Knowledge base October 23rd, 2026

What Is RNG in iGaming? A Certification and Due Diligence Guide for Casino Operators

Written by Claire Evans

Key Takeaways for Operators and Suppliers

Random number generator (RNG) is the algorithm that produces the unpredictable numbers behind every casino game outcome—the digital stand-in for a shuffled deck, a spun wheel, or rolled dice.
RNG runs well beyond the slot reel—bonus mechanics, jackpot triggers, promotional mechanics, and even parts of live casino rely on RNG. Each RNG casino game has its own certification requirement.
An RNG is only as trustworthy as the lab that tested it, and that lab is only as trustworthy as its accreditation. Certification (commonly GLI-19 for online casino RNG) confirms the algorithm is sound; a separate accreditation (ISO/IEC 17025) confirms the lab itself is competent and independent. Both matter.
Certification is tied to one exact build, one RTP variant, and one jurisdiction—never ‘the game’ in general. A certificate doesn’t transfer between markets, between RTP versions (the common 96/94/92% pattern), or between software builds.
Once certified, a build is locked. Paytable edits, new bonus mechanics, RNG library updates, jackpot changes, or expansion into a new market trigger re-certification.
Due diligence is ongoing, not a one-time gate. Checksum verification against the certified build, live RTP monitoring, and periodic reconfirmation of a lab’s own accreditation status are what keep a certificate worthy.

What Is RNG in iGaming?

The abbreviation ‘RNG’ stands for the random number generator, which is a tool that produces an unpredictable sequence of numbers. These numbers are then converted to the round outcome by the game software. In simple words, RNG is a virtual croupier that shuffles a deck, draws cards, or spins a wheel.

To make an online casino feel real, the produced outcomes should be consistent and unpredictable. The production of such results is a mathematical, programming, and legal challenge.

What is RNG in iGaming? How does it work? How does it get certified? What due diligence do operators need around RNG? We’ll guide you through.

RNG in Plain Terms for a Commercial Team

What is RNG in iGaming? Understanding it doesn’t require a math degree—if we drop technical details, RNG is just a number-generating engine that runs in the background of a game. It responds to the player’s action with a number, and then this number is converted into a symbol landing, card appearance, or the ball’s settling position.

The most important takeaway for a commercial team is the proof of the algorithm’s fairness and its compliance with the local regulations. This is why the certification of iGaming engines is needed. During the certification process, an independent lab calls the RNG millions of times. The RNG outcomes should present mathematical randomness with no hidden bias toward the house. If it’s the case, the certification is granted.

What RNG is Not: Video Game Slang vs. The iGaming Term

Outside of the iGaming industry, the RNG abbreviation is often misused. This misuse came from online games, where ‘bad RNG’ means bad luck in a loot drop. Although in both cases the player clicks the button and gets the result, the RNG outcome in iGaming is a specific, auditable, regulated system, while nothing guarantees the loot results in online games being fair.

RNG isn’t a synonym for randomness—it’s a complex mathematical algorithm with strict documented logic that goes through a source code verification and independent testing. That’s far from ‘the loot went wrong.’

Why RNG Sits at the Center of the Supplier, Operator, and Regulator Triangle

The supplier, operator, and regulator are all around RNG. Suppliers develop RNG, operators license it, and regulators oversee it. Although users mainly see the fruits of the supplier’s work, the role of operator and regulator shouldn’t be underestimated. Operators hold licenses for the RNG casino games. They’re responsible for providing correctly working games in line with the local laws. They monitor game updates, supervise the certification of every game’s current build, and organize prompt testing. Regulators accredit testing labs and verify that the games offered by operators are certified. These three are like parents sharing custody of the common kid—RNG.

How an RNG Turns a Seed Into a Game Outcome

RNG returns a random number or sequence. How does this become a game result?

Entropy Sources and Seed Generation

Most iGaming RNGs are pseudorandom number generators (PRNGs). A PRNG is predictable; that’s why it has ‘pseudo’ in its name. It’s an algorithm that follows some procedures described in documentation. It will always produce the same results if there’s no additional incoming information. To make it deviate in an unpredictable way, one should bring in a genuinely random value from outside the code—seed. No third party, even someone with access to the source code and the server, can predict or influence the game outcome.

There are many different ways to generate a seed. Usually, the seed value comes from naturally unpredictable processes, so-called entropy. For example, timing of hardware events, mouse or process jitter, or even hardware electrical noise can be used as entropy sources. An unpredictable seed is the number one due diligence for an operator.

The Algorithm, Its Period, and Reseeding

Once seeded, the RNG produces a sequence of numbers. This sequence will be statistically indistinguishable from true randomness. It’s, however, dependent on the initial seed—given the same seed, the RNG output will remain the same. At some point, the sequence produced by the RNG starts repeating itself. The number of the RNG outputs before cycling is called the period. It’s an important parameter of an RNG, because a relatively short period may cycle back on itself, making the game predictable. To deal with it, regular reseeding is needed—a fresh entropy value comes into play.

