It's increasingly hard to tell one from the other. The mechanism here appears to be (the article itself is light on facts) a contract, same as would be with a

It's increasingly hard to tell one from the other. The mechanism here appears to be (the article itself is light on facts) a contract, same as would be with a private entity. The entity on the other end of the contract could be private, public or mixed. The rule/clause may originate in a contract between this entity and a 3rd party, or the entity's interpretation/implementation of a regulatory framework. In regulated industries, the last version is ubiquitous. A bank, casino or whatnot will have a "compliance" function. There will be "regulatory/compliance" requirements, rules and clauses. It's never clear whether these are government rules, private policies, etc.