INDEX

Chapter I. General provisions.

Article 1. Object.

Article 2. Definitions.

Chapter II. Technical gaming systems.

Article 3. Requirements for technical gaming systems.

Article 4. Requirements of the Central Games Unit.

Article 5. Random number generator requirements.

Chapter III. Approval, certification and audit of technical gaming systems.

Article 6. Approval of the technical game systems.

Article 7. Entities designated to issue the certification report for technical gaming systems.

Article 8. Approval and certification procedure.

Article 9. Recognition of approval and certification validated by other public administrations.

Article 10. Effects of the approval.

Article 11. Provisional certification of gaming systems.

Article 12. Audit of technical gaming systems.

Chapter IV. Monitoring and monitoring of gaming activities.

Article 13. Internal control system.

Article 14. Control of the Central Operator's Gaming Unit and its replica.

Article 15. Gaming activities carried out over the Internet.

Article 16. Gaming activities performed via text messaging of fixed or mobile telephone services.

Article 17. Gaming activities through voice communications services.

Article 18. Gaming activities through audiovisual media.

Article 19. Gaming activities through terminals and auxiliary machines.

Chapter V. Monitoring of payment means and gateways.

Article 20. Media monitoring and payment gateways.

Chapter VI. Safety requirements for technical gaming systems.

Article 21. Access and security control.

Article 22. Communications with participants.

Article 23. Communications between the components of the technical gaming systems.

Article 24. Registration and traceability of gaming operations.

Article 25. Continuity of play activity.

Chapter VII. Participant control.

Article 26. Identification of participants.

Article 27. Control of the subjective prohibitions of participation in the games and money laundering.

Single additional disposition. Specific regime of the Spanish National Blind Organization.

Final disposition first. Enabling the National Gaming Commission.

Final disposition second. Entry into force.

I

Law 13/2011, of 27 May, of regulation of the game, establishes the regulatory framework of the activity of play, in its various modalities, that it is developed with state scope in order to guarantee the protection of the order public, fight against fraud, prevent addictive behaviour, protect the rights of minors and safeguard the rights of participants in games.

The aforementioned Law creates in its article 20 the National Gaming Commission as the regulatory body of the gaming sector with the purpose, among others, to supervise and control the development, exploitation and marketing of the activities game.

The aforementioned control of the gaming activity is regulated in Title IV of the cited Law 13/2011, which devotes its Chapter III to the approval of the technical systems of the game.

The technical game system is made up of the Central Games Unit and the set of technical or telematic systems and instruments that enable the organization, marketing and holding of games by these means and must have sufficient authentication mechanisms to ensure, inter alia, confidentiality and integrity in communications, the identity of the participants, the authenticity and computation of the bets, the control of their correctness functioning, compliance with the subjective prohibitions laid down in Article 6 of Law 13/2011, of 27 May, of regulation of the game and the access to the components of the computer system exclusively of the authorized personnel or of the National Commission of the Game, under the conditions that it could establish.

The entities that carry out the organization, operation and development of games regulated in the aforementioned Law must have the material software, equipment, systems, terminals and instruments in general necessary for the development of the game activities, duly approved, corresponding to the National Gaming Commission the approval of the technical systems of the game and the establishment of the specifications necessary for its operation.

This royal decree regulates the provisions of Law 13/2011, of 27 May, of regulation of the game, regarding the technical systems of the game of the operators referred to in Title III of the aforementioned the law and lays down the technical requirements to be met by those operators in the development and exploitation of gambling activities. The technical requirements of operators authorised for the placing on the market of Lotteries shall be regulated in a specific and differentiated regulation given the specificity of that game product.

The standard also attributes to the National Gaming Commission broad powers to, through the exercise of its regulatory powers, establish the details of the procedures and the determination of the requirements and conditions. which, precisely because of their fundamentally technical condition, may be subject to change as a result of the development of the technique and that, only from the perspective of the regulator, can be addressed with adequate speed.

II

This royal decree is divided into seven chapters, with twenty-seven articles, one additional provision and two final provisions.

Chapter I regulates the object of the rule and the definition of certain concepts that are important for its proper interpretation.

Chapter II lays down the technical requirements of the technical gaming systems, the Central Gaming Unit and the random number generator.

Chapter III deals with the procedure, the entities and the effects of the approval and certification of the technical systems of the game. The recognition of approvals and certifications validated by other administrations is also regulated.

Chapter IV is dedicated to the control of the gaming activities through its monitoring and monitoring, establishing the technical requirements to be adopted by the operators for the correct performance of the game. functions by the National Gaming Commission. It also lays down the obligation to implement an internal control system in the technical system of the operator's game which captures and registers all the gaming operations and the economic transactions between the operators. participants and the operator's Central Gaming Unit.

Chapter V sets the criteria for monitoring the payment gateways and means.

