iGaming Security

GLI-19 Standards Explained: A Plain-English Guide for iGaming Platforms

By NextGarrison Security TeamPublished 6 min read

Planning to launch an online casino platform in a regulated market, or move one there? Someone will ask if it is GLI-19 certified. Here is what that means and how to get ready.

In plain English

  • GLI-19 is a technical standard that online casino platforms are tested against before going live.
  • Many gambling regulators use it to check that platforms are fair, secure and easy to audit.
  • An approved lab does the testing; your job is to get the system and paperwork ready.
  • In our experience, late paperwork and security fixes cause most delays, so start early.

What GLI-19 is

GLI-19 is a technical standard for Interactive Gaming Systems, which means online gaming platforms. It is published by Gaming Laboratories International (GLI), a testing lab. It sets out what an online gaming platform must do to be fair, secure and easy to audit. Many regulators point to GLI standards in their own rules. So platform providers and operators have an accredited lab (one approved to do this testing) test their systems against GLI-19. They do this before going live in those markets.

Always check which version and which local rules your regulator uses. Rules change, and each market (jurisdiction) can add its own.

GLI-19 vs GLI-33 vs GLI-11

StandardCoversTypical user
GLI-19Interactive gaming systems: the online platform, player accounts and games delivered over the internetOnline casino operators and platform providers
GLI-33Event wagering systemsSportsbooks and betting platforms
GLI-11Gaming devicesSlot and electronic game machines

What a GLI-19 review looks at

In short, GLI-19 covers online casino platforms, GLI-33 covers sports betting and GLI-11 covers slot machines. The exact rules in GLI-19 depend on the version. But the review broadly covers:

  • Player accounts: sign-up, identity checks, account limits, self-exclusion (players blocking themselves from play) and account history.
  • Games and fairness: game rules, the random number generator that decides results, and how payouts work.
  • Money: deposits, withdrawals, balances and how they are recorded.
  • Logs and reports: full records that are hard to alter, which the regulator can audit.
  • Security: who can access what, secure connections, protection of player data and control over changes.
  • Resilience: how the system copes with failures and outages, and recovers without losing data.

How to prepare

  1. Confirm which markets you are targeting. Then check which GLI standards and local rules they need.
  2. Match the parts of your platform to the standard: which parts handle accounts, games, money and logs.
  3. Check for gaps against the security and logging rules before the lab sees the system.
  4. Run a penetration test, where a hired expert tries to break in with your permission. Cover the player site, cashier, back office and APIs (the links between apps). Fix the serious findings.
  5. Prepare documents: how the system is built, how data moves, how changes are approved and how you handle incidents.
  6. Freeze the version you send in, because labs certify one exact build.

In our experience, most delays come from missing documents and late security fixes, not from the core game logic.

How NextGarrison helps

We do not certify systems. That is the job of accredited labs such as GLI. We get your platform ready for the lab: a gap check, security testing, fixes to logging and access, and documents. See our iGaming security services and our UKGC security audit guide.

#GLI-19#GLI-33

Need a hand with this?

Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.

Written by

NextGarrison Security Team

Penetration testers, SOC analysts and compliance consultants

Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.

Frequently Asked Questions

Who issues GLI-19 certification?

Accredited test labs, most notably Gaming Laboratories International, test the system. They then issue a certificate or report for the markets you are targeting.

Do sportsbooks need GLI-19?

Sportsbooks are usually tested against GLI-33, the standard for event wagering (sports betting) systems. A platform that offers both casino games and betting may need both standards.

Keep reading