Safety · RNG Certification
RNG Certification and Game Testing for Online Blackjack
Every online blackjack game you can legally play in the United States has been through a laboratory before it reached your screen, and almost nothing you have read about that process is specific to blackjack. The certification pages published by most US online blackjack sites are recycled slot machine copy: they talk about return to player percentages stamped on a game by a testing lab, about volatility, about hit frequency. None of that is how a blackjack game gets approved. Blackjack has no lab-assigned return figure. It has a random number generator, a shuffle, a rule set, and a payout table, and those four things are what a lab looks at.
If your question is the narrower one, whether the game is cheating you, that argument lives on the sibling page about whether online blackjack is rigged. This page is the technical underpinning for it.
Below: what the four labs actually test, how a virtual shoe is built, what US state regulators require, why live dealer blackjack is a different fairness question entirely, how to verify a certificate yourself, and the list of things a valid certificate does not prove.
On This Page
- The core point: labs do not certify a blackjack RTP
- How a virtual shoe is actually built
- The labs that do the testing
- How US state licensing relates to lab certification
- Offshore sites: certification is voluntary and self-selected
- Live dealer blackjack: a different fairness question entirely
- How to verify a certificate yourself
- What certification does not prove
- Published return figures and how to read them
- RNG certification FAQ
- Play within your limits
What you need to know about blackjack game testing
- A lab does not assign a blackjack game a return to player figure the way it assigns one to a slot. Blackjack’s return is an emergent result of the rule set, the shuffle and how well you play
- A certificate says the deal is genuinely random, the game plays by the rules it publishes, and it pays what its pay table says. It is a fairness test, not a value test
- Four labs cover most US-facing work: GLI, eCOGRA, iTech Labs and BMM Testlabs. GLI owns iTech Labs, so two seals are not two independent opinions
- Most online RNG blackjack reshuffles the full shoe before every hand, which makes card counting arithmetically impossible and leaves the house edge essentially unchanged
- In the seven regulated states, testing is a precondition of the game existing: the state names the standard, licenses the lab and receives the report before the game goes live
- Offshore, testing is whatever the operator chose to buy, and the seal in the footer may be narrower, older or emptier than it looks
- Live dealer blackjack is a different question: card recognition, the game control unit, the shuffler, dealer licensing and where the studio is physically allowed to sit
- Certification does not prove the operator will pay you, that the terms are fair, that the site is solvent, or that the rules on offer are good rules
The core point: labs do not certify a blackjack RTP
Blackjack has no lab-assigned return figure
A slot machine has a return to player figure baked into it by design, and the certificate records it. Blackjack does not work that way. A blackjack game’s return is not a property the developer chooses and the lab confirms. If a page tells you a lab certified a blackjack RTP, that page is recycled slot copy.
A slot machine’s math model says the game returns 96.2 percent over an infinite number of spins, the lab verifies that the implemented reel strips and pay table produce that number, and the certificate records it. There is nothing the player can do to change it. A blackjack game’s return, by contrast, is an emergent result of three inputs.
The three inputs that set a blackjack game’s return
- The rule set: number of decks, whether the dealer hits or stands on soft 17, whether blackjack pays 3:2 or 6:5, whether you can double after splitting, whether you can resplit, whether surrender is offered, and whether the dealer peeks for blackjack
- The randomness of the shuffle, which the lab does test
- How well the player plays. A perfect basic strategy player and a player who never splits eights are playing the same certified game at wildly different returns
So a certificate for an online blackjack game is a statement that the deal is genuinely random, that the game plays by the rules it publishes, and that it pays what its pay table says it pays. The return figure that follows from those rules, roughly 99.5 percent under a good six-deck rule set and materially worse under 6:5, is arithmetic that anyone can compute once the rules are fixed. The lab confirms the rules are implemented honestly. It does not hand blackjack a percentage the way it hands one to a slot.
This distinction matters commercially, not just pedantically. A site can offer a fully certified, genuinely random, perfectly honest blackjack game that pays 6:5 on a natural and takes about 1.8 percent of every dollar you put at risk instead of about 0.5 percent. Certification is silent on that. It is a fairness test, not a value test.
