GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998 (Northern Territory)

These Regulations set out the operational, control, financial, recordkeeping and people‑management rules that apply to internet gaming conducted under an internet gaming licence in the Northern Territory. They operate as subordinate law under the Gaming Control Act 1993 and operate by defining three core approval and licensing regimes: approval of the computer system used to run games (Part 2, regs 4-5), approval of the control system that governs the business and player interface (Part 3, regs 6-11), and licensing and review of key employees (Part 4, regs 12-34). The Regulations also prescribe financial controls, audit obligations, record retention, player protection measures (including registration, players’ accounts, limits and protections for minors), procedures for aborted or miscarried games and rules for prize payment and dispute resolution (Parts 5-8, regs 35-67). Miscellaneous protections include confidentiality of player identity (r 70) and a monetary fee for an application for an internet gaming licence (r 71).

Mechanically, the Regulations require internet gaming licensees to obtain written approval from the Director for the computer system used to conduct games (r 4) and for the control system that contains the rules displayed to players and the internal controls for game conduct (r 6; regs 8-11). Licensees must operate only under those approved systems and must seek Director approval before changing them (r 5(1)-(2), r 9). The Director may require testing and may recover reasonable evaluation costs from the licensee before evaluating a proposed computer system (r 4(2)-(3)). The Director has a range of supervisory powers: to approve or refuse applications (rr 4, 10), to direct changes to approved control systems (r 11) and to cancel approvals for non‑compliance (r 11(2)).

The Regulations also create a distinct licensing requirement for people occupying or exercising significant influence over licensed operations (so‑called internet gaming key employees). A person must hold an internet gaming key employee licence to perform key duties unless appointed by the Director (r 13). The statutory process for granting a key licence includes prescribed application material (r 14), mandatory investigations into character, criminal history and financial background (r 15), and power for the Director to grant provisional or full licences and to impose terms and conditions (rr 17-20). The Director may review key licensees and take regulatory action including reprimand, counselling, imposition of conditions, suspension up to six months or cancellation (r 34).

NORTHERN TERRITORY OF AUSTRALIA GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998 As in force at 14 April 2020 Table of provisions Part 1 Preliminary 1 Citation ............................................................................................ 1 2 Definitions ........................................................................................ 1 3 Financial institutions ........................................................................ 2 Part 2 Approval of computer systems 4 Approval of computer systems ........................................................ 3 5 Internet games must be conducted under approved computer system ............................................................................................. 3 Part 3 Approval of control systems 6 Control system................................................................................. 4 7 Internet games must be conducted under approved control system ............................................................................................. 5 8 Submission of control system to Director for approval..................... 5 9 Change of approved control system ................................................ 5 10 Consideration of and decisions about submissions ......................... 5 11 Direction to change approved control system .................................. 6 Part 4 Licensing of key employees Division 1 Grant of key employee licence 12 Key duties and functions ................................................................. 7 13 Person performing key duties to hold internet gaming key employee licence ............................................................................. 7 14 Application for licence ...................................................................... 8 15 Investigation of applicant ................................................................. 9 16 Further information, &c., to be supplied ......................................... 10 17 Grant or refusal of licence.............................................................. 11 18 Grant of provisional or full licence.................................................. 13 19 Duration of provisional licence ....................................................... 13 20 Duration of full licence ................................................................... 14 21 Application for further licence ........................................................ 14 22 Person whose licence is cancelled must not apply for another licence for 12 months .................................................................... 15

Gaming Control (Internet Gaming) Regulations 1998 ii Division 2 General 23 Renewal of licence ........................................................................ 16 24 Variation of licence ........................................................................ 16 25 Loss, &c., of licence ....................................................................... 17 26 Surrender of licence ...................................................................... 18 27 When licence to be returned to Director ........................................ 18 28 False statements ........................................................................... 18 Division 3 Review of key licensees 29 When review must occur ............................................................... 19 30 Review may occur at any time ....................................................... 20 31 Notice of review to be given to internet gaming licensee ............... 20 32 Notice of review to be given to internet gaming key licensee ........ 20 33 Review procedure.......................................................................... 21 34 Determination of review ................................................................. 21 Part 5 Financial controls Division 1 Accounts, financial statements and reports 35 Keeping of accounting records ...................................................... 22 36 Preparation of financial statements and accounts ......................... 22 37 Submission of reports .................................................................... 23 Division 2 Financial institution accounts 38 Keeping of accounts ...................................................................... 24 39 Use of accounts ............................................................................. 24 Division 3 Audit 40 Audit of internet gaming licensee's operations .............................. 24 41 Completion of audit........................................................................ 24 42 Further information following audit ................................................. 25 Part 6 Internet gaming records 43 Notices about keeping internet gaming records............................. 25 44 Internet gaming records to be kept at specified place ................... 26 45 Internet Gaming records to be kept for required period ................. 26 Part 7 Player protection Division 1 Registration of players 46 Player registration .......................................................................... 27 47 Procedure for registration .............................................................. 27

Gaming Control (Internet Gaming) Regulations 1998 iii 48 Certain players not to be registered............................................... 27 49 Persons cannot be registered if they have provided false information ..................................................................................... 27 Division 2 Players' accounts 50 Players' accounts........................................................................... 28 51 Acceptance of wagers ................................................................... 29 52 No payments unless player's identity is verified ............................ 29 53 Funds in players' accounts to be remitted on demand................... 29 54 Access to players' accounts by internet gaming licensees ............ 30 55 Inactive players' accounts.............................................................. 30 Division 3 Financial protections 56 Internet gaming licensee not to act as credit provider ................... 30 57 Limitation on amount wagered....................................................... 31 58 Voluntary de-registration as player ................................................ 31 Division 4 Protection of minors 59 Prohibition of minor's participation in conduct of games ................ 32 60 Participation by minors as players prohibited ................................ 32 61 Software limiting minor's access to be made available .................. 34 Part 8 Conclusion of games Division 1 Prizes 62 Payment or collection of prizes ...................................................... 34 63 Claims for prize .............................................................................. 34 64 Entitlement to prize lapses if not claimed within 5 years ................ 35 Division 2 Aborted games 65 Aborted games .............................................................................. 35 66 Miscarriage of game ...................................................................... 36 67 Power to withhold prize in certain cases ........................................ 37 Part 9 Miscellaneous 68 Player to be bound by rules of game ............................................. 37 69 Interference with proper conduct of internet games....................... 38 70 Internet gaming licensee not to publish identity of player in certain cases ................................................................................. 38 71 Fee for application ......................................................................... 38 ENDNOTES

NORTHERN TERRITORY OF AUSTRALIA

As in force at 14 April 2020

GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998 Regulations under the Gaming Control Act 1993 Part 1 Preliminary 1 Citation These Regulations may be cited as the Gaming Control (Internet Gaming) Regulations 1998. 2 Definitions In these Regulations, unless the contrary intention appears: approved computer system means a computer system, approved under regulation 4, for internet gaming and includes a computer system changed in accordance with an approval under regulation 4 or a direction of the Director under regulation 11. approved control system means a control system approved under regulation 10. computer system means a combination of computer hardware and computer software used or intended to be used by an internet gaming licensee for the conduct of, or ancillary to the conduct of, internet games. control system has the meaning it has in regulation 6. financial institution means: (a) an ADI; (b) a friendly society; or (c) an entity prescribed under regulation 3. full internet gaming key employee licence means an internet gaming key employee licence that is not a provisional internet gaming key employee licence.

Part 1 Preliminary Gaming Control (Internet Gaming) Regulations 1998 2 gaming record, in relation to an internet gaming licensee, means a record kept in any form or medium, electronic or otherwise, about the operations conducted by the licensee under his or her licence. internet game means a game conducted by means of the internet but does not include a game conducted by means of the internet in accordance with the Act by an approved association. internet gaming key employee licence means: (a) a provisional internet gaming key employee licence; or (b) a full internet gaming key employee licence. internet gaming key licensee means a person to whom an internet gaming key employee licence is granted. internet gaming licence means a licence granted under Division 5 of Part 4 of the Act. internet gaming licensee means a person to whom an internet gaming licence has been granted or assigned. key duties has the meaning it has under regulation 12. player means a natural person who participates in an internet game. player's account has the meaning it has in regulation 50. provisional internet gaming key employee licence means an internet gaming key employee licence that is granted for a period, specified on the licence, of not more than 12 months. registered player, in relation to an internet gaming licensee, means a person registered with the licensee as a player under regulation 47(1). 3 Financial institutions The Director may, by notice in the Gazette, prescribe an entity to be a financial institution for the purposes of these Regulations.

Part 2 Approval of computer systems Gaming Control (Internet Gaming) Regulations 1998 3 Part 2 Approval of computer systems 4 Approval of computer systems (1) An internet gaming licensee may apply to the Director: (a) for approval of the computer system the licensee proposes to use to conduct internet games; or (b) for approval to change the licensee's approved computer system. (2) The Director must: (a) consider the application; (b) evaluate the system or proposed change as soon as practicable if the Director believes it is necessary to do so to decide the application; and (c) after considering the application and, if necessary, the evaluation of the system or proposed change – approve or refuse to approve the computer system or change. (3) Before evaluating the computer system or proposed change, the Director may require the internet gaming licensee to pay to the Director the reasonable costs of the Director of evaluating the computer system or proposed change. (4) The Director must promptly give the internet gaming licensee written notice of the Director's decision. (5) If the Director decides to refuse to give an approval, the notice under subregulation (4) must state the reasons for the decision. 5 Internet games must be conducted under approved computer system (1) An internet gaming licensee must not conduct an internet game except under the licensee's approved computer system. Maximum penalty: 15 penalty units. (2) An internet gaming licensee must not change, or authorise a change to, the licensee's approved computer system unless the change is approved by the Director in writing under regulation 10 or 11. Maximum penalty: 15 penalty units.

Part 3 Approval of control systems Gaming Control (Internet Gaming) Regulations 1998 4 Part 3 Approval of control systems 6 Control system (1) A control system is a system of controls containing all the rules, terms and conditions and other matters displayed to a player and all internal controls, whether computerised or otherwise, for the proper conduct of internet games. (2) Without limiting subregulation (1), a control system includes: (a) the accounting systems, financial procedures and chart of accounts, the administrative systems and procedures, the computer software and hardware and the standard forms and terms used to conduct internet games; (b) the procedures including, if appropriate, formulas for or with respect to the hold percentages and their calculation and verification to be followed in conducting internet games; (c) the procedures and standards for maintaining the integrity of all data and equipment used in conducting internet games; (d) the procedures for recording and paying prizes won in internet games and maintaining and using players' accounts including the procedures for paying in and out of any account, foreign currency dealings and the recording of all transactions relating to gaming operations; (e) the structure of the organisation to which it relates including: (i) the management structure and description of positions within the management structure and the responsibilities and functions of those positions; (ii) the employee structure and description of positions within the employee structure and the responsibilities and functions of those positions; (iii) the chain of authority that shows the diversity of responsibility among employees engaged in all operations of the internet gaming business including primary and secondary supervisory positions; and (iv) if the organisation uses an agent – the terms and conditions of the agency agreement including to whom the agent is to report or to whom the agent is accountable within the organisation; and

Part 3 Approval of control systems Gaming Control (Internet Gaming) Regulations 1998 5 (f) all measures for securing all data and equipment and the premises where they are to be located or stored (as applicable). 7 Internet games must be conducted under approved control system An internet gaming licensee must not conduct an internet game except under the internet gaming licensee's approved control system. Maximum penalty: 15 penalty units. 8 Submission of control system to Director for approval (1) An internet gaming licensee may make a submission to the Director for approval of the internet gaming licensee's proposed control system. (2) A submission under subregulation (1) must describe and explain the internet gaming licensee's proposed control system. 9 Change of approved control system (1) An internet gaming licensee may change his or her approved control system only: (a) with the approval of the Director under regulation 10; or (b) in accordance with a direction of the Director under regulation 11. (2) An internet gaming licensee may make a submission to the Director for approval to change the internet gaming licensee's approved control system in the way specified in the submission. 10 Consideration of and decisions about submissions (1) The Director must consider a submission received under regulation 8 or 9 and approve or refuse to approve the internet gaming licensee's proposed control system or the proposed change to the licensee's approved control system. (2) In considering the submission, the Director may, by written notice to the internet gaming licensee, require him or her: (a) to give the Director further information about the submission that is necessary and reasonable to help the Director make a decision about the submission; or

Part 3 Approval of control systems Gaming Control (Internet Gaming) Regulations 1998 6 (b) to allow the Director to submit to tests the proposed control system or the approved control system as proposed to be changed. (3) In considering whether to give an approval, the Director must have regard to: (a) whether the submission satisfies the requirements under this Part for the submission; and (b) whether the internet gaming licensee's proposed control system, or approved control system as proposed to be changed, is capable of providing satisfactory and effective control over the conduct of internet games. (4) The Director may refuse to give an approval if the internet gaming licensee fails to comply with a requirement under this regulation. (5) The Director must promptly give the internet gaming licensee written notice of the Director's decision to give an approval or to refuse to give an approval. (6) If the Director decides to refuse to give an approval, the notice is to state the reasons for the decision. (7) If the Director believes a submission can easily be rectified to enable the Director to approve the internet gaming licensee's proposed control system or the proposed change to the licensee's approved control system, a notice under subregulation (6) is to also: (a) explain how the submission may be changed so as to enable the Director to give an approval; and (b) invite the internet gaming licensee to resubmit the submission after making the appropriate changes. 11 Direction to change approved control system (1) The Director may, by written notice to an internet gaming licensee, direct the licensee to change the licensee's approved control system within the time, and in the way, specified in the notice. (2) If the internet gaming licensee's does not comply with the direction, the approval of the internet gaming licensee control system under regulation 10 is cancelled.

