A facility operator shall maintain complete, accurate, and legible books and records of all transactions pertaining to the revenues and expenses of a facility. General ledger books and records shall be maintained on a double entry system of accounting with transactions recorded on a basis consistent with generally accepted accounting principles in the United States. Subsidiary ledgers books and records supporting general ledger records shall be prepared in accordance with generally accepted accounting principles in the United States. Subsidiary ledgers and books and records shall include, at a minimum, documents that: Support the financial statements and all transactions impacting the financial statements including contracts or agreements with manufacturers, contractors, and management companies; Identify for instant bingo machine on a week-to-date, month-to-date and year-to-date basis: Coin in; Coin out; Win amount; Win percentage; and Payout percentage; Identify all costs and expenses associated with the operation of a facility; Are prepared in compliance with the internal controls approved by the Commission under this chapter; and Relate to: Loans and other amounts payable by a facility operator; and Investments in property and equipment for the benefit of a facility. A facility operator shall provide a list and written description of forms or documents used in its instant bingo operations. A form or document, including stored data, shall have: All information placed on the form or document recorded in ink or other permanent form; and The title of the form or document and the name of the facility imprinted or preprinted on it. A facility operator shall develop a written description of its administrative and accounting procedures including the system of internal controls over instant bingo operations. A facility operator’s internal controls are subject to review and approval under this regulation. Internal controls shall, at a minimum, include: Administrative controls and record keeping that document the authorization of transactions; Accounting controls that provide reasonable assurance that: Transactions or financial events which occur in connection with instant bingo operations are: Executed in accordance with the facility operator’s authorization protocols; Recorded to permit preparation of financial statements in conformance with generally accepted accounting principles in the United States and the requirements of this chapter; and Recorded to permit proper and timely reporting and calculation of proceeds and to maintain accountability for assets; Access to assets is permitted only in accordance with the facility operator’s authorization protocols; and The recorded accountability for assets is compared with existing assets at reasonable intervals and appropriate action is taken with regard to a discrepancy; Procedures and controls for ensuring: That an instant bingo machine accurately and timely communicates all required activities and financial details to the instant bingo validation and accounting system; That all functions, duties and responsibilities are segregated and performed in accordance with sound financial practices by qualified personnel; and Through the use of a surveillance and a security department, that the facility is secure at all times during normal operation and during any emergency due to malfunctioning equipment, loss of power, natural disaster or any other cause; Access controls which address, at a minimum: Content of, and administrative responsibility over, the manual or computerized access control matrix governing employee access to restricted areas; Issuance of a temporary access credential; and Comprehensive key controls; A record retention policy; Procedures and controls over the movement of cash and the count room; Procedures and standards for conducting internal audits; and Other procedures and controls the Commission may require to be included in a facility operator’s internal controls. A facility operator shall maintain, in hard copy or electronic form, all superseded internal controls for at least five years subsequent to the date the internal controls were superseded. A facility operator shall submit its internal controls to the Commission for review and written approval. If the Commission determines that a submitted internal control is deficient, the: Commission shall provide the facility operator with written notice of the deficiency; and Facility operator shall revise the internal control as appropriate and resubmit it to the Commission for review. A facility operator’s initial internal controls submission and a change or amendment to its approved internal controls shall be reviewed and approved in accordance with a process and time frame developed and implemented by the Commission. The process developed by the Commission under §C of this regulation shall, at a minimum, require the facility operator to: Submit a redlined copy of any section of the approved internal controls to be changed or amended with added text underlined and deleted text lined out; Document on the redlined copy the date the Commission approved the section to be changed or amended and the date the revision was submitted to the Commission for review; Submit a narrative explaining the reason for the change or amendment which includes the facility operator’s target date for implementation; Maintain a log of all changes or amendments in approved internal controls which includes the initial approval date and the effective date of any change or amendment approved by the Commission; and Mark each page of approved internal controls with the date on which it was approved by the Commission. The Commission may require a facility operator to submit monthly, quarterly, and annual reports of financial and statistical data. Reports required under this regulation shall be in a form and submitted in accordance with a time frame specified by the Commission. The Commission may, on written notice to a facility operator, require an interim report to be submitted in a form and in accordance with a time frame specified by the Commission. A facility operator who operates