What a lab actually certifies
- That the random number generator’s output is genuinely random and properly distributed
- That the shuffle algorithm produces a fair ordering of the virtual shoe
- That the code matches the published rule, including whether the dealer hits soft 17
- That the payout matches the pay table, including 3:2 or 6:5 on a natural
- That side bet payouts resolve correctly
- That the game can be replayed from stored seed and state data if a hand is disputed
What people assume it certifies
- A return to player percentage assigned to the blackjack game, the way one is assigned to a slot
- That the rules on offer are good rules rather than merely honest ones
- That the side bets are decent value rather than merely paying what they say
- That the operator’s platform, wallet, bonus engine and payment handling were examined
- That the whole site was audited, rather than one game title at one software version
- That the operator will pay your withdrawal
What is certified versus what determines your return
| Element | Who controls it | Is it in the lab’s scope? |
|---|---|---|
| Randomness and distribution of the RNG output | The game supplier’s engine | Yes. Core of the test. |
| Shuffle algorithm and the order of the virtual shoe | The game supplier | Yes. |
| Whether the dealer hits soft 17 | The operator or supplier, as a commercial choice | Only that the code matches the published rule |
| Whether blackjack pays 3:2 or 6:5 | Commercial choice | Only that the payout matches the pay table |
| Side bet pay tables and their house edges | The game supplier | Payout correctness yes, edge level no |
| Whether you play basic strategy | You | No |
| Whether the operator pays your withdrawal | The operator | No |
How a virtual shoe is actually built
In a software blackjack game there are no cards. There is an ordered list of integers and a rule for consuming it. Everything a lab checks about deal fairness comes down to how that list is produced.
Pseudorandom generators and hardware entropy
Pseudorandom generator
A deterministic algorithm. Give it the same starting value, called a seed, and it produces the identical sequence forever. That sounds like a fatal flaw and it is the reason regulators write rules about seeding specifically.
Hardware entropy
A hardware or true random source samples physical noise: thermal noise across a resistor, jitter in a clock, or an operating system entropy pool that mixes many such sources.
Production systems use both
A cryptographically strong pseudorandom algorithm for speed, reseeded or continuously refreshed from a hardware entropy source, so that no attacker who observes past outputs can reconstruct the internal state and predict the next card.
The property that matters is not merely that the output looks random in a statistics test. It is that the output is unpredictable to someone who has watched a very long stretch of it, which is a cryptographic property, not a statistical one.
New Jersey writes this out in regulation. Under N.J.A.C. 13:69E-1.28G, an algorithmic RNG must be large enough to encompass all possible outcomes, must be available at the initiation of every game, must be statistically independent and conform to a random distribution, and must pass recognized statistical tests, with the chi-square test, the monobit test and the runs test named explicitly in the rule. It must be designed to cycle continuously in the background between games, and it must employ a random seed determined by an uncontrolled event so that the generator does not start from the same value each time.
The clause that kills a common implementation bug
Where a number is needed outside the generator’s native range, New Jersey’s rule requires that the rescaling method leave every value in the shorter range equally probable. Naive modulo reduction of a random integer into the range one to 52 makes some cards slightly more likely than others, and a lab will catch it.
Shuffling, and the reshuffle question
Once you have a trustworthy stream of random numbers, the shuffle is the easy part, and the standard method is a Fisher-Yates shuffle: walk the array from the end, swap each element with a randomly chosen element at or before it, and every one of the possible orderings becomes equally likely. A six-deck shoe has 312 cards, so the number of distinct orderings is astronomically larger than the number of hands that will ever be dealt anywhere. There is no meaningful chance of a repeated shoe.
The reshuffle policy is the fact that affects you
Most online RNG blackjack reshuffles the full shoe before every hand. That is not cheating and it is not a deviation from the rules, but it does mean the game has no memory. Cards dealt on the previous hand are back in the shoe, so card counting is arithmetically impossible against a game that reshuffles each round. The same effect exists in the physical world with a continuous shuffling machine.
Some games instead deal down through a shoe to a defined penetration point before reshuffling, and their rules screens say so. If the information panel does not state the policy, treat that as a gap. None of this moves the house edge for a basic strategy player by any meaningful amount. It changes only whether a counting approach could ever work, covered in more depth under card counting law and policy.
The labs that do the testing
Four names cover most of the certification work you will meet on a US-facing blackjack site. All are private companies paid by the supplier or operator whose product they are testing, which is normal in every certification industry from elevators to electrical equipment. The check on that conflict is accreditation: an outside body audits the lab’s competence and independence against ISO standards, and regulators separately license the lab before its reports are accepted.
Gaming Laboratories International
Gaming Laboratories International, universally called GLI, is the largest of them and the one whose documents most US regulators reference by name. It was created on June 23, 1989 by James Maida and Paul Magno, is headquartered in Lakewood, New Jersey, operates laboratories on six continents, and states that it serves more than 710 jurisdictions. It holds US and international accreditations for ISO/IEC 17025, 17020 and 17065, which cover, respectively, testing and calibration competence, inspection body competence, and product certification body competence.
