IRG for the Licensing of Online Poker Operations and its Platforms

Licensing and Regulatory Group Table Games Department IMPLEMENTING RULES AND GUIDELINES FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Rev. No: 0 Effectivity: March 23, 2023

Table Games Department Page No.: Page 1 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 EXECUTIVE SUMMARY In October 2021, the Philippine Amusement and Gaming Corporation (PAGCOR) Board of Directors approved the Implementing Rules and Regulations for Online Poker Operations which was amended in April 2022. This was triggered by the pandemic when poker room operators explored other avenues to conduct their operations to keep business afloat despite the challenges. Amidst the difficulties, the industry has seen a significant growth of online poker operations. Even without regulations, there have been online poker sites that anyone in the country can access and play on. This exposes anyone in the Philippines to online operators that may scam them of their money and get off scotfree without any form of accountability. This regulatory framework aims to provide licensing and/or accreditation guidelines for online poker operators to legally operate in the Philippines and provide safeguards for Filiipinos when playing poker in an online platform.

Table Games Department Page No.: Page 2 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 TABLE OF CONTENTS I. GENERAL PROVISIONS……………………………………………………. 3 II. LICENSING OF ONLINE POKER OPERATORS………………………….. 3 III. ONLINE POKER PLATFORM STANDARDS AND REQUIREMENTS… 4 IV. COMMENCEMENT OF OPERATIONS……………………………………. 15 V. FINANCIAL CONSIDERATIONS AND OBLIGATIONS…………………... 15 VI. MARKETING PROGRAM……………………………………………………. 16 VII. MISCELLANEOUS PROVISION……………………………………………. 16 VIII. RENEWAL……………………………………………………………………... 19 IX. ACCREDITATION OF ONLINE POKER PLATFORM…………………….. 19 ANNEX A - Summary of Technical Requirements

Table Games Department Page No.: Page 3 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 I. GENERAL PROVISIONS 1. Online poker is defined as the game of poker or playing poker in a virtual venue where players may play player-to-player poker games. It utilizes random number generator to cause the distribution of pocket cards or player cards to players after which they interact in real time by proceeding with necessary actions in the game. Player accounts may be funded via third-party payment solutions through which the same account content may be withdrawn. 2. An online poker platform is the virtual venue where players may play player- to-player poker games. It may be web-based or accessed via a mobile application. An online poker platform may be directly operated by an online poker operator or partnered with poker gaming site operators for their online poker operations. 3. An online poker operator (OPO) is the operator of an online poker platform. 4. A poker gaming site operator is the operator of an authorized/ licensed brick- and-mortar poker room. It may be located inside (onsite) or outside (offsite) a Casino Filipino gaming facility or inside a licensed casino. 5. PAGCOR shall license OPOs and approve their corresponding online poker platform following an application process. 6. Only PAGCOR-approved online poker platforms of a PAGCOR-licensed OPO or accredited with a poker gaming site operator are allowed to legally operate in the Philippines. II. LICENSING OF ONLINE POKER OPERATORS 1. Only corporations duly registered with the Securities and Exchange Commission (SEC), whose primary purpose should be “gaming” or “engaged in operating poker games”, may apply as a PAGCOR-licensed OPO, referred herein as the Applicant. 2. The Applicant must submit a letter of intent (LOI) addressed to the Chairman and CEO of PAGCOR. 3. The Applicant shall submit a duly filled-out Online Poker Operator Registration Form together with the following requirements: A. Company-related requirements: i. Company profile; ii. Detailed location sketch of company office; iii. Copy of Registration Certificate from Securities and Exchange Commission (SEC) with required capitalization of 50 Million Pesos authorized capital stocks and 12.5 Million Pesos paid-up capital; iv. Articles of Incorporation and By-laws duly approved by the SEC;

Table Games Department Page No.: Page 4 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 v. Latest General Information Sheet (GIS) duly filed with SEC; vi. Personal Disclosure Statement vii. Audited Financial Statement B. Payment of the non-refundable and non-transferable Application Fee of ₱1,000,000.00. The company office of the Applicant shall be inspected by PAGCOR representatives to verity the legitimacy of its business and operations. 4. The Applicant must pass PAGCOR’s standard probity check for gaming operator suitability via an accredited third party probity checker, comply with all documentary and system requirements, and pay applicable fees. 5. The Applicant is to have only one website to cater to its operations which must be registered with PAGCOR. III. ONLINE POKER PLATFORM STANDARDS AND REQUIREMENTS 1. General Policies A. The Applicant’s gaming protocols must comply with minimum requirements and standards provided set forth hereunder. B. The online poker platform shall have documentations/ manual, i.e., website and/or desktop or mobile application documents indicating, among others, the main functions, web design and contents, accounting documents, and other salient details. C. The OPO shall submit Information and Communications Technology (ICT) documentation as prescribed by PAGCOR following the details found in the attached Annex A – Summary of Technical Requirements. D. The online poker platform must have a certification from an independent gaming laboratory certifying that the betting system of the Applicant’s online poker platform was extensively tested and has been found compliant with the following standards: i. All data are captured, accounted and reported by the system; and; ii. Game is fair, secure, and able to be audited and operated correctly. E. The online poker platform shall not be accessible outside the Philippines nor shall it accept bets emanating outside the Philippines. For this purpose, Internet Protocol (IP) blocking certification must be acquired from an independent gaming laboratory. F. For the purpose of proper collection of fees, the OPO shall allow the integration of its online poker platform with PAGCOR’s third-party audit platform. The OPO shall give the third-party auditor necessary access to the online poker platform.