more than ten instant bingo machines shall cause its annual financial statements to be audited in accordance with generally accepted auditing standards by an independent certified public accountant. The annual financial statement shall include the method of calculation and a statement of the gross receipts subject to the admissions and amusement tax. The annual financial statements shall be prepared on a comparative basis for the current and prior fiscal year and present financial position and results of operations in conformity with generally accepted accounting principles in the United States. The audited financial statements shall include a footnote reconciling and explaining any difference between the financial statements included in any report submitted to the Commission under Regulation .05 of this chapter and the audited financial statements. With regard to adjustments resulting from the annual audit. a facility operator shall: Disclose to the Commission all adjustments, whether or not recorded in the accounting records; and Record the adjustment in the accounting records of the year to which the adjustment relates. Not later than 120 days after the end of its fiscal year, a facility operator shall submit to the Commission: A copy of its audited financial statements; and Any management letter or report prepared with regard to the financial statements by its independent certified public accountant. A facility operator shall prepare a written response to the reports required by §E of this regulation which includes details as to any corrective action taken. A facility operator shall submit a written report to the Commission if an independent certified public accountant who is engaged as the principal accountant to audit its financial statements: Resigns; Is dismissed as the facility operator’s principal accountant; or Is replaced by another independent certified public accountant as principal accountant. A report that is required to be filed under §G of this regulation shall include: The date of the resignation, dismissal, or new engagement; Whether in connection with the audits of the 2 most recent years preceding a resignation, dismissal or new engagement there were any disagreements, resolved or unresolved, with the former accountant on: Accounting principles or practices; Financial statement disclosure; or Auditing scope or procedure; The nature of any disagreement disclosed in §H(2) of this regulation; Whether the principal accountant's report on the financial statements for either of the past two years contained an adverse opinion, disclaimer of opinion or was qualified; The nature of any adverse opinion, disclaimer of opinion or qualification; and A letter from the former principal accountant addressed to the Commission stating whether the principal accountant concurs with the statements made by the facility operator in the report to the Commission submitted under this section. A report required to be filed under §G of this regulation shall be submitted to the Commission not later than 10 days after the end of the month in which the resignation, dismissal or new engagement occurred. A facility operator shall develop written record retention procedures for its instant bingo machine operations. All original books and records shall be: Prepared and maintained in a complete, accurate, and legible form; Stored in a format that ensures readability, regardless of whether the technology or software that created or maintains it has become obsolete; Retained in a secure location equipped with a fire notification system at: The facility; or An off-site location approved by the Commission for the express purpose of document storage; Kept immediately available for inspection by the Commission during all hours of operation; Organized and indexed in a manner designed to provide immediate accessibility to the Commission; and Destroyed only after expiration of the minimum retention period required under this regulation. On submission of a written request by a facility operator, the Commission may, authorize destruction prior to the expiration of the minimum retention period required under this regulation. Unless a request for destruction is submitted in writing and approved in writing by the Commission, a facility operator shall retain indefinitely original books and records documenting: Ownership of the facility; Internally initiated investigations and due diligence; Personnel matters; Destruction of documents including: The identity of the document; Period of retention; and Date of destruction. Unless a request for destruction is submitted in writing and approved in writing by the Commission, a facility operator shall retain for a minimum of five years all original books and records. Nothing in this regulation shall be construed as relieving a facility operator of any obligation to prepare or maintain books and records required by any other federal, State, or local governmental entity. For the purposes of this regulation, the title used to describe a department head is intended to indicate responsibility for the functions of the enumerated department and does not obligate the facility operator to use that particular title. Subject to the requirements of this regulation, a facility operator shall tailor its table of organization to meet its needs and policies. A facility operator shall submit to the Commission for review and written approval a table of organization depicting all direct and indirect reporting lines for instant bingo operations: A facility operator’s table of organization shall include: A system of personnel and chain of command which permits management and supervisory personnel to be held accountable for actions or omissions within their areas of responsibility; The segregation of incompatible functions, duties, and responsibilities so that no individual is in a position both to: Commit an error or to perpetrate a fraud; and Conceal the error or fraud in the normal course of the individual’s duties; The performance of all functions, duties and responsibilities by qualified personnel; Areas of responsibility which are not so extensive as to be