Mapping Raw Numbers Onto Reels, Cards, and Wheels

As it was said earlier, the RNG only provides a number, not a reel or a card. A separate layer of the game code converts this raw number into something meaningful for players.

The fairness of this step is also reviewed by independent labs. The game outcome may turn wrong even with a perfect RNG if the mapping logic is unfair. Let’s consider a simple example:

A slot reel has 20 possible stop positions.

The RNG generates a random number between 1 and 1,000,000
The game’s mapping logic then converts that number into a symbol
The mapping must match the published paytable
For example, the paytable may state that the jackpot symbol is 10 times rarer than a cherry symbol
In that case, fair mapping could work like this:
- 1 to 5000: jackpot symbol
- 5001 to 55,000: cherry symbol
- 55,001 and above: other low-value symbols
This gives the jackpot a 5000:1,000,000 chance and the cherry symbol a 50,000:1,000,000 chance
Accredited testing labs also verify that the paytable and the game implementation match

Independence: Why the Result is Fixed Before the Animation Ends

A surprising detail about the work of the online casino is that the game outcome is determined once the RNG is called—way before the end of the game animation. The animation is only visual. It has no effect on the game outcome.

To exercise due diligence, the operator should confirm with the supplier that the game outcome is independent of anything downstream from RNG. In a fair mapping, once the RNG is launched, there’s nothing else that might affect the game outcome. That’s why trying to find a sign in the animation is meaningless; it’s rendered purely for fun.

TRNG, PRNG, and HRNG: The Generator Types Used in Casino Software

True random number generator (TRNG), pseudorandom number generator (PRNG), and hybrid random number generator (HRNG) work in fundamentally different ways.

PRNG: The Workhorse Behind Online Slots and RNG Casino Games

As it was said before, online casino games—slots, virtual table games, instant-win titles—use a pseudorandom number generator (PRNG), the most common type of random number generator casino platforms rely on today. Although the sequence produced by PRNG behaves statistically like true randomness, the reason why it’s not true randomness is the possibility of reproducing the exact same sequence if the seed value is known.

PRNGs dominate over other RNGs because they’re fast, computationally cheap, and capable of producing a huge number of outcomes on demand. The first weakness of PRNG may arise if the statistical quality of the algorithm is insufficient, resulting in leaking patterns of the output sequences. This is why the period length, the uniformity of sequences, and the non-correlation of output sequences at different seed values should be carefully checked for PRNG algorithms.

TRNG: Hardware Entropy and Where Regulators Expect It

A true random number generator doesn’t have an intermediary between the entropy and produced random numbers—it relies on physical nondeterministic processes. Thermal noise in a circuit, atmospheric radio noise, and radioactive decay timing—those are nature-based, genuinely unpredictable entropy sources.

TRNGs require more computational resources and time compared to PRNGs. They measure entropy every time the game outcome is asked. One measurement, however, isn’t enough to generate a random number. The processing of raw physical noise is launched first. The computational time of such processing depends on the entropy source but anyway adds up to the physical measurement itself. Moreover, the overall time efficiency is bounded by the physics of the event. For example, if radioactive decay is taken as an entropy source, the TRNG should wait until a radioactive sample emits a new decay event. Then, it will have the necessary value—the interval between consecutive decay events.

Games such as slot spins or roulette ball drops demand a high-frequency RNG. If that’s the case, PRNG is a better option. In some contexts, for example, lottery draws or jackpot trigger events, the verifiably non-algorithmic randomness is essential. It can be required either by the regulator or by the game’s design.

HRNG and Hybrid Designs: Hardware-seeded Pseudorandom Generators

In iGaming reality, the RNG implementation combines TRNG and PRNG approaches—the seed is provided by the TRNG, and the PRNG is run with this seed. Such an approach handles the PRNG’s weakest point by providing an unpredictable seed while keeping the algorithm fast and high-throughput.

It’s also in line with due diligence—the supplier has no control over a seed and, consequently, over the game output.

A hardware entropy source feeding a well-tested PRNG algorithm, with regular reseeding, is one of the best possible answers to regulators’ and players’ expectations of fair play.

Where RNG Runs Beyond the Slot Spin

When people hear about the use of RNGs in iGaming, they first think about the use of RNG in slot reels. It’s indeed the highest-volume use of RNG. Slot reels are the most visible application of RNG in online casino games. The RNG, however, is behind the scenes in nearly every corner of the iGaming platform, and certification is required for every RNG use. Moreover, the regulators’ requirements may differ for prize wheels, jackpot triggers, and auto-shuffles.

Bonus Mechanics, Drops and Wins, Prize Wheels

Every bonus feature or spinning prize wheel that involves elements of chance relies on RNG, for example, a free spins retrigger, a pick-and-click reveal screen, and a ‘drops and wins’ leaderboard prize. It’s similar to the base game mechanics where random numbers are mapped to different outcomes. Usually, the bonus feature runs on the same RNG as the base game, but their mapping is certainly different. The bonus feature mapping assigns the random number to, for example, the prize tier or the bonus multiplier.

