The standard for casino card payments in NZ
PCI DSS is an industry standard set by the PCI Security Standards Council for organisations that handle card data. The Minimum Standards name the version and make compliance a condition for licensed casinos, so it binds the provider that processes the card as well as the casino brand. Customer data comes under a second condition: it must not be hosted anywhere that would prejudice New Zealand's reputation.
Other rules that touch a card deposit
- Sign-in needs a unique identifier and a password every time, and a customer may choose multi-factor authentication for sensitive steps such as registering a new deposit or withdrawal method.
- An account is logged out automatically after a period of inactivity chosen by the operator, which may reach 30 minutes at most.
- Transactions on an account must be uniquely identifiable and traceable to one customer.
- Time, deposit and spend limits must be easy to find, including on deposit screens or through a link from them.
- A customer may lower a limit at once, but raising or removing one needs a wait of at least 24 hours.
- Each platform keeps a self-exclusion register that is checked before an account is activated and again at every login.
Card data in DIA's market reports
DIA's market insight reports measure online gambling spend through card transactions from one bank, scaled up to estimate the whole market. They count deposits and not the amounts wagered, and they leave out TAB and Lotto NZ.