eCOGRA
eCOGRA was established in 2003 in London and is the lab most associated with player-facing seals rather than back office regulatory filings. Its menu includes game engine certification and RNG testing, platform certification, geolocation testing, live dealer audits, change management review, and integration testing, and it runs an alternative dispute resolution service it says has handled more than 10,000 disputes, approved as an ADR provider in Great Britain since 2015 and Malta since 2018. It holds four United Kingdom Accreditation Service accreditations, for ISO/IEC 17020, 17021-1, 17025 and 17065, plus one from Ireland’s National Accreditation Board. Its jurisdictional approval list includes both New Jersey and Pennsylvania, which is the fact that matters for a US reader: this is not only an offshore-facing lab. Its geolocation work bears directly on the border problems described under geolocation and state line blocking.
iTech Labs
iTech Labs is a Melbourne-based lab, now GLI-owned, doing RNG evaluation, game certification for casino, multiplayer and skill-based games, platform and integration certification, and math and payout verification. It also sells a category worth knowing about: an RTP and RNG audit certification based on analysis of live server logs rather than bench testing. Its accreditation weight sits in European markets rather than US states, so an iTech seal on a site serving Americans is almost always attached to an offshore licence.
BMM Testlabs
BMM Testlabs is headquartered in Las Vegas and describes itself as the longest-established independent gaming test laboratory, serving the industry more than 40 years. Its work spans RNG and mathematics testing, product certification, iGaming and sports betting testing, land-based testing and casino inspections, lottery testing, and security assessment including PCI DSS. BMM is the main structural competitor to GLI in North American regulated markets, and in most states where GLI is a licensed testing lab, BMM is too.
Two seals are not always two opinions
GLI owns iTech Labs, having invested in the Australian lab and then acquired the remaining shares in an announcement dated May 2023. A site displaying both marks is not showing you two independent opinions.
GLI’s real influence is that it publishes the standards other people adopt. The documents that matter for blackjack are:
- GLI-19, Standards for Interactive Gaming Systems, currently version 3.0, released in July 2020. This is the online gaming standard, organized into an introduction, platform and system requirements, random number generator requirements, and game requirements. When a state says online blackjack must be certified, GLI-19 is usually the document being pointed at.
- GLI-11, Gaming Devices, the land-based device standard. GLI-19 leans on GLI-11 for game level requirements, so the two are read together.
- GLI-21, Client-Server Systems, which applies where a game client talks to a remote game server, the architecture of essentially all online blackjack.
You will also meet smaller names. Technical Systems Testing, founded in Vancouver, still appears on older offshore footers. NMi Gaming and QUINEL, based in the Netherlands and the Isle of Man respectively, do meaningful volumes of European work. None of them is a US state fixture in the way GLI and BMM are.
Three different things all called certification
The single most useful thing a player can learn here is that a lab does at least three distinguishable jobs, and operators habitually blur them.
| Type of engagement | What it covers | How long it stays true |
|---|---|---|
| Game or RNG certification | One specific game title, or one RNG engine, at one specific software version, against one named standard, for one named jurisdiction | Until the code changes. A new version needs new testing, which is why change management is a separate service. |
| Platform or system audit | The operator’s whole interactive gaming system: account handling, wagering, session and transaction logging, geolocation, responsible gaming controls, integration between the platform and each supplier | Point in time, then re-examined on material change or on a regulator’s schedule |
| Ongoing return audit | Live server logs analyzed after the fact to confirm that actual results match the theoretical model. This is the only one that looks at what really happened to real players. | Covers the period reviewed only, typically a month or a quarter |
A seal saying only that a lab tested the RNG tells you nothing about whether the operator’s platform, payment handling or bonus engine was ever examined. The three engagements have almost nothing in common except the letterhead. It is worth saying plainly that a casino-level audit does not automatically certify every game on the site, a claim you will see made confidently elsewhere. Games are certified as products, by title and by version, usually to the supplier that built them.
What the test actually consists of
The lab is not simply watching a game play itself. A full engagement on a card game runs along several tracks at once.
The five tracks of a card game test
- Statistical testing of the generator’s raw output. Beyond the chi-square, monobit and runs tests named in New Jersey’s rule, labs run established public test suites, most commonly the NIST Statistical Test Suite published as NIST Special Publication 800-22 and the older Diehard battery, plus serial correlation and equidistribution checks, over output runs measured in the hundreds of millions of values.
- Source code review. Statistical testing of outputs cannot by itself prove that nothing in the code inspects the wager before choosing a card. Reading the code can. Regulated submissions typically include the source package as well as the compiled build.
- Seed and entropy assessment. How the seed is produced, how often it is refreshed, and whether the internal state can be reconstructed from observed output. This is the part that matters most and the part a marketing seal never describes.
- Game logic and pay table verification. The implemented rules are compared line by line against the submitted math model and the rules the player will see, including every side bet and every edge case: dealer peek behavior, split and resplit limits, whether a split ace receives one card only, and how a five-card hand or a push is settled.
