Every regulated iGaming platform has to pass through an independent test laboratory before it can accept a single real-money bet in a licensed market. Certification is not a formality you bolt on at the end — it is the gate that decides whether you launch on schedule or watch your go-live date slip by months. This guide explains what iGaming software certification actually covers, which standards and test houses matter, how the process runs, and how to build so you pass on the first submission rather than the third.
Why certification decides whether you launch
A gambling regulator does not take your word that your games are fair or that your platform protects players. It requires proof from an accredited, independent test house. Until that proof exists, your licence application stalls and your platform cannot legally take bets. Operators who treat certification as an afterthought routinely lose a quarter or more to re-submissions, because the problems the lab finds are architectural — the kind you cannot patch in an afternoon. Building for certification from the first sprint is far cheaper than retrofitting it under deadline pressure.
What iGaming certification actually covers
Certification is not one test. It is a set of assessments spanning four areas:
- Random number generation (RNG). The lab verifies that outcomes are statistically random, unpredictable and unbiased, and that the RNG is correctly scaled to each game.
- Game fairness and math. Every game's return-to-player (RTP), paytable and rules are checked against the declared figures, so the maths a player is told matches the maths that actually runs.
- Platform and system integrity. The wallet, ledger, bet-settlement, reconciliation and reporting are examined to confirm money movements are accurate, auditable and tamper-resistant.
- Responsible gaming and AML controls. Deposit limits, self-exclusion, age and identity verification, and anti-money-laundering rules must be enforced where a player cannot reach them — server-side, at the wallet and ledger.
The main standards and test houses
A handful of independent laboratories are accredited by regulators worldwide. The standard you target depends on the market you licence in:
- GLI-19 — Gaming Laboratories International's standard for interactive gaming systems (the platform, wallet and server logic). It is the most widely referenced standard for online casino and sportsbook systems.
- GLI-11 — the standard for gaming devices, used for the game and RNG layer.
- GLI-33 — event wagering (sports betting) systems.
- iTech Labs and BMM Testlabs — alternative accredited houses that certify RNG, RTP and platform integrity, accepted across many jurisdictions.
Regulators such as the UK Gambling Commission and the Malta Gaming Authority publish their own technical standards on top of these; a platform built to GLI-19 with clean RNG and RTP evidence is well positioned for both. Confirm the exact requirements with the regulator or your compliance counsel, because they differ by market and change often.
The certification process, step by step
A typical submission runs like this:
- Scope and code freeze. You agree the game and system versions to be tested and freeze that build — the lab certifies exactly what it sees.
- Documentation submission. Game rules, RTP declarations, RNG design, and system architecture are handed over.
- Source and math review. The lab reviews source code for the RNG and game logic, and evaluates the maths against the declared RTP.
- RNG evaluation. Statistical testing confirms the output is random and correctly mapped to game outcomes.
- System testing. Wallet, settlement, reporting and responsible-gaming controls are exercised.
- Field trial and sign-off. Some jurisdictions require a controlled live trial before the certificate is issued.
RNG and RTP: what the lab actually checks
For the RNG, the lab looks for three properties: the output must be uniformly distributed, unpredictable (you cannot infer the next value from previous ones), and unbiased across the full range. It also checks that the RNG is scaled correctly — that mapping a raw number to a reel position or card does not quietly skew the odds. For RTP, the lab confirms that the theoretical return built into the maths matches what the paytable and game rules advertise, and that it holds across millions of simulated rounds. If you build your own games, our explanation of slot RNG and slot math and RNG development cover how this is engineered.
How to build so you pass the first time
The platforms that clear certification cleanly share a few engineering habits:
- Enforce every control server-side. Limits, self-exclusion, KYC and bet validation belong in the wallet and ledger, never in the UI. A control a modified client can bypass fails the audit.
- Log everything, immutably. The lab and the regulator need a complete, tamper-evident audit trail of every bet, settlement and balance change.
- Use reproducible builds. The version you submit must be the version you deploy; a documented, reproducible build pipeline prevents the mismatch that invalidates a certificate.
- Isolate the RNG and treat seeds as secrets. Seed handling and entropy sources must be documented and protected.
- Certify integrations too. Third-party game and payment providers must themselves be certified for your market — our game aggregator integration work accounts for this.
Common reasons platforms fail certification
Most first-submission failures are avoidable: responsible-gaming limits enforced only in the front-end; RTP that drifts from the declared figure under real distributions; missing or incomplete audit logs; RNG that is statistically fine but incorrectly scaled; and undocumented changes between the submitted and deployed builds. Each of these is an architecture decision, which is why they are so expensive to fix late — and why a security audit and internal pre-check before submission pays for itself.
Costs and timelines
Certification cost and duration vary widely by scope, jurisdiction and how many games are involved. A single game's RNG and math certification is a relatively contained exercise; a full GLI-19 platform certification for a Tier-1 regulated market is a larger programme that can run several weeks to a few months, especially if the lab returns findings that require code changes and re-submission. The single biggest lever on both cost and time is how certification-ready the build was before it reached the lab. Budget for the process explicitly in your launch plan — a timeline that never mentions certification is a timeline that will slip.
How Sudonex builds certification-ready platforms
Sudonex has built iGaming software since 2018 with certification as a first-class requirement, not a final hurdle. Our platforms are engineered to GLI-19 and iTech Labs expectations, with fluency in MGA, UKGC and Curaçao technical standards across regulated markets. We enforce responsible-gaming, KYC and AML controls server-side, keep immutable audit trails, and run a pre-submission review so the test house sees a build that is ready to pass. If you are planning a launch, our casino licensing and compliance and RNG integration testing services take you from architecture to a certified, launch-ready platform. Tell us what you are building and we will map the certification path for your target markets.