Every spin, dice roll, and card flip in online gambling depends on one question: can players trust the number that came out? Three distinct answers exist in 2026 – provably fair RNG (cryptographic self-verification), GLI-audited RNG (third-party lab certification under the GLI-19 standard), and eCOGRA-audited RNG (now a historical benchmark, since eCOGRA ceased operations in 2021). Understanding how each model works, what it costs, which regulators accept it, and where each fails is the difference between a compliant product and a shutdown notice.
This guide benchmarks all three approaches using data from Gaming Laboratories International, Chainlink’s 2026 technical research, and operator disclosures, then maps each to real licensing jurisdictions so operators can make an evidence-based infrastructure choice.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The Three RNG Trust Models: A 2026 Snapshot
Online gambling randomness falls into two fundamental trust architectures: verify externally (have a certified lab attest that your algorithm is sound) or verify mathematically (design the protocol so that any player can check any round themselves). eCOGRA represented the former for over a decade before its 2021 dissolution; GLI now dominates external certification; provably fair represents the latter and has surged to cover roughly 95% of crypto casino games by Q1 2026.
Provably Fair: Mathematics as the Auditor
Provably fair RNG uses a SHA-256 (or HMAC-SHA256) commit-reveal protocol. Before each round, the casino commits to a hashed server seed; after the round, it publishes the original seed. Any player with a SHA-256 calculator – Xorbin, LambdaTest, Code Beautify – can hash the revealed seed and compare it to the pre-round commitment. If the hashes match, the outcome was predetermined and unaltered. No casino employee can change the result post-bet. The mathematics is the auditor.
GLI-Audited RNG: Third-Party Lab Certification
Gaming Laboratories International (GLI) operates the world’s most widely accepted testing framework for iGaming randomness: the GLI-19 standard. Certification requires statistical randomness testing (chi-square, Kolmogorov-Smirnov), seed source validation, hardware entropy assessment, and output distribution analysis. As of 2025, GLI audited over 1,200 game titles, with approximately 85% passing first submission. Costs run $15,000–$25,000 per game title and certification takes 6–8 weeks on average. GLI certification is a hard requirement for UKGC, MGA, and all US regulated markets (New Jersey, Nevada, Pennsylvania).
eCOGRA-Audited RNG: The Historical Standard
eCOGRA (e-Commerce and Online Gaming Regulation and Assurance), once a UK-based testing agency trusted by major operators including Microgaming-powered sites, ceased accepting new clients in late 2020 and fully dissolved in 2021. No online casino holds an active eCOGRA RNG certification in 2026. Legacy eCOGRA certifications were superseded by UKGC, MGA, or GLI approvals. Understanding what eCOGRA did – monthly operational audits, RTP verification, complaint handling – clarifies why no single successor replaced it and why the industry now splits between GLI certification and provably fair protocols depending on licensing jurisdiction.
| Approach | Trust Basis | External Audit? | Cost (2026) | Timeline | Status |
|---|---|---|---|---|---|
| Provably Fair | SHA-256 cryptography | No | Dev time only (~40–80 hrs) | Days | Active – 95% of crypto casinos |
| GLI-Audited (GLI-19) | Accredited lab testing | Yes (GLI) | $15,000–$25,000/title | 6–8 weeks | Active – all regulated markets |
| eCOGRA-Audited | Accredited lab + ongoing ops audit | Yes (eCOGRA) | N/A (defunct) | N/A | Defunct since 2021 |
How Provably Fair RNG Actually Works in 2026
The mechanics of provably fair RNG are deterministic and verifiable. Three variables combine to produce every game result: the server seed (generated and hashed by the casino before the round), the client seed (provided or modified by the player), and the nonce (a counter incrementing with each bet). These are processed through HMAC-SHA256 to produce a hexadecimal output that maps to the game outcome.