Due diligence is sometimes skipped in the promotional add-on. The core game is rigorously verified before getting a license, but bonus mechanics aren’t. Lately, regulators are heading this secondary mechanic toward the same verification process as for the primary game—with its own documentation and a separate casino RNG certification.

Jackpot Triggers and Shared Network Jackpot Pools

From a due diligence point of view, a jackpot run by a single operator needs routine tests. The lab verifies both the RNG and the mapping to decide whether the jackpot trigger mechanism is fair and whether its odds correspond to the ad.

The jackpot run by multiple operators at a time is a whole different story. In addition to the usual documentation, regulators typically require the audit of the jackpot contribution and payout accounting across the network.

Mystery Cashback, Promo Loot Boxes, and Gamification

Gamified promotional mechanics, such as mystery cashback drops, loot-box-style reward reveals, and tiered loyalty prize unlocks, are popular across operators. Technically, it’s very similar to a slot reel—a value produced by RNG is mapped to the reward.

Although the gamified mechanics came to iGaming from online video games, its status is still debated across the world. In several countries, such mechanics are viewed as gambling even when integrated into a video game. Consequently, they apply specific regulations to such gambling-adjacent mechanics. For casino operators, the gamified mechanics land in the regulatory gray zone. In some countries the specific regulations are applied, while in others they’re treated similarly to any other online casino game.

Live Casino: Auto-shufflers, RNG Side Bets, and Game-show Wheels

Live casinos don’t seem to rely on RNG—there’s a real dealer shuffling physical playing cards. RNGs, however, have found their way into it.

Auto-shufflers are mechanical devices, but many rely on RNG internally to determine shuffle sequencing—and they’re subject to their own certification, separate from the platform’s software RNG.
RNG side bets are optional side wagers offered alongside a live game. Those wagers usually rely on RNG that’s not dependent on the physical dealer action. It’s a side game that’s played simultaneously with the live stream.
Game-show wheels are often a mix of physical events happening on live stream and RNG-driven randomizing elements. It can be, for example, the size of a multiplier applied to the outcome, or whether a bonus round is unlocked, or how a bonus round plays out.

Having a physical dealer doesn’t automatically exempt an operator from casino RNG certification. Usually, at least one RNG component is run during live streams.

RNG vs RTP: What an Operator Can and Cannot Change

RNG and RTP (return to player) are often discussed together, but they’re different concepts. The RNG is the source of randomness, while RTP is the percentage of wagers returning to players. The mapping is tailored in such a way that the outcome over a very large number of rounds is equal to RTP.

How a certified RNG feeds the game math model

It’s worth noting that the RNG doesn’t depend on the RTP in any way. RNG generates unpredictable numbers. It’s the mapping logic that aims for the given RTP.

In addition to the RNG verification, the lab also confirms that the game actually produces the claimed RTP. A poorly designed mapping, even if fed by a perfect RNG, can still produce an incorrect RTP.

Multi-RTP Builds (96 / 94 / 92 Percent) and Who Selects the Version

A single game is often put on the market in multi-RTP builds, commonly 96%, 94%, and 92%. The supplier builds and separately certifies multiple outcome-mapping models for the same game. In such a case, RNG is shared by the versions, while the mapping layers are different. Because of this different mapping, every build requires its own certification.

It’s the operator who selects the version based on its business model. The version is decided by the time of integration, and operators cannot switch it freely from game to game.

What is Locked After Certification and What Regulators Treat as Tampering

Once a specific build passes certification, it’s expected to stay this way. Even a small change to the certified build requires re-certification. Changes that trigger re-certification include but are not limited to adjusting a payout table, changing symbol weighting, altering the RNG’s seeding or reseeding behavior, or swapping to a different pre-certified RTP variant without notifying the regulator.

In brief, operators cannot change anything about the game core. Operators are only allowed to adjust the game visuals. As for the game, the operator decides which of the certified RTP versions to deploy; that’s all. Altering payout logic, RNG behavior, or odds is considered tampering.

Who Certifies RNG: Test Labs Compared

Regulators don’t certify RNGs themselves; they maintain a list of trusted labs. Here’s a list of the major names in the industry.

GLI (Gaming Laboratories International)

Gaming Laboratories International is the world’s largest independent testing facility. GLI’s standards have been adopted by regulators across a wide range of jurisdictions, which makes their certification essential for operators seeking global market access.

GLI consolidates the testing lab market. In 2024, GLI absorbed one of its biggest competitors on the European market—Trisigma, which now operates under the GLI brand. In 2023, GLI acquired iTech Labs. The latter, however, stayed under its original brand name but continues to operate its global testing network independently while coordinating sales and back-office efforts with GLI.

For operators, this is worth tracking—the labs may share infrastructure, even while issuing certificates under different names.

BMM Testlabs

BMM Testlabs is a private independent gaming test laboratory with over 40 years of experience. It’s fully licensed in most well-established markets.

eCOGRA

eCOGRA (eCommerce Online Gaming Regulation and Assurance) is a London-based testing agency in the realm of online gambling. eCOGRA is more than just a testing lab; it also advocates for responsible gaming. eCOGRA certification requires monthly compliance checks. It’s not a one-time audit—a detail worth flagging for operators. eCOGRA is particularly well recognized across European markets.

iTech Labs

iTech Labs’ online casino RNG certification is recognized by regulators worldwide, with particular strength in Asian and European markets. Since 2023, iTech Labs has been a part of GLI.

