Churchill Downs Calls for FTC Review of Horse Racing Regulator HISA

The American horse racing industry is facing a significant internal rift. Churchill Downs, the powerhouse behind the world-famous Kentucky Derby, has officially called for a federal investigation into its own regulator. In a letter dated August 28, 2026, addressed to FTC Chairman Andrew Ferguson, the company demanded an independent review of the Horseracing Integrity and Safety Authority (HISA). The allegations are serious, ranging from technological incompetence to a lack of transparency that threatens the very foundation of the sport.

William Carstanjen, CEO of Churchill Downs, argues that the current state of oversight is unsustainable. As the operator of the Churchill Downs Racetrack and the TwinSpires wagering platform, the company has a massive stake in maintaining public trust. However, two recent controversies have severely damaged that confidence, leading to this direct appeal to the Federal Trade Commission.

Numbers and facts

The financial burden of HISA on the thoroughbred industry is staggering. Since its inception, mandatory assessments on racetracks have exceeded $250 million. A significant portion of this budget, roughly 12 percent, was allocated to technology. Despite this $30 million investment, the HISA Portal suffered a critical security failure. Confidential veterinary records, which are supposed to be restricted to specific owners and veterinarians, were allegedly accessed by unauthorized parties for weeks.

One central figure in this scandal is Marshall Gramm, a college professor and prominent horse owner. HISA has charged Gramm with multiple rule violations, including fraud, related to the unauthorized access of these portal records. The situation was further complicated when HISA CEO Lisa Lazarus initially denied that the leaked data came from the authority's own systems, only to have the organization later confirm that the portal was indeed the source of the breach.

"HISA’s legitimacy depends on confidence that it is transparent, accountable, technologically competent, and subject to meaningful oversight. The recent controversies have further damaged that confidence." - William Carstanjen, CEO of Churchill Downs

Background

Beyond the data breach, the "Fair Hill Five" case has raised eyebrows across the industry. This controversy involves unusual betting patterns and a string of wins by horses linked to a specific training center. Churchill Downs pointed out that HISA failed to disclose a trainer's positive test for a banned substance until long after the suspicious wagering had become a public concern. This delay in transparency is viewed as a major failure in maintaining betting integrity.

While battling regulators, Churchill Downs is also fortifying its market position against new gambling forms. During a quarterly earnings call, where the company reported record revenues of $665.9 million for the end of 2025, Carstanjen dismissed the threat of prediction markets like Kalshi. He noted that horse racing operates under the Interstate Horse Racing Act of 1978, which provides federal protections for their content, meaning prediction markets cannot offer bets on their races without explicit consent.

Why it matters for German players

For German racing fans and bettors, this US conflict serves as a reminder of the benefits of a centralized, state-run regulatory system. Germany’s Glücksspielstaatsvertrag 2021 ensures that all wagering is overseen by the GGL, preventing the kind of jurisdictional chaos currently seen in the US courts. In Germany, a data breach of this magnitude would trigger immediate regulatory intervention and likely result in heavy fines or license revocation. German players are protected by the LUGAS system and a strict 1,000 euro monthly deposit limit, ensuring a level of safety that is currently being questioned in the American market.

What it means for GGL-licensed casinos

Licensed operators in Germany must view the HISA failure as a cautionary tale. Technological investment is only effective if combined with rigorous access controls and a culture of transparency. German law requires operators to be whitelisted and to adhere to strict data protection standards. The Gramm case proves that even respected figures can exploit system vulnerabilities if oversight is lax. For GGL-licensed casinos, the lesson is clear: maintaining the integrity of data and reporting suspicious activities promptly is not just a regulatory requirement but a necessity for long-term survival in a regulated market.