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 7 Part 4 Licensing of key employees Division 1 Grant of key employee licence 12 Key duties and functions (1) For the purposes of these Regulations, a person performs key duties in relation to an internet gaming licence if he or she: (a) occupies or acts in a key position, or carries out key functions, in relation to operations carried out under an internet gaming licence or the business of the internet gaming licensee; (b) is in a position to control or exercise significant influence over the operations conducted under an internet gaming licence; (c) occupies or acts in a position designated in the internet gaming licensee's approved control system as a key position; or (d) occupies a position, or carries out a function, that is designated as a key position or a key function by the Director by notice in writing to the licensee under subregulation (2). (2) The Director may, by notice to an internet gaming licensee, designate a position, or a function, related to the conduct of an internet gaming business to be a key position or a key function. 13 Person performing key duties to hold internet gaming key employee licence (1) The holder of an internet gaming licence must not allow a person to perform key duties in relation to the licence unless the person holds an internet gaming key employee licence authorising the person to perform those duties. Maximum penalty: 15 penalty units. (2) A person must not: (a) perform key duties in relation to an internet gaming licence unless he or she holds an internet gaming key employee licence permitting the performance of those duties; or (b) perform key duties in relation to an internet gaming licence except in accordance with his or her internet gaming key employee licence. Maximum penalty: 15 penalty units.

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 8 (3) Subregulations (1) and (2) do not apply to a person performing key duties who is appointed by the Director under section 47P of the Act to perform those duties. 14 Application for licence (1) A person who: (a) intends to perform key duties in relation to an internet gaming licence; and (b) has attained the age of 18 years, may apply to the Director for an internet gaming key employee licence. (2) An application under subregulation (1) is to be in the approved form and accompanied by: (a) a certificate signed by or on behalf of an internet gaming licensee stating that he or she: (i) will engage the applicant, subject to the applicant being granted the internet gaming key employee licence, to perform key duties in relation to the internet gaming licence; and (ii) has carried out his or her own investigations and inquiries into the probity of the applicant and that the applicant is competent to perform the duties for which he or she is to be employed; (b) the documents required by the Director, by notice in writing, to provide information supporting the applicant's eligibility for the grant of the internet gaming key employee licence, verified by a statutory declaration signed by the applicant; (c) an extract of the applicant's birth certificate, passport, refugee certificate or naturalisation certificate; (d) if the applicant's name has changed since birth – a certified copy of the document by which the name change occurred or that otherwise provides evidence of the change; (e) 3 recent passport size photographs of the applicant; (f) a written statement signed by a member of the Police Force verifying that the applicant has had his or her fingerprints and palm prints taken;

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 9 (g) the written consents, authorities and indemnities necessary to enable the Director to obtain: (i) a criminal history report in respect of the applicant; and (ii) information concerning the financial background of the applicant; and (h) an application fee of 285 revenue units. (3) Subject to subregulation (5), if, before an internet gaming key employee licence is granted or refused, there is a change in the information supplied by an applicant in support of his or her application for the licence, the applicant must give written particulars of the change, verified by a statutory declaration signed by the applicant. Maximum penalty: 15 penalty units. (4) The written particulars that are received under subregulation (3) are to be considered to be part of the application. (5) An applicant is not required to provide to the Director written particulars of a change in the information supplied by him or her to the Director in support of his or her application if the Director has notified the applicant in writing that it is not necessary to do so. (6) In determining for the purposes of subregulation (5) whether it is necessary for an applicant to give particulars of a change in respect of the information, the Director is to have regard to: (a) the suitability of the applicant for the grant of the internet gaming key employee licence; and (b) the nature of the information concerned. (7) The Director may waive compliance with any of the requirements of subregulation (2). 15 Investigation of applicant (1) Subject to these Regulations, if a person applies to the Director for an internet gaming key employee licence, the Director must investigate and inquire into the application and assess whether the applicant: (a) has attained the age of 18 years; (b) is of good repute having regard to character, integrity, honesty and responsibility;

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 10 (c) has an adequate command of the English language for the purpose of performing the duties he or she proposes to perform; (d) has a sound and stable financial background; (e) has, subject to the Criminal Records (Spent Convictions) Act 1992, not been found guilty of: (i) an offence involving dishonesty since he or she attained the age of 18 years; (ii) an offence against the Act; or (iii) an offence that is punishable on conviction by a maximum penalty of not less than 5 years imprisonment; and (f) is, by reason of his or her skills, qualifications, knowledge and experience, competent to perform the duties he or she proposes to perform. (3) If the Director is of the opinion that an applicant has not supplied information required to accompany his or her application under regulation 14(2), the Director may request the applicant to provide the information. (4) The Director must not consider an application in relation to which a request for information has been made under subregulation (3) until he or she receives the information. 16 Further information, &c., to be supplied (1) The Director may inquire into matters, additional to those specified in regulation 15, that he or she considers relevant to the determination of the application. (2) The Director must give written notice to the applicant: (a) specifying the other matters the Director is inquiring into and the reasons for so doing; and (b) requesting the applicant to furnish written consents and authorities to enable the Director to inquire into the other matters.

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 11 (3) The Director may, for the purpose of inquiring into those other matters: (a) request the applicant or another person who has an association with the applicant to supply further information or attend interviews; or (b) make inquiries of his or her own, including inquiries in a State or another Territory of the Commonwealth or in a place outside Australia. (4) If a person does not comply with a request of the Director under subregulation (3), the Director may decide he or she has sufficient grounds to refuse to grant the internet gaming key employee licence. (5) A civil or criminal action or proceeding does not lie against a person requested by the Director to supply information for the purposes of this regulation in respect of an act or thing done or omitted to be done in good faith by the person for the purpose of supplying the information. 17 Grant or refusal of licence (1) The Director may grant an internet gaming key employee licence to an applicant if the Director is satisfied under regulations 15 and 16 that the applicant: (a) is eligible to be granted the licence; and (b) is a fit and proper person to be granted an internet gaming key employee licence to perform the duties he or she proposes to perform under the licence. (2) Despite regulations 15 and 16, the Director may, in his or her absolute discretion, grant an internet gaming key employee licence to an applicant on the grounds that the applicant holds a licence that is: (a) issued by a State or another Territory of the Commonwealth; and (b) in the opinion of the Director, equivalent to the internet gaming key employee licence. (3) An internet gaming key employee licence granted under subregulation (1) or (2) is to be: (a) a full internet gaming key employee licence; or

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 12 (b) a provisional internet gaming key employee licence. (4) An internet gaming key employee licence granted under subregulation (1) or (2) is subject to those terms and conditions, not inconsistent with these Regulations, in relation to: (a) the duties to be performed by the holder of the licence; and (b) the manner in which the holder of the licence must perform duties, that the Director thinks fit and specifies on the licence. (5) It is a condition of an internet gaming key employee licence that the holder of the licence must comply with and not contravene: (a) the Act or these Regulations; (b) a lawful direction or order given to him or her by a gaming inspector in respect of the carrying out of the holder of the licence's duties in relation to the conduct of internet gaming; or (c) a direction of the Director or a procedure or control specified in the approved control system. (6) The Director must notify the applicant as soon as practicable after refusing to grant an internet gaming key employee licence to him or her. (7) A person who has been refused an internet gaming key employee licence may, not later than 14 days after receiving notice of the refusal, request the Director to supply his or her reasons for that decision. (8) The Director must, as soon as practicable after receiving a request under subregulation (7) from a person, give to the person written reasons for the Director's decision. (9) Subject to these Regulations, an internet gaming key employee licence granted under this regulation remains in force until: (a) it expires; (b) the holder of the licence no longer performs the duties to which the licence relates; (c) the holder of the licence surrenders the licence to the Director; or (d) the licence is cancelled under regulation 34(1)(g).

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 13 18 Grant of provisional or full licence (1) Subject to these Regulations, if an applicant: (a) has been found guilty of an offence involving dishonesty committed before he or she attained the age of 18 years; (b) has been found guilty of an offence involving the use, manufacture or sale of drugs; (c) is a person whose internet gaming key employee licence was cancelled under regulation 34(1)(g); or (d) is to be engaged by an internet gaming licensee to perform duties for a period not exceeding 12 months, the Director may only grant a provisional internet gaming key employee licence to the person. (2) If subregulation (1) does not apply in relation to an applicant for an internet gaming key employee licence, the Director may only grant a full internet gaming key employee licence to the person. 19 Duration of provisional licence (1) A provisional internet gaming key employee licence: (a) takes effect from the date on which it is granted; and (b) subject to these Regulations, remains in force for the period, of not more than 12 months, specified by the Director on the licence. (2) In determining the period to specify on a provisional internet gaming key employee licence to which regulation 18(1)(a) or (b) relates, the Director must have regard to: (a) the nature of the offence committed; (b) how recently the offence was committed; (c) the severity of the penalty imposed in respect of the offence; and (d) any restitution made in respect of the offence. (3) In determining the period to specify on a provisional internet gaming key employee licence to which regulation 18(1)(c) relates, the Director must have regard to the circumstances of, and the reasons for, the cancellation of the licence.

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 14 (4) The expiry date of a provisional internet gaming key employee licence to which regulation 18(1)(d) relates is to be the date of the expiry of the period, not exceeding 12 months, for which the person was engaged by an internet gaming licensee to perform duties. 20 Duration of full licence (1) A full internet gaming key employee licence: (a) takes effect from the date on which it is granted or renewed; and (b) subject to these Regulations, continues in force for 5 years on and from that date. (2) If an internet gaming key licensee makes an application for the renewal of a full internet gaming key employee licence, the licence continues in force, subject to these Regulations, until: (a) the date on which the licence expires; or (b) the application for renewal is determined, whichever is the later. 21 Application for further licence (1) A person granted an internet gaming key employee licence that is no longer in force may apply under regulation 14 to the Director for the grant of an internet gaming key employee licence. (2) The holder of a provisional internet gaming key employee licence may, not less than one month before the licence expires, apply under regulation 14 to the Director for the grant of a full internet gaming key employee licence. (3) If a person applies for an internet gaming key employee licence before 6 months after the expiry of his or her internet gaming key employee licence, the Director may waive compliance with regulation 14, to the extent he or she considers necessary having regard to: (a) the circumstances of the application; and (b) the nature of the information to be supplied under regulation 14.

Part 4 Licensing of key employees Division 1 Grant of key employee licence Gaming Control (Internet Gaming) Regulations 1998 15 (4) If the holder of a provisional internet gaming key employee licence applies for the grant of a full internet gaming key employee licence, the Director may: (a) waive compliance with regulation 14(2)(a) to (g) (inclusive); and (b) waive the payment of the fee under regulation 14(2)(h) in respect of the application, if he or she thinks it is proper to do so because: (c) the person applied for an internet gaming key employee licence not more than 12 months before the application before the Director was made; and (d) in the Director's opinion, the person conducted himself or herself properly while the provisional internet gaming key employee licence was in force. (5) The Director may grant a full internet gaming key employee licence to the holder of a provisional internet gaming key employee licence if the Director is of the opinion that the person is suitable in view of the person's conduct while the provisional internet gaming key employee licence was in force. (6) Subregulation (5) has effect although the applicant is a person referred to in regulation 18(1)(a), (b), (c) or (d). 22 Person whose licence is cancelled must not apply for another licence for 12 months (1) Subject to these Regulations, a person who held an internet gaming key employee licence that was cancelled under regulation 34(1)(g) must not apply for a further internet gaming key employee licence until after 12 months after the date the previous internet gaming key employee licence was cancelled. Maximum penalty: 15 penalty units. (2) Subject to these Regulations, a person whose application for an internet gaming key employee licence was refused must not apply for an internet gaming key employee licence until after 12 months after the date the previous application was refused. Maximum penalty: 15 penalty units.