Regional Labs: Trisigma, SIQ, QUINEL

A particular jurisdiction may require or simply prefer a local testing facility.

Trisigma is a Netherlands-based testing lab operating under its own brand in its established jurisdictions following its 2024 acquisition by the GLI Group.
SIQ—a Slovenia-based lab. Alongside RNG and game-technology testing, SIQ also offers the electrical safety testing of operators’ equipment and runs its own cybersecurity testing.
QUINEL is a strong regional player of testing labs. It has offices based in the UK and Malta, and its lab is based in Italy.

How to Confirm a Lab is Recognized in Your Target Market

The list of recognized labs is published by the regulator. The list is updated, so it’s worth regularly verifying, especially before a new launch.

A due-diligence note for an operator searching for certification:

Check the regulator’s lab list directly
The certificate should match exactly what’s being deployed
Verify the certification badge links through to a live page on the lab’s own site
Reconfirm lab accreditation status periodically

The Standards Map: GLI-11, GLI-19, GLI-33, NIST SP 800-22, and ISO/IEC 17025

There’s no single universal standard against which the games are tested. Every lab has its own testing frameworks for RNG in casino software described in the lab’s documentation. Usually, this documentation is public, so the suppliers and operators may consider reviewing those files while selecting a lab.

GLI-11 vs GLI-19 vs GLI-33: Which Standard Applies to Your Vertical

These three GLI standards are often mentioned together, but they’re intended for very different game categories.

GLI-11—Gaming Devices in Casinos. GLI-11 is the standard for physical gaming machines, for example, physical slot machines. It’s the oldest of the three, and it mainly includes hardware-adjacent requirements.
GLI-19—Interactive Gaming Systems. GLI-19 is made for online casino RNG testing. It’s built specifically for iGaming platforms and tests general RNG requirements, RNG strength and monitoring, and mechanical RNG use within a digital system.
GLI-33—Event Wagering Systems. As its name implies, GLI-33 is made for sports betting and event wagering platforms. It aims to assess account management, market creation, wager settlement, and risk management, rather than the RNG specifically. After its appearance, GLI-33 gave an impulse to a wave of US state-level sports betting legalization.

NIST SP 800-22 and the Statistical Test Batteries Behind RNG Testing

NIST SP 800-22 is a statistical test suite developed by the National Institute of Standards and Technology. Most independent labs rely on this standard in their testing frameworks for RNG in casino software.

While RNG is verified by the lab, it passes not just one test but is run through recognized statistical batteries. NIST SP 800-22 includes:

Frequency test—whether possible outcomes appear roughly equally often over a large sample
Runs test—do streaks (consecutive identical or predictable results) appear at the rate of true randomness?
Serial correlation test—may the next output number be guessed from the previous one?
Chi-square test—a statistical check comparing the actual distribution of outputs

ISO/IEC 17025: Accreditation of the Lab Itself

ISO/IEC 17025 is the international standard for testing and calibration laboratories. It certifies the lab, not games. This standard helps regulators check labs’ testing processes, equipment, and methodology. ISO/IEC 17025 accreditation is issued by a national accreditation body. The ISO/IEC 17025 accreditation confirms the following:

Staff qualifications for the tests they perform
Consistency of the lab’s methodology
Chain-of-custody of the results
Lab independence (a conflict-of-interest safeguard)

ISO 27001 and the Management-system Layer Around the RNG

ISO 27001 is the international standard for information security management systems. It’s devoted to the organizational security practices assessment. It doesn’t test the RNG itself; it verifies how this RNG is developed, maintained, and operated. This certification checks access control to the source code, code development standards, incident management, and so on.

How RNG Certification Works, Step by Step

Casino RNG certification is a scoping, testing, and reporting process that starts well before a lab.

Scoping the Submission and Selecting the Lab

Scoping the submission is, in practice, one of the most difficult parts of the certification process. It requires assembling the RNG documentation, the mapping math model report, and the system architecture description. At this point, a specific build—with the selected RTP and configuration—is decided. Once obtained, the certification only applies to that exact configuration, not to ‘the game.’

The lab selection is jurisdiction-driven. The operator first decides the market, then checks the list of approved labs from the regulator’s list. For example, GLI or BMM might be the good choice for a US multi-state operation, while eCOGRA or iTech Labs are probably the better option for a European or Asian market.

Source Code Review and Seed Generation Assessment

Source code review is the first step of technical assessment. At this stage, the lab checks the RNG seeding, the reseeding schedule, and whether the algorithm matches the documentation. In addition, the entropy source is carefully verified—whether the entropy comes from a genuinely unpredictable source or a predictable mechanism, for example, a low-resolution clock value.

