Testing labs decoded: what GLI, BMM, iTech Labs and eCOGRA actually certify

Ask a slot studio whether its games are certified and the answer is almost always yes. Ask which lab, against which standard, for which version and for which market, and the conversation slows down. That second set of questions is where the useful information sits.

We went back through every certificate on file for the suppliers profiled on Gamitas. There are 195 of them, held by 111 companies. Only 87 were issued by gaming test laboratories. The rest are ISO certificates, SOC 2 reports, PCI attestations and identity-verification approvals, which matter, but answer different questions. This guide is about the 87.

Which labs turn up, and how often

One name dominates. Gaming Laboratories International appears on certificates held by 40 suppliers. Add iTech Labs, the Australian lab GLI bought outright in May 2023, and the group accounts for 46 of the 57 lab-tested suppliers we track. BMM Testlabs is a distant second with 12.

Most suppliers stick with one lab. 41 of the 57 hold certificates from a single lab, 10 use two, and six use three or more. The multi-lab suppliers are not hedging for the sake of it. They are usually chasing market coverage: a regulator accepts only the labs on its own list, and no lab is on every list.

Lab certification is also concentrated by category. A quarter of the game providers we profile have a lab certificate on file, and almost the same share of platform providers. Outside those two groups it all but disappears.

That last point is easy to miss when comparing suppliers across categories. A payments provider with no GLI certificate is not cutting corners. Nobody tests a PSP for RNG fairness. Its equivalent is a PCI DSS attestation. If you are shortlisting game providers, though, a missing lab certificate deserves a question.

The labs, side by side

The labs are not interchangeable, even though their certificates look alike. They differ in age, ownership and, most usefully for buyers, in which regulators accept their work.

What a lab certificate actually covers

"Certified by GLI" can mean at least four different things. In our records the split looks like this: 35 of the 87 lab certificates cover a random number generator, 22 cite a GLI system standard, and most of the rest are game approvals for named titles or for a named market.

Two of the certificates we hold are explicitly labelled non-jurisdictional. That is not a weakness. Platform providers often get a GLI-19 or GLI-33 against the base standard first, then add market-specific approvals as operators ask for them. The mistake is reading the base certificate as a licence to launch.

Where buyers misread them

The version has moved on

Lab certificates are tied to a build. An RNG certificate for "version 1.0" says nothing about version 3.2. Only 17 of the 87 lab certificates on file carry an expiry date, because most do not expire in the usual sense. They simply stop describing the software once it changes. Ask for the report number and the version it covers, then ask what has shipped since.

The market is different

Brazil is the clearest recent example. From 2024, only labs accredited by the Secretaria de Prêmios e Apostas could certify for the federal market, so suppliers with years of GLI and BMM paperwork still needed new, Brazil-specific approvals. Eight of the lab certificates in our records were issued for Brazil. Our Brazil compliance page sets out what the SPA asks for.

It is the wrong kind of certificate

ISO 27001 turns up 43 times in our records, nearly as often as GLI's 45. It is issued by certification bodies such as BSI and Bureau Veritas, and it audits how a company manages information security. It does not test a single game. The reverse is also true: a GLI certificate says nothing about how a supplier protects data. If you see iBeta on a supplier's page, that is another category again. All nine iBeta certificates we hold are ISO/IEC 30107-3 liveness tests for identity-verification vendors.

What to ask for instead of "are you certified?"

1. The report or certificate number. It lets you match the document to the lab's records rather than to a logo on a website.
2. The standard and the version. GLI-19, GLI-33 or a jurisdiction's own technical standard, and the exact software version tested.
3. The jurisdiction list. Which markets the certificate was issued for, and which are planned.
4. The lab's standing with your regulator. Check the lab against the regulator's approved list, not the supplier's.
5. What changed since. Any release after the test date should either be re-certified or fall under a change-control process the regulator accepts.

We cover the wider set of documents, including ISO 27001, SOC 2 and PCI DSS, in what gaming certifications prove, and what they do not.

How we counted

Figures come from the certificate records attached to supplier profiles on Gamitas as of October 2026: 195 certificates across 111 suppliers, of which 87 were issued by gaming test laboratories. Each record links to the evidence the supplier or its announcement published. We grouped legal entities of the same lab together, so GLI LLC, GLI Europe and similar count as GLI, and kept iTech Labs separate because its certificates are still issued in its own name. Lab histories and approvals come from the labs' own material and the UK Gambling Commission's register of approved test houses.