Table Games Department Page No.: Page 5 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 G. The online gaming platform shall be credible and reliable with regards to the determination of gross rake and other reports as may be required by PAGCOR. H. The OPO shall maintain a replication server to contain and retain a copy of all information, game data, and financial data of all registered players as well as their playing session/s. These data shall be retained for a period of five (5) years. 2. Gaming System The gaming system must: A. Be able to produce auditable and aggregate financial statements of gaming transactions as required by PAGCOR. B. Be able to calculate accurately all taxation and other monies due to PAGCOR and the Bureau of Internal Revenue (BIR). C. Have the technology to verify the identity of registrants for Know-Your- Customer (KYC) purposes. Verification must at least be present prior to account withdrawal of a player. D. Have a mechanism in place to ensure that a player cannot play against him/ herself or occupy more than one seat at an individual table. E. Be able to provide tools and log all relevant activities related to the detection of collusion and cheating and equipped with data analytics to detect and prevent such acts. F. Not employ proposition players nor use bots as proposition players. G. Ensure the accuracy, integrity, reliability, safety, transparency, and confidentiality of all the activities and functions performed, as well as the accuracy and promptness of all prize payout. H. Provide clear information to players on the process of reporting activities related to collusion and cheating, including the suspected use of bots. The process must be simple to use and readily accessible to a player seeking to make a report. I. Be able to maintain and provide all players’ activities information, including IP address, bet status, all gaming history, login and logoff times, and payment information including information on the aggregate financial transactions of players. J. Retain a record of relevant activities to facilitate investigation and be capable of suspending or disabling the player account. K. Assure all the data about the gaming sessions carried out are recorded and can be traced for a period of five (5) years. L. Provide a mechanism to export the data generated for any report to an acceptable format (i.e. csv, xls, pdf) as specified by PAGCOR.

Table Games Department Page No.: Page 6 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 M. Clearly indicate the disconnection protection policy within the gaming platform. N. Contain the following information and easily accessible by the player: i. Player’s Wallet Balance ii. Operator’s Terms and Conditions iii. Relevant policies, e.g.: House Rules and Privacy Policies iv. Financial and game play information v. Responsible Gambling / Problem Gambling Information vi. Exchange Rate, if applicable 3. Random Number Generator (RNG) and Card Shuffling A. The Random Number Generator (RNG) used should be capable of demonstrating the following qualities: i. The output from the RNG is uniformly distributed over the entire output range and game outcomes are distributed in accordance with the expected or theoretical probabilities. ii. The output of the RNG and game outcomes should be unpredictable. For example, a software RNG should be computationally infeasible to predict what the next number will be without complete knowledge of the algorithm and seed value. iii. Random number generation does not reproduce the same output stream (cycle), and that two instances of an RNG do not produce the same stream as each other (synchronize). iv. Any forms of seeding and re-seeding used do not introduce predictability. v. Any scaling applied to the output of the RNG shall not be biased. B. Functionality with an element of chance but not used for generating results shall be based on a certified Random Number Generator (RNG) and related functionality, e.g., a player’s assignment of seat at the poker table in a poker tournament. C. The RNG shall be generally recognized as being a cryptographically strong source for drawing random numbers. D. The RNG output shall pass one of the following statistical tests: i. The DIEHARD test suite; ii. The NIST (National Institute of Standards and Technology) Statistical Test Suite; or, iii. A similar test suite of the same level. E. The tests shall be conducted on a dataset, which PAGCOR’s accredited testing laboratory considers to be sufficient for securing statistical valid results.