- Deterministic replay and audit logging. Regulated systems must be able to reconstruct any historical hand from stored seed and state data. This is the quiet feature that makes blackjack disputes resolvable at all: when a player insists a hand settled wrongly, the operator and the regulator can rebuild the exact hand rather than argue about memory.
If you ever need that replay capability, it is what the process on the complaints page is reaching for. All of this is paid work, priced per game and per jurisdiction, and it typically runs from a few thousand dollars and a few weeks for a simple variant to a great deal more for a multi-game submission across several markets. That cost is the reason offshore operators certify selectively rather than comprehensively, and it is the reason a small change is submitted as a variation review rather than a fresh certification.
How US state licensing relates to lab certification
In a regulated state, certification is not a marketing decision but a precondition of the game existing. The operator cannot deploy a blackjack title until the regulator approves it, the regulator will not approve it without a test report, and the regulator decides which lab’s report it accepts and which standard the lab must test against. That is the whole difference between regulated and offshore certification, and it matters more than any individual lab’s reputation.
Seven states require a blackjack game to be tested before it can exist
Real-money online blackjack is live in seven states. Maine has passed an online casino law, LD 1164, reserving online casino gaming to the four Wabanaki Nations, and that law took effect in late July 2026, but the state has not launched as of August 2026 and its Gambling Control Unit is still writing rules, so no Maine testing regime is operating yet. Nevada authorizes online poker only, so there is no Nevada certification of an online blackjack game to look for.
The minimum age is 21 in every state that does offer it.
New Jersey: the regulator runs its own lab
New Jersey’s Division of Gaming Enforcement operates the Technical Services Bureau, based in Atlantic City and known internally as the slot lab. The bureau tests and approves all games and gaming equipment offered to patrons along with their associated systems, and for internet gaming it tests and evaluates all systems and software, performs inspections before use, and conducts ongoing oversight. For slot machines the bureau enforces a hard floor: the machine must pay out at least 83 percent theoretically, it must do what it says it does, and it must not do anything it is not supposed to do.
Notice what that 83 percent floor implies for blackjack. There is no equivalent minimum return rule for a table game, because a table game’s return follows from its rules and the rules are approved individually. The state does not tell an operator its blackjack must return 99 percent. It tells the operator the blackjack must play by the rules it filed and displayed. New Jersey also licenses private testing laboratories as casino service industry enterprises, which is how a GLI or BMM report gets standing in the state at all, and why eCOGRA lists New Jersey among its approvals. The rules sit in N.J.A.C. Title 13, with internet and mobile gaming in Chapter 69O and gaming equipment standards in Chapter 69E.
Pennsylvania: a state lab paid for by manufacturers
The Pennsylvania Gaming Control Board runs its own Bureau of Gaming Laboratory Operations out of a 5,100-square-foot facility at the board’s Harrisburg headquarters, which opened in November 2007 and was funded entirely by licensed manufacturers rather than by taxpayers. Its units include Slot Certification, Gaming Equipment Inspections, and a Statistical Review unit that evaluates the theoretical return of every game theme submitted, analyzes progressive payouts, and performs random number generator analysis. For interactive gaming the state layers a private lab requirement on top: compliance certification of an interactive gaming certificate holder’s proposed devices and associated equipment, software and hardware included, must come from a board-approved gaming laboratory before the product can be used.
Michigan: adoption of GLI-19 by reference
Michigan regulates online casino play under the Lawful Internet Gaming Act, Act 152 of 2019, administered by the Michigan Gaming Control Board. The board’s internet gaming technical standards reference GLI-19 version 3.0 directly, which is the clearest example of a US regulator adopting a private lab’s published standard as the state’s own technical baseline. Testing has to be done by an independent test lab authorized by the board, and for live dealer products the board additionally requires that integration testing of live game equipment to each internet gaming platform be performed by an authorized lab. Before authorizing a live dealer supplier, board staff also conduct an on-site review of the studio.
The other four states
Delaware
Runs the oldest of the seven programs through the Delaware Lottery, with a single shared technology platform serving all three racinos rather than a competitive multi-operator market.
West Virginia
Licenses interactive casino gaming through the West Virginia Lottery.
Connecticut
Licenses two master wagering licensees, tied to the Mashantucket Pequot Tribal Nation and the Mohegan Tribe, with the Department of Consumer Protection’s gaming division supervising.
Rhode Island
Splits the job between two agencies and you should know both names: R.I. Gen. Laws Section 42-61.2-3.4 leaves iGaming rulemaking and the patron complaint route with the director of the Division of State Lottery inside the Department of Revenue, while the Department of Business Regulation handles personnel and vendor licensing and casino supervision.
The structure of each of these agencies is laid out on the page covering state gambling regulators.
In a regulated state, skip the seal
In all seven, the practical takeaway is the same. The certificate is filed with the state, not with you. Your verification route in a regulated state is not to hunt for a seal on the casino’s footer. It is to confirm that the operator holds a live license and that the game supplier appears on the regulator’s approved list.