In Chapter VI, the safety requirements of the technical systems of the game are established, control of access and safety of the technical systems, communications with the participants and communications between the components of the technical gaming systems. The traceability and registration of the game operations are also regulated and the obligation to have a Technology Contingency Plan is established for the maintenance of the operating game in cases where the Central Games Unit The operator or its main infrastructure and computer systems are not available.

Finally, Chapter VII, is dedicated to the control of the participants, establishing the technical requirements for their identification, as well as the applicable criteria for the control of the subjective prohibitions of participation in the games referred to in points (a), (b) and (c) of the second paragraph of Article 6 of Law 13/2011 of 27 May of regulation of the game.

III

This royal decree, for the purposes of complying with Directive 98 /34/EC of the European Parliament and of the Council of 22 June 1998, as amended by Directive 98 /48/EC of the European Parliament and of the Council, of 20 July 1998, has been subject to the procedure for information in the field of technical standards and regulations and regulations relating to the services of the information society, as regulated in Royal Decree 1337/1999 of 31 December 1998. July.

In its virtue, on the proposal of the Minister of Economy and Finance, in agreement with the Council of State and after deliberation of the Council of Ministers at its meeting on November 11, 2011,

DISPONGO:

CHAPTER I

General provisions

Article 1. Object.

The purpose of this royal decree is to establish the technical requirements to be met by the operators for the organization, exploitation and development of the game activities they require. the enabling titles referred to in Title III of Law 13/2011 of 27 May of regulation of the game.

Article 2. Definitions.

For the purposes of this royal decree, the terms used in this decree shall have the meaning laid down in this Article.

1. Game technical system. The technical system of the game means the set of equipment, systems, terminals, instruments and material used by the operator for the organization, exploitation and development of the game activity. The game technical system supports all the operations necessary for the organization, exploitation and development of the gaming activity, as well as the detection and recording of the corresponding transactions between the players and the operator.

The basic elements of the technical gaming system are the Central Gaming Unit and the internal control system.

2. Central Games Unit. The Central Gaming Unit understands the set of technical elements needed to process and manage the operations performed by the participants in the games.

They are part of the Central Gaming Unit, the gaming platform and the software of the games.

3. Internal control system. It is understood by internal control system the set of components destined to record the totality of the operations and transactions carried out in the development of the games in order to guarantee to the National Commission of the game the possibility to maintain a permanent control over the operator's gaming activities.

The fundamental elements of the internal control system are the capture and the secure database.

4. Captor. The capture is the component of the internal control system of the operator intended for the capture and recording of the monitoring and control data established by the National Gaming Commission, its translation and storage in the database secure.

5. Secure database. The secure database is the warehouse that contains the monitoring and control data entered by the capture and can be accessed at all times by the National Gaming Commission.

6. Access record. The access register is the system that stores and preserves the operations performed on the Central Games Unit by operators, administrators and other persons linked to the operator or, where appropriate, to the National Gaming Commission, with access to that.

7. Gaming platform. The software and hardware infrastructure that constitutes the main interface between the participant and the gaming operator is understood by a gaming platform.

The gaming platform offers the player the tools necessary to open or close your gaming account, record, edit your profile information, deposit or withdraw funds from your gaming account, or view detail or a summary of your account movements.

The gaming platform includes any technical element that displays relevant information to the participant about the games offered by the operator, as well as any client software that the participant has to download and install on your computer to be able to interact with the platform.

The gaming platform allows the operator to manage the user registry and the participant's gaming account, as well as the game's financial transactions, to report on the results of the games, to enable or disable logs and accounts and set all configurable parameters.

The game platform and the payment gateway are part of the gaming platform.

8. Game databases. The set of logical stores in which the personal data of the participants in the games are recorded and retained is understood by means of game data, those relating to the totality of the transactions carried out by these and the information on the results of sporting events or events, coefficients and other relevant data for the purposes of the development and management of gaming activities.

9. Payment gateway. Payment gateway is understood as a set of technical systems and instruments that enable economic transactions to be performed between the participant and the gaming operator and which contains the logic necessary for transferring funds from the medium of payment by the participant to the operator and from the participant to the participant.

10. Gaming Software. The game software consists of or consists of the modules that allow you to manage each of the games, authorize and implement the rules of each one of them and which are accessed from the platform of the game.

11. Random number generator. The random number generator is the software or hardware component that, by means of procedures that guarantee its randomness, generates the numerical results that are used by the operator to determine the outcome of certain games.

12. User registry. User registration means the single registration which allows the participant to access the gambling activities of a particular operator and where data is collected, inter alia, to identify the participant and those who enable economic transactions to be performed between the game operator and the game operator.

13. Game account. The account is taken into account of the account opened by the participant and linked to its user registry in which the revenue of the economic quantities allocated by the participant is charged for the payment of the participation in the gaming activities and pay the amounts of the participation. The game account cannot in any case present a creditor balance.

