What GLI-19 is
GLI-19 is a technical standard for Interactive Gaming Systems, which means online gaming platforms. It is published by Gaming Laboratories International (GLI), a testing lab. It sets out what an online gaming platform must do to be fair, secure and easy to audit. Many regulators point to GLI standards in their own rules. So platform providers and operators have an accredited lab (one approved to do this testing) test their systems against GLI-19. They do this before going live in those markets.
Always check which version and which local rules your regulator uses. Rules change, and each market (jurisdiction) can add its own.
GLI-19 vs GLI-33 vs GLI-11
| Standard | Covers | Typical user |
|---|---|---|
| GLI-19 | Interactive gaming systems: the online platform, player accounts and games delivered over the internet | Online casino operators and platform providers |
| GLI-33 | Event wagering systems | Sportsbooks and betting platforms |
| GLI-11 | Gaming devices | Slot and electronic game machines |
What a GLI-19 review looks at
In short, GLI-19 covers online casino platforms, GLI-33 covers sports betting and GLI-11 covers slot machines. The exact rules in GLI-19 depend on the version. But the review broadly covers:
- Player accounts: sign-up, identity checks, account limits, self-exclusion (players blocking themselves from play) and account history.
- Games and fairness: game rules, the random number generator that decides results, and how payouts work.
- Money: deposits, withdrawals, balances and how they are recorded.
- Logs and reports: full records that are hard to alter, which the regulator can audit.
- Security: who can access what, secure connections, protection of player data and control over changes.
- Resilience: how the system copes with failures and outages, and recovers without losing data.
How to prepare
- Confirm which markets you are targeting. Then check which GLI standards and local rules they need.
- Match the parts of your platform to the standard: which parts handle accounts, games, money and logs.
- Check for gaps against the security and logging rules before the lab sees the system.
- Run a penetration test, where a hired expert tries to break in with your permission. Cover the player site, cashier, back office and APIs (the links between apps). Fix the serious findings.
- Prepare documents: how the system is built, how data moves, how changes are approved and how you handle incidents.
- Freeze the version you send in, because labs certify one exact build.
In our experience, most delays come from missing documents and late security fixes, not from the core game logic.
How NextGarrison helps
We do not certify systems. That is the job of accredited labs such as GLI. We get your platform ready for the lab: a gap check, security testing, fixes to logging and access, and documents. See our iGaming security services and our UKGC security audit guide.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.