impractical for one individual to monitor; and A General Manager: Based for employment purposes at the facility; Licensed as a principal employee; and Ultimately responsible for the daily conduct of all operations at the facility. A facility operator may not implement a change in the table of organization approved by the Commission under §D of this regulation without the prior written approval of the Commission. A facility operator shall ensure that an individual employed at the facility is trained in the policies, procedures, and internal controls relevant to the individual’s function. If there is a vacancy in the General Manager position: Not later than 5 days after the date of a vacancy, the facility operator shall notify the Commission in writing of: The vacant position; The date on which the position will become or became vacant; and The date on which the facility operator anticipates that the vacancy will be filled on a permanent basis; Not later than 30 days after the date of a vacancy, a facility operator shall fill the vacant position on a temporary basis; Not later than 120 days after the original date of the vacancy, a facility operator shall fill the vacant position on a permanent basis; and Not later than 5 days after filling a vacancy, a facility operator shall notify the Commission in writing of: The vacant position filled; The name of the individual designated to fill the position; The date that the vacancy was filled; and Whether the vacancy has been filled on a temporary or permanent basis. A facility operator shall install in its facility a surveillance system that complies with the requirements of this regulation. A facility operator’s surveillance system shall be reviewed and approved by the Commission under Regulation .10 of this chapter. A facility operator’s surveillance system shall include: Light sensitive cameras that are: Enabled by lenses of sufficient magnification to observe instant bingo operations; Enabled by lighting which is continuous and of sufficient quality to produce clear video recordings and still pictures; and Configured to clandestinely monitor and record: Play and transactions conducted at instant bingo machines; Transactions conducted at cashier locations including the face of each individual transacting business with a cashier; Transactions conducted at automated teller machines; Activity in the count room; Movement of cash and cash storage boxes within the facility; Entrances and exits to the facility; Activities in all other restricted areas; and Other areas and events designated by the Commission; Digital video recording capability equipped to: Superimpose the date and time on all monitoring and recording; Identify and locate, through the use of a meter, counter, or other device or method, a particular event which was recorded; and Identify on video recording disks or other storage media the type of media player and software prerequisite to viewing the digital images. Except as provided in §E of this regulation, a facility operator shall retain surveillance recordings for a minimum of 7 days. Upon the request of the Commission or a law enforcement agency that has proper jurisdiction over the facility, a recording shall be retained and stored in accordance with the directives of the Commission or law enforcement agency pertaining to that recording. A facility operator shall provide the Commission with timely and unfettered access to its surveillance monitor room, surveillance system, and all transmissions. A facility operator shall comply in a timely fashion with a request from the Commission to: Use, as necessary, any monitor room in the facility; Display on the monitors in its monitor room any event capable of being captured by the surveillance system; Relinquish control of a camera or monitor; Discontinue monitoring a particular camera or recording activity captured by it; Make a video recording or photograph of any event capable of being captured by the surveillance system; and Restrict or deny access to a recording or photograph. A surveillance system may not be remotely accessed from a location outside the surveillance monitor room without the prior written approval of the Commission. A facility operator shall submit to the Commission for review and written approval its surveillance operating procedures. A facility operator’s surveillance operating procedures shall, at a minimum, require: Coverage of all areas and transactions enumerated in Regulation .09; Contingency plans addressing: Full and partial failure of the surveillance system including: A contact list with telephone numbers for individuals required to be notified in the event of a failure; and Facility closure protocols; and Planned shutdown of the surveillance system; A surveillance incident log: Maintained in: A book with bound numbered pages that cannot be readily removed; or An electronic format equipped with software that prevents modification of an entry after it has been initially entered into the system; and Documenting the scheduled coverage in §B(1) of this regulation and all other non-routine surveillance activity, such as: The date and time surveillance is commenced; The name of the individual initiating, performing, or supervising the surveillance; The reason for the surveillance; Whether the suspicious activity involves an alleged regulatory violation or criminal activity; The name, if known, alias or description of an individual being monitored; A description of the activity in which the individual being monitored is engaged; A reading on a meter, counter or device that identifies the point on the video recording at which the event was recorded; The time at which a video recording is commenced and terminated, if different than when surveillance is commenced or terminated; The date and time surveillance is terminated; A summary of the results of the surveillance; and A description of the time, date and cause of any equipment or camera malfunction which occurred during the conduct of surveillance; A facility operator may not implement a change or amendment in its surveillance system or surveillance operating procedures approved