How Random Number Generators Are Certified for Online Casinos
RNG certification is the independent lab process that confirms a casino game’s random number generator is unpredictable, unbiased and free of adaptive or rigged behavior. The process involves source-code review, statistical testing on raw and game-facing output, and periodic re-audits. Named accredited labs (GLI, eCOGRA, iTech Labs, BMM Testlabs) perform this work, and regulators like the UK Gambling Commission and Malta Gaming Authority require certification before a game goes live and throughout its lifecycle. In markets like the UK and Malta, a game without a valid certificate from an accredited lab is not permitted to launch or stay live.
What an RNG Actually Does in a Casino Game
A random number generator is the engine behind every spin, card dealt, or dice roll in an online casino game. It produces a stream of numbers that the game software maps to specific outcomes. A number between 1 and 10 maps to a reel position, and a number between 1 and 52 maps to a playing card. The two major types are PRNG and TRNG.
A pseudorandom number generator (PRNG) uses a deterministic algorithm combined with a seed value. The same seed always produces the same sequence of numbers, which in principle lets a testing lab reproduce and check a given sequence during an audit, on top of the source-code review and statistical simulation that make up the rest of the process. Most commercial online casino games rely on well-seeded PRNGs because they are fast, reproducible for audit purposes, and easy to certify.
A true random number generator (TRNG) draws entropy from physical sources such as thermal noise in a chip or radioactive decay. It does not use an algorithm or seed, so it cannot reproduce sequences. TRNGs are rare in online casino games because they are slower and harder to audit. The table below summarizes the differences.
| Feature | PRNG | TRNG |
|---|---|---|
| Source | Deterministic algorithm + seed | Physical entropy (thermal noise, decay) |
| Reproducibility | Yes (same seed = same sequence) | No |
| Auditability | Regulators can replay sequences | Cannot replay, harder to verify |
| Speed | Very fast | Slower |
| Use in online casinos | Standard in nearly all games | Rare |
The practical difference for fairness is minimal when the PRNG is properly seeded and certified. A PRNG with a truly unpredictable seed and periodic reseeding produces output that passes the statistical test battery labs use for certification.
Who Certifies RNGs and How the Lab Process Works
Four labs dominate the independent RNG certification space globally. They are Gaming Laboratories International (GLI), eCOGRA, iTech Labs, and BMM Testlabs, and each follows a multistage process that starts with source-code review and ends with scaled output testing. The process at iTech Labs runs in three stages, according to their public documentation. First comes source-code review, where engineers examine the RNG implementation for algorithmic weaknesses, insufficient seed entropy, or code paths that could bias outcomes. Second, statistical tests run on the raw output of the RNG, often across roughly a million outcomes, checking for uniform distribution and absence of patterns. Third, tests run on scaled game-facing outputs to confirm that the game software maps RNG results correctly.
eCOGRA follows a similar sequence. They review RNG source code and run statistical analysis on RNG output over many iterations to check uniform distribution and absence of patterns. The lab treats RNG assessment as an ongoing process, with periodic audits and re-certification built into the lifecycle.
According to GLI’s own materials, the lab has certified equipment for roughly 475 jurisdictions since 1989 and holds ISO/IEC accreditation for technical competence. Their certification process covers both the RNG itself and the platform that hosts it. BMM Testlabs describes itself as the world’s oldest independent gaming certification lab, with offices across roughly 14 countries. Its RNG work checks for randomisation and pattern absence, runs statistical analysis, and audits whether real-world results actually match the operator’s stated RTP. GLI holds accreditation to ISO/IEC standards for technical competence, and the wider industry treats ISO/IEC 17025, the international standard for testing and calibration laboratories, as the accreditation regulators look for across this group of labs. This matters because it means an external body audits the lab itself for competence, impartiality, and consistent methodology.
| Lab | What It Primarily Tests | Founding / Scope |
|---|---|---|
| GLI (Gaming Laboratories International) | Full gaming device/platform integrity including RNG | Founded 1989; active in ~475 jurisdictions |
| eCOGRA | RNG source code + statistical analysis; ongoing audits | Focus on online gaming fairness |
| iTech Labs | RNG internal state, unpredictability, non-repeatability, reseeding | Source code review through scaled output |
| BMM Testlabs | RNG randomisation/pattern checks + RTP-match audits | World’s oldest independent gaming lab; offices in ~14 countries |
The Standards Behind the Certificate
Two GLI standards define RNG requirements for a large share of the industry, GLI-11 and GLI-19. GLI-11 covers land-based gaming devices, slot machines and electronic table games in physical casinos. The other one is GLI’s standard for online and interactive gaming systems, and it covers RNG certification at the platform level as well as individual games. That standard dedicates a section specifically to RNG requirements, alongside several other core areas of an interactive gaming system. In practice, an RNG being tested against it has to show a uniform distribution and independence between outcomes, the same properties every lab in this article tests for.
That same lab-accreditation standard sits above these two GLI documents. It certifies that the testing laboratory itself follows proper procedures, maintains equipment and software, and employs qualified staff. Regulators in Malta, the UK, and other jurisdictions commonly recognise labs that hold this accreditation.