Table Games Department Page No.: Page 7 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 F. For games or virtual events that use the mechanical RNGs, the mechanical RNG used should be capable of meeting the requirements in section (III)(3), where applicable. G. Card Shuffling i. The card shuffling algorithm shall be a simulation of the actual card shuffling method with the same probabilities and randomness. ii. Shuffled card deck shall be drawn according to the shuffled sequence. 4. Game Display Requirements A. The display of the game instructions and game information shall adapt and align with the player interface. If multiple information is to be displayed on the player interface, it is acceptable to have the information displayed in an alternating fashion, with the condition that the rate at which the information alternates allow the player reasonable time to read the displayed information. B. Any resizing of the player interface screen shall scale the display accordingly and each touch point shall be mapped accurately. C. The gaming platform shall display only the games authorized for play. The player shall be made aware of which game has been selected for play or is being played. 5. Game Play Requirements A. The OPO must clearly provide notice to players that the use of bot software is not permitted and, if the player is found to have used such software, it will be considered cheating, and the player may be sanctioned by the OPO accordingly. It is the OPO’s responsibility to sanction the use of bots. The OPO shall submit a monthly report to PAGCOR of the list of blocked accounts due to the use of bots. Same with deactivated and dormant accounts.The player shall not be forced to play a game, unless the player is sitting on the blind position which requires the placing of mandatory blind bets. B. The OPO should take all reasonable steps to ensure that their policies for instigating or dealing with service interruptions are fair and do not systematically disadvantage the players. These aforementioned policies must be submitted to PAGCOR for approval. C. Systems must be capable of recovering from failures that cause interruptions to gambling, including where appropriate, the capability to void the games (with or without manual intervention), the capability to suspend the games, and takes all reasonable steps to retain sufficient information to be able to restore events to their pre-failure state. Players’ fund shall be returned for any voided games.

Table Games Department Page No.: Page 8 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 D. The OPO must make available information about their policies regarding service interruptions in various circumstances. E. The game shall clearly indicate to the player the amount of money being gambled, including any conversions from one form of currency to another, or from currency to credits, chips, or other tokens etc., at the point of conversion. F. Any conversion from one currency to another should be clearly presented to the player. G. The game rules shall be easily accessible by the player and before being committed to game play. The content including artwork and text must be accurate and sufficient to explain all the applicable rules and how to participate. All reasonable steps must be taken to ensure that the content is understandable. H. As the poker game progresses, information that may be reasonably expected to enable the player to understand the current state must be displayed. I. Where speed of interaction has a significant effect on the player’s chance of winning, OPO must assess the level of risk and take reasonable steps to reduce the risk to the player. J. The rake schedule and any fees collected shall be displayed by the OPO and easily accessible to the player prior to game play. K. The game rules must clearly indicate any variation in the rake amount based on the table, limit amount, number of players, or jackpot amount. L. The game artwork must clearly indicate the total amount the player has bet on the game currently being played. This amount must be updated every time the player places a wager. M. The game artwork should be sufficient to provide the player with all of the information required to determine whether they have lost or won, and the value of any winnings. N. All tournaments and their prize structures, if applicable, must be clearly explained to the player. PAGCOR shall be notified of all tournaments conducted in the platform. O. Winning hands must be clearly labeled. 6. Player Account Registration A. An OPO shall not permit a person to participate as a player in an authorized game conducted by the OPO unless that person is registered as a player and holds an account with the OPO. A list of registered players must be periodically submitted to PAGCOR. B. Only persons twenty-one (21) years of age and above shall be allowed to register.

Table Games Department Page No.: Page 9 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 C. At the onset, account registration should undergo initial CDD, i.e., counter checking with international databases on sanctions list – e.g., UN Sanctions List, Name Scan, World Check, and determination whether the registrant is a politically-exposed-person or not. D. Registrants should be properly informed that providing false information may cause the forfeiture of their account credits. E. The online poker platform’s player registration or Know Your Customer (KYC) process must have the following minimum capabilities and/or functionalities: i. Requires the submission of registrant’s (i) full name, (ii) date and place of birth, (iii) present address, (iv) permanent address, (v) contact number, (v) nationality, (vi) nature of work/ occupation, (vii) name of employer/ business, (viii) source of funds, and (ix) specimen signature. ii. Requires the submission of a copy of one valid photo-beraing government-issued ID (e.g., Driver’s License, Passport, SSS, TIN ID, Postal ID, Voters ID, UMID, National ID, etc.) of the registrant; iii. Provided that the OPO introduces tiering of players’ account following Customer Due Diligence (CDD) Guidelines of PAGCOR, the OPO may implement levels of CDD subject to approval of PAGCOR of submitted account tiering guidelines applicable to the platform. iv. Requires the authentication of a registered account via email and/or mobile number verification. v. Provided that if the OPO becomes aware that a person has provided false information in this aspect, the OPO shall not register such person and where that person has already been registered, the OPO shall immediately cancel that person’s registration and forfeit all remaining balance in the player’s account. vi. Requires the capability to exclude persons listed in PAGCOR’s National Database of Restricted Persons. vii. Requires the registrant’s declaration of the following information: a. That he/she is at least twenty-one (21) years of age; b. That he/she is not among any of those persons disqualified under the law to engage in gambling, such as but not limited to, public officials, members of the Philippine National Police and the Armed Forces of the Philippines. viii. Requires anti-money laundering (AML) risk assessment. ix. Requires the elevation of KYC to Enhanced Due Diligence should the registrant, including but not limited to politically-exposed persons (PEP) be assessed as high risk.