Part 4 Licensing of key employees Division 2 General Gaming Control (Internet Gaming) Regulations 1998 16 Division 2 General 23 Renewal of licence (1) A provisional internet gaming key employee licence is not renewable. (2) A licensed person who holds a full internet gaming key employee licence may, not less than one month before the licence expires, apply to the Director for the renewal of the licence. (3) An application under subregulation (2) is to be in the approved form, accompanied by: (a) an application fee of 285 revenue units; and (b) 3 recent passport size photographs of the applicant. (4) The Director must consider an application for the renewal of a full internet gaming key employee licence. (5) The Director must renew a full internet gaming key employee licence if he or she is satisfied that the applicant: (a) has complied with the terms and conditions of the licence; and (b) is not otherwise prevented from having his or her licence renewed by a provision of these Regulations. (6) A full internet gaming key employee licence that is renewed is subject to: (a) the same terms and conditions as applied to the original licence; or (b) if the terms and conditions are varied under regulation 24 or 34 – the same terms and conditions as applied to the original licence as varied under that regulation. 24 Variation of licence (1) An internet gaming key licensee may apply to the Director to vary: (a) a term or condition of his or her internet gaming key employee licence; (b) the duties he or she performs under his or her internet gaming key employee licence; or

Part 4 Licensing of key employees Division 2 General Gaming Control (Internet Gaming) Regulations 1998 17 (c) the classification (as a provisional internet gaming key employee licence or a full internet gaming key employee licence) of the internet gaming key employee licence he or she holds. (2) An application under subregulation (1) is to: (a) set out the variation required and the reasons supporting the variation; (b) be in accordance with regulation 14 to the extent the Director considers necessary having regard to the nature of the variation and the information to be supplied in support of the application; and (c) be accompanied by a variation fee of 20 revenue units. (3) The Director must consider an application made under subregulation (1) as soon as practicable after receiving it. (4) For the purpose of determining an application under subregulation (1), regulations 15, 16 and 17 apply to the extent necessary as if the application were an application for an internet gaming key employee licence under regulation 14. (5) If the Director decides to vary the internet gaming key employee licence to which the application relates, he or she must: (a) amend the internet gaming key employee licence; or (b) issue a new internet gaming key employee licence, as he or she considers appropriate. 25 Loss, &c., of licence (1) If an internet gaming key employee licence is lost, destroyed or damaged, the holder of the licence must apply to the Director for the issue of a replacement licence. Maximum penalty: 15 penalty units. (2) An application under subregulation (1) is to be: (a) in writing in an approved form; (b) verified by a signed statutory declaration; and (c) accompanied by a replacement licence fee of 20 revenue units.

Part 4 Licensing of key employees Division 2 General Gaming Control (Internet Gaming) Regulations 1998 18 (3) If the Director is satisfied that an internet gaming key employee licence has been lost, destroyed or damaged to such an extent that replacement is necessary, he or she must issue a replacement licence in the same form and on the same terms and conditions as the licence it replaces. 26 Surrender of licence (1) The holder of an internet gaming key employee licence may, at any time, surrender the licence by returning it, together with the approved form, to the Director. (2) A licence ceases to have effect immediately after the licence and the approved form are received by the Director under subregulation (1). 27 When licence to be returned to Director An internet gaming key licensee must deliver or send his or her internet gaming key employee licence to the Director as soon as practicable after: (a) the licence is cancelled, suspended, varied or made subject to conditions; and (b) he or she has received notice from the Director requiring the return of the licence. Maximum penalty: 15 penalty units. 28 False statements A person must not knowingly: (a) make a false statement; or (b) supply false information, in relation to the grant, renewal, variation or replacement of an internet gaming key employee licence or the conduct of a review under Division 3. Maximum penalty: 15 penalty units.

Part 4 Licensing of key employees Division 3 Review of key licensees Gaming Control (Internet Gaming) Regulations 1998 19 Division 3 Review of key licensees 29 When review must occur (1) If it is brought to the attention of the Director that: (a) an internet gaming key employee licence was obtained by fraud or misrepresentation; (b) an internet gaming key licensee has been found guilty of an offence: (i) against the Act or these Regulations; (ii) involving dishonesty; (iii) involving the use, manufacture or sale of drugs; or (iv) punishable on conviction by a maximum penalty of not less than 3 months imprisonment; (c) an internet gaming key licensee has contravened a term or condition of his or her licence, a direction of the Director or a procedure or control specified in the approved control system; (d) an internet gaming key licensee failed to provide information that he or she is required to provide under these Regulations or provided information knowing it to be false or misleading; (e) an internet gaming key licensee has become bankrupt, applied to take the benefit of a law relating to bankrupt or insolvent debtors, has compounded with his or her creditors or made an assignment of his or her remuneration for their benefit; or (f) the holder of an internet gaming key employee licence may not be a fit and proper person to hold the licence, the Director must as soon as practicable conduct a review to investigate the matter. (2) Despite subregulation (1) and regulation 34, the Director may determine that, having regard to the minor nature of the matter referred to in subregulation (1) that has been brought to his or her attention: (a) a review need not be commenced or continued in relation to the matter; or

Part 4 Licensing of key employees Division 3 Review of key licensees Gaming Control (Internet Gaming) Regulations 1998 20 (b) the review is to be determined by reprimanding the holder of the licence to which the matter relates. 30 Review may occur at any time The Director may at any time conduct a review as to whether a person who holds an internet gaming key employee licence is a suitable person to hold the licence. 31 Notice of review to be given to internet gaming licensee (1) Before commencing a review of an internet gaming key licensee, the Director must give written notice of the review to the internet gaming licensee in relation to whom the internet gaming key licensee performs duties. (2) A notice under subregulation (1) is to include: (a) the reason for the review; and (b) the time, date and place of the review. (3) A notice under subregulation (1) may include a requirement that the internet gaming licensee must ensure that the internet gaming key licensee to whom the notice relates ceases to perform duties until the determination of the review. (4) An internet gaming licensee must comply with and not contravene a requirement under subregulation (3) specified in a notice given to him or her under subregulation (1). Maximum penalty: 15 penalty units. 32 Notice of review to be given to internet gaming key licensee (1) Before commencing a review in relation to an internet gaming key licensee, the Director must give the licensee not less than 14 days notice in writing of the reason for conducting the review. (2) A notice under subregulation (1) is to specify: (a) the time, date and place where the internet gaming key licensee may attend to make submissions, either personally or by a representative, to the Director; or (b) the time and date before which, and the place at which, the internet gaming key licensee may make written submissions to the Director.

Part 4 Licensing of key employees Division 3 Review of key licensees Gaming Control (Internet Gaming) Regulations 1998 21 33 Review procedure (1) Subject to this Division, the procedure of a review is as determined by the Director. (2) Despite subregulation (1), the Director: (a) is not bound by the rules of evidence; (b) must act without regard to technicalities and legal form; (c) may inform himself or herself about a relevant matter in the manner he or she thinks fit; (d) may require the production of a relevant document, must inspect a relevant document produced before him or her, may retain the document for a reasonable period for the purposes of the review and make copies of it; (e) may require a person, other than the internet gaming key licensee, who has an association with the subject of the review to attend before him or her and to answer truthfully questions put to that person; and (f) may determine the review although the internet gaming key licensee has failed to make submissions within the time allowed, if the Director is satisfied that the licensee had received notice to do so. (3) A person must comply with and not contravene a requirement under subregulation (2). Maximum penalty: 15 penalty units. (4) Despite subregulation (3), a person is not required to answer a question if the answer might tend to incriminate the person. 34 Determination of review (1) After conducting a review, the Director may take one or more of the following actions that he or she thinks fit in the circumstances: (a) dismiss the matter the subject of the review; (b) reprimand the internet gaming key licensee; (c) require the internet gaming key licensee to attend for counselling or retraining; (d) impose conditions on the internet gaming key licence;

Part 5 Financial controls Division 1 Accounts, financial statements and reports Gaming Control (Internet Gaming) Regulations 1998 22 (e) vary a term or condition of the internet gaming key employee licence, the duties authorised to be performed under the licence or the classification (as a provisional internet gaming key employee licence or a full internet gaming key employee licence) of the internet gaming key licensee's licence; (f) suspend the internet gaming key licensee's licence for a period of not more than 6 months; (g) cancel the internet gaming key licensee's licence. (2) A person must comply with and not contravene a requirement under subregulation (1)(c). Maximum penalty: 15 penalty units. Part 5 Financial controls Division 1 Accounts, financial statements and reports 35 Keeping of accounting records An internet gaming licensee must: (a) keep accounting records that correctly record and explain the transactions in relation to, and the financial position of the internet gaming licensee in respect of, operations conducted under his or her internet gaming licence; and (b) keep the accounting records in a way that allows: (i) true and fair financial statements and accounts to be prepared from time to time; and (ii) the financial statements and accounts to be conveniently and properly audited. Maximum penalty: 15 penalty units. 36 Preparation of financial statements and accounts An internet gaming licensee must prepare financial statements and accounts giving a true and fair view of the licensee's financial operations conducted under the internet gaming licence, including but not limited to: (a) trading accounts, if applicable, for each financial year; (b) profit and loss accounts for each financial year; and

Part 5 Financial controls Division 1 Accounts, financial statements and reports Gaming Control (Internet Gaming) Regulations 1998 23 (c) a balance sheet as at the end of each financial year. 37 Submission of reports (1) The Director may, by written notice to an internet gaming licensee: (a) require the licensee to give the Director a report about the internet gaming licensee's operations under the internet gaming licence; and (b) specify a date by which the report is to be given to the Director. (2) The internet gaming licensee must give the report to the Director on or before the date specified in the notice under subregulation (1). Maximum penalty: 15 penalty units. (3) A report is to be in the approved form. (4) The Director may, by written notice to an internet gaming licensee, require the licensee to give to the Director further information about a report by the date specified in the notice, to enable the Director to understand the internet gaming licensee's operations. (5) An internet gaming licensee must comply with a requirement under subregulation (4) by the date specified in the notice, unless the internet gaming licensee has a reasonable excuse. Maximum penalty: 15 penalty units. (6) An internet gaming licensee must not give the Director a report containing information, or further information about a report, if the internet gaming licensee knows the information is false, misleading or incomplete in a material particular. Maximum penalty: 15 penalty units. (7) It is enough for a complaint of an offence against subregulation (6) to state that the report or information was false, misleading or incomplete to the defendant's knowledge.

Part 5 Financial controls Division 3 Audit Gaming Control (Internet Gaming) Regulations 1998 24 Division 2 Financial institution accounts 38 Keeping of accounts An internet gaming licensee must keep with an approved financial institution an approved account or accounts for use for all banking or similar transactions in relation to the operations conducted under the internet gaming licence. Maximum penalty: 15 penalty units. 39 Use of accounts An internet gaming licensee must not use an account approved by the Director under regulation 38 other than for a purpose for which the account is approved. Maximum penalty: 15 penalty units. Division 3 Audit 40 Audit of internet gaming licensee's operations An internet gaming licensee must cause the books, accounts and financial statements in relation to the operations conducted under the internet gaming licence for the financial year to be audited: (a) in accordance with the approved control system; and (b) at the internet gaming licensee's own expense, by a company auditor registered under Part 9.2 of the Corporations Act 2001. Maximum penalty: 15 penalty units. 41 Completion of audit (1) The auditor must: (a) complete the audit required under regulation 40 within the period, if any, specified in the approved control system; and (b) immediately after completion of the audit required under regulation 40, give a copy of the audit report to the Director and the internet gaming licensee. Maximum penalty: 15 penalty units.

