RNG Certification: What an Audit Tests, and What It Does Not
A laboratory seal is the most widely displayed and least understood object in this industry, and it almost never says what was tested, when, or on which piece of software.
The short answer
- What a real certificate names: a specific artifact and a specific version or build, issued on a date, against a named standard, for a named jurisdiction.
- What it might cover: the generator, the game with its rules and pay table, the platform, or the operator’s own security controls. Four different objects.
- What it never covers: whether the tested build is running tonight, whether the operator can pay you, what the bonus terms do, how your session goes, or whether the table is a good bet.
- How to verify it: you mostly cannot. Check the regulator’s licensee and supplier lists instead, then read the rules screen.
Certification Is Not One Thing
The word “certified” gets applied to at least four different objects, and confusing them is the root of most bad reasoning about seals.
A laboratory seal sits in the footer of nearly every site offering online blackjack, players read it as a general guarantee of honesty, and it almost never comes with anything saying what was tested, when, or on which piece of software. Certification is a real, demanding, legally mandated exercise that catches real problems. It is also narrow, dated the moment it is issued, and silent on most of what a player wants to know. This page walks the process end to end, then gives the second half to the limits, because that is where readers get misled. For profiles of the laboratories themselves, see independent testing labs.
The generator
At the narrowest level a laboratory evaluates the algorithm: how it is seeded, how raw output is scaled onto a 52-card deck, and whether someone watching a long run could compute the next value. Pennsylvania requires the generator to be “cryptographically strong at the time of submission for approval,” and says each instance must be separately evaluated and certified, so approval inside one product does not travel to another using the same code. The mechanics are covered in how RNGs work in blackjack.
The game, with its rules and pay table
A game certificate covers one title: dealing logic, deck count, the soft 17 rule, doubling and splitting permissions, surrender, insurance pricing, side bet pay tables and reshuffle points. Blackjack differs sharply from slots here, because its rules move the math directly and can be wrong in ways that look entirely normal on screen. A generator can be flawless while the game built around it pays naturals at 6-5.
The platform or gaming system
Above individual games sits the remote gaming server, the wallet, the account layer, session handling, geolocation enforcement and logging. That is the object a state approves before an operator launches, and a certified title can be delivered by an uncertified integration layer.
The operator’s controls
Laboratories also run organizational and security audits: information security controls, penetration testing, change management, disaster recovery. Those examine a company’s practices, not a card game, and they are frequently what sits behind a badge a player reads as a fairness claim.
Undated, unversioned seals are decoration
A genuine certificate names a specific artifact and a specific version or build, issued on a date, against a named standard, for a named jurisdiction. A homepage badge carries none of that. It may point at any of the four objects above, at a document issued to a supplier rather than the casino displaying it, or at a build superseded three years ago.
Start with the object being certified
Before a seal means anything, work out which of the four things above it is describing.
The Process, From Source Code to a Live Table
Read the sequence as a chain in which each step closes a gap left by the last.
Submission
A supplier submits source code and compiled binaries with documentation: the mathematical model, rules of play, help screen text, pay tables and configuration options. None of this is a black box test. The laboratory reads the code that determines outcomes.
Review against a named standard
The submission is measured against a published technical standard, either a laboratory standard such as GLI-19 or a state’s own technical rules, and usually both, since state requirements layer on top.
Statistical testing of generator output
Raw and scaled output go through recognized public test batteries rather than in-house methods. Pennsylvania’s rule is unusually specific about what those batteries are and what the generator has to survive, set out in full below.
Verification that the game matches its submission
A tester works the implemented game against the submitted rules document, checking that coded behavior matches what the paperwork and help screens claim. Discrepancies concentrate in side bets, whose pay tables are the ones nobody opens.
Calculation of theoretical return
Expected return is computed from the game’s own math model and compared against the supplier’s claim. For blackjack the number means nothing without its assumption, since return depends on assumed player strategy: a game returning 99.5 percent to perfect basic strategy returns considerably less to the way most people play. See house edge and RTP.
Failure and disconnection handling
Testers force dropped connections, crashed clients and server faults to confirm a hand in progress resolves deterministically, that wagers are neither lost nor duplicated, and that the transaction log reconstructs events.
Issuance tied to a build
The report identifies the exact software version tested. That specificity is the whole value of the document, and also the reason it expires in practice.
