)
Back Office is a broad expression meaning the part of a system in which customer specific data are stored. At a minimum this will be the customer’s identity details and financial data, and in some cases gambling data will also be stored there (Falls under item 2.)
Data Warehouse is the word for the part of a system in which system generated data are structured and stored. In the illustration above it will essentially be gambling data, but in certain cases also fi-nancial data may be stored there (Falls under item 2.)
Payments Transfer
SAFE Game
Operati-on
Back Office Data
Ware-house Front End
Gambling System
Game Operation is the Gambling Authority’s expression for that part of the system which deter-mines the outcome of a game or calculates whether the player has won or lost in a game. The Ran-dom Number Generator with its support processes and the system for carrying through betting and the like are located here (Falls under item 3.)
Certification of the gambling system, etc.
The Gambling Authority sets the requirement that yourgambling systems, business procedures and business systems must be certified by an accredited testing agency before the gambling system is used to offer games to players.
The requirements in respect of certification are described in three documents:
Technical Standards of the Danish Gambling Authority
The Gambling Authority’s programme for managing system changes
The Gambling Authority’s requirements for accredited testing agencies.
The certifications are divided into five different categories. To obtain status as an approved testing agency qualified to certify the particular categories, the testing agency must satisfy the requirements specified in the document the Gambling Authority’s requirements for accredited testing agencies.
The categories are:
Certification category Requirements Description
A Gambling system Technical Standards
of the Danish Gam-bling Authority
Random Number Generator (RNG), game rules, registration, reporting on operations, custom-er ovcustom-erview, tcustom-erms and condi-tions, etc.
B Business system Technical Standards
of the Danish Gam-bling Authority
Information security, etc. (audit)
C Preventive measures to counter money launder-ing of proceeds and fi-nancing of terrorism
Technical Standards of the Danish Gam-bling Authority
Registration, security, suspicious player behaviour
D Vulnerability and pene-tration testing
Technical Standards of the Danish Gam-bling Authority
Information security (testing)
changes thority’s Programme for Managing System Changes
to gambling systems
The documents ’Technical Standards of the Danish Gambling Authority’ and ’The Gambling Authori-ty’s Programme for Managing System Changes’ indicate the requirements which the testing agencies have to certify. Certain requirements may be certified by several different certification categories. For example, certain parts of the customer identification process may be certified by both category A, B and C.
Postponement of the requirement for certifications
If the certifications (A-E) have not been achieved before the commencement date on 1 January 2012, the licence will be granted with the condition attached that the compliance with the requirements must be ensured as soon as possible and that the Gambling Authority must be informed about the certifica-tion time schedule.
Initially, fixed-term licences for a period of one year will be issued. One reason for this approach is that it may be time-consuming to get a gambling system etc. certified to international and Danish standards. It will be possible for the licence holder as from the commencement date on 1 January 2012 to get a period of up to one year to obtain complete certification of its gambling system.
This means that gambling services may be provided in the intervening period on the strength of the be-lief that the licence holder with get the certifications into place. There must be ongoing dialogue with the Gambling Authority in the intervening period.
If the necessary certifications have not been obtained before Appendix B is submitted, the fields in the form concerned with certification should not be filled in. If a time schedule for the certifications has been drawn up it should be enclosed.
About the Gambling Authority’s programme for managing system changes in particular
Irrespective of whether the certification requirement has been postponed, the licence holder must com-ply with the Gambling Authority’s programme for managing system changes. System changes must be logged, as indicated in the programme, and the Gambling Authority must be informed of all changes to the RNG, and any implementation of brand new games must be approved by the Gambling Authority before the implementation is carried through. In respect of changes that must be analysed by testing agencies according to the programme, it is optional for the licence holder whether to choose to have the change analysed.
Using accredited testing agencies
requirements imposed on the testing agency you may choose to carry through certifications for you. The testing agency must set up an audit programme based on the Gambling Authority’s certification programme and against this background acquire accreditation to ISO 17025. When a testing agency has been accredited it may, without any approval from the Gambling Authority, carry through certification of gambling systems, etc.
When your gambling system is ready to be certified you should approach the testing agencies you want to use and inquire whether the enterprise is an accredited agency. The licence holder is responsible for proving to the Gambling Authority that the testing agency complies with the requirements defined by the Gambling Authority in its requirements for accredited testing agencies.
The document ‘Technical Standards of the Danish Gambling Authority’ consists of a number of re-quirements listed as points with each requirement having a reference to the certification categories A-E. When an accredited testing agency has certified a given requirement in one certification category and this requirement is part of several certification categories, it will not be necessary to repeat the certifi-cation of the requirement.
Location of the gambling system
The gambling system must as a main rule be located physically in Denmark. The system may be located physically in another country if
You have a licence to operate gambling in that country,
The Gambling Authority has made an agreement with the authority that supervises your
gam-bling operations in that country and
The Gambling authority approves the location in the country in question.
In special cases the Gambling Authority may approve location of part of the gambling system in a country with which the Gambling Authority has not made any cooperation agreement, provided that it will be possible for the Gambling Authority to supervise it in an appropriate manner.
