Game Certification
Game certification is independent lab testing that confirms a game, RNG or platform meets a regulator's technical standard, evidenced in a report the regulator accepts.
What it means
No regulated market lets a slot go live on the studio's word alone. Game certification is testing by an accredited independent lab against a published technical standard, with a report the regulator accepts as evidence. The lab checks that the random number generator is unpredictable, that a game's behaviour matches its declared RTP and paytable, and that the platform holding player money logs every transaction as the rules require.
It isn't a licence, and it isn't a one-off. A certificate is tied to a build, a standard and usually a jurisdiction. Change the build, enter a new market or let a year pass, and you're back at the lab.
What gets certified
| Object | What's tested | Typical standard or lab scope |
|---|---|---|
| RNG | Statistical randomness, seeding, cycling, scaling to outcomes | GLI-11 / GLI-19 RNG sections, jurisdiction annexes |
| Game maths | Simulated and live RTP vs declared, paytable, max win, feature logic | Per-game report, one per RTP build |
| Platform / PAM | Wallet integrity, transaction logs, bonus handling, RG controls | GLI-19, UKGC RTS, MGA system audit |
| RGS | Server integrity, session handling, disconnect recovery | Certified with the games it serves, see RGS |
| Information security | ISMS, access control, change management | ISO/IEC 27001-based security audit |
Operators forget the second row. A studio may certify a title at 96% for Malta and never submit the 94% build; the aggregator shows both anyway.
Who certifies
A regulator accredits a lab for a scope. Approved in Ontario doesn't mean approved in Italy.
- Gaming Laboratories International (GLI): widest footprint, recognised across US states, Ontario, the UK, Malta, Brazil and most of Europe. Publishes GLI-11, GLI-19 and GLI-33.
- BMM Testlabs: strong in North America, Australia and Latin America; approved in the UK and Malta.
- eCOGRA: UK-based, approved by the UKGC, MGA and several European regulators; runs MGA compliance audits too.
- iTech Labs: Australian, accepted across Europe, Asia and Latin America; common for RNG certificates on Curacao-facing platforms.
- Gaming Associates: Australian, accredited by the UKGC, MGA and several state regulators.
Lab lists change. Check the regulator's page, not the lab's marketing.
Timelines and costs
Typical ranges, not quotes:
- RNG certificate: 2-4 weeks, roughly USD 5-15K per jurisdiction family.
- Single game, single market: 1-3 weeks once the lab has a slot, USD 1-3K per game per build. A 200-title catalogue entering a new market is a six-figure line.
- Platform or PAM under GLI-19 or equivalent: 3-6 months kickoff to report, USD 50-150K by scope, plus remediation cycles.
- Annual re-audits (UK games testing audit, MGA compliance audit, Brazil revalidation): budget 20-40% of the initial spend, every year.
Lab capacity is the hidden variable. A platform slot booked six months out costs nothing; one needed three weeks before launch costs a premium, if it exists.
Per-jurisdiction notes
- UK: the UKGC keeps an approved test house list and a major/minor change model. Games pass a test house before release, the operator files an annual games testing audit, and the security audit follows the ISO 27001-based annex. See UKGC regulation.
- Malta: the MGA requires a system audit in the first months live, then periodic compliance audits by approved Audit Service Providers. Game and RNG certificates come from recognised labs.
- Curacao: the 2024 gambling ordinance replaced master-licence sublicensing with the Curacao Gaming Authority. Games and platforms need certificates from CGA-recognised labs; B2B suppliers register separately. See Curacao supplier licensing.
- Brazil: the SPA's 2024 technical ordinance requires the betting system and games to be certified by an SPA-recognised lab, revalidated annually, with an 85% RTP floor.
- Ontario: AGCO-registered independent testing labs certify games and platforms against the Registrar's Standards for Internet Gaming. No report, no go-live.
How platforms handle it
Of the 44 platform providers iGamingHub tracks, 41 carry an RNG-certified flag; 35 of 50 game studios do. The flag says a certificate exists, not that it covers your market.
Licence lists say more. Oryx Gaming lists MGA, ONJN, Greece, Brazil, Ontario, Nevada and Michigan, so its ATOMIC hub has passed European and North American lab regimes. White Hat Gaming shows MGA plus Ontario, New Jersey, Pennsylvania and Michigan, a platform built for regulated markets. GR8 Tech lists thirteen licences from MGA and Gibraltar to Colombia and Brazil, which implies a rolling certification calendar, not one project. Ask any vendor for the certificate number, standard version and build covered, and match it to your market. Launch-path detail is in game testing and certification.
Common confusions
- Certification vs licence. A licence is the regulator's permission for a company to operate; certification is a lab's evidence that a product meets the standard. You need both.
- Certification vs supplier licence. A B2B licence covers the company supplying software. Its games still need per-market certificates.
- A vendor's certificate vs yours. A turnkey vendor's GLI-19 report may cover another jurisdiction, an older release or a game set that isn't yours. Read the scope.
- Provably fair isn't certification. It lets a player verify one outcome; regulators want a lab report.