White Paper Implementation of Online Gaming Standards in Europe 2012-06-19

White Paper Implementation of Online Gaming Standards in Europe 2012-06-19

1. Summary... 4 2. Introduction... 4 3. Organized crime on the internet - A brief overview... 5 3.1 How the Internet is used for criminal activities... 5 3.2 Organized crime in the field of online gaming... 6 4. General principles for providing a secure framework for online gaming... 7 4.1 Ensure limited free trade... 9 4.2 Consider the possible impact on society... 9 4.3 Ensure similar standards for all types of gaming, online or offline... 9 4.4 Subsidiarity in planning policy... 9 4.5 Precautionary planning...10 4.6 Ensure viability and fairness...10 4.6.1 Fair Taxation Levels...10 4.7 Ensure the integrity of the gaming industry with regard to risks from criminal activity...10 5. Specific regulatory proposals for online gaming Licenses...11 5.1 General criteria for the acquisition and retention of national online gaming licenses from Member States within the European Economic Area (EEA)...11 5.2 Enforcement measures aimed at the prevention of illegal activities...11 5.2.1 Control of deposits and withdrawals...11 5.2.2 Prescription of the use of secure electronic payment solutions...11 5.2.3 Internet Service Provider (ISP) blocking...12 5.2.4 Domain Name System (DNS) blocking...12 5.2.5 Advertising to channel consumers towards legal operations...12 5.2.6 Establishment of national special task forces...12 5.2.7 Consideration of technologies used for proposing licensed online gaming..12 Page 2 of 13

5.3 Content of licenses...13 5.3.1 Establish a binding gaming policy to enforce the following requirements...13 5.3.2 Ensure transparent content in the license policy...13 5.3.3 Define a validity period for the license...13 5.3.4 Demand accounting standards to secure customer deposits...13 5.3.5 Ask for independent certificates and audits...13 5.4 Player participation...13 Page 3 of 13

1. SUMMARY The European Casino Association (ECA) is commited to cooperate towards a safer and more responsible online gaming sector, particularly in the view of the current fast-paced changes on the Internet and the expansion of online commercial services. By following the recommendations summarized in this document, online gaming - at least in Europe - can be established on a safe and responsible basis. Drawing on its many years of experience in the gaming sector, the ECA can help ensure that the Internet may be used as a platform for legal online gaming operating in the interests of all legitimate stakeholders. The most important prerequisites are the creation of restrictions on free trade in the online gaming environment and the definition of mandatory standards. It must be ensured that the relevant legal and consumer protection standards can be enforced on the Internet. The ability to audit licensed online gaming operators must be assured and non-licensed providers must not be allowed to offer their products in Europe without legal consequences. Responsible gaming standards and consumer protection rights must be enforced. Misuse of the online gaming sector for criminal activities such as fraud and money laundering must be prevented. The ECA can act as a strong partner in working towards achieving these goals. 2. INTRODUCTION The ECA represents national associations and individual operators of casinos in Europe. We represent the interests of around 800 licensed casinos and over 60 000 employees in 22 countries across Europe. Founded in the early 1990s, the ECA has grown steadily over the years and today includes members from nearly all EU Member States, as well as from Switzerland and Serbia. Members of the ECA have expertise in the casino industry gained from decades of experience. Based on principles of integrity and professional business management, the casino industry in Europe has moved forward in a gradual and responsible manner to adjust to economic, regulatory and technological changes in society. Particularly in recent years, the landscape in which casinos operate has changed dramatically as have the casino business models in Europe. One relatively recent phenomenon in this respect is the emergence of online casinos. This type of gaming offer was first the business of certain niche operators. However, its growing success has turned online casino gaming into a business with an aggregate European turnover of billions of Euros. Online casino gaming has caused a big impact on the casino industry in this respect. The ECA is not trying to fight to the developments in online gaming. Online casinos should not be seen as a separate industry but more as a different means of distribution of the classic casino industry. The Internet opens a window of opportunities but at the same time the ECA also sees the need for all bonafide stakeholders (ECA members, regulators, authorities, consumers, etc.) to remain vigilant. With the possibilities offered by the Internet, also come certain possibilities for criminals and frauds. Illegal activity connected with online casinos can be to the detriment of consumers, authorities and those operators that abide by the rules and aim to offer gaming services Page 4 of 13

