Requirements for fair play and game integrity attach to a single object: the game build a player loads. GICNT-FP certifies at that level rather than at operator level, because an operating licence says nothing about whether one slot pays what its paytable claims. The domain covers independent testing of randomness and maths, publication of theoretical return, and disclosure of bonus conditions before a player accepts them.
What GICNT-FP Covers and Where Its Scope Ends
GICNT-FP is one of the six compliance domains in the framework and the only one assessed per game rather than per operator. That follows from how failure happens here. A maths error, a mis-scaled RNG output or a paytable that no longer matches the engine affects one title, one build, sometimes one delivery channel. An operator-level review conducted once a year would not surface any of it.
The domain sets requirements in four areas:
- Independent testing of the random number generator and of game maths by a laboratory holding recognised accreditation, completed before release.
- Publication of theoretical RTP, or of house edge or outcome probability where RTP is not the meaningful measure, in a location the player can reach before staking.
- Disclosure of bonus and wagering conditions at the point the offer appears, not after the player has accepted it.
- Reassessment whenever a change touches fairness, supported by a documented classification of every change made to a certified build.
None of this is exotic by regulator standards. What the domain adds is one evidence file covering all four areas across every market an operator serves, so that a supervisor in one jurisdiction can see what a laboratory in another has already tested.
Which Laboratories Meet the Accreditation Test
Requirements for RNG certification are set by the market, not by the operator, and the accreditation of approved test houses is where regulators concentrate. GICNT-FP recognises test reports issued by laboratories accredited to ISO/IEC 17025 for the relevant gaming scope: eCOGRA, BMM Testlabs, iTech Labs, Gaming Laboratories International or equivalent. Recognition follows the accreditation, not the brand of the laboratory, and a report from a body outside the target market’s approved list still fails the local test even where the technical work is sound. That distinction runs through the whole of RNG certification obligations.
| Regulator | Who may certify games and RNGs | Instrument |
|---|---|---|
| UK Gambling Commission | Test houses on the Commission’s published approved list, accredited to ISO/IEC 17025 with selected requirements from ISO/IEC 17065 and ISO/IEC 27002 | Licence condition 2.3.1 and the testing strategy |
| AGCO, Ontario | The Registrar, or an independent testing laboratory registered by the Registrar | Registrar’s Standards for Internet Gaming, standard 4.08 |
| Spelinspektionen, Sweden | Bodies accredited for the control, testing and certification of gambling activities | SIFS 2022:3 |
| Malta Gaming Authority | Approved audit service providers for systems audits and reviews, accredited laboratories for game and RNG testing | Gaming Authorisations and Compliance Directive, Directive 3 of 2018 |
The British list is the most explicit of the four. The Commission publishes which test houses are approved, in which categories, and states that a test house must hold full accreditation to ISO/IEC 17025 before it appears there. The list published on 2 March 2026 remains the operative reference for licensees choosing a laboratory.
Certification Attaches to a Build, Not to a Brand
Certification at game level in iGaming means the certificate names a build. The British testing strategy requires a game report to identify the game name, the theoretical RTP, the software number and the digital signature, plus the platform supplier, the platform version, the channels covered and the versions the build supersedes. Change any of those and the certificate no longer describes what is live.
This is why an operator cannot inherit fairness assurance from a supplier’s reputation. Under standard 4.08 of the Ontario Registrar’s Standards, amended in April 2023, every igaming game, random number generator and outcome-determining component must be approved by the Registrar or certified by a registered independent testing laboratory before it is provided on a gaming site, and the standard extends explicitly to subsequent modifications. Ontario also operates its own laboratory accredited to ISO/IEC 17025:2017, which is unusual among gambling regulators.
A certificate is also silent on lawfulness. It states that a build behaves as documented, nothing more, which is where the boundary between certification and licensing becomes practical rather than semantic.
How a Major Change Differs From a Minor One
The dividing line adopted in Britain is a principle rather than a list: any software change that may affect the fairness of a game is major and needs external retesting. Fairness elements include the RNG, scaling and mapping, and the game rules, meaning the underlying maths, symbol distribution and feature logic, including how the software processes those rules. Everything else can be handled internally under change control. GICNT-FP applies the same test and expects the classification of each change, with its justification, to be recorded before release. Periodicity for the other five domains follows a different logic, set out under review frequency by standard.
| Change to a certified game | Classification | Consequence |
|---|---|---|
| RNG algorithm, seeding or reseeding, scaling and mapping | Major | External retesting before release |
| Paytable, symbol distribution, feature or bonus round rules | Major | External retesting before release |
| Recoding how existing rules are processed, with no rule change | Major | External retesting before release |
| Sound format, artwork, character or background graphics | Minor | Internal testing, logged in change documentation |
| Button alignment or a dialog that renders badly in one browser | Minor | Internal testing, logged in change documentation |
| Platform or RNG update serving many games at once | Major at platform level | Representative sample across game types retested before launch |
Two national approaches sit either side of this. Sweden fixes a clock: under SIFS 2022:3, control, testing and certification protocols must be renewed at least every twelve months, and a material change to the gambling system requires a fresh assessment by an accredited body before release. Britain fixes an audit instead: licensees that procure games testing undergo an annual games testing audit by an approved test house, which samples major and minor updates to confirm they were classified correctly, and the report is due within four weeks of the audit period ending.