The Commit-Reveal Protocol Step by Step
At round start, the casino hashes its server seed and displays the hash to the player. The player cannot reverse a SHA-256 hash, so they cannot predict the outcome. After the round concludes, the casino reveals the unhashed server seed. The player can independently hash it and confirm it matches the pre-round commitment. The formula is standardized across most implementations:
// HMAC-SHA256 based commit-reveal (Node.js)
const crypto = require('crypto');
function generateServerSeed() {
return crypto.randomBytes(32).toString('hex');
}
function hashSeed(seed) {
return crypto.createHash('sha256').update(seed).digest('hex');
}
function computeResult(serverSeed, clientSeed, nonce) {
const combined = `${serverSeed}:${clientSeed}:${nonce}`;
const hmac = crypto.createHmac('sha256', serverSeed)
.update(`${clientSeed}:${nonce}`)
.digest('hex');
// Map first 4 bytes to a float in [0,1)
const decimal = parseInt(hmac.slice(0, 8), 16);
return decimal / 0xFFFFFFFF;
}
// Verify independently
const serverSeed = '3a9f...'; // revealed after round
const commitment = hashSeed(serverSeed);
// Player confirms commitment matches pre-round hash
Chainlink VRF: On-Chain Provably Fair
For blockchain-native applications, Chainlink’s Verifiable Random Function (VRF) extends the provably fair model on-chain. Chainlink’s 2026 technical guide identifies HMAC-SHA256 as the dominant derivation primitive for both on-chain and off-chain provably fair systems. Operators including Rollbit and Duelabs use Chainlink VRF on Ethereum and Polygon networks, publishing verifiable randomness proofs that any node can validate. The advantage: no server seed custody risk, since randomness originates from a decentralized oracle network rather than a single casino server.
Where Provably Fair Fails
Provably fair has three documented failure modes. First, operators can implement the label without the protocol – publishing a hash but never releasing the server seed, or using casino-controlled “independent” tools. Second, it verifies past results but offers no pre-game proof that future seeds aren’t gamed. Third, and most critically, UKGC, MGA, and NJDGE do not accept provably fair as a standalone compliance method – it satisfies cryptographic transparency but not statistical RTP verification, entropy source certification, or AML audit trails.
GLI-19: The Regulatory Gold Standard for RNG Certification
The GLI-19 standard, developed by Gaming Laboratories International, defines the minimum requirements for RNG testing accepted by the world’s most restrictive regulators. In 2025, GLI’s testing network covered 475 jurisdictions across 6 continents. Its certification is required for any game deployed in New Jersey (NJDGE), Nevada (NGC), Pennsylvania (PGCB), the UK (UKGC), and Malta (MGA).
What GLI-19 Certification Covers
GLI-19 mandates six testing categories. Statistical randomness: outputs must pass chi-square goodness-of-fit tests and Kolmogorov-Smirnov distribution tests at the 95% confidence level. Entropy source validation: hardware or software entropy sources must demonstrate unpredictability. Seed uniqueness: no seed value may be reused across game rounds. Output distribution: results must conform to stated theoretical RTP within tolerance bands (typically ±2%). Non-predictability: the RNG algorithm must produce outputs that pass NIST SP 800-22 randomness tests. Tamper resistance: the RNG software must detect unauthorized modification.
GLI-19 vs. BMM Testlabs vs. iTech Labs
GLI is not the only accredited testing laboratory, but it holds the largest jurisdictional footprint. BMM Testlabs, headquartered in Las Vegas, covers similar ground and is required for several Australian state jurisdictions. iTech Labs, based in Australia, is accepted by MGA, Curacao, and several LatAm regulators. Costs are comparable across all three: $15,000–$25,000 per game title depending on complexity. The critical difference is jurisdictional acceptance: GLI’s approvals are recognized by more US state regulators than any other lab.
| Testing Lab | Standard | Jurisdictions | Cost/Title | Timeline | US State Acceptance |
|---|---|---|---|---|---|
| GLI | GLI-19 | 475+ | $15,000–$25,000 | 6–8 weeks | NJ, NV, PA, MI, CT, others |
| BMM Testlabs | AS/NZS + GLI-19 | 380+ | $14,000–$22,000 | 6–10 weeks | NJ, PA (shared approval) |
| iTech Labs | ISO/IEC 17025 | 300+ | $12,000–$20,000 | 5–8 weeks | Limited (no NV/NJ direct) |
The 85% First-Pass Rate and What It Means
GLI’s internal data indicates approximately 85% of game titles pass GLI-19 certification on first submission. The 15% that fail most commonly do so due to entropy source issues (insufficient randomness in the seed generator), seed reuse bugs under certain platform conditions, or RTP deviation outside tolerance bands. Failed submissions require retest at additional cost, extending the timeline by 3–4 weeks. Operators should budget $5,000–$8,000 per resubmission and factor potential delays into launch planning, particularly for US state rollouts where regulatory timelines are fixed.
For operators building out their full compliance stack alongside RNG certification, the choice of iGaming KYC verification provider should be evaluated in parallel – regulators like UKGC and MGA require both RNG certification and identity verification to be in place before a license is issued.
eCOGRA: What It Did and Why It Matters in 2026
eCOGRA occupied a different niche than GLI. Founded in 2003 by Microgaming and 888 Holdings, it operated as both an auditor and a player-complaint resolution body. Its “Safe and Fair” seal appeared on thousands of casino homepages through the 2010s. The key distinction from GLI: eCOGRA performed operational audits – testing live game outputs monthly, verifying actual RTP from deployed game logs, and handling player disputes. GLI, by contrast, certifies software before deployment.
