The news broke, oddly enough, while I was on my way to an anti-money laundering conference in Las Vegas in the autumn of 2017. “Have you seen the news?” a colleague back in Ontario asked me over the phone. “All hell is breaking loose in British Columbia.”

The morning of September 22, 2017, B.C.’s attorney general David Eby issued a news release outlining details of an anti-money laundering compliance review that had been commissioned by the province’s gaming regulator. At the time, I downplayed it and told my colleague that these stories tended to be cyclical: every few years, for whatever reason, the press turns its attention to casinos. I recalled the CBC reports from almost ten years ago, where reporters went undercover into casinos to investigate whether they could launder money. Then there were the Freedom of Information requests a few years later, where the media acquired some Suspicious Transaction Reports and proceeded to report the blindingly obvious fact that, well, casinos are required to report suspicious activity. At the end of the day, nothing had really happened as a result of those media reports, other than Canada’s gaming industry perhaps getting a bit of a bloody nose.

“If history is any indication,” I told my colleague, “there will be a few more headlines and the story will fade.”

I couldn’t have been more wrong.

Only days after the attorney general’s press release, Minister Eby appointed former RCMP deputy commissioner Peter German to conduct an independent review into alleged money laundering in British Columbia casinos. The review culminated in a 250-page report entitled “Dirty Money” that was released to the attorney general in March 2018 and the public at large in June 2018. “Dirty Money” can be summarized in four words: everybody dropped the ball.

Peter German identified a “collective system failure,” citing infighting between the provincial crown corporation and gaming regulator, an inadequate response from law enforcement and an ineffective regulatory regime as contributing factors leading to certain Lower Mainland casinos unwittingly serving as “laundromats for the proceeds of organized crime.” The report went on to provide sweeping recommendations to reform B.C.’s gaming industry, with a view to combatting money laundering more effectively.

The attorney general then tasked German with reviewing B.C.’s horse racing industry, luxury car dealers and real estate market. A second report, creatively titled “Dirty Money Part Two,” was delivered in March 2019 and released to the public in its entirety in May 2019. Turning the volume up to eleven, German’s second review took place concurrently with two other studies into B.C.’s real estate market that had been commissioned by the Ministry of Finance.

Neither of the “Dirty Money” reports, in the words of Minister Eby, were intended to be “finger-pointing exercises.” But between the government’s determination to tackle money laundering and the hundreds of news stories that dominated print and broadcast media over the past two years, members of the public — and certainly some elected officials — were looking for answers. Thus, on May 15, 2019, Premier John Horgan announced that the provincial government will hold a public inquiry. Retired B.C. Supreme Court justice Austin Cullen was appointed to head the commission of inquiry into Money Laundering in British Columbia (dubbed the “Cullen Commission”).

The Cullen Commission has a broad mandate, including the authority to compel witnesses and order disclosure of documents. According to its website, the Commission’s mandate is to make findings of fact with respect to the extent, growth, evolution and methods of money laundering in British Columbia, with regard to specific economic sectors; the acts or omissions of responsible regulatory agencies and individuals, and whether those have contributed to money laundering in the province or amount to corruption; the scope and effectiveness of the anti-money laundering powers, duties and functions of these regulatory agencies and individuals; and the barriers to effective law enforcement in relation to money laundering. The Commission’s work has already begun and it’s tasked with delivering an interim report within 18 months and a final report by May 2021.

What can we expect? It’s safe to say a lot of the focus will be on B.C.’s real estate and luxury car markets. But given the first “Dirty Money” report’s account of the apparent dysfunction within the government agencies tasked with managing and regulating the province’s gaming industry, we should also expect plenty of fireworks when it comes to casinos.

While the Commission’s work is important, one overarching challenge is that the federal government holds most of the cards when it comes to money laundering compliance and enforcement. First, there’s the Criminal Code itself, which designates the offences for money laundering. Then there’s the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which governs anti-money laundering compliance and reporting in the casino and real estate sectors. Even if British Columbia, or other provinces, were to adopt new anti-money laundering measures in response to the Commission’s findings, they would still have to line up with federal requirements (although B.C. deserves a big round of applause for being the first Canadian province to introduce a public land ownership registry).

