All 114 Ontario standards,
organised by risk theme

There shall be a commitment to character, integrity and high ethical values demonstrated through attitude and actions.

Operators and gaming-related suppliers shall develop, document and implement formal control activities to address regulatory risks and achieve regulatory objectives.

Management overrides of control activities shall be clearly documented and made available upon request.

Operators must establish, implement and maintain controls to support preparation of financial reports complying with all applicable accounting standards, rules and good practices.

A personnel security screening process shall be in place for any director, officer, employee, agent or consultant at a level appropriate for their organizational role.

Employees must have competence, skills, experience and training required to execute relevant control activities.

Organizational structures shall be designed to promote sound control environments and proper segregation of duties minimizing collusion and unauthorized activities.

Management clearly understands its accountability and authority for the control environment.

Information, including logs, related to compliance with law, Standards, Requirements and/or control adherence shall be retained minimum three (3) years, unless otherwise stated.

Compliance with Standards and Requirements shall be documented in organized manner enabling review and audit by independent oversight function.

Primary compliance accountability resides with Board or other governance structure, with evidence the Board has carried out this responsibility.

There shall be independent 'whistleblowing' process allowing employees to anonymously report control environment deficiencies, non-compliance incidents with controls, Standards, Requirements, or law.

Registrants shall engage with Registrar in transparent way.

The Operator shall ensure that investigators (OPP or Registrar) are able to monitor and participate in games.

Operators and gaming-related suppliers shall only contract with reputable suppliers.

Operators and gaming-related suppliers shall maintain supplier list providing goods/services relating to lottery schemes; make available to Registrar on request.

Operators and gaming-related suppliers must cease unregulated activities if those same activities require registration under GCA to conduct in regulated scheme. Operators shall not enter agreements with unregistered persons providing goods/services if provision would require registration under GCA.

The OLG and iGaming Ontario shall implement and follow policies/procedures ensuring their activities facilitate and support gaming harm identification, prevention and minimization.

Game designs and features shall be clear and shall not mislead the player. This Standard does not apply to sport and event betting products.

The method of making bets in sport and event betting must be straightforward and understandable.

Players must be able to access information regarding available sport and event bets without having to place a bet.

Reputable and legitimate data source(s) must be used determining bet outcomes.

Operators shall not knowingly permit individuals with non-public information or sport-connected persons to bet on related events.

Games on gaming sites shall be provided only within Ontario, unless conducted in conjunction with another province government.

If the list of prohibited and excluded individuals changes, all registered player information shall be re-verified.

Relevant player information shall be collected and saved upon registration. Minimum information required at registration:

Before a player account is created, players shall affirm that all player information provided upon registration is complete and accurate.

Player information shall be kept complete and accurate.

Prior to participating in game play, players must affirm that they are fit for play.

All player accounts shall be uniquely identifiable.

Players may have only one player account per gaming site.

There shall be an auditable trail of events that is logged and available relating to account creation and activation, account deactivation and account changes.

Players shall acknowledge and accept the contract terms governing player account and game play prior to account creation and shall acknowledge and accept any subsequent material term changes when logging in.

All players shall be authenticated prior to accessing their player account and being permitted to gamble. Third parties are not permitted to access a player's account.

All player account transactions shall be recorded and logged in an accurate and complete manner.

All player account transactions shall be uniquely identifiable and traceable to a unique individual player account.

Reasonable efforts shall be made to inform players of player funds remaining in dormant accounts.

Players may elect to deactivate their player account at any time and, once the election is made, the account is deactivated.

Where necessary, a player account may be deactivated by the Operator.

A player account shall be deactivated if requested by the Registrar.

If player information is removed, it must be retained in accordance with Standard 1.09 or other applicable records retention requirement.

All gaming activities and financial transactions shall be conducted fairly and honestly, and must be independently verifiable.

There shall be appropriate, accurate and complete records of transaction and game state and play information kept.

There shall be a mechanism in place to ensure that if logging is interrupted, compensating manual controls are used, where reasonable.

