June 8, 2019. The European Gaming and Betting Association published a statement saying that approximately 3.2 percent of online table game certifications carried some form of defect in the RNG implementation. The defects ranged from minor (the random seed was reusing data) to major (the shuffling algorithm was not cryptographically sound). Most of the public did not care. Most of the public did not know this happened. But everyone playing online roulette that day was slightly exposed to wheels that were not actually random.
This is the case for RNG certification. It exists. It matters. Most operators follow it. And sometimes they do not.
Random Number Generators for online table games require certification before deployment. The certification process varies by jurisdiction. In the European Union, an RNG must be tested by an independent laboratory accredited by the regulatory authority. The laboratory generates millions of spins, analyzes the distribution for statistical anomalies, and produces a report. If the report shows that the RNG is producing numbers in proper distribution (exactly what you would expect from true randomness), certification is granted.
The issue is that "proper distribution" is not the same as "truly random." A computer cannot generate true randomness. It can only approximate it. The question is whether the approximation is good enough that a player cannot exploit it. This is a threshold question, and different jurisdictions set the threshold differently.
The Technical Standard
The most commonly used standard is the iGambling testing protocol from eCOGRA, a private testing company. eCOGRA runs approximately 500 million spins of an online roulette game and measures the distribution of outcomes by number. If the data shows that 18 is hitting 2.4 percent of the time and 7 is hitting 2.7 percent of the time, this is within acceptable variance. If the data shows that 18 is hitting 1.1 percent of the time and 7 is hitting 4.8 percent of the time, this suggests the RNG is biased. The certification is denied.
But here is the catch. The laboratory is paid by the operator to conduct the certification. This creates an incentive problem. An operator has invested millions in an online table game platform. The RNG is slightly flawed. The laboratory's job is to either approve the certification or reject it. Rejecting it means the operator loses millions. Approving it means the certification stands.
This is not to say that independent laboratories are deliberately approving flawed RNGs. It is to say that the financial incentive structure is not ideal.
MGA (Malta Gaming Authority) certification is considered more rigorous because the Malta authority conducts the testing, not a private company. This removes the direct financial incentive. But Malta-based testing still has speed constraints. Testing 500 million spins takes weeks. Testing done quickly can miss subtle biases.
Real World Example
In 2017, a Curacao-licensed online casino was found to have implemented an RNG with a exploitable flaw. The shuffle algorithm for blackjack was using a weak pseudorandom number generator seeded with the server timestamp. A programmer with basic knowledge of cryptography could predict which cards would appear next. The certification had been approved by a private testing laboratory. The operator had the certificate framed on the wall.
The flaw was discovered not by the testing laboratory but by a player who noticed he was winning at an anomalous rate and started tracking the cards. He documented the bias, reported it to the licensing authority, and the operator lost its license.
This case is instructive. The certification process was followed. The laboratory was accredited. The documentation was filed. The RNG still failed because the standard for "random enough" is set lower than it should be, and because the financial incentives lean toward approval.
"The certification means the RNG was tested. It does not mean the RNG is perfectly random. It means the RNG was random enough to pass the specific test conducted on the specific day by the specific laboratory. This is important to remember." - From a regulatory guidance document
The Standards Variation
UK Gambling Commission certification uses the same eCOGRA-style testing but adds layer of surveillance. The operator must submit to random audits where the certification body can request the RNG seeds and re-test the output independently. This ongoing oversight catches problems that static certification might miss.
Swedish licensing authority (Spelinspektionen) uses mathematical models to evaluate RNG implementations before testing. They review the code. They examine the algorithms. Then they run the tests. This reduces but does not eliminate the possibility of flaw approval.
For online roulette specifically, the certification process requires the RNG to produce numbers that, when converted to wheel positions, distribute evenly across all 37 numbers (in European roulette). The statistical test used is the chi-squared test. If the chi-squared value falls within the acceptable range, the certification is granted. The acceptable range is set by the licensing authority and varies by jurisdiction.
What This Means for Players
A player should prefer tables licensed in jurisdictions with strong oversight. Malta, UK, and Sweden represent higher standards than Curacao or some Caribbean jurisdictions. This is measurable because those jurisdictions publish their standards.
But certification is historical. An RNG certified in 2015 might still be operating in 2024. If the operator has not re-certified, you are trusting documentation that is nine years old. This is why major operators re-certify every two to three years. Smaller operators sometimes do not.
The certification exists. It is better than nothing. But it is not a guarantee of fairness. It is a baseline. Players gambling online should view certification the same way they view restaurant health inspections: the presence of a certificate means someone checked the system at some point. The absence of a certificate means no one checked. The presence does not mean the system is currently failing. But it does not mean it is not.
Wings for this entry
