Last month, I had the opportunity to share a panel with highly respected gaming industry stakeholders where we discussed the current state of operating and regulating Casino Management Systems (CMS). As part of the discussion, we also evaluated the advantages and efficiencies that off-premises hosting, change management program (CMP) and audit-based approach have brought to the newly developed iGaming and sports betting markets, and how these might be applicable to the land-based world. As the topic is still fresh in my mind, I wanted to expand the discussion by providing a more focused point of view on the similarities and differences between these operations and its applicable regulations.
UPDATING A CMS
At the beginning of the panel, we tried to present the current state of regulating CMS and the challenges that suppliers faced when modernizing systems in a casino due to maintenance, security updates and new features. From every perspective, updating a CMS can be different based on the specific supplier; however, even after taking this into consideration, our conclusions were unchanged. We agreed that these types of updates have been very challenging due to the inability to verify the changes in a live environment.
When a supplier is implementing changes to the system software without load testing, there are several aspects that may be missed. Picture a fully operating Casino Resort. Think of it as a very complex infrastructure where you have a mixture of several game suppliers (some may be new games, some may be very old games), different protocols based on the interfaces used to communicate to the CMS, and incorporating other systems such as player tracking, bonusing and promotional, point of sale systems, marketing systems, hotel operating systems that connect to both the CMS and the player tracking systems for promotions and other type of advertisement, and the list goes on.
Therefore, when implementing changes, a supplier will most likely need to have the capabilities to simulate every operator’s environment for every upgrade in order to test and validate the code changes to reduce risk, confirm functionality and ensure regulatory compliance with CMP requirements.
SYSTEM TESTING AND MARKETS APPROVALS
After the changes have been implemented, the supplier must set up the system at the Independent Testing Laboratory (ITL), where all the changes get tested for regulatory compliance, and in some instances, functional concerns could be identified. However, these discoveries are minimal due to ITLs having the same limitations on load testing as suppliers do.
Once testing has been completed, there are several markets where secondary approvals are required, meaning there’s a second level of review based on the ITL evaluation to provide final approval. In land-based, there’s limited number of regulatory bodies that allow for emergency approvals, therefore approvals take additional time based on the workload the regulatory agency is handling.
When the final approval is received, it’s time to coordinate the updates with the property. This is often the most challenging step. Operators are constantly running promotions, and there may be other operational concerns if the casino is a 24-hour operation due to the down time during the upgrade. There must be enough floor staff at the property to manage the upgrade, technicians and product support from the supplier side, and IT personnel from both sides must be readily available in case of problems. Sometimes, as we would say, all the stars and planets need to align to make the upgrade possible, with the coordination of an acceptable downtime window, if needed, and the availability of required personnel. All of this could easily take months to complete.
BENEFITS OF IMPLEMENTING A CMP OR AUDIT-BASED PROCESS
Now, all the above applies to maintenance and security updates, but when it comes to “New Features”, a whole different conversation needs to be started. New features are usually part of a maintenance release; therefore, there’s additional red tape regarding allowance in certain markets, but not others, that can delay the approval process based on regulatory feedback. Regulations vary widely when it comes to bonuses, wide area progressive and other cashless functionalities. I’m sure it is not hard to understand the challenges of creating specific versions of systems for each regulated market and how that could become unsustainable.
When we look at the current state of land-based CMS approvals, it’s not too difficult to point out the benefits of implementing a CMP or audit-based process, and how these can provide a different value from the traditional testing and certification model. Let’s start by going back to the variety of games and systems as stated before, where we discussed that load and true interoperability testing can only be seen in a live casino environment where thousands of transactions happen every minute.
Within the infrastructure of a CMS there are several components and modules that are ultimately not controlled components. Meaning they don’t affect regulatory functions, therefore the risk to the operations is very low when it comes to changes to those items. Having the ability to apply those changes for the operator and have the testing completed in a live environment can mitigate several operational concerns and guarantee a CMS that the operator can use effectively. By implementing CMP or audit-based processes, suppliers will be able to fix and point out to the individual and specific concerns that otherwise could be encounter later, since it allows us to identify in each property the causes of the compatibility concerns and avoid suboptimal operations or reporting capabilities.
MOVING FORWARD TO REMOTE HOSTING
Let’s think of a sports betting system that crashes and it is inoperable the night before the Super Bowl, or the MLB Championship. Time is of essence and that operator is allowed to use all available resources, included changes to the code, to be able to come back and continue to run smoothly. Why is it different in land-based casino? The management system’s operation is identical in form and function. So just like we moved from coins 30 years ago to TITO, it’s time to continue moving forward and allow the regulations to come together to provide a uniform and effective way to manage those systems.
Another point that was very important for me to bring up is the after-COVID reality. There is a lot in the news about hardware shortages and shortages of skilled workers, and I wanted to pull back the curtain from the supplier side to these challenges and the advantages that remote hosting and ongoing monitoring/remote maintenance of CMS may bring to the industry.
When you talk about onsite hosting for each property, there are two things the operator is going to need on a 24/7 basis: hardware and skilled workers. Remote hosting of CMS is very practical when it comes to multi-property operators as they won’t require massive number of servers and IT staff. Managed services where suppliers can proactively monitor the system at an IT level (not revenue related) will allow operators to focus on players, data, and revenue operations. This approach will ensure:
a) Stability of the system
b) Authorized Access
c) Proactive patch and upgrades deployments
d) Security enhancements on time
e) System operational enhancement
THE IMPORTANCE OF DELIVERING SYSTEM FILES ELECTRONICALLY
Additionally, by having a remote hosting approach, there is another step that is worth mentioning, and that is the shipment and delivery of CMS media. When it comes to providing software for testing purpose to ITLs and inclusive state-owned laboratories, even more during and after COVID-19, suppliers managed to have software delivered electronically via FTP, drop box or other approved method. However, when it comes to delivery to the operators, must jurisdictions follow Electronic Gaming Machines shipping requirements that may not be applicable to systems and adds a layer that may cause additional delays:
a) Notifications periods of up to 2 weeks based on the jurisdiction.
b) Physical shipment of software that includes the need for hardware (media) and skilled workers to perform the duties.
c) Signature verification that can be complex and challenging
d) Not directly to the IT department that will work with the technicians for the updates.
The risk is low, and it has been proven with data from iGaming markets for the last 3 years that having those systems files delivered electronically ads security to the process, producing:
a) The files are only accessed by approved individuals.
b) Point to point delivery system.
c) Not risk for the software of falling on the wrong hands before or after use
I think that my colleagues did an amazing job on presenting different points of view from the ITL, the regulatory and the supplier side regarding changes to the operation and regulation of Casino Management Systems, specifically on the approval process for any system that is driving gaming activity at a slot machine or similar physical gaming device. Ultimately, it is very important that we understand one concept: progress and innovation are the only ways to stay on and win.