Ultimately, anyone involved in gaming or the anti-money laundering field needs to be paying close attention to the Cullen Commission. The reality is that Canada’s gaming industry is a large, vital and mature business that makes substantial contributions to the broader Canadian economy. It is a significant driver of investment, employment, development and innovation, generating billions of dollars of economic activity that benefits public priorities like social welfare, education and health. Much like the “Dirty Money” reports, it’s almost certain that the findings of the Commission will reverberate beyond B.C.’s provincial borders. I believe it’s critically important that Canada’s gaming industry stakeholders provide the Commission with reasoned, evidence-based information on approaches and best practices to combat money laundering. (I mention this because, having been involved in financial crime prevention for over 20 years, I’m concerned with the recent trend in the gaming industry to adopt strict rules-based anti-money laundering compliance requirements.)

Globally, financial regulators have been moving to a risk-based approach to compliance for several years. In fact, the Government of Canada released new anti-money laundering regulations this past summer that will allow for more flexibility in customer due diligence and risk assessment. Ontario’s gaming regulator (AGCO) rolled out a well-reasoned standards-based approach to regulation several years ago.

Of course, what is broken must be fixed. We’ve already seen a number of knee-jerk reactions to the events in B.C. in various parts of the country through the imposition of overly-prescriptive obligations. Such a “tick-the-box” approach to compliance is rife with risk and often creates unnecessary operational challenges without yielding better outcomes.

The Financial Action Task Force (FATF) — the inter-governmental organization that sets global standards for combatting money laundering and terrorist financing — addressed this very issue over ten years ago in its guidance to casinos:

By adopting a risk-based approach, it is possible to ensure that measures to prevent or mitigate money laundering and terrorist financing are commensurate with the risks identified. This will allow resources to be allocated in the most efficient ways. The principle is that resources should be directed in accordance with priorities so that the greatest risks receive the highest attention.
The alternative approaches are that resources are either applied evenly, or that resources are targeted, but on the basis of factors other than risk. This can inadvertently lead to a “tick box” approach with the focus on meeting regulatory requirements rather than on combating money laundering or terrorist financing efficiently and effectively.

A wise police sergeant I once worked with said it best: “Good anti-money laundering policy should be designed to catch bad guys, not drive business away.”

Whatever the findings of the Commission may be, it is vitally important that those involved in the fight against money laundering embrace practical, well-thought solutions that ensure regulatory policies, priorities and government objectives are properly aligned to present-day risks.

Here’s also hoping the Cullen Commission will be able to answer a few burning questions that I’ve had over the course of my career: Is the current Canadian legislative framework for gaming adequate, or does it inherently create insurmountable conflicts between government agencies? Are sufficient resources deployed to combat money laundering in British Columbia, and indeed, in Canada? Are some of the barriers to effective law enforcement in relation to money laundering self-imposed? Are the roles, functions and accountabilities of the gaming industry’s various stakeholders properly aligned to optimize the coordination and expertise of those stakeholders?

Regardless, the next two years will unquestionably be an interesting time for Canada’s gaming industry. To misquote the legendary Bette Davis: “Fasten your seatbelts, it’s going to be a bumpy ride.”

Derek Ramm is Vice President of MT>Play, a global gaming advisory firm. Prior to joining MT>Play, he held senior roles at the Alcohol and Gaming Commission of Ontario (AGCO), Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and the Ontario Lottery and Gaming Corporation (OLG). He also served as a Commissioner on the Bermuda Casino Gaming Commission.

Any opinions expressed in this article are those of the author and do not necessarily represent those of his current or former employers.

By Gregory Furgala, with files from Kavita Sabharwal-Chomiuk

Casinos aren’t crowned by towering smoke stacks. They don’t produce ammonia-laced tailing ponds. Disaster scenarios aside, in the event of a catastrophic operational failure, it’s unlikely that a casino would do much more than temporarily close. A casino certainly isn’t going to rupture and gush oil anywhere (its owners might get into a new line of work if it did). In terms of environmental impact, casinos aren’t nearly as visible as international shipping, marine plastic pollution and fracking.