What the generator has to survive, in the rule’s own words
Pennsylvania does not leave “recognized statistical tests” undefined. It names candidates outright and attaches a confidence level, then adds separate duties for scaling and for idle time.
| Requirement | What the Pennsylvania rule demands |
|---|---|
| Independence | Outcomes must “be statistically independent.” |
| Distribution | Outcomes must “be fairly distributed (within statistically expected bounds) over their range.” |
| Recognized test batteries | Output must “pass various recognized statistical tests.” The rule names candidates outright: chi-square, equi-distribution, gap, poker, coupon collector, permutation, Kolmogorov-Smirnov, runs and serial correlation. |
| Confidence level | Those tests are applied at a 95 percent confidence level. |
| Scaling onto the deck | Scaling “may not compromise the cryptographic strength,” and any compliant scaling method must have “bias equal to zero.” |
| Background cycling | The software must keep cycling in the background between games, so idle time does not make the next value guessable. |
| Where outcomes are decided | All critical functions “including the generation of the result of any game (and the return to the player) must be generated by the interactive gaming platform and be independent of the player device,” and outcome “may not be affected by the effective bandwidth, link utilization, bit error rate or other characteristic of the communications channel.” |
Then Comes the State Layer
A laboratory report is an input, not a permission. A regulator reviews it and approves the certified build for its own market. New Jersey’s rule for server-based table games is the cleanest illustration for a blackjack audience. Under N.J.A.C. 13:69O-1.5 such a game must:
- “function in accordance with approved rules for its corresponding authorized non-electronic table game”
- “function as approved by the Division pursuant to the software submission process”
- “accurately represent the layout and equipment used to play” that live game
- conspicuously indicate minimum and maximum wagers
- carry help screens covering approved variations such as deck count, special odds and supplemental wagers
An online blackjack game in New Jersey may not be a loosely blackjack-flavored product; it has to behave like the approved live game.
The principle behind that sits in the equipment rule, N.J.A.C. 13:69E-1.20, which conditions approval on equipment being “identical in all mechanical, electrical, electronic or other aspects to a prototype thereof that has been reviewed and approved for use by the Division.” Prototype approval is the mechanism; the certificate feeds it rather than replacing it. State permissions generally are covered under licensing for online blackjack sites.
The Standards, Named Properly
Three names do most of the work and are routinely misused.
GLI-19, Interactive Gaming Systems, currently version 3.0
The systems-level standard covering the online gaming platform as a whole. It is the one that matters for an internet casino.
GLI-11, Gaming Devices, currently version 3.0
The device standard, historically written for slot machines and their descendants. Game clients and math models inherit requirements from it, but a site citing GLI-11 alone has not told you its platform was assessed.
NIST Special Publication 800-22, Revision 1a, published April 2010
The recognized public statistical reference for random and pseudorandom generators, which laboratories draw on. Two caveats belong with any citation to it.
The industry’s most-cited randomness reference is 16 years old and flagged for revision
NIST SP 800-22 is a general-purpose cryptographic suite rather than a gambling standard, so passing it says output looks random, not that the game built on it deals fairly. And NIST posted a planning note in April 2022 saying it had decided to revise the publication under its Crypto Publication Review Project.
Why the Laboratory Itself Has to Be Accredited
Certification is not a private arrangement between an operator and a friendly vendor. In regulated states it is a legal duty, and the laboratory is regulated too.
| Pennsylvania rule | What it requires of the laboratory |
|---|---|
| 58 Pa. Code 469a.3, accreditation | A private testing and certification facility must “be accredited in accordance with ISO/IEC 17025 by an accreditation body that is a signatory to the International Laboratory Accreditation Cooperation Mutual Recognition Agreement.” |
| 58 Pa. Code 469a.3, independence | The facility must be “independent from any manufacturer” of the equipment it tests, and from any board-licensed gaming related gaming service provider. |
| Section 469a.4, improper influence | The facility must notify the board immediately of attempts at improper influence. |
| Section 469a.4, audit results | After an ISO/IEC audit is completed the facility must “notify the Board in writing of the availability of the results within 15 days.” |
| Section 469a.4, cooling-off period | An employee who worked for a licensed manufacturer or gaming related service provider within one year before joining the laboratory “may not be permitted to inspect or certify” that equipment. |
| Section 469a.5 | Sets the registration term and renewal. |
Read together, the shape is clear. The state does not simply trust the seal. It registers the laboratory, requires accreditation with international mutual recognition behind it, polices conflicts of interest with a cooling-off period, and demands sight of the laboratory’s own audit results on a deadline. Some states go further and run their own facility, which is what New Jersey’s Division of Gaming Enforcement does.
Who signs off, and where you can check them
The laboratory, the regulator and the licence are three separate layers, and only the last two are public.
What an Audit Genuinely Does Not Tell You
This is the half that never appears next to the badge, and it is the half that changes decisions.
