Suppose a government decides to legalise online casino games tomorrow. Writing the law is the easy part. The harder question arrives immediately afterwards: how does anyone confirm that the software people are playing behaves the way the licence says it does, and who is qualified to make that call?
Almost no sovereign regulator answers this by testing the code itself. What they build instead is a chain of delegated verification, and the design of that chain is the real regulatory product. It determines whether a licence is a meaningful statement about a platform's random number generator, payout logic, data handling and account controls, or just a receipt for a fee.
One distinction is worth drawing before going any further, because it is routinely blurred. Regulators and the testing laboratories they recognise sit inside that verification chain and have legal authority behind them. Commercial review and comparison websites, which publish operator-by-operator terms, licensing details and payment options in one place (source:thespike.gg/reviews/), sit entirely outside it. They are publishers with a commercial interest, not auditors, and their assessments carry no regulatory weight whatever language they use. A reader can find them useful for orientation while understanding that nothing on such a site constitutes verification of a platform.
Two recent builds show how differently sovereign regulators solve the actual verification problem.
Brazil built the chain and the bottleneck at the same time
Brazil is the largest new regulated market of the decade and the clearest example of a framework assembled from scratch. Law 14.790 of 2023 created a federal regime for fixed-odds betting and online casino games, with the Secretariat of Prizes and Betting inside the Ministry of Finance as the regulator, and the market opened on 1 January 2025.
Two instruments do the technical work. Ordinance SPA/MF 300 of 2024 sets the requirements and procedures by which the regulator recognises the operational capacity of certifying entities, meaning the laboratories permitted to test betting systems, live game studios and online games. Ordinance SPA/MF 722 of 2024 then obliges operators to have their betting system certified by one of those recognised entities.
The list of recognised laboratories is published by the Ministry of Finance itself and has grown since licensing began. As of the current official list, seven entities are recognised, each admitted by its own ordinance: Gaming Laboratories International, eCOGRA, BMM Spain Testlabs, Gaming Associates Europe, Quinel, Lean Lab Company and BMM North America. Industry reporting on Ordinance 722 describes an obligation to revalidate assessment reports annually and whenever critical components change, though operators and their advisers should work from the ordinance text rather than from secondary summaries on that point.
What happened when the paperwork met the deadline
The interesting part is what the design did under load. With more than a hundred applicants and a single-figure number of recognised laboratories, the labs became the constraint. In January 2025 the regulator published Normative Instruction No 3/2025, which standardised the format of technical certificates with a set cover page and index and required operators to file index documents through the Sigap portal, updated monthly where certifications change. That is a small administrative fix to a structural problem: a certification regime is only as fast as the number of accredited labs willing to work in that jurisdiction.
Ontario delegated the testing and audited the controls instead
Ontario took a different route when it opened its market, and its documentation is unusually explicit about the division of labour. Under the Registrar's Standards for Internet Gaming, standard 4.08 requires that all games, random number generators and the system components that accept, process, determine the outcome of, display and log player bets, including any later modifications, are either approved by the Registrar or certified by an independent testing laboratory registered with the regulator.
The Alcohol and Gaming Commission of Ontario stated plainly when the scheme launched that it would not test gaming technology in house. Laboratories must register as gaming-related suppliers and confirm, through independent audit, that their testing methodology is configured to the Registrar's standards before they can issue certificates. On top of the technical layer, operators submit an independently audited assessment of the processes and controls they use to meet the standards, which the regulator refers to as a control activity matrix. Details for suppliers are set out on the regulator's own iGaming suppliers guidance.
The difference in emphasis matters. Brazil's model concentrates on certifying the product before entry. Ontario's adds a second question about whether the operator's internal controls actually work in daily operation, which is closer to how financial regulators approach the same problem.
Reading a framework without taking its word for it
For anyone assessing a new regime, whether as a journalist, a policymaker or a resident of a country about to license this activity, the useful questions are structural rather than rhetorical. Any regulator will describe its framework as robust. The framework's design tells you more than its description.
|
Question |
Brazil (SPA/MF) |
Ontario (AGCO) |
|
Who sets the technical standard |
The regulator, through Ordinances 300 and 722 of 2024 and later normative instructions |
The Registrar, through the Standards for Internet Gaming |
|
Who performs testing |
Certifying entities recognised by the regulator and published on its own list |
Independent testing laboratories registered with the regulator; no in-house testing |
|
What must be certified |
The betting system, covering sports betting and online gaming platforms |
Games, random number generators and bet-handling system components, including modifications |
|
Recheck trigger |
Revalidation of assessment reports, including on changes to critical components |
Registrar approval or lab certification before deployment, including for modifications |
|
Additional assurance |
Technical certificates and index documents filed through the Sigap portal |
Independently audited control activity matrix covering operator processes |
A framework that names its standard-setter, its testing bodies, its recheck triggers and its filing route is one that can be held to account. A framework that names none of these is asking to be trusted.
Because regulators publish these lists and standards themselves, a reader can verify any claim about them at source, which is precisely what separates an official register from a commercial directory that ranks platforms for a living.
The other thing worth noticing is how much of this rests on a small number of private laboratories operating across many jurisdictions at once. That concentration is what makes mutual recognition possible, since a lab can carry prior testing between markets. It is also a single point of strain, as Brazil discovered within a month of opening. Governments write the standards, but the capacity to enforce them technically sits mostly outside government, and no amount of legislative drafting changes that.
This article is provided for informational purposes only. Gambling laws and promotional availability vary by jurisdiction. Readers should confirm local requirements and only use gambling services where legally permitted. Gambling involves financial risk and is intended for adults of legal gambling age.
