How RNG and Game Fairness Are Audited in Online Casinos

At 8:12 a.m., an auditor boots a clean test PC. A sealed build of a slot arrives with a hash. The lab logs the hash, signs the receipt, and loads tools. Millions of spins run while coffee cools. A second machine checks a shuffler’s seed data. A third verifies that the math sheet and the code agree. By noon, reports line up: pass or fail. In the evening, a certificate gets posted, or the build goes back to the studio with notes. This is how real “fair” is made, one check at a time.

What Auditors Actually Do All Day

Auditors do not guess. They trace. First, they receive a build straight from the game maker. They verify the file hash so no one has changed a single byte. They lock the test plan. Then they test the RNG (random number generator), the game math, logs, and the way the server and client talk to each other. If the game uses a live shuffler, they inspect that device too. They check change control: who can push a new version, and how it is signed.

Good labs follow strict rules. They are ISO/IEC 17025-accredited labs, which means a national body checks their methods and gear. They also map each test to a regulator’s rules, so the work stands up in court if needed. The point is simple: no bias, no guesswork, and no silent edits after approval.

The Part Players Never See: RNG Isn’t Just a Buzzword

RNG is the engine that picks numbers for reels, cards, dice, wheels, and bonus events. In most online games it is a PRNG (pseudo random number generator). It takes a seed and gives out numbers that look random. Good PRNGs pass hard tests so they cannot be used to predict future outcomes. Some setups also use hardware entropy to feed the seed.

Where does RNG live? Often on the server. In some setups, the client requests numbers from the server through a secure call. For live games, certified shufflers or draw devices run their own RNG or a fair mechanical process. Each path is tested in the lab and again when code changes.

Myth vs reality

Myth: “RNG makes wins happen on a timer.” Reality: RNG does not know time. Each event is fresh.
Myth: “Casinos flip a switch to make you lose.” Reality: In regulated markets, code and builds are locked. Silent edits fail audits.
Myth: “RNG is the same as RTP.” Reality: RNG picks outcomes; RTP is the long-run average return of a game’s math.
Myth: “Provably fair replaces labs.” Reality: It adds checks in crypto setups but does not replace full audits in most regions.

What “Fairness” Means in Practice

Fairness is not a vibe. It is a set of checks that match the game’s math to what you play. Each slot or table game has a paytable and a math model. That model sets the RTP (return to player) and volatility. RTP is the long-run average return across huge play. Volatility tells you how bumpy that ride can be. A high-volatility slot may “feel cold” for a while, then hit big. That feeling does not mean the game is broken; it is how the math spreads wins.

Many regulators explain what they expect. The UK, for example, sets terms for testing, change control, and display rules in its UK remote technical standards (RTS). In short: the declared RTP must match the approved math, logs must be kept, and any change must be tested again. Some markets also ask for reports that compare actual payout over time with the approved figures.

The Standards and the Maze: Who Certifies What

Labs test games and systems against clear standards. For online platforms, a common baseline is GLI-19 Interactive Gaming Systems. It covers RNG, game math, reporting, security, and more. Studio teams read this like a checklist while they build.

Live card games and shufflers have their own guide. GLI-29 Card Shufflers sets rules for fair shuffles and device RNG. Auditors check that a machine cannot bias a shoe or reveal a pattern.

Who says a casino can offer games at all? That is the regulator. In Malta, you can look up a license in the Malta Gaming Authority licence register. In New Jersey, the Division of Gaming Enforcement lists tech rules and updates at New Jersey DGE Technology. In Ontario, online rules live in the AGCO Registrar’s Standards for Internet Gaming. Each one ties back to lab work and ongoing checks.

Who Audits What: RNG and Game Fairness at a Glance

RNG algorithm & seeding	Unpredictable, unbiased results	GLI, eCOGRA, iTech Labs, BMM, QUINEL	NIST-style test suites, long-run sims	On release + after major code changes	iTech Labs public certificates
Game math & paytables	RTP and volatility match declared values	Same labs	Math proofs, Monte Carlo, model review	On release + updates	Lab cert + regulator pages
Live shufflers / draw devices	Fair shuffles and draws with no bias	GLI (GLI-29), BMM	Cycle tests, device RNG checks	On device changes	Lab standard refs (GLI-29)
Change management & version control	Stops untested code from going live	Regulator + labs	Hash checks, signed builds, audit logs	Continuous	Regulator tech standards
Payout reporting & logs	Aligns actual returns with approved math	Regulator	Periodic reports, system audits	Periodic (as set by market)	Regulator portals
Jurisdiction compliance	Game fits local law and display rules	Regulator + labs	Conformance checklists	On market entry	Public licence registers

Want to see what a test lab looks like? Here is how one lab explains its scope: eCOGRA testing services. It shows their role as an independent testing facility for games and systems.

How to Verify a Casino’s Claims in 3 Minutes

Step 1: Find the licence. Scroll to the footer. Look for the badge of the regulator. For UK sites, click through to the public entry and match the domain and company in the UKGC licence search. For other markets, use their own public register.

