The terminology of game integrity sits next to responsible gambling language in almost every compliance file, and the two are routinely confused. One set describes whether a product behaves as advertised. The other describes whether a player can limit exposure to it. This page defines both, states where each definition comes from, and flags the places where regulators and certification bodies use the same word to mean different things.
How Game Integrity Language Differs From Player Protection Language
Game integrity is a statement about the product. It covers how outcomes are generated, whether the payout arithmetic matches what was certified, and whether the rules shown to a player describe the game actually running on the server. Player protection is a statement about the account: deposit ceilings, session interruption, marketing suppression and exclusion.
The distinction is built into the regulatory architecture. In Great Britain the Remote Gambling and Software Technical Standards govern the product, while the social responsibility provisions of the Licence Conditions and Codes of Practice govern the customer relationship. A licensee can breach one without touching the other. The same split runs through the certification framework, where the requirements on fair play apply to an individual game and the player protection domain applies to an individual account.
This matters in audit because evidence for the two comes from different places. Game integrity evidence is a laboratory report on a defined build. Player protection evidence is system configuration plus records of customer interaction. Asking a supplier for the second, or an operator for the first, costs a cycle.
RNG, RTP and House Edge: What Each Term Measures
Five terms carry most of the weight in game integrity work, and each is fixed at a different point in the production chain.
| Term | What it describes | Where the number is fixed |
|---|---|---|
| Random number generator (RNG) | The component producing outcomes independent of prior results and of player behaviour | In the game build, verified by an independent test laboratory, commonly against GLI-19 for interactive gaming systems or GLI-11 for gaming devices |
| Return to player (RTP) | The theoretical share of total stakes returned as prizes across a modelled cycle of the game | In the game maths at build time. For MGA licensees the floor is 85% under Article 22 of the Player Protection Directive, lowered from 92% in 2021 |
| House edge | The theoretical margin retained by the operator, being the complement of RTP | Derived arithmetically. A 96% RTP is a 4% house edge |
| Hit frequency | The share of game cycles returning anything at all, of any size | In the game maths, independently of RTP, and rarely disclosed |
| Volatility | The dispersion of outcomes around the theoretical mean | In the game maths. No standardised scale exists across suppliers |
The difference between RTP and house edge is arithmetic rather than conceptual, so publishing either satisfies the same disclosure logic. Certification of an RNG used in online casino games is issued against a submitted build and covers outcome generation, seeding and the absence of reachable state that would let a result be predicted. It says nothing about the operator platform on which that game is served, which is why the laboratory work behind certifying RNG output is requested separately from a platform assessment.
One asymmetry deserves attention. The Gambling Commission sets no minimum RTP, and its technical standard on game descriptions accepts a description of how the game works, the house edge, the RTP percentage or the probability of winning. An operator can satisfy the disclosure rule without ever publishing an RTP figure. Certification schemes tend to specify the format precisely for that reason.
Why Volatility Is Not the Same as Return to Player
Confusing dispersion with the mean produces most of the bad answers given to players and, in a complaints file, most of the reversals.
- RTP is an average and volatility is the spread around it. Two titles configured at 96% can behave nothing alike: one returning small amounts frequently, the other returning nothing across hundreds of cycles and then paying a large multiple.
- The average is a long-run figure. Theoretical RTP converges only across a very large number of cycles, often millions. A player comparing one session against the published percentage is comparing incompatible quantities, and a complaints team needs that argument documented rather than improvised each time.
- A single title may ship at several settings. Suppliers routinely build 94%, 95% and 96% variants of the same game for different tax and margin conditions. The configured value for the market in question, not the headline value for the title, is the one that has to be disclosed.
- Returns below the stake are not wins. Requirement 14F of the British technical standards prohibits win-associated audio or visual effects for a return equal to or lower than the last total staked. The industry name for the pattern is a loss disguised as a win.
- Volatility labels are marketing rather than measurement. Low, medium and high carry no agreed numerical boundary, so two suppliers can describe the same standard deviation differently and both be defensible.
How Wagering Requirements Work Under the Revised UK Rules
A wagering requirement is the total value of bets a customer must place before bonus funds, or winnings derived from them, become withdrawable. It is quoted as a multiple: a bonus of GBP 10 at ten times requires GBP 100 of qualifying stakes.
UK rules on wagering requirements changed materially on 19 January 2026, when the revised Social Responsibility Code 5.1.1 came into force. Two provisions carry the change. The maximum wagering requirement is 10 times the bonus, against the 30 to 50 times that was common before. Incentives may no longer require play across more than one product type, which ends the structure where a sports bet unlocks casino free spins. The original date was 19 December 2025 and was moved after representations about implementation time, so guidance written before autumn 2025 cites a date that never took effect.