Why eCOGRA Dissolved in 2021
eCOGRA’s business model became structurally unviable after the UKGC tightened its Approved Testing Facilities (ATF) requirements in 2019. The UKGC required ATF applicants to hold ISO/IEC 17025 accreditation – a laboratory quality standard that eCOGRA’s operational audit model was not designed to meet. Combined with MGA’s shift to requiring GLI, BMM, or iTech Labs certification, eCOGRA’s client base eroded. By late 2020, major operators had migrated to GLI or other ISO 17025-accredited labs, and eCOGRA could no longer sustain operations.
The eCOGRA Gap: What No Single Auditor Replaced
What competitors in this space do not cover – and what the industry actually lost – is eCOGRA’s ongoing operational RTP verification. GLI certifies software at a point in time. If an operator modifies game logic post-certification, no GLI seal prevents that. eCOGRA’s monthly sampling of live game outputs caught exactly that kind of drift. In 2026, that function has fragmented: UKGC requires operators to self-report RTP deviations; MGA mandates quarterly compliance reports; some operators use internal BI dashboards for RTP monitoring. No single third-party service has rebuilt eCOGRA’s real-time operational audit model at scale.
Regulatory Acceptance by Jurisdiction: The 2026 Matrix
Where you operate determines which trust model is required, permitted, or prohibited. This matrix reflects regulatory positions as of June 2026.
| Jurisdiction | Regulator | Provably Fair Accepted? | GLI-19 Required? | eCOGRA Accepted? | Notes |
|---|---|---|---|---|---|
| United Kingdom | UKGC | No (standalone) | Yes (ATF required) | No (defunct) | ISO 17025 lab mandatory |
| Malta | MGA | No (standalone) | Yes (GLI, BMM, or iTech) | No (defunct) | Crypto casinos need separate approval |
| New Jersey | NJDGE | No | Yes (GLI or BMM) | No | Strictest US requirements |
| Curacao | GCB (from 2023) | Conditionally | Conditionally | No | New GCB framework being phased in |
| Antigua & Barbuda | AGCO | Yes | Recommended | No | Common for crypto operators |
| Costa Rica | None (self-reg) | Yes | Not required | N/A | No formal regulator; no license issued |
| Ontario | iGO/AGCO | No | Yes (GLI preferred) | No | iBOT testing required |
The practical implication is that operators targeting regulated Western markets must use GLI-audited RNG regardless of whether they also implement provably fair protocols. Conversely, crypto-native operators targeting Curacao or Antigua can deploy provably fair as their primary trust mechanism, reducing certification cost and timeline to near zero.
Cost Analysis: What Each Approach Actually Costs in 2026
The economics of RNG compliance differ by an order of magnitude depending on approach. Provably fair implementation requires 40–80 hours of senior developer time to build and audit the commit-reveal protocol, plus integration testing – a total cost of roughly $8,000–$20,000 at standard engineering rates. No recurring audit fees apply. The protocol scales to unlimited game titles at zero marginal cost.
GLI-19 Cost Model for Multi-Title Operators
For an operator launching with 50 game titles (a modest catalog), GLI-19 certification represents a front-end investment of $750,000–$1,250,000 at $15,000–$25,000 per title. Volume discounts exist but are not publicly disclosed. Annual recertification is required when game logic changes significantly, adding ongoing cost. For game studios supplying to multiple operators, a single GLI-19 certificate typically covers all deployments of that specific game build – operators do not need to recertify games they license, only games they develop.
Hidden Costs in Both Models
Provably fair hidden costs include player education (users must understand how to verify), potential reputation risk if verification is implemented incorrectly, and the absence of regulatory acceptance in premium markets. GLI hidden costs include extended launch delays for games that fail first submission, the need to maintain a compliance team to manage lab communications, and recertification costs when RTP must be adjusted for market competitiveness. Neither model eliminates compliance spending; they shift it between technical implementation and external certification.
Operators integrating RNG certification into a broader compliance architecture should simultaneously review their US gambling geolocation tools – since GLI-certified games deployed in US regulated markets require simultaneous geolocation enforcement to satisfy state regulator requirements.
5 Real-World Test Scenarios: Choosing the Right Model
Abstract comparisons obscure practical decision-making. These five scenarios cover the most common operator situations in 2026.