Part 6 Internet gaming records Gaming Control (Internet Gaming) Regulations 1998 25 (2) Subregulation (1)(a) does not apply to the auditor if: (a) in the circumstances it would be unreasonable to require the auditor to comply with it; and (b) the auditor completes the audit as soon as practicable. 42 Further information following audit (1) On receiving a copy of the audit report under regulation 41, the Director may, by written notice to the internet gaming licensee, require the licensee to give the Director, within a reasonable period specified in the notice, further information about a matter relating to the licensee's operations mentioned in the audit report. (2) An internet gaming licensee must comply with a requirement under subregulation (1) within the time specified in the notice, unless the licensee has a reasonable excuse. Maximum penalty: 15 penalty units. Part 6 Internet gaming records 43 Notices about keeping internet gaming records (1) The Director may, by written notice to an internet gaming licensee: (a) approve a place nominated by the licensee (other than the internet gaming licensee's public office) as a place for keeping the licensee's gaming records; (b) specify a gaming record of the licensee's that is not required to be kept at the licensee's public office or a place approved under paragraph (a); (c) specify: (i) a gaming record of the internet gaming licensee that may be kept temporarily at a place other than the licensee's public office or a place approved under paragraph (a); and (ii) the period for which, or the circumstances in which, the record specified in subparagraph (i) may be kept at the other place; (d) approve the keeping of information contained in a gaming record in a way different from the way the information was kept when the record was being used by the licensee; or

Part 6 Internet gaming records Gaming Control (Internet Gaming) Regulations 1998 26 (e) approve the destruction of a gaming record of the licensee that the Director considers need not be kept. (2) The Director may specify a gaming record under subregulation (1)(b) only if the Director considers there is sufficient reason for the record to be kept at a place other than the internet gaming licensee's public office or a place approved under subregulation (1)(a). (3) The exercise of the Director's power under subregulation (1)(d) or (e) is subject to any other law about the retention or destruction of the gaming record. 44 Internet gaming records to be kept at specified place (1) An internet gaming licensee must keep the internet gaming licensee's gaming records at: (a) the internet gaming licensee's public office; or (b) at a place approved under regulation 43(1)(a) for the records. Maximum penalty: 15 penalty units. (2) A gaming record referred to in regulation 43(1)(c) is not required to be kept at the internet gaming licensee's public office or the place approved under regulation 43(1)(a): (a) for the period specified in the notice; or (b) while the circumstances specified in the notice exist. 45 Internet Gaming records to be kept for required period (1) An internet gaming licensee must keep a gaming record for 7 years after the end of the transaction to which the record relates. Maximum penalty: 15 penalty units. (2) Subregulation (1) does not apply to a gaming record: (a) if the information previously contained in the record is kept in another approved way; or (b) that has been destroyed as approved. (3) Subregulation (1) has effect subject to any other law about the retention or destruction of the gaming record.

Part 7 Player protection Division 1 Registration of players Gaming Control (Internet Gaming) Regulations 1998 27 Part 7 Player protection Division 1 Registration of players 46 Player registration (1) An internet gaming licensee must not permit a person to participate as a player in an internet game conducted by the licensee unless the person is registered as a player with the licensee. Maximum penalty: 15 penalty units. (2) A person must not participate as a player in an internet game unless the person is registered as a player with the internet gaming licensee who conducts the game. Maximum penalty: 15 penalty units. 47 Procedure for registration (1) An internet gaming licensee may register a person as a player with the licensee. (2) An internet gaming licensee may register a person as a player with the licensee only if the licensee has received from the person an application, in an approved form, for registration. 48 Certain players not to be registered (1) The Director may, by notice to an internet gaming licensee, prohibit the registration as a player with the licensee of a person specified in the notice. (2) A licensee must not register as a player with the licensee a person specified in a notice given to the licensee under subregulation (1). Maximum penalty: 15 penalty units. 49 Persons cannot be registered if they have provided false information (1) Subject to subregulation (2), if an internet gaming licensee becomes aware that a person has provided false information to the licensee under regulation 47: (a) the licensee must cancel the person's registration as a player with the licensee; and

Part 7 Player protection Division 2 Players' accounts Gaming Control (Internet Gaming) Regulations 1998 28 (b) the licensee must not register the person as a player with the licensee. Maximum penalty: 15 penalty units. (2) Subregulation (1) does not apply to a person if the Director is satisfied that: (a) the provision of the information occurred as a result of an honest or reasonable mistake; or (b) it is otherwise appropriate to register the person. Division 2 Players' accounts 50 Players' accounts (1) For the purposes of these Regulations, a player's account, in relation to a registered player, means an account, established and maintained by an internet gaming licensee, of the funds held by the licensee to the credit of the player. (2) An internet gaming licensee must establish and maintain a player's account in relation to each player who is registered with the licensee. (3) An internet gaming licensee must credit to the account established under subregulation (2) in respect of a registered player all funds: (a) received by the licensee from or on behalf of the player; or (b) owed by the licensee to the player. (4) An internet gaming licensee may withdraw from the account established under subregulation (2) in respect of a registered player all amounts wagered and lost by the player. (5) An internet gaming licensee may close the account established under subregulation (2) in respect of a registered player and must close the account when directed to do so by the Director. (6) An internet gaming licensee must remit to a registered player in accordance with the approved control system all funds in credit in the account established under subregulation (2) in respect of the registered player when the account is closed.

Part 7 Player protection Division 2 Players' accounts Gaming Control (Internet Gaming) Regulations 1998 29 51 Acceptance of wagers An internet gaming licensee must not accept a wager from a player in an internet game unless: (a) a player's account has been established in the name of the player and there are adequate funds in the account to cover the amount of the wager; or (b) the funds necessary to cover the amount of the wager are provided in an approved way. 52 No payments unless player's identity is verified An internet gaming licensee must not make a payment out of a player's account to a player until the player's identity, age and place of residence have been verified under the licensee's approved control system. Maximum penalty: 15 penalty units. 53 Funds in players' accounts to be remitted on demand (1) An internet gaming licensee must, at the request of the registered player in whose name a player's account is established, remit the funds standing to the credit of the account to the player as soon as practicable after receipt of the request. Maximum penalty: 15 penalty units. (2) An amount may only be remitted by a licensee to a player: (a) in an approved manner; and (b) in accordance with the licensee's approved control system. Maximum penalty: 15 penalty units. (3) An internet gaming licensee may, before remitting funds to a player in accordance with subregulation (1), take such time as is reasonably necessary for the purposes of: (a) verifying the player's registration as a player; (b) verifying the playing of a game by the player; (c) conducting security and other internal procedures in relation to the player or the player's account; and (d) ensuring that the rules that are approved relating to the award of prizes to players have been complied with.

Part 7 Player protection Division 3 Financial protections Gaming Control (Internet Gaming) Regulations 1998 30 54 Access to players' accounts by internet gaming licensees An internet gaming licensee must not deal with funds credited to a player's account except: (a) to debit to the account a wager made by the player or an amount the player indicates the player wants to wager in the course of an internet game the player is playing or about to play; (b) to remit funds standing to the credit of the account to the player at the player's request under regulation 53; or (c) as specified in the licensee's approved control system. Maximum penalty: 15 penalty units. 55 Inactive players' accounts (1) If no transaction has been recorded on a player's account for 6 months, the internet gaming licensee in relation to whom the account is established must comply with the approved procedures for determining the player's intentions in relation to the account. (2) If an internet gaming licensee has complied with subregulation (1) but is not able to determine the player's intentions in relation to the account, the licensee must deal with the account in accordance with the licensee's approved control system. Division 3 Financial protections 56 Internet gaming licensee not to act as credit provider (1) An internet gaming licensee must not provide credit to a player or a player's account. Maximum penalty: 15 penalty units. (2) An internet gaming licensee must not act as agent for a credit provider to facilitate the provision of credit to a player or a player's account. Maximum penalty: 15 penalty units. (3) If a player makes a payment into his or her account by means of a credit card, an internet gaming licensee must ensure that the payment does not exceed the amount specified for the player in the approved control system. Maximum penalty: 15 penalty units.

Part 7 Player protection Division 3 Financial protections Gaming Control (Internet Gaming) Regulations 1998 31 57 Limitation on amount wagered (1) A registered player may by: (a) written notice; or (b) electronic notice, to an internet gaming licensee, set a limit on the amount the player may wager within a specified period. (2) A player who has set a limit under this regulation may change or revoke the limit by: (a) written notice; or (b) electronic notice, given to the internet gaming licensee in accordance with the approved procedures. (3) A notice increasing or revoking the limit has effect only: (a) after 7 days after the internet gaming licensee received the notice; and (b) if the player has not, before 7 days after the internet gaming licensee received the notice, notified the internet gaming licensee of an intention to withdraw the notice. (4) A notice reducing the limit has effect immediately after it is received by the internet gaming licensee. (5) An internet gaming licensee must not accept a wager from a player contrary to a limit set for the player under this regulation. Maximum penalty: 15 penalty units. (6) In this regulation, wager means the amount wagered from the player's funds deposited into his or her account, but does not include any winnings generated from the wager. 58 Voluntary de-registration as player (1) An internet gaming licensee's must ensure that the approved computer system enables a registered player to notify the internet gaming licensee that he or she wishes to permanently de-register as a player with the licensee. Maximum penalty: 15 penalty units.

Part 7 Player protection Division 4 Protection of minors Gaming Control (Internet Gaming) Regulations 1998 32 (2) An internet gaming licensee: (a) must de-register a registered player as soon as practicable after, and in any case before 24 hours after, receipt of notice from the player under subregulation (1); and (b) must not knowingly re-register the person as a player with the licensee except with the approval of the Director. Maximum penalty: 15 penalty units. Division 4 Protection of minors 59 Prohibition of minor's participation in conduct of games (1) An internet gaming licensee must not allow a minor to participate in operations related to the conduct of internet games by the licensee. Maximum penalty: 15 penalty units. (2) It is a defence to a charge against subregulation (1) if the defendant proves that he or she had no reason to believe, and did not believe, that the person to whom the charge relates was a minor. (3) A minor must not participate in operations related to the conduct of internet games. Maximum penalty: 15 penalty units. (4) An internet gaming licensee must: (a) take all reasonable steps to restrict access by minors to an internet game conducted by the licensee; and (b) comply with all directions of the Director relating to the restriction of access by minors to internet games conducted by the licensee. Maximum penalty: 15 penalty units. 60 Participation by minors as players prohibited (1) A person involved in the conduct of an internet game by an internet gaming licensee must not permit a minor to participate as a player in the game. Maximum penalty: 15 penalty units.

Part 7 Player protection Division 4 Protection of minors Gaming Control (Internet Gaming) Regulations 1998 33 (2) It is a defence to a charge against subregulation (1) if the defendant proves that he or she had no reason to believe, and did not believe, that the person to whom the charge relates was a minor. (3) If a person involved in the conduct of an internet game by an internet gaming licensee: (a) suspects; or (b) ought, in all the circumstances, reasonably be expected to suspect, that a player of the game is a minor, the licensee must not permit the player to continue to play the game, or to play another internet game with the licensee, until the player has submitted proof, of the approved type, that he or she is an adult. Maximum penalty: 15 penalty units. (4) If a person involved in the conduct of an internet game by an internet gaming licensee: (a) suspects; or (b) ought, in all the circumstances, reasonably be expected to suspect, that a player of the game is a minor, the licensee must not add money to or deduct money from what appears to be the player's account, or otherwise pay money or award a prize to the player, until: (c) the player has submitted proof, of the approved type, that he or she is an adult; or (d) the licensee is authorised to do so by notice in writing from the Director. Maximum penalty: 15 penalty units. (5) A player may apply to the Director for a notice of authority for the purposes of subregulation (4). (6) A minor must not participate as a player in an internet game conducted by an internet gaming licensee. Maximum penalty: 15 penalty units. (7) A prize won by a minor by participation in an internet game contrary to this regulation is forfeited to the Territory.

Part 8 Conclusion of games Division 1 Prizes Gaming Control (Internet Gaming) Regulations 1998 34 61 Software limiting minor's access to be made available An internet gaming licensee must ensure that a person has electronic access, at the licensee's internet site, to computer software that will enable the person to restrict or prevent access to the site from the person's computer by a minor. Maximum penalty: 15 penalty units. Part 8 Conclusion of games Division 1 Prizes 62 Payment or collection of prizes (1) If a registered player in an internet game conducted by an internet gaming licensee wins a monetary prize, the licensee must as soon as practicable pay the prize to the player by crediting the amount to the player's account. (2) An internet gaming licensee may, before crediting the amount of a prize to a player under subregulation (1), take the time necessary to: (a) verify the player's registration as a player; (b) verify the operation of a game by the player; (c) conduct security and other internal procedures in relation to the player or the player's account; and (d) ensure that the rules approved by the Director relating to the award of prizes to players have been complied with. 63 Claims for prize (1) If a claim for a prize in an internet game conducted by an internet gaming licensee is made before 5 years after the end of the game, the licensee must immediately try to resolve the claim. (2) If an internet gaming licensee is not able to resolve the claim, the licensee must, by written notice to the claimant, promptly inform the claimant: (a) of the licensee's decision on the claim; and (b) that the person may, within 10 days of receiving the notice, ask the Director to review the decision.