What Regulators Actually Require
The UK Gambling Commission sets out its RNG requirements in Remote Technical Standards (RTS) 7. The standard states that RNG and game outcomes must be “acceptably random” to a high degree of statistical confidence. Output must be uniformly distributed across the full range and match theoretical probabilities. Remote licence holders above a reporting threshold must meet full RNG testing plus third-party security audit requirements and submit test results before launching or updating games.
The UK RTS explicitly bans adaptive and compensated behavior. Random numbers must be used in the order received and never discarded to change an outcome. This is a direct prohibition against mechanisms that detect a losing streak and adjust the RNG to produce a win. The Malta Gaming Authority (MGA) requires independent certification of RNG fairness, RTP validation, and functional checks before a game can launch. The MGA generally recognises labs that hold ISO/IEC 17025 accreditation, which covers GLI, eCOGRA, iTech Labs, and BMM Testlabs among others. Pre-launch certification is mandatory, and the MGA retains the right to request additional testing.
Why It Isn’t a One-Time Check
RNG certification is not a single event. eCOGRA treats RNG assessment as ongoing, with periodic audits and re-certification. The UK Gambling Commission requires submission of test results before launching or updating games, which means any change to the RNG implementation triggers a new review.
A game update that changes the RNG algorithm, the seeding mechanism, or the game logic that consumes RNG output requires re-certification. Even if the RNG itself stays identical, a change to the game’s mathematical model may require renewed testing on the scaled output. Recertification schedules vary by jurisdiction. Annual re-certification is common for active games in regulated markets. Some jurisdictions stretch to every one to three years, and any software update triggers a fresh round of testing regardless of the calendar.
What Adaptive or Compensated Behavior Means
Adaptive or compensated behavior refers to any system that adjusts RNG output based on previous outcomes to produce a desired result. A compensated RNG might track that a player has lost several rounds in a row and then increase the probability of a win to keep them playing. This is the mechanism that players sometimes suspect when they feel the game is “due” for a payout.
The UK RTS explicitly bans this. Random numbers must be used in the order received, and none may be discarded specifically because the outcome they would produce is undesirable to the operator. Technical steps like mapping a raw number onto a smaller range are normal and expected; what is banned is using outcome history to decide which numbers get kept.
Independent labs test for adaptive behavior during certification. The source-code review looks for code pathways that branch based on outcome history. The statistical tests on scaled output would detect deviations from theoretical probability over long runs.
How a Player Can Verify a Certificate
A valid RNG certificate shows the lab name, the standard referenced (such as GLI’s interactive-gaming standard or UK RTS 7), the date of certification, and the game or platform tested. Certificates are issued by the lab to the game developer or the operator running the game.
Players can look for the lab’s logo or seal on the casino’s website, typically in the footer or on a dedicated fairness page. Several of the major labs run a public verification page where a certificate number can be checked, though not every operator links to it directly. If no certificate or lab name is mentioned anywhere on the site, that is a reason for caution rather than proof of anything.
A certificate does not guarantee that a player will win.
RNG certification confirms that the game operates as designed within the stated probabilities. The house edge is a mathematical feature of the game design, not a product of the RNG.
FAQ
Is online casino RNG really random?
Yes, when properly certified. A certified PRNG produces output that passes statistical tests for uniform distribution and independence. A PRNG is deterministic given the seed, yet the output is unpredictable enough in practice that a player has no practical way to exploit the sequence.
How often is RNG retested?
RNG is tested before a game launches and periodically after. Labs such as eCOGRA treat RNG assessment as ongoing with periodic audits and re-certification. Any game update that touches the RNG or game logic triggers a new review. Annual re-certification is common for active games in regulated markets.
What is GLI-19?
GLI-19 is Gaming Laboratories International’s standard for interactive gaming systems. It dedicates a section to RNG requirements alongside several other core areas, covering both the platform and the games that run on it.
Can a casino change RNG odds after certification?
Not without triggering re-certification. The UK Gambling Commission requires submission of test results before launching or updating games. An RNG change, a seeding change, or a mathematical model change all require renewed testing. The MGA similarly requires independent certification before a game can launch.
Does a licence automatically mean RNG is certified?
A valid licence from the UKGC or MGA implies that the operator’s games have undergone RNG certification, because certification is a prerequisite for licensing. However, a licence number alone does not prove that a specific game is certified. Players should verify the lab certificate for the game in question.
PRNG versus true random: does it matter for fairness?
It does not matter much for practical fairness. A well-seeded PRNG with periodic reseeding passes the same statistical test battery a TRNG would need to pass. PRNGs are actually preferred for regulated gaming because their output can be reproduced for review, which TRNGs cannot. The fairness assurance comes from certification, not from the type of RNG.
RNG certification exists to confirm that casino games operate as designed, with outcomes determined by chance. Independent labs, accredited standards, and regulator oversight create a system that protects players from rigged games. Certification is not a guarantee of winning, and playing any casino game carries inherent financial risk. This content is intended for readers 18 and older; only gamble with money you can afford to lose.