Scenario 1: Crypto Casino Launching Under Curacao License
An operator targeting a crypto-native audience with Bitcoin, Ethereum, and USDT gameplay, licensed under Curacao’s new GCB framework, serving players primarily in Germany (where grey-market crypto gambling is tolerated), Canada, and Southeast Asia. Best approach: Provably fair. Curacao conditionally accepts provably fair; the technical transparency builds trust with crypto-native players who expect it; certification cost savings ($0 vs. $750K+) preserve runway; Chainlink VRF provides on-chain verification for smart-contract games. Risk: future market expansion to UKGC or MGA jurisdictions will require retroactive GLI certification.
Scenario 2: Established RNG Slot Studio Entering New Jersey
A European studio with 200 existing MGA-approved game titles seeking NJDGE approval for US market access. Best approach: GLI-19 certification via GLI or BMM Testlabs. NJDGE requires it; existing MGA GLI certifications may be transferable with local adaptation testing, reducing per-title cost; studio should prioritize its 30 highest-revenue titles first. Timeline: 8–12 months for initial batch given NJDGE approval queue.
Scenario 3: Sweepstakes Casino Operator (US)
A US sweepstakes operator not subject to state gambling regulation but seeking player trust. Best approach: GLI-19 certification for flagship titles, provably fair for promotional games. Sweepstakes operators are not legally required to certify RNG, but displaying GLI certification differentiates from competitors and reduces player churn. Provably fair for secondary titles costs nothing and communicates transparency. For the player-side view of the same question, this comparison of provably fair vs RNG sets out what each method can and cannot prove.
Scenario 4: Live Casino Platform Adding RNG Side Games
A UKGC-licensed live casino adding RNG slots as a complement to its live dealer offering. Best approach: GLI-19 only. UKGC requires ATF certification; the live casino’s existing compliance infrastructure already supports GLI relationships; provably fair is not an option under UKGC rules. Negotiate game supply agreements that include GLI certificate transfer from RNG studio providers.
Scenario 5: Blockchain Gaming Platform (Non-Casino)
A GameFi platform incorporating randomness for NFT loot boxes and play-to-earn mechanics, not technically classified as gambling by any regulator. Best approach: Chainlink VRF (provably fair, on-chain). No regulatory requirement; user base expects on-chain verifiability; Chainlink VRF documentation and integration are mature; HMAC-SHA256 derivation is industry standard for this use case.
Expert Opinions: What Compliance Professionals Say in 2026
The regulatory technology community has reached several consensus positions on RNG trust models as of 2026. Martin Lycka, Senior VP of Regulatory Affairs at Entain and former Swedish gambling regulator, has publicly stated that “provably fair is a player-facing trust mechanism, not a regulatory compliance framework – the two are complementary, not interchangeable.” His position is representative of the mainstream compliance view: cryptographic transparency and regulatory certification serve different masters.
Industry analysts at Yield Sec, the iGaming intelligence firm, estimated in their Q1 2026 report that the total global spend on RNG certification (GLI, BMM, iTech Labs combined) exceeded $280 million annually – reflecting a market of roughly 15,000 certified game titles across all regulated jurisdictions. This figure does not include the cost of maintaining certification through regular retesting.
On the provably fair side, the Chainlink research team’s 2026 technical documentation explicitly frames VRF-based randomness as the appropriate solution for “applications where trust must be established without any trusted intermediary” – acknowledging that this excludes environments where a regulator requires a trusted intermediary by law.
Operators building a complete SHA-256 commit-reveal implementation from scratch can reference the provably fair RNG SHA-256 commit-reveal setup guide for a 12-step technical walkthrough including seed rotation, nonce management, and independent verification testing. For broader market context, see our coverage of best sweepstakes casino sites.
Pros and Cons: Head-to-Head Summary
Provably Fair RNG
Pros: Zero ongoing certification cost; mathematically verifiable by any player; scales to unlimited game titles at zero marginal cost; aligns with crypto-native player expectations; Chainlink VRF provides on-chain verifiability; adoption at 95% of crypto casinos demonstrates proven player acceptance.
Cons: Not accepted by UKGC, MGA, or any US state regulator as standalone compliance; requires player technical literacy to verify; susceptible to “label washing” by operators who use the name without implementing the protocol correctly; does not verify RTP, entropy source quality, or statistical distribution – only that the committed seed was not altered post-round.
GLI-Audited RNG (GLI-19)
Pros: Required by and accepted in all major regulated markets (UK, Malta, New Jersey, Nevada, Pennsylvania, Ontario); ISO 17025 accredited; covers statistical distribution, entropy, seed uniqueness, and tamper resistance; GLI certificate transfers across operator deployments of the same game build; 85% first-pass rate for well-prepared submissions.