CHAPTER II

Technical gaming systems

Article 3. Requirements for technical gaming systems.

1. The technical game systems used by operators who are enabled for the organisation, exploitation and development of gaming activities by electronic, computer, telematic and interactive means will bring together the conditions which, by means of provision, establish the National Gaming Commission and must allow compliance with the obligations set forth in Law 13/2011, of May 27, of regulation of the game, those established in this royal decree and those that, if necessary, establish in the basic regulation of the games and in the corresponding enabling titles.

2. In any case, the technical game systems shall ensure the effectiveness of the controls in relation to the duration of the game time, the maximum amount played or the use of the self-exclusion options, among other measures, which are required by the National Gaming Commission, in relation to the development of the games or their modalities of exercise, as well as the other ends provided for in Article 17.2 of Law 13/2011, of 27 May, of regulation of the game.

Article 4. Requirements of the Central Games Unit.

1. In accordance with Article 16 of Law 13/2011, of 27 May, of regulation of the game, the operators authorized for the organization, exploitation and non-occasional development of the games object of the mentioned law, must have a Unit Central Games that will meet the specifications set by the National Gaming Commission and will allow:

a) Register all performances or game operations performed from the teams and users connected to it, operations and results on betting events and draws, prize sharing, operations on the register user and gaming accounts, aggregated and control data, as well as gaming platform operating events.

b) Ensure the proper functioning of gaming activities.

c) Check at all times, if necessary, the operations performed, the participants in the same and their results, if the nature of the game so permits, as well as to reliably reconstruct all the performances or operations performed through it.

2. In accordance with the provisions of Article 18 (2) and (3) of Law 13/2011 of 27 May of the regulation of the game, the authorised operators must ensure the existence of the necessary backups and the implementation of the measures technical and contingency plans to ensure the recovery of data in any kind of incident, as well as to have a replica of its Central Games Unit, which will allow the normal development of the gaming activity, with all warranties, in cases where the main unit is off-duty.

3. The Central Games Unit and its replica shall be installed in dependencies subject, at all times, to control of access and surveillance, with the operator being responsible for their custody.

The operator will provide access to these dependencies, regardless of where they are located, to the inspectors of the National Gaming Commission, for the conduct of face-to-face inspections in any of the locations of the physical media of the Central Games Unit.

The operator is responsible for ensuring the access and inspection of the Central Games Unit regardless of their physical location or the ownership of the means they employ and whatever the country in which they are located. are located.

In the event that the location of the gaming platform or that any of its components are virtual, or will employ dislocated elements, the operator must ensure access and the precise powers to perform the inspection from the physical places where the services are administered.

In any case, the personnel who provide services at the operator's premises, be they themselves, be of the entities that provide or provide some type of service, will lend total collaboration to the inspectors of the National Commission of the Game in order to facilitate access and inspection. The operator shall be responsible for the failure to cooperate with the staff, irrespective of the legal or employment relationship which binds him.

Article 5. Random number generator requirements.

The random number generator, without prejudice to any additional requirements that the National Gaming Commission may establish, must at least gather the following characteristics:

a) The random data generated will be unpredictable and indeterminable.

b) The generated data series will not be reproducible.

c) Scaling methods will be linear and will not introduce any bias, pattern, or predictability.

d) The method of translation of the game's symbols or results shall not be subject to the influence or control of a factor other than the numerical values derived from the random number generator.

CHAPTER III

Approval, certification and auditing of technical gaming systems

Article 6. Approval of the technical game systems.

1. It is for the National Gaming Commission to type in the technical systems of the game and to establish the specifications necessary for its operation in accordance with the provisions of Article 16 of Law 13/2011 of 27 May, Regulation of the game. For the performance of the approvals, it may be based on reports of certification of the adequacy of the operator's technical gaming systems issued by entities duly designated for these purposes.

2. The National Gaming Commission shall establish the technical specifications which it has drawn up for approval and certification of the technical systems of the game. The National Gaming Commission shall avoid such effects as obstacles that may distort competition on the market.

Article 7. Entities designated to issue the certification report for technical gaming systems.

1. The certification report of the technical game systems shall be performed by the entities designated for this purpose by the National Gaming Commission.

2. The National Gaming Commission shall lay down the technical requirements and the conditions to be met by the entities in order to obtain the designation referred to in the preceding number, and the procedure for their application by the interested entities.

3. The requirements or conditions required and the procedure laid down for the designation of certification bodies for technical gaming systems shall not establish obstacles which may unduly distort competition.

4. The National Gaming Commission will publish on its website the relationship of the designated entities to issue the certification report of the technical gaming systems.

Article 8. Deadline and procedure for approval and certification.

1. The National Gaming Commission shall approve the technical gaming systems in accordance with Article 16 of Law 13/2011 of 27 May, regulating the game, within a maximum period of six months from the notification of the game. grant of the license.

