It’s 1 a.m. and a friend of mine in Pune has just watched an Aviator round crash at 1.03x for the third time running. He sends a screenshot with one word: “Rigged?” Fair question, badly aimed. The honest answer is that nobody can tell from three rounds, which is precisely why an entire industry of testing labs exists to answer it properly, with millions of rounds and a lot of statistics.
That industry is the subject of this guide. iGaming compliance testing is the unglamorous machinery that decides whether a casino’s games, payouts and data handling can be trusted, and once you know how it works, you can check a site yourself in about five minutes.
What is iGaming compliance testing?
iGaming compliance testing is the independent examination of an online casino’s software and systems by an accredited third-party laboratory, carried out to confirm that games behave randomly, pay out as advertised, and handle money and personal data securely. Pass the tests and the lab issues a certificate; regulators then use that certificate as a condition of the operator’s licence.
The core purpose is fairness verification. A slot is a few thousand lines of code, and nothing about the spinning reels on your screen proves what the code underneath is doing. Testing closes that gap by inspecting the code and the output rather than the animation.
Broadly, a lab looks at four things: the random number generator, the mathematical return of each game, the security of the platform handling your deposits and documents, and the responsible gambling tools the operator is obliged to provide. Everything else in this guide is detail hanging off those four pegs.
How a frontier industry ended up with auditors
The first online casinos launched in the mid-1990s with no testing regime at all. Players sent money to companies they couldn’t locate, played games nobody had inspected, and hoped. Some operators were honest. Some vanished with balances. Nobody could prove which was which, and that ambiguity was the industry’s biggest commercial problem: without verifiable fairness, online casino trust had no foundation to stand on.
The turn came through government licensing rather than goodwill. In 1998, Dr. Aftab Rizvi of Gaming Associates was brought into the first government gaming testing project, for Lasseters Online in Australia’s Northern Territory. Structured compliance testing of a digital casino was close to an invented discipline at that point: the testers were working out what “fair” even meant in software, round by round.
From there the model spread. Regulators in Malta, Alderney, the Isle of Man, Gibraltar and later Great Britain made independent testing a licence condition instead of a marketing option. Game studios followed, because no serious operator would take an uncertified game. Today a slot you load from a licensed site has typically been tested twice over, once as a game and once as part of the platform running it.
How RNG certification works
RNG certification is a lab’s formal statement that a casino’s random number generator produces outcomes that are unpredictable, uniformly distributed and independent of each other. It proves the draw is honest. It does not promise you a profit, and the house edge stays exactly where the game’s maths put it.
What RNG testing involves
Testers start with the source code and the entropy source, the raw unpredictability that seeds the generator. They check how the RNG is seeded, whether its output can be reproduced or predicted by someone who knows previous results, and how the raw numbers are mapped onto game outcomes. That mapping matters: an immaculate RNG attached to a sloppy symbol-selection routine still produces an unfair slot.
They then pull enormous samples of output, often tens or hundreds of millions of values, and run them through statistical analysis. Alongside that sits a scaling test on the live game: do the observed symbol frequencies and feature triggers match what the maths model says they should?
The statistical tests auditors run
The specific tests are standard tools from statistics rather than anything exotic to gambling:
- Chi-square tests whether outcomes are distributed as evenly as the model predicts.
- Kolmogorov-Smirnov compares the observed distribution against the expected one across its whole range.
- Runs and serial correlation tests look for patterns and dependence between consecutive results, the thing a player trying to predict the next round would exploit.
- Gap and poker-style tests check how often values repeat and how long the intervals between repeats are.
A single test can produce an odd result by chance, which is the point of running a battery of them. Fail a cluster and the lab goes back to the code.
How long a certificate stays valid
Certificates are tied to a specific software version, so any change to the RNG or game maths triggers retesting. Beyond that, most regulators require periodic re-verification, commonly annual, plus checks whenever a new game or platform release goes live. A certificate from several years ago that names a version number you can’t find in the current software tells you very little. Check the date, always.
The main areas casino auditing covers
Game fairness verification
Beyond the RNG, auditors verify that each game plays by its own rules. Blackjack must deal from a correctly modelled shoe and follow the stated dealer rules. Roulette must treat all 37 pockets on a European wheel identically, which is where the 2.7% house edge comes from. Live dealer studios get their own review, covering wheel and shoe handling, camera coverage and dealer procedure. Crash games may add provably fair mechanics, letting you verify individual rounds from published seeds and hashes.
Return-to-player (RTP) testing
RTP testing confirms that a game returns, over the long run, the percentage its paytable claims. A 96% RTP slot returns about ₹96 per ₹100 wagered averaged over millions of spins, leaving a 4% house edge. That average says nothing about your session: a high volatility slot can run cold for hundreds of spins and still be perfectly certified, because volatility describes how returns are spread, not how large they are in total.