Part 8 Conclusion of games Division 2 Aborted games Gaming Control (Internet Gaming) Regulations 1998 35 (3) If a claim is not resolved or the claimant has not received a notice under subregulation (2), the claimant may apply in the approved form to the Director for a review of the internet gaming licensee's decision in respect of the claim. (4) If the claimant received a notice under subregulation (1), the application to the Director under subregulation (3) must be made within 10 days after receiving the notice. (5) If a request is made to the Director, the Director: (a) may carry out investigations the Director considers necessary to resolve matters in dispute; and (b) must determine whether the prize is to be given to the claimant or not. 64 Entitlement to prize lapses if not claimed within 5 years If a prize is not claimed within 5 years after the end of the internet game in which the prize was won, the entitlement to the prize is extinguished. Division 2 Aborted games 65 Aborted games (1) An internet gaming licensee is to take all reasonable steps to ensure that the licensee's approved computer system enables a player whose participation in a game is, after he or she has made a wager, interrupted by: (a) a failure of the telecommunications system; or (b) a failure of the player's computer system, that prevents the player from continuing with the game, to resume, on the restoration of the system, his or her participation in the game that was interrupted as at the time immediately before the interruption. Maximum penalty: 15 penalty units. (2) If a licensee's computer system does not enable a player to continue, after the restoration of the system, with a game interrupted by a failure of the telecommunications system or the player's computer system, the licensee must: (a) ensure that the game is terminated in accordance with the approved control system; and

Part 8 Conclusion of games Division 2 Aborted games Gaming Control (Internet Gaming) Regulations 1998 36 (b) refund the amount of the wager to the player by placing it in the player's account. Maximum penalty: 15 penalty units. (3) If a game has not terminated within the period after commencing that is specified in an internet gaming licensee's approved control system, the licensee must: (a) ensure that the game is terminated in accordance with the approved control system; and (b) deal with the amount of the wager in accordance with the approved control system. Maximum penalty: 15 penalty units. 66 Miscarriage of game (1) If an internet game conducted by an internet gaming licensee is started but miscarries because of a failure of the licensee's computer operating system, the internet gaming licensee: (a) must: (i) refund the amount wagered in the game to the player by crediting it to the player's account or, if the account no longer exists, by paying it to the player in an approved manner; and (ii) if a player has an accrued credit at the time the game miscarries – credit to the player's account the monetary value of the credit or, if the account no longer exists, pay it to the player in an approved manner; (b) must immediately inform the Director of the circumstances of the incident; and (c) must not conduct a further game if the game is likely to be affected by the same failure. Maximum penalty: 15 penalty units. (2) After investigating the incident, the Director may, by written notice to the internet gaming licensee, give the internet gaming licensee other directions the Director considers appropriate in the circumstances.

Part 9 Miscellaneous Gaming Control (Internet Gaming) Regulations 1998 37 (3) The internet gaming licensee must comply with a direction under subregulation (2). Maximum penalty: 15 penalty units. 67 Power to withhold prize in certain cases (1) If an internet gaming licensee has reason to believe that the result of an internet game has been affected by an illegal activity the internet gaming licensee may withhold a prize in the game. (2) If an internet gaming licensee withholds a prize under this regulation, the internet gaming licensee: (a) must immediately inform the Director of the circumstances of the incident; and (b) must not conduct a further game if a recurrence of the illegal activity is likely. (3) After investigating the incident, the Director may, by written notice to the internet gaming licensee: (a) direct the internet gaming licensee to pay the prize to the player by placing it in the player's account or, if the account no longer exists, to pay it to the player in another approved manner; or (b) confirm the internet gaming licensee's decision to withhold the prize, but direct the internet gaming licensee to refund an amount wagered in the game by placing it in the player's account or in another approved manner. (4) The internet gaming licensee must comply with a direction under subregulation (3). Maximum penalty: 15 penalty units. Part 9 Miscellaneous 68 Player to be bound by rules of game A player who participates in an internet game and the internet gaming licensee must comply with the rules of the game specified at the internet site at which the game is conducted by the licensee. Maximum penalty: 15 penalty units.

Part 9 Miscellaneous Gaming Control (Internet Gaming) Regulations 1998 38 69 Interference with proper conduct of internet games A person must not, without the Director's authorisation, interfere in the proper conduct of an internet game. Maximum penalty: 15 penalty units. 70 Internet gaming licensee not to publish identity of player in certain cases (1) An internet gaming licensee or an employee or other person engaged in duties related to the conduct of an internet game must not, without authorisation under subregulation (2): (a) disclose information about the name, or other identifying particulars, of a player; or (b) use information about a player for a purpose other than the purpose for which the information was given. Maximum penalty: 15 penalty units. (2) The disclosure of information, or its use for a purpose other than the purpose for which it was given, is authorised if the disclosure or use is: (a) authorised by the player; (b) reasonably necessary for the conduct of internet games; (c) required for the administration or enforcement of the Act or these Regulations; or (d) otherwise required by law. 71 Fee for application For section 47B(2) of the Act, the prescribed fee for an application for an internet gaming licence is 20 000 revenue units.

ENDNOTES Gaming Control (Internet Gaming) Regulations 1998 39 ENDNOTES 1 KEY Key to abbreviations amd = amended od = order app = appendix om = omitted bl = by-law pt = Part ch = Chapter r = regulation/rule cl = clause rem = remainder div = Division renum = renumbered exp = expires/expired rep = repealed f = forms s = section Gaz = Gazette sch = Schedule hdg = heading sdiv = Subdivision ins = inserted SL = Subordinate Legislation lt = long title sub = substituted nc = not commenced 2 LIST OF LEGISLATION Gaming Control (Internet Gaming) Regulations (SL No. 64, 1998) Notified 13 January 1999 Commenced 13 January 1999 Corporations Reform (Consequential Amendments NT) Act 2001 (Act No. 17, 2001) Assent date 29 June 2001 Commenced 15 July 2001 (s 2, s 2 Corporations Act 2001 (Cth Act No. 50, 2001) and Cth Gaz S285, 13 July 2001) Statute Law Revision (Financial Provisions) Act 2002 (Act No. 38, 2002) Assent date 13 September 2002 Commenced 30 October 2002 (Gaz G43, 30 October 2002, p 3) Treasury Legislation Amendment (Revenue Units) Regulations 2006 (SL No. 33, 2006) Notified 18 October 2006 Commenced 18 October 2006 Fees and Charges Amendment Regulations 2009 (SL No. 34, 2009) Notified 14 December 2009 Commenced 1 January 2010 (r 2) Gaming Control (Internet Gaming) Amendment Regulations 2013 (SL No. 11, 2013) Notified 29 May 2013 Commenced 29 May 2013 Penalties Amendment (Miscellaneous) Act 2013 (Act No. 23, 2013) Assent date 12 July 2013 Commenced 28 August 2013 (Gaz G35, 28 August 2013, p 2) Licensing (Repeals and Consequential Amendments) Act 2014 (Act No. 44, 2014) Assent date 5 December 2014 Commenced 1 January 2015 (Gaz S130, 19 December 2014, p 2)

ENDNOTES Gaming Control (Internet Gaming) Regulations 1998 40 Statute Law Revision Act 2017 (Act No. 4, 2017) Assent date 10 March 2017 Commenced 12 April 2017 (Gaz G15, 12 April 2017, p 3) Licensing (Director-General) Repeal Act 2020 (Act No. 4, 2020) Assent date 9 March 2020 Commenced 14 April 2020 (Gaz G13, 1 April 2020, p 2) 3 GENERAL AMENDMENTS General amendments of a formal nature (which are not referred to in the table of amendments to this reprint) are made by the Interpretation Legislation Amendment Act 2018 (Act No. 22, 2018) to: rr 1 and 15. 4 LIST OF AMENDMENTS r 2 amd Act No. 38, 2002, s 7; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 rr 3 – 4 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 5 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 7 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 8 – 12 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 13 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 14 amd No. 33, 2006, r 5; No. 34, 2009, r 10; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 rr 15 – 16 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 17 amd Act No. 44, 2014, s 145; Act No. 4, 2017, s 34; Act No. 4, 2020, s 87 rr 18 – 19 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 21 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 22 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 r 23 amd No. 33, 2006, r 5; No. 34, 2009, r 10; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 24 amd No. 33, 2006, r 5; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 25 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 26 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 27 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 28 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 29 – 30 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 31 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 32 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 rr 33 – 34 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 35 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 r 37 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 38 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 r 39 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 40 amd Act No. 17, 2001, s 22; No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 41 – 42 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87

ENDNOTES Gaming Control (Internet Gaming) Regulations 1998 41 r 43 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 rr 44 – 46 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 48 – 49 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 50 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 rr 52 – 54 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 56 – 57 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 58 – 60 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 61 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 62 – 63 amd Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 65 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 rr 66 – 67 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 68 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 r 69 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6; Act No. 44, 2014, s 145; Act No. 4, 2020, s 87 r 70 amd No. 33, 2006, r 5; Act No. 23, 2013, s 6 r 71 ins No. 11, 2013, r 3

1 GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998

The Regulations rest on a small set of interlocking legal concepts which determine the regulatory levers and who carries compliance costs.

Approved computer system (reg 2, reg 4): A “computer system” is computer hardware and software used to conduct internet games. The licencee must operate only under a computer system approved by the Director (r 4), and seek Director approval for proposed changes (r 4(1)(b)). The Director may require an evaluation and recover reasonable evaluation costs from the licensee (r 4(2)-(3)). Failure to operate under an approved computer system or to authorise changes outside approval attracts a maximum penalty of 15 penalty units (r 5).
Approved control system (rr 6-11): The “control system” is broader than the computer system; it includes the terms and conditions displayed to players, internal controls (computerised or otherwise), accounting and administrative procedures, security measures, management and employee structures, agent terms and other operational matters (r 6(1)-(2)). The licensee must conduct internet games only under an approved control system (r 7). The Director examines submissions for approval, can require tests and additional information, can refuse approval or outline how to rectify a submission, and may direct changes to an approved control system; non‑compliance leads to cancellation of approval (rr 8-11).
Internet gaming key employee and licensing (regs 12-34): A “key duty” is a statutory concept describing positions that control or exercise significant influence over internet gaming operations, are designated in the approved control system or are designated by the Director (r 12). Both licensees and individuals have obligations: licensees must not permit unlicensed persons to perform key duties and persons must not perform key duties without a key employee licence (r 13). The licensing process requires prescribed documentation, criminal history checks, financial background checks and fingerprinting (r 14(2)(f)-(g)). The Director must investigate fitness and propriety against defined criteria , age, repute, English language, financial background, criminal record (subject to the Criminal Records (Spent Convictions) Act 1992), and competence (r 15). Licences can be provisional (≤ 12 months) in specified circumstances or full (5 years) otherwise (rr 18-20). The Director has broad review and sanction powers (rr 29-34).
Player registration and accounts (regs 46-55): Players must be registered before participation (r 46) and licensees must establish and maintain a players’ account for each registered player (r 50). The account must hold funds received from or owed to the player; losses may be debited, and the account must be remitted to the player on closure in the approved manner (r 50(2)-(6)). The licensee must not accept a wager unless the player has an account with adequate funds or funds are provided in an approved way (r 51). Payment out of a player’s account is prohibited until identity, age and residence are verified under the approved control system (r 52).
Financial controls and audit (regs 35-42): Licensees must keep accounting records enabling true and fair financial statements and audits (rr 35-36). The Director may request reports and further information (r 37). Licensee bank accounts must be kept with an approved financial institution as prescribed by Gazette (r 3, r 38), and must only be used for approved purposes (r 39). Audits must be performed by a company auditor registered under Part 9.2 of the Corporations Act 2001 and the audit report must be provided to the Director promptly after completion (rr 40-41). The Director may require further information following an audit (r 42).
Player protections (regs 56-61): Licensees must not act as credit providers for players, or facilitate credit via agency arrangements (r 56). Players can set wagering limits and can permanently de‑register; the Regulations provide timing rules for changes to limits, including a 7‑day delay for increases or revocations (r 57) and immediate effect for reductions (r 57(4)). Minors are subject to strict prohibitions both as staff and as players (rr 59-60); software enabling adults to restrict or prevent minor access must be made available (r 61).
Game continuity, aborted games and prizes (regs 62-67): The Regulations require licensees to design computer systems so that, where possible, a player interrupted by telecommunications or client failures can resume the game at the prior state (r 65(1)). Where resumption is not possible, approved procedures must terminate the game and refund wagers (r 65(2)). Miscarriages due to the licensee’s computer failures trigger immediate refund obligations, Director notification and potential directions (r 66). Prize claims must be handled promptly, with a player able to seek Director review of an unresolved claim; entitlement to an unclaimed prize extinguishes after 5 years (rr 62-64).
Director’s discretion and enforcement (throughout): The Director is the central decision‑maker for approvals, designations (r 12(2)), requests for information (rr 4, 10, 16), notices to prohibit player registration (r 48), and remedial or punitive action for key employee reviews (r 34). Many offences attract a uniform maximum penalty of 15 penalty units; for procedural matters the Director must provide reasons if refusing approvals or licences (rr 4(5), 10(6), 17(6)-(8)). Fees and revenue units are set by regulation (r 71; r 14(2)(h); r 23(3)(a)).