The National Gaming Commission will establish, within the framework of the criteria set by the Ministry of Economy and Finance and the Council of Game Policies, the procedure for the approval and certification of the systems Game technicians. The Commission shall also establish the minimum content of the reports issued by the designated entities.

2. The initial approval procedure for the technical game systems shall be carried out in the framework of the procedure for granting general and unique licences.

The licence application will be accompanied by a technical project detailing the fundamental aspects of the system for the development of gaming activities and, in particular, the components of the Central Unit Games and internal control system.

The National Gaming Commission may require the data subject to provide information that is necessary for the evaluation of the technical project.

3. The certification reports shall give an opinion on compliance with the technical requirements for the licence applied for and shall have at least the following content:

a) In relation to the gaming platform, a detailed functional description of processes supported by the platform will be included, among others, the user registry, session data, game account, information to the participant of the plays, collection and payment systems, mechanisms of limitation to participation, as well as any other that implements the system.

The report will also assess the behavior of the platform against system falls, recovery procedures, session management, anti-fraud and money laundering measures, responsible gambling measures and obligations. information to the participants.

b) For each game for which a singular license will be requested, the report will certify the adequacy of the rules implemented by the software with those established by the basic regulation of the game, including, if applicable, all the possible options, bonus policy, prize detail and the odds of the game, as well as the percentage of return to the player.

c) In relation to the random number generator, the report shall indicate the intrinsic quality level of the generator, after exceeding the number of statistical tests necessary to demonstrate that the data generated are of a character random, unpredictable, non-reproducible, and the scaling and translation methods are linear and independent of any other factor other than the generator itself.

d) In relation to the internal control system, the report shall include a detailed functional description of the processes implemented for the capture and recording in the secure database of the gaming operations.

The certification reports shall be accompanied by a copy of the approved software digitally signed by the entities designated for this purpose, which shall be used to verify the integrity of the software in the procedures for auditing the technical systems of the game.

4. Certification reports shall include a relationship of the components, software or hardware, rated as critical, with detailed information of the location of each component in the game technical system, component naming, and levels of review. For these purposes, the elements referring to the random number generator, the user registry and the gaming account, the internal control system, the connections to the National Gaming Commission, or the payment processing.

The production of any substantial modification affecting a critical component of those indicated in the previous paragraph will require the prior authorization of the National Gaming Commission after the filing of the corresponding type-approval report.

The National Gaming Commission may qualify as critical components of the operator's gaming technical system that initially would not have been qualified in this way and that it will motivate to consider that they affect or may reach affect the development of the games, the rights of the participants, or the public interest.

Article 9. Recognition of approval and certification validated by other public administrations or by the competent authorities of the States of the European Economic Area.

1. The National Gaming Commission shall establish the effects of approvals and certifications validated by other countries of the European Economic Area or by competent bodies of the Autonomous Communities in the procedures for the granting of game-enabling titles comparable to the licenses granted in Law 13/2011 of 27 May, for the regulation of the game, as well as the procedures in which, where appropriate, they are to be considered.

2. The rules which the National Gaming Commission will give to this effect should be based on the principle of reducing administrative burdens, avoiding the reiteration of technical tests validated by another administration.

Certificates in respect of which the effects are requested before the Commission must have been issued, where appropriate, by an independent entity designated for this purpose by a procedure that accredits their solvency.

3. The rules on which the application for the recognition or the effects of approvals, certificates or documentation is based must have been notified, if appropriate, to the European Commission, on the basis of Directive 98 /34/EC, establishes the procedure for information on technical standards and regulations.

Article 10. Effects of the approval.

1. The approval of the technical systems of the game credits the fulfillment of the technical requirements required for the performance of the activities of the game in Spanish territory or that they are directed to Spanish participants or with registration of user

2. Issued the preliminary or final report favourable to the approval of the technical systems of the game, the interested party shall submit it to the National Commission of the Game in the framework of the corresponding procedure, either of granting of licenses or of modification of the technical systems of the game, which will proceed to its evaluation in the forms and deadlines established to the effect.

3. The approval of the technical game systems is valid for ten years from the date of issue of the relevant report.

Article 11. Preliminary and final approval of the technical game systems.

1. The provisional grant of licences shall be conditional upon obtaining, within a period of six months from the notification of the person concerned, a favourable approval report.

2. The certification report of the operator's technical gaming systems shall be performed by an entity designated by the National Gaming Commission.

3. The preliminary certification report, which shall be accompanied by licence applications, shall have the content set by the National Gaming Commission and, on the basis of the technical project submitted, shall at least decide on the correct operation of the platform software or, where applicable, the game, the projected safety elements and the connection of the operator's technical systems with the National Gaming Commission.

During the approval process the National Gaming Commission, by itself or through the designated entity, will review the operation with real data from the operator's gaming technical system and compliance with the requirements required by Law 13/2011, of 27 May, of regulation of the game and its standards of development, being able to recommend to the operator the improvements and modifications of the technical system of play that it considers necessary for the correct fulfillment of the technical requirements. These recommendations shall form part of the final certification report, which shall also include the degree of compliance with the recommendations by the operator.