in a safe and controlled environment. It is therefore in everyone s best interest to define certain common standards for online gaming, which can help minimize the risk of money laundering or other types of fraud and can maximize consumer protection in the broad sense. The online casino environment should be made at least as secure as the classic landbased casinos. Due to the specificities of the Internet, online gaming is very interesting for criminals and frauds and therefore correct security measures should be applied. A downright prohibition of online casinos is pointless, as this would lead more consumers into the hands of uncontrolled and illegal operators. All stakeholders should strive together to create a safe online casino environment where players are protected and where national authorities can levy taxes as is done with land-based gaming. At the same time, authorities should impose strict enforcement measures on those that refuse to abide by the rules and choose to step outside of the legal framework. Due to its widespread representation and expertise, the ECA can offer a series of regulatory suggestions and best practices to ensure optimal operation and crime prevention by means of thoughtful policy governing the online gaming sector. 3. ORGANIZED CRIME ON THE INTERNET - A BRIEF OVERVIEW 3.1 How the Internet is used for criminal activities The Internet is increasingly threatened by expanding organized crime. This is primarily the result of increased commercial activity online. It has simply been advantageous for many businesses to have moved onto the Internet. The Business-to-Customer (B2C) business model in particular is enormously successful while there has also been a dramatic increase in Business-to-Business (B2B) activities. Naturally, where there are large amounts of money to be made, sooner or later organized crime will follow. Based on a Europol press release 1, statistics currently show a total of 750 billion EUR in damages caused by cybercrime every year 2. This is more than the costs incurred by the international marijuana, cocaine and heroin black markets combined and almost matches the value of the entire illegal drug trade. In many ways, the European Union (EU) is a victim of its own success. Because of its advanced Internet infrastructure, high number of Internet users and widespread use of electronic banking, it is one of the most infected areas in the world when it comes to computer viruses and malware. There are several ways in which criminals attack commercial systems on the Internet: Computer-viruses (computer programs that harm computer software or data and reproduce themselves spreading from one computer to another) Denial-of-service attacks (attempt to make a computer or network resource unavailable to its proper user) Malware (software that is designed to disrupt or deny operation, gather information that leads to exploitation or the loss of privacy, or to gain unauthorized access) Organized crime uses the above technologies to achieve the following goals: Cyber stalking (the use of the Internet to stalk or harass an individual, a group of individuals, or an organization) 1 https://www.europol.europa.eu/content/press/cybercrime-business-digitalunderground-economy-517 2 http://www.mcafee.com/us/resources/reports/rp-underground-economies.pdf Page 5 of 13

Fraud (intentional deception aimed at personal gain or to damage another individual) Identity theft (obtaining and using another person's identity, typically in order to access resources or obtain credit and other benefits in that person's name ) Information warfare (the use and management of the Internet to gain a competitive advantage over an opponent) Phishing scams (a way of attempting to acquire information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity) 3.2 Organized crime in the field of online gaming For the purpose of informing our current discussion about online gaming regulation, it is beneficial to draw on the experience of the land-based gaming industry. Thanks to the development of strong regulation and stringent control, countries have managed to keep criminality and poor consumer protection out of licensed land-based casinos. Similar regulations to those that have been applied to licensed land-based gaming operations must now be applied to the online gaming world. There is a need for a fair and realistic playing field for the brick and mortar as well as for online operations in order to ensure a sustainable and healthy gaming environment. The focus of organized criminal activities in the area of online gaming is predominantly on poker and online betting platforms. However, typical online casinos are also affected by criminal activities. In recent years, there have been several incidents involving online gaming sites. The following examples highlight this phenomenon: There are programs that install so called backdoor Trojans without the knowledge of those affected. These programs store the name and password of game players with the intention of committing data theft 3. Individual gamblers were infected with unique (single copy) viruses, which are activated only during high stakes scenarios. Upon activation, these viruses take screenshots of the victim s cards, and transmit them to the perpetrators. High rollers without any antivirus or other protection software on their computers have been cheated in this way. The operators risk is the biggest risk for money laundering. Criminal operators could very easily add proceeds from crime to the results of their online gaming operation. As the taxation on the revenues from low-regulated or illegal operations is very low, money can be laundered by this method with only little loss. Besides this, there are many other money laundering risks for such operations, as well from the operators, as from the customers side. Illegal Poker sites on the Internet are particularly vulnerable to money laundering. The criminal uses a stolen identity and (slowly and quietly) loses money to the owners of real and legitimate user accounts. The winners, who are accomplices of the losers, can easily declare these amounts as profit. Money launderers on the Internet only expect low "returns on investments". The "trick" is to permanently wash small amounts of money and act as inconspicuously as possible. Studies 4 confirm our position that clearly defined frameworks for online casinos should be implemented. 3 RBCalc,exe, Backdoor.TDSS, OnLineGames.xevz, Sub7 are examples of Trojan viruses targeting Online Gaming 4 The study Online crime and Internet gaming http://www.cbc.ca/news/pdf/onlinegaming-crimestudy.pdf contains many references Page 6 of 13

