Testing Labs Explained: What a GLI, BMM, eCOGRA or iTech Certificate Actually Certifies
Each of those small gray footer logos points at a document about one piece of software, tested on one date against one written standard, and a certificate covering a slot engine tells you nothing about the blackjack table beside it.
The short answer
- What a lab does: tests a named software build against a named written standard on a named date.
- What a lab cannot do: freeze accounts, order a payout, levy a fine or revoke anything. Only a regulator does that.
- The names you will see: GLI and BMM Testlabs across the American regulated market, with eCOGRA serving Pennsylvania, Michigan and Connecticut.
- The trap: iTech Labs has been a wholly owned GLI subsidiary since May 19, 2023, so a row of distinct logos can mean fewer distinct owners than it looks.
- Check in this order: the state regulator’s own register of approved operators first, the technical certificate second.
Four Things a Seal Does Not Say
Operators treat lab logos as generic proof of honesty, and most players read them the same way. They are not generic at all.
Scroll to the bottom of almost any casino site and you find a row of small gray logos: a lab name, an accreditation mark, maybe a shield. Each refers to a document about a specific piece of software, tested on a specific date against a specific written standard. Below is what each of the four familiar names does and where its report stops. If you are weighing legal online blackjack in a regulated state against an offshore alternative, what those seals mean is one of the sharper distinctions. All of it sits downstream of how online blackjack sites get licensed: a test lab supplies the licensing process, it does not replace it.
It is a photograph
One build, one version, one date
A certificate covers one software build, identified by version, on one date. It does not by itself establish that the operator pushed that exact build to production, and it does not prove the same build is running today.
A lab is not a regulator
No power to act on your account
No lab can freeze an operator’s accounts, order a payout, levy a fine or revoke anything. Only a regulator does that, which is why a state register beats a footer image every time.
ISO is not a gambling standard
Competence, not card dealing
ISO/IEC 17025 governs how a lab documents methods, calibrates equipment and manages impartiality. “ISO certified” on a casino footer means almost nothing alone: the questions are which standard, from which accreditation body, for which scope.
Four logos, fewer owners
iTech Labs is owned by GLI
GLI acquired all outstanding shares in iTech Global Pty Ltd on May 19, 2023, making it a wholly owned subsidiary of GLI Australia while iTech kept its branding. A row of distinct marks can represent fewer distinct companies than it appears to.
What an Independent Test Lab Is, and Why Regulators Insist on One
A state gaming regulator has a verification problem, and delegating the technical examination is how most of them solve it.
A regulator approves games and licenses operators, but it cannot keep a permanent staff of mathematicians, cryptographers and software engineers able to read every build submitted to it. Most states therefore delegate the technical examination to private laboratories they register, supervise and can discipline.
Pennsylvania wrote that delegation down more clearly than most. 58 Pa. Code Chapter 469a, “Private Testing and Certification Facilities,” runs to five sections covering registration, standards, responsibilities and renewal. Section 469a.3 separates a laboratory from a logo. To register with the Pennsylvania Gaming Control Board, a facility must be “accredited in accordance with ISO/IEC 17025 by an accreditation body that is a signatory to the International Laboratory Accreditation Cooperation Mutual Recognition Agreement,” must demonstrate technical competence in a manner verified by the board’s Bureau of Gaming Laboratory Operations, and must be independent of any manufacturer of slot machines, table games, interactive games or sports wagering devices.
ISO/IEC 17025 is not a gambling standard at all
It is the international standard for the competence of testing laboratories. It governs how a lab documents methods, calibrates equipment, estimates uncertainty, manages impartiality and produces reports a third party could reproduce. A national accreditation body grants it after on-site assessment and renews it on a cycle, and Pennsylvania’s mutual recognition clause counts a foreign accreditation only if the issuing body signed the arrangement making such accreditations comparable.
Section 469a.4 adds duties that outlast the test, and sanctions for breaching them run up to revocation.
Report the audit within 15 days
A registered facility must tell the board within 15 days that its ISO/IEC audit results are available.
Retain the testing file
Testing documentation has to be kept for as long as the tested item stays approved, so the paperwork behind a live game can still be produced.
Run peer review
The lab must peer review its own work rather than let a single examiner’s conclusion stand unchecked.
Keep former staff at arm’s length
Employees who worked for a licensed manufacturer in the prior year must be kept away from equipment they once handled.
