In early March 2024, the Nevada Gaming Control Board (“Board”) voted unanimously in favor of a series of proposed amendments to Gaming Regulation 5, specifically as it pertains to registered hosting centers and service providers (in particular, cloud computing service providers). These regulations were recently considered for final approval by the Nevada Gaming Commission (“Commission”) at its May 16th meeting.
Hosting Centers
Under Regulation 1.137, a ”hosting center” means a facility that houses associated equipment, cashless wagering systems, games, gaming devices, race book operations, or sports pool operations, in whole or in part thereof, and which is not located on the premises of a licensed gaming establishment, the business premises of a gaming licensee, or the business premises of a cloud computing service provider that meets the requirements set forth in paragraph (c) of subsection 2 of section 5.242 of these regulations. For purposes of this section, “business premises of a gaming licensee” does not include space leased by a licensee from a third-party data center operator.
Of note, Regulation 5.231(1) previously granted the Board access to the premises on which a registered hosting center is located as though the premises is where gaming is conducted and as if the hosting center is a gaming licensee. As amended, the Board’s access is limited to the portion[1] of the premises of a registered hosting center on which equipment is located that hosts or processes gaming-related transactions/activities. The reason for this limitation is that hosting centers provide services to multiple companies, some of which are non-gaming and highly sensitive (e.g., federal government and military) and the Board has no need to access said areas. For the avoidance of doubt, the Board maintains access to gaming-related areas (and such areas/equipment are subject to the power and authority of the Board and Commission pursuant to NRS 463.140).
The adopted amendments to Regulation 5.231(2) also allow a hosting center to seek a waiver or modification to the Board’s powers set forth in 5.231(1) as noted above, provided such requests are consistent with the public policy of the state.[2] This amendment did generate some discussion at the Commission hearing as it was questioned why the Board would waive its typical, physical access to gaming-related areas. Board staff explained that the purpose of this regulation is to provide flexibility. A potential waiver scenario would likely involve a request for alternate physical access procedures or to potentially limit access to virtual forensic techniques. In particular, staff noted that certain hosting centers had expressed concerns in the past about the Board’s ability to physically access areas of the hosting center and take servers. The hosting centers were not comfortable with such broad powers and instead sought a solution of virtual access to the gaming-related information on servers. Staff recognized that having virtual access was sufficient from a regulatory standpoint because (a) gaming-related information can be stored over multiple servers (along with other, non-gaming, information), so it’s impractical to seize physical servers and (b) the risk of a person tampering with a physical server is low due to it being housed in a secure hosting center. Staff concluded it is not their intent to physically access a hosting center and commandeer servers, and the waiver language would allow for virtual access.
Finally, Regulation 5.231(3) was amended to clarify that it is an unsuitable method of operation for a hosting center to deny a member or agent of the Board or Commission, upon proper and lawful demand: (a) access to the premises or equipment as described in Regulation 5.231(1) or as waived of modified pursuant to Regulation 5.231(2); (b) the ability to inspect any aspect of its operation conducted pursuant to its registration as a hosting center; or (c) to fail to disclose any aspect of its operation conducted pursuant to its registration as a hosting center to a member or agent of the Board or Commission. Disciplinary action for such an unsuitable method of operation can include, among other things, fines and revocation of a registration as a hosting center.
Cloud Computing Service Providers
A “Cloud computing service provider” is defined in Regulation 5.240(2)(c) as:
(1) A person who, on behalf of a licensee, provides cloud computing services by acquiring and maintaining the computing infrastructure and software necessary to provide cloud computing services for associated equipment, cashless wagering systems, games, gaming devices, race book operations, or sports pool operations, in whole or in part, and otherwise in accordance with paragraph (4) of section 5.225 and section 5.242 of these regulations.
(2) The services described in subparagraph (1) do not include the performance of any service, action, transaction, or operation that would otherwise require a gaming license or other registration pursuant to Chapter 463 of NRS or these regulations.
“Cloud computing services” are defined in Regulation 5.240(2)(b) as:
(1) Consist of the following as defined by the National Institute of Standards and Technology in NIST SP 800-145 and as further explained in NIST SP 500-292I Software as a Service;
(II) Platform as a Service; or
(III) Infrastructure as a Service.
(2) The services described in subparagraph (1) do not include the performance of any service, action, transaction, or operation that would otherwise require a gaming license or registration pursuant to Chapter 463 of NRS or these regulations, other than a registration as a cloud computing service provider.
Similar to the amendments detailed above for hosting centers, similar amendments were made to Regulation 5.240 for service providers (including cloud computing service providers), where the regulations make clear that it shall be unsuitable method of operation for any registered service provider to deny a member of agent of the Board or Commission access to premises, the ability to inspect, or failure to disclose any aspect of its operation. Of note, the Regulation 5.240 was not amended to specifically define the exact premises of a service provider, other than to note that the premises of a service provider includes all places where a service provider conducts its operations as described in Regulation 5.240. Lastly, the Regulation 5.240(10)(b) notes that a service provider may apply for a waiver or modification of Regulation 5.240(a) that notes that the premises of a service provider is subject to the authority of the Board and Commission.
Moreover, amendments were made to Regulation 5.242 to allow cloud computing service providers the ability to apply to the Board chair for a waiver or modification of the requirements of Regulation 5.242(2). Further, the waiver allows for the use of one or more hosting centers that are not registered with the Board. Of note, Regulation 5.242(3)(b) states that an unregistered hosting center would be (i) deemed the business premises of the cloud computing service provider for the purpose of these regulations; and (ii), with the exception of the requirement to register with the Board, they would still have to comply with the standards and requirements set forth in sections 5.231 through 5.235 of the regulations (which govern access to, and suitability of, hosting centers) unless waived or modified by the Chair of the Board. Lastly, as noted in Regulations 5.242(9), waivers of modifications granted shall be subject to any conditions or limitations placed by the Board and such applications shall be considered part of, or an addendum to, the cloud computing service provider’s application for registration.
When presenting the proposed amendments to the Commission, the Attorney General’s office explained that they had situations where they had reputable registered cloud computing service provider’s that had hosting centers throughout the country, where a majority were registered but a few of them were operated by a third party that did not wish to be registered. This change would allow the Board, in cases where there are a minority of unregistered hosting centers, the ability to allow for the use of those hosting centers while being fully vetted by the Board. Ultimately, the registered cloud computing service provider would be liable for any issues that arise through the use of an unregistered hosting center.
As noted in an earlier in April 2022, Regulation 5 was previously amended to permit out-of-state hosting centers. These new changes to Regulation 5 demonstrate the Board and Commission’s continued commitment towards embracing advancements in technological developments.
[1] Specifically, Regulation 5.231(1) states “the portion of the premises of a registered hosting center on which equipment is located that hosts certain parts of associated equipment, a game, gaming device, cashless wagering system, race book or sports pool operation, or interactive gaming system is subject to the power and authority of the Board and Commission pursuant to NRS 463.140, as though the premises is where gaming is conducted and as if the hosting center is a gaming licensee.”
[2] The Board may impose an investigative fee to review and consider waiver requests.