Statistical Testing: Sample Sizes, Chi-square, and Diehard-type Batteries

Labs verify the RNG output across millions to billions of simulated outcomes. Such a large number of tests is required to catch every, even subtle, randomness flaw. The recognized statistical suites, such as NIST SP 800-22 or Diehard-type batteries, are used at this step.

The chi-square is a specific statistical test that compares the distribution of outcomes to the expected distribution. It confirms if the rate of every possible result corresponds to the claimed math model.

Diehard-type batteries are statistical tests built specifically to stress-test RNGs for weaknesses that simple tests miss. A Diehard-type battery is done to check, for example, whether particular bit patterns repeat too often, whether specific subsequences show correlation, or whether the generator’s output behaves consistently across many different statistical “angles” of attack. The batteries are called ‘Diehard-type,’ because updated variants are typically used rather than the original suite.

Game Math and RTP Verification Against the Paytable

RNG alone doesn’t guarantee the fairness of a game. Therefore, the layer that sits on top of it—outcome mapping—should also be verified. This verification includes the agreement of the published paytable and the declared RTP to the actual mapping logic in the code.

The RTP is validated not only by code revision but also by large-scale simulations. The latter is a key to measuring the resulting RTP with statistical confidence.

Report, Certificate Issue, and Submission to the Regulator

Once the previous steps are all clear, the lab issues a test report along with a certificate of compliance against the relevant standard.

Those papers are further submitted to the regulator as evidence of compliance. The license is granted by the regulator, not the lab. The license is valid on the specific market. Even if a lab is accredited by multiple regulators, a lab certification is not a free ticket to all of these markets.

Re-certification Triggers: Paytable Edits, New Bonus Mechanics, RNG Library Updates, Jackpot Changes, New Markets

Certification isn’t attached to the game; it’s tied to a specific build. Any change in this build triggers re-certification. Not all changes, however, are changes in the build and, consequently, require re-certification. The changes that may seem minor but aren’t considered such by regulators are

Paytable edits—any adjustment to payout values or symbol weighting implies changes in the RTP, so re-certification is needed.
New bonus mechanics—adding features like a prize wheel or a pick-and-click bonus introduces new RNG-driven results not verified during the original submission.
RNG library updates automatically require another round of the code review.
Jackpot changes, for example, modifications of trigger odds or pool structure, need a re-certification of the whole game.
New markets require obtaining a local license; therefore, it may trigger re-certification by the locally accepted lab.

Allowed changes are limited to game visuals. They must have no influence on either the source code or the math model.

RNG Requirements in US Regulated States

In the US, there is no federal regulator of the iGaming industry; each state has its own regulator with its own technical standards, list of approved testing labs, and submission procedure. The same game must hold several licenses to operate across multiple states in the US.

New Jersey DGE Technical Standards and Transactional Waivers

New Jersey’s Division of Gaming Enforcement (DGE) has had a full online gaming compliance framework since 2013. A unique feature of the DGE is the existence of a transactional waiver—a provisional authorization delivered to the platform for the period of application review. A transactional waiver allows an operator to launch while the processing is still in progress, rather than waiting for the complete license.

Michigan MGCB Submissions

Michigan’s Gaming Control Board (MGCB) requires completed lab testing before submission to the MGCB. First, suppliers pass the tests in MGCB-approved labs for testing against Michigan’s technical requirements. After the lab certification is issued, a formal submission can be sent to the regulator. Among the cited global labs, GLI and eCOGRA are both approved by MGCB.

Pennsylvania PGCB and West Virginia

Pennsylvania’s Gaming Control Board (PGCB) and West Virginia’s regulatory framework are similar to MGCB. The submission is first sent to a state-approved independent testing lab. Once the compliance against that state’s specific technical standards is confirmed, the documents are sent to the regulator that grants its approval.

State-isolated Environments and Per-state Resubmission of the Same Game

Certification in one state doesn’t mean an automatic approval in another, even for the exact same game build. Technical standards vary across the states, and resubmission to local regulators is required. The ‘new markets’ category was listed as a re-certification trigger category because of this state-by-state isolation.

Using a Lab That the State Itself Has Approved

Operating in the US means careful lab selection. The presence of the lab on the state regulator’s list should be checked separately. The lists of the trusted labs are regularly updated; therefore it’s important to follow these lists in real time.

What an RNG Certificate Actually Contains and How to Verify the Live Build

A certificate is only useful to an operator if the operator knows for sure to what exact build the certificate was issued. So, how does the operator confirm the validity of an RNG certificate for casino games?

Anatomy of a Certificate: Number, Game Build ID, Tested RTP Version, Jurisdictions, Validity

A properly issued casino RNG certificate is a document tied to a concrete build. It holds the following details about the uniqueness of the certificate and a specific build:

Certificate number—a unique reference that can be checked by the issuing lab upon request
Game build ID—an identifier of the exact game version tested
Tested RTP version (the 96/94/92% from the example above)—which exact RTP variant actually passed the lab’s testing
Jurisdictions—which markets or regulatory standards the certificate covers
Validity—the date range during which the certificate remains valid

An operator’s due diligence is to verify that none of these are missing.