Not every state outsources, and the three models below are the ones an American player will actually meet. Anyone playing in New Jersey relies on a state lab as well as, or instead of, a private one.
| Jurisdiction | Who runs the technical test | What that looks like in practice |
|---|---|---|
| Pennsylvania | Private facilities registered under 58 Pa. Code Chapter 469a | Five sections covering registration, standards, responsibilities and renewal, with ISO/IEC 17025 accreditation and independence from manufacturers as entry conditions |
| New Jersey | The Division of Gaming Enforcement’s own Technical Services Bureau | Tests skill-based games, electronic table games, internet gaming systems and both online and land-based slots in house; submissions must describe the RNG used to determine game outcome and show those outcomes cannot be predicted |
| Nevada | Private labs opened up by Assembly Bill 279 in the 2011 session and registered under Regulation 14 | The Gaming Control Board publishes a roster of registered independent testing laboratories naming each entity, its address and the exact scope it may certify; one listed lab covers bingo and keno systems only |
Who actually holds the power here
A lab writes a report. A regulator issues, suspends and revokes. Start with the bodies that can act on your account.
The Labs You Will Actually See on an American Site
Four marks turn up on most footers. They do not do the same job, and one of them is not a lab at all in the way players assume.
Gaming Laboratories International
GLI is the default in the American regulated market, and its published standards library is why. Instead of testing against a vague notion of fairness, GLI writes numbered technical documents that regulators adopt by reference. Two matter most to a blackjack player.
| Standard | What it covers |
|---|---|
| GLI-19, Interactive Gaming Systems, version 3.0 | The online standard, aimed at the system rather than a single game: account handling, wagering rules, session and transaction logging, error states, client-to-server communications, and controls over what a remote player can affect. When a regulator says a licensee’s platform was certified for internet gaming, GLI-19 or a jurisdictional variant is usually what was applied. |
| GLI-11, Gaming Devices, version 3.0 | The land-based device standard and the ancestor of most online game testing. Its RNG and pay table sections are why online engines get examined the way they do, and many jurisdictions reach virtual games with GLI-11 requirements through GLI-19. |
| GLI-21 | Client-server systems. |
| GLI-24 and GLI-25 | Electronic table games and dealer-controlled table games. |
| GLI-26 | Wireless gaming. |
| GLI-29 | Card shufflers and dealer shoes. |
| GLI-33 | Event wagering. |
| GSF-1 through GSF-5 | The Gaming Security Framework series, covering information security audits. These audit an organization; they do not test a game, and conflating the two is among the most common misreadings of a certificate. |
On recognition, GLI was the first independent test lab authorized by the Michigan Gaming Control Board to test and certify iGaming and mobile sports betting, announced Sept. 8, 2020. Nevada’s roster lists it under several corporate entities: Gaming Laboratories International, LLC in Las Vegas, GLI Test Labs Canada, GLI Europe B.V. in Haarlem, GLI Africa in Johannesburg. Normal structure for a global lab, and a quiet trap, since a certificate from a European GLI entity is not automatically inside the scope Nevada or Michigan registered.
BMM Testlabs
BMM calls itself the longest-established private independent gaming test laboratory in the world, with more than 40 years behind it, and is headquartered at 815 Pilot Road in Las Vegas. It holds ISO/IEC 17025 accreditation and covers product certification, mathematics and RNG testing, iGaming and sports betting, lottery and iLottery, and managed security work including PCI DSS evaluations.
Nevada registered BMM alongside GLI in June 2012; the current roster shows BMM International, LLC in Las Vegas plus narrower-scope entities in Slovenia and India. Michigan has authorized it as well. For a player, BMM and GLI are interchangeable in credibility; the difference is which supplier hired which lab, not one being stricter.
eCOGRA
eCOGRA is the odd one here, and the confusion around it is worth clearing up. It is a United Kingdom-based testing laboratory holding multiple ISO/IEC 17025:2017 accreditations across Great Britain, Greece, Denmark, Sweden and Switzerland, and its testing menu runs to game front ends, game engines, platforms, RTP and RNG work, geolocation and live dealer studios. So it is a lab. It is simultaneously a certification body issuing its own seal and a dispute service, and those three roles blur together in players’ minds. eCOGRA says it is the first non-American test lab authorized to offer testing, inspection and certification services in the United States, naming Pennsylvania, Michigan and Connecticut as the states it serves.