These concepts create an approval‑centric regulatory architecture where licence‑holders are obliged to submit systems, personnel and procedures to prior review and ongoing oversight, maintain segregated financial arrangements and records and provide technical means and administrative processes to protect players and the integrity of games.

Direct obligations fall on internet gaming licensees, the individual persons who perform key duties (internet gaming key licensees), players (registered or prospective) and, to a lesser extent, banks and auditors.

Internet gaming licensees: The principal regulated entity under these Regulations is the person to whom an internet gaming licence has been granted or assigned. Licensees must obtain Director approval for the computer system and control system (regs 4, 8-10), keep accounting records and have audits (regs 35-41), maintain approved accounts with approved financial institutions (regs 3, 38-39), keep records at the public office or an approved place and retain records for seven years (regs 43-45), and implement player registration and account procedures including identity verification and remittance of funds (regs 46-55). Licensees must also take steps to restrict minors and provide software tools to allow adults to block access (rr 59-61). Financial and operational compliance costs largely fall on licensees: fees for licence applications (r 71), key employee application fees (r 14(2)(h): 285 revenue units), audit costs (r 40(b): at the licensee’s expense), and reasonable evaluation costs for system assessment that the Director may require (r 4(3)).
Internet gaming key licensees (key employees): Individuals occupying “key positions” or performing “key duties” , as defined in regulation 12 , are required to hold an internet gaming key employee licence before they perform those duties (r 13). The licence applicant must supply detailed identification, photographs, police fingerprint/palm print verification, written consents to criminal history and financial background checks, and a certificate from the employing internet gaming licensee about engagement and preliminary probity checks (r 14(2)(a)-(g)). The Director conducts investigations into age, character, criminal history (subject to spent convictions law), financial background and competence (r 15). Key employees thus face direct regulatory obligations and the risk of review and sanctions if found unsuitable (rr 29-34), including cancellation and a 12‑month bar on reapplying in specified circumstances (r 22).
Players: Natural persons who participate as players are affected by registration requirements (r 46-47) and must provide information to register. Players’ funds are held in players’ accounts maintained by the licensee; players can request remittance of account funds “as soon as practicable” (r 53(1)), set wagering limits (r 57) and permanently de‑register (r 58). Players under 18 are not permitted to play and are subject to forfeiture rules if they win prizes in contravention (r 60(7)). Players’ identity, age and place of residence must be verified before payments from accounts (r 52), which places on players the practical burden of providing acceptable verification documentation under whatever procedures the licensee’s approved control system specifies.
Financial institutions: The Director may prescribe entities to be “financial institutions” for the Regulations (r 3) and licensees must keep accounts with an approved financial institution (r 38). Financial institutions therefore gain a regulatory role: they are the permitted custodians for players’ and licensee funds. The Regulations enable the Director to approve the use of specified accounts and restrict their use to approved purposes (r 39), which affects bank account setup, segregation and reporting obligations.
Auditors and corporate auditors: Auditors registered under Part 9.2 of the Corporations Act 2001 must perform required audits (r 40). Auditors must complete audits within periods specified in the approved control system and deliver reports to the Director and licensee immediately upon completion (r 41). This links auditors’ obligations to the licensee’s regulatory timetable and the Director’s control system approvals.
Director and compliance staff: The Director is the regulator, with functionally broad powers to approve, require tests and information, direct changes, conduct reviews, and issue notices (throughout , e.g. rr 4, 10-11, 16, 29-34, 43). Gaming inspectors (or persons appointed under the Act) can give lawful directions that form conditions of key employee licences (r 17(5)(b)). Administrative resources of the Director’s office will be the locus for decision making, inspections, audits and review processes; these are centralised costs borne by the regulator.
Agents and contractors: Where a licensee uses agents, the control system must set out agency terms including reporting lines (r 6(e)(iv)). Agents engaged to perform parts of internet gaming operations will be affected by those contractual and reporting requirements and may be the subject of Director designation of key positions (r 12(2)).

Indirectly affected parties include software and platform vendors, hosting and telecom providers, payment processors and overseas service providers, since Director approval processes for computer and control systems require testing and explanation of software, security measures and data integrity procedures (rr 4, 6, 10). Where investigative powers include inquiries outside Australia (r 16(3)(b)), overseas‑based service providers and foreign records may become relevant to licensing and review.

The Regulations allocate decision rights largely to the Director and impose granular compliance obligations on licensees and key employees, while players are protected through mandatory account structures, verification and limits. Financial institutions and auditors are incorporated into the compliance chain by requirement.

This section summarises the principal positive duties and procedural rights created by the Regulations and identifies the legal mechanisms through which they operate.

Duties imposed on internet gaming licensees

Operate only under approved computer and control systems: A licensee must not conduct an internet game except under the licensee’s approved computer system and approved control system (r 5(1), r 7). Changes to those systems require Director approval (r 5(2), r 9).
Submit systems for approval and bear testing/evaluation costs: Licensees may apply for approval and must provide descriptions and explanations of the proposed control system (rr 4(1), 8(2)). The Director may evaluate systems and require payment of reasonable evaluation costs for computer system assessments (r 4(2)-(3)). The Director may require further information and testing for control system submissions (r 10(2)).
Maintain accounting records and produce true and fair financial statements: Licensees must keep accounting records and prepare financial statements that give a true and fair view of operations (rr 35-36). The Director can require reports and further information (r 37). Failure to keep appropriate records or provide required reports attracts penalties (r 35, r 37).
Keep funds and banking with approved financial institutions and use accounts only for approved purposes: Licensees must maintain approved accounts with an approved financial institution for all transactions relating to licensed operations (r 38) and must not use such accounts other than for approved purposes (r 39).
Audit: Licensees must cause their books, accounts and financial statements for each financial year to be audited by a company auditor registered under the Corporations Act, at their own expense, and provide the audit report to the Director immediately after completion (rr 40-41). The Director can request further information following audit (r 42).
Players’ accounts and payment obligations: Licensees must establish and maintain a player's account for each registered player, credit funds received, debit losses, and remit funds to a player on request in an approved manner in accordance with the approved control system (r 50, r 53). Licensees must not make payments out of a player's account until identity, age and place of residence are verified under the approved control system (r 52).
Player registration and minors: Licensees must register players (r 46-47) and must not permit minors to participate either as staff in operations (r 59) or as players (r 60). They must implement reasonable steps and comply with Director directions to restrict minors’ access (r 59(4)) and provide software tools to permit adults to restrict or prevent minor access (r 61).
Non‑crediting: Licensees must not provide credit to players nor act as an agent to facilitate credit (r 56), and must enforce limits on credit card payments as set in the approved control system (r 56(3)).
Game continuity and aborted games: Licensees must implement approved computer system capabilities that, where possible, allow interrupted games to resume at the prior state; otherwise they must terminate according to control system procedures and refund wagers (r 65). On miscarriage due to licensee computer failure, licensees must refund wagers, inform the Director immediately and not conduct further games likely to be affected by the same failure (r 66).
Confidentiality: Licensees and their staff must not disclose player identity or use player information for other purposes except where authorised (r 70).

Duties imposed on individuals (key employees)

Hold an internet gaming key employee licence to perform key duties: Persons who occupy or act in key positions or perform key functions must hold a key employee licence authorising such duties (r 13). Neither the licensee nor the individual may allow or perform key duties without the licence (r 13(1)-(2)).
Supply documentation and consents: Licence applicants must provide specified documentary evidence, photos, fingerprints/palm prints and written consents to criminal and financial checks, and pay the application fee (r 14(2)(a)-(h)). Applicants must notify of material changes while application is pending (r 14(3)-(4)).
Comply with licence conditions and lawful directions: Licence holders must comply with the Act and Regulations, lawful directions of a gaming inspector and directions/procedures specified in the approved control system (r 17(5)).

Regulator’s duties and procedural rights (Director)

Consider and decide applications, give reasons and give notices: The Director must consider applications for system approvals and key employee licences (rr 4(2), 10(1), 17(1)); where refusals occur the Director must give written reasons (r 4(5), r 10(6), r 17(6)). Applicants refused a key licence may request reasons and the Director must supply them promptly (r 17(7)-(8)).
Investigate and require further information: The Director may require additional information, conduct inquiries including interstate or overseas (r 16(3)(b)), and refuse to consider an application until information requested is provided (r 15(3)-(4)).
Supervise and sanction key employees: The Director must conduct a review where information suggests a key employee might be unfit (r 29), must give notice before review to both licensee and key licensee (rr 31-32), and after review may dismiss, reprimand, require counselling, impose licence conditions, suspend for up to 6 months, or cancel the licence (r 34(1)(a)-(g)). The Director may also approve changes to control systems or direct their change (r 11).

Procedural rights of licence applicants and licensees

Right to be notified of decisions and reasons: The Director must promptly give written notice of decisions on system approvals (r 4(4)-(5)) and of licence application refusals (r 17(6)-(8)). For proposed review, the Director must give not less than 14 days’ notice to the key licensee specifying the time, date and place to make submissions or to make written submissions by a specified date (r 32).
Right to resubmit: If a control system submission is refused but is capable of easy rectification, the Director must explain how to change the submission and invite resubmission (r 10(7)).
Appeals and review of decisions: The Regulations provide a process for players to request Director review of an unresolved prize claim (r 63). For key employee licence refusals, the applicant can request reasons and then presumably pursue remedies under the Act or administrative law; the Regulations do not set out a statutory merits appeal within the Regulations themselves but impose disclosure obligations on the Director.

In short, the Regulations impose operational, financial and personnel duties on licensees and key employees while creating administrative procedures intended to ensure oversight. The Director is both decision‑maker and investigatory authority with powers to require information, test systems and impose sanctions.

The Regulations provide a mix of criminal penalties expressed as monetary penalty units, compliance mechanisms enforced through Director directions and approvals, and regulatory controls exercised through audits and review processes.

Monetary penalties

Uniform penalty level for many contraventions: Numerous contraventions carry a maximum penalty of 15 penalty units. Examples include operating outside an approved computer system (r 5(1)), changing an approved computer system without approval (r 5(2)), conducting internet games outside an approved control system (r 7), failing to keep accounting records (r 35), failing to comply with reporting requirements (r 37(2), (5)), failure to keep approved accounts (r 38), misuse of approved accounts (r 39), failure to comply with auditing or post‑audit information requests (rr 41-42), failure to register players or permitting unregistered players to play (r 46(1)-(2)), falsely supplying information in connection with licences (r 28), and multiple other operational offences across Parts 5-8. The exact monetary value of a penalty unit is not specified in the body of the Regulations; the regulatory text uses the unit as the measure of penalty.
Specific penal consequences for procedural noncompliance: Failure to return a licence on cancellation/suspension/variation when required carries a maximum penalty of 15 penalty units (r 27). Making false statements in relation to a licence or review is a penal offence (r 28).

Non‑monetary enforcement tools and administrative sanctions

Director’s review and remedial powers for key employees: Following a review under Division 3 (regs 29-34), the Director may dismiss a matter, reprimand, require counselling or retraining, impose licence conditions, vary terms, suspend for up to 6 months or cancel the licence (r 34(1)(a)-(g)). The Director may require compliance with counselling or retraining (r 34(2)) and a failure to comply with such a requirement is penalised (r 34(2) , maximum 15 penalty units).
Approval cancellations and directions: The Director can cancel approval of an internet gaming licensee’s control system if the licensee fails to comply with a direction to change the system within a specified time (r 11(2)). The Director may, following investigation into aborted or miscarried games, give directions about further measures to be taken by the licensee and the licensee must comply (r 66(2)-(3)). In cases where illegal activity has affected a game, the Director may direct payment of a withheld prize or confirm withholding and direct refund of wagers (r 67(3)).
Audit reporting and post‑audit enquiries: The auditor must submit an audit report to the Director and the licence holder immediately after completion (r 41(1)(b)); the Director may require further information and licensees must comply unless they have a reasonable excuse (r 42). Non‑compliance attracts the standard maximum penalty applied elsewhere (r 42(2)).
Operational prohibitions and procedural enforcement: The Director may prohibit registration of certain individuals through notices to licensees (r 48). Where the Director gives a notice under the Regulations (for example requiring additional information under r 10(2), or approving a place to keep records under r 43), the licensee must comply; a failure to comply with such requirements is typically a penal offence under the specific regulation (e.g. r 37(5)).