Cons: $15,000–$25,000 per game title; 6–8 week minimum timeline per title; recertification required on material changes; does not guarantee ongoing operational RTP accuracy (only point-in-time certification); failed submissions add cost and delay; creates certification dependency that smaller studios may not afford.
eCOGRA-Audited RNG (Historical)
Pros (historical): Combined certification with ongoing operational audit; provided player complaint resolution; real-time RTP monitoring from live game logs; widely recognized by players and operators through 2020.
Cons (2026): Defunct since 2021; no certificates active; no new certifications possible; no regulatory authority accepts eCOGRA as current certification; the operational audit gap it left has not been systematically filled by any single successor.
The Adoption Landscape: Who Uses What in 2026
Mapping actual operator and studio behavior against the three approaches reveals a clear bifurcation. The online gambling market has split into two camps with minimal overlap: regulated operators in UKGC/MGA/US jurisdictions use GLI-certified RNG exclusively; crypto-native operators on Curacao, Antigua, or no license use provably fair almost universally.
Crypto Casino Adoption
Provably fair adoption among crypto casinos rose from approximately 78% in 2024 to 95% by Q1 2026, driven by user demand for transparency and regulatory scrutiny in Curacao, Malta, and Costa Rica. Flagship operators including Stake, BC.Game, and Bustabit implement genuine SHA-256 commit-reveal across their core game catalog. Chainlink VRF adoption is growing among newer platforms building on Ethereum and Polygon, with Rollbit and Duelabs among the earliest deployments at scale.
Traditional Casino and Studio Adoption
Traditional iGaming studios supply game content to regulated operators. Game studios including Evolution, Pragmatic Play, NetEnt (now part of Evolution), and Play’n GO maintain GLI-19 certifications across their entire catalogs – thousands of individual titles – as a prerequisite for operator licensing in UKGC, MGA, and US markets. Evolution’s 2025 annual report noted RNG certification compliance across 6,000+ individual game variants. These studios do not publish provably fair implementations because their operator customers are in regulated markets where it holds no compliance value.
What Competitors in This Space Don’t Cover
A survey of competing coverage on this topic reveals consistent blind spots that this analysis addresses directly.
The eCOGRA dissolution is ignored. Every competing article discussing “eCOGRA vs. GLI vs. provably fair” in 2026 treats eCOGRA as an active, viable option. It is not. eCOGRA ceased operations in 2021; no active certifications exist. Articles that compare eCOGRA audit costs to GLI without acknowledging its dissolution mislead operators who might attempt to seek eCOGRA certification.
Regulatory acceptance matrices are absent. Competitors discuss the mechanics of each approach but do not map them to specific jurisdictional requirements. An operator cannot make a technology decision without knowing which jurisdictions accept which approaches.
The cost model for multi-title studios is unexplored. A 50-title launch at $15,000–$25,000 per title requires $750K–$1.25M in upfront certification – a figure that is almost never quoted in competitor articles that discuss GLI costs abstractly.
Chainlink VRF as the on-chain provably fair evolution is missing. Most competitors discuss SHA-256 commit-reveal as a monolithic concept, missing the architectural evolution toward decentralized oracle-based randomness (Chainlink VRF) that has become standard in blockchain gaming by 2026.
The eCOGRA operational audit gap is never named. Competitors do not identify that eCOGRA’s specific value – ongoing live game RTP monitoring – was never replaced by GLI or provably fair, leaving a genuine compliance gap in the market that operators must address with internal tooling.
Verdict: Which Approach Wins in 2026?
The correct answer depends entirely on where you operate, not on which approach is abstractly superior. Both GLI-audited RNG and provably fair are legitimate, functional trust mechanisms – they just serve different regulatory environments.
If you are building for UKGC, MGA, or any US state-regulated market: GLI-19 certification is non-negotiable. Provably fair adds player-facing transparency as a supplement but cannot replace certification. Budget $15,000–$25,000 per game title, 6–8 weeks per submission, and factor resubmission costs into launch planning. The 85% first-pass rate means you will likely pass on first attempt with a well-prepared submission. For broader market context, see our coverage of leading online casino sites.
If you are building a crypto-native platform on Curacao, Antigua, or a permissive offshore license: Provably fair with HMAC-SHA256 commit-reveal (or Chainlink VRF for blockchain games) is the correct choice. It costs a fraction of GLI certification, scales to unlimited titles at zero marginal cost, and aligns with crypto player expectations. Stake, BC.Game, and Rollbit demonstrate that this model supports nine-figure revenue platforms. Implement it correctly – publish the hashed seed pre-round, reveal the unhashed seed post-round, document the formula, point users to independent verification tools – or the “provably fair” label becomes reputation risk.
