Developing The Thresholds Everyone Printed Would Have Missed ProPublica's Reporter. The Eleven Triggers Nobody Printed Would Not

Three numbers travelled from New York's Gaming Commission to the wires on Friday: deposits over $10,000 in 24 hours, deposits over $100,000 in 90 days, and more than $1 million wagered in 90 days. They are real, they are in the rule, and they are the least consequential part of it.

Here is why. Jake Pearson, the ProPublica reporter whose September 26 investigation is the reason this rulemaking has urgency, capped his own DraftKings deposits at $100 per 24 hours. Over 90 days that is $9,000 — nine per cent of the second threshold. He never approached $10,000 in a day. He did not wager $1 million in a quarter. He lost more than $10,000 across ten weeks on two apps, was invited into a VIP programme the day after chasing a loss of nearly $1,800, and received promotional alerts while he was in the middle of setting limits on himself.

Under the three thresholds that got printed, nothing about Pearson would have tripped. Under the eleven triggers that are actually in proposed 9 NYCRR § 5330.34(d)(4), he would have been flagged inside a week.

The eight triggers nobody quoted

The list is long and almost none of it is about money. Alongside the three dollar figures, a licensee would have to flag a patron for due-diligence review when the patron:

• opens the self-exclusion request page without completing it three or more times in 30 days;
• requests a second cooling-off period within 45 days of the first one ending;
• makes three consecutive increases to any responsible-gambling limit, with no decreases, inside seven days;
• cancels pending withdrawal requests three times in 10 days;
• was active for the prior two weeks and then logs 50 per cent more time in the current week than in that two-week baseline;
• ends two or more sessions in the same week with less than $1 left in the account;
• concludes two or more sessions in a week each with more total wagers than the session before;
• deposits from more than two funding sources inside 24 hours.

Four of those categories were previewed in public in March, when Hochul announced the package: the Commission described "activity triggers" keyed to large deposits, repeated betting-limit increases, cancelled withdrawals and increased time gambling. What March did not say is how specific the numbers would get, or that the ladder they lead to ends where it does.

Read the eleven as a group and they are not thresholds. They are a behavioural description — the shape of a person losing control, written down by someone who has looked at the data. The patron who keeps opening the self-exclusion page and closing it. The patron who ratchets their own limit up three times in a week. The patron who ends the night at zero, twice. Pearson's test hit several of these by design, because the behaviours are the ones that define the condition.

Two of them point directly at practices the industry has never defended in public. Cancelling a withdrawal three times in ten days is the signature of a bettor talking themselves back into action, and subdivision (d)(7) attacks it from the other side: a patron "may not cancel or reverse a withdrawal request within a three-day period" and any solicitation by a licensee asking patrons to rescind pending withdrawals is flatly prohibited. Someone at the Commission knows that retention teams call people who try to cash out.

The ladder ends with the account closed

The interventions at (d)(6) are the part of this proposal that has no American precedent in sports betting, and we have not seen it described anywhere.

Phase 1 is an email about limits, cooling-off, self-exclusion and account closure. Phase 2 requires the patron to watch a Commission-approved video tutorial, in full, with audio and video, before placing another wager, and the licensee must generate and retain a record that it was watched to the end. Phase 3 is a phone or video call from a named human — the "responsible gambling lead," one designated employee per licensee — who must discuss the behaviour, hand over the contact details of a New York-licensed counsellor, hand over their own contact details, and consider referral to emergency medical or mental-health services or to law enforcement if the patron may be a danger to themselves or others.

Then the enforcement machinery starts. Three call attempts, each at least 24 hours after the last, with a voicemail every time. If the lead still has not spoken to the patron, an email goes out and the account is suspended until a live conversation happens. The account stays suspended until that conversation produces a determination that the patron no longer meets the at-risk criteria.

And if the conversation produces the opposite conclusion: "the patron's account shall be closed, and the patron shall be referred to available problem gambling resources."

Shall. Not may. A New York licensee that works all the way through a Phase 3 intervention and concludes its customer is still at risk would be required by regulation to terminate the relationship. Every state in the country has rules requiring books to offer self-exclusion; this is a rule requiring a book to exclude someone who has not asked. The loss curve of the customers who reach Phase 3 is, by construction, the top of the revenue distribution. New York is proposing that sportsbooks be legally obliged to fire their best accounts.

There is a quieter provision that may do as much work. Once a patron is on the at-risk list, (d)(2)(iii) requires the lead to ensure they "are not presented with direct advertising materials, including, without limitation, marketing, promotions, casino- and gaming-event invitations and complimentary services or items." That sentence is aimed squarely at the 5:01 p.m. VIP Showcase email. Paired with Friday's other proposal — the ban on using individual data to time or target any promotion — it ends the hosted-VIP model as a thing that can legally exist in New York.

Where the rule gets neutralised

The strongest case against taking any of this at face value is that the licensee grades its own homework.

A trigger does not create an at-risk patron. It creates a "due-diligence review," defined at (d)(1)(iii) as "a comprehensive examination and assessment of a patron's financial vulnerability and gaming patterns" — a requirement the October 8 memo says was added to this draft after industry comment, which is interesting on its own. The operator then decides whether the patron is at risk. If it decides no, it writes down why and keeps that document for seven years. Nothing in the proposal gives the Commission a standard for reviewing that judgment, and nothing sets a ratio the Commission would find suspicious. A book with a compliant paper trail and a generous view of its whales can run eleven triggers and an empty list.

The sharper problem is the exception at the foot of (d)(4):

"Notwithstanding subparagraphs (i), (ii) and (iii) of this paragraph, if a patron has been reviewed for proof of funds and/or further financial probity within the previous 60 days to determine whether wagering activity is commensurate with funding or a due-diligence trigger, an additional due-diligence review is not required."

Subparagraphs (i), (ii) and (iii) are the three dollar thresholds. So the customer depositing $10,000 a day — the exact customer the headline numbers were written for — is exempt from re-review if the book did a source-of-funds check in the previous two months. Source-of-funds checks are routine for high-stakes accounts; they are a standing feature of VIP onboarding. As drafted, the provision most likely to apply to the largest accounts is the one that excuses the review. If the Commission wants this rule to bite where the money is, that paragraph needs a cap on how many consecutive 60-day windows a single probity check can cover.

And then the gap O'Dwyer named himself. The at-risk list is maintained per licensee and furnished to the Commission on request. It is not shared. A patron closed out at Phase 3 by one New York book can open an app from another one that afternoon with a clean record, because, in the chair's words, "there is no uniform system for sharing responsible gambling data." He told operators that if they do not build one, the Commission will, and they "may not like the situation or the solution that we come up with." Friday's proposals do not build one.

That is not a drafting oversight; it is the whole difficulty. A mandatory-closure rule without shared data is a displacement rule. It moves the person with a problem from a licensee that just concluded they have a problem to a licensee that does not know. And the displacement does not stop at the state line or at the licensing boundary — the available alternatives include offshore sites and federally registered prediction exchanges, neither of which has ever seen New York's at-risk list and neither of which would be allowed to.

So we land somewhere uncomfortable: the strongest provision in Friday's package is also the one most likely to export the harm it identifies. The answer is not to drop the closure requirement, which is the first thing any state has proposed that an addicted bettor's own operator would have to act on against its own interest. The answer is the thing the chair asked for and the rule did not do. Mandate the data exchange — build it inside the Commission if the industry will not — and the closure provision becomes protection instead of a transfer. Leave it out, and in two years someone writes the story about the man New York closed, who simply moved next door.