MawarSlotResmiLicensing & player protection

Licensing

Game fairness and RNG testing

What a laboratory actually examines, who approves the laboratories — and why a fairness certificate says nothing about whether an operator will pay you.

Last reviewed: 18 September 2026MawarSlotResmi Editorial Desk

In short

Game and RNG testing certifies something narrow: that a random number generator produces statistically random, unpredictable output, and that a game pays according to the rules and maths described to the player. Regulators do not do the testing themselves. They approve or accredit laboratories, which test against a scope the operator and the laboratory agree between them. A certificate says nothing about whether an operator holds enough money to pay you, whether withdrawals are honoured, or how the business treats its customers.

What a random number generator is

An RNG is the component that decides outcomes. Great Britain’s technical standards define it as “any item of hardware or software which is used to generate random numbers” with the intended property of statistical randomness — hardware included, which is why Ontario’s certification policy also covers the physical RNGs used in live dealer games.

British RTS 7A requires random number generation and game results to be acceptably random, demonstrated through statistical analysis, and prohibits adaptive or compensated behaviour. Its guidance describes unpredictability as it being “computationally infeasible to predict what the next number will be”, and asks for uniform distribution matching theoretical probabilities, an output stream that does not repeat between instances, and seeding and scaling that do not introduce predictability. Sweden requires results that are random, statistically independent, with correct standard deviation and probability distribution. Separately, RTS 7C prohibits designs that mislead customers about the likelihood of outcomes, naming false near-miss substitutions.

The technical standards regulators publish

Each instrument binds the operators the authority beside it licenses, and no others.

Remote gambling technical standards, as read on 18 September 2026
JurisdictionInstrument, and where fairness sits in it
Great BritainRemote gambling and software technical standards (RTS), issued under sections 89 and 97 of the Gambling Act 2005; compliance is mandated by licence condition 2.3.1 of the LCCP, as the RTS introduction states. RTS 7 is generation of random outcomes; RTS 3 is rules, game descriptions and the likelihood of winning
DenmarkCertification Programme, a numbered document set with separate requirements for the RNG, the base platform, information security, penetration testing, vulnerability scanning, change management and games. SCP.07.03 covers online casino games
SwedenSIFS 2022:3, on technical requirements and on accreditation of bodies for control, testing and certification. Chapter 13 covers the RNG, Chapter 10 payout percentage, Chapter 11 game instructions
OntarioRegistrar’s Standards for Internet Gaming, in force 4 April 2022. Standard 4.08 requires games, RNGs and betting components to be “approved by the Registrar or certified by an independent testing laboratory” it has registered — a disjunction, so an Ontario game is not necessarily lab-certified
MaltaDirective 3 of 2018, in force 1 August 2018; the version read is marked V2, October 2021. It governs approval of RNGs and game engines, reserving to the Authority the right to require certification rather than mandating a test for every release

Denmark’s documents state that only the Danish version is legally binding and the English is guidance only; the Swedish material is read through the Authority’s May 2025 guidelines, an unofficial translation which states the Swedish version prevails.

One requirement converges across four of them: the outcome must not depend on what has already happened. Great Britain prohibits adaptive or compensated behaviour, Denmark prohibits overriding RNG output for adaptive reasons, Sweden requires independence from current and previous games, and Ontario requires outcome probability to be “constant and independent” of game history or player. Each carves out structures disclosed in the rules or terms, so what is prohibited is undisclosed adjustment — our reading of the four texts.

Who does the testing, and how a laboratory is recognised

No regulator here tests games itself. Each recognises third-party laboratories by a different route.