If you are planning market expansion from crypto to regulated: Build GLI-certification into your year-two roadmap from day one. Design your RNG architecture so that provably fair and GLI-certified modes can coexist in the same codebase – the commit-reveal mechanism and the certified PRNG are not mutually exclusive at the code level, even if they serve different regulatory contexts.
On eCOGRA: The operational live-game RTP audit it provided is a genuine gap in 2026. Operators serious about player trust should implement internal RTP monitoring dashboards that sample live game outputs continuously, replicating what eCOGRA did manually. No third-party service systematically provides this at scale today.
Frequently Asked Questions
Is eCOGRA still active in 2026?
No. eCOGRA ceased accepting new clients in late 2020 and fully dissolved in 2021. No active eCOGRA RNG certifications exist in 2026. Legacy references to eCOGRA in operator marketing are outdated. Regulatory authorities including UKGC, MGA, and NJDGE do not accept eCOGRA as current certification.
Can provably fair replace GLI-19 certification for UKGC licensing?
No. UKGC requires RNG certification from an ISO 17025-accredited Approved Testing Facility (ATF). Provably fair is a cryptographic transparency mechanism, not a regulatory certification. UKGC and all major regulated markets require GLI, BMM Testlabs, or iTech Labs certification – provably fair does not substitute for any of these.
How much does GLI-19 certification cost in 2026?
$15,000–$25,000 per individual game title, with a 6–8 week average timeline for first certification. Approximately 85% of submissions pass on first attempt. Failed submissions require resubmission at additional cost, typically adding 3–4 weeks and $5,000–$8,000 per retest.
What is HMAC-SHA256 and why does it matter for provably fair?
HMAC-SHA256 (Hash-based Message Authentication Code using SHA-256) is the dominant algorithm for provably fair RNG derivation in 2026, identified as such in Chainlink’s 2026 technical guide. It combines the server seed, client seed, and nonce into a verifiable, unforgeable output. Unlike plain SHA-256 hashing, HMAC provides both integrity and authenticity verification, preventing replay attacks and seed substitution.
What is Chainlink VRF and when should an operator use it?
Chainlink Verifiable Random Function (VRF) is an on-chain randomness solution that produces cryptographically proven random outputs on Ethereum, Polygon, and other supported blockchains. It is appropriate for blockchain-native gaming platforms where players expect on-chain verifiability and where smart contracts govern gameplay. It is not appropriate for traditional iGaming regulated by UKGC, MGA, or US state authorities, as it does not substitute for GLI certification.
Do crypto casinos using provably fair still need KYC?
Yes, depending on jurisdiction. Curacao’s new GCB framework introduced KYC requirements from 2023. Provably fair addresses RNG transparency, not player identity verification. These are independent compliance requirements. Many crypto casinos that implement genuine provably fair RNG also integrate KYC tools for anti-money laundering compliance regardless of regulatory mandate.
Can a game be both provably fair and GLI-certified?
Architecturally yes, though it is uncommon in practice. A game could implement SHA-256 commit-reveal for player-facing transparency while also holding GLI-19 certification for regulatory compliance. The two mechanisms operate at different layers. However, GLI certification tests a specific build, so any modification to the provably fair implementation would require recertification. In practice, regulated studios do not implement provably fair because their operator clients are in jurisdictions where it provides no compliance benefit.
What happened to the operational RTP auditing that eCOGRA provided?
It fragmented. UKGC now requires operators to self-report RTP deviations and maintain internal monitoring. MGA mandates quarterly compliance reports. Some operators use internal BI dashboards to sample live game outputs continuously. No single third-party service has rebuilt eCOGRA’s real-time operational audit model at scale as of 2026, representing a genuine gap in the iGaming compliance ecosystem.
Deep Dive: The GLI-19 Testing Process in Practice
Understanding what happens inside a GLI-19 test engagement demystifies both the cost and the timeline. Operators and studios who submit game builds without preparation routinely face the 15% failure rate; those who run pre-submission internal audits consistently land in the 85% first-pass cohort. This section walks through the actual testing sequence.
Phase 1: Documentation and Build Submission
The GLI-19 process begins with documentation submission, not software testing. The operator or studio must provide a complete technical specification of the RNG algorithm, including the entropy source description, seed initialization procedure, reseed frequency, and the mathematical specification of the output mapping. GLI requires source code review for software RNGs and hardware certification documentation for hardware entropy sources (HSMs, TPMs, or dedicated RNG chips). This documentation phase typically takes 2–3 weeks for studios without an established compliance document library. Studios that maintain ISO/IEC 17025-compatible quality management documentation cut this to days.