The dispute side is what players are most likely to need and most likely to misunderstand. eCOGRA is an approved alternative dispute resolution provider under the Great Britain Gambling Commission and the Malta Competition and Consumer Affairs Authority, operating under Britain’s Alternative Dispute Resolution for Consumer Disputes Regulations 2015.
Exhaust the operator’s own complaints process
A player must go through the internal process before eCOGRA will look at anything.
Give the operator up to eight weeks
The operator gets that window to resolve the matter on its own.
File inside one year, on the right kind of complaint
eCOGRA will not touch a dispute more than a year after that process ends. It takes transactional and contractual complaints, meaning game results, bet outcomes, account handling, bonus application and misleading terms, and declines to arbitrate customer service quality or a responsible gambling policy.
That authority is British and Maltese, not American
It comes from British and Maltese regulators, not from any state gaming board. If your dispute is with a licensed operator in a regulated state, your route runs through that state’s regulator. Read how disputes actually get resolved before assuming a footer seal gives you somewhere to appeal.
iTech Labs
iTech Labs began in Australia around 2004 and built its name testing RNGs and games for European and Australian-facing operators. Its current site describes a boutique iGaming test lab focused on Europe, the Middle East, India and Africa, offering RNG and game certification, server log RTP audits, platform certification and hotfix validation, from an office in Sofia, Bulgaria. iTech certificates remain common on games built for markets outside the United States and are rare on platforms serving regulated American states.
What the iTech seal will not tell you: it is no longer independent of GLI
On May 19, 2023, GLI announced it had acquired all outstanding shares in iTech Global Pty Ltd, making it a wholly owned subsidiary of GLI Australia, with iTech keeping its branding. An ordinary transaction, but it should reset your mental model: a row of distinct logos can represent fewer distinct owners than it appears to.
Others American Regulators Recognize
The field is wider than four names. Gaming Associates, an Australian firm, is registered as an independent testing laboratory in Michigan, and Nevada’s roster includes the Slovenian Institute of Quality and Metrology and Eclipse Compliance Testing of Solon, Ohio. A lab name you do not recognize is not a reason to assume fraud, but it is a reason to check the state regulator’s own register, exactly as you would verify an operator’s license.
Go deeper on what the labs are testing
The RNG work, the return figures and the complaint route each have a page of their own.
What the Test Actually Examines
A competent evaluation of an online blackjack product is several separate examinations bundled into one report.
The random number generator
Labs review RNG source code, then test raw output and scaled output, the second being what happens once raw numbers map onto a 52-card deck. Statistical work draws on recognized public suites rather than house methods, most often the tests in NIST Special Publication 800-22 Revision 1a, A Statistical Test Suite for Random and Pseudorandom Number Generators, published April 2010, alongside older batteries such as Diehard and checks including chi-square goodness of fit, runs tests and serial correlation. Randomness alone is not sufficient: the lab also asks how the generator is seeded and whether someone who watched a long run could compute the next value. Our page on how RNGs work in blackjack covers the mechanics, and RNG certification goes deeper on the process.
Game rules as implemented
Blackjack differs from slots here, because its rules move the math and can be silently wrong. A tester works through whether the dealer hits or stands on soft 17, deck count, when reshuffling happens, whether doubling after splitting is allowed, how many splits, what happens on split aces, whether surrender exists and in which form, how insurance is priced and settled, and how a natural pays. The gap between a 3-2 game and a 6-5 game is enormous. Shoe composition and reshuffle points feed penetration, so they get examined rather than assumed.
Pay tables against what is advertised
The lab compares the table coded into the game against the one shown in the help screen. Side bets cause most of the trouble, carrying pay tables the player never opens.
Return to player against the published figure
Theoretical return is computed from the game’s own math model and compared with the supplier’s claim. New Jersey’s documentation requirements suggest the granularity: mathematical return calculations, percentage sheets, symbol weights and denominations. For blackjack the figure depends on assumed player strategy, so a stated return means something only next to the strategy assumption behind it. See house edge and RTP for what those numbers do and do not promise.
Behavior under failure and disconnection
A hand interrupted by a dropped connection, a crashed browser or a server fault has to resolve deterministically. Testers force those conditions and check that game state survives, the hand resumes or settles correctly, wagers are neither duplicated nor lost, and the transaction log reconstructs events. Unglamorous, and the part most likely to matter to you personally.
The link between generator and client
Outcomes must be determined server-side, the client must be unable to influence or read them early, and the channel between them must resist interception and replay. A game can have an impeccable RNG and still be broken if the result reaches the browser in a form the browser can act on.