It does not prove the tested build is what is running tonight
A certificate describes one version of one piece of software on one date. It is a photograph. It does not become false when the software changes, it simply stops describing the thing you are playing. Nothing in the document itself confirms that the operator deployed exactly the certified build, or that a subsequent patch went back through review. That gap is why regulated states run separate software authentication and field verification, and why change control matters more than the original certificate. In an unregulated market, nobody closes it at all.
It Says Nothing About Whether the Operator Can Pay You
A game test is not a financial audit. An RNG report speaks to card distribution, not to whether player balances sit in a segregated account, whether a daily reserve covers cashable balances plus pending withdrawals, or whether the company is solvent next quarter. Those are licensing and banking obligations, enforced through recurring attestations signed by a named officer in states such as Pennsylvania, West Virginia, New Jersey and Connecticut. The most common real-world complaint against a casino is a withdrawal that will not arrive, and a fairness certificate has no bearing on it whatsoever. See what to do about withdrawal delays for the path that does.
It Does Not Evaluate the Terms and Conditions
No laboratory reads the bonus terms. A game can be certified to the last decimal place while the promotion attached to it carries a maximum-bet clause that voids winnings, excludes blackjack from wagering contribution, caps a withdrawal at a multiple of the deposit, or reserves a right to close accounts at the operator’s discretion. Certification and contract are separate universes, and confiscated winnings almost always trace to the contract. Read bonus terms explained before assuming the seal covers you.
It Does Not Measure Your Session
Certification confirms a property of a model over an enormous number of trials. It makes no claim about any individual stretch of play, and a correctly certified blackjack game will take your money for hours without any of that being evidence of tampering. The reverse is also true: winning $2,000 on a Saturday does not certify anything either. The numbers in the next section show how far apart those two scales are.
It does not mean the game is a good bet
This is the most important one and the one almost nobody says out loud. Fair and favorable are unrelated. A blackjack variant that pays 6-5 on a natural, hits soft 17, forbids doubling after a split and offers no surrender can be certified without a single deficiency, because certification asks whether the game does what it says, not whether what it says is any good for you. Roughly speaking, moving a game from 3-2 to 6-5 costs the player about 1.4 percentage points of expectation, which is several times the entire house edge of a decent 3-2 game. A certified 6-5 table is exactly as fair, and roughly four times as expensive, as a certified 3-2 table. Our page on 3-2 versus 6-5 payouts works through what that costs at real stakes. If you take one thing from this page, take that: the seal is a floor, not a recommendation.
The problems a seal was never going to solve
Every one of these is handled somewhere other than the laboratory report.
Certified Return Versus What You Actually See
Certification confirms a long-run mathematical property. Your results are a small sample from a high-variance distribution.
In blackjack the variance is large relative to the edge. Flat-betting basic strategy, standard deviation runs around 1.15 betting units per hand against a house edge that in a good game is roughly half a percentage point, and that noise shrinks only with the square root of the number of hands.
The table below takes a game with a true 0.5 percent house edge and shows how wide the ordinary range of results stays, expressed as a percentage of total money wagered. Hours assume 60 hands an hour.
| Hands played | One standard error | Ordinary range for observed result | Hours at 60 hands an hour |
|---|---|---|---|
| 500 | 5.1 percentage points | minus 10.8 to plus 9.8 percent | about 8 |
| 5,000 | 1.6 percentage points | minus 3.8 to plus 2.8 percent | about 83 |
| 50,000 | 0.51 percentage points | minus 1.5 to plus 0.5 percent | about 833 |
| 500,000 | 0.16 percentage points | minus 0.8 to minus 0.2 percent | about 8,300 |
| 5,000,000 | 0.05 percentage points | minus 0.6 to minus 0.4 percent | about 83,000 |
Two conclusions fall out. At 50,000 hands, more than most people play in several years, an ordinary result still includes coming out ahead. The point where merely being a loser becomes statistically unmistakable arrives near half a million hands, roughly four years of 40-hour weeks. Pinning the observed edge down tightly enough to distinguish 0.5 percent from 0.4 percent takes millions of hands that no human will supply.
The implication cuts both ways. A losing streak is not evidence of a rigged shoe, and a laboratory report offers no comfort during one either. For numbers large enough to mean something, look at regulator-published revenue and hold data rather than your own history, covered under payout reports and what they show.
The Verification Gap
The credential players are shown most often is the one they can verify least, and the asymmetry should be uncomfortable.
Stated plainly, because checking confirmed it: none of the major testing laboratories operates a public, consumer-facing page where you can enter a certificate number and confirm it is genuine, current and issued to the operator displaying it. Certificates go to clients and the reports behind them are commercially confidential. That is unlike a state license, which you can look up on a regulator’s own site in under a minute. What you can do instead:
Check the regulator’s list
Every regulated state publishes its licensees and its approved manufacturers and suppliers, and Pennsylvania maintains eligibility and licensing lists plus a verification search. If the operator is on the state’s list and the game comes from a supplier on the state’s list, you have a verifiable fact instead of an image. The walkthrough is at how to verify a gambling license.