Step 2: Find lab seals. Common seals include eCOGRA, iTech Labs, GLI. Click the seal. It should open a page on the lab’s site, not a local image. Check the company name, game or system name, and date.

Step 3: Check game info. Open the game’s info panel. Look for the RTP figure and version. Match it to what the casino claims on its help pages. If a patch note says “math change,” a new test should exist.

Edge Cases and Red Flags

Old seals are a flag. A lab page with no date, or with a firm name that does not match the casino, is a risk. A “badge” that is just a PNG with no link is a red flag too. So is a help page that lists one RTP, but the info panel in the game shows a lower one. Another flag: different versions by region with no clear note. This is allowed in some places, but the site should make it clear.

Watch out for “copycat” seals. Real lab seals link to the lab’s domain. Fake seals link to the casino’s own site. If in doubt, search the lab’s own directory by brand or by game. If a support agent gives an excuse like “we cannot share the link,” push back politely or leave.

Where “Provably Fair” Fits In (Crypto Context)

Some crypto sites use “provably fair.” It means the site shows a commitment (a hash) to a server seed before your bet. You add a client seed. After the round, the site reveals the server seed so you can verify the hash. This is good for trust between you and the site. But it does not replace full audits, change control, and regulator checks. For RNG design in general, you can see how standards talk about generators here: NIST SP 800-90A (DRBG).

Before You Deposit: A Preflight Checklist You Can Save

Licence: Find it, click it, and match the legal name.
Lab seal: Click through to a live page on the lab’s site. Check the date and scope.
Game info: Check RTP and version inside the game. Match to help pages.
Updates: Scan news or patch notes. Math change means re-test.
Payments: Read payout rules. Slow cashout can be a sign of stress at the site.
Complaints: Search the brand name + “complaint.” Note patterns.

Want a second set of eyes? Cross-check certifications and complaint history on a trusted, independent review site like https://casinoswelt.com/. It is a quick way to see licence status, lab seals, and user notes in one place.

How Labs Test RNGs (For the Curious)

Labs run a lot of spins. But they do more than that. They look for bias and patterns with formal tests. One well-known suite is the NIST SP 800-22 test suite. It has tests for frequency, runs, block frequency, spectral patterns, and more. The goal is to see if the bits from the RNG look like true random bits in many ways, not just one.

The seed is key. A weak seed can make a strong PRNG weak in practice. Labs check how the seed is made and stored. If hardware entropy feeds the seed, they may look at guidance like NIST SP 800-90B (Entropy Sources). Then they test for state leaks and cycle length. For server RNGs, they test the secure link so a man-in-the-middle cannot swap numbers.

Math review pairs with RNG tests. Auditors confirm that hit rates, reel strips, and pay tables add up to the stated RTP. They simulate long play and compare with the proof from the studio. If a bonus draw has a rare branch, they also test that branch in isolation to make sure it pays as set.

If Things Go Wrong: Dispute Paths

First, contact the casino with a clear record: dates, game IDs, stakes, and screenshots. If you are in the UK and the site cannot resolve it, you can use an ADR (alternative dispute resolution) body like IBAS (ADR for gambling disputes). Many sites also use eCOGRA as an ADR; you can file a case at eCOGRA ADR. If the issue is a licence breach, contact the regulator with the case number from the site.

Most disputes are about payments, bonuses, or KYC, not RNG. Still, logs matter. Ask for the game round IDs. A good operator can share these. Labs and regulators can read them if a formal probe starts.

FAQ

Are online casino RNGs truly random?

They are unpredictable enough for fair play. Labs test them with big test suites and long runs. A good RNG has no bias you can use.

What is the difference between RTP and what I feel in a session?

RTP is the long-run average after huge play. Your session is short and can swing high or low. That is volatility at work, not a broken game.

How can I check if a game or casino is certified?

Find the lab seal in the footer or in the help page. Click it. It should open a page on the lab’s site with dates and the brand name. Check the licence in the regulator’s public register too.

Do regulated casinos use “provably fair” systems?

Some crypto sites do. In most regulated markets, full audits, logs, and change control are the main tools. Provably fair can add extra checks, but it does not replace audits.

Can a casino change the RTP after certification?

In some markets, a studio may ship more than one approved RTP model. The site must use an approved one and disclose it. Any change must be tested and logged.

Who do I contact if I think a game is unfair?

Start with the site, then go to the ADR named in the site’s terms. If you think there is a licence breach, contact the regulator with your case notes.

Sources, Author, and Review Notes

Standards and guidance: GLI-19, GLI-29, NIST SP 800-22, 800-90A, 800-90B
Regulators: UKGC RTS, MGA register, New Jersey DGE, AGCO iGaming standards
Labs and ADR: eCOGRA (testing + ADR), iTech Labs certificates, IBAS

Author: Alex Carter, Casino Math and Compliance Lead. I work on slot models, audits, and market entries. I have led math reviews and RNG checks for both studio and operator teams across EU and North America. I write guides so players and teams can verify claims in minutes, not hours.

Last reviewed: September 7, 2026

Disclaimer: This article is for information only and is not legal advice. Rules vary by market. Always check your local regulator’s site.