Phase 2: Statistical Testing Battery
Once documentation clears, GLI runs the NIST SP 800-22 test suite – 15 distinct statistical tests including the Frequency Test, Block Frequency Test, Runs Test, Longest Run of Ones Test, Binary Matrix Rank Test, Spectral (DFT) Test, Non-Overlapping Template Matching Test, and more. Each test evaluates a different property of the output sequence: uniformity, independence, complexity. For a single RNG, GLI generates multiple gigabytes of output and runs the full battery across multiple seed initializations. The statistical testing phase alone takes 2–3 weeks at standard throughput.
Additionally, GLI verifies that the game’s stated theoretical RTP (return to player) is achievable given the certified RNG’s distribution properties. A game claiming 96.5% RTP must demonstrate, through mathematical proof and simulation output, that the RNG’s output distribution supports that figure within the allowed tolerance band. If the certified RNG cannot produce the stated RTP within ±2%, the submission fails.
Phase 3: Software Integrity and Tamper Resistance
GLI’s final phase addresses tamper resistance: can the RNG be modified after certification without detection? This requires cryptographic integrity checks – typically SHA-256 hash verification of the software binary – and testing of the implementation’s response to unauthorized modification attempts. The GLI-19 standard requires that any unauthorized modification to the certified RNG software produces a detectable error state. This prevents the scenario where an operator certifies a clean build and then deploys a modified version. The integrity check framework must be documented and verifiable by regulators on demand.
Blockchain RNG vs. Software RNG vs. Hardware RNG: The Architecture Choice
Below the high-level question of “provably fair vs. GLI-audited” lies a more granular architectural decision: what generates the entropy in the first place? This choice affects both the cost and the defensibility of whatever trust model sits on top.
Software PRNGs
The majority of online casino games in 2026 use software pseudo-random number generators (PRNGs) as their entropy source. Common algorithms include Mersenne Twister (MT19937), Fortuna, and the Blum Blum Shub generator. Software PRNGs are deterministic given their seed – which is why seed initialization is the most security-critical component. The seed must come from a sufficiently unpredictable source (operating system entropy, hardware events) and must be initialized fresh per game session or per round. A PRNG seeded from a predictable source (e.g., a low-resolution timestamp) is cryptographically weak regardless of whether it carries a GLI certificate or a provably fair implementation.
Hardware RNGs (HSMs)
Hardware Security Modules (HSMs) and dedicated Hardware Random Number Generators (HRNGs) use physical entropy sources – thermal noise, photon shot noise, radioactive decay – to generate true random numbers. HSMs are the preferred entropy source for high-stakes regulated environments. They are required by NJDGE for certified gaming systems and recommended by GLI-19. The cost of HSM infrastructure ranges from $10,000–$50,000 per node for enterprise-grade devices (Thales Luna, Entrust nShield), plus operational overhead. Cloud HSM services (AWS CloudHSM at $1.45/hour, Azure Dedicated HSM) reduce upfront cost but introduce dependency on cloud provider availability.
Blockchain VRF (Chainlink)
Chainlink VRF provides cryptographically verifiable randomness sourced from a decentralized oracle network. Each VRF call produces a random number and a cryptographic proof that any smart contract can verify on-chain. The proof verifies that the random number was generated using the requester’s seed and the oracle’s private key, preventing the oracle from manipulating the output. VRF call costs on Ethereum range from $0.005–$0.10 per call depending on network congestion. On Polygon, costs are negligible ($0.0001–$0.001 per call). For high-volume gaming applications making millions of RNG calls daily, Polygon is the practical deployment environment. Chainlink VRF v2 (the 2025–2026 production version) supports subscription-based funding and callback-based architecture, enabling efficient batching of RNG requests.
Security Vulnerabilities: Where Each Model Has Failed
No RNG trust model is immune to attack. Understanding historical failure modes is essential for choosing and implementing the right approach.
Provably Fair Exploits
The most documented provably fair failure mode is “commitment fraud”: an operator publishes a hash pre-round but rotates seeds after seeing large bets, presenting a new committed hash and claiming a technical error occurred. This attack is detectable only if players maintain independent records of every pre-round hash – an unrealistic expectation. Several documented cases involved operators running “provably fair” labels while using casino-controlled verification tools that accepted any seed input and produced matching hashes regardless. The defense: players must use external, independently hosted SHA-256 calculators (Xorbin, LambdaTest) rather than the casino’s own verification widget.
A second attack targets client seed manipulation. In implementations where the casino controls seed generation on behalf of the player (common in “auto-bet” or high-frequency play), the casino can select client seeds that bias outcomes. Defense: implementations must allow players to set their own client seeds independently and refresh them at will.