The cap does not remove every complication. Game weighting survives untouched: an operator may still count slots at 100% and table games at a lower rate towards the same requirement, which changes the real cost of clearing a bonus without changing the stated multiple. Reviewing an incentive therefore means reading the weighting table alongside the multiple and testing both against the UKGC licence conditions that require terms to be clear, transparent, fair and readily accessible.
Reality Checks, Time-Outs and Deposit Limits in Session Control
Session controls sit between disclosure and exclusion. Each has a narrow definition in the British technical standards, and the definitions are worth holding to because product teams use the same words loosely.
| Control | What it does | Governing provision in Great Britain |
|---|---|---|
| Deposit limit | Caps money paid into the account over a stated period | RTS 12A. Limit-setting facilities must be available from registration, and the customer must be prompted at registration or first deposit |
| Reality check | Interrupts play with elapsed session time and a route into account history | RTS 13B and 13C. Elapsed time must be displayed, with a link to the account history |
| Time-out | A short operator-level break, commonly 24 hours to 6 weeks, after which the account reopens | Carried by social responsibility code obligations on customer-led controls rather than by a technical standard |
| Autoplay | Prohibited for online gaming. The customer commits to each cycle individually | RTS 8A |
| Speed of play | Minimum 2.5 seconds per slot cycle, and 5 seconds for other casino games since 17 January 2025 | RTS 14D and RTS 14G |
| Withdrawal reversal | Prohibited. A customer cannot cancel a withdrawal request once made | RTS 14B |
A reality check is a time-tracking tool inside the gambling account rather than a block on play, so it is weak in isolation and is assessed in combination with the rest. Germany pushes two of these controls further. A panic button suspends play for 24 hours on demand, and the cross-operator deposit ceiling of EUR 1,000 per calendar month is enforced centrally through the limit file of LUGAS (Länderübergreifendes Glücksspielaufsichtssystem, the cross-state gambling supervision system) under § 6c of the Glücksspielstaatsvertrag 2021. Ceilings above that level, up to EUR 10,000, require a documented assessment of the customer. Definitions of responsible gambling tools shift between markets, which is why tools for responsible gambling are examined as deployed rather than as described in product copy.
What an Affordability Check Means After the Shift to Financial Risk Assessments
Affordability check is industry shorthand with no statutory basis in Great Britain. The regulator’s term is a Financial Risk Assessment, and on 7 July 2026 the Commission confirmed a staged introduction rather than a single start date. Assessments run on credit reference agency data rather than customer documents, and they leave no mark on a credit score.
| Stage | Customers aged 25 and over | Higher-risk groups, including customers under 25 |
|---|---|---|
| Stage one | Net deposits above GBP 5,000 in a rolling 24-hour period | Net deposits above GBP 2,500 in a rolling 24-hour period |
| Interim stages | To be set after engagement with implementation groups | To be set after engagement with implementation groups |
| Final stage | Above GBP 1,000 in a rolling 24-hour period, or GBP 3,000 over a rolling 90-day period | Above GBP 750 in a rolling 24-hour period, or GBP 2,000 over a rolling 90-day period |
Pilot results shaped the design. 97% of customers spending above the threshold levels could be assessed without any contact, against the 80% estimated in the 2023 White Paper, leaving under 3% of accounts subject to an assessment at all and fewer than 1 in 1,000 unable to be assessed. For that residual group the operator must verify identity properly and may fall back on open banking or documents. The Commission also confirmed that during the early stages it will take no enforcement action over a failure to act on an assessment result, while every other licence requirement continues to apply. Stage one reaches the largest operators only, and its timetable follows the work of implementation groups.
Affordability checks that gambling operators run in other markets do not follow this design, which is the assumption most often carried across borders in error. Behavioural markers of harm remain the primary trigger elsewhere, and a financial data check is an addition to that analysis rather than a substitute for it.
