RNG Testing and Casino Game Fairness

An unpredictable RNG does not, by itself, make a casino game fair. The software might map random numbers incorrectly or pay according to the wrong table. Nor does a “certified RNG” logo establish what was actually tested. Independent testing checks the generator, the rules linking its output to the result and the version running at the casino. A New Zealand operator’s licence is a separate question.

What does an RNG do in an online casino?

An RNG supplies random values for digital casino games. Online pokies map them to reel stops and symbols; RNG roulette maps them to a winning number. Digital blackjack, baccarat, poker, bingo and keno may use the values to shuffle or select cards, balls and numbers. The game maths, paytable and probability mapping-not the generator alone-determine the odds and payouts.

Casino software commonly uses a pseudo-random number generator (PRNG): an algorithm produces a sequence from its internal state. With a properly implemented cryptographically secure PRNG (CSPRNG), outsiders cannot feasibly predict the next output without access to protected information. The seed, entropy source and re-seeding process are part of that security. Hardware randomness is another approach, but a label such as “true random” says nothing about whether the casino’s game mapping is correct.

How a random value becomes a result

1. Initialisation: the software establishes a seed and internal state without exposing values that would allow prediction.
2. Generation: the RNG produces raw output. Tests examine its statistical properties and resistance to predictable patterns.
3. Scaling and mapping: the game transforms raw numbers into reel positions, card orders or other game outcomes. Poor mapping can introduce bias even when the original generator is sound.
4. Settlement: the game applies the published rules, paytable, bet size and any applicable jackpot logic to calculate the result and payout.
5. Recording: the gaming platform retains transaction and game-event information needed to reconstruct errors and investigate disputes.

Random values need not make every prize equally likely. A pokie may assign different probabilities to different symbols, as long as the outcome mapping agrees with its approved mathematics. Statistical independence concerns the relationship between draws: one completed spin does not change the chance of the next independent spin. Ten losses in a row do not make a win due, and a jackpot does not make the following spin less likely to win.

What independent game testing checks

A laboratory tests a specified game, system and software version against the standards relevant to its assessment. It may inspect source code, RNG settings, game mathematics, rules, payout handling and the platform integration. Passing a generator test does not certify every game built around that generator.

A source-code review shows how the generator is configured. Testers also collect raw RNG output, check the results the player sees and simulate large numbers of rounds. Frequency and chi-square tests, runs tests and serial-correlation checks can expose particular patterns. NIST SP 800-22 may help answer a suitable question; it cannot replace tests of game mapping and payouts.

Check what build the report identifies. Version numbers, test parameters, report references and a SHA-256 code checksum can connect a certificate to the released software. A later software or platform update may need a fresh assessment. Penetration tests and vulnerability scans concern system security; they cannot replace checks of game mathematics. No finite test guarantees fault-free software.

RTP, house edge and winning streaks: what fairness does not promise

Return to Player (RTP) describes the theoretical proportion of total stakes a game pays back over extensive play. At 96% RTP, the expectation is NZ$96 returned per NZ$100 staked across a sufficiently large aggregate. It is not a forecast for one person staking NZ$100. In this example, the theoretical house edge is 4%; individual sessions can be nowhere near either figure.

Volatility describes the spread of payouts, while hit frequency counts how often a spin returns something. Frequent small wins may still leave a player down overall. A low-hit-frequency game may pay occasional large prizes. Neither measure replaces RTP, and bonus rounds, progressive jackpots and side bets need to be accounted for in the relevant game model.

Game certification checks whether the implemented paytable and probabilities produce the stated theoretical RTP. A separate audit may compare observed RTP in server logs with the expected figure over a suitable sample. A brief divergence is not proof of tampering; a persistent, unexplained one deserves a closer check. The same pokie title may also have several approved RTP variants, so the version and configuration matter.

Millions of simulated rounds can expose faults that a few hundred real spins miss. They cannot predict a particular session. The gambler’s fallacy treats earlier losses as if the next independent spin must compensate for them; the RNG has no such obligation.

How to tell whether a casino's testing certificate is meaningful

A genuine certificate identifies the software and the work performed. A testing seal in a casino footer has little evidential value unless its issuer and scope can be traced.