4. Issued in time the favorable report of the definitive certification of the technical systems of the game, the operator will transfer it to the National Commission of the Game for its appraisal.

If the assessment of the report is positive, the National Gaming Commission will automatically modify the provisional registration of the license that will become final.

If the assessment of the report is not positive, the National Gaming Commission will order the cessation of the activity of the operator, taking the necessary measures to avoid any damages to the participants and to the interest public.

Article 12. Audit of technical gaming systems.

1. The audit of the technical systems of the game must be carried out every two years. The audit, the cost of which shall be borne by the operator, may be carried out by the National Gaming Commission or by the entity which, for these purposes, proposes from among the recognized for the approval and certification of the technical systems of the game and which shall be different from the entity which, where appropriate, would have carried out the final approval and certification report of the operator's technical gaming systems.

2. The first audit shall be carried out within six months of the expiry of the two-year period following the granting of the approval. Successive audits shall also be carried out within six months of the expiry of the two-year period.

In the event that the audit has not been carried out by the National Gaming Commission, the favourable report resulting from it shall be subject to the assessment of the Commission.

3. If the time limit set has not been submitted to the National Gambling Commission, the favourable audit report shall provisionally agree to suspend the operator's activity and initiate the relevant file of the revocation of the singular license.

4. The National Gaming Commission may, in the field of a sanctioning procedure or in the case of proceedings prior to its opening, order the conduct of an audit of the gaming systems of the operator allegedly responsible for a infringement. The audit may be carried out by the National Gaming Commission or by the entity which, for these purposes, designates among those recognised for the approval and certification of the gaming systems and which will be different from the entity which it would have carried out. the last audit of the operator's gaming systems.

5. The National Gaming Commission will dictate the particular provisions or instructions that it deems necessary for the practice of the audit.

CHAPTER IV

Monitoring and monitoring gaming activities

Article 13. Internal control system.

1. The monitoring and monitoring of the gaming activities performed by the operator shall be carried out through the internal control system.

2. Operators shall establish in their technical system a system of internal control that captures and records all the game operations and economic transactions that are carried out between participants located in Spain or with registration in Spain and the operator's Central Gaming Unit.

The internal control system must be adapted to the different channels of the games and the interaction with the participants, in such a way that the capture and registration of all the operations of the game.

When different marketing or interaction channels are used simultaneously in a single game, the operator must establish the gateways, interfaces or channels of communication between the entire the means of participation or interaction in the game in order to enable the National Gaming Commission to access all the operations and transactions that would have been carried out by anyone who was the means used to do so.

3. The operator will implement the systems and mechanisms that ensure the capture and recording of gaming operations, operations and results of betting and raffles events, distribution of prizes, operations on user registries, transactions In the case of gambling accounts, aggregate and control data, as well as the performance of the gaming platform, and its storage in a secure database to which the National Gaming Commission can access. The operator shall also be responsible for the establishment and maintenance of the secure access line of the National Gaming Commission to the database and for the establishment of the means and systems to ensure the conservation and, where appropriate, the retrieval of the data recorded by the internal control system.

The National Gaming Commission may, by resolution, extend or reduce the number of operations that are captured and recorded.

4. The internal control system shall permit the control by the National Gaming Commission, and in the terms and conditions laid down by it, of all registered gaming operations.

5. The National Gaming Commission shall have the technical requirements to be met by the internal control system and the line of access to the secure database, the protocols and, where applicable, the encryption tools, which must be used for the purposes of the recording of the data. It shall also establish the minimum security requirements to be met by the operator for both access to the control system and for the preservation of the data.

Article 14. Control of the Central Operator's Gaming Unit and its replica.

1. The Central Gaming Unit and its replica will incorporate secure and compatible computer connections with the National Gaming Commission's systems, which will allow it to carry out a monitoring and follow up, in real time if required, of the gambling activity, the prizes awarded and the identity of the persons who participate and are awarded on the same, and where appropriate, the return of prizes that will eventually occur on the occasion of the cancellation of the games, all without prejudice to the possibility of carrying out face-to-face inspections.

2. The Central Gaming Unit and its replica, regardless of their location, should be able to be monitored from Spanish territory by the National Gaming Commission.

It is up to the operator to establish and maintain a secure line that allows the access of the National Gaming Commission to the Central Gaming Unit of the operator and its replica. The National Gaming Commission shall have the technical requirements to be met by the access lines.

3. In order to facilitate the verification and control operations of the information, the National Gaming Commission may require the gaming operator to have certain secondary units of its technical systems located in Spain.

Article 15. Gaming activities performed through the website.