But they’re not perfect. Casinos and resort hotels produce tonnes of organic and inorganic waste that needs to be hauled away. Hauling staff uniforms and linens off to get laundered costs carbon and money as well. Casino and resorts’ biggest impact, however, is energy usage. A 2005 study by the United States’ Environmental Protection Agency notes that casinos are extremely energy intensive due to their 24/7 operations, high ventilation requirements and high energy loads. By way of example, the EPA report found that the Turning Stone Resort and Casino in New York used 57.6 million kilowatt hours of energy per year to power its 750 rooms, 500,000 square foot casino floor, 30,000 square foot event space andamenities. To put that in perspective, in 2016, the entire city of Hamilton used 351.6 million kilowatt hours.

Turning Stone is a massive resort, but the EPA study makes it clear that casinos and casino resorts, with their abundance of lights, games and massive open spaces, demand more energy per square foot than other lodgings. Managing down that usage might at first glance seem like a thankless, capital-intensive task, but it can quickly pay dividends, both environmental and financial. Steve Stone, the director of facility management at Fallsview Casino Resort in Niagara, recently found that out for himself.

An Efficient Plan

“It began as we reviewed the efficiencies of our programs and the associated costs,” says Stone. “As we made decisions on what programs could be improved and reviewed for opportunities for capital investment, it became clear that creating these efficiencies would work hand-in-hand with sustainable and environmentally friendly programs.”

The initial goal was to cut operational costs, but it led Stone to making investments in projects that dovetail with sustainability and energy efficiency. Most of the changes are what you would expect. Stone’s team installed variable speed drives on fans and pumps, switched to LEDs, added automatic lighting controls in under-used areas and installed energy-saving window treatments. Fallsview even added a film to the southwest-facing side of the building that ref lects UV light, relieving the HVAC system of some stress. Rebates helped offset some of those costs, as well.

“Energy audits are an imperative part of the process in order to ensure that we are comprehensively reviewing opportunities for efficiency and to create a baseline for our programs,” says Stone. “Once we established a baseline we were able to identify and prioritize opportunities that would al low us to increase efficiency.”

But some of the biggest benefits came from unexpected places. Dyson hand dryers, for example, allowed Fallsview to get rid of paper towels in washrooms. That eliminated a significant chunk of their waste disposal, which in turn decreased the amount of haulage needed to get rid of it and the amount energy required to process it. The results at Fallsview bear out an MIT study concluding that Dyson’s dryers had the least environmental impact compared to other dryers and paper towels. Dyson estimates it costs 97 per cent less than paper towels to run its dryers, and 81 per cent less than slower dryers. Bringing laundry in house brought on a similar cascading series of benefits, and, given Fallsview’s “always-on” nature, lighting controls were another boon. Routine operational reviews yielded other small ways to make Fallsview more efficient, as well.

Despite Stone’s overall success, there were challenges. On-site organics disposal, for example, was particularly difficult. To work, staff have to sort waste perfectly. Otherwise, the disposal units break down. “Even just a small fraction of the waste being misallocated will cause the loads to be rejected and caused almost daily breakdowns in equipment,” says Stone. “This is a real challenge when you are relying on a large population to perform the procedures perfectly every time with little to no margin for error.” When the machines worked, they worked well. But too often they didn’t. Given the chance to do it over again, Stone says he’d purchase smaller machines and work in smaller loads, which would make it easier for his staff to keep the waste stream clean.

Operationally, the cost-benefit of Fallsview’s green initiatives have worked out in its favour, but the environmental benef it might yield more revenue unto itself. Green Keys global, an international environmental certification body, awarded Fallsview its 4 Green Key rating. Green Key designs sustainability programs specifically for the hotel industry, and Stone says the rating helps signal to potential clients and guests that Fallsview act ively works toward reducing its environmental footprint. It’s a moral value-add to go along with the traditional amenities for Fallsview guests. “We want to ensure that their experience is a good one while on property, therefore we inform them of the environmental benefits behind the changes made that impact them,” says Stone. “If we make the guest feel as though they are making an environmental impact, they are likely to accept and have more positive feelings about these changes.”

Big Picture Change

In aggregate, re-tooled processes, retrofits and guest-facing changes can have a significant impact on overhead. Bringing in certain processes, like laundry, helped Fallsview meet its goals, but particularly large facilities can consider bringing in their own power generation. In a 2007 report, the EPA analyzed energy use at two casinos, the Rio All Suite Hotel and Casino in Las Vegas, and the Seneca Niagara Falls Casino in New York state. Both recently had combined heat and power (CHP) systems installed with the aim of reducing their carbon footprints. In a nutshell, CHP systems generate energy more efficiently than traditional power sources. In a process sometimes called cogeneration, heat created by power generation is contained and channeled toward a useful purpose, like heat ing or cool ing, making product ive use of what would otherwise go to waste.

