Gambling licences vs game certification: what each proves

Two documents come up whenever someone asks whether an online casino or game studio is legitimate: a gambling licence and a lab certificate. They are often mentioned in the same breath, sometimes shown side by side in a site footer, and they are routinely confused. They answer different questions. A licence tells you who is allowed to offer gambling, where, and under whose supervision. A certificate tells you that a particular game or random number generator met a technical standard when an accredited lab tested it.

Affiliates, B2B buyers and compliance teams need both, and they need to know where each one stops.

What an operator licence actually proves

A licence is a regulator's permission to offer gambling in a defined territory, with conditions the regulator can enforce. Malta shows how specific that permission is. The Malta Gaming Authority separates B2C licensees, which provide gaming services to players, from B2B licensees, which provide a "critical gaming supply" such as games or platforms. A casino brand and a game studio can both say they are MGA-licensed while holding very different permissions.

In Great Britain, the Gambling Commission licenses operators and software suppliers and keeps a public register. A British licence comes with technical standards attached, including rules on what games must tell players and how random outcomes must be generated.

What a licence does not prove is that every game on a site is fair, or that the brand on the screen is the company on the licence. Brands often run under a platform operator's licence, so the name in the footer may not belong to the licence holder. The trade publication AffHouse covers this in its regulator-by-regulator guide to online gambling licences, which compares Curaçao, Malta, Anjouan, the Isle of Man, Kahnawà:ke, the UK and US state licensing, and gives affiliates a checklist for confirming a licence in the regulator's own register.

What a lab certificate proves

Game and RNG certification is the job of independent test houses. The names that come up most often are GLI (Gaming Laboratories International), eCOGRA, BMM Testlabs and iTech Labs, which works in partnership with GLI. Their work is narrower and more technical than a regulator's. They review game maths, test random number generators statistically, check that a game follows its rules and paytable, and confirm which build was tested.

The UK shows how the two layers connect. The Gambling Commission's testing strategy requires licensees to make sure new RNG-driven products, such as casino, bingo and virtual betting games, are tested by an approved test house before release, and to send the test report to the Commission. Any later software change that may affect a game's fairness counts as a major update and needs external retesting. Holders of a gambling software licence, and certain remote casino, bingo and virtual betting licensees, also face an annual games testing audit, again carried out by an approved test house.

Approval is specific, too. The Commission publishes its list of approved test houses, currently headed "as of 2 March 2026", and requires them to hold ISO/IEC 17025 accreditation. Labs apply for approval in particular areas, so "tested by X" only means something if X was approved for that kind of product in that market.

What a certificate does not prove is that the operator is running the certified version today, that nothing has changed since, or which of several certified configurations is live. A certificate describes one build at one point in time.

Curaçao's reset and why registers matter

Curaçao is the clearest recent case for checking a licence again rather than trusting old assumptions. The regulator began a phased reform of online gaming in November 2023, and the National Ordinance on Games of Chance, known by its Dutch initials LOK, came into effect on 24 December 2024. The LOK replaced the much-criticised master licence system. The Curaçao Gaming Authority, formerly the Gaming Control Board, is now the online gaming regulator and keeps a public licence register. Its published policies also include one on testing labs.

The register has had growing pains. In September 2025 local press reported that operators with revoked licences had been removed from it, and critics said that made the market less transparent. The practical lesson for partners is to check the register when a deal is signed, then check it again later.

A verification routine for partners

For an affiliate, a B2B buyer or a compliance officer doing due diligence, a short routine covers most of the ground:

• Find the licence in the regulator's own register, not through a footer seal. Match the company name, the licence status and, where the register lists them, the approved domains.
• Confirm that the licence covers the activity and market you care about: B2C or B2B in Malta, the right licence type in Great Britain, and each US state separately.
• Ask which test house certified the games and the RNG, and whether that lab is approved in the relevant jurisdiction for that type of product.
• Ask for certificate references for the exact game versions and configurations live on the site.
• Check again after any change of platform, ownership or game supplier.

The gap neither document closes

Even with both documents in order, there is a gap between them. The licence names a company and the certificate names a build. Neither tells a player or partner which certified build is running on a given site today. Regulators see more of this than outsiders do, since the UK Commission receives test reports before release, but those reports go to the regulator, not to the public.

Independent, tamper-evident records can help close that gap: a public, timestamped trail linking a licence, a lab certificate and a deployed game version, so anyone can check the chain without asking for a PDF. That is the approach Play Fair takes with on-chain certification records. Whatever the tool, the principle holds. A compliance claim should be something an outsider can verify, not just something a footer says.