RNG Certification and iGaming Testing Labs

RNG certification is independent proof, issued by an accredited testing laboratory, that a game’s random number generator produces unpredictable, unbiased outcomes and that the game pays out in line with its published maths. In regulated markets a lab must test the RNG, each game and the wider platform before launch and again after material changes, and most regulators accept results only from labs on their own approved list or holding ISO/IEC 17025 accreditation.

This guide explains what labs test, which labs appear on the published lists of the Gambling Commission, the AGCO, the Isle of Man and Switzerland as of October 2026, how Sweden and Denmark rely on accreditation instead, and how to read a certificate. Testing labs are one link in the wider iGaming B2B supply chain.

What does an iGaming testing lab actually do?

An iGaming testing lab checks software against a regulator’s technical standard and issues a report or certificate the operator files with that regulator. Typical work covers RNG testing, game maths and return-to-player (RTP) verification, platform and system compliance, change-management reviews of new versions, and security assessments. Gambling Commission-approved test houses, for instance, must hold BS EN ISO/IEC 17025 accreditation.

• RNG evaluation: source-code review of the generator, seeding and scaling, plus statistical testing of large output samples.
• Game testing: confirming that rules, paytables, theoretical RTP and outcome mapping match the documentation, and that the game behaves correctly on disconnection or error.
• Platform and system testing: checking the account, wallet, limits, self-exclusion and reporting functions against the market’s rules.
• Market-specific features: for example Germany’s default 1 euro maximum stake per spin, five-second average minimum game duration and ban on autoplay for virtual slots, or Sweden’s minimum of three seconds per game round under SIFS 2022:3.
• Change management: reviewing new versions and confirming that the build in production matches the build that was certified, usually by comparing file hashes.
• Security and audits: penetration tests, vulnerability scans and periodic compliance audits, which some regulators require yearly.

Labs do not license operators and cannot make an unlicensed game legal. Their reports are evidence that a regulator weighs when it approves a product, which is why the same game often carries separate certificates for each market.

Which testing labs do regulators accept?

As of October 2026 the labs that appear across the most published regulator lists are Gaming Laboratories International (GLI), BMM Testlabs, eCOGRA, Gaming Associates Europe, Global Lab, Quinel, RiskCherry (Lean Lab Company) and Eclipse Compliance Testing. The Gambling Commission’s list dated 2 March 2026 names 14 entities; the AGCO lists eight registered independent testing labs; the Swiss Federal Gaming Board’s list of 4 March 2026 names nine.

The Isle of Man list also names GTA Pty Ltd and QA Lab. Not every lab is approved for every activity: the Gambling Commission’s list shows, for example, that eCOGRA, Gaming Associates Europe, Global Lab, Quinel and RiskCherry are approved for the remote technical standards but not for gaming machines, while several GLI entities, BMM Spain and Eclipse also cover machines and bingo or casino equipment. An operator must confirm that the chosen house is approved for the specific facility it plans to offer.

GLI and iTech Labs

GLI was created in June 1989 by James Maida and Paul Magno and has the most separately listed entities on these lists, spanning Europe, Africa and India. In May 2023 GLI bought the outstanding shares of iTech Labs, the Australian online test lab, which now operates as a wholly owned GLI subsidiary under its own brand; GLI says it moved iTech’s operations to Bulgaria and India in 2025. Because iTech Labs is not on the British, Ontario, Isle of Man or Swiss lists under its own name, an iTech certificate should be checked against the specific regulator’s requirements rather than assumed to be accepted.

BMM Testlabs

BMM was founded on 27 November 1981 in Las Vegas and describes itself as the longest-established private independent gaming laboratory. It holds ISO/IEC 17025 accreditation for testing, 17020 for inspection and 17065 for product certification, which is the combination several regulators look for.

eCOGRA

eCOGRA was established in 2003 in the United Kingdom as a self-regulatory body for online gambling and now holds UKAS accreditation to ISO/IEC 17025:2017. It also runs a player dispute service and was approved as an alternative dispute resolution (ADR) provider by the Gambling Commission in 2015. That ADR role matters in Malta: the MGA’s Player Support Unit stopped ruling on individual disputes on 1 April 2019, so complaints go to ADR bodies such as eCOGRA. See our MGA licence guide for the complaints route.

Other labs on national lists

Gaming Associates Europe, Global Lab, Quinel and RiskCherry appear on all four lists checked for this guide. Other accredited bodies are accepted by specific national regulators, so the right question is never “is this a good lab?” but “is this lab approved, by this regulator, for this activity, on this date?”

Which regulators publish approved-lab lists?

Great Britain, Ontario, the Isle of Man and Switzerland publish named lists of approved or recognised testing bodies. Sweden and Denmark instead set accreditation criteria that any qualifying body can meet: Swedish licensees must use accredited bodies under SIFS 2022:3, and Denmark’s certification programme requires ISO/IEC 17025 or 17065 accreditation for testing. As of October 2026 we found no comparable public MGA list.

Two consequences follow. First, a lab’s ISO accreditation number is not the same as regulator approval: a British approval depends on the Commission’s list, not only on a UKAS certificate. Second, operators entering several markets should choose a lab that appears on every relevant list, which keeps one test cycle feeding several submissions. Our UK Gambling Commission guide and European markets overview cover the licences themselves.

How is an RNG tested and certified?