Investigatory and information powers

Requirements for information and testing: The Director may require applicants and licensees to provide further information, allow tests to be carried out on systems (r 10(2)), and file consents enabling inquiries into criminal and financial background (r 14(2)(g)). Under r 16 the Director can investigate matters beyond those specified in r 15, can request third parties to supply information or attend interviews (r 16(3)(a)), and can make inquiries outside Australia (r 16(3)(b)). A failure to comply with a request may be taken by the Director as sufficient grounds to refuse a licence (r 16(4)).

Procedural protections and disclosure of reasons

Reasons and resubmission: Where the Director refuses approval of a control system or a computer system, the notice must state reasons (r 4(5), r 10(6)). If rectification is readily available, the Director must explain how to change the submission and invite resubmission (r 10(7)). Applicants refused a key employee licence may request reasons within 14 days and the Director must provide written reasons promptly (r 17(7)-(8)).

Enforcement architecture: who enforces and who pays

The Director is the primary enforcer. Enforcement action may take the form of direction, suspension, licence cancellation, cancellation of approvals, and prosecution for contraventions carrying monetary penalties. The licensee ordinarily bears the financial cost of compliance: audit fees are at the licensee’s expense (r 40(b)), system evaluation costs may be required to be paid by the licensee before testing (r 4(3)), and application fees are payable for licence applications (r 14(2)(h); r 71).

Practical enforcement implications

Many offences are framed with a uniform penalty maximum (15 penalty units), signalling consistency of enforcement but not differentiating between minor and major breaches. The Director’s broad discretion to approve, require further information, test systems, and to direct changes means administrative compliance is a key enforcement mechanism. Regulatory action for staff (key employees) operates both through pre‑employment vetting and post‑grant review and sanctions (rr 14-17, 29-34). The use of audit and financial institution approvals channels ongoing oversight through third parties: auditors must send copies of audit reports to the Director (r 41) and approved financial institutions host licensee accounts (r 38).

In summary, the Regulations combine criminal penalties measured in penalty units with administrative and supervisory enforcement powers vested in the Director, backed by mandatory audit, reporting and recordkeeping requirements that create recurrent compliance costs for licensees.

The Regulations explicitly and implicitly cross‑refer to other statutes and legal frameworks that affect the allocation of duties and the identity of regulated actors.

Gaming Control Act 1993 (the Act): The Regulations are made under the Act (see the formal header) and frequently cross‑reference it. For example, an “internet gaming licence” is a licence granted under Division 5 of Part 4 of the Act (reg 2). The Regulations defer to the Act for the regime governing licensing, inspectors and the Director’s general powers (e.g. references to section 47P of the Act at reg 13(3)). The Regulations implement operational detail under the Act’s licensing framework.
Corporations Act 2001: Auditing obligations require a company auditor “registered under Part 9.2 of the Corporations Act 2001” to conduct the required audits (r 40). This imports audit professional standards, registration requirements and statutory duties from the federal Corporations Act into the compliance chain of internet gaming licensees. It places auditors under federal regulatory frameworks when auditing licensees.
Criminal Records (Spent Convictions) Act 1992: Regulation 15(1)(e) requires the Director to assess whether an applicant "has, subject to the Criminal Records (Spent Convictions) Act 1992, not been found guilty of" certain offences. That cross‑reference imports the regime governing spent convictions into the fitness and propriety assessment for key employee applicants, and determines whether historical convictions must be disregarded.
Laws about retention and destruction of records: The Director’s power to approve destruction of gaming records under r 43(1)(e) is exercised "subject to any other law about the retention or destruction of the gaming record" (r 43(3)). Regulation 45(3) similarly makes record retention obligations subject to any other law. This leaves open interaction with federal or other Territory laws on retention of financial, tax or crime‑related records, which would prevail or constrain disposal authorised by the Director.
Revenue unit and penalty unit frameworks: The Regulations use "revenue units" for fees (r 14(2)(h): 285 revenue units; r 23(3)(a): 285 revenue units; r 71: 20 000 revenue units for an internet gaming licence application) and use "penalty units" to quantify fines (commonly 15 penalty units). The value of the revenue unit and the monetary value of a penalty unit are determined by separate fiscal and statutory instruments (not contained in the Regulations themselves). The endnotes indicate subordinate legislation and amendments (e.g. Treasury Legislation Amendment (Revenue Units) Regulations 2006) that bear on those units; those instruments determine actual monetary amounts licensees and applicants must pay and fines they may face.
Corporations and insolvency laws: Regulation 29(1)(e) lists bankruptcies and assignments of remuneration as grounds that trigger the Director’s obligation to conduct a review of a key licence holder. Thus federal bankruptcy and insolvency laws operate as triggers in the fitness and propriety regime.
Administrative law and natural justice: Although the Regulations do not set out a full merits appeal, they require written notices, give applicants rights to receive reasons for refusal and provide a notice and opportunity to make submissions before review (rr 17(6)-(8), 31-32). These procedural requirements intersect with general administrative law principles, judicial review and potential statutory appellate paths under the Act for decisions taken by the Director.
International and interstate inquiries: The Director’s investigative powers expressly allow inquiries in a State, another Territory or outside Australia (r 16(3)(b)). This creates a mechanism for cross‑border information gathering but will interact with foreign data protection, privacy or mutual legal assistance regimes where applicable.
Corporations and contract law for agents and service providers: The Regulations require the control system to specify the terms and conditions under which agents are engaged and reporting lines (r 6(e)(iv)). That links the regulatory approval of the control system to the commercial contracts between licensees and agents; contract and corporate law will therefore govern the performance and liabilities of agents.
Criminal law: Several regulations reference offences and criminal convictions as disqualifying factors in key employee assessments (r 15(1)(e) lists offences involving dishonesty, offences under the Act, offences regarding drugs, and offences punishable by five years or more). Criminal prosecutions for offences under federal or Territory criminal law remain possible where conduct crosses into criminality beyond regulatory penalties set out in these Regulations.

Taken together, the Regulations do not operate in isolation. They import federal auditing standards, cross‑refer to spent convictions law, refer to bankruptcy and insolvency as fitness criteria and rely on separate fiscal and penalty‑unit instruments to set monetary amounts. They also create interfaces with administrative law and with foreign information regimes where the Director exercises investigative powers outside the Territory.

The instrument includes a recorded set of amendments and related subordinate instruments in the endnotes. The Regulations were originally made as Gaming Control (Internet Gaming) Regulations (SL No. 64, 1998), notified and commenced 13 January 1999. The endnotes list a sequence of legislative and subordinate legislation changes that affected wording, fees or cross‑references. The amendments recorded in the endnotes indicate periodic updating of penalty, fee and cross‑statutory references. Key entries in the endnotes include:

Corporations Reform (Consequential Amendments NT) Act 2001 (Act No. 17, 2001) , this Act’s commencement is recorded and it is cited as having amended r 40 by referencing auditors registered under the Corporations Act 2001 (endnotes list r 40 amended by Act No. 17, 2001, s 22).
Statute Law Revision (Financial Provisions) Act 2002, Treasury Legislation Amendment (Revenue Units) Regulations 2006, Fees and Charges Amendment Regulations 2009: these instruments relate to revenue units and fees which directly affect application fees and charges noted in the Regulations (endnotes refer to revenue unit adjustments in rr 2, 3-5 etc).
Gaming Control (Internet Gaming) Amendment Regulations 2013 (SL No. 11, 2013): This subordinate instrument inserted reg 71 prescribing a fee of 20 000 revenue units for an application for an internet gaming licence (endnotes: r 71 ins No. 11, 2013, r 3).
Penalties Amendment (Miscellaneous) Act 2013 (Act No. 23, 2013): This Act amended several regulations, including penalty provisions and rewordings across multiple regs as reflected in the list of amendments (endnotes show many regs amended by Act No. 23, 2013, s 6).
Licensing (Repeals and Consequential Amendments) Act 2014 and Licensing (Director-General) Repeal Act 2020: These Acts effected structural changes affecting regulatory references and were applied to multiple regulations (endnotes show many regs amended by Act No. 44, 2014, s 145; Act No. 4, 2020, s 87). The Repeal Act 2020 commenced on 14 April 2020.
Statute Law Revision Act 2017: Noted in endnotes as making formal amendments to selected regs.

The endnotes list general amendments of a formal nature made by the Interpretation Legislation Amendment Act 2018 to rr 1 and 15.

What these amendment entries show practically is that the Regulations have been periodically aligned with federal reforms (Corporations Act matters), updated for fee and revenue unit frameworks, and adjusted for changes in the licensing architecture (through the Licensing Acts). The endnotes are explicit about which regulation numbers were amended and by which Act or subordinate instrument. For precise historical text changes, the amendment instrument cited should be consulted. The Regulations’ current in‑force text as provided is “as in force at 14 April 2020”, and the endnotes record amendments up to that date.

The recorded amendment history indicates recurring points of interaction: auditor requirements aligned with the Corporations Act, fee structures updated via revenue unit regulations, and penalties or formal wording revised in light of wider penal amendments. For practitioners handling historical compliance or transitional matters, the endnotes identify which instruments altered which regulations and where to look for legislative history.

The text of the Regulations as supplied does not contain or cite any judicial decisions, reviews or litigation outcomes. There are no cases named in the instrument, and the endnotes do not list any judicial determinations. Therefore, within the scope of this instrument and the provided material:

No judicial or tribunal decisions are cited in the Regulations themselves.
No litigation history, case law or appeals about the meaning, application or constitutionality of these Regulations is recorded in the source material provided.

Practitioners seeking to locate litigation or administrative review outcomes involving these Regulations will need to search court and tribunal databases and administrative law records for decisions involving the Director’s actions (approvals, refusals, cancellations, reviews under rr 29-34) or prosecutions under the Regulations. The Regulations set out administrative decision processes and rights to reasons in some contexts (e.g. r 17(7)-(8)), which are features often litigated in administrative law; however, neither the Regulations nor their endnotes include any reference to cases or litigation outcomes.

Absent statutory citations to cases, any assessment of how courts have interpreted specific provisions (for example the scope of the Director’s discretion, the meaning of “approved control system”, or the procedural fairness owed in reviews) must be founded on external case law searches. The Regulations do not themselves provide precedent or judicial guidance.

This section highlights procedural and substantive traps in the Regulations that commonly produce compliance failures or unexpected legal exposure. Each point is tied to the text.