What Testing Does Not Tell You
This is the part no operator prints beside the seal, and it is the difference between a fair game and a business that will pay you.
What a lab report does establish
- That one named software build, identified by version, was examined against a named standard on a named date.
- That the generator’s raw and scaled output stood up to recognized public statistical suites, and that its seeding resists prediction.
- That the rules as coded match the rules as described, down to soft 17, split aces, surrender and how a natural pays.
- That the coded pay table matched the one in the help screen, side bets included.
- That theoretical return matched the supplier’s claim under a stated strategy assumption.
- That the hand resolved correctly through forced disconnections, crashes and server faults.
What it never establishes
- That the operator pushed that exact build to production. Regulators run separate field verification and software signature checks for that reason.
- That the certificate still describes what you are playing. It does not become false when the software changes; it simply stops describing the game, and a fresh submission is supposed to follow.
- That the operator is solvent, that player balances sit apart from operating funds, or that a withdrawal will be honored next month. Those are licensing and banking questions, covered under segregated player funds, and they determine whether you get paid.
- Anything about your session. Return to player is a long-run property of a mathematical model, measured across a volume of hands no individual will ever play.
A lab certificate is not a license
No lab can freeze an operator’s accounts, order a payout, levy a fine or revoke anything. Only a regulator does that. And a correctly certified blackjack game will still take your money for hours at a stretch, which is not evidence of tampering. If you landed here suspecting a game is crooked, our page on whether online blackjack is rigged works through what the evidence supports.
How to Read a Certificate
A real certificate is a boring document with six identifiable elements. If you cannot find all six, treat what you are looking at as decoration.
| Element | What to look for | Why it matters |
|---|---|---|
| Issuing laboratory | Full legal entity, not just a brand | Global labs run several entities with different registered scopes |
| Certificate holder | The supplier or operator named on it | A studio’s certificate does not cover the casino licensing the game |
| Product and version | Named software with a version or build reference | Without a version, nothing can be matched to what is running |
| Jurisdiction | The regulator whose rules were applied | A certificate written for one market may not satisfy another |
| Standard applied | GLI-19 v3.0, say, or a named state technical standard | Tells you the scope: system, device, security audit or narrower |
| Date of issue | An actual date | Fixes the certificate in time and lets you judge staleness |
Two failure modes worth naming
An undated seal, or one carrying no version or product reference, is close to meaningless, because nothing ties it to a game you can play. And a seal that is a flat image rather than a live link to the laboratory’s own verification page proves nothing, since an image is a file anyone can copy. The test is simple: click it. If it does not land on a page hosted by the lab that names the operator or the software, you have learned nothing. Related patterns appear under red flags.
Check the operator before you check the seal
A state register answers the question a footer image cannot: is this site approved to take your money at all.
Game, Platform, System: Three Different Certificates
Most of the confusion here comes from treating one word, certified, as though it had a single meaning.
A game certificate
Covers a single title from a single studio: rules, pay table, math model and RNG use. It travels with the game to every operator that licenses it, which is why one blackjack title turns up at dozens of sites carrying the same underlying document.
A platform certificate
Covers the remote game server or aggregation layer that delivers games, handles bets and returns results. It is plumbing rather than any individual title, and a game can be certified while the platform serving it is not, or the reverse.
A whole-system certificate
What a standard like GLI-19 aims at: account management, wagering, geolocation enforcement, session controls, logging, regulatory reporting and the interactions among them. That is the level at which a state approves an operator to launch.
Beside all three sit the organizational audits described above, the GSF series, which say nothing about whether a blackjack game deals fairly.
Live Dealer Testing Is a Different Exercise
When outcomes come off a physical shoe in a studio, the RNG stops being the object of examination and physical and procedural controls replace it.
Shuffling equipment
Examined in its own right. GLI publishes GLI-29 for card shufflers and dealer shoes, with GLI-24 and GLI-25 covering electronic table game systems and dealer-controlled electronic table games.
Card recognition
Optical systems read each card as it leaves the shoe. Testing asks how the system behaves on a misread, an obscured card or one landing outside the reading zone, and whether a recorded result can diverge from the physical card without triggering a void.
Dealer protocols
Governing card handling, when a hand is voided, how a misdeal is declared, and how discretion is removed from settlement.
Studio controls
Surveillance coverage, floor access, chain of custody for decks, retirement of used cards, and the integrity of the feeds carrying results to your screen.
