Almost every online slot you played in 2025 was decided by a pseudo-random number generator — a deterministic algorithm seeded once and run forward — not by a physical source of true entropy. That is not a scandal. It is the disclosed industry standard, and the certification bodies operators cite test for exactly that. The interesting part is what the audit scope does *not* cover.
This piece walks through what listed operators and their certifiers actually put on the public record about RNG implementation. We use the published audit scopes, the operator filings, and the certificate registries — and we flag where the marketing surface runs ahead of the document.
What Does "RNG Certified" Actually Mean on an Operator's Page?
It means a testing lab ran statistical randomness tests against the algorithm's output and signed off. It almost never means the operator runs a hardware true-random generator.
Take the scope language operators cite. Flutter Entertainment's games are tested by Gaming Laboratories International, and the disclosed GLI scope reads: "RNG statistical randomness tests (NIST 800-22), game math verification against paytable specification, RTP empirical validation across 10M simulated rounds." Read that carefully. NIST 800-22 is a battery of statistical tests for *pseudo*-random sequences. It is the standard you apply to a deterministic generator to confirm its output is indistinguishable from random. The certificate confirms the PRNG is well-behaved. It does not certify a true-entropy source, because there usually isn't one to certify.
Is Pseudo-RNG Less Fair Than True-RNG?
No — and the distinction matters less than the marketing dichotomy suggests. A properly seeded, audited PRNG that passes NIST 800-22 produces outcomes that are statistically unpredictable to a player. The fairness question is not "pseudo or true." It is "who seeds it, how often, and who checks."
That is where the certifier's re-audit cadence becomes the real disclosure. Bet365's slot content is certified by iTech Labs, and the disclosed audit frequency is specific: "Quarterly per deployed game; annual re-certification for RNG seed; incident re-audit within 48h if dispute raised." The seed is re-certified annually. The 48-hour dispute clause is the part players never read. A true-RNG label tells you nothing about any of this. The cadence tells you everything.
*The iTech Labs certificate registry lists per-game certificates, not per-operator. We checked. You match the game studio, not the brand.*
Where Does the Audit Scope Stop Covering You?
The scope stops at the math model. It does not extend to the operator's server-side configuration, the session handling, or the live-dealer products — which aren't RNG-driven at all.
This is the gap. The GLI scope Flutter cites validates RTP "across 10M simulated rounds" against the paytable specification. Simulated. In a lab. It confirms the game *can* pay the certified rate over a large sample. It says nothing about the specific RTP variant an operator deploys in a given jurisdiction, because studios ship multiple RTP builds of the same title. NetEnt's published slot range runs 94.00 to 96.70 percent. That is a 2.7-point spread on the same catalogue. The certificate covers the build; the operator chooses which build goes live. Two players on "the same certified slot" can sit on different math.
Are Live Dealer Games Even RNG Games?
No. Live dealer outcomes come from physical cards and physical wheels in a studio, which makes the entire pseudo-versus-true RNG debate irrelevant to that product line — and operators rarely make that clear.
Evolution publishes the RTP for its live tables directly: European Roulette at 97.30 percent and Blackjack at 99.28 percent. Those figures derive from the fixed rules of the game, not from a random number generator at all. The wheel is the entropy source. So when an operator's homepage flattens "all our games are RNG-certified for fairness" across a catalogue that includes live tables, the claim is technically incoherent — the live product is governed by game rules and studio supervision, audited on a different basis entirely. The marketing collapses two unrelated fairness regimes into one badge.
Which Operators Actually Disclose Their RNG Implementation?
Almost none disclose the *implementation*. They disclose the *certifier*. There is a difference, and it is the whole story.
Across the filings we pulled, the pattern is uniform: operators name the lab and the certificate type, never the generator architecture. Flutter lists GLI and eCOGRA. Entain lists GLI and eCOGRA. Bet365 lists iTech Labs plus GLI. DraftKings adds BMM Testlabs for "RNG, RTP, geolocation compliance." Every one of these is an attestation that *a third party tested the output* — not a published spec of the seeding mechanism, the entropy pool, or the reseed interval. The implementation lives behind the certifier, and the certifier's scope is the only window the public gets.
*We searched four operator investor pages for the words "entropy" or "seed." Zero hits. The word that appears is "certified."*
What Do the Certification Bodies Test That Operators Don't Mention?
They test game math against the paytable, RTP empirically, and the statistical quality of the sequence — but the scope is narrower than the badge implies. The badge says "fair." The scope says "this build, this math, this sample size."
Here is the cross-reference that exposes it. GLI's disclosed scope for Flutter covers "game math verification against paytable specification." BMM's disclosed scope for DraftKings covers "RNG, RTP, geolocation compliance, responsible gaming system testing." Both are operative certifications. Both are real. But notice that BMM's scope explicitly bundles *responsible gaming system testing* into the same audit, while GLI's does not — GLI tests the math, eCOGRA handles "operator safety (seal program), player dispute mediation." The operator presents one unified "certified and safe" surface. The labs divide the work into separate scopes with separate boundaries. The reader assumes one audit covered everything. It didn't.
