A Testing House Certifies a Build Against a Standard on a Given Day. The Badge Implies Rather More.

An accredited laboratory signs off a specific software version against named clauses of a named standard, which leaves the operator's conduct, its solvency, whether a withdrawal gets paid and the round a player just lost entirely outside the certificate.

The UK Gambling Commission's RTS 7, issued under sections 89 and 97 of the Gambling Act 2005, requires RNG output and game results to be "acceptably random" and prohibits adaptive behaviour, that is, a compensated game. (RTS 7)
The Commission's testing strategy says a games test report should include at least the game name, return to player, software number and digital signature, the platform supplier and version, and the channels covered by testing, and it goes to the Commission before release. (Testing strategy: procedure for testing)
GLI-19 states that evaluation of the internal control systems used by operators, such as anti-money laundering, financial and business processes, should not be incorporated into laboratory testing of the standard, but instead sits in the operational audit performed for local jurisdictions. (GLI-19 v3.0, clause 1.3.1)
The Commission's list of approved test houses names 14 facilities and the areas each is approved for, all of which must hold ISO/IEC 17025 accreditation. It is a register of laboratories, not of game certificates. (Approved test houses)
Licensees holding customer funds must state in their terms whether those funds are protected in the event of insolvency, the level of protection and the method used, according to a rating system the Commission specifies. (Licence condition 4.2.1)

What is actually submitted for testing?

Not a casino, and not a brand. A build.

The Commission's testing strategy sets out what a games test report should include at least, and that field list is the clearest description of the object being certified: game name, return to player, software number and digital signature, platform supplier and platform version, the channels — the game clients — covered by testing, and the versions the game supersedes. An RNG report is separate, naming the RNG version, stating whether it is hardware or software, carrying its own signature and citing limits on that RNG's use.

A document that identifies a signature and a version is a statement about that signature and that version. It is not a statement about the company displaying it.

What falls outside the badge?

GLI-19 answers this in its statement of purpose: assessment of operator internal controls, including anti-money laundering and financial and business processes, is deliberately kept out of laboratory testing and assigned to the operational audit run for the local jurisdiction. Operator solvency, whether a withdrawal is honoured, marketing claims and current licence status are all in that other category.

Whether player money survives an operator's failure is governed separately. Licence condition 4.2.1 requires disclosure of insolvency protection under the Commission's rating system, whose guidance notes that segregation without protection — the minimum for remote operators holding customer funds — leaves those funds part of the business's assets in insolvency. A game certificate says nothing about which rating applies.

Nor does it resolve a single round. That runs through the operator's complaints procedure and, under social responsibility code provision 6.1.1, to a free alternative dispute resolution entity if unresolved after eight weeks. A tested RNG supports claims about a distribution over many outcomes; it cannot reconstruct the hand a player just lost. Cryptographic designs of the kind covered in what provably fair means target exactly that gap, letting a player recompute one round rather than trust a report about the generator, and the distinction between a tested RNG and a verifiable one is the substance of the VRF versus RNG comparison.

What does the laboratory measure?

Two layers: the random source, and the game sitting on it.

For randomness, the Commission's procedure describes review of the RNG documentation, research into publicly known weaknesses in the algorithm, source code review to confirm the implementation matches the documentation, and statistical testing of raw output alongside scaled or shuffled data. GLI-19, Gaming Laboratories International's standard for interactive gaming systems, converges on the same method, down to a battery of statistical tests evaluated collectively at a 99% confidence level.

For the game, testing verifies the maths, the rules as displayed and the theoretical RTP, then that the software implements that design — through simulation, emulation of rare outcomes such as jackpot triggers, and manual play.

This is where a common misreading starts. "RTP verified" means the lab found that the game returns what its own maths says it returns. It carries no view on whether that figure is generous. Under RTS 7 the prohibition is on misleading the customer and on adaptive behaviour, not on a thin paytable.

What is the certificate bound to, and what voids it?

A version, a jurisdiction's standard, and a date.

The Commission's testing strategy defines a major update as any software change which may affect a game's fairness, including any change to the RNG, to scaling and mapping, or to game rules — which its footnote defines as the underlying maths and design: paytables, symbol distribution, feature rules. Major updates require external retesting before release. Minor updates — a sound format fix for a new mobile operating system, a character's hat colour changing because image rights expired — ship under change control, with a random sample checked afterwards in an annual games testing audit by an approved test house.

The boundary is drawn at fairness, not at visibility. One published example makes the point: a performance fix that rebuilt how a game's symbol arrays were constructed required independent testing even though no rule changed, because the implementation of those rules had. A platform or RNG update sitting under hundreds of games triggers retesting of a representative sample rather than a fresh certificate per title.

There is also the gap between a certified build and a running one. GLI-19's operational audit appendix requires procedures verifying that critical control components in production are identical to those the regulator approved, by gathering signatures at installation, at power-up, at least daily and on demand, and comparing them against the approved versions. That control exists because a certificate proves what was submitted, not what is deployed. The scheme type says it in the standard's own vocabulary: eCOGRA classifies its online gambling certification as a Type 1a scheme under ISO/IEC 17067:2013, and for Type 1a no surveillance is required at all, because the attestation covers only the items actually tested: at clause 5.3.2, “subsequent production items are not covered by the certification body's attestation of conformity.” eCOGRA calls its work “point in time” certification for that reason, superseding a certificate after a major update rather than suspending it.

Who checks the laboratory?

ISO/IEC 17025 is the international standard for the competence, impartiality and consistent operation of testing laboratories, and accreditation bodies assess against it. It makes a lab's competence auditable by someone other than its clients.

Accreditation is scoped, and the scope is often geographic. eCOGRA's published schedule, for instance, lists its ISO/IEC 17025:2017 testing accreditation for a named list of jurisdictions rather than universally. "Accredited" is therefore always a scoped claim, never a general one.

One further point on names. "eCOGRA certified" can mean two different things: a game or RNG test report from an approved test house, or certification to eCOGRA's own eGAP scheme, whose seal — per eCOGRA's published description — indicates that operational systems are secure, monetary deposits are safe and games are fair, assessed through annual review. Broader scope, different scheme, different evidence. The badge does not say which.

Can a player look up the certificate?

Only halfway. For Great Britain the Commission publishes a list of approved test houses — 14 facilities as of 2 March 2026, each marked for remote technical standards, categories of gaming machines, and bingo and casino equipment — and where the testing strategy requires third-party testing, a licensee must appoint one from that list. That is a register of laboratories. The games test report itself, with its software number and digital signature, goes to the Commission rather than to the public. So a player can confirm that the laboratory behind a badge is recognised, and for which areas, and cannot pull the report for the game they were playing, let alone for the round they just lost.

Also: a badge is an image file served by the site displaying it, while the underlying records live elsewhere — a games register submitted to the regulator, a test report naming a signature, an accreditation schedule, a public licence register. Verification runs downward from those registers to the operator, not upward from the logo. That asymmetry, rather than any doubt about laboratory method, is what makes a certification badge a weak consumer signal: it is durable artwork attesting to a perishable fact.

Sources: