A random number generator is the engine of every regulated casino game. If the RNG is biased, predictable, or improperly seeded, every spin, card draw and dice roll built on top of it inherits that flaw. Regulators reject the submission, operators face fines, and players lose trust the moment a pattern surfaces on a forum. Sudonex provides RNG integration testing for casino studios and operators preparing for GLI-19, iTech Labs, BMM Testlabs, and MGA RNG certification, plus internal audits for licensed operators who need ongoing assurance between resubmissions.
What RNG Integration Testing Actually Covers
RNG integration testing is not the same as testing the RNG algorithm in isolation. A vendor may ship a certified core (Mersenne Twister, ChaCha20, Fortuna, Hardware RNG output), but the integration layer is where most failures occur: seeding logic, scaling functions that map raw output to game ranges, reseed intervals, thread safety, and the bridge between the RNG and the game math model. We test the algorithm, the wrapper, and the consumption pattern as one system, because that is exactly how a regulator evaluates it.
A full engagement covers entropy source verification, statistical analysis on raw and scaled output, source code review of the seeding and consumption layer, unpredictability and forward-prediction resistance checks, and reproducibility testing under load. The deliverable is a certification-ready report that maps directly to the relevant standard.
Why It Matters: Regulators and Players
Two audiences care about your RNG. The first is the regulator. GLI-19, iTech Labs RNG evaluation, BMM, MGA, UKGC RTS 7 and similar frameworks all require independent statistical evidence that the generator produces output indistinguishable from true randomness across billions of samples. The second is the player. A single suspicious streak posted on Reddit or AskGamblers can cost a brand more than a failed audit. Our test methodology produces evidence both audiences accept.
GLI-19 vs iTech Labs vs BMM: What Differs
The three major test houses share a common statistical foundation but differ in scope, sample sizes, and reporting format. GLI-19 (Standard for Random Number Generators) is the most widely recognised, used by most US state regulators and many tribal jurisdictions. It mandates a defined battery of tests, minimum sample sizes (typically tens of millions of values per test), and explicit documentation of the entropy source and reseed strategy.
iTech Labs applies a similar statistical core but places extra weight on unpredictability and the cycle length of the generator, which matters for jurisdictions like MGA and several Australian states. BMM Testlabs maintains its own internal protocol that tracks closely to GLI-19 but adds specific requirements around hardware entropy validation for jurisdictions that mandate HRNG. MGA RNG certification can be issued through any of these three; the choice usually depends on which regulator you also need to satisfy in parallel. We prepare the same code base for whichever path you select, then tailor the report.
Statistical Tests We Run
Our lab runs the full NIST SP 800-22 suite (frequency, block frequency, runs, longest run of ones, binary matrix rank, discrete Fourier transform, non-overlapping and overlapping template matching, Maurer universal, linear complexity, serial, approximate entropy, cumulative sums, random excursions and random excursions variant). On top of NIST we run Diehard and Dieharder where the regulator requires it, plus targeted tests that catch integration bugs the generic batteries miss: chi-square goodness-of-fit on the scaled game range, Kolmogorov-Smirnov on continuous outputs, runs test on game-level outcomes, autocorrelation across multiple lags, and a poker test on hand distributions for card games.
For slots specifically we sample at the symbol level and at the reel-stop level, because a generator can pass uniformity at the raw byte level and still skew once mapped through a weighted reel strip. That class of bug is the most common reason a math-correct slot fails certification.
Entropy Source Review
We classify your entropy source into one of three buckets and test accordingly. A pure software PRNG (Mersenne Twister, LCG variants) is acceptable for non-monetary or social casino contexts but rarely passes regulated review on its own. A CSPRNG (ChaCha20, AES-CTR-DRBG, Fortuna) seeded from a quality OS entropy pool is the modern baseline for regulated online casino. A hardware RNG, either dedicated silicon or a TPM-backed source, is required by some land-based jurisdictions and by certain MGA submissions for live dealer infrastructure. We review your seed material, reseed cadence, seed mixing function, and what happens during process restart and container scaling. The reseed window is the single most common source of preventable failures.
Deliverables
Each engagement produces a signed test report with raw datasets, p-value tables, pass/fail per test, the entropy assessment, source code observations, and remediation guidance. The report is formatted to drop into a GLI, iTech or BMM submission package without rewriting. We also hand back the test harness so your team can re-run any subset during future development.
Common Failure Modes We Fix
Weak seeding from time-based or PID-based sources. Reseeding too frequently from a low-entropy pool. Modulo bias when scaling raw output to a non-power-of-two game range. Thread-shared generator state without locking. Reusing a single seed across server instances after a deployment. Predictable PRNG output exposed through client-side prediction of bonus triggers. Each of these has shipped in production casino games we have audited; each has a defined fix.
Integration With Existing Engines
We work with Unity (C#), HTML5 / TypeScript, native C++ game servers, and the common server-side stacks (Node, Go, Java, .NET). The RNG layer is usually a thin wrapper, so integration changes are scoped and rarely touch game logic. For studios building from scratch we provide a reference RNG service alongside our slot game development and casino app development work. For operators integrating third-party content we audit the wrapper your platform uses to consume vendor RNG feeds.
Timeline and Cost (Directional)
A single-game RNG integration audit typically runs two to three weeks from code handover to signed report. A full studio-level engagement covering the shared RNG service plus three to five game integrations runs four to six weeks. Costs are quoted per scope; expect mid five-figure USD for single-game work and low six-figure for studio-wide engagements with ongoing retest rights. Add four to eight weeks for the test house to issue the formal certificate after our pre-cert report is delivered.
Related work: slot game math and RNG design, security audit and penetration testing, and casino licensing compliance.
FAQ
Q: Can Sudonex issue the GLI-19 certificate directly?
A: No. Only accredited test houses (GLI, iTech, BMM, eCOGRA) issue certificates. We perform pre-certification testing and remediation so your submission passes on the first attempt rather than after two or three rejection cycles.
Q: How many samples do you collect for statistical testing?
A: A minimum of one billion raw bits for the NIST suite, and ten to one hundred million game-level outcomes per scaled test, depending on the regulator. Sample size is set by the standard, not by us.
Q: Do we need a hardware RNG?
A: For most online casino jurisdictions, no. A properly seeded CSPRNG is sufficient. For some land-based and live dealer deployments, yes. We confirm during scoping which path your target jurisdiction requires.
Q: Can you test an RNG we cannot share source for?
A: Yes, through black-box statistical testing on output samples. The report is weaker than a full white-box review and some regulators will not accept it without source access, so we flag that constraint up front.
Q: How often do we need to retest?
A: Most regulators require resubmission on any change to the RNG, the seeding logic, or the scaling functions. Annual retest is common even without changes. We retain your harness so reruns are fast.
Ready to start? Send your RNG implementation or the games you need certified to the Sudonex team and we will scope a pre-certification engagement against your target regulator. Begin at contact.