The results were staggering. Rio has 2,800 suites, 15 restaurants, theatres, lounges and, of course, gaming rooms. Before its CHP system was installed, Rio’s annual energy bill was $9 million. Once installed, the CHP system generated 40 per cent of Rio’s electricity, heated 60 per cent of its water and managed 65 per cent of the resort’s heating. With 95 per cent up-time, Rio saved $1.5 million annually. Seneca Niagara installed its CHP system to operate in the event of a power outage (its installation was partially a response to the 2003 Northeast blackout). Its system was designed to meet the thermal load of the facility, provide heating and cooling, and heat water, as well. The report goes on to say that during the summer months, Seneca Niagara’s CHP system will meet 100 per cent of its thermal needs, and at peak load, 73 per cent of its electricity needs. The numbers at Connecticut’s Foxwoods Resort & Casino are even more impressive. The Alliance for Industrial Efficiency, a sustainability advocacy, reported that Foxwoods’ 15 megawatt CHP system met 100 per cent of its heating and cooling needs and 60 per cent of its electricity needs. In three years, it recouped $36 million.

That’s money that could be reinvested into the operational savings, or expansion, or staff raises to reward performance and at tract new talent. It could be doled out in bonuses or go to shareholders. Wherever it goes, the source is the same: investment into green initiatives. Efficiency saves money, and the cost of things like LEDs and solar panels have both consistently decreased over the past decade, making simple retrofits and upgrades that much cheaper. The entire electrical system could be reconfigured around a CHP system, or bulk soap dispensers could replace individual bottles. Both help.

Green Ink

Despite his overall success, Stone cautions other facility managers about just diving into going green. “Before making any big decisions in starting green initiatives, it is crucial to fully understand the needs of your business as a whole. Each business is a unique entity and while some initiatives may look desirable on paper, it is imperative to think through the potential impact on guest and staff experiences.” Fallsview didn’t invest into energy efficient retrofits and processes purely out of environmental guilt. For casinos and resorts, sustainable practices are a new means to an old end: improving customer experience and the bottom line. They just have the added benefit of reducing waste and environmental impact, and, for now, coincide with consumers’ approval of green practices. “We are proud to have set ourselves apart as a green leader in the community,” says Stone. “Not only have we implemented many green initiatives on our properties, but we also work to educate our employees on green pract ices in hopes that they will carry some of it to their own homes.”

There aren’t smoke stacks or tailings ponds, but there is plenty of room for improvement. There’s also thousands of dollars — in some cases millions — left on the table. It just takes a bit of investment to get it.

Delta Bingo & Gaming welcomes you to its modern gaming locations. Many of its 16 gaming locations across Ontario have undergone exterior renovations to match the exciting interiors.

Over the past several years, Delta has invested millions of dollars in modernizing each of its locations, and more recently, transformed the exteriors by using its brand’s colour palette to create a modern and inviting space, inside and out.

Delta worked closely with Regional Signs Inc. and local painters to install a combination of channel lettering and box signage, as well as updated window graphics, at all Delta Bingo & Gaming locations to showcase the gaming centres’ exciting atmosphere.

“We are committed to the communities that we are a part of, and each of our customers in those communities is important to us,” said Cam Johnstone, CEO, Delta Bingo & Gaming. “We strive to make each of our customers feel welcome, safe and excited to visit. With our updated exteriors, you can feel the energy as soon as you arrive.”

All Delta locations were reenergized as the new vibrant paint colours were added. Two locations in particular saw the biggest transformation: Peterborough and Penetanguishene.

Delta Peterborough has the most welcoming interior, with a gorgeous fireplace seating area and fully loaded gaming lounge, complete with TapTix machines, dart boards and pool tables. This did not translate to their exterior design; faded beige siding ran along the top of each dull brown brick wall. In spring 2017, Delta Peterborough underwent a complete design overhaul with new paint, new signage and new window decals. Today, you can’t miss it from the street; it looks like an exciting gaming destination!