1. For the marketing and development of gaming activities through websites in the field of Law 13/2011, of May 27, of regulation of the game, operators will have to implement a specific website with the name of domain under ". is" that must direct all connections made from Spain or that are made with a Spanish user registry.

2. The operator shall establish the systems, mechanisms or arrangements that ensure that all gaming activities carried out from Spain or using a Spanish user registry are served from the website of the operator under ". is". In particular, the operator must ensure that all connections made from Spanish territory or by participants with Spanish user registration and that were initially directed to websites under different domain to the ". is" property or are controlled by the operator, its parent or its subsidiaries, are redirected to the specific website of the operator under ". is".

3. The operator shall notify the National Gaming Commission of the domain name and relevant information and data of the website it uses for the development of its activity, as well as any alteration thereof.

The National Gaming Commission may establish, in such cases as it deems necessary for the protection of the public interest and minors, that the marketing and development of certain types of game be carried out from an exclusive website created for these purposes by the operator.

Article 16. Gaming activities performed via text messaging of fixed or mobile telephone services.

1. Operators who organise, exploit or develop gambling activities in which they are used as a means of participation or interaction, principal or accessory, text messaging systems through fixed or mobile telephone services, shall be implement a control system that allows capturing, recording and, where appropriate, translating the language used for recording into its database, the totality of the messages sent and received by the participants.

2. Communications between the participants and the operator shall be recorded in a database in the formats established by the National Gaming Commission. The National Gaming Commission may at all times access the database in which the communications are recorded.

3. The operator shall establish the mechanisms and systems to enable the National Gaming Commission to monitor and control the sending and receiving servers of text messages used by the operator and the customer databases. and operations and the implementation of the limitation and information measures to the participant.

Article 17. Gaming activities through voice communications services.

1. Operators who organise, operate or develop gambling activities in which they are employed as a means of participation or interaction, principal or accessory, the voice communications service, shall implement an internal control system which The ability to capture and record communications between participants and the operator.

For the purposes of this royal decree it will be understood that both the persons who in their case attend the calls of the participants and the automatic systems of interactive response, are part of the technical systems of game.

2. The operator shall establish the mechanisms and systems to enable the National Gaming Commission to monitor and control voice communications between the participants and the operator, as well as the recording thereof, and client databases and operations.

3. The recording and recording of the communications between the participants and the operator shall be performed on a database in the formats and in the manner established by the National Gaming Commission. The recordings will make it possible to determine the date and time when they were performed.

The National Gaming Commission will be able to access the database at all times in which voice recordings are recorded.

4. The operator must keep the recordings, at least for one year or until the expiry of the prizes for the relevant gambling activities, if this period is greater.

Article 18. Gaming activities through audiovisual media.

Operators who organise, exploit or develop gaming activities through audiovisual media must implement an internal control system that allows for the capture and recording of communications that are perform between participants and the operator.

The operator, based on the means used for the participation and interaction with the participant, must adapt the internal control system to the requirements established in this royal decree and to those who establish the National Gaming Commission.

Article 19. Gaming activities through terminals and auxiliary machines.

1. For the purposes of monitoring and controlling the gaming activities carried out by the use of terminals or auxiliary machines, the operator shall make any adaptations to the National Gaming Commission, by itself or by through the inspection services of the relevant Community or Autonomous City, access to the terminals and auxiliary machines and to the technical systems of play to which they are connected.

2. Auxiliary machines and terminals used for the organisation, operation or development of gaming activities, as well as the software used by them, are part of the gaming platform and are subject to approval and certification. in the terms set out in Chapter III of this royal decree.

CHAPTER V

Media monitoring and payment gateways

Article 20. Media monitoring and payment gateways.

The operator, without prejudice to the obligations of capture and registration of transactions and economic transactions linked to gaming activities, shall establish the systems and mechanisms to enable the National Commission of the Game access to the systems, means and payment gateways used by the operator for the collection of the participation and the payment of the prizes obtained by the participants.

The National Gaming Commission shall establish the technical and access requirements that are necessary and proportionate to the control of collection and payment operations.

CHAPTER VI

Safety requirements for technical gaming systems

Article 21. Access and security control.

1. The operator must establish a physical and logical access protocol to its technical gaming systems in which the procedures for its control are collected, the relationship of the persons with access to the authorisation, as well as the operations that you can perform on your systems.

The registration of the Central Games Unit, its replica and the internal control system must be retained by the operator for at least two years.

2. The Central Gaming Unit and its replica shall be accessible only by persons expressly designated by the operator for these purposes and, in the framework of an inspection, by the staff of the National Gaming Commission.

3. The operator shall establish physical and logical security measures to ensure the control of access to technical gaming systems, which prevent access and allow the detection of any unauthorised person.

4. The operator shall ensure the access of the National Gaming Commission to the technical game systems in the terms set out in Articles 13 and 14 of this royal decree.

5. The National Gaming Commission shall establish the additional conditions of access to the operators ' technical gaming systems and the technical requirements they have met.

