How Casino RNGs Work: A Complete Technical Guide

Every spin, card deal and roulette result at a licensed online casino is produced by a random number generator, and almost every player has an opinion about whether that RNG is honest. Very few have read the regulations that govern it. This guide documents what a casino RNG actually is, the specific qualities regulators require it to demonstrate, the statistical tests laboratories run against it, and the ongoing monitoring obligations that continue long after a game goes live.

All requirements described here are drawn from published regulatory texts and testing standards rather than operator marketing. Where a rule is quoted, it comes from the regulator's own manual.

Key Findings

UK-licensed RNGs must demonstrate five specific qualities under RTS 7A, including uniform distribution and computational unpredictability, and adaptive or "compensated" games are explicitly banned. Certification involves four distinct stages: documentation review, algorithm vulnerability research, source-code review and statistical testing of raw output. The NIST SP 800-22 suite alone applies 15 tests and recommends at least 100 million bits of output. Operators must also run continuous live RTP monitoring after launch.

What a Casino RNG Actually Is

A random number generator is a system that produces a sequence of numbers with no discernible pattern. In gambling, two families are used, and the distinction matters for how they are tested.

Pseudorandom Generators (PRNGs)

Nearly all online casino games use a software PRNG: a deterministic algorithm that takes a starting value called a seed and expands it into a long sequence of numbers. Given the same seed, a PRNG produces the same sequence every time — which sounds fatal to fairness until you understand the requirement. Regulators do not demand that the output be unpredictable in principle; they demand that it be computationally infeasible to predict the next number without complete knowledge of both the algorithm and the seed value. A well-constructed PRNG with a cryptographically secure design and a properly entropic seed satisfies this even though it is mathematically deterministic.

Hardware and True Random Generators (TRNGs)

Some systems seed from physical entropy sources — thermal noise, radioactive decay timing, or electrical fluctuation. These are more common in land-based gaming machines and in the seeding layer of online systems than as the direct output generator, because hardware sources are slower and harder to audit than a certified software algorithm.

Mechanical RNGs

Live dealer products and physical devices such as roulette wheels and ball-draw machines are treated as mechanical RNGs and carry their own requirements: components must be built from materials that will not decompose over time (a ball must not disintegrate), the physical properties of the selection items must not be altered, and players must have no ability to physically interact with or manipulate the mechanism.

The Five Qualities Regulators Require

The UK Gambling Commission's Remote Gambling and Software Technical Standards set out the clearest public statement of RNG requirements in any major jurisdiction. RTS requirement 7A states that random number generation and game results must be "acceptably random," meaning it must be possible to demonstrate to a high degree of confidence, through statistical analysis using generally accepted tests, that outcomes are random. Adaptive behaviour — a compensated game that adjusts probabilities based on results — is not permitted.

The accompanying implementation guidance lists five qualities an RNG must be capable of demonstrating:

#	Required Quality	What It Prevents
1	Output is uniformly distributed across the entire output range, and game outcomes match expected theoretical probabilities	Certain numbers or symbols appearing more often than the paytable implies
2	Output is unpredictable; for software RNGs it must be computationally infeasible to predict the next number without full knowledge of algorithm and seed	A player or insider reverse-engineering the sequence from observed results
3	The generator does not reproduce the same output stream (cycle), and two instances do not synchronise with each other	Two players on the same game receiving identical outcome sequences
4	Any seeding or re-seeding does not introduce predictability	Time-based or low-entropy seeds that narrow the search space for an attacker
5	Any scaling applied to raw output maintains all the above qualities	Bias introduced when a raw 32-bit number is mapped onto a 52-card deck or a reel strip

Point five is the one most often overlooked in consumer explanations and the one that causes the most real-world defects. A raw RNG can be flawless while the code that converts its output into a card or a reel position introduces measurable bias — the classic case being modulo bias, where a range that does not divide evenly into the generator's output space makes low values slightly more likely.

Rules That Govern Game Behaviour, Not Just Randomness

Certification does not stop at the number generator. Several adjacent requirements exist specifically because a technically random RNG can still power a misleading game:

1. No discarding of numbers. When random numbers are received, they must be used in the order received and may not be discarded due to adaptive behaviour. Numbers may only be discarded if they fall outside the expected range, and such an occurrence must be logged and investigated.
2. No false near-misses. Games may not substitute one losing outcome with a different losing outcome designed to look like a near-win.
3. Real devices must have real probabilities. Where a virtual game simulates a physical device, theoretical probabilities must match the real device — a simulated coin must land heads exactly 50% of the time.
4. Fixed layouts stay fixed. Where a game uses a pre-determined layout such as hidden prizes on a map, winning locations may not move during play.
5. No live rule changes. Rules, payouts and outcome probabilities may not be altered while a game is available for gambling. Changes require the game to be taken offline, and altered games must display a notice such as "rules changed" or "new odds" on selection screens.
6. Jackpot eligibility. Where a customer contributes to a jackpot pool, that customer must be eligible to win it while playing.