Operating outside approved systems is an offence with modestly severe maximum penalties: Licensees must not conduct internet games except under the approved computer system and approved control system (r 5(1), r 7). A licensee who deploys software updates without Director approval risks contravening r 5(2), which carries the same maximum penalty (15 penalty units). Mechanism: approvals can be required for any change, and the Director’s prior approval is necessary unless a direction under r 11 applies.
Director discretion and information demands can delay operations: The Director may require testing and charge the licensee for reasonable evaluation costs before evaluating a proposed computer system (r 4(2)-(3)) and may require further information for control system submissions (r 10(2)). Mechanism: the Director can defer decision until tests are run and information is provided, which may slow deployment or software patching.
Key employee licensing is document‑intensive and invasive: Applicants must provide fingerprint/palm print verification, provide consents for criminal history and financial background checks, and be the subject of interstate and international inquiries (r 14(2)(f)-(g), r 16(3)(b)). Mechanism: onboarding and staff mobility timelines can be lengthy; failure to notify material changes during application carries a penalty (r 14(3)) and may result in refusal.
Provisional licence limits and application timing: Where certain disqualifying facts exist the Director may grant only provisional licences of up to 12 months (r 18). If a provisional licence holder applies for a full licence, the Director may waive many application requirements but will assess conduct during the provisional period (r 21(4)-(5)). Mechanism: firms that rely on temporary staff should be aware of the provisional regime and renewal timings.
Audits must be by a Corporations Act registered company auditor: The audit requirement references a company auditor registered under Part 9.2 of the Corporations Act (r 40). Mechanism: licensees cannot simply appoint any accountant; the audit must be completed within periods specified in the approved control system and the report delivered to the Director immediately (r 41(1)), creating scheduling constraints.
Players’ funds and remittance timing have conditional flexibility: The licensee must remit funds to a player on request “as soon as practicable” (r 53(1)), but may take reasonable time before remitting for verification and internal procedures (r 53(3)). Mechanism: disputes can arise when players expect immediate withdrawal; “as soon as practicable” is fact sensitive and can lead to complaints if licence control systems permit extended hold periods.
Wager limit increases are delayed 7 days and revocations may be halted: When a player increases or revokes a limit under r 57(1), the notice takes effect only after 7 days and provided the player has not notified an intention to withdraw the notice. Conversely, reductions take effect immediately (r 57(3)-(4)). Mechanism: software and control systems must implement these timing rules precisely or risk accepting wagers contrary to set limits.
Minors’ prohibition coupled with ‘no reason to believe’ defence: The offence provisions prohibiting minors from conducting operations or playing include the defence that the defendant had no reason to believe the person was a minor (r 59(2), r 60(2)). Mechanism: licensees must maintain robust verification systems and document steps taken; otherwise reliance on the defence is riskier.
Record retention exceptions depend on other law: The 7‑year retention requirement can be displaced only if information is kept in an “approved way” or if the record has been destroyed as approved. But r 43(3) and r 45(3) make retention subject to “any other law about the retention or destruction of the gaming record,” creating potential conflicts with tax, privacy or foreign data laws. Mechanism: record management policies must reconcile multiple legal regimes.
Confidentiality exceptions are broad: Disclosure of player identity is prohibited except if authorised by the player, reasonably necessary for conduct of games, required for administration or enforcement of the Act/Regulations, or otherwise required by law (r 70(2)). Mechanism: licensees must be able to justify disclosures under one of these grounds or risk a penalty.
Director’s notice may prohibit registration of specific persons: The Director may notify a licensee to prohibit registration of named persons and the licensee must comply (r 48). Mechanism: a licensee’s customer onboarding processes must integrate real‑time checking against Director prohibitions to prevent prohibited registrations.
Forfeiture of prizes won by minors: If a minor participates contrary to r 60, a prize won is forfeited to the Territory (r 60(7)). Mechanism: where verification fails or is delayed, licensees may find themselves having to forfeit prizes and handle player disputes.
Fee quantum is in revenue units: Fees are expressed in revenue units (r 14(2)(h); r 23(3)(a); r 71). Practical cost depends on separate revenue unit instruments and the current conversion, so budget planning must account for changes in revenue unit valuation and fee schedules set by separate subordinate instruments.
Statutory language often requires Director specifications: Numerous duties require compliance “in accordance with the approved control system” (e.g. r 52, r 53(2)) or “in an approved manner” (r 53(2)(a)), meaning that much practical detail is delegated to a licence holder’s approved control system which itself is subject to Director approval. Mechanism: licensees must ensure approved control systems are sufficiently detailed and aligned with operational reality because deviations will amount to contraventions.

These “gotchas” are not legal conclusions but practical compliance risks arising from the Regulations’ structure. They primarily affect operational timelines, staff onboarding, systems testing and verifications and require licence holders to pre‑empt Director scrutiny in documentation, data handling, testing procedures and customer processes.

This final section sets out a compliance roadmap, mapping each major regulatory obligation into operational steps and documenting checkpoints tied to specific regulations. The steps are practical and structured by topic.

Governance and control systems (regs 6-11)

Action: Prepare a single, comprehensive control system document that includes all matters listed in reg 6(2): accounting systems and chart of accounts, administrative procedures, software and hardware inventories, hold percentage procedures, data integrity and security procedures, prize payment and player account processes, organisational charts with job descriptions, chain of authority and agency agreements where agents are used.
Checkpoints: Ensure the control system explicitly designates “key positions” in the organisational chart (r 12(1)(c)). Include terms for any agents (r 6(e)(iv)).
Filing: Submit the control system as a formal submission to the Director under r 8(1)-(2). Expect to provide further information or allow testing per r 10(2)(a)-(b). Implement any Director direction to change the control system under r 11(1) within the time specified.

Computer system approvals (regs 4-5)

Action: Compile technical documentation on hardware, software, security, redundancy, backup, disaster recovery and game continuity plans. Demonstrate how the system enables resumption of interrupted games (r 65(1)).
Checkpoints: Budget for evaluation costs; the Director may require payment of reasonable evaluation costs before evaluation (r 4(3)). Be prepared to allow tests.
Change control: Implement strict change‑control procedures so that any change to the approved computer system triggers a written application for approval under r 4(1)(b) or is made in accordance with a Director direction (r 5(2), r 9).

Key employee licensing and HR processes (regs 12-24)

Action: Identify positions that are “key” under r 12 and ensure job descriptions in the approved control system reflect the responsibilities. For each occupant, check whether they must hold an internet gaming key employee licence (r 13).
Application process: For each applicant, collect the documentation required by r 14(2): employer certificate of engagement and probity checks, statutory declaration verified supporting documents, identification documents, evidence of name changes, three passport photos, police verification that fingerprints/palm prints were taken (r 14(2)(f)), consents to criminal and financial checks and payment of the required fee (r 14(2)(h)).
Timing: Notify applicants to supply updated particulars while application pending (r 14(3)). Where the Director requests further information under r 16, supply consents and authorities for third party inquiries promptly.
Provisional licences: If the applicant falls within r 18(1)(a)-(d), expect the Director to issue a provisional licence for up to 12 months and plan for further review before the provisional licence expires (r 19-21).
Compliance: Ensure licence holders are aware of their obligation to comply with the Act, the Regulations, lawful directions by inspectors and procedures in the approved control system (r 17(5)).

Financial controls, bank accounts and audit (regs 35-42)

Action: Maintain accounting records that allow preparation of true and fair financial statements and convenient audit (r 35). Prepare balance sheet, profit and loss and trading accounts as applicable (r 36).
Banking: Establish approved accounts at an approved financial institution as prescribed by the Director (r 3, r 38). Use accounts only for approved purposes (r 39).
Audit: Appoint a company auditor registered under Part 9.2 of the Corporations Act early, align audit timetable with the approved control system (r 40-41), and ensure the audit report is sent to the Director immediately on completion (r 41(1)(b)). Budget for auditors’ fees; the audit is at the licensee’s expense (r 40(b)).
Reporting: Implement procedures to respond to Director requests for reports or further information under r 37 and r 42, and ensure records are kept accessible.

Player registration, accounts and funds handling (regs 46-55)

Action: Implement a player onboarding process using the approved registration form (r 47(2)) and ensure licensee systems prevent unregistered players from participating (r 46).
Account mechanics: Establish and maintain individual players’ accounts (r 50(1)-(3)). Credit funds received or owed immediately; debit losses per play rules (r 50(4)). Build automatic procedures to close accounts and remit credit in the approved manner when directed (r 50(5)-(6)).
Payments: Ensure the approved control system contains detailed identity, age and residence verification steps; payments from player accounts must not be made until verification is completed (r 52). Build customer identity verification (KYC) processes into onboarding and withdrawal flows.
Withdrawals: Implement operational rules to remit funds “as soon as practicable” but allow time for verification, confirming games, security checks and compliance with approved prize rules (r 53(1)-(3)). Document acceptable “approved manner” for remittance and publish this within the approved control system (r 53(2)).

Responsible gambling measures and minors (regs 56-61)

Action: Prohibit offering credit and acting as agent for credit providers (r 56(1)-(2)). For credit card payments, set and enforce per‑player maximums in accordance with the approved control system (r 56(3)).
Limits and self‑exclusion: Provide functionality for players to set wagering limits via written or electronic notice (r 57(1)). Program timing rules: reductions take effect immediately, increases or revocations take effect only after 7 days unless the player withdraws the notice before that period ends (r 57(3)-(4)). Implement self‑exclusion and permanent de‑registration options, with prompt removal within 24 hours and require Director approval for re‑registration (r 58(1)-(2)).
Minors: Apply strict age verification to prevent minors from participating or working in gaming operations (rr 59-60). Provide publicly accessible software tools at the licencee’s internet site to allow adults to restrict site access from their computers (r 61). Document steps taken to restrict minor access and retain audit evidence.

Technology, continuity and incident response (regs 65-67)

Action: Build technical architecture to support resumption of interrupted games, including session state persistence and reconnection protocols (r 65(1)). If resumption is not feasible, ensure automatic termination rules are implemented and refund workflows trigger to return wagers to the player’s account (r 65(2)).
Incident handling: Develop incident reporting procedures that trigger immediate Director notification if a miscarriage of a game occurs due to the licensee’s systems (r 66(1)(b)). Have pre‑planned responses to refrain from further games when recurrence is likely (r 66(1)(c), r 66(3)).
Illegal activity: Create monitoring and fraud detection capabilities. If illegal activity is suspected and the licensee withholds prizes, immediately inform the Director and follow subsequent directions (r 67(1)-(4)).

Records and data retention (regs 43-45, r 70)

Action: Maintain gaming records at the public office or at a Director‑approved place (r 44(1)). For specified records that may be kept elsewhere temporarily, maintain a documented Director approval and time limits (r 43(1)(c)).
Retention period: Retain gaming records for seven years after the end of the transaction to which they relate (r 45(1)), unless information is kept in another approved form or destroyed as approved (r 45(2)).
Confidentiality: Implement policies to ensure player identity information is not disclosed or used for other purposes except as authorised (r 70(1)-(2)). Where disclosure is required (e.g. law enforcement), maintain records explaining the basis for disclosure.

Compliance monitoring and internal controls

Action: Implement internal compliance function responsibilities in the approved control system, including chain of authority and secondary supervisory positions (r 6(e)(iii)). Document training, counselling and retraining regimes so the licensee can demonstrate compliance with r 34(1)(c) if the Director demands retraining for key employees.
Controls testing: Schedule periodic penetration testing and controls verification to support system approvals. Retain evidence of tests and of Director approvals for system changes (r 10(2)(b)).

Administrative and fee procedure

Action: Prepare application budgets for the internet gaming licence application fee (r 71 , 20 000 revenue units) and for key employee licences (r 14(2)(h): 285 revenue units), plus smaller fees for licence variations or replacements (r 24(2)(c), r 25(2)(c)). Confirm current revenue unit conversion rates under the Treasury regulations that set revenue unit values.
Notices and reasons: If a licence or approval is refused, the Director must give written reasons. Where refused, make timely requests for reasons (rr 4(5), 10(6), 17(7)-(8)) and prepare for any resubmission by addressing the points identified by the Director (r 10(7)).

Dispute handling and engagement with the Director

Action: Draft formal procedures for handling player disputes and prize claims, including timelines to attempt rapid resolution and to issue notices informing claimants of the right to request Director review (r 63(1)-(3)). Keep logs of communications to demonstrate compliance.
Engagement: Maintain a compliance liaison point for the Director’s office and for auditors; ensure prompt responses to notices and inquiries (e.g. r 10(2)(a), r 16(3)(a), r 37(1)). Documented cooperation reduces the risk of refusal on grounds of non‑cooperation (r 16(4)).

Operational checklist summary (minimum viable compliance)

Submit control system and computer system for prior approval; budget for evaluation and testing (rr 4, 8-11).
Identify key positions and ensure all incumbents hold internet gaming key employee licences before performing duties; collect required documentation and consents (rr 12-17).
Appoint an auditor registered under the Corporations Act and schedule annual audits; maintain true and fair financial statements (rr 35-41).
Set up approved bank accounts with an approved financial institution and segregate player funds (rr 3, 38-39, 50).
Implement KYC and age verification processes for onboarding and withdrawals; build self‑exclusion and limit change flows with required timing (rr 50, 52-53, 57-58).
Develop incident response plans including Director notification processes for miscarriages and suspected illegal activity (rr 66-67).
Maintain records for seven years at the public office or an approved location and implement data confidentiality controls (rr 43-45, 70).
Keep internal control documentation aligned with the approved control system and retain evidence of compliance with Director directions, testing and audits.

Concluding compliance note: The Director’s approvals and directions are pervasive and many operational duties are expressed as compliance “in accordance with the approved control system” or “in an approved manner” (e.g. r 52, r 53(2)). Therefore a practical compliance strategy must treat the approved control system not as mere paperwork but as the operational blueprint that will be scrutinised, tested and enforced. Maintain contemporaneous evidence of compliance, keep prompt channels to respond to Director queries and audits, and design systems to enforce the rules for player limits, identity verification and minors’ protections automatically.

GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998

Plain English Summary

Deep Dive

What it does

Current sections

GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998

Source text: opening excerpt

1 GAMING CONTROL (INTERNET GAMING) REGULATIONS 1998

Main concepts

Who it affects

Key duties and rights

Penalties and enforcement

How it interacts with other laws

Amendment history

Litigation history

Gotchas

How to comply