Labs verify RTP by simulating the game at scale and comparing the result against the supplied maths model. Some also publish ongoing reports on actual player returns at audited operators, which is a genuinely useful signal because it reflects real play rather than a lab bench.
Security, data and responsible gambling controls
The rest of the audit is less romantic and arguably more relevant to you. Testers examine encryption of payments and KYC documents, access controls over player accounts, segregation of player funds, and the integrity of transaction logs. They also check that deposit limits, loss limits, session reminders, cool-off and self-exclusion tools exist, work, and apply immediately rather than after a convenient delay.
Who actually does the testing
A handful of laboratories dominate fair play testing, and their accreditations with regulators are what give the certificates weight.
| Laboratory | Base | Best known for |
|---|---|---|
| Gaming Laboratories International (GLI) | United States, with labs worldwide | The GLI technical standards, including GLI-19 for online gaming systems, used by regulators globally |
| eCOGRA | London | Player-facing seals, RNG and game audits, and published RTP reporting for certified operators |
| iTech Labs | Melbourne | RNG and game evaluation certificates widely used by slot studios and crash game providers |
| BMM Testlabs | United States and Australia | One of the oldest gaming test labs, covering land-based and online systems |
| Gaming Associates | Australia | Pioneered government-mandated online testing from 1998 |
Regulators sit above all of them. A Malta Gaming Authority or UK Gambling Commission licence means a commission has accepted lab reports and keeps auditing the operator afterwards. For Indian players, who mostly use offshore-licensed sites, the licence plus the lab certificate is the realistic substitute for domestic regulatory oversight, since Indian gambling law is a state-by-state patchwork and most online casinos are not licensed here at all.
How to verify a casino’s compliance status
This takes five minutes and it is the cheapest due diligence in gambling.
- Scroll to the footer. Licence number, licensing authority and lab seals live there. No footer details is itself an answer.
- Click the licence seal. A real one links to the regulator’s register and shows the operating company, licence status and permitted games. A static image that clicks nowhere is decoration.
- Check the name matches. The company on the licence should be the company in the site’s terms and conditions. Mismatches are common on clone sites.
- Open the testing certificate. Look for the lab’s name, the operator or game studio, the scope of the test and a date. “RNG certified” as plain text, with no document behind it, is a claim rather than evidence.
- Search the lab’s own directory. GLI, eCOGRA and iTech Labs list the clients and products they have certified. If the site’s certificate isn’t verifiable at the source, treat it as unverified.
- Read the withdrawal terms. Compliance covers payouts too. Check KYC requirements, withdrawal limits and any bonus conditions, especially wagering requirements, before you deposit.
li
If you’d like a worked example, our casino review section runs through licence and certification checks for individual sites, and our guide to how RNGs work covers the maths in more depth.
Red flags that suggest nobody checked
The following patterns show up repeatedly on sites with weak or absent casino auditing:
- Logos of regulators or labs that are images only, with no link, licence number or verifiable certificate.
- A licence number that returns nothing in the regulator’s public register, or belongs to a different company.
- No published RTP figures anywhere, and support that cannot tell you a game’s RTP when asked.
- Certificates with no date, no version reference, or dates several years old.
- Games from studios nobody has heard of, with no provider listed in the game info panel.
- Missing or buried responsible gambling tools, or deposit limits that the site asks you to request by email.
- Terms that allow the operator to void winnings at its discretion, or payout caps that only appear after you try to withdraw.
- Heavy promotion of guaranteed wins, prediction tools or “patterns” in game results. Certified RNG outcomes are independent, so anyone selling a pattern is selling fiction.
Worth keeping in proportion: certification tells you the game is honest and the operator is supervised. It does not change the fact that every casino game carries a house edge and loses money for players over time. Set a deposit limit, treat the spend as entertainment, and use the self-exclusion tools if it stops feeling like that. If gambling is causing you harm, step away and speak to a support service.
Frequently asked questions
What is compliance testing in iGaming?
It is independent third-party testing of a casino’s games, RNG, payout percentages, security and responsible gambling tools, usually required by the regulator that licensed the operator.
How does RNG certification work?
A lab reviews the generator’s code and entropy source, then runs huge samples of its output through statistical tests such as chi-square and serial correlation to confirm outcomes are uniform, unpredictable and independent.
Why do casinos need auditing?
Because players cannot inspect the software themselves. Auditing gives regulators enforceable evidence that games match their stated maths and that player funds and data are handled properly.
How can I check a casino is fair?
Verify the licence in the regulator’s public register, open the testing certificate and confirm it names the operator with a recent date, then cross-check it in the testing lab’s own client directory.