by the Commission without the prior written approval of the Commission. A facility operator shall submit to the Commission for review and written approval its security operating procedures. A facility operator’s security operating procedures shall, at a minimum, include: A security zone plan for the facility designed to ensure: The physical safety of employees and invitees to the facility; The safeguarding of assets; Compliance with all applicable laws and regulations including Commission approved internal controls and operating procedures; That intoxicated individuals are identified, prohibited from entering the facility and, if necessary, immediately removed from the facility; and That an individual under the age of 18 years is identified, prohibited from playing instant bingo and, if necessary immediately removed from the facility; and Procedures and controls addressing: Facility access controls including: An access badge or key system; If utilized, specifications pertaining to a computerized access control system; and Administrative responsibility over a manual or computerized access control system; A temporary access credential; Key controls; Emergency alarm and fire command responsibilities; Evacuation of the facility in the event of fire or other emergency; The identification and immediate removal of an intoxicated individual, and, if applicable, an individual under the age of 18 years; and The notice requirements of §(B)(4) of this regulation; A security incident log: Maintained in: A book with bound numbered pages that cannot be readily removed; or An electronic format equipped with software that prevents modification of an entry after it has been initially entered into the system; and Documenting: The assignment number of the incident; The date and time of the incident; The name of the person covering the incident; The nature of the incident; and The resolution of the incident; and A requirement that a facility operator notify the Commission upon detection of: An individual engaged in, attempting to engage in, or suspected of cheating, theft, embezzlement, or other illegal activities; and An individual who is: Under the age of 18 years and has played instant bingo; or Intoxicated. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .05 of this chapter procedures addressing physical access to the instant bingo validation and accounting system equipment located in the facility. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .04 of this chapter, procedures addressing the general conduct of cashiers’ transactions. A facility operator shall at all times maintain a reserve cash bankroll sufficient to pay all winning wagers. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .04 of this chapter, procedures addressing the payment of a jackpot or credit meter payout not totally and automatically paid by an instant bingo machine. A facility operator shall prepare and timely file IRS Form W-2G, Certain Gambling Winnings as required by the IRS. A facility operator shall pay a jackpot or credit meter payout of: $10,000 or more by check; and Less than $10,000 by: Cash or check; or Check on the request of a player. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .04 of this chapter, procedures addressing cash storage boxes to include: Access controls for cash storage boxes including: Key controls for access to cash storage box within instant bingo machines; Key controls for access to the currency contained within cash storage boxes; and A method for association of the contents of a cash storage box with an instant bingo machine. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .04 of this chapter, procedures addressing the collection of cash storage boxes including: An access control matrix indicating which employee positions are authorized to participate in the cash storage box collection process; and Details of the actual procedures to be performed and documentation to be generated by drop team employees collecting cash storage boxes. A facility operator shall develop and include in the internal controls submitted to and approved by the Commission under Regulation .04 of this chapter, procedures addressing the counting and recording of cash storage boxes. A facility operator’s internal controls shall: Detail the actual procedures to be performed and documentation to be generated by: Count team employees conducting the counting process; and The employee verifying and accepting the count; and Require two separate counts and, if the separate counts are not in agreement, document the discrepancy. A facility operator shall report in writing to the Commission within 72 hours of the count: Any variance greater than $20 between the actual count of cash, in a cash storage box as determined in the count room and the amount for that particular cash storage box recorded on the: Facility operator’s instant bingo machine; and The instant bingo validation and accounting system; The reason for the variance; and The corrective action taken or adjustments made. A facility operator shall attempt to timely resolve a dispute with a player concerning operation of an instant bingo machine or payment of alleged winnings. A facility operator who is unable to satisfactorily resolve a dispute with a player shall provide the player with a Commission player complaint form together with instructions for completing and submitting the form. The Commission shall investigate a complaint submitted to the Commission and notify the player and facility operator of its determination. A facility operator shall submit to the Commission for review and approval internal audit standards and procedures designed to test the facility’s compliance with its internal controls. Criminal Law Article, §§ 12-301. 1 and 12-308; State Government Article, §9-110; Annotated Code of Maryland Effective date: Regulations .01— .19 adopted as an emergency provision effective August 26, 2013 (40:20 Md. R. 1650); adopted permanently effective December 12, 2013 (40:24 Md. R. 2019) Regulation .06A amended effective October 22, 2018 (45:21 Md. R. 976) Regulation .14B amended effective May 25, 2026 (53:10 Md. R. 459)