# COMAR Title 36 — Maryland State Lottery and Gaming Control Agency

## Subtitle 10 — Sports Wagering Provisions

### Chapter 18 — Sports Wagering Technical Standards

**Authority:** State Government Article, §§9-1E-01—9-1E-15, Annotated Code of Maryland

**Administrative History:** Effective date:

**Administrative History:** Regulations .01—.06 adopted as an emergency provision effective August 5, 2021 (48:18 Md. R. 690); adopted permanently effective January 13, 2022 (49:1 Md. R. 16)

**Administrative History:** Regulation .04E amended effective April 27, 2026 (53:8 Md. R. 356)

**Administrative History:** Regulation .04E, F, G adopted effective July 7, 2025 (52:13 Md. R. 657)

**Administrative History:** Regulation .05N amended as an emergency provision effective January 26, 2022 (49:5 Md. R. 364); amended permanently effective July 25, 2022 (49:15 Md. R. 740)

**Administrative History:** Regulation .05F amended effective July 7, 2025 (52:13 Md, R. 657)

**Administrative History:** Regulation .06 amended as an emergency provision effective January 26, 2022 (49:5 Md. R. 364); amended permanently effective July 25, 2022 (49:15 Md. R. 740)

**Administrative History:** Regulation .06B amended effective April 27, 2026 (53:8 Md. R. 356)

#### Regulation .01 General.

*COMAR 36.10.18.01*

Unless context or the individual regulation dictates otherwise, for purposes of COMAR 36.10.18, “sports wagering licensee” includes:

A. Mobile sports wagering licensee;

B. Online sports wagering operator licensee;

C. Sports wagering facility licensee; and

D. Sports wagering facility operator licensee.

#### Regulation .02 Definition.

*COMAR 36.10.18.02*

In this chapter, “past posting” means a wager that was made after the result of an event is accepted or after the selected participant has gained a material advantage.

#### Regulation .03 Sports Wagering Platform Requirements.

*COMAR 36.10.18.03*

A. All sports wagers shall be initiated, received, and otherwise made within the State unless otherwise licensed by federal law.

B. A sports wagering licensee or applicant shall submit its sports wagering platform and sports wagering equipment to an independent certified testing laboratory prior to their use for sports wagering.

C. Sports wagering platform documentation shall include:

  (1) A complete, comprehensive, technically accurate description and explanation of the sports wagering platform;

  (2) A detailed operating procedures of the sports wagering platform; and

  (3) A description of the risk management framework, including:

    (a) User access controls for all sports wagering licensee personnel;

    (b) Information regarding segregation of duties;

    (c) Information regarding automated risk-management procedures;

    (d) Information regarding identifying and reporting fraud and suspicious activity;

    (e) Information regarding technical safeguards that protect the sports wagering platform from unauthorized access and loss of data;

    (f) Controls to ensure compliance with all statutory and other legal requirements;

    (g) A description of AML compliance standards;

    (h) A description of all software applications that comprise the sports wagering platform;

    (i) A description of wagers available to be offered by the sports wagering platform;

    (j) A description of all third-party systems proposed for utilization;

    (k) A description of the method proposed by the sports wagering licensee to prevent cheating; and

    (l) Any other information imposed by the Commission.

D. Upon request, a sports wagering licensee shall promptly provide the Commission with relevant reports and documentation that shall include, at a minimum:

  (1) Complete, comprehensive, technically accurate description and explanation of the sports wagering platform;

  (2) The ability to query or sort wagering data; and

  (3) The ability to export wagering data.

E. A sports wagering licensee or a supplier providing a licensee’s sports wagering platform shall maintain all transactional wagering data for a period of 5 years.

F. The house rules that apply to wagers placed on a sports wagering platform shall be readily available to a bettor.

G. For each wager, a sports wagering platform shall be capable of recording the:

  (1) Description and alphanumeric identifier of the sporting event;

  (2) Wager selection;

  (3) Type of wager;

  (4) Amount of wager;

  (5) Date and time of the wager;

  (6) Unique wager identifiers;

  (7) Bettor identification number;

  (8) Current wager status;

  (9) Relevant location information;

  (10) Results of the wager;

  (11) Amount won; and

  (12) Date and time the winning wager was paid to the bettor.