Another location that underwent a similar transformation was Delta Penetanguishene. This centre is conveniently located on the town’s main strip, however it was often lost amongst the other businesses in the strip plaza. At first glance, you may have thought it was a corner store. Like Peterborough, after entering the front door, you would notice it is a rather large facility, with a separate TapTix lounge and a large bingo area with stadium seating. In summer 2017, the entire plaza was painted and new signage and window decals were installed. Today, as you first enter the township of Penetanguishene, you can not miss Delta Bingo & Gaming.

A challenge faced by many shopping centres, restaurants and gaming centres is the design of a smoke-free entrance. The new Delta Niagara Falls entrance was carefully designed with a smoke-free entrance in mind, with a designated covered shelter dedicated to customers who smoke. At each of the Delta Bingo & Gaming locations, a designated smoking section is now a part of design to create external smoke-free zones.

Customer experience starts before a customer enters the door and ends with the decision of whether to return in the future. Over the past few years, Delta has committed to building a brand voice and delivering a consistent Delta experience. In addition to the modernized gaming centres, updated uniforms, and revitalized digital assets, including website and social platforms, Delta has also re-designed its customer loyalty program, introducing a global system called InnerCircle.

“I wanted to introduce a loyalty program that made customers feel welcomed and appreciated. Something that would work at all locations and allow us to reach our VIPs at any time,” said Isabel McMurrich, Marketing Manager, Delta Bingo & Gaming.

In this digital world, you need to find ways to connect and communicate with your customers where they are. It is important that they feel welcome at each touch point. To help make Delta Bingo & Gaming a complete night out experience, the food and beverage offerings are equally important. Delta Bingo & Gaming introduced Red7 Eatery, which features a pub-style menu. Over the past few years, with the instrumental expertise of Zoltan Bankuti, Food and Beverage Manager, the menu has been fine-tuned with additions like local brewery offerings. Since the debut of Red7, Delta has seen a tremendous uptake on its Eatery and menu selection.

As Delta continues to transform, it keeps the potential new customer in mind. The Delta group has been involved in the operation of bingo for over 50 years and looks forward to the future with the OLG and their charity partners as customers’ needs and technology continue to evolve.

By Andrew Jefferies

Over the last year, I’ve had critical infrastructure protection on my mind. Critical infrastructure (CI) is an area that is increasingly getting attention from both the IT industry and the hacker community. Bulletproof has been part of a strategic partnership with CyberNB and some major industry players to create a collaborative critical infrastructure operations centre. This “CI-SOC” will be a first-of-kind facility to protect CI assets.

Critical infrastructure is a category that includes power systems, water, food supply and transportation. These verticals are increasingly being targeted by attackers because of both their susceptibility to attacks, as well as their overall value as a target, since successful attacks can have they a massive societal impact. Protecting these CI organizations is important business!

How does this relate to gaming systems? It is obviously hyperbole to call gaming systems critical infrastructure, but as I have been researching CI protection, I have come to realize that there are many technical and organizational parallels between critical infrastructure and gaming systems. Turns out, critical infrastructure systems can be used as a model for how to protect our gaming infrastructures.

First of all, let’s talk about the similarities. Here are five areas where both gaming systems and CI systems are similar:

High value: When thinking about value, from a security perspective, you need to think about replacement value, lost revenue or the impact of the loss of functionality, and the value of the data. For both CI and gaming systems, all these tick-boxes in the valuation equation are checked. Gaming systems not only have an intrinsic value in terms of revenue, they also contain high value patron data. A high percentage of attacks today are not about stealing cash, but about stealing data.

Targeted: Any high value organization is a target and the gaming industry is no stranger to highly sophisticated and targeted attacks — technology is just the new vector for attacks. Similarly, critical infrastructure is increasingly being targeted because of the high impact and the opportunity for leverage it provides.

Highly integrated: Gaming systems, like CI systems, are highly integrated. There is no doubt that integration provides value. For example, being able to integrate gaming and patron management systems, or entertainment and hotel management systems, provides both a better customer experience and more value to the operator. Similarly, integration of CI infrastructure with management platforms also provides high value to CI operators. However, whenever integration occurs, risk is increased.