Great Britain — an approved Test House list
A licensee must appoint an approved Test House from the Commission’s published list. Approval requires “full accreditation to BS EN ISO/IEC 17025 standards” plus selected requirements from ISO/IEC 17065 and 27002, and applicants are assessed on ownership and independence from operators, finances, integrity, competence and criminality.
Denmark — accreditation through mutual recognition
Testing must be accredited testing by a laboratory accredited to ISO/IEC 17025 or 17065 by DANAK, by a similar body co-signing the European co-operation for Accreditation multilateral agreement, or outside that jurisdiction a co-signer of the ILAC multilateral agreement.
Sweden — the duty sits on the applicant
A licence applicant applies to an accredited body for inspection, testing and certification, then sends the documentation to the Authority with the evaluation methods clearly indicated. Accreditation runs through Swedac; there is no regulator-operated approval list.
Ontario — registration as a gaming-related supplier
A testing lab must register with the AGCO and submit confirmation, such as an independent audit, that its testing methodology has been configured to the Registrar’s Standards. The AGCO states it does not conduct the testing itself.

What "tested" covers in practice

Great Britain says outright how the boundary was drawn: the Commission weighed “the visibility of compliance” against the “potential impact of non-compliance”, and states that external assurance “mainly applies to the fairness elements of RNG driven products”.

Great Britain: what an approved test house checks, and what the licensee checks itself
Assured by a third partySelf-tested by the licensee
RNG statistical analysisAvailability of player information and terms
Game maths verificationResponsible gambling features
Source code analysis and game playCheating prevention
Annual assessment of live RTP monitoringSystem recovery
Live dealer assuranceInternal controls
An annual security audit by an independent third partyConfiguration management

The right-hand column is the part most people assume a certificate covers. In Great Britain it does not.

  • The work inside the scope is substantive. British RNG testing reviews the RNG documentation, researches the algorithms for known vulnerabilities, reviews source code against that documentation, and analyses raw output statistically.
  • Scope is negotiated. The licensee and its chosen test house agree the scope between them, so two certificates that look alike may cover very different ground — which is why Ontario requires a report to list the standards certified against.
  • Part of a "certification" is inspection, not testing. Denmark’s online casino document marks requirements to be tested with a [TEST] label; the rest are inspection requirements, with different accreditation requirements attached.
  • It is point-in-time. In Great Britain, updates affecting fairness need external retesting and minor ones do not, and the annual audit samples updates rather than re-testing every game. Denmark removed annual re-testing in March 2026, requiring a renewed test only when a defined component changes. Nothing found requires a laboratory to watch an RNG in real time.

Return to player, and what must be disclosed

Return to player is a modelled long-run figure, not a forecast of a session: the British term is “the average theoretical return to player percentage”, and Denmark’s is the theoretical return under an optimal game strategy.

What each regulator requires the player to be told before committing to gamble
JurisdictionThe disclosure dutyRTP figure required?
Great BritainRTS 3C lists four items of information: a description of how the game works and how winners are determined; the house edge (or margin); the return to player (RTP) percentage or; the probability of winning events occurring. The “or” sits at the end of the third item, which reads as making all four alternatives rather than cumulative — our reading of an ambiguous list. RTS 3A requires the rules to be easily available first.No — an RTP figure is one listed option, not a universal duty
DenmarkRequirement 3.3.1: the theoretical return under an optimal strategy, in each game’s rules, with the options falling outside that strategy made clear. For a progressive prize, the theoretical minimum must be displayed.Yes, for online casino games — the strictest checked
SwedenChapter 10: the minimum payout percentage for progressive games; the system must monitor each game’s payout percentage and keep it available for audit; the payout table must be checksummed.Under this chapter, progressive games only
OntarioStandard 4.06: the terms governing play, including “the odds of winning, payout odds, or returns to players”. Standard 4.05: specifications document the operator’s advantage on each wager.No — alternatives, as in Great Britain

Great Britain treats pooled products differently: where the likelihood of winning depends on the eventual number of participants, as in bingo, describing how prizes are allocated is sufficient. Many such games carry no RTP figure at all.