Table Games Department Page No.: Page 10 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 x. Utilizes a verification process. For this purpose, an account tiering system may be utilized. Video calling may be used to fully-verify and confirm the identity, the submitted information, and ID card of the player prior to confirmation of his/her account. Only fully-verified accounts should be allowed to fully access the platform and the player’s account. xi. A registered player shall only have one (1) account per online poker platform; F. Prior to account confirmation, each player must read and accept the Terms of Use of the online poker platform. The OPO shall initially submit its online poker platform Terms of Use for PAGCOR’s approval. The OPO shall send any subsequent change/s to PAGCOR. A Player’s violation of any provisions of the Terms of Use shall be a ground for the cancellation of his/her online poker platform account. G. Only the online poker platform, and not any payment systems/ channels/ solutions or money transfer service, may perform the Player Registration System, as herein mentioned. 7. Player Account Verification During Login A. The online poker platform shall have the capability to ensure that only the registered player is using his/her account to bet on the platform. Hence, either of the following functionalities for membership verification and monitoring shall be mandatorily implemented in the platform: i. Use of account password. ii. Biometrics verification a. Facial verification; or b. Fingerprint scanning; or c. Iris scanning iii. One-time PIN (OTP) Verification for platform login where the system sends a randomly-generated one-time-PIN (OTP) to the registered number of the player which must be inputted by the player to the system to allow access to the platform. B. The online poker platform must put in place mechanisms to detect the location of a player attempting to access the gaming platform. 8. Account Funding and Withdrawal A. Account funding and withdrawal shall be done only through Anti-Money Laundering Council (AMLC)-compliant channels, such as over-the- counter and online banking, eWallet systems, and through other legitimate money transfer services. Only payment solutions or money transfer

Table Games Department Page No.: Page 11 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 services accredited by the Banko Sentral ng Pilipinas shall be considered legitimate and shall be utilized under this framework. B. Account funding via credit cards or other credit facilities shall only be permitted to approved accounts determined to have low responsible gaming risk based on the OPO’s Player Tiering System. C. For the above purpose, the OPOs shall regularly submit an updated list of all accounts/ payment solutions they are using in receiving funds from its players. It shall likewise ensure, that its players may only fund their accounts, collect their winnings, or withdraw their account credits, through a payment solution/ channel duly registered with it and only under the name of the registered player. D. Funding, withdrawals, and transfers from and to an account other than these registered accounts are strictly prohibited. 9. Poker Game Offerings A. The OPO shall submit a certification from an independent gaming laboratory for each poker game offering including side games/ bets, jachpots, tournaments in the online poker platform. B. The certification should attest to the poker game offerings’ compliance to the provisions of this IRG on (1) Gaming System, (2) Random Number Generator and Card Shuffline, (3) Game Display Requirements, and (4) Game Play Requirements. C. All poker game offerings shall require approval from PAGCOR prior to implementation. D. The OPO shall readily make available to players the rules of any game offerings. The OPO shall ensure that game rules are presented in an easily understandable manner. 10. Minimum Buy-in and Allowable Rake Collection A. The Player’s initial minimum buy-in/deposit shall be set at ₱1,000. Additional top-up/buy-in shall be at a minimum and divisible by ₱500. B. The allowable rake from the pot of every poker deal/hand shall be an amount equivalent to a minimum of three percent (3%) to a maximum of five percent (5%), provided that such amount shall not exceed the OPO’s prescribed ceiling for each table game blinds in the rake schedule. In cases when the OPO will need to start/ keep going a game that may be considered as high stake, the OPO may implement an acceptable rake structure and inform PAGCOR via email as soon as the structure is implemented.