Rule five closes a loophole that would otherwise make everything else meaningless. Without it, an operator could certify a game and then quietly adjust its paytable. The blanket prohibition on terms stating "game rules may be changed at any time" is explicit in the guidance.

How Test Houses Verify an RNG

The UK Gambling Commission maintains a published list of approved test houses. Its testing strategy defines RNG evaluation as four sequential activities:

1. Documentation review — understanding how the RNG is implemented within the gaming system.
2. Algorithm research — confirming there is no publicly known weakness or vulnerability associated with the algorithm or hardware under evaluation.
3. Source code review — verifying the implementation matches the documentation.
4. Statistical testing — analysing the raw output of the RNG plus scaled or shuffled deck data.

Any non-compliance is reported to the supplier and re-evaluated after remediation. Stage two is more consequential than it sounds: an algorithm that was considered acceptable a decade ago may have since been broken in the academic literature, and the test house is obliged to check.

The Statistical Suites

The dominant standard is NIST Special Publication 800-22, a suite of 15 tests (several with sub-tests) developed by the US National Institute of Standards and Technology for cryptographic generators. It includes a frequency test assessing uniformity and a runs test assessing how often the sequence alternates between zeros and ones, with chi-square statistics converted to p-values; if a p-value falls below the significance threshold, the sequence is judged non-random. The NIST guidance recommends testing 100 sub-strings of 10⁶ bits each — at least 10⁸ bits, or roughly 12.5 MB of raw output. The older Diehard battery proposed by George Marsaglia is also widely used alongside it.

Test reports for an RNG must document the test house and the supervisor who signed off, the licensee, date, certificate reference, RNG version and digital signature, whether the generator is hardware or software, the full scope of tests applied, and any limitations on use — including acceptable degrees of freedom, whether it is suitable for sampling with or without replacement, and any dependency on operating-system functionality such as Java SecureRandom that could affect operation if modified.

From RNG to RTP: How Games Are Certified

An approved RNG is a component, not a certified game. Game testing verifies design (maths, artwork, rules as displayed to players, and theoretical return to player) and then software implementation, using three distinct methods:

Method	What It Does	What It Catches
Simulation testing	Plays the game automatically for a very high number of rounds, with volume determined by the game's volatility, to confirm actual RTP falls within acceptable range of expected RTP	Maths errors, paytable implementation faults, scaling bias
Emulation testing	Forces rare outcomes such as jackpot triggers, special features and maximum prizes	Defects in code paths that simulation would almost never reach
Manual play	A tester plays the game in real time, typically for an extended session	Interface faults, misdrawn paylines, display errors

Crucially, the required simulation volume scales with volatility. A low-volatility game converges on its theoretical RTP quickly; a high-volatility slot with a rare top prize needs vastly more simulated rounds before the observed return means anything. This is also why an individual player's session results carry no information about whether a game is fair, and why any honest discussion of variance at online casinos has to start with sample size.

Live RTP Monitoring: The Requirement Players Rarely Hear About

Certification at launch is not the end of the obligation. UK licensees must maintain ongoing RTP monitoring for both underpayments and overpayments, calculating actual RTP (win divided by turnover) and comparing it against the advertised figure.

The guidance is specific about how this must be done. Measurement frequency must reflect volume of play — monthly measurement is explicitly called out as inadequate for popular games that accumulate high volume quickly. The preferred approach is an automated backend process raising alerts when measurements fall outside tolerance, with one acceptable method being daily measurement over a rolling 30-day window of play. Volatility must be a parameter in setting the allowable tolerance for each game.

The rule against over-aggregation is the most useful part for players to understand: monitoring must not be so aggregated that it hides errors at a lower level. A fault existing only in the mobile version of a game would be invisible if all markets and channels were pooled into a single calculation. The guidance also states that it is not sufficient to tell a complaining player that games have met required testing standards, because that response fails to acknowledge that errors can evade testing.

Who Certifies What

Several independent laboratories operate in this space, with overlapping but distinguishable specialisms.

Body	Type	Primary Focus
Gaming Laboratories International (GLI)	Test house	Authors the GLI-19 and GLI-33 standards; broad coverage across online and land-based gaming
BMM Testlabs	Test house	Long-established across both online and land-based markets
eCOGRA	Test house and standards body	RNG certification and player-protection focus in online casino software
iTech Labs	Test house	RNG evaluation and RTP verification against advertised percentages
UK Gambling Commission	Regulator	Sets RTS requirements; approves test houses; receives all game and RNG reports before release
New Jersey Division of Gaming Enforcement	Regulator	Tests gaming equipment and internet gaming platform systems through its Technical Services Bureau prior to use

GLI-19 is the interactive gaming systems standard and matters beyond its own certificate because many regulators write their technical rules on top of it. A supplier certified to GLI-19 or GLI-33 can often enter an adopting jurisdiction with only a reduced delta test covering local specifics, which is why the same games appear across many regulated markets with only minor variation.