Matching the Certified Build ID and Checksum to What is Running in Production

To check that the games running on the platform hold valid certificates, the checksum is used. It’s a cryptographic fingerprint calculated from the game’s software files. Even a minor modification in the code results in a change of checksum.

During testing, the lab calculates and records a checksum for the exact build it certified. An operator, an auditor, or a regulator can independently calculate a checksum of the software actually running. A match of the two confirms that the live build is the certified one.

Operators, especially those with frequent supplier updates, should regularly validate the checksum of all the games that run on their platforms.

Certificate Age: When a Three-year-old Document Stops Meaning Anything

A certificate that was issued a long time ago is a warning. Here are a few reasons why a three-year-old certificate is a bad sign:

The build has likely changed. Within three years, software usually gets patched and updated, and bugs are fixed. Any of these changes triggers re-certification even if the certificate hasn’t formally expired.
The issuing lab’s own accreditation may have changed. A lab’s ownership, independence, or accreditation status three years ago may not match its current standing.
Regulatory standards evolve. A regulator’s technical standard is revised and updated. A certificate issued against outdated requirements has no meaning to the regulator.

Operators should be cautious with certificates that are a few years old.

Verifying a Certificate Directly With the Issuing Lab

The most reliable way to confirm a certificate is trusted is to contact the issuing lab using the certificate number. The lab’s own records should match what the supplier has presented—same game build, same RTP version, same validity period. A certificate document itself can be falsified, while the lab records can’t.

RNG Certification Cost and Timelines by Market

Cost and timeline are the two hardest answers in the RNG certification process. Both of them depend on the game complexity, number of resubmissions, RTP options certified, and more.

What Drives the Price: Game Complexity, Number of Jurisdictions, Retests

Factors that influence the certification quote are

Game complexity—a slot reel with a single bonus mechanic is a fundamentally smaller testing scope compared to a game with multiple bonus layers and a progressive jackpot. Every random output requires its own RNG and mapping revision.
Number of jurisdictions—certification is valid for a single jurisdiction only. Moreover, one country may have multiple jurisdictions, as, for example, the US. The casino game destined for three US states and two European markets requires certifications against different technical standards.
Number of RTP variants—the multi-RTP pattern (96/94/92%) brings multiple math models for verification, which is, of course, more expensive than testing a single RTP option.
Retests—any finding leading to a code fix and, therefore, to a resubmission extends the timeline and increases the price.

Why Published Price Ranges Contradict Each Other

The prices that can be found by a simple Google search vary significantly. It’s not because of unreliable sources but due to the complexity of pricing. As it was demonstrated above, many factors play a role in the final cost. Some of them, for example, the number of resubmissions, are unknown prior to the testing.

For a supplier or an operator who needs their game certified, the best answer will be given by the testing lab.

Budgeting a Multi-market Rollout of One Game Portfolio

A multi-market launch budget is almost the same as for independent submissions to the selected jurisdictions. Some adjustments in schedule, however, may be useful.

First, some of the targeted jurisdictions probably accept certifications from the same lab. Although the certification includes testing against specific regulatory standards that differ from one jurisdiction to another, some statistical tests are probably the same. If that’s the case, a lab may accept a discount.
The first certification will most likely be the hardest one. There will probably be adjustments in source code, documentation, and the math model. Once the first certification is complete, the next ones of the same build may move faster in other jurisdictions. Some of the underlying documentation can be reused. Even though the testing itself has to be redone against another jurisdiction’s standard, the code has already passed a rigorous revision.
At least one round of re-testing per jurisdiction should be included in the launch budget. Resubmissions are common in the industry, so it’s better to be prepared.
Multi-RTP variants aren’t a one-time cost. The mapping functions and documentation are revised independently for every RTP. They only share RNG, but tests of mapping functions, RNG+mapping duos, as well as the documentation revision, are completely different for each RTP variant.

Hidden Costs: Re-tests, Regulator Fees, Delayed Launch Windows

Beyond the direct testing fee, a budget should reserve money for some extra expenses, such as

Re-test fees—a finding that requires resubmission is charged an extra fee.
Regulator submission fees—in addition to the lab’s charge, the regulator also charges for the submission review process.
Delayed launch windows are the hardest to put in numbers. A certification delay, multiplied by a multi-jurisdiction launch, results in missed revenue, contractual penalties from partners, and operating costs.

Who is Liable When RNG Fails: Providers, Aggregators, and Incident Response

Supply Contract Clauses: Who Pays for Re-certification and Who Answers to the Regulator

Regardless of who actually wrote the RNG, it’s almost always the operator who holds the license and answers directly to the regulator. This is why the supply contract between the operator and supplier should include a section about incident management. The key flaw-related aspects of the supply contract are:

Coverage of re-certification expenses
The responsibility of the party for preparing and filing the regulatory disclosure
Warranties or indemnities provided by the supplier
Time for a supplier to respond to tickets

The Aggregator Layer: Whose Certificate Covers 30,000 Integrated Games

Today, iGaming platforms usually pass through an aggregator instead of an individual supplier. An aggregator offers thousands of games from multiple studios. When an operator integrates through an aggregator, who is responsible for the certification?