4. GENERAL PRINCIPLES FOR PROVIDING A SECURE FRAMEWORK FOR ONLINE GAMING Before suggesting a number of proposals that may help to ensure that online gaming operations evolve in a safe, legal, and consumer-friendly environment, it is important to take into consideration key judgments of the Court of Justice of the European Union (CJEU). They confirm the view of the ECA that the unique nature of online gaming 5 requires special framework conditions: In the Liga Portuguesa case 6 the CJEU upheld the right of EU Member States to maintain restrictions on the provision of online gaming service within their territory in order to safeguard responsible gaming and combat fraud and crime. The Court found the fact that a private operator lawfully offers services via the Internet in another Member State in which it is established, cannot be regarded as amounting to a sufficient assurance that national consumers will be protected against the risks of fraud and crime in the country of destination. The Court also raised the issue of the special status of Internet gaming in Liga Portuguesa, noting that Internet gaming poses different and important risks. The Court noted that, given the characteristics that are associated with the provision of gaming via the Internet, online games involve different and more substantial risks of fraud by operators against consumers compared with the traditional markets for such games. 7 In light of the above, the CJEU confirmed the legitimacy of specific national restrictions for online gaming. In the Carmen Media case, the Court added that the characteristics specific to the offer of games of chance by the Internet may prove to be a source of risks of a different kind and a greater order in the area of consumer protection, particularly in relation to young persons and those with a propensity for gaming or likely to develop such a propensity, in comparison with traditional markets for such games. The Court furthermore referred to the lack of direct contact between consumer and operator, the particular ease and the permanence of access to games offered over the Internet and the potentially high volume and frequency of such an international offer. It also mentioned the isolation of the player, his anonymity and an absence of social control as factors which can lead to Internet gaming addiction. The CJEU furthermore concluded that a prohibition measure covering any offer of games of chance via the Internet may be justified to protect 5 With Internet gaming, the addiction risks are much higher due to various factors: 24 hour/7 availability; playing on the Internet is anonymous; Internet gaming is easy to access if you have a computer and Internet connection; Internet gaming is accessibile even for less educated people and more vulnerable people. With Internet gaming, consumer protection is more difficult : Because of the lack of direct contact between consumer and operator, games of chance accessible via the Internet involve different and more substantial risks of fraud by operators against consumers compared with the traditional markets for such games. The initial direct contact between consumers and operators is crucial not only to verify the identity of the players, but also to know the players and capture their behavioural attitudes in view of protecting them when necessary. 6 CJEU jugdment of 8 September 2009, C-42/07, Liga Portuguesa de Futebol Profissional, ECR 2009, I-07633. 7 CJEU jugdment of 8 September 2009, C-42/07, Liga Portuguesa de Futebol Profissional, ECR 2009, I-07633, paragraph 70. Page 7 of 13