Check the game provider
A named studio with regulated-market relationships has far more to lose from a rigged title than any single casino does, and a blackjack game from a supplier licensed in Pennsylvania or Michigan carries those licenses with it.
Read the rules screen
Thirty seconds, and the only check that says anything about the specific table in front of you: deck count, soft 17, natural payout, doubling and splitting, surrender, side bet pay tables. Certification cannot make a bad rule set good, but the rules screen tells you which one you face.
What Happens After the Certificate
The meaningful protection in a regulated market is not the original document. It is the change-control regime around it.
Pennsylvania’s Chapter 810a, “Interactive Gaming Testing and Controls,” is a compact example.
| Section | What it provides |
|---|---|
| Section 810a.7 | Any “change or modification to an interactive game shall be handled in accordance with the Change Management guidelines issued and distributed to interactive gaming certificate holders, interactive gaming operators and interactive gaming manufacturers.” |
| Section 810a.6 | Production environments must be logically and physically separated from development and test environments, development staff are barred from promoting code into production, and there must be “a documented method to verify that test software is not deployed to the production environment.” |
| Section 810a.12 | Governs test accounts down to how funds are issued, audited and withdrawn. |
Unglamorous provisions, and the actual answer to whether the certified build is what is running. A modified game goes back through submission, a regulator can field-verify deployed software against what it approved, and periodic audits and annual security assessments continue after launch. None of that appears on a badge, which is exactly why a badge is a poor proxy for it.
One boundary worth carrying: none of this transfers cleanly to a game dealt by a person, where the trust problem moves to cards, cameras, optical recognition and studio procedure, handled on live dealer fairness.
What sits around the certificate
Change control, field verification and the signs that none of it is happening.
Offshore Certification: Real Tests, Unverifiable Deployment
The lazy version of this argument says offshore games are untested. That is not accurate, and overstating it costs credibility.
Plenty of offshore casinos run titles from studios that submitted them to genuine laboratories, and those tests really happened. The problem is not a missing rule.
The duty that exists on paper
- The Curacao licensing regime took effect Dec. 24, 2024.
- The gaming authority’s standing license conditions require certification of every game by an authority-approved laboratory under Article 10.
- Segregated player accounts are required under Article 9.
- A complaints and dispute procedure is required under Article 11.
What nobody inspects
- No published compliance reporting.
- No consumer-facing verification.
- No regulator comparing deployed builds against approved ones.
- No demonstrated mechanism to compel a payout.
- A game could have been tested honestly in 2021 and modified since, and nothing external would register the difference.
- Seals are also displayed by sites that were never entitled to them, since an image file copies in a second and the entities named on it publish nothing to check it against.
The framing that runs through this whole site applies here: separate a duty that is written down from a duty somebody actually inspects. A Pennsylvania reserve calculation with an officer’s attestation and a New Jersey prototype approval are checked by somebody with subpoena power. An offshore Article 10 duty is a sentence in a document. More at offshore licensing jurisdictions and offshore versus licensed sites.
The Practical Summary
A certificate answers one question well and several others not at all.
What a certificate does tell you
That at a moment in the past an accredited, conflict-screened laboratory read the code, ran recognized statistical tests on the generator, confirmed the implemented rules matched the submission, computed theoretical return and forced the failure conditions. In a regulated state it also tells you that a regulator then approved a prototype and wrapped a change-control regime around it.
It tells you nothing about:
- whether the build in front of you is the one tested;
- whether the company can pay a withdrawal;
- what the bonus terms will do to your balance;
- how your session will go;
- or whether the table you picked is a reasonable bet.
Those five gaps are not defects in the process; they are outside its scope, and a reader who knows the scope stops reading a footer image as a general assurance. The wider question is taken up on whether online blackjack is rigged, and the shuffle-specific version at shuffling and deck penetration.
Keep reading in fair play
The rest of this section takes the fairness question apart one piece at a time.
Official sources used here: Pennsylvania Code Chapter 469a and Chapter 810a; New Jersey rules 13:69O-1.5 and 13:69E-1.20; the New Jersey Division of Gaming Enforcement; the Pennsylvania Gaming Control Board licensing lists; NIST SP 800-22 Rev. 1a; the GLI standards index; and the International Laboratory Accreditation Cooperation.
Reviewed and updated Aug. 25, 2026. Rule text was read against current published sources on that date; standards and state change-management guidelines are revised periodically, so check the regulator’s own site before relying on a section number.