1. Identify the issuer. Establish which laboratory performed the assessment and whether that legal entity is accepted for the relevant jurisdiction and type of work. International recognition alone does not establish New Zealand regulatory approval.
2. Open the original record. A certificate or audit report hosted or authenticated by the laboratory carries more weight than a static image uploaded by the casino. Look for a report number, issuing organisation and a way to validate it.
3. Read the scope. Determine whether it covers the RNG, a specific game, an entire platform, integration testing, or recorded RTP performance. An RNG certificate cannot stand in for a game certificate.
4. Match the product. Compare the named operator, game supplier, game title, platform, supported jurisdiction, software version and available RTP configuration with the product on offer.
5. Check dates and status. An old certificate may refer to retired software; a newer game or major RNG update may need further assessment. Check for expiry, suspension, replacement or other limitations stated by the issuer.
6. Check the operator separately. A certified game supplied to a casino does not establish that the casino itself has a valid operating licence, reliable payments or adequate consumer protections.

A dead seal link, a report issued to an unrelated company, a bare “100% fair” promise or an RTP that disagrees with the game’s help screen all warrant scrutiny. The casino should identify its supplier and the assessment covering the actual game. Some labs do not publish full reports, so the lack of a public download is not, by itself, proof of misconduct.

Which laboratories test casino games?

eCOGRA, Gaming Laboratories International (GLI), iTech Labs and BMM Testlabs provide gambling technology testing services. International compliance materials also refer to Gaming Associates, Quinel, NMi, SIQ, Global Lab, RiskCherry and Technical Systems Testing (TST). Their work can concern RNGs, game maths, platforms, integration or operational audits. Recognition of a laboratory does not mean it has certified a particular game-or that its approval applies in New Zealand.

GLI’s RNG testing submission requirements seek game parameters, raw and final-outcome data, production-like software and relevant source code. eCOGRA's RNG certification process covers statistical behaviour, code and seed generation. iTech Labs distinguishes game and RNG certificates from server-log audits and platform or integration testing.

GLI announced approval in October 2026 to test for New Zealand’s emerging regulated online-casino market. BMM announced its New Zealand online gaming approval later that month. These approvals cover laboratory work, not every casino or game it may inspect.

New Zealand rules for RNGs and independent testing

New Zealand’s Online Casino Gambling Act 2026 established a licensing regime being introduced in stages. As at November 2026, Department of Internal Affairs (DIA) guidance for players expects the first licences from early 2027. Being selected to apply is not the same as holding a licence. Neither an overseas licence nor a lab seal establishes New Zealand licensing.

The Online Casino Gambling (Minimum Standards) 2026 came into force on 8 July 2026. The requirements for operators within the new regime address both technical fairness and player protection:

• Standard 14 - random number generation: RNG output and game results must be acceptably random. Software PRNGs must be cryptographically secure, unpredictable and appropriately distributed; seeding, re-seeding and multiple RNG instances must not introduce repeatability or synchronisation. Scaling and mapping must preserve the certified distribution and not introduce bias or correlation.
• No adaptive outcomes: compensated games are prohibited. The software must not subsequently discard or manipulate selected outcomes, including in response to platform load.
• Ongoing integrity monitoring: the platform must dynamically monitor RNG output and immediately deactivate an affected game when an RNG anomaly, degradation or failure is detected.
• Standard 13 - informed decisions: customers must have access to game rules, winning odds and the theoretical RTP expressed as a percentage; games must show the customer's net position during play.
• Standard 15 - live dealers: suitable commercial-grade equipment, controlled access and video surveillance are required to protect physical game integrity.

Other provisions cover interrupted rounds, settlement or restoration of bets, progressive jackpots, audit trails, security and information displayed during play. Rules on game speed, starting each round deliberately and preventing automatic slot replay also address gambling harm.

DIA also published Testing and Monitoring Requirements as a discussion draft. Its proposed Game and RNG Register, named testing facilities and submission arrangements should not be described as final rules. A draft, the Act, the minimum standards and an individual lab approval have different legal roles.

Are pokies, roulette and live-dealer games tested the same way?

The underlying source of randomness determines what testers need to inspect.