consumers, even though the offer of such games remains authorised through more traditional channels. 8 In the Dickinger case 9, the Court confirmed again that one Member State is not required to rely on the controls of another Member State with respect to the gaming sector. In this same case, the CJEU also recognized the positive steering effect of advertising toward lawful gaming sites 10. It confirmed that the limitation of the national online gaming market, in view of the peculiarities associated with online gaming, may be justified. A controlled expansion policy of exclusive operators is not inconsistent with the objective of fighting crime and fraud and with that of combating addiction to gaming if it aims to oust illegal gaming offers and to direct consumers towards those trustworthy and controlled legal operators. The Court has furthermore found that Member States are free as to how their online gaming restrictions should be enforced. 11 Enforcement is an indispensible element of any restrictive gaming policy. Even an online operator who does not pursue an active sales policy in the Member State concerned, particularly because he is not making use of advertising in that State, can be imposed enforcement measures, simply because his games are accessible to the public of that State. 12 Moreover, enforcement measures can legally comprise criminal (or other) sanctions. 13 Aside from the specificities of online gaming, it should be born in mind that gaming as such is an activity of a very sensitive and special nature, and should therefore not be treated as a normal internal market service. a. The European Courts have over and over again recognized the very specific nature of gaming services and the need to protect European consumers by channelling the demand towards responsible and highly regulated operators 14. 8 CJEU jugdment of 8 September 2010, C-46/08, Carmen Media, ECR 2010, not yet published, paragraphs 103-105. 9 CJEU judgment of 15 September 2011, C-347/09, Dickinger and Ömer, ECR 2011, not yet published. 10 See also CJEU judgment of 6 March 2007, C-338/04, C-359/04 and C-360/04, Placanica and others, ECR 2007, I-01891, paragraph 55; and CJEU jugdment of 8 September 2010, C-316/07, C-358/07, C-359/07, C-360/07, C-409/07 and C-410/07, Markus Stoss and others, ECR 2010, not yet published, paragraph 101. 11 CJEU jugdment of 3 June 2010, C-258/08, Ladbrokes, ECR 2010, I-04757, paragraphs 43-44; CJEU jugdment of 8 September 2010, C-316/07, C-358/07, C-359/07, C-360/07, C-409/07 and C-410/07, Markus Stoss and others, ECR 2010, not yet published, paragraph 86. 12 CJEU jugdment of 3 June 2010, C-258/08, Ladbrokes, ECR 2010, I-04757, paragraph 56. 13 CJEU jugdment of 8 July 2010, C-447/08 and C-448/08, Sjöberg and Gerdin, ECR 2010, I-06921. 14 See e.g. CJEU jugdment of 21 September 1999, C-124/97, Läärä, ECR 1999, I-06067, paragraph 37; CJEU judgment of 21 October 1999, C-67/98, Zenatti, ECR 1999, I-07289, paragraph 35; and CJEU jugdment of 8 September 2009, C-42/07, Liga Portuguesa de Futebol Profissional, ECR 2009, I-07633, paragraph 67. Page 8 of 13

b. It is in the interest of health and social benefits that gaming services are dealt with in a very specific and careful way, rather than considering them as normal free market products. i. As explained above, these types of services have always attracted criminals because of the high profits linked to compulsive users. ii. Responsible and serious gaming operators have the primary responsibility to protect their consumers through the controlled expansion of gaming, including the advertising of gaming services. iii. Gaming operators should strive to fulfill the natural gaming demand of society, rather than enticing people to gamble. iv. Gaming must be treated in a different way than normal free market products so as to ensure consumption in safe dimensions and avoid what could be detrimental to society. c. Moreover, casinos are embedded in the social, economic and cultural environments specific to each Member State. The gaming cultures and historical backgrounds are considerably different. It is therefore crucial that these differences are respected. For example, in some Member States, casinos are intrinsically linked to entertainment activities and the tourism sector of the country (e.g. France and Greece), in other Member States, casinos are welcomed in cities (e.g. UK). d. It is crucial that regulators have a clear picture of the market within their jurisdictions to enable efficient control of the activities. Regulators already know and trust the long-existing land-based operators in their jurisdictions. They are aware of the number of operators, the scope, the supply of services, the operators assets, and the revenue streams in their jurisdictions. In light of the above, the ECA would suggest the following proposals that may help to ensure that online gaming operations evolve in a safe, legal, and consumer-friendly environment. Further, they may prevent online casinos from being used for criminal activities. 4.1 Ensure limited free trade Online gaming must not be treated as a product or service of free trade. 4.2 Consider the possible impact on society Gaming is a sensitive activity which can have a negative impact on society if not properly regulated. 4.3 Ensure similar standards for all types of gaming, online or offline Similar standards, regulations and protection measures as for land-based casinos should also be applied to online gaming services. 4.4 Subsidiarity in planning policy The individual Member States are best able to define the appropriate regulatory requirements that are adapted to their culture, history and traditions. Page 9 of 13