Offshore sites: certification is voluntary and self-selected
Sites licensed in Curacao or Panama and serving Americans are not regulated by any US authority. Their testing is a private matter between the operator, its licensing jurisdiction and whichever lab it hired, and the operator decides what to publish. That produces three failure modes a US regulated site structurally cannot have.
Scope narrower than the impression
A certificate whose scope is narrower than the impression it creates. One RNG engine or one game title, displayed next to the words certified fair so a reader infers the whole operation was audited.
True two versions ago
A certificate that was true two software versions ago. Labs sell change management review precisely because a certified build stops being the build in production the moment an update ships.
A picture file
A seal that is a picture file with nothing behind it. It carries no more authority than any other image on the page, and copying one takes a few seconds.
Curacao is the licence you will see most often, and it changed substantially. The National Ordinance on Games of Chance, known by its Dutch initials LOK, came into force on Dec. 24, 2024 and abolished the master licence and sub-licence structure that had let four private master licence holders resell permits with little oversight. Licences are now issued directly by the Curacao Gaming Authority, the old sub-licences expired in January 2025, and operators must display the authority’s digital seal with their legal entity name, Chamber of Commerce number and licence number. Under the LOK, gaming software and random number generators must be certified by an approved independent testing laboratory before going live, and suppliers of critical services face a parallel registration requirement. That is a genuine improvement on the pre-2025 position, and it is still not equivalent to a New Jersey approval, because the enforcement resources, the audit cadence and the player remedies are not comparable.
The practical consequence for a blackjack player is not that offshore games are all crooked. Many of the recognizable engines offshore are the same engines used in regulated markets. The consequence is that when something goes wrong there is no US regulator to escalate to, a trade-off set out on the page comparing legal and offshore sites.
Provably fair blackjack, and what it does not solve
Crypto-facing sites often offer a provably fair scheme instead of, or alongside, a lab certificate. Before the hand the server generates a secret seed and publishes only its cryptographic hash. You supply or accept a client seed. The shuffle is derived deterministically from the server seed, the client seed and an incrementing nonce. When the seed pair is rotated the server reveals the original server seed, and you can hash it yourself, confirm it matches the commitment published beforehand, then recompute the exact shoe order and check your cards against it.
What provably fair proves
- The operator did not choose your cards after seeing your bet
- The shoe order was committed to before the hand was dealt
- You can hash the revealed server seed yourself and confirm it matches the published commitment
- You can recompute the exact shoe order and check your cards against it
What it does not prove
- That the server seed was generated randomly rather than picked from a set of favorable pre-computed seeds, unless seed generation itself is audited
- That the rules are the published rules
- That the payouts are right
- That you will be paid
- A site offering only provably fair has not been audited by anyone
Provably fair and lab certification answer different questions, and a site offering only the first has not been audited by anyone.
Live dealer blackjack: a different fairness question entirely
A large share of online blackjack in the United States is dealt by a human being from a physical shoe in a licensed studio, and almost every article about RNG certification ignores this. In live dealer blackjack the random number generator is not the fairness question. The cards are real and the shuffle is physical. What has to be verified instead is the chain that turns a physical card into a number on your screen, plus the controls around the people handling the cards.
RNG blackjack: what must be verified
- That the generator’s raw output passes chi-square, monobit, runs and public test suites
- That the seed comes from an uncontrolled event and the internal state cannot be reconstructed
- That the shuffle produces every ordering with equal likelihood
- That the implemented rules and pay table match the submitted math model
- That any historical hand can be replayed from stored seed and state data
Live dealer: what must be verified instead
- That card recognition, by edge mark scanner and by camera, reports the right card
- That the game control unit keeps the video and the recorded outcome locked to the same hand
- That the misdeal procedure halts the round and resolves or voids it under published rules
- That the shuffler is treated as gaming equipment with its own RNG requirements
- That dealers are licensed or registered employees under casino-floor supervision
- That the studio sits where state law says it must sit
Card recognition and the game control unit
Every card that leaves the shoe is read by machine before it appears in your interface. Two techniques are used, usually together. Cards are printed with a coded mark along the edge, read by a scanner built into the shoe as the card is drawn, and separately a camera trained on the table reads the card face using optical character recognition. Each table has a small dedicated device, generally called a game control unit, that encodes the video stream and attaches the recognized outcome data to it, so the picture you see and the result the platform records stay locked to the same hand.
That voided round was probably a misread
Studio procedure for a mismatch between the two readings, a misread card or a card exposed out of turn is to halt the round and either resolve it under the published misdeal rules or void the round and return wagers. That procedure is a rule of the game, it should be in the game’s rules panel, and it is one of the things a regulator’s on-site review examines. If you have ever had a live blackjack round void mid-hand, that is almost always what happened, not a connection problem on your end.