In New Jersey, all RNG games must be tested by independent laboratories approved by the DGE, covering RNG systems, game logic, payout calculations and live dealer operations. Each licensee offering internet gaming must additionally commission an annual system integrity and security assessment from a Division-approved independent professional and submit the report each year.

Provably Fair: A Different Model

Cryptocurrency casinos often advertise "provably fair" gaming, which is a cryptographic protocol rather than a certification regime. The server commits in advance to a hashed seed, the player supplies or can alter a client seed, and after the round the server reveals its seed so the player can independently recompute the outcome and confirm it was not altered after bets were placed.

This solves a narrow problem — post-hoc result manipulation — and solves it well. It does not verify that the underlying probability distribution matches what was advertised, that the house edge is what the site claims, or that the operator is solvent and will pay. A provably fair verification confirms the deal was not rigged after the fact; it does not confirm the deck was the deck you were told about. The two models are complements, not substitutes, which is why the better crypto casinos hold conventional lab certification in addition to publishing verification tools. Anyone assessing operators in this segment should read our wider crypto gambling guide alongside the fairness claims themselves.

How to Verify a Casino's Certification Yourself

1. Find the licence number in the site footer and check it against the regulator's own public register rather than trusting the on-page badge.
2. Look for the test house seal and confirm the certificate covers the specific games and platform version in use, not merely the company.
3. Check the published RTP in the game's information panel. UK rules require rules, game descriptions and the likelihood of winning to be available before play commences.
4. Confirm the jurisdiction. A licence from a market with a published technical standard and an approved test-house list carries materially different weight from one without.
5. Watch for prohibited language such as terms reserving the right to change game rules at any time, which is explicitly unacceptable under RTS 7D.

Our regularly updated shortlist of licensed online casinos applies these checks as a baseline screen.

Methodology

All regulatory requirements described here are taken directly from the UK Gambling Commission's published Remote Gambling and Software Technical Standards, specifically RTS 7 on the generation of random outcomes, and from its Testing Strategy for Compliance with Remote Gambling and Software Technical Standards, covering the procedure for testing and live RTP monitoring sections. Statistical testing detail is drawn from the published structure of NIST Special Publication 800-22. New Jersey requirements are drawn from public descriptions of the Division of Gaming Enforcement's Technical Services Bureau remit.

We have quoted requirements as written and clearly separated regulatory text from our own interpretation. Where a requirement applies specifically to one jurisdiction, we have named that jurisdiction rather than presenting it as universal. No operator supplied information for this article, and no certification body reviewed it prior to publication.

Frequently Asked Questions

Can an online casino change a game's RNG to make players lose?

Under UK rules, no. Adaptive behaviour — a compensated game whose probabilities respond to results — is explicitly prohibited under RTS 7A. Rules, payouts and outcome probabilities may not be changed while a game is available for gambling, and any permitted change requires the game to be taken offline and a notice displayed to customers afterwards.

How much data does an RNG test actually analyse?

The NIST SP 800-22 guidance recommends 100 sub-strings of 10⁶ bits, meaning at least 100 million bits — around 12.5 MB — of raw generator output, run through 15 separate statistical tests. Game-level simulation testing is separate and its volume scales with the game's volatility.

Does a certified RTP mean I will get that return?

No. RTP is a theoretical long-run figure derived from the game's mathematical design and confirmed by simulation over very large numbers of rounds. Over any realistic session the outcome distribution is dominated by variance, and high-volatility games can deviate enormously from their stated RTP across thousands of spins.

What is the difference between RNG certification and provably fair?

RNG certification is an independent laboratory verifying that the generator is statistically random, that the game implements its advertised maths, and that the operator monitors live returns. Provably fair is a cryptographic scheme letting a player verify that a specific result was not altered after they bet. Certification addresses the design; provably fair addresses individual rounds.

Who approves the laboratories that test the games?

Regulators do. The UK Gambling Commission maintains and publishes a list of approved test houses, and licensees must agree the scope of testing with their chosen house. In New Jersey, laboratories must be approved by the Division of Gaming Enforcement, whose Technical Services Bureau also tests gaming equipment and internet gaming platform systems directly.

Sources

• UK Gambling Commission — RTS 7: Generation of Random Outcomes
• UK Gambling Commission — Testing Strategy: Procedure for Testing
• UK Gambling Commission — Testing Strategy: Live RTP Monitoring
• New Jersey Division of Gaming Enforcement
• NIST Special Publication 800-22 — Statistical Test Suite for Random and Pseudorandom Number Generators
• Gaming Laboratories International — GLI-19 and GLI-33 interactive gaming standards

Cite This Article

If you use data from this article, please link back to https://www.deucescracked.com/blog/how-casino-rng-works-certification-guide. This reference is maintained by the DeucesCracked editorial team and reviewed when the underlying technical standards are updated. Further reference material is collected in our guides library.