Know thy Customer
How technology is advancing player verification and business strategy in iGaming, by Lindsay Kininmonth, North American Operations Manager at GeoComply Ltd.
A truism of all business is that the more you know your customer, the better the market advantage you enjoy. This is all too true in the iGaming space. New and advancing technologies continue to push the boundaries of present day gaming operations, and there’s every indication that the opening of the US market for iGaming will add another catalyst for technological innovation. As the North American market heats up for its long-awaited iGaming legislation, new solutions are coming together in the background to foster and support iGaming developments in the US. Many of these solutions are beyond the typical game content and systems required by the industry, but are rather geared towards the specialised compliance and business needs of the US market. As anyone who has ever had to go through compliance to be an operator or a supplier into the US market knows, this can often prove to be a far more rigorous and hands-on experience than what European or Asian operators may be used to. Gaming solutions providers will need to tread lightly in this environment and be cognizant of North America’s regulatory expectations and practices as they push their way into the West.
Shifting trends, increasing prominence of geolocation
Since its inception in 2006, UIGEA has demanded that “location verification requirements [be] reasonably designed” to block players based on their geographical location within the US.
For many, the most contentious subject of legislating gaming right now in the US pertains to jurisdiction – will it be allowed in the form of federal, intra-state, or inter-state? In any case, it’s a matter of isolation and defining boundaries. With that in mind, there has been increasing interest in geolocation technologies to assist operators in locating their players and ensuring compliance with whatever player location requirements they are subject to. For most regulated European jurisdictions, KYC is an established concept for both marketing purposes and regulatory needs. Technical standards typically require an operator to identify the country and/or residency of a player when they set-up an account, and often when they make deposits or place bets as well. This practice has also played a part in anti-money laundering and responsible gaming programmes.
Traditionally, European operators have relied on third-party geolocation technology to verify a player’s location by tracing their IP address, and confirming the country from which they access a particular gaming site. This method has proven effective enough for the needs of the regulators in an area where gaming jurisdictions are typically defined by country instead of a more granular territory or ‘state within a nation’ requirement. A diferent and perhaps more advanced approach, however, may be required for geolocation in the US; where each of the forty-eight states that take part in some form of gambling activity maintain distinct and sovereign gaming regulations.
Delivering geolocation compliance to such a patchwork quilt of jurisdictions may prove a challenge for existing IP address technologies. Densely populated cities, especially those which lie on or close to state or federal boarders, will require a new approach to locating players from their point of access.
The District of Columbia, until recently a forerunner in the American iGaming race, is an example of the kind of challenges that need to be overcome in order to adequately restrict players by physical location. In DC, the lottery publicly stated that it not only needed to block anyone attempting to gain access from outside of DC’s seven miles by ten miles borders, but also to block anybody trying to access the DC Lottery’s iGaming sites from within the District. While DC may be a particularly challenging jurisdiction for geolocation, there are plenty of other scenarios within the US borders (such as blocking Internet cafes in any New Jersey iGaming regulatory regime, or a Tribal reservation within a state) that regulators will need to face and contend with as they devise their own iGaming regulatory regimes.
Advancing technologies to monitor player activity
Emerging solutions point to geolocating with methods beyond, or in conjunction with, existing IP address technologies, in order to more effectively meet demands of these new, more rigorous regulatory requirements. A breakthrough and promising new method is Wi-Fi triangulation, which can pinpoint a player’s location within 50 meters of accuracy. Wi-Fi triangulation has been shown to be more effective than IP geolocation alone and, therefore, well-suited to complement IP geolocation in urban areas. One could argue this makes for an ideal solution for operators wishing to accommodate the US federal and intra-state demands for iGaming, whether they be private enterprises or state lottery organizations. However, standard Wi-Fi geolocation is comparatively easy to spoof (see later chapter on this) and even a non-tech savvy player could quickly fool a solution not designed for ‘industrial grade’ security.
Following the Department of Justice’s recent declaration that intra-state Internet gaming was legal in a December 23, 2011 opinion letter, one can expect interest to increase from would-be US intra-state licensees in how to operate in compliance with this opportunity. However, in such a heated and sensitive political environment, Internet gaming entities have every reason to take a proactive approach and ensure they know their customer location accurately as possible in order to avoid exposure to risk of fine, suspension, or other legal action.
Can players spoof their physical location?