The shoe, the shuffle and the discard
Live blackjack tables use pre-shuffled decks delivered under seal, an automatic shuffling machine on the table, or a manual shuffle performed in full camera view before the shoe is loaded. Regulated markets treat the shuffler as gaming equipment in its own right: New Jersey’s standard for automated shufflers, N.J.A.C. 13:69E-1.28X, requires the machine to use a random number generator conforming to the division’s RNG rules and to shuffle in a manner that prevents patterns. The RNG question does reappear at live tables, just inside the shuffler rather than inside the game.
Penetration, meaning how deep into the shoe the cut card sits, is what a blackjack player should be looking for, and it is rarely advertised. Shared-hand formats, where one dealer hand is settled against an unlimited number of players at once, behave differently again from a seven-seat table, which is why the mechanics of Infinite Blackjack are worth reading first. Michigan’s framework for live games treats standard blackjack and scalable or shared-hand blackjack as distinct approved game types.
Dealers, surveillance and where the studio is allowed to be
In a regulated state the dealer is a licensed or registered casino employee, subject to background checks, and the studio floor is supervised the way a casino pit is supervised. The location rule is statutory, not a convention. New Jersey requires under N.J.S.A. 5:12-95.22 that a casino licensee’s primary internet gaming operation, including the facilities, equipment and the personnel directly engaged in conducting internet gaming, sit in a restricted area on the casino hotel premises or in another secure facility owned or leased by the licensee, inaccessible to the public, within the territorial limits of Atlantic City. The same statute requires the facility to include a closed circuit visual monitoring system built to division specifications, with the division given access on the premises to that system or to its signal. In plain terms: New Jersey live blackjack is dealt inside Atlantic City, and the state can watch the surveillance feed.
That is why the studio map looks the way it does. Evolution opened the first purpose-built US live casino studio in Atlantic City in August 2018 and added a second there, then opened studios serving Pennsylvania out of Philadelphia, Michigan out of Southfield, and Connecticut. Playtech and other suppliers operate on the same principle, and individual casino companies have begun building in-house studios inside their own properties, with Caesars debuting its first such studio in April 2025. A studio streaming to Michigan players cannot simply be a room in Latvia, which is a meaningful and underappreciated consequence of state law.
What auditing applies to a live table
Live dealer products still get tested, but on different axes. The game logic, the payout engine, the side bet resolution and the wagering platform are software and are certified like any other software. The bridge between the table and the platform gets its own treatment: Michigan requires that integration testing of live game equipment to each internet gaming platform be performed by an independent test lab authorized by the board, and board staff conduct an on-site review of a studio before authorizing its supplier. eCOGRA sells live dealer audits as a distinct service line.
The remaining controls, shuffle procedure, dealer conduct, camera coverage, chip and card handling, are inspection and surveillance matters rather than laboratory matters, and in a regulated state they belong to the regulator’s own field staff. The net effect is that regulated live blackjack carries more layers of oversight than the software version, because it inherits the casino floor control regime on top of the software regime. Offshore, the same studio may be streaming to you with none of those requirements attached.
How to verify a certificate yourself
A seal in a website footer is an image file. It carries no more authority than any other picture on the page, and copying one takes a few seconds. Verification means getting from that image to a document hosted on the certifying body’s own domain that names a specific product, a specific version, a specific standard and a specific date. Here is the sequence that actually works.
Seven steps from a seal to a real document
- Click the seal. If nothing happens, you have learned something already. A genuine eCOGRA or lab seal is normally a live link. An inert image is not evidence of anything.
- Check where it lands. The destination must be on the certifying organization’s own domain, not a page hosted by the casino that reproduces a certificate as a screenshot. A PDF sitting on the operator’s own server is an operator claim, not a lab statement.
- Read who is named. This is where most claims fall apart. Certificates are frequently issued to the game supplier, not to the casino. A blackjack engine certified for a supplier tells you the engine was tested. It says nothing about the operator’s platform, wallet, bonus engine or payment handling.
- Read the scope line. Look for the specific product and software version, and for the standard tested against, such as GLI-19 version 3.0. A certificate that names one game title is a certificate for one game title. It is not site-wide coverage, however it is displayed.
- Read the jurisdiction. Test reports are issued against a named jurisdiction’s requirements. A certificate issued for one market is not automatically meaningful in another, and a certificate issued for an offshore licence says nothing about US regulated compliance.
- Read the date, then think about versions. Software changes constantly. Labs sell change management review precisely because a certified build stops being the build in production the moment an update ships. A certificate from several years ago describing a product version no longer in use is a historical document.