Table Games Department Page No.: Page 12 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 11. Poker Jackpot Requirements A. Jackpot offerings are optional. Implementation requires PAGCOR’s prior approval. B. Jackpot rules must be clearly explained and available to the player before they commit to the poker game. C. The progressive jackpot amount shall be available and accessible by the player at all times when available for game play, and the jackpot value should be updated as frequently as is practicable, particularly after the amount has been reset following a win. D. Jackpot payout amount shall be proportionate to the jackpot amount contributed. E. Jackpot winning amount shall be clearly shown to each individual winning player. F. Jackpot systems must be configured and operated with adequate fairness and security. G. A 20% withholding tax shall be deducted from the individual payouts above ₱10,000.00. H. Jackpot decommissioning shall only be allowed if there is another jackpot available to transfer the jackpot amounts to or when the jackpot is hit and that the main and reserve jackpot is awarded all at once upon approval of PAGCOR for the purpose of jackpot decommissioning. I. In the event of revocation of the OPO’s license, said jackpot amounts (net of the seed money infused by the OPO as long as said seed amount has not been hit in the jackpot) shall be returned to the players that contributed to the jackpot amount. In case the system is unable to identify contributing player, the amount shall be forfeited in favor of PAGCOR. 12. Player Account Maintenance A. All player account transactions shall be recorded and logged in an accurate and complete manner and shall be made readily available to the player. B. The player account transactions at a minimum shall include deposit and withdrawal history, date and time of previous login, gaming event and transaction history, total monies wagered per session and/or for a period of time, total monies won and lost per session and/or for a period of time, and account balance at the start and end of the session. Where applicable, this information shall be available to the player on their gaming account for at least 90 days. C. The gaming platform shall not accept a stake from a player unless there are sufficient funds in the game account to cover the value of the stake.

Table Games Department Page No.: Page 13 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 D. The OPO shall make sure that, if a game is interrupted due to technical reasons not attributable to the players, the players who have placed a stake before this interruption can continue the interrupted game. If this is not possible, the stake will be returned to the player/s according to the terms and conditions on account maintenance. E. All test transactions and test account should be notified to PAGCOR and should abide by PAGCOR’s test account policy. 13. Deactivation and Dormant Accounts A. Player may elect to deactivate their gaming account at any time. B. Where necessary, a player gaming account may be deactivated by the OPO or under PAGCOR’s request. C. Once the player gaming account is deactivated, the player information shall be retained for a period of five (5) years. D. Where a player gaming account becomes dormant or is deactivated, the player shall be able to recover the balance of their account. E. Reasonable efforts shall be made to inform players of their funds remaining in the dormant/ deactivated gaming account. The OPO’s policy on account dormancy shall be submitted to PAGCOR. F. A list of deactivated accounts shall be periodically submitted to PAGCOR. 14. Reportorial/ Documentary Requirements The OPO shall submit the following: A. Monthly relevant data (e.g., rake, tournaments, progressive jackpot, etc.) not later than the 2nd day of succeeding month following a standard format to be set by PAGCOR. B. List of payment solutions utilized in the system (both for funding of and withdrawal from player’s account) to be submitted everytime change/s occur. C. Proof of quarterly remittance of 5% Franchise Tax to the Bureau of Internal Revenue (BIR) to be submitted within seven (7) days after the deadline set by the BIR. D. When the OPO offers a jackpot, it shall submit proof of remittance to the Bureau of Internal Revenue (BIR) of the 20% Withholding Tax deducted from jackpot winnings exceeding ₱10,000.00. The proof of remittance shall be submitted to PAGCOR within three (3) working days upon remittance to the BIR. E. Annual submission of the following on or before May 31st of each year: i. Business Permit for the current year – nature of business must pertain to its online poker operation.

Table Games Department Page No.: Page 14 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 ii. Updated General Information Sheet (GIS) duly received by SEC; if a stockholder is also a corporation, a copy of the latest GIS of said corporation should likewise be submitted. iii. Company Income Tax Return (ITR) duly filed with the Bureau of Internal Revenue (BIR) iv. Personal Disclosure Statement F. Test reports conducted by an accredited gaming laboratory on any of PAGCOR’s required testing/ certification. 15. Responsible Gaming A. The online poker platform shall abide by the PAGCOR Responsible Gaming (RG) Code of Practice. B. The online poker platform shall prominently display a responsible gambling statement, and provide a link to a page that provides responsible gambling materials, information, resources and support for people experiencing problems with gaming. C. The online poker platform shall implement and make accessible to its players the player exclusion regulations contained in the RG Code of Practice. D. The online poker platform shall offer limited deposit or limited play restrictions that the player may set for himself/ herself. 16. Miscellaneous Provisions on Online Poker Platform Standards and Requirements A. The OPO shall notify PAGCOR of any modification on any electronic gaming system, interface elements, equipment or games. B. The OPO may conduct a version upgrade of the online gaming platform and shall notify PAGCOR by submitting a report/write-up on the overview of the version upgrade including the features and functionalities of the new version. C. Given a situation where the online gaming system failed under critical system failure and required an emergency software patch to put the system back online, the OPO shall notify PAGCOR’s Compliance Monitoring and Enforcement Department (CMED) for I-Gaming/ TGD immediately and submit a report outlining the incident and the rectification steps taken. D. Adequate measures must be put in place to address issues (e.g. hacking or theft, virus infection, and other cyber threats) that may compromise online transactions and cause downtime in poker gaming operations.