How GAMSTOP, Spelpaus, CRUKS and OASIS Differ
Four European schemes dominate the vocabulary, and a fifth has just been added in Canada. They are not interchangeable, and the differences change what an integration has to do.
| Register | Market | Basis and operator | Terms available | Practical distinction |
|---|---|---|---|---|
| GAMSTOP | Great Britain | Run by The National Online Self Exclusion Scheme Limited. Registration has been mandatory for remote licensees since 31 March 2020 | 6 months, 1 year, 5 years, and 5 years with automatic renewal | Exclusion does not lapse on its own. Removal needs a positive request and a 24 hour cooling-off period |
| Spelpaus | Sweden | Spelinspektionen, live since 1 January 2019 | 10 days, 1, 3 or 6 months, or open-ended with a minimum of 12 months | The 10 day option arrived in 2026. Since 1 August 2026 operators must query the register through assigned credentials, including before direct marketing |
| CRUKS | Netherlands | Kansspelautoriteit under the Wet kansspelen op afstand, live since 1 October 2021 | 6 months minimum, extending to 99 years | Relatives, operators and the authority itself can trigger an involuntary entry, decided after an investigation of at least 6 weeks |
| OASIS | Germany | Regierungspräsidium Darmstadt under §§ 8 to 8d of the Glücksspielstaatsvertrag 2021 | 3 months minimum. An open-ended entry runs at least 1 year | Covers arcades, casinos, sports betting and online gaming in one record. Operator-initiated entries sit alongside self-requested ones |
| BetGuard | Ontario | iGaming Ontario, with operator duties in Registrar’s Standard 2.14.1. Live since 14 May 2026 | 6 months, 1 year, 5 years, or a custom term | Provincial, not national. A term can be extended but neither shortened nor cancelled |
Two points about that table are worth stating plainly. Registers of this kind exist in a minority of markets, so an operator holding several licences runs a hybrid: integration with the central register where one exists and an operator scheme with comparable reach where none does. Canada has no country-wide arrangement. Ontario’s is provincial, and Alberta opened its regulated market on 13 July 2026 with a centralised system of its own.
The second point is technical. Integration is now an obligation with its own failure modes rather than a database lookup. Where national registers of self-exclusion are queried through an API, the assessment question is what the platform does when a query times out or returns an error, not whether the query exists at all.
How GICNT-FP and GICNT-PP Apply These Definitions
GICNT is a certification body, not a regulator, and certification does not substitute for an operating licence in any market. What the framework adds is a fixed reading of terms that legislation often leaves loose.
- GICNT-FP treats certification as game-level. A laboratory report covers one build. A change to the maths, the RTP configuration or the outcome logic ends the validity of that report and requires resubmission.
- GICNT-FP requires the RTP shown to a player to match the value configured for the build in service in that market, rather than the supplier’s headline figure for the title.
- GICNT-FP expects the testing laboratory to hold accreditation to ISO/IEC 17025 for the relevant scope. A report is read on the accreditation and the scope, not on the name of the laboratory, so recognition by a licensing regulator or an equivalent body is what carries weight.
- GICNT-PP treats limit-setting, session interruption and exclusion as one control set, audited together. A deposit limit a customer can raise instantly is assessed as weaker than one carrying a cooling-off delay, whether or not the local regime requires the delay.
- GICNT-PP requires integration with the central register where the market operates one, and an operator scheme of comparable reach where it does not, which is how the player protection obligations treat markets without a statutory register.
- Both domains require dated evidence. A laboratory report or a configuration record without a date is treated as absent.
Frequently Asked Questions on Game Integrity Terminology
Does a higher RTP mean a game pays out more often?
No. RTP is the theoretical share of stakes returned over a long run, while hit frequency is the share of cycles returning anything at all. A game at 96% with low hit frequency returns larger amounts less often than a game at 94% with high hit frequency. The two figures are set independently in the game maths.
Is an RNG certificate for a game the same as certification of the operator?
No. A laboratory report covers a defined build of a game or a gaming system. Operator-level assessment covers the platform, the controls around it and the way certified content is deployed. An operator can serve certified games from a platform that has never been assessed, which is why the two are requested separately.
What is the maximum wagering requirement a UK-licensed operator can apply?
Ten times the value of the bonus, under the revised Social Responsibility Code 5.1.1 in force since 19 January 2026. The same provision bars incentives that require play across more than one product type. Game weighting is not capped, so the real cost of clearing a bonus still varies with the games a customer chooses.
Can a player cancel a national self-exclusion before it expires?
Not in the schemes described here. GAMSTOP, Spelpaus, CRUKS and OASIS each run for the term selected, and in Great Britain removal after expiry requires a positive request rather than happening automatically. Ontario’s BetGuard allows a term to be extended but not shortened or cancelled.
Does a Financial Risk Assessment affect a customer’s credit score?
No. The assessment draws on credit reference agency data but is not a credit application and leaves no footprint on the score. Where an assessment cannot be completed, which the pilot put at fewer than 1 in 1,000 accounts, the operator must verify identity properly and may request open banking access or documents instead.