H. A sports wagering platform that offers wagering shall be capable of:

  (1) Accurately and timely updating of odds for wagers;

  (2) Notifying a bettor of any change in odds that is not beneficial to the bettor while the wager is selected but before it is placed;

  (3) Allowing bettors to confirm the wager after notification of the odds change; and

  (4) Freezing or suspending the offering of wagers when necessary.

I. A sports wagering platform shall be capable of:

  (1) Creating a wager;

  (2) Settling a wager;

  (3) Voiding a wager;

  (4) Cancelling a wager; and

  (5) Preventing the acceptance of a wager on a prohibited sporting event.

J. If a wager is voided or cancelled, a sports wagering platform shall indicate that:

  (1) The transaction was voided or cancelled;

  (2) The transaction was rendered nonredeemable;

  (3) An entry in the system was made indicating the wager was voided or cancelled; and

  (4) Subject to COMAR 36.10.13.07, the transaction is clearly noted in a permanent record.

K. Unless approved in advance by the Commission, a sports wagering licensee or an online sports wagering operator may not alter the odds or any other material aspect of the transaction after accepting a wager.

L. A sports wagering platform shall prevent:

  (1) The electronic modification of data to facilitate cheating;

  (2) The past posting of wagers; and

  (3) The voiding and cancellation of wagers after the outcome of an event is known.

M. If a bettor has a pending wager and the bettor subsequently self-excludes:

  (1) The wager may settle; and

  (2) The funds and account balance shall be returned to the bettor in accordance with the sports wagering licensee’s internal control standards.

N. Software Validation.

  (1) At least once every 24 hours and on demand, a sports wagering platform shall perform a software validation on all critical control program components contained on the system to ensure that:

    (a) There have been no unauthorized modifications; and

    (b) The software is authentic.

  (2) The software validation process shall employ a hash algorithm which produces a message digest of at least 128 bits and includes all critical control program components which may affect wagering operations, including but not limited to:

    (a) Executables;

    (b) Libraries;

    (c) Wagering or system configurations;

    (d) Operating system files;

    (e) Components that control required system reporting; and

    (f) Database elements that affect system operations.

  (3) In the event of a software validation failure, the sports wagering platform shall have the capability to detect if any system component is determined to be invalid.

O. The sports wagering licensee shall notify the Commission within 12 hours of a validation failure.

P. A sports wagering licensee shall:

  (1) Record all validation attempts by the sports wagering platform; and

  (2) Maintain the recorded attempts for a period of 180 days.

Q. Data Feeds.

  (1) A sports wagering platform shall have controls in place to review the accuracy and timeliness of any data feeds used to offer or settle wagers.

  (2) If an incident or error occurs that results in a loss of communication with the data feeds used to offer or redeem wagers, the sports wagering licensee shall record the error in a log capturing:

    (a) The date and time of the error;

    (b) The nature of the error; and

    (c) A description of its impact on the system’s performance.

  (3) The sports wagering licensee shall maintain the information required by §Q(2) for a minimum period of 2 years.

R. A sports wagering licensee that provides a sports wagering platform shall grant the Commission read only access to the platform in the manner required by the Commission.

S. In a format required by the Commission, a sports wagering platform shall provide a process for the Commission to query and export all sports wagering platform data.

T. The Commission may require additional system specifications.

#### Regulation .04 Geolocation Systems.

*COMAR 36.10.18.04*

A. A sports wagering licensee shall keep its geolocation system up to date by integrating current solutions in real time that can detect the use of:

  (1) Remote desktop software;

  (2) Rootkits;

  (3) Virtualization; and

  (4) Any other programs identified by the Commission as having the ability to circumvent geolocation measures.

B. The sports wagering licensee shall continually review the integrity of the geolocation system to ensure that the system detects and mitigates existing and emerging location fraud risks.