8.2.4 Registration of customers (players)
It is a fundamental requirement that you must have knowledge about your customers. You must be convinced that the customer is in fact the person he says he is. There can be no circumstances which cause doubts as to whether the customer is in fact who he says he is.
The extent of the identification procedure must be determined on the basis of an individual risk assess-ment. However, the risk assessment must never result in no identification measure being taken. Below is a description of the guidelines in the area, but the licence holder is obliged to introduce stricter
pro-cedures where it is assessed that there is a greater risk. For each customer relationship, you must be able to prove to the Gambling Authority that the extent of the checks was sufficient.
In order to be allowed to participate in gambling, the player must be registered as your customer. Only natural persons may be registered as players, and this means that companies, clubs, etc., are not al-lowed to have gambling accounts. Moreover, you are required to make the registration conditional up-on the customer up-only acting up-on his own behalf.
Registration of the customer
In connection with the registration, the customer must provide the following information:
Name
Address
Civil reg. no. (CPR)
If the customer does not have a CPR number, you must obtain other similar identification information. This may be a personal registration number applied by the public authorities of the person's home country or, if this is not used in the country in question, information about date and place of birth. Customers without CPR numbers include tourists staying in Denmark.
You are required to confirm all information by means of sufficient documentation.
Customers without CPR numbers only include customers who actually do not have a CPR number. If the customer does not wish to state his CPR number or similar information, he cannot be registered as a player.
Specific requirements about addresses
The address stated must be the customer's permanent address (habitual residence). A post-office box address does not satisfy the requirement. If the customer is homeless, it may be acceptable to establish a customer relationship even though address information has not been provided. Instead, the customer may obtain documentation from the local authority confirming that he is homeless.
If the customer resides outside Denmark, please refer to section 8.2.5.
Proof of the customer's identity
The information provided by the customer must be checked. The name, address and CPR number of the player must be verified by means of a reliable and independent source, such as the CPR Register. All three pieces of information must be checked. Thus it is not sufficient only to check the CPR number and name, but all three pieces of information do not have to be verified through the same source.
For customers without CPR numbers, you are also required to perform a check of the name, address and the identification similar to the CPR number. When carrying out the check, you must be aware that passports and driving licences do not contain information about the holder's home address. Therefore, it will not be sufficient to submit a copy of these documents.
Supplementary documentation must be provided as well.
This documentation may be provided in the form of an information check by using NemID as it is a requirement that customers use a digital signature with a security level corresponding to the OCES standard when logging in to their gambling account. Prior to first login, the data should be compared with the information which has been provided by the customer and verified. Access to the gambling account must only be granted if the data agree.
The digital signature requirement does not apply to customers without a CPR number either. In connec-tion with the registraconnec-tion of such customers, the identity must be checked further.
Based on a risk assessment, further information must also be obtained for customers with a CPR num-ber if there may be doubt about the customer's identity. This may also be the case in the event of a po-litically exposed person, see the section about popo-litically exposed persons below.
Further information for confirmation of the customer's identity may include:
Submitting picture identification.
Requiring that the first deposit be made by means of a transfer of funds from the customer’s ac-count with a bank where the customer has provided proof of identity.
Contacting the customer by telephone after having checked the telephone number by looking it up in a reliable place.
Sending a contract or a similar document to the customer, requesting him to sign it and return it. Picture identification must originate from a reliable and independent source and will thus typically be issued by public authorities. The information contained in the picture identification must be current. You must not set up a gambling account if you discover that the customer has provided incorrect formation. You may adjust individual pieces of information if you assess that the customer did not in-tend to provide incorrect information, for example if the customer did not state whether he lives to the right or to the left in a multi-storey building.
Information about the customer's intended gambling volume
You are required to obtain information about the customer's intended gambling volume at the same time as the customer provides the identification information (name, address and CPR number). The in-formation must be obtained from the customer. Therefore, you are not permitted to assess the expected
gambling volume yourselves based on the customer's profile. However, you may provide the customer with predefined categories to choose from.
8.2.5 Politically exposed persons residing in another country
This section only applies to online casino licences.
For customers who fall within the definition of ‘politically exposed persons’ and who reside in another country, special rules apply, including:
Requirements for special procedures.
Enhanced identification requirements.
Requirement for information on assets and sources of income.
Requirement for enhanced monitoring.
The reason for this is that the international community (the FATF, the EU) requires particular attention to be paid to politically exposed persons (PEPs) because of an increased risk of money laundering re-lated to corruption, etc.
What is a politically exposed person?
The concept of politically exposed persons is defined in accordance with the Money Laundering Act and its associated executive orders. Therefore, the text of these guidelines is in accordance with the Danish Financial Supervisory Authority's guidelines on the Act on Measures to Prevent Money Laun-dering and Financing of Terrorism.