Table Games Department Page No.: Page 15 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 IV. COMMENCEMENT OF OPERATIONS 1. Upon approval of the application of the PAGCOR Board of Directors, the OPO shall be advised to: A. Post the required ₱20M Performance Cash Deposit. B. Submit a detailed operating manual of the platform, including but not limited to, player registration process, account funding, playing the games, account withdrawal, backend access, and reports generation. C. Submit a photocopy of: i. Mayor’s Permit/Business Permit/Municipal License for the relevant gaming activities from the location of the company office; ii. BIR Registration Certificate 2. PAGCOR shall then conduct a site inspection of its related facilities. 3. Likewise, the online poker platform shall be tested. This testing will simulate real scenarios on, but not limited to, player registration, account funding, actual play, account withdrawal, and generation of required reports, to determine the compliance of the system with regulations and its capability and readiness to fulfill the prescribed scope of service. The online poker platform’s integration with PAGCOR’s third-party audit platform shall also be tested. 4. Should the OPO and its platform accomplish/ pass the abovementioned items, PAGCOR shall issue a Notice to Commence online poker operations to the OPO. 5. The online poker license shall be valid for three (3) years upon commencement of operations. V. FINANCIAL CONSIDERATIONS AND OBLIGATIONS 1. The OPO shall remit to PAGCOR and BIR, as indicated herein, the following: A. The OPO’s License Fees due to PAGCOR shall be the higher amount between the PAGCOR Share and the monthly Minimum Guarantee Fee (MGF). PAGCOR Share shall be set at 10% of the total collection (gross rake contribution, tournament entry fees, jackpot rake administrative fees) on the initial implementation which, together with the Monthly Minimum Guarantee Fee (MGF), shall be subject to review. B. Third-party audit fee shall be equivalent to 10% of PAGCOR Share. C. The OPO shall subject its gross gaming revenue (GGR) to 5% Franchise Tax (FT) as follows:

Table Games Department Page No.: Page 16 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 i. Equivalent of five percent (5%) of the PAGCOR Share shall be remitted to PAGCOR. ii. The remaining 5% of the GGR shall be remitted directly to the revenue district office of the Bureau of Internal Revenue where its office/ operations is located. D. The OPO shall be billed with the PAGCOR Share by TGD. 2. CMED-IG will be in-charge of monitoring the platform and enforcement of these guidelines. 3. Failure to remit the amounts due to PAGCOR on time shall result in surcharge penalty of one percent (1%) of the amount due on all remittances made after the prescribed remittance schedule up to the time of payment, prorated on a daily basis. 4. All costs, whether essential and/or incidental for the operation of the online poker platform, must be shouldered by it. 5. All claims by any player of the OPO or by a third-party shall be shouldered by the OPO and shall hold PAGCOR free from all claims and obligations. VI. MARKETING PROGRAM The OPO should conduct marketing programs subject to the prior approval of PAGCOR following the IRG for online products/offerings. VII. MISCELLANEOUS PROVISION 1. The implementing rules and guidelines herein are designed specifically for online poker operation. 2. The OPO shall at all times ensure compliance with the following: A. Anti-Money Laundering Act of 2001 and the Casino Implementing Rules and Regulations Act No. 10927; B. Data Privacy Act of 2012 C. Responsible Gaming Code of Practice 3. Any deviation from the IRG may result in the suspension of the online poker operation. Any loss incurred due to such remiss shall be solely shouldered by the OPO. 4. The OPO must establish a 24/7 customer service and complaint resolution mechanism for any complaint arising from the conduct of its operations. Conflicts that cannot be resolved at the OPO’s level may be elevated in writing to PAGCOR through TGD for final resolution. 5. If needed, other websites to be utilized by the OPO shall be treated as a new application and shall be subjected to payment of applicable fee/s and requirements.