C. A sports wagering platform shall utilize a geolocation system to:

  (1) Reasonably detect the physical location of an individual attempting to access the sports wagering platform and place a sports wager; and

  (2) Monitor and block attempts to place an online sports wager when an individual is not within the State.

D. The geolocation system required by §C of this regulation shall:

  (1) Ensure that a bettor:

    (a) Is located within the State when placing a sports wager; and

    (b) Can dynamically monitor the bettors location; and

  (2) Block unauthorized attempts to place a sports wager when an individual is not within the State.

E. A sports wagering licensee shall:

  (1) Prior to commencing operations, and annually thereafter, ensure:

    (a) Its geolocation system is tested by a Commission approved testing laboratory; and

    (b) A report on the annual testing is submitted to the Commission no later than 120 days after the end of the licensee’s fiscal year;

  (2) Ensure that testing of the geolocation system includes:

    (a) Attempts to place wagers at locations from outside of the State from multiple locations within varying distances from the State border;

    (b) Attempts to place wagers at locations within the State from multiple locations within varying distances from the State border; and

    (c) Attempts to place wagers in which the tester crosses the State border;

  (3) For all geolocation testing, ensure that the frequency of geolocation check is documented and tested;

  (4) Ensure that testing confirms that a geolocation check occurs immediately upon a change of IP address;

  (5) Ensure that testing includes static and mobile connections; and

  (6) Ensure that testing is completed on all device types using the most prevalent versions available.

F. A sports wagering licensee shall grant the Commission read only access to its geolocation system as required by the Commission.

G. In addition to the requirements in this regulation, the Commission may require a sports wagering licensee to implement other geolocation features.

#### Regulation .05 Bettor Accounts.

*COMAR 36.10.18.05*

A. Only a registered bettor may place an online wager.

B. The sports wagering licensee shall record and maintain the information necessary to initiate a bettor account for a period of 5 years.

C. The information recorded and maintained under §B of this regulation shall include:

  (1) Bettors legal name;

  (2) Bettors date of birth;

  (3) Bettors residential address and mailing address if different;

  (4) Bettors phone number;

  (5) Bettors active email address;

  (6) Bettors social security number or equivalent as approved by the Commission;

  (7) Verification that the bettor is permitted to place a wager;

  (8) Sources of identification authentication, which may include:

    (a) Type and identification number of any government-issued credentials provided; or

    (b) Other methodology for remote, multi-source authentication including third-party and governmental databases, as approved by the Commission; and

  (9) Any other information required by the Commission.

D. A sports wagering licensee shall record:

  (1) A bettors acceptance of the sports wagering licensees:

    (a) Sports wagering terms and conditions; and

    (b) Privacy policy; and

  (2) The bettors acknowledgment that:

    (a) The bettor has provided the sports wagering licensee accurate information; and

    (b) The bettor is prohibited from allowing any other person to access or use the bettors bettor account.

E. Verification of Transactions on a Bettor Account.

  (1) For each deposit or withdrawal on a bettor account, a sports wagering licensee shall determine if the information provided by the bettor:

    (a) Is inconsistent with the funding information previously provided by the bettor;

    (b) Fails to verify the identity of the bettor; or

    (c) Violates the sports wagering licensees terms and conditions.

  (2) Within 24 hours after a condition set forth in §E(1) occurs, the sports wagering licensee shall require the submission of additional information from the bettor that:

    (a) Verifies the bettors:

      (i) Identity; or

      (ii) Fund deposit or withdrawal information; or

    (b) Remedies the violation of the sports wagering licensees terms and conditions.

  (3) If the information provided by the bettor pursuant to §E(2) of this regulation does not provide the proper verification or remedy the violation, the sports wagering licensee shall:

    (a) Immediately suspend the bettor account;

    (b) Prohibit the bettor from placing any wagers;

    (c) Submit any winnings attributable to the bettor to the Commission for distribution to the States Problem Gambling Treatment and Support Fund;

    (d) Refund the balance of deposits made to the account to the source of such deposit or by issuance of a check; and

    (e) Deactivate the account.