On whether a stated figure can quietly be lowered, Denmark is most explicit: two of its tested requirements state that “the theoretical return to player stated in the game rules must be correct” and that “the theoretical return to player must not be manipulated”, with guidance that no intervention may be made to hold a constant percentage.

What a certificate does not prove

Each item follows from the standards themselves, not from scepticism about laboratories.

  • Not a solvency statement. No standard read here tests whether an operator holds enough money to pay players or segregates player funds.
  • Not a promise that withdrawals are paid. Payment behaviour is outside the tested scope in every regime here — see when a site is not paying.
  • Not a conduct or terms rating. Contract terms and bonus conditions are not what a game test examines, and in Great Britain responsible gambling features, player information, cheating prevention and internal controls sit in the licensee’s own self-testing.
  • Not a statement about the platform. Denmark separates the RNG, base platform, information security, penetration testing and games into distinct requirement sets; a badge naming one laboratory does not say which were done.
  • Not continuous supervision. Great Britain requires live RTP monitoring by the licensee, assessed annually; nothing found requires live third-party surveillance.
  • Some work may have been done elsewhere. Ontario requires the report to state whether testing relied on “previous testing completed for regulatory requirements in another jurisdiction”.
  • Approval attaches to the laboratory, not to the claim. Nothing in these registers lets a member of the public confirm that a given site’s game build was covered by a specific report.

Reading a certification claim

A genuine test report has a defined shape, because regulators specify its contents.

  1. Check the site is attached to a licensed business at all

    The Gambling Commission’s public register indexes domain names, so it is the right tool: open the register of gambling businesses and type the domain into the search field. We tested a URL with a query string; it does not work, so use the page’s own box. For other jurisdictions, start from how to check a gambling licence.

  2. Check what the document actually says

    A British game test report carries the licensee name, game name, RTP, software number and a digital signature; an RNG report gives the RNG version and its limitations on use. Ontario requires the AGCO-registered name of the operator or supplier, the product name, version and manufacturer, a unique identifier, and a list of the standards certified against. A document naming only a games developer does not connect the testing to the business taking your deposit, and a report that states no limitations is not describing real testing.

  3. Check the issuing body, the date and the version

    The list that matters is published by the regulator whose licence the site claims — not a review site, and not this page; read the caveat above before treating any absence as proof. Then check what the regime required when the certificate was issued: Denmark removed annual re-testing in March 2026, so the age of a Danish certificate means something different from what it meant in 2025.

Names the operator and product version Scope and limitations stated Logo with no document behind it Issuing body not on the regulator’s list No date or version anywhere

Two further points cost nothing to check. Sweden states that game instructions and rules must be available without placing a bet, and requires them to be “complete, unambiguous and non-deceptive”. And Ontario will not recognise a certification that limits, or purports to disclaim, the Registrar’s use of it.

Common questions

Can an operator lower the RTP when I am winning?

In the jurisdictions read here, adjustment of that kind is prohibited where it is not disclosed. Denmark makes the stated RTP a tested quantity and requires that it not be manipulated; Great Britain prohibits adaptive or compensated behaviour; Sweden requires independence from current and previous games; Ontario requires outcome probability to be constant and independent of game history. Each carves out structures explained in the rules.

Does a certified RNG mean I will be paid my winnings?

No, and this is the most consequential gap on the page. Solvency, segregation of player funds and withdrawal behaviour are outside the scope of testing in every regime read here. If a withdrawal is stuck, the route runs through complaints and dispute resolution, not through a test certificate.

Is every game re-tested every year?

No. Denmark removed annual re-testing in March 2026; a renewed test is required only when defined components change. Great Britain requires external retesting for updates affecting fairness, and its annual audit samples updates rather than covering every game.

Is RTP the chance that I will win?

No. It is an average theoretical figure computed over the long run under an assumed strategy. It describes a model of the game, not the outcomes of your session.

Primary sources

Each link below goes to the issuing authority’s own website. Where a page could not be retrieved by our automated checks, that is stated rather than hidden.