4.5 Precautionary planning The objectives of regulation are best achieved by taking a gradual approach, which is based on relevant knowledge and tested by independent and neutral data. 4.6 Ensure viability and fairness Whatever solutions are adopted, they must be sustainable and ensure a level playing field for all kinds of legal gaming operations. 4.6.1 Fair Taxation Levels In order for solutions to be viable long-term, and for the gaming market to remain competitive, it is important that comparable and competitively neutral taxation levels be applied to land-based and online activities. Online operations are, after all, another distribution channel of gaming activities. In nearly all European countries, the level of taxation on land-based casinos is extremely high. This is a very important asset for national governments that would want to integrate the gaming revenues generated through the Internet into their tax framework. Taxation systems enable regulators or national authorities to have a clear picture of gaming operations. Through regulation, they can control and trace the number of operators, the scope and supply of services, operators assets, and revenue streams in each jurisdiction. Furthermore, because online gaming is considered more dangerous than land-based gaming in terms of addiction risks, taxation can also play a role in consumer protection. As explained above, due to the lack of direct contact between the customer and the provider, the risk that customers will be deceived by the provider is greater when gaming on the Internet.This was confirmed in the judgment of the CJEU in Liga Portuguesa 15. An important point for customer protection is to propose provider transparency, along with protected and regulated markets both online and offline. 4.7 Ensure the integrity of the gaming industry with regard to risks from criminal activity The gaming industry, both online and offline, should fall under the guidelines of the EU Anti-Money Laundering (AML) Directive. The ECA supports a broader scope of the AML Directive, but with the precise scope to be determined on a risk-based approach. Clear rules are an important basis for the prevention of criminal activities. Ensure that the ownership - operators risk is prevented: A big risk for AML lies within the ownership with operators who would be tempted to add black money to the results of their online gaming operation, in order to launder criminal money. 15 CJEU jugdment of 8 September 2009, C-42/07, Liga Portuguesa de Futebol Profissional, ECR 2009, I-07633, paragraph 70; and see also CJEU jugdment of 8 September 2010, C- 46/08, Carmen Media, ECR 2010, not yet published, paragraph 102. Page 10 of 13

5. SPECIFIC REGULATORY PROPOSALS FOR ONLINE GAMING LICENSES There are a number of organizational and technical options to prevent criminal activities. These must comply with data protection and other legal requirements for every country in which an operator has received a license to offer his services. 5.1 General criteria for the acquisition and retention of national online gaming licenses from Member States within the European Economic Area (EEA) Licenses should only be given to EEA-based operators. A license should only be valid for the issuing country. Liquidity 16 should be taken into account within each country s legal framework. The probity and integrity of the license owners, shareholders, decision makers, third party suppliers, senior management and all employees should be proven. Regular screening of the license holders, the ultimate beneficial owners, the operator s shareholders, the board and senior management should be mandatory. It should be standard practice for operators to obtain a certificate of good conduct for all employees. Persons with a criminal background or who have committed tax offences should not be able to obtain a license. 5.2 Enforcement measures aimed at the prevention of illegal activities: Avoiding unlicensed online gambling is crucial for protecting consumers and legal operators. Therefore, with the support of EU policies, Member States, based on the subsidiarity principle, should put enforcement measures in place to protect consumers and legal operators such as: 5.2.1 Control of deposits and withdrawals The control of deposits and withdrawals can prevent gaming systems from being used for money laundering. 5.2.2 Prescription of the use of secure electronic payment solutions Preventing the use of anonymous electronic cash payments represents an important means of preventing money laundering. 16 Liquidity refers to having sufficient traffic, i.e. players, games and money, at any requested time. Page 11 of 13