Politically exposed persons are defined as
Persons who are or have been entrusted with a prominent public function and immediate family
members, or persons known to be close associates, of such persons. The Danish Financial Supervisory Authority has defined the following concepts:
Politically exposed persons, who are or have been entrusted with a prominent public function, include the following:
Heads of state, heads of government, ministers and deputy ministers or assistant ministers.
Members of parliaments.
Members of supreme courts, of constitutional courts or of other high-level judicial bodies whose decisions are not subject to further appeal, except in exceptional circumstances.
Members of courts of auditors or of the boards of central banks.
Members of the administrative, management or supervisory bodies of state-owned enterprises. If the person mentioned has ceased to be entrusted with a prominent public function for a period of at least one year, that person is no longer to be considered as a politically exposed person. The persons mentioned do not include middle ranking or more junior officials.
Immediate family members include the following:
Spouses.
Registered partners.
Children of the politically exposed persons.
Parents of the politically exposed persons.
Persons known to be close associates include the following:
Persons who have joint beneficial ownership of legal entities or legal arrangements, or have any other close business relations, with one of the primary persons referred to under the first list of bullets above.
Persons who have sole beneficial ownership of a legal entity or legal arrangement which is set up for the benefit of one of the primary persons referred to under the first list of bullets above.
Special procedure requirements
If the customer resides outside Denmark, you must ask the customer to state the following:
Current occupation.
Whether the customer is or has been entrusted with a prominent public function or whether the customer is related to or has close cooperation with a person who is or has been entrusted with a prominent public function.
Then you must:
1) have adequate procedures to determine whether the customer is a politically exposed person who is a resident of another country; and
2) have senior daily management approval for establishing business relationships with such cus-tomers. Daily management means the enterprise's management or the manager of the organisa-tional part of the enterprise, such as a division or a branch.
However, this does not apply if other information is available which documents that the customer is not a politically exposed person.
Your information about the customer may also help determine whether further investigations need to be instituted to find out if the customer is a politically exposed person.
It may also be relevant for you to make a routine internet search for the customer's name via a search engine.
If you have many customers who are resident outside Denmark, it may be relevant to subscribe to ser-vices from international information providers specialising in making and updating lists of politically exposed persons. Based on a risk assessment, you will have to decide whether this is sufficient. The number of customers who are resident outside Denmark and the nature of the countries where the customers live may increase the probability that you have politically exposed persons among your cus-tomers who are not on the lists of these private providers. Based on a risk assessment, this may mean that the enterprise has to cooperate with locals, such as lawyers, bank connections, etc., to verify whether the customer is a politically exposed person in the country in question.
Tightened proof of identity requirements
If a politically exposed person who is resident outside Denmark is registered as a customer, there are further tightened proof of identity requirements. Please refer to section 8.2.4 for information on proof of the customer's identity.
Requirements for information about sources of income and funds
You must take reasonable measures to gather information about politically exposed persons’ sources of income and funds involved in the gambling activity. This entails that the customer must be requested to provide the required information. This information must then be assessed on the basis of the circum-stances, including the customer's transactions.
Duty to pay special attention
You must continuously monitor the business relationship with a politically exposed person. Specific, enhanced monitoring of the business relationship must be established.
8.2.6 The players' gambling accounts
When you have obtained information about the customer's identity and confirmed the information by means of sufficient documentation, you need to set up a gambling account for the customer. One player may have several gambling accounts, but customer identification must be carried out every time a gambling account is set up.
A gambling account must provide the player with information about
Account balance
Gambling history (including stakes, winnings and losses)
Related transactions.
Gambling history involves providing the player with access to view all stakes, winnings and losses re-sulting from a session of play including, as a minimum, an indication of the minute the action took place.
The information must be available to the player in the gambling account for at least 90 days. The player must also have access to receiving the information upon request for a minimum of twelve months. It must only be possible for the player to gain access to the gambling account using a digital signature. This must, as a minimum, have a security level corresponding to the OCES standard. NemID meets this requirement. Upon each login, it must be verified that the digital signature applied corresponds to your information about the player.
Currently, there is no digital signature which can be used for mobile telephones and tablets, etc. There-fore, it is the intention of the Gambling Authority to grant an exemption until a technical solution for these media becomes available.
It is a requirement for the exemption that the player activates his use of these media by logging in to a gambling account via the Internet. Upon login to the gambling account, the usual player identification requirements, including the digital signature requirement, apply.
The digital signature requirement does not apply to customers without a CPR number either. For such customers, adequate identification of the player must be carried out upon login in some other manner, for example through the use of secure passwords.
Temporary gambling account
Until the customer's identity has been confirmed correctly as referred to in section 8.2.4 (proof of the customer's identity), you are only permitted to set up a temporary gambling account. The temporary gambling account must be shut down if the customer has not been correctly identified with documenta-tion within one month.
You are not permitted to set up a temporary gambling account for players who are listed in ROFUS. The customer may deposit a maximum amount of DKK 10,000 into a temporary gambling account, and no withdrawals may be made from the gambling account. This means that any winnings won must not be withdrawn before the gambling account has gained status as a normal gambling account. However, the amounts must be credited to the gambling account immediately after they are won.