As several recent investigations have shown, including research conducted by the Iowa Racing and Gaming Commission for its December 2011 white paper on the possibility of regulating intra-state poker, IP geolocation can be ‘spoofed’ relatively easily either through use of remote desktop software or a proxy server. In the case of AOL users, sometimes the user may not even know that his/her ISP is routing their connection through a proxy farm which results in a complete divergent physical location of their IP address.
In 2009, a study was commissioned by Wired Safety, a non-profit Internet safety group, to detail the risk associated with online gaming. In the study, Michael K. Sparrow explains that in some cases, the user could be on a different continent from the one indicated by their IP address because he or she may be using such technologies which mask their true location. The VPN software that many people use to access work networks from home or while traveling, effectively masks one’s location in this manner. The state of Illinois also recently authored a white paper on an Internet Lottery Pilot Program, which concluded that accessing an online gambling site via VPN or mobile gateways can circumvent the ability to accurately pinpoint the end user’s actual location.
Anti-proxy solutions can also be used to augment IP address geolocation to reveal whether a proxy server is being used by a player to access a gaming site and falsely report their location from an otherwise prohibited territory. Expert testimony in a French court case involving Yahoo! noted that a user can use a foreign IP address to connect through long distance dial-up, thus disguising their true access point. New solutions are also being developed to harness technologies to detect screen-sharing software (such as GoToMeeting) from a computers list of running programs, and determine whether a player is truly where they are perceived to be, or instead accessing a gaming site from a computer in another location using a remote-desktop program.
These types of solutions are often easy to implement into an operator or software supplier’s back office, and can be provide a greater level of confidence when getting to know your customer on an account registration and game-play basis.
How smart are your customers?
Players are becoming very well versed when it comes to the Internet gaming market. They know what kind of game content they want and know to read the fine print of bonus promotions. Affiliate sites educate players on which casino sites are safe and reliable, whether games are playing fair and paying out correctly, and which jurisdictions to watch out for when shopping around for a trustworthy place to deposit their money. Therefore, an endless amount of information is available to them at their fingertips and accessibility based on location is no exception. US players are becoming more knowledgeable and attentive to which sites still accept them, which ones block them and the opportunities they have to get around such ‘geoblocking’ methodologies.
Aside from US concerns over state borders and jurisdictions, European entities also have their own valid anxieties. An increasing amount of nations are domesticating their gaming industries and introducing new challenges to both new and existing operators. Italy not only requires operators to have a geolocation solution in place when they go live online, but also requires that operators successfully redirect domestic players to their ‘.it’ domains rather than their international sites (such as those ending in ‘.com’). Similar requirements already exist or are being introduced in Spain, France, Denmark, and others. These countries are also putting the onus on operators outside of their jurisdiction to monitor bets made from their boundaries – meaning the ‘.com’ sites in effect have a regulatory responsibility to ensure they do not accept bets from such countries, should any of their players successfully manage to access a site other than their domestic portal.
While there will always be people actively looking to get around the rules, there are still your average law-abiding citizens who have no idea they have broken regulations pertaining to location – and who would expect them to know the ins and outs of gaming law in any case? Does your average UK bettor who tries to access their account while on holiday in the US know they’re effectively doing something illegal? Perhaps not. Implementing geolocation technologies can prevent such occurrences from happening.
Player acquisition (it’s not all about regulation)
Aside from the many regulatory hurdles, geolocation technologies also have the potential to offer an operator a great deal of information about their players. Using IP address geolocation, logs can be created on player country origin, while Wi-Fi geolocation can even pinpoint customer access down to the city block. Such precision opens up a whole new myriad of possibilities for leveraging this information for player acquisition purposes.
Why is geolocation so important if players’ residential addresses are provided upon account registration? Perhaps they don’t play at home; in fact, they may only log into their accounts remotely on their mobile, on their iPad during the morning commute, or even from their work computer. The accuracy of Wi-Fi geolocation can enable operators to select whether they will allow bets to be placed from schools, libraries, or even government offices, or simply monitor the gaming activity taking place from such areas.
A new dimension of KYC can be accumulated where you not only know what type of products your players enjoy, but where they prefer to place their bets during their daily routines. Such advancement could definitely challenge the status-quo method of player acquisition and retention, and also give operators increased leverage in keeping up business.
About The Author
Lindsay Kininmonth is North American Operations Manager at GeoComply Ltd. Lindsay is an expert in compliance in the interactive gaming sector having worked in that role at TST for five years. During that time, she has worked with some of the largest operators, vendors and regulators in North America and Europe. Lindsay holds a political science and international relations degree from the University of British Columbia.