5.2.2.1 Prepaid credit cards: only secure and safe payment methods, where identification of customers can be verified, in accordance with the EU anti-money laundering regulations, should be applied. 5.2.2.2 Block all risky online cash-payment services: forbidding any kind of financial transaction from risky online cash-payment services without proper customer registration ensures that all money paid comes from legal sources. 5.2.2.3 Allow only direct and traceable transactions via bank accounts: this is a good way to help combat money laundering and it will reduce the participation in illegal gaming by making workarounds to do so not worth the effort. There should only be one bank account allowed per player. 5.2.2.4 Control money transfers: authorities should ask for reports of financial transactions and track down unlawful financial institutions that accept transfers to or from illegal gaming operators. This should also make tracking down illegal gaming operators and/or their agents possible. 5.2.2.5 Demand for broad cooperation between financial institutions, responsible ministries, regulators and licensed operators: financial institutions should respect their AML obligations and not engage in business with illegal gaming operations. 5.2.2.6 Evaluate the Italy System : one platform for all gaming operators on the Internet can prevent illegal operators. In Italy, there is only one entry site (one entrance door) for all legal and licensed gaming operations. This may help customers to recognize whether they play on a licensed or illegal gaming site. 5.2.3 Internet Service Provider (ISP) blocking The ECA recommends the use of ISP blocking as an effective means to help keeping illegal content, including illegal gaming, off the Internet. 5.2.4 Domain Name System (DNS) blocking The ECA recommends the use of DNS blocking as an effective means to help keeping illegal content, including illegal gaming, off the Internet. 5.2.5 Advertising to channel consumers towards legal operations Advertising should only be used to channel consumers towards legal online gaming operators. 5.2.6 Establishment of national special task forces A special task force charged with the pursuit of illegal gaming, such as those already in existence to prevent drug crime, could be established at the EU level and in each country. 5.2.7 Consideration of technologies used for proposing licensed online gaming The way that data is stored is constantly changing with the rapid technological evolution. Without considering the way that online operators store their data, we recommend that state authorities should, on demand, receive all necessary data to allow a reliable control of the operator, its customers, financial transactions and all relevant gaming-related data (bets, losses and winnings, outcome of the game etc.). It should be guaranteed that this data is stored such that its alteration, distortion or deletion, by the operator or their representatives, becomes impossible. Page 12 of 13

5.3 Content of licenses Gaming is a very sensitive product and, as such, it differs in many ways from the usual Business-to-Consumer relationship. Specifically, the requirements of responsible gaming, measures to prevent money laundering and crime, differentiate gaming from many other industries. The following guidelines can help meet the major gaming industry requirements, especially in the online gaming sector. These conditions should be regulated by clear obligations for license holders: 5.3.1 Establish a binding gaming policy to enforce the following requirements: Limit and frame the offer and consumption Control its operation in order to prevent excessive or pathological gaming Protect minors Ensure the integrity, trustworthiness and transparency of gaming operations and operators Prevent fraudulent or criminal activities, money laundering and the financing of terrorism Ensure privacy protection for all customer data Ensure the balanced and fair development of the various types of games in order to avoid any economic destabilization Define strict rule for assuring public order, public security, health protection and protection of minors 5.3.2 Ensure transparent content in the license policy The license should clearly describe what games are permitted and what rules are valid 5.3.3 Define a validity period for the license It should be clear how long the license is valid for 5.3.4 Demand accounting standards to secure customer deposits Player funds should be kept on a separate account from the operational funds in order to prevent players from being put at risk as victims of company insolvency 5.3.5 Ask for independent certificates and audits Independent testing and auditing can ensure compliance with industry standards such as ISO/IEC 27001, GoodPriv@cy etc Established management systems allow for companies to retain better control of their risks 5.4 Player participation Unfailing identification of players, in particular for the protection of children and youth Each player should be allowed to hold only one account Prevent players from agreeing to play against another player altogether. Page 13 of 13