GLI-19 Certified System Exploits
GLI certification certifies a specific software build at a specific point in time. Operators who modify certified builds post-deployment bypass the certification guarantee. Documented cases include operators disabling certified RNG modules during peak hours and substituting deterministic output, resetting PRNG seeds to a fixed value under certain bet size conditions, and deploying modified RTP tables that reduced payout rates below certified levels. All of these attacks exploit the point-in-time nature of GLI certification – the seal attests to what was submitted, not what is currently running.
Defense: continuous runtime integrity verification (hashing the running binary against the certified hash at regular intervals), independent RTP sampling by regulatory bodies, and real-time reporting obligations enforced by regulators. This is precisely the gap eCOGRA’s operational audit model was designed to close.
The PRNG Seed Prediction Attack
Both provably fair and GLI-certified systems are vulnerable to seed prediction attacks if the entropy source is weak. In 2023, a widely reported vulnerability in a European online casino’s software PRNG allowed researchers to predict slot outcomes by reverse-engineering the seed initialization routine – which used system time at millisecond resolution as the sole entropy source. The casino held GLI certification, and the certified game passed all statistical tests because the PRNG algorithm was sound; the vulnerability was in the initialization, not the algorithm itself. Defense: entropy sources must combine multiple independent sources (OS entropy pool, hardware events, network timing jitter) and must not be seeded from any single, externally observable value.
Interoperability: Can You Run Both Simultaneously?
A practical question operators rarely see answered: is there an architecture that satisfies both provably fair player expectations and GLI-19 regulatory requirements simultaneously? The answer is yes, with caveats.
The Hybrid Architecture Pattern
At the code level, provably fair and GLI-certified RNG are not mutually exclusive. A game can use a GLI-certified PRNG as its core random number source while wrapping each output in a commit-reveal protocol for player-facing verification. The certified PRNG produces the output; the commit-reveal layer commits to a hash of that output before the round and reveals the underlying seed after. Players can verify the commitment chain; regulators can verify the certified algorithm. The technical implementation requires that the commit-reveal wrapper not modify the PRNG’s output sequence – it must be a pure transparency layer.
The challenge: GLI certification tests a specific binary. Adding a commit-reveal wrapper constitutes a material modification that triggers recertification. Studios that want to offer both layers must submit the wrapped implementation for GLI-19 testing – which adds 6–8 weeks and $15,000–$25,000 per title to the certification process.
Jurisdictional Mismatch Risk
Operators running hybrid implementations in multiple jurisdictions face a specific risk: a Curacao-licensed version (provably fair, no GLI) and a UKGC-licensed version (GLI-certified, no provably fair) of the same game title may share a codebase but must be separately certified. Any shared component that affects randomness generation – configuration files, seed initialization routines, build flags – must be audited to ensure it does not introduce cross-contamination between certified and uncertified builds. This is not a theoretical risk: several studios have received UKGC enforcement notices after deploying Curacao-configured builds in UK player sessions due to CDN or geolocation misconfigurations.
Market Structure: The RNG Certification Industry in 2026
The global market for RNG testing and certification is larger than most operators realize. Yield Sec’s Q1 2026 intelligence report estimated total annual spend across GLI, BMM Testlabs, and iTech Labs at over $280 million – driven by the combination of US market expansion (New Jersey, Pennsylvania, Michigan, Connecticut, and emerging states), the continued growth of MGA-regulated operators serving European markets, and the maturation of LatAm regulated markets including Brazil’s newly licensed iGaming sector.
US Market Expansion Driving GLI Revenue
US state-regulated iGaming is the primary growth driver for GLI’s certification business. Each state that opens to online gambling creates demand for mass certification of game titles previously approved in other states. While some states have reciprocal certification arrangements (New Jersey and Michigan accept each other’s approved games, reducing testing duplication), each new state entry typically requires local regulatory review and often retesting of key game mechanics. Studios entering the US market for the first time face certification costs of $500,000–$1,000,000 for their initial title batches, making the US the highest-cost market to enter from a certification perspective.
The $280M Certification Market and Consolidation Pressure
At $280 million annually, the RNG certification market is large enough to attract consolidation. GLI’s parent company, Gaming Laboratories International Inc., has maintained independence, but BMM Testlabs merged with international operations through its parent company’s acquisition activity. The certification market’s growth creates structural pressure on smaller studios: certification costs that represent 5% of a large studio’s annual revenue can represent 100% of a small studio’s annual budget, forcing smaller operators to license pre-certified content from large studios rather than developing proprietary games.