Does a Tier-1 License Force True-RNG?
No regulator in the tier-1 English-speaking set mandates true hardware RNG. They mandate testing against recognised standards by an approved lab — which a compliant PRNG satisfies.
The enforcement record confirms where regulators actually focus, and it is not the generator. When the UKGC fined a Flutter UK licensee £1.17m in March 2023, the scope was "social responsibility and anti-money laundering controls" — not RNG integrity. When Entain settled for £17m in August 2022, the failures named were customer-interaction and AML, again not randomness. The pattern across the UKGC public register is consistent: enforcement targets player-protection and AML failures, while RNG fairness is handled upstream by the lab certification regime. The generator is a solved compliance problem. The player-protection layer is where operators get fined.
How Often Is the RNG Actually Re-Tested?
It depends entirely on the lab and the contract — and that cadence, not the pseudo-versus-true label, is the variable that matters for a player.
The only operator in our dataset with a fully disclosed cadence is Bet365 via iTech Labs: quarterly per game, annual seed re-certification, 48-hour incident re-audit. That is a tight loop. Compare it to the certificate *dates* the other operators publish — Flutter's GLI cert dated 2024-10-01, Entain's 2024-11-15, DraftKings' 2024-12-15. A dated certificate is a snapshot. It tells you the build passed once. Without a published re-test interval, you cannot tell whether the live game today matches the build that was certified last autumn. The cadence is the disclosure that protects you. Most operators publish the date and omit the interval.
What Should a Player Read Instead of the "True-RNG" Badge?
Read three things: the named certifier, the certificate's scope language, and — if you can find it — the re-test cadence. The pseudo-versus-true framing is largely a marketing artifact.
The honest summary of the 2025 public record is this. The generator is almost always a pseudo-random algorithm, audited against NIST 800-22, and that is fine. The fairness risk does not live in the algorithm class. It lives in the gap between the certified build and the deployed build, in the RTP variant the operator selects from a 94.00–96.70 percent range, and in how often anyone re-checks. Operators disclose the certifier readily. They disclose the scope reluctantly. They disclose the cadence almost never.
FAQ
Is true-RNG safer than pseudo-RNG for online casino games in 2025?
Not in any way the public record supports. A pseudo-random generator that passes the NIST 800-22 battery — the test GLI runs in its disclosed scope — produces outcomes a player cannot predict. Tier-1 regulators like the UKGC and certifiers like iTech Labs and BMM accept audited PRNGs as standard. The meaningful safety variable is the re-test cadence and the certifier's scope, not whether the entropy source is physical hardware.
Which certification body tests the casino I'm playing on?
You have to match the game studio, not the operator brand. Flutter and Entain both cite Gaming Laboratories International and eCOGRA; Bet365 cites iTech Labs plus GLI; DraftKings adds BMM Testlabs. The certificate registries — such as GLI's at gaminglabs.com — list certificates per deployed game, so the same brand can carry slots audited by different labs depending on the studio that built each title.
Does a UKGC or MGA license guarantee the RNG is fair?
It guarantees the operator used an approved testing lab against recognised standards — not that a regulator personally inspected the generator. The UKGC's enforcement focus is elsewhere: its 2023 £1.17m Flutter settlement and 2022 £17m Entain settlement both concerned social-responsibility and AML failures, not RNG integrity. Randomness is handled upstream through lab certification; the regulator polices player protection and money-laundering controls.
Why can the same slot pay a different RTP at two different casinos?
Because studios ship multiple RTP builds of one title, and the operator chooses which to deploy. NetEnt's published slot range spans 94.00 to 96.70 percent — a 2.7-point spread on identical-looking games. The lab certifies the specific build; the operator selects the variant for a given jurisdiction. Two players on "the same certified slot" can sit on materially different math, and the badge won't tell them which.
Do live dealer games use RNG at all?
No. Live dealer outcomes come from physical cards and wheels in a studio, so the pseudo-versus-true RNG debate does not apply to them. Evolution publishes those RTPs directly — 97.30 percent for European Roulette, 99.28 percent for Blackjack — derived from fixed game rules rather than a generator. When an operator's homepage applies one "RNG-certified" badge across both slots and live tables, it is conflating two unrelated fairness regimes.
How can I tell when a game's RNG was last audited?
Look for the certificate date and, more importantly, the re-test interval — though most operators publish only the former. Flutter's GLI certificate is dated October 2024; Entain's November 2024. Those are snapshots. Bet365 is the rare case with a disclosed cadence via iTech Labs: quarterly per game, annual seed re-certification, and a 48-hour re-audit if a dispute is raised. Without a stated interval, a dated certificate only proves the build passed once.
What does "NIST 800-22" mean on a certificate?
It is a US-government statistical test suite for evaluating random and pseudo-random sequences. When GLI's disclosed scope lists NIST 800-22, it is confirming the operator's generator output is statistically indistinguishable from random across the battery. Crucially, this is the standard you apply to a *deterministic* PRNG — its presence on a certificate is itself a quiet confirmation that the generator is pseudo-random, not a physical true-entropy source.