The answer depends on the aggregator’s model. With a catalog running into the tens of thousands of titles, it’s not realistic to individually verify certification on every single game. The agreement between an aggregator and an operator should explicitly state whether the certification for the operator’s target jurisdictions is guaranteed by the aggregator.

Player Compensation and Regulator Notification Duties

When a regulatory issue, for example, uncertified build variance or a statistical anomaly discovered post-launch, arises, two obligations arise:

Regulator notification. Most regulators expect the disclosure of a game issue. Moreover, the bug fix affects the game build, so the re-certification is triggered.
Player compensation. If players were paid too little or paid based on incorrect odds, operators are expected to identify such players and make them whole. This implies a serious audit-trail discipline among operators.

Incident Playbook: Detect, Freeze the Game, Roll Back, Report

An incident response for a suspected issue in a game generally follows four stages:

Detect. There are two usual ways of detecting incidents. First, a player or a supplier may report issues. Second, in-place monitoring can catch statistical abnormalities through automated live RTP monitoring or a build mismatch by regularly verifying checksums.
Freeze the game. Once an issue is suspected, a responsible operator freezes it until the end of the investigation. Such behavior limits the player’s impact and demonstrates active response, which is favorably viewed by regulators.
Roll back. Reverting the game to the last certified build with no detected issues is the fastest path back to a compliant state.
Report. Notifying the regulator and the certifying lab, if applicable, as soon as possible is the safest route to long-lasting business on the current market.

Provably Fair vs. Certified RNG: Two Different Trust Models

How Provably Fair Verification Works With Server and Client Seeds

Provably fair systems are common in crypto casinos. A built-in cryptographic technique allows a player to verify a game round’s fairness themselves. The mechanism typically works as follows:

A server seed is generated before the start of the round. It shows the player its hash—a cryptographic fingerprint, which is a seed’s unique ID.
The player supplies a client seed, adding an input the platform didn’t fully control.
The round’s outcome is generated from a combination of both seeds.
Once the round is completed, the platform reveals the actual server seed. The player can then independently hash that seed and confirm it matches the hash.

The fundamental difference from lab certification is the round verification, not the whole game.

Why Regulators Still Require Lab Certification on Top of Provably Fair

Provably fair verification is a strong guarantee that a specific round wasn’t rigged after the player’s input was known. It doesn’t, however, address several regulatory claims:

Was the initial seed itself generated from genuine entropy?
Does the game’s outcome-mapping logic actually match its stated odds and RTP?
Is there an accountable, licensed, auditable entity a regulator can actually hold responsible?

This is why regulated markets require certification even for provably fair games.

When to Run Both: Crypto Casinos and Hybrid Game Portfolios

Provably fair and certified RNG are complementary, not exclusive. Running both simultaneously has become a trend in the industry.

Crypto casinos are gambling platforms that accept cryptocurrency as a deposit and withdrawal method. Instead of traditional gambling regulation, they propose provably fair games to players. Crypto casinos operating in regulated markets need to run both. They need a license to operate locally, which implies the lab-certified RNG and math-model verification. Their audience, however, are crypto-native players who expect provably fair verification as a transparency feature, independent of what a regulator requires.

Hybrid game portfolios are platforms offering both lab-certified and provably fair games side by side. Hybrid game platforms need to be careful not to blur the two labels in player-facing communication. Notably, the hybrid game portfolios that have unlicensed provably fair games can only operate in unlicensed markets or in lighter-touch licensed jurisdictions like Curaçao.

Operator Due Diligence: RNG Checklist Before Signing a Provider

Artifacts to Request Before Signing: Certificates, Test Reports, Build List, RTP Versions

A provider should be able to provide the following documents. If any of them are missing, it should be considered as a red flag:

Certificates for every targeted jurisdiction. Each certificate should include the details listed above: certificate number, game build ID, tested RTP version, jurisdiction, and validity period.
Test report. The certificate is only a summary; the test report should include details such as what statistical batteries were run, what sample sizes were used, what the source code review covered, and what the RTP simulation results showed against the paytable.
A complete build list—an exhaustive configuration file specifying every single component, dependency, or task required to assemble a certified version of the game intended for deployment.
RTP variants offered, each with its own certification reference.
Checksum values, so the operator can independently confirm the certification of the current build.

Red Flags in a Provider Dossier: Missing Jurisdictions, Expired Scope, Unnamed Lab

Some signs in a provider dossier that should raise concern:

Missing jurisdictions. A provider offering a game for a market where it doesn’t hold certification is either mistaken or hoping it won’t be checked. Neither is reassuring.
Expired or lapsed validity periods. A provider presenting an expired certificate or obtained several years ago without proactively flagging the lapse probably isn’t the right partner.
An unnamed or unverifiable lab. A certificate should name a testing lab it comes from, and this name should appear in the targeted market regulator’s list of approved labs.
A gap among the marketing materials, the paytable, and the certificate. Any inconsistency here shouldn’t be tolerated if the operator wants to get the regulator’s approval.

