14 CFR 65.31: Required credentials, certificates, and ratings or qualifications.

No person may act as an air traffic control tower operator at an air traffic control tower in connection with civil aircraft unless he or she—

(a) Holds an FAA Credential with a tower rating or an air traffic control tower operator certificate issued under this subpart;

(b) Holds a facility rating for that control tower issued under this subpart, or has qualified for the operating position at which he or she acts and is under the supervision of the holder of a facility rating for that control tower; and

(c) Except for a person employed by the FAA or employed by, or on active duty with, the Department of the Air Force, Army, or Navy or the Coast Guard, holds at least a second-class medical certificate issued under part 67 of this chapter.