Finland notifies EU of gambling tech rules for data vault and OCSS signing

Finland has submitted technical gambling regulations covering a regulatory data vault and the Official Control Signing Service (OCSS) to the EU’s Technical Regulation Information System (TRIS) on 10 July.

According to the notified documents, operators must submit signed gaming and player-account data to the authority through a secure SFTP data vault in a prescribed format. The rules also require operators to retain the data for five years and ensure “its integrity, availability and retrievability.”

The documentation also sets out requirements for using the authority’s OCSS to sign gaming data. It specifies signing generally every five minutes for gaming transactions and at least once daily for player-account data, alongside obligations to manage API keys and handle technical disruptions.

The technical documents are currently available only in Finnish. The press release says unofficial English translations have been prepared, titled “eCertification of Gaming Transactions and Gaming Account Transactions EN” and “Submission of Gaming Transactions and Gaming Account Transactions EN.”

The press release also lists the broader status of technical documentation supporting Finland’s new gambling regulation. It says randomness checks and reliability and information security requirements have been adopted into national legislation; the OCSS signing and data-vault transfer specifications have been notified via TRIS; player-account and game-event data specifications are being prepared following an earlier public consultation; a Ministry of the Interior decree is under public consultation; and drafts are still awaited covering player identification APIs, jurisdiction-wide self-exclusion checks, and certification requirements for games and platforms.