- Minimum age
- 21+
- KYC timing
- Information is collected when the account is opened. If identity, deposit or withdrawal details cannot be verified, the permit holder must request further information within 21 days and, failing verification, suspend the account, refund deposits and send any winnings to the Director for the Problem Gambling Treatment and Support Fund (11VAC5-70-290 D). Identity must be re-verified on reasonable suspicion of compromise (11VAC5-70-290 N).
- AML regime
- Internal controls and the platform risk framework must include anti-money laundering compliance standards (11VAC5-70-270 C 3 f); house rules must warn players that wagers are subject to AML rules, including currency transaction and suspicious activity reports, and must prohibit structuring (11VAC5-70-260 C, D). Permit holders must report suspicious or illegal wagering, including laundering and use of illegal funds, to the Lottery (§ 58.1-4044 A 5), and must report violations of the Virginia Comprehensive Money Laundering Act or federal money laundering law (11VAC5-70-230).
- AML supervisor
- Federal anti-money laundering regime, with the Virginia Lottery enforcing its AML-related regulations
- Deposit limits
- Permit holders must honour requests to set deposit limits and publish procedures for them; limits can be tightened at any time but loosened only after the current restriction expires (11VAC5-80-120 A, B).
- Session limits
- Platforms must let players note the passage of time and start cooling-off periods (11VAC5-80-90), offer timeouts and pop-up warnings (11VAC5-80-120 B), and suspend an account at the player's request for any period of at least 72 hours (11VAC5-70-290 R).
- Data localisation
- All wagers must be initiated and received within Virginia unless federal law permits otherwise; intermediate routing of data does not change where a wager is placed (§ 58.1-4046; 11VAC5-70-270 A). No requirement to host servers in Virginia was found in the statute or regulations read.
- KYC requirements
- One account per player per permit holder. At account opening the permit holder records legal name, date of birth, residential address (not a PO box), phone number, email, Social Security number (or the last four digits where the full number can be established, or a passport or taxpayer number for a foreign player), confirmation that the player is not prohibited, and the number of a government ID or an approved remote multi-source authentication (11VAC5-70-290 B, F). Age-verification methods must be approved by the Director (11VAC5-70-210 B). Records are kept for five years.
- Stake limits
- Players may limit their total betting activity or restrict themselves to bets below a set amount (11VAC5-80-120 A). House rules must disclose the operator's power to limit maximum bets (11VAC5-70-260 E).
- Mandatory player messaging
- Platforms must show a responsible gambling logo, the toll-free National Problem Gambling Helpline number and a responsible gaming commitment (11VAC5-80-80), link to the Sports Bettors' Bill of Rights (11VAC5-80-20) and the self-exclusion programme (11VAC5-80-90), and publish parental control procedures (11VAC5-80-50 C). Permit holders must keep a responsible gambling policy, train staff, and have systems to identify at-risk players (11VAC5-80-120).
- Reporting obligations
- Monthly tax returns by the 20th (§ 58.1-4037 B); records of all bets and of suspicious activity kept for at least three years after the event (§ 58.1-4034 B, C); prompt reports of criminal or disciplinary proceedings, abnormal betting, integrity breaches and suspicious wagering to the Lottery and affected sports governing bodies (§ 58.1-4044); an annual report of wagers, adjusted gross revenue and payouts by 15 January (11VAC5-70-250 A); daily reserve calculations with deficiencies reported within 24 hours (11VAC5-70-140 D); complaint records kept for four years (11VAC5-80-30 D).
- Game content restrictions
- No bets on youth sports, no proposition bets on college sports, and no bets on any single game involving a Virginia college team (§ 58.1-4039). The Lottery's directive also excludes proposition bets on injuries, unsportsmanlike conduct or officiating calls, bets on subjective awards and bets on drafts; operators may offer only events and wagers in the approved catalogue. Proxy servers and simultaneous logins from inconsistent locations must be blocked (11VAC5-80-110).