- In a regulated state, skip the seal entirely. Go to the regulator. Every one of the seven states publishes lists of licensed interactive gaming operators, approved skins or domains, and licensed suppliers and service providers. Confirm that the exact domain you are playing on appears there. That single check is worth more than any number of logos, and it is the check described on the page about verifying a licence.
The trick is not forgery, it is accurate but misleading display
The most common trick in the offshore market is a real certificate whose scope covers one RNG engine or one game, positioned next to the words “certified fair” so a reader infers the whole operation was audited. Nothing on the page is false and the impression is entirely false. A close relative is the group certificate, where operators run several brands off one platform and a certificate naming the platform company appears on brands the lab never examined. If the entity on the certificate is not the entity holding your money, the certificate is not about your account.
What certification does not prove
This is the section most testing pages leave out, and it is the section that keeps people out of trouble. A valid, current, well-scoped lab certificate proves that the deal is random and the game plays by its stated rules. It does not prove any of the following.
That the operator will pay you
Testing labs certify software. They do not hold the money, do not audit the withdrawal queue, and have no power to make a payment happen. Slow or refused payouts are a licensing and enforcement problem, not a certification problem, and they are the single most common complaint against offshore sites. See voided winnings.
That the terms are fair
Maximum win caps, irregular play clauses, dormancy fees and bonus terms are contract, not code. Blackjack is usually either excluded from bonus wagering entirely or weighted at around 10 percent, which is a decision in the terms, not in the certified game. The mechanics are set out under wagering requirements.
That the site is solvent
No lab certificate speaks to segregation of player funds or to the operator’s balance sheet. Sites that certified their games have still closed owing balances, which is the subject of the page on casino shutdowns.
That your account will stay open
Account closures and confiscations usually turn on identity verification, source of funds review, or an advantage play determination, none of which a game certificate touches.
That the rules on offer are good rules
This is the blackjack-specific one and it deserves repeating. A certified 6:5 single-deck game with a dealer who hits soft 17 and no surrender is honest and expensive. Certification and value are orthogonal.
Published return figures and how to read them
Three different numbers get published and they are routinely confused with each other. Getting them straight is the difference between reading a regulator’s report correctly and drawing a conclusion that is off by a factor of twenty.
| Figure | What it means | Who publishes it |
|---|---|---|
| Theoretical return to player | Expected return per dollar wagered under a stated rule set, assuming the player uses correct basic strategy for that rule set and places no side bets | Game suppliers, in the game’s information panel |
| Actual return over a period | Total returned to players divided by total wagered, across real play in a defined window | Labs doing server log audits, and computable from some regulator data |
| Hold, or win as a percentage of drop | What the casino kept as a share of the money players bought in with, not of the money they wagered. Every dollar is bet many times over. | Regulators reporting table game results |
Hold is not the house edge
Two correct figures with different denominators. Downtown Las Vegas licensees reported the blackjack hold below for February 2026.
The hold figure is the trap. Nevada’s Gaming Control Board publishes monthly revenue reports drawn from licensee filings, and the live blackjack line, reported as Twenty One, shows a hold that typically runs in the low to mid teens as a percentage of drop. In February 2026, for example, downtown Las Vegas licensees reported a blackjack hold near 12.8 percent. The house edge on the same game is well under 1 percent per hand. Both figures are correct because they use different denominators: a player who buys in for $200 and plays 60 hands at $10 has wagered $600 against a $200 drop, so a small edge per hand compounds into a large share of the buy-in. Anyone quoting a table hold as if it were a house edge is out by more than a factor of ten.
Online, US regulators publish revenue rather than return. New Jersey and Pennsylvania publish monthly internet gaming win by category, which tells you what operators kept but not what was wagered. Delaware is the useful exception: the Delaware Lottery publishes monthly internet gaming data by fiscal year including amounts wagered as well as net proceeds, so a reader can divide one by the other and see a blended real-world hold across all internet table games, which in recent periods has sat in the low single digits of amount wagered. No US regulator currently publishes a per-title blackjack return report.
Where a lab publishes an ongoing return audit, read the date range and the scope. For blackjack specifically, an observed return normally lands below the theoretical figure, because the theoretical figure assumes basic strategy and real player populations do not play it. That gap is a fact about players, not evidence of a rigged game.
The rule set is where your money actually goes
Since certification does not set blackjack’s return, the rules do, and this is the arithmetic no certificate can change. Start from a six-deck game where the dealer stands on soft 17, doubling is allowed on any two cards, doubling after a split is permitted and a natural pays 3:2: roughly a 0.4 percent house edge, about 99.6 percent return, for a player using correct basic strategy. Standard combinatorial analysis gives the approximate cost or benefit of each variation, in percentage points of house edge.
What each rule change costs you
Approximate effect on house edge, in percentage points, from a six-deck baseline. Red bars are worse for the player, green bars are better.