F. Creation of a Bettor Account.

  (1) A sports wagering licensee shall notify the bettor of the creation of the bettor account by email, text message, or first-class mail.

  (2) When a bettor account is created, the bettor or sports wagering licensee shall establish a unique username and password for the bettor authorized to use the bettor account that prevents unauthorized access to the bettor account by an individual other than the bettor.

  (3) A sports wagering licensee shall implement a required multi-factor authentication process for all bettor accounts.

  (4) A sports wagering licensee may use a multi-factor authentication process that uses a:

    (a) One-time password or code sent to a device or account that is confirmed to be owned by the owner of the bettor account;

    (b) Software token generated from an authentication application;

    (c) Face ID or fingerprint verification application; or

    (d) Different method approved by the Commission.

  (5) The bettor must successfully complete a multi-factor authentication at account creation before the bettor may access their account and for each new device used to login to the account.

  (6) The bettor must repeat multi-factor authentication at least every 14 days for each device.

G. A bettor may have only one bettor account for each sports wagering licensee.

H. A bettor account may be funded using:

  (1) A debit card;

  (2) A credit card subject to COMAR 36.10.13.28;

  (3) An electronic bank transfer, including a transfer through third parties;

  (4) An online or mobile payment system that supports online money transfers;

  (5) Winnings or payouts;

  (6) Bonuses and promotions;

  (7) Reloadable prepaid card, which has been verified as being issued to the bettor and is non-transferable; and

  (8) Any other means approved by the Commission.

I. Funds may be withdrawn from a bettor account through:

  (1) Cash;

  (2) Wagers;

  (3) A cashiers check, wire transfer, or money order by the sports wagering licensee made payable to the bettor that is:

    (a) Issued directly to the bettor; or

    (b) Delivered to the bettors address on file with the sports wagering licensee;

  (4) Credits to the bettors debit card;

  (5) Electronic bank transfers, including transfers through third parties;

  (6) Online or mobile payment systems that support online money transfers;

  (7) Reloadable prepaid card that:

    (a) Has been verified as being issued to the bettor; and

    (b) Is non-transferable; or

  (8) Any other means approved by the Commission.

J. Within 7 days of a bettor request for withdrawal of funds, the sports wagering licensee shall complete the withdrawal unless there is a pending:

  (1) Unresolved bettor dispute; or

  (2) Investigation prompted by a bettor dispute or the Commission.

K. Funds for withdrawal may be withheld from withdrawal until:

  (1) The funding transaction clears; or

  (2) The chargeback period ends.

L. All adjustments to a bettor account for:

  (1) Individual amounts of $500 or less shall be periodically reviewed by the sports wagering licensee consistent with the sports wagering licensees internal control standards; and

  (2) Individual amounts of more than $500 shall be authorized by the sports wagering licensees management before being entered.

M. A sports wagering licensee may not allow the transfer of funds or credits from or to another bettor account.

N. Except for the placement or settlement of a wager, unless the bettor has opted to not receive such notifications, the sports wagering licensee shall confirm each transaction on a bettor account by:

  (1) Email;

  (2) Text message; or

  (3) Other means:

    (a) Agreed upon by the bettor and sports wagering licensee; and

    (b) Approved by the Commission.

O. Account Statements.

  (1) A sports wagering licensee shall provide an account statement upon demand by the bettor.

  (2) An account statement shall include detailed account activity for at least 6 months preceding the 24-hour period before the request.

  (3) A sports wagering licensee shall be capable of providing a summary statement of all bettor activity during the previous 24 months if requested.

P. If a sports wagering licensee knows or has reason to know that a bettors identification or bettor account has been compromised, a sports wagering licensee shall:

  (1) Suspend wagers from being made; and

  (2) Immediately re-verify a bettors identification.

Q. A sports wagering licensee shall:

  (1) Offer an easily accessible method for a bettor to close the bettors account; and

  (2) Refund the balance remaining in a bettors account:

    (a) Pursuant to the sports wagering licensees internal control standards; and

    (b) No later than 7 days after receiving notice from the bettor of the intent to close the bettors account.