Table Games Department Page No.: Page 17 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 6. The OPO must submit to CMED-IG its list of newly registered players on a monthly basis. 7. The OPO must maintain in its records the files including the copies of IDs of its players for PAGCOR’s use upon demand. 8. Operations shall be monitored by CMED-IG, as well as operations at the source. The CMED-IG together with PAGCOR’s third-party audit platform, must continuously monitor and ensure that the online poker platform captures all data, and properly accounts and reports the same. For this purpose, the CMED-IG shall have its own Implementing Rules and Guidelines for the proper monitoring of online poker operations. 9. The OPO shall comply with all Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Laws and Implementing Rules and Regulations issued and shall be issued by the Anti-Money Laundering Council (AMLA), PAGCOR, and other relevant government agencies, To this end, the OPO shall: A. Register with the Anti-Money Laundering Council as a covered person; B. Conduct institutional risk assessment as provided for by AMLC. C. Develop/ adopt a money-laundering and terrorist financing prevenetion program. The OPO shall assign a compliance officer. The assigned compliance officer shall also address the OPO’s compliance with the Data Privacy of 2012 and the Responsible Gaming Code of Practice. 10. Any misrepresentation, breach and/or circumvention, directly or indirectly, of any of the conditions set in this regulatory framework for online poker operations, any other relevant communication or memorandum issued by PAGCOR, and/or any law, local or national, shall be sufficient ground for the immediate blacklisting of the erring OPO and shall be cause for the imposition of suspension, penalties, and revocation of the OPO’s license. 11. To ensure the compliance with the Regulatory Framework for the Licensing and Accreditation of OPOs and platforms and other lawful orders of PAGCOR, the following demerits and administrative penalties shall be imposed accordingly. A performance score card shall be assessed to the OPO at the end of the license term which shall be one of the bases for license renewal. The performance score card shall reflect demerit points marked against the OPO whose points will begin at 100. An ending score below 50 disqualifies the OPO for license renewal. a. Assessment of Demerits and Penalties i. Based on the nature of the offense, each offense will correspond to demerits and penalties. Major offenses will be accorded a corresponding demerit and penalty and will be collected from the OPO or may be deducted from its Performance Cash Deposit.

Table Games Department Page No.: Page 18 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 ii. Demerit points will be marked against the OPO’s Performance Score Card at the time of License renewal. Notwithstanding the imposition of penalties, the commission of offense/s by an OPO shall be taken intoconsideration in the renewal of License. iii. One demerit point shall have a monetary equivalent of ₱1,000.00 to be assessed to the OPO prior to the expiry of its current license payable before license renewal or cessation, whichever is applicable. b. Table of Offenses Demerit Item/ Description Sanction Penalty Remarks Points KEY PROVISIONS Allowing Demerit 5 ₱100,000.00/ prohibited and per person per unregistered session player/s to place bets. Allowing minor/s Revocation of to place bets. license Non-Remittance Penalty + 5 ₱30,000.00 Non-remittance shall be subject to penalty and demerit, of Amount due to Demerit as prescribed; and a notice of non- compliance PAGCOR, i.e., demanding settlementof all arrears within thirty (30) License Fees and days shall be issued. PAGCOR Shares Failure to settle thearrears within thirty (30) days shall causethe issuance of noticeof suspension. Failure to settle the third (3rd) and final notice of collection within thirty (30) daysshall lead to revocation of the License. Non-payment of Penalty + 5 ₱50,000.00 player’s winnings Demerit Making any Penalty + 5 ₱50,000.00 unauthorized Demerit deduction from winnings of players Unauthorized Demerit 3 Demerit is per day of offense; Notwithstanding the suspension of demerits imposed for each day of offense, continuous operations unauthorized suspension of operations may cause the (including failure to revocation of the License. resume operations after the approved period of non- operation granted by PAGCOR).

Table Games Department Page No.: Page 19 of 19 IMPLEMENTING RULES AND GUIDELINES Revision No.: 0 FOR THE LICENSING OF ONLINE POKER OPERATORS AND ITS PLATFORMS Effectivity: March 23, 2023 Demerit Item/ Description Sanction Penalty Remarks Points Failure to restore Demerit 5 Demerit is for every month of non- compliance. the Performance Cash Deposit at its original level within fifteen (15) calendar days from deduction. Document Submission Non-compliance Penalty + 3 ₱30,000 - Notwithstanding the penalty and demerits imposed, with the manual Demerit non- issuance of a renewalLicense upon expiration of and/or electronic the current License shall cause the automatic submission of suspension of online operations; documentary Should the suspension reach a period of thirty (30) requirements on days, the gaming sitewill be permanently closed. time - Failure to submit theBusiness permit may cause the revocation of the License VIII. RENEWAL Renewal of online poker license shall require submission of a letter of intent at least three (3) months prior to expiration of the previous license. The same shall be subject to a renewal fee of P1,000,000. IX. ACCREDITATION OF ONLINE POKER PLATFORM An operator/ developer of an online poker platform may opt to have its platform accredited for a prospective tie up with a poker gaming site operator for the latter’s online poker operations. 1. The operator/ developer of an online platform must submit a letter of intent (LOI) addressed to the Chairman and CEO of PAGCOR. 2. The online poker platform must pass the requirements/ provisions contained in Part III - Online Poker Platform Standards and Requirements of this document. 3. Payment of non-refundable and non-transferable Accreditation Fee shall be Five Hundred Pesos (₱500,000.00) prior to recommendation to the PAGCOR Board for approval. 4. Upon approval of the Board, PAGCOR shall then conduct evaluation of the dedicated poker platform and inspect its related facilities. It will simulate real scenarios on, but not limited to, player registration, account funding, actual play, account withdrawal, and generation of required reports to determine the compliance of the platform with regulations and its capability and readiness to fulfill the prescribed scope of service. 5. The approved online poker platform shall be included in the list of approved online poker platforms that poker gaming sites may choose from should it decide to operate online poker.