The gaming system shall be capable of providing custom and on-demand reports to the Registrar.

Game specifications must be documented that clearly indicate: objectives of the game, wagers that may be made, how the game is operated and played, odds of winning for each available prize, the advantage of the operator in relation to each wager.

Information provided to players prior to and during game play shall not mislead players or misrepresent games.

All igaming games, random number generators and igaming system components must be approved by the Registrar or certified by an independent testing laboratory registered by the Registrar.

Gaming systems and gaming supplies shall be provided, installed, configured, maintained, repaired, stored, and operated in a way that ensures integrity, safety and security.

Where there are suspected game or system faults that may impact game integrity or fairness, Operators shall make the game unavailable to players until resolution.

Production, testing and development systems shall be logically separated.

Game outcomes and sport and event betting transactions shall be recoverable, where technically possible, so that player bets can be settled appropriately.

In any case where there is a game or system fault, the Operator shall have clearly defined policies and processes in respect of treating the player fairly when resolving the player's transactions. These policies and processes shall be made available to players.

Mechanisms shall be in place to allow a game to be recreated up to and including the last communicated state to the player.

A player's bet and the outcome of the game shall be clearly displayed, easy to understand, and available for a sufficient length of time for the player to review.

Operators shall have mechanisms in place to appropriately deter, prevent and detect collusion and cheating.

All relevant activities related to the detection of collusion and cheating shall be logged.

Players shall be provided with clear information on the process to report activities related to collusion and cheating, including suspected use of bots. The process must be simple to use and readily accessible.

Where speed of interaction has an effect on the player's chances of winning, the Operator shall take reasonable steps to ensure the player is not unfairly disadvantaged due to gaming system related performance issues.

In peer-to-peer games, Operators must implement measures intended to deter, prevent and detect the use by players of software programs to automatically participate in game play (bots).

Games must be conducted in a manner that ensures players are treated fairly and not unfairly disadvantaged by other players.

Games must operate according to their game specifications and the outcomes must be determined in accordance with the terms governing play and prevailing payouts as they are described to the player.

Bets shall be committed before the determination of game outcomes. Any wager received after the determination of game outcomes shall be voided and returned to the player.

In sport and event betting, bets must be settled fairly and in accordance with the terms of the bet placed by the player and any applicable betting rules.

The results of bets on sporting or other events must be provided to players making bets on the events. Any change of results must be made available.

Sport and event betting operators shall have controls in place to ensure the accuracy and timeliness of sport and event results data.

A mechanism shall be in place to randomly select game elements used to determine game outcomes. Not applicable to sport and event betting.

Mechanisms used to select game elements must be capable of being monitored and inspected to ensure integrity and randomness of generated outcomes.

Terms governing play must not be changed during a game session unless the player is made aware of the change before the player places any wagers.

Game sessions must be appropriately secured and checked for authenticity.

There shall be a player activity time-out that automatically logs the player out or ends the player's session after a specified period of inactivity.

All critical functions, including the generation of the outcome of any game, shall be generated by the gaming system, independent of the end player device.

Sport and event betting operators shall have risk management measures in place to mitigate the betting integrity risk, including insider betting and event manipulation.

An operator receiving a report of suspicious activity may suspend or cancel sport and event betting on events related to the report or withhold associated customer funds. The Operator's decision must be fair, reasonable, and made in good faith.

Operators offering sport and event betting products shall ensure bets meet criteria including: outcome can be verified, outcome not affected by placed bet, majority of participants 18+, event supervised by sport governing body. Prohibited: bets on financial markets, bets exposing players to losses greater than amount wagered, bets on minor league sports in Canada including CHL.

Access to live dealer gaming supplies shall be restricted to individuals with a business need.

Operators must have controls in place to ensure live dealer game presenters do not compromise the integrity of a game.

A recognized industry standard framework shall be used to manage the information technology (IT) control environment to support compliance with the Standards and Requirements.

Users shall be granted access to the gaming system based on business need.

Access to gaming information systems shall be monitored, logged and shall be traceable to a specific individual.