Ongoing Monitoring of Game Results and Periodic Re-verification

Due diligence doesn’t end at signing—the provider stays the operator’s partner when re-certification triggers, checksum drifts, and the certificate expires. A reasonable operator-supplier collaboration includes:

Scheduled checksum verification of live builds against certified references.
Statistical monitoring of live game results—tracking actual RTP performance against the certified target over time.
Fixed schedule for reconfirming certificate validity and lab accreditation status, especially given the pace of labs’ merging, acquisition, or loss of accreditation.
An obligation to proactively disclose if re-certification triggers—paytable edits, new bonus mechanics, RNG library updates, jackpot changes, and new markets.

FAQ

Is GLI Certification Mandatory, and Do I Need GLI-19 or GLI-33?

GLI certification isn’t mandatory—every jurisdiction has its own list of accredited labs. GLI’s standards, however, are recognized so widely that they’re considered the default option by many operators.

The choice of GLI standard is product-based: the GLI-19 standard is for iGaming systems, including the RNG behind online slots and casino games, while GLI-33 covers event wagering systems.

How Much Does RNG Certification Cost Per Game Per Jurisdiction, and How Long Does It Take?

Cost and timeline depend on game complexity, the number of RTP variants, the targeted jurisdiction, and whether any retests are needed. Therefore, it’s worth relying on the lab quote for pricing rather than any figure found on the internet. As for the timeline, the approximate range is one to 12 weeks. In addition to previously cited factors, the lab queue should also be taken into consideration.

How Do I Verify That the Certified Build is the One Running in Production?

The standard mechanism is a checksum—a cryptographic fingerprint calculated from the game’s software files. The checksum changes if even a single byte of the code is modified. The certifying lab records the checksum of the exact build it tested; a third party can independently calculate a checksum of the live build and compare the two. If the checksums are the same, the live game is the certified one; a mismatch means something changed since certification. The checksum should be verified on a recurring schedule, not just once at initial integration.

Are Test Labs Truly Independent if the Operator or Studio Pays for the Audit?

It’s a good question. Every lab should hold its ‘lab accreditation’ from the national accreditation body under some local standards, for example, ISO/IEC 17025. The lab accreditation process requires documented methodology, calibrated equipment, qualified staff, and independence from the products being tested. This accreditation may be withdrawn from the lab if the national accreditation body suspects corruption within the lab. That’s why the situation where a test lab is unfair is unlikely.

Can an Operator Change the RTP or the Outcomes of a Certified Game?

No. Changing RTP or outcomes triggers a re-certification. Once a specific build is certified, that exact combination is what’s approved to run. An operator can only select among multiple RTP variants if they were all separately certified. A supplier may certify different RTP options (the common 96/94/92%). If that’s the case, an operator can pick between them, not modify one. Changing the math outside of a certified build is tampering with a licensed product.

Who Answers to the Regulator When the Supplier Built the RNG?

The operator holds the license, so it will face the consequences of an RNG flaw regardless of who wrote the code. That’s why the supply contract between operator and provider is almost as important as the certification paperwork. In this contract, each party’s responsibility should be explicitly stated. Such a contract defines who pays for re-certification, who prepares regulatory disclosures, and what warranties are provided to the operator if the game is found non-compliant.

Why Do Live Dealer Games Not Use an RNG, and Where Does RNG Still Appear in Live Casinos?

Although the live casino streaming runs on iGaming platforms, its particular vibe draws players’ attention. The core of the live casino is a physical dealer who shuffles real cards or spins a real wheel. RNG, however, still appears behind the scenes: auto-shufflers used in live blackjack are mechanical devices that often use RNG internally to determine shuffle sequencing. Such devices are certified under the GLI-29 standard, which is different from the GLI-19 standard used for the platform’s software RNG.

In addition, side bets and game-show-style formats may be offered alongside a live table game. Both of them rely on the software RNG running independently of the dealer. RNG components running alongside the live casino require their own certification trail.

Can a PRNG Be Predicted, and How Should an Operator Answer Hot and Cold Slot Complaints?

A properly implemented, certified PRNG can’t be predicted. Its security is based on a long enough period, statistically clean output, and a seed derived from an entropy source. The weakest point in a PRNG is most often a poorly generated seed, not the RNG algorithm itself.

‘Hot and cold’ are players’ perceptions, not evidence of a flawed RNG. The randomness naturally produces streaks and clusters. A perfectly correct certified RNG may produce streaks of wins and losses, which is a normal statistical variance over a small sample. The operator’s response shouldn’t dispute the player’s experience but clarify that streaks aren’t a sign of game malfunction.

Final Thoughts

What is RNG in iGaming? One thread that runs through this guide is that the operator should be careful at every single step. Since the game relies on the chain—entropy feeding a seed, a seed feeding an algorithm, an algorithm’s output feeding a mapping layer, the mapping layer producing an RTP—an issue happening in any chain link may lead to the withdrawal of the license. Continuous monitoring of every chain link quality is the key to a successful operation in any regulated market.