Publishing Theoretical RTP Before the Player Commits a Stake
Requirements on RTP disclosure are older and more settled than most operators assume. RTS 3C obliges British licensees to make available, before the customer commits to gamble, a description of how the game works and how winners are determined, together with the house edge or margin, the return to player percentage, or the probability of winning events occurring. The instrument is technical rather than promotional, and it operates alongside the LCCP licensing objectives rather than inside them.
GICNT-FP treats the following as the minimum for the disclosure to count:
- The figure is the theoretical RTP verified during testing, not a marketing approximation or a portfolio average.
- It is reachable from inside the game environment, without leaving the game to search a help centre.
- Where a game ships with more than one paytable, the RTP shown is the one configured for that player’s session.
- Where RTP is not meaningful, as in most peer-to-peer formats, the disclosure explains the mechanics and the rake instead.
Ontario reaches the same outcome by a different route, requiring rules of play, paytable information and return-to-player or odds information to be accurate and available within the game environment. Germany shows what happens when a regulator legislates the maths itself: under section 22a of the Interstate Treaty on Gambling, virtual slots are capped at EUR 1 per spin with a minimum of 5 seconds between spins, and autoplay and jackpots are prohibited outright. The GGL opened a review of those parameters in 2026, so operators building German content should treat the current figures as under examination rather than fixed.
Wagering Requirements Must Be Visible Before the Bonus Is Accepted
Disclosure of a wagering requirement belongs to game integrity because a bonus alters the economics of every round played with it. The British position tightened on 19 January 2026, when amended social responsibility code provision 5.1.1 took effect. Two requirements matter for product teams, and they sit next to the advertising and marketing standards rather than replacing them.
- Wagering requirements attached to an incentive must not exceed 10 times the incentive amount.
- An incentive must not combine more than one type of gambling product, with betting, casino, bingo and lottery counted as separate types.
- Game weighting has to be stated, because it changes the real cost of clearing the offer. On a 10 times requirement against a GBP 100 bonus, a game weighted at 30 per cent contributes 30 pence per pound staked.
- Expiry, maximum conversion and excluded games are significant conditions and belong with the offer, not in a linked terms page reached after acceptance.
GICNT-FP asks for one further thing that no regulator currently mandates: the wagering multiplier, the weighting table and the expiry period should be rendered in the offer itself, in the same view as the headline figure, so that a player sees the cost of the bonus at the moment of choosing it.
Live RTP Monitoring Keeps a Certified Game Honest
Pre-release testing establishes that a build was correct on the day it was signed. It says nothing about the following eighteen months. British licensees must therefore run live RTP monitoring, comparing actual return against the expected figure at a frequency scaled to volume of play, with tolerances set using the game’s volatility. One accepted method is a daily calculation over a rolling window of the last 30 days of play, raising an alert automatically when the measured figure falls outside tolerance.
The failure mode regulators warn about is aggregation. Monitoring that rolls every market and channel into one number will hide a fault that exists only in the mobile client of one title. Monitoring must also feed complaint handling, and telling a player that a game passed its tests is not an answer, because testing does not catch every error. GICNT-FP requires the same discipline: monitoring segmented by title, channel and market, documented tolerances, and a defined trigger for taking a game offline rather than a discretionary one.
Common Questions About GICNT-FP Certification
Does GICNT-FP certification replace a laboratory test report?
No. GICNT-FP verifies that valid test reports exist for every live game, that they match the builds actually deployed, and that the surrounding controls work. The testing itself is performed by accredited laboratories, and the certification is an assessment of the operator’s evidence, not a substitute for it.
How often does a game need to be recertified?
There is no fixed interval for a game that has not changed. Recertification is triggered by change: any modification affecting the RNG, the scaling and mapping or the game rules requires external retesting before release. Sweden is the exception among major markets, requiring certification protocols to be renewed at least every twelve months regardless.
Is a laboratory certificate from one market valid in another?
Not automatically. Each regulator maintains its own technical standards and its own view of which laboratories it recognises, so the same build often needs separate submissions. The IAGR Multi-Jurisdictional Testing Framework exists to reduce that duplication between participating jurisdictions, but it has not removed it.
Who carries the obligation when a B2B supplies the games?
Both parties, in different forms. The supplier certifies the RNG and the games it builds. The operator remains responsible for offering only certified content under its own licence, for maintaining a games register, and for knowing who performs live RTP monitoring, which contracts should state explicitly.
What happens to a certified game after a platform migration?
A change to the remote gaming server or the RNG can affect hundreds of games at once, so a representative sample spanning each game type and generation must be retested before the updated platform goes live. Sampling restricted to games with similar characteristics does not satisfy the requirement.