RNG certification combines a code review with statistical testing. The lab inspects how the generator is seeded, how raw numbers are scaled to game outcomes such as a card or reel position, and whether outputs can be predicted or influenced. It then runs large output samples through statistical batteries looking for bias or patterns, and issues a certificate tied to a specific software version.

1. Documentation review: the supplier submits source code, a description of the algorithm (often a cryptographic or well-studied pseudo-random generator), seeding sources and the scaling method.
2. Code review: testers check there is no back door, no reuse of seeds, and no scaling bias, such as modulo arithmetic that slightly favours some outcomes.
3. Statistical testing: large samples are run through tests such as chi-square goodness-of-fit, runs tests and serial correlation tests, often alongside published batteries such as NIST SP 800-22.
4. Integration check: the lab confirms the certified RNG is the one the game actually calls in production, and that outcomes are determined before the result is shown.
5. Certificate and fingerprint: the report identifies the RNG version and a cryptographic hash of the files, so any later change is detectable.

How do labs verify RTP and game maths?

For each game the lab recalculates the theoretical return to player from the paytable and reel strips or rules, then simulates many millions of rounds to confirm that the observed return converges on that figure within statistical tolerance. Where a game ships with several RTP configurations, each one is listed separately on the certificate, and the operator must run only a configuration approved for its market.

Multiple RTP versions are a common source of confusion. A slot might be certified at three settings, and the version a player sees depends on what the operator selected in the back office. Regulators that publish game registers expect the deployed setting to match the certified one, and many require the RTP to be shown to players in the game’s help screen.

What happens when a certified game or platform changes?

Any change to certified software is handled under change management: the supplier classifies the change, and material changes go back to the lab for testing before release, while minor changes may be logged and reviewed later where the regulator allows. The production build is then matched to the certified build by hash. In Sweden, inspection and certification protocols must be renewed at least every 12 months under SIFS 2022:3.

Emergency fixes are the weak point. Regulators generally allow urgent security patches to go live first, provided the change is documented and tested afterwards within a set period. Operators should require suppliers to notify every version change, because an uncertified build in production is a licence breach for the operator, not only the supplier.

How do you read a testing certificate?

A testing certificate should name the issuing lab and its accreditation, the regulator or technical standard tested against, the game or system name, the exact version and file hashes, each approved RTP configuration, and the issue date. If any of these is missing, or the version differs from what runs in production, the certificate does not cover the product in front of you.

1. Issuer: check the lab’s legal entity appears on the relevant regulator list (for Great Britain, the specific GLI or BMM entity matters).
2. Standard and jurisdiction: a certificate against one market’s standard does not prove compliance with another’s.
3. Product identity: game name, supplier, version number and the hash values of each critical file.
4. Configurations: every RTP or feature variant covered, with any limits on stake or features.
5. Dates: issue date, and whether the regulator requires renewal or periodic re-audit.
6. Verification: where the lab offers an online certificate lookup, use it; a PDF alone can be altered.

Players and affiliates sometimes see a lab’s logo in a casino footer. A logo proves nothing by itself: it must link to a certificate for that operator and that game portfolio. The same rule applies to licence seals, as our Curaçao licensing guide explains for CGA validation.

How much does RNG certification cost?

None of the major labs publishes a standard price list. Cost depends on the number of games, the number of target markets, the RNG’s complexity, whether source code has been reviewed before, and how much change-management work follows. Suppliers usually negotiate framework agreements covering a pipeline of games. Budget also for internal time: preparing documentation and fixing findings often takes longer than the lab’s testing itself. For the wider cost picture of licensing, see the licensing hub.

Frequently asked questions

Is iTech Labs approved by the UK Gambling Commission?

Not under its own name on the Commission’s approved test house list dated 2 March 2026. iTech Labs has been a wholly owned subsidiary of GLI since May 2023, and several GLI entities are on the list. Check the exact legal entity named on any certificate against the current list before relying on it in Great Britain.

Which accreditation must an iGaming test lab hold?

ISO/IEC 17025 is the common baseline. The Gambling Commission requires full BS EN ISO/IEC 17025 accreditation plus selected ISO/IEC 17065 and 27002 requirements, from UKAS or an equivalent body. Denmark accepts ISO/IEC 17025 or 17065 for testing and ISO/IEC 17020 type A for inspection. Regulator approval is still a separate step.

How often does a game need to be re-certified?

Whenever a material change is made to certified software, and periodically where a regulator demands it. Sweden’s SIFS 2022:3 requires inspection, testing and certification protocols to be renewed at least every 12 months. Elsewhere the trigger is usually a version change, checked by comparing the production file hashes with the certified ones.

Does an RNG certificate from one country work in another?

Only if the second regulator accepts both the lab and the standard tested against. A report against Great Britain’s remote technical standards does not show compliance with Danish, Swedish or Ontario rules. Many labs test a game against several standards in one cycle and issue a separate certificate for each market.

Can a lab logo on a casino website be trusted?

Not on its own. A logo should link to a certificate that names the operator or games, the version and the date, ideally on the lab’s own verification page. Without that link, a lab badge is decoration rather than evidence of testing.

Do Ontario testing labs need their own registration?

Yes. The AGCO lists independent test labs among the suppliers that must register before serving the Ontario igaming market, and it publishes a list of registered independent testing labs, eight as of October 2026. Suppliers must have their product, all games and the RNG certified by one of these labs before they apply.