On 19 February 2020, the Isle of Man Gambling Supervision Commission (the GSC) published an updated practice note for Virtual Currencies (Practice Note GSC85). The background to the amended practice note is that it is now possible to open an account with an IOM gambling operator by using anything that has a value in money’s worth, which includes convertible and non-convertible virtual currencies. Convertible virtual currencies (CVC) include bitcoins, whilst non-convertible virtual currencies (VC) include virtual goods such as weapons in video games. The note covers a variety of aspects, the most significant of which are described below:
Permitted models for CVS and VCs
The GSC has identified five different models which operators can use:
- CVC to fiat conversion prior to play;
- CVC to operator via exchange;
- CVC in – CVC out, peer to peer;
- CVC in – CVC out, against the house; and
- VC in – Conversion – VC out.
The practice note provides guidance and expansion on the above permissible models while clarifying that CVC in – Fiat out is not a model the IOM GSC is willing to license at present.
Player Account rules
The section of the practice note on Player Account rules details all expected obligations that must be met, including AML requirements. The AML section states that an account may only be opened if the operator complies with the current AML/CFT Code and guidance while also adhering to the enhanced AML/CFT guidance issued by the GSC. This section also details, under specific CVC used, that if an operator wishes to accept a CVC directly from the player, then the nature of that CVC must be risk assessed for AML/CFT purposes. A player may also play or deposit with more than one CVC/ VC but the accounting rules for tracking play must keep each channel separate.
There also exists a general requirement to ensure that withdrawals are sent to an instrument under the same control as the player who made the deposit. This is to prevent account takeover typology from succeeding. In the account takeover typology, an attacker gains access to another player’s gambling account (e.g. unattended laptop, misplaced trust in another, hackers, etc) and uses their access to empty the account’s funds by specifying a different target (e.g. different credit card number, different crypto address) for the withdrawals.
Protection of players’ currencies and goods
According to the GSC, deposits of CVC/VCs may be vulnerable to protection failure. As a result, operators must demonstrate to the GSC that they have anticipated such threats and that there are credible measures in place to mitigate these threats. Such mitigations may include taking surplus currency off the network until needed, converting currency to something more secure until needed or using multi-signature applications to protect against withdrawal by a single person. Operators are also under an obligation to explain to players that virtual goods obtained in games do not belong to them or are not protected, if the operator does not have an agreement with the software supplier responsible for the virtual goods.
Volatility Rules
As the value of CVC/VCs can change quickly, an operator who accepts CVC/VCs when the price is low may face a large overhead if a win occurs when the value has increased significantly. If an insurance arrangement is used to hedge against unpayable wins, the practice note states that it must be capable of supplying the CVC/VCs required even during periods of increased value.
Player to Player transfers
If the operator offers a function that allows VCs to be transferred, traded, or sold, it must not be possible for players to set a trade or sale price. Any transfers that occur must be subject to AML/CFT monitoring and treated as qualifying payments if the EUR 3,000 threshold is met.
Technology assurance costs
The practice notice states that the GSC reserves the right to oblige operators to pay for an independent technology expert, chosen by the GSC, to assist with elements of the model that are beyond the GSC’s expertise.
Pay as you go gambling
Operators who satisfy AML/CFT obligations may offer pay as you go arrangements to players. If offering such a service, the operator must be able to detect unusual activity in real time and suspend the account immediately until a satisfactory explanation can be obtained. Operators must also be capable of applying an automatic lock on withdrawals when the AML/CFT qualifying payment threshold has been met (EUR 3,000). The GSC will also require exchange rate information when examining transaction records so operators should be able to demonstrate this.
In addition, operators must be able to manually lock accounts and prevent play for people that are suspected of cheating, being underage, having a gambling problem, or alternatively are subject to financial sanctions or an AML/CFT investigation.
Information requirements
Operators adopting VCs will be subject to a separation of channels for quarterly reports to the GSC. Further guidance on this is given in the practice note. The operator will also be subject to thematic checks by the GSC which result in additional reporting.
Adding to licence
The practice note advises that the GSC does not see the addition of a CVC into payment options as a new gambling product. However, an operator’s licence will need to be modified to include a schedule with the CVC requirements for use.
Smart contracts
Licensees with models that use smart contracts will be required to demonstrate that the code used in the contract conforms to the model supplied to the GSC. The practice note states that this can be proved through the opinion of an independent expert.
The practice note also covers advertising fiat equivalent values for VCs, existing operators adding virtual goods to their licence as well as fees and taxation in brief. A copy of the practice note can be obtained directly from the GSC.
Here at DQ, our Regulatory and Compliance team advise on a wide range of matters involving cryptocurrencies and crypto based business.