Article 22. Communications with participants.

The operator shall establish the systems and mechanisms that ensure the integrity and confidentiality of the participants ' communications with their technical gaming systems and in particular with the Central Gaming Unit and its replica.

The system must ensure the identity of the transmitter and receiver, the confidentiality of the information transmitted through the use of effective encryption and authentication algorithms and the integrity of the information transmitted through the communication channels used for participation and interaction with gaming systems.

The National Gaming Commission may establish the detail and additional conditions it understands necessary to ensure the safety and integrity of communications between the participants and the technical gaming systems. of the operators.

Article 23. Communications between the components of the technical gaming systems.

The systems used for data communication between the various components of the technical gaming systems will ensure their integrity and confidentiality. In particular, the operator shall ensure the integrity of the communications between the Central Gaming Unit and the internal control system.

In cases where communication between the various components of the technical gaming systems is carried out through public or third-party communications networks, the operator must use protocols to secure communication ensuring their integrity and confidentiality.

The National Gaming Commission may establish the additional detail and conditions necessary to ensure the safety and integrity of communications between the various components of the technical systems. game.

Article 24. Registration and traceability of gaming operations.

1. The Central Gaming Unit must ensure the traceability and registration of all gaming operations and economic transactions that are carried out, allowing for the faithful reconstruction of gaming operations and transactions. registered.

2. The internal control system shall perform the capture, recording and preservation of the transactions and transactions in the terms that are established by resolution of the National Gaming Commission.

All elements of the internal control system must be physically and logically protected and prevent any unauthorized access.

3. Without prejudice to resolutions which may be issued by the National Gaming Commission in connection with the capture and registration of additional data, operators shall capture and record in the secure database at least the following: operations:

(a) Gaming operations, including at least the confirmed units or plays, the cancelled or cancelled plays by the operator, the denied plays and the payment or payment transactions made by the operator operator.

b) Operations on gaming events, including at least the high event or events that determine the game results, the modification of the event or event parameters, the events canceled or nullified by the operator in their gaming systems and result of the event or events.

c) Operations for the payment of the participation in the games and the payment of the prizes obtained.

d) Operations on user and game records, including at least the opening of account and the data provided by the participant, acceptance of the terms and conditions, modification of the parameters of accounts, economic movements, income and payments, the account of the game and the closing of accounts.

The National Gaming Commission will establish the details of the capture and recording of the operations and the minimum fields that would have to be incorporated into the secure database in relation to each of them.

4. The system shall permit the real-time capture and recording of data relating to gaming operations and economic transactions linked to those data. The National Gaming Commission, on the basis of proportionality criteria, shall establish the periodicity to be observed by the operator for the recording of the data in the secure database and the manner in which its association is to be carried out. temporary to reliable time sources.

5. Operators will also include in the secure database:

a) The aggregated and control data set by the National Gaming Commission.

b) An incident record that includes at least service interruptions or games disabling

c) Any other data required by the National Gaming Commission in general or individual form in a control procedure.

The National Gaming Commission shall establish the scope of the data to be recorded, the period of update of the data, and the technical requirements for availability and access.

6. The secure database and the operator's records shall be kept for a minimum period of six years, with the purpose of establishing the protection and back-up systems to ensure their integrity and security during that period, as well as their recovery. integrates with eventualities.

Article 25. Continuity of play activity.

1. The operator must have a Technology Contingency Plan for the maintenance of the operating game.

2. The Technological Contingency Plan will provide for the technical, human and organizational measures necessary to ensure the continuity of the service. The operator must report adequately on its policies in relation to service interruptions and the way in which customers can be affected. The operator shall take the necessary steps to ensure that his clients are treated fairly in case of interruption of the game or the bet.

3. The Technological Contingency Plan shall ensure that in no case data or transactions that affect or are likely to affect the development of the games, the rights of the participants or the public interest are lost.

4. In the framework of the Technology Contingency Plan, the operator must have a replica of the Central Games Unit that will allow the normal development of the activity of the games.

5. In addition, the Plan will address the alleged unavailability of the internal control system, ensuring the continuity of the data capture and recording functions, the gaming operations and the economic transactions linked to the those. In cases where the internal control system is out of service and unavailable, the operator must suspend the offer of the game until the internal control system becomes active again.

6. The National Gaming Commission will evaluate the operators ' Technology Contingency Plans and, where appropriate, require the operator to take the additional measures it deems necessary to ensure the continuity of the business activities. game.

CHAPTER VII

Participant control

Article 26. Identification of participants.

1. Operators shall establish the systems and mechanisms to facilitate the identification of the participants in the games. Exceptionally, in the light of the special conditions of the means used for the marketing and development of the games, on the basis of criteria of proportionality and on a reasoned request from the operator, the National Gaming Commission may authorise participation without the prior identification of the participants.