Payment and settlement still ride on the same certified platform as virtual games, so a live table sits on two certification stacks at once. More under live dealer fairness, with the practical side on our live dealer blackjack page.
The fairness questions behind a live table
Shuffle depth, payout rules and studio integrity all sit outside the RNG report.
Offshore Sites, Real Certificates and Borrowed Seals
It would be tidy if offshore seals were all fake and regulated ones all genuine. The real picture is messier and more useful.
Plenty of offshore certificates are genuine
Many offshore sites run games from suppliers holding authentic certificates, because those suppliers sell into regulated European markets and had to be tested to get there. The certificate is real. What it covers is the supplier’s game, examined for a market that is not yours, and it says nothing about the operator running it: not whether player funds are held separately, not whether the bonus terms are enforceable, not whether a clause will void your withdrawal, and not who reads your complaint. That gap between a fair game and a trustworthy business is the subject of offshore versus licensed play.
At the other end are marks the site has no entitlement to
Expired certificates, seals belonging to a former supplier, accreditation logos lifted from another company’s page, or images with no underlying document at all. Copying a graphic costs nothing, so the click test is the entire defense. So is knowing what the site’s licensing claim is worth, the subject of offshore licenses: a permit from a jurisdiction with a thin enforcement staff and no stake in your outcome does not create a body that will act on your complaint.
Access is patchier than offshore marketing suggests, too. Bovada now blocks 19 states plus the District of Columbia, having switched off Connecticut and the District in July 2024 after a June 14, 2024 cease-and-desist in Connecticut. Whatever a seal claims, an operator that will not accept you is not an option.
What a seal cannot cover
Solvency, fund segregation and enforceable terms are licensing questions, not laboratory ones.
Checking a Claim Yourself
The order of operations is the reverse of how most people do it.
Start with the regulator, not the seal
A state gaming authority publishes the operators it has approved, and a site either appears there or it does not. That is a public list you can settle in a minute, and no footer image substitutes for it.
Only then examine the technical certification
Use the six questions in the table above: issuing entity, holder, product and version, jurisdiction, standard applied, date of issue. Then click the seal and see whether it lands on a page hosted by the lab that names the operator or the software.
Keep it in proportion
All of it concerns software integrity, one component of a decision rather than the whole. Whether any of this is safe for American players is the broader subject of our safety section.
Does a GLI seal mean the blackjack game I am playing right now was tested?
No. A certificate covers one software build, identified by version, on one date. It does not by itself establish that the operator pushed that exact build to production, which is why regulators run separate field verification and software signature checks. It does not become false when the software changes; it simply stops describing what you are playing, and a fresh submission is supposed to follow.
Is eCOGRA a regulator I can complain to?
It is a testing laboratory, a certification body and an approved alternative dispute resolution provider, but its dispute authority comes from the Great Britain Gambling Commission and the Malta Competition and Consumer Affairs Authority, not from any state gaming board. If your dispute is with a licensed operator in a regulated state, your route runs through that state’s regulator.
Are GLI, BMM, eCOGRA and iTech four independent companies?
Not any more. GLI acquired all outstanding shares in iTech Global Pty Ltd on May 19, 2023, making iTech a wholly owned subsidiary of GLI Australia while it kept its own branding. GLI itself operates under several corporate entities with different registered scopes, so a certificate from a European GLI entity is not automatically inside the scope Nevada or Michigan registered.
Can a testing lab make a casino pay me?
No lab can freeze an operator’s accounts, order a payout, levy a fine or revoke anything. Only a regulator does that. Nothing in an RNG report speaks to whether the operator is solvent, whether player balances sit apart from operating funds, or whether a withdrawal will be honored next month.
Does “ISO certified” on a casino footer mean the games are fair?
ISO/IEC 17025 is the international standard for the competence of testing laboratories, and it is not a gambling standard at all. It governs how a lab documents methods, calibrates equipment, estimates uncertainty, manages impartiality and produces reports a third party could reproduce. The questions are which standard, from which accreditation body, for which scope.
A certified game you cannot stop playing is still a problem
If your play has stopped feeling like a choice, our responsible gambling resources are a place to start. Confidential help is available at any hour on 1-800-697-3738, keyed as 1-800-MY-RESET, the national line since Jan. 29, 2026.
Where to go next
Licensing, fairness, your rights and the support lines, all in one place.
Checked against the laboratories’ own material and state regulator registers on Aug. 25, 2026. Version numbers and registration scopes shift; where this page cites a document, the linked source is the authority.
