Every RGS vendor publishes a list of certifications. Almost none publish what it actually takes to get one. The gap between "the studio claims GLI-19" and "GLI signed off this title yesterday" is the part the operator inherits if it is not done correctly.
Step one is RTP audit. The cert lab does not audit the title's design RTP — it audits the production binary's *measured* RTP across millions of simulated rounds, and compares it against the math memo. Our math memos carry an explicit tolerance band — typically ±0.05 percentage points — and the binary that ships is the one that fell inside that band on a 50-million-round run from a fresh PRNG seed.
Step two is PRNG audit. The lab inspects the seeding, the bit-stream depth, the spectral test results and the entropy source. We use a vetted third-party PRNG (not a hand-rolled Mersenne Twister) and the cert evidence we hand over includes the upstream library's NIST suite results.
Step three is jurisdictional fit-out. GLI-19 is the baseline; jurisdictions add or remove. Italy's ADM expects an explicit max-stake-loss-per-spin guarantee. Sweden's Spelinspektionen expects a deposit limit reachable at 10 EUR. The platform's bonus engine has to honour each. We ship one binary; the jurisdiction toggles are config.
Step four is the audit ledger. Every game round writes an append-only entry: round id, seed reference, bet amount, win amount, RTP rolling estimate, jurisdiction. The ledger is what the lab inspects on audit; it is also what the operator's compliance team reads when a player disputes a result.
The four steps take about four weeks for a new title against an established lab relationship. They take three months for a first-time relationship. The studios that publish "GLI certified" without acknowledging the four-week-vs-three-month gap are usually the ones that miss go-live windows.
We track those four weeks as the certification SLA on every roadmap card. It is the only date that matters once the math is locked.