In any event, the identification of the participant and the verification that it is not ongoing in any of the subjective prohibitions referred to in points (a), (b) and (c) of Article 6 (2) of Law 13/2011, May 27, game regulation, will be a must for the collection of prizes obtained whatever their amount and nature.

2. The identification of the participant shall be made through a single active user registry in which at least the identification data necessary for the verification that this is not in place in any of the subjective prohibitions shall be made. (b) and (c) of the second paragraph of Article 6 of Law 13/2011, of 27 May, on the regulation of the game.

The user registry shall also collect the participant's tax and residence identification data and those other that allow the conduct of the economic transactions and the gaming operator to be determined by the user. National Gaming Commission.

The operator will establish the necessary procedures and mechanisms to ensure that the same player does not have multiple active user records.

3. The opening of a user registry shall require the participant to provide the data referred to in the preceding paragraph and to ensure that the operator checks the accuracy of the data.

Finished the verification procedure of the data in the terms set by the National Gaming Commission, the operator will be able to activate the user registry.

The National Gaming Commission will establish the necessary procedures to facilitate the authentication and verification of the identity data of residents in Spain in real time and, in cases where it is not possible, in a period of less than three days.

The verification of the data provided by the non-resident participant in Spain must be performed by the operator within a maximum of one month from the activation of the user registry and will be a prerequisite for the collection of prizes obtained by the participant whatever their amount and nature.

In both cases, after the one-month period from the registration request, without the data being verified, it will be nullified.

The operator is responsible for the accuracy and periodic contrast of the data contained in its user records, in terms established by the National Gaming Commission.

4. The operator may suspend user records that remain inactive for more than two years without interruption. The suspended user records may be activated at the request of the participant. Four years after the suspension, the operator will cancel the inactive user record.

5. The National Gaming Commission shall establish the additional requirements and conditions to be met by the user registries and the game accounts and the protective measures to be complied with by the operators.

Article 27. Control of the subjective prohibitions of participation in the games and money laundering.

1. Operators shall be responsible for the control of the subjective prohibitions on participation in the games referred to in points (a), (b) and (c) of Article 6 of Law 13/2011 of 27 May of regulation of the game.

2. The National Gaming Commission will provide the necessary means and establish appropriate procedures to allow operators to access the General Register of Access to the Game telematics.

In any case, in the process of opening the user registry, prior to activation, and in the process of crediting the prizes, the operator must contrast the data contained in the user registry with which they are registered. in the General Register of Access to the Game, in order to verify that the participant is not registered in the Registry.

The National Gaming Commission shall establish the procedures to be applied by operators for the periodic verification of the data of their user registries with those entered in the General Register of Interdictions Access to the Game.

3. Without prejudice to the procedures which may be established by operators for such purposes, the National Gaming Commission shall provide the means necessary to facilitate the verification of the age of the participants with the number of the participants. National identity card or foreign identification document. To this end, competent public administrations shall provide the National Gaming Commission with the necessary collaboration.

The National Gaming Commission will establish the consultation procedures that are accurate.

4. The National Gaming Commission shall cooperate in the enforcement of the rules on the prevention of money laundering and the financing of terrorism, without prejudice to the powers of supervision and inspection conferred by Article 47 of the Law. 10/2010, of April 28, to the Executive Service of the Commission on the Prevention of Money Laundering and Monetary Violations. In the cases where the National Gaming Commission will appreciate possible breaches of the rules on the prevention of money laundering and terrorist financing, it will inform the Secretariat of the Commission on the Prevention of Capital and Monetary Violations in the terms of Article 48.1 of Law 10/2010 of 28 April.

Single additional disposition. Specific regime of the Spanish National Organization of the Blind (ONCE).

In accordance with the provisions of paragraph 3 of the second provision of Law 13/2011, of 27 May, of the regulation of the game, in order to preserve the strict public control of the gaming activity of the ONCE, the powers that this royal decree attributes to the National Commission of the Game and to the holder of the Ministry of Economy and Finance, will be exercised by the Council of Protectorate of the ONCE in relation to the activities subject to reservation that said development, with the exception of the powers that correspond to the Council of Ministers.

Final disposition first. Enabling the National Gaming Commission.

In accordance with the provisions of Article 23 of Law 13/2011, of May 27, of the regulation of the game, the National Gaming Commission is enabled to dictate those provisions that are accurate for development and execution of this royal decree.

In relation to the occasional gambling authorisations provided for in Article 12 of Law 13/2011 of 27 May, the Commission may establish the adaptations and exceptions to those technical or technical requirements. Approvals which objectively lack justification on the basis of the non-occasional nature of the game.

Final disposition second. Entry into force.

This royal decree will enter into force on the day following its publication in the "Official State Gazette".

Given in Madrid, on November 14, 2011.

JOHN CARLOS R.

The Vice President of the Government of Economic Affairs and Minister of Economy and Finance,

ELENA SALGADO MENDEZ