• Online pokies: testing centres on virtual reel mapping, symbol weights, bonus triggers, volatility, theoretical RTP, the paytable and any progressive jackpot. Names such as NetEnt, Pragmatic Play, Play'n GO or Games Global identify suppliers, not proof that a particular game build is certified.
• RNG roulette and digital table games: the laboratory examines the digital random selection, rule logic, payment of bets and any card-shuffling method. Blackjack returns also depend on the stated rule set and player decisions, so a single advertised RTP may not describe every style of play.
• Live-dealer roulette, blackjack and baccarat: results come from physical equipment and dealer actions rather than an RNG selecting each card or wheel number. Cameras, surveillance, shoe or wheel integrity, controlled access and accurate settlement become central. Evolution and Playtech are examples of suppliers whose brand identity must not be confused with proof of a specific live table's compliance.
• Peer-to-peer poker and bingo: card or ball selection, player separation, collusion controls, transaction records and game rules matter alongside randomness. A system should not allow a player to occupy multiple seats at the same table under New Zealand's applicable standards.

Some crypto casinos call their games provably fair. A commitment scheme can combine a server seed, player seed and nonce and use a hash such as SHA-256. After the server reveals its seed, the player can reproduce a result and check for certain retrospective changes. That check does not establish whether the paytable is correct, the full code is secure, the casino holds the right licence or withdrawals will be honoured.

Can an operator change a game after certification?

A certificate can become outdated when a supplier changes the RNG library, reel mapping, game engine, remote server or payout configuration. Version control, integration tests and re-testing help establish whether the new build still falls within the original assessment. Changing a screen illustration is different from changing reel weights or the way cards are selected.

A casino may offer an approved RTP variant, but it cannot lawfully compensate for a player’s losing streak under New Zealand’s Minimum Standard 14. The standard prohibits adaptive outcomes and later interference with selected results. Session history alone cannot tell ordinary variance from defective code or manipulation.

What evidence matters when a game looks wrong?

For a disputed round, the useful evidence is specific: casino, supplier, game, New Zealand date and time, account or session reference, round ID, stake, displayed result, expected payout and any error message. Screenshots, game history and transaction records help trace what happened. Keep passwords and full card details out of a complaint.

A losing streak is not evidence of RNG failure. A payout that contradicts the paytable, a duplicate settlement, an unexplained void or a conflict between the displayed result and game history gives the operator a specific round to trace. Its server logs should help reconstruct the event. An available regulator or approved dispute channel may review an unresolved complaint, subject to the operator’s licence.

RNG certification is not the whole of casino safety

Correct game outcomes do not prevent stolen accounts, delayed withdrawals, misleading offers or gambling harm. Casino safety also involves licensing, age and identity checks, authentication, encryption, audit logs, privacy, customer support and safer-gambling controls. ISO/IEC 27001 addresses information-security management; ISO/IEC 17025 concerns laboratory competence. Neither certifies a game’s RTP. HTTPS encrypts the connection, but it does not audit the casino’s mathematics.

New Zealand’s 2026 minimum standards include deposit, spend and time limits, breaks, time-outs and self-exclusion. An independently tested RNG cannot prevent harmful play or make losses recoverable by continuing to gamble. Gambling Helpline New Zealand provides support on 0800 654 655 and by text on 8006; Safer Gambling Aotearoa offers further resources.

Frequently asked questions

Can a player predict an RNG after watching enough spins?

Watching previous spins cannot reveal the next output of a correctly implemented CSPRNG. Weak seeds, flawed code and predictable algorithms create vulnerabilities, not dependable betting systems.

Does an eCOGRA or GLI logo guarantee fair play?

No. A seal must match the game or system, version and jurisdiction. RNG certification, game testing, operational audits and casino licensing cover different questions.

Does 96% RTP mean losing only NZ$4 on every NZ$100?

No. The 96% figure describes expected payouts over a very large total of stakes. One player can lose the full NZ$100 or finish ahead; a small sample does not validate theoretical RTP.

Can a casino legally make a pokie pay more after losses?

Minimum Standard 14 prohibits compensated games. An independent draw does not become more favourable after losses, even when a long run feels unusual.

Is independent testing the same as a New Zealand casino licence?

No. Laboratories test specified technology. DIA administers New Zealand’s operator licensing regime, phased in across 2026-2027. A test report, an application and a granted licence are not interchangeable.