R. A sports wagering platform shall employ a mechanism that can detect and prevent any bettor-initiated activity that would result in a negative balance of a bettor account.

S. A sports wagering licensee shall:

  (1) Lock a bettors account after 3 failed log-in attempts; and

  (2) Require multi-factor authentication to recover or reset a password or username after being locked.

T. A sports wagering licensee shall suspend a bettor account if:

  (1) The bettor requests a suspension for a period not less than 24 hours as a self-limiting measure;

  (2) Required by the Commission;

  (3) The sports wagering licensee knows or has reason to know that the bettor may be a prohibited individual; or

  (4) The sports wagering licensee knows or has reason to know of:

    (a) Illegal activity related to the account;

    (b) A negative account balance; or

    (c) A violation of the sports wagering licensees terms and conditions has taken place on the bettors account.

U. When a sports wagering account is suspended, the bettor shall be prevented from:

  (1) Wagering;

  (2) Depositing funds, unless the reason for the deposit is to clear a negative balance that resulted in the suspension;

  (3) Withdrawing funds if there is a pending unresolved bettor dispute or investigation prompted by a bettor dispute or the Commission;

  (4) Making changes to the bettor account; or

  (5) Removing the bettor account from the sports wagering platform.

V. A bettor account suspended for a reason stated in §T of this regulation may be restored:

  (1) Upon expiration of the time period established by the bettor;

  (2) When the sports wagering licensee has determined that the Commission has granted permission for the restoration;

  (3) When the licensee has determined that the bettor is not a prohibited or excluded individual; or

  (4) When the sports wagering licensee has determined that:

    (a) No illegal activity related to the account occurred;

    (b) There is no longer a negative account balance; or

    (c) No violation of the terms and conditions that has taken place on the bettors account.

#### Regulation .06 Information Security.

*COMAR 36.10.18.06*

A. A sports wagering licensee shall:

  (1) Implement, maintain, regularly review and revise, and comply with a comprehensive information security system that reasonably protects the confidentiality, integrity, and availability of a bettor’s personally identifiable information; and

  (2) Ensure that the security system set forth in §A(1) of this regulation includes administrative, technical, and physical safeguards which:

    (a) Are appropriate to the size, complexity, nature, and scope of the operations; and

    (b) Protect the personal information owned, licensed, maintained, handled, or otherwise in the possession of the sports wagering licensee.

B. A sports wagering licensee shall:

  (1) Within 90 days of commencing operations, and annually thereafter, conduct a vulnerability assessment, penetration testing, and operational security control review against ISO 27001 standard, or other similar standards such as CIS or NIST CSF;

  (2) Perform vulnerability assessments and penetration testing of the sports wagering platform at multiple layers, including:

    (a) Internal and external network;

    (b) Mobile and web application;

    (c) Database;

    (d) Firewall;

    (e) If applicable, wireless; and

    (f) Any additional security testing that the Commission requires;

  (3) Ensure that a Commission approved third party described in Regulation .02B of this chapter conducts the testing required in §B(1) and (2) of this regulation;

  (4) Ensure that the annual reporting requirement required in §B(1)—(3) of this regulation is submitted to the Commission no later than 120 days after the end of the licensee’s fiscal year;

  (5) Perform internal quarterly vulnerability scans; and

  (6) Submit to the Commission documentation of the scan results and the actions taken to resolve identified vulnerabilities.

C. A sports wagering licensee shall submit to the Commission the assessment report issued by the third party and the licensee’s report.

D. The combined reports in §C of this regulation shall:

  (1) Provide details for all vulnerabilities identified;

  (2) Assess the adequacy and effectiveness of the sports wagering licensee’s information technology security controls and system configurations; and

  (3) Provide recommendations for eliminating each material weakness or significant deficiency identified.

E. A sports wagering licensee shall evaluate all identified vulnerabilities for potential adverse effect on security and integrity and:

  (1) Remediate the vulnerability no later than 90 days following the earlier of vulnerability’s identification or public disclosure; or

  (2) Document why remediation action is unnecessary or unsuitable.