One line swamps the rest. Moving a natural from 3:2 to 6:5 costs more than every other common variation put together, and it is the change most often made quietly on a table that otherwise looks generous. A certified 6:5 game takes roughly four times as much from a correct player as a certified 3:2 game with identical other rules.
Side bets are the other leak: their pay tables are certified for correctness without anyone certifying that they are good value. Insurance on a six-deck game carries a house edge around 7 percent, and common pair and three-card side bets typically sit between about 3 percent and 8 percent depending on pay table and deck count. None of that is hidden, and none of it belongs in the 99.5 percent figure quoted for blackjack, which describes the main game only.
RNG certification FAQ
Are online casino games tested?
In the seven US states with regulated online casinos, yes, mandatorily, by a lab the state licenses, against a standard the state names, with the report filed with the state before the game can go live, and with the state’s own technical staff involved in New Jersey and Pennsylvania. Offshore, testing happens where the operator chose to buy it, and the scope is whatever the operator paid for.
Can the game deal itself a better card when I raise my bet?
Not in a certified implementation, and the reason is structural rather than a matter of trust. The New Jersey standard requires the generator to cycle continuously between games and to be available at the initiation of every game, and it requires the device to display only the outcome the generator determined, with no secondary selection process used to produce the displayed result. A build that consulted your wager size before selecting a card would fail that requirement outright, and the behavior would be visible in the log analysis a state lab performs.
Does reshuffling after every hand make the game unfair?
No. It makes every hand statistically identical to every other, which is what an honest shuffle should produce. What it removes is the chance to gain information from cards already dealt. That is a design choice against advantage play, not a manipulation of the odds, and the house edge is essentially unchanged. It also means no hand is ever due: after a reshuffle the shoe has no memory of the six losses you just took.
Does a certificate tell me the blackjack game’s RTP?
No. Blackjack has no lab-assigned return figure. The lab confirms that the deal is random, that the game plays by the rules it publishes, and that it pays what its pay table says. The return that follows from those rules, roughly 99.5 percent under a good six-deck rule set and materially worse under 6:5, is arithmetic anyone can compute once the rules are fixed.
Is a GLI seal and an iTech Labs seal two independent checks?
No. GLI invested in the Australian lab iTech Labs and then acquired the remaining shares in an announcement dated May 2023. A site displaying both marks is not showing you two independent opinions.
Does a casino-level audit certify every game on the site?
No, although you will see that claimed confidently. Games are certified as products, by title and by version, usually to the supplier that built them. A platform or system audit covers the operator’s account handling, wagering, logging, geolocation and responsible gaming controls. The two engagements have almost nothing in common except the letterhead.
Is provably fair as good as a lab certificate?
They answer different questions. Provably fair proves the operator did not choose your cards after seeing your bet. It does not prove the server seed was generated randomly rather than picked from favorable pre-computed seeds, that the rules are the published rules, that the payouts are right, or that you will be paid. A site offering only provably fair has not been audited by anyone.
How do I check a site in a regulated state?
Skip the seal and go to the regulator. Every one of the seven states publishes lists of licensed interactive gaming operators, approved skins or domains, and licensed suppliers and service providers. Confirm that the exact domain you are playing on appears there. The certificate is filed with the state, not with you.
Is there a Nevada certification for online blackjack?
No. Nevada authorizes online poker only. There is no regulated online casino or online blackjack in Nevada, so there is no Nevada certification of an online blackjack game to look for. Nevada’s blackjack numbers you may see quoted are land-based table hold figures from monthly revenue reports.
This page is general information about testing and regulation, not legal advice. Rules, standards and lab approvals change; verify anything you intend to rely on with the state regulator or the lab directly.
Play within your limits
Knowing that a shuffle is genuinely random is not the same as having an edge, and no certificate makes a losing session less expensive. Decide what a session is worth to you before it starts, use the deposit, spend and time limits that regulated operators are required to offer, and stop when the number you set is gone. Once the choice to play starts making itself, call 1-800-GAMBLER, available around the clock and free, or read the tools and self-exclusion options collected on our responsible gambling page.
Play responsibly
You must be 21 or older to play real-money blackjack in any regulated US state. Every regulated US operator must offer deposit limits, cooling-off periods and self-exclusion. If gambling stops being fun, call or text 1-800-GAMBLER for free, confidential help.
USA Blackjack Sites is an independent informational guide to blackjack sites for USA players. We may earn a commission from some of the sites we list, at no extra cost to you, which does not affect our rankings. This page is general information about game testing and regulation, not legal advice. Testing standards, lab accreditations, regulator approvals and state gaming law change frequently and are decided state by state, so verify anything you intend to rely on with the state regulator or the lab directly before you play. You must be 21 or older to gamble. Gambling problem? Call 1-800-GAMBLER.