Annex A Summary of Technical Requirements 1. Hardware Inventory List of Information and Communications Technology (ICT) related devices which may include but not limited to the following information: 1.1. Device Name 1.2. Brand/Model 1.3. Serial Number 1.4. Part Number 1.5. Accompanying Software (if any) 1.6. Installed Location 1.7. Purpose/Role 1.8. User Manuals If not included in the user manuals, all devices capable of being interfaced with system to include wiring diagrams depicting connection points to devices, power, etc. any unique wiring harnesses and ancillary boards required for communication of a particular device. 1.9 Hardware support Service Level Agreement with vendor 2. Software Inventory 2.1. Gaming Platform System 2.1.1. Module Name 2.1.2. Version Information 2.1.3. Brief Description of Module Function 2.1.4. Sample Reports (if applicable) For each standard report capable of being generated on the system with a formula summary detailing all reporting calculations including data types involved, mathematical operations performed, and field limit. 2.1.5. License Information (if applicable) 2.1.6. User Manuals Both hard and soft copy format to include a general overview of the system from a component level, software and hardware setup and integration, system block diagrams or flow charts for the communication program (if applicable). 2.1.7. Software support Service Level Agreement with vendor 2.2. Operating Systems 2.2.1. Product Name 2.2.2. Version Information 2.2.3. System Documentation or User Manual 2.2.4. License Information (if applicable) 2.3. Antivirus Software

2.3.1. Product Name 2.3.2. Version Information 2.3.3. System Documentation or User Manual 2.3.4. License Information (if applicable) 3. Backup/Recovery Procedures 3.1. Backup Procedures The backup procedures may include the following information: 3.1.1. Backup Software 3.1.2. Backup Type (full, incremental, differential, snapshot, etc.) 3.1.3. Backup Schedule 3.1.4. Data Repository 3.1.5. Data Compression/Encryption method (if any) 3.1.6. Retention Period 3.1.7. Limitations (if any) 3.2. Recovery Procedures The recovery procedures may include the following information: 3.2.1. Recovery Software (if applicable) 3.2.2. Recovery Techniques 3.2.3. Recovery Point Objective (RPO) The Recovery Point Objective (RPO) is the point in time to which the system must recover data as defined by the management. 3.2.4. Recovery Time Objective (RTO) The Recovery Time Objective is the duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity. 4. Network Diagram 4.1. Gaming Floor Layout 4.2. Network/Cabling Diagram for Data, Audio/Video, Electrical, Surveillance, if applicable. 5. Internet Subscription 5.1. Subscription document between the Internet Service Provider (ISP) and subscriber 5.2. List of IP Address range assigned by the ISP 6. System Testing PAGCOR Test Team from different departments will conduct system testing of the Gaming Platform System prior to live implementation and subject for approval of PAGCOR management (depending on the result of the testing). The requirements for the system testing are as follows: 6.1. Test Environment (could be the same with the proposed live environment) 6.2. Player Accounts with account balance (as agreed by the casino operators and PAGCOR Test Team) 6.3. User account for preparation of system generated reports

6.4. User account for monitoring of player/user transactions (if applicable) 6.5. Results of In-house Testing (if any) 7. Training System Administration training for PAGCOR personnel who will handle the monitoring of technical related transactions 8. Contact Information 8.1. Key Persons (Casino Operator) 8.2. System Providers 8.3. Internet Service Providers 9. Information Systems Security 9.1 Please refer to Chapter 5 of the GLI-19 Interactive Gaming Systems v2.0 documentation 9.2 IP blocking certification that the online gaming website is only accessible outside the Philippine jurisdiction 9.3 VPN Blocking – the system must implement a Virtual Private Network (VPN) blocking system to ensure computer security and internet censorship. 9.4 System Security Certification/Documentation – series of vulnerability testing procedure to ensure the website is secured. (e.g. SQL injection, Cross-site request forgery (CSFR), XSS – URL protection, etc.)