Poor vendor support: Typically, vendors of specialized equipment, whether it is a gaming system, centrifuge, or an MRI machine, are really good at engineering their systems for the task required, but they are not great at maintaining those systems in a secure way. This is especially true when integration comes into play. Updating these systems is often difficult, to say the least.

Compliance-driven: In any compliance-driven industry, security is more challenging. Compliance plays an important role in ensuring that systems perform as they are designed. However, compliance creates a challenge in a dynamic situation like cyber security, where new vulnerabilities and attack techniques are released daily. Having compliance-driven systems that can’t be easily updated for security creates an opportunity for problems.

Given the similarities between critical infrastructure and gaming systems, we can draw upon experience with CI to better protect ourselves in gaming environments. Below, we get into the key points that you can use to protect your network:

Don’t trust users

Like with CI, we know that user screening and monitoring is key. From a prevention perspective, education is the key to preventing user-based security issues, but you also need to protect your critical systems from your users. Users should be segmented by role, and permissions should be granted accordingly. This will limit the exposure of data and systems if a user makes a mistake or maliciously tries to gain access to your data.

Users should also never be given admin rights on their standard user accounts. If you have administrators that require administrative rights, give them a separate account for admin tasks. Do not allow them to use that for normal day-to-day tasks. Despite what your technical team will tell you, they do not need admin rights on their day-to-day account.

Zone your systems

While testing networks, we often see that organizations have flat, unprotected networks. Logically they are all on the same plane, without any barriers. This type of flat structure means that both attackers and malware can propagate unabated in your network. Breaking up your system into logical networks, protected by a firewall, allows you to maintain optimal control over what is happening in your network.

Zoning becomes more important when you have systems that are highly sensitive, poorly supported by vendors or that cannot be updated because of compliance requirements. If you cannot update your systems at least monthly (or quicker when there is a critical patch released), you need to have them highly segregated.

It is a best practice to zone your systems based on business function and the sensitivity of the system. Your gaming systems are an obvious first choice for segmentation, but what about your patron systems, your HVAC control systems or your cash counting machines? Internet-enabled devices are another common example of poorly managed and patched systems. If you have a lot of them in your environment, you should be protecting yourself from them by segmentation. Critical Infrastructure operators tightly segregate their systems because they need to control interactions and attacks. You should do the same.

Monitor your systems

Just like you monitor your game floor activity with guards, you need to monitor your network, systems and user behaviour for suspicious activity. This needs to be done 24/7, regardless of your business hours, because your systems are still turned on. It also needs to be done by experts. For the same reason that you use trained security guards, you also need to use trained security analysts for monitoring your network. When things are discovered, you need to be prepared to act on them quickly.

Similar to critical infrastructure clients, gaming operators often have systems that do not inherently allow for monitoring. You can’t necessarily put a log collection agent on your slot machines. In these scenarios, you can still do monitoring, but it might be at a gateway level, or at an upstream control system. In most cases there is a way to monitor a given system.

Don’t assume you’re physically secure

Critical infrastructure operators know that restricting physical access is key, but they assume that it will be breached. Systems need to be secured independent of physical controls. This is part of a “defense in depth” strategy. For example, can an attacker walk into your back office and plug in a laptop? No? Our penetration testers are frequently able to do just that! We have done the exact same thing in a police agency data center! Just because you think you have good physical security doesn’t mean that it is infallible. Assume that your physical security will be breached when you design your security.

In a recent webinar on incident response in gaming systems, I described some of the trends in attacks against gaming clients that we see in our security operations centre. I also described that in many ways our industry has been lucky. Like the CI industry, we haven’t traditionally been a focused target of hackers. Most attacks are still using generic attack techniques. While these are still devastating to the victims, it is the targeted attacks that need to be keeping you up at night. When the focus swings to our industry, it will be a ripe fruit to be picked.

The critical lesson

Casino operators need to treat your systems similar to critical infrastructure, because to you, your team and your clients, it is critical infrastructure. Could you recover from a two week outage due to a breach? Could you recover if all of your client data and was stolen and you had to notify them? Treat your systems like critical infrastructure and you’ll have a better chance of not needing to answer these hard questions.

Andrew Jeffries is co-founder and vice president of security services at Bulletproof, an IT security firm and subsidiary of Gaming Laboratories International.