iGaming Platform Certification 2026 Guide

iGaming platform certification is the requirement that turns a provisional licence into a go-live approval. Without it, the compliance review can be finished, the fit-and-proper assessments passed, the team hired, the banking sorted and the platform still can’t open to real-money players. It’s not a formality. It’s a parallel critical path that operators consistently start too late.

A B2C operator received their provisional MGA licence in month eight of their application. The team celebrated. Launch planning moved into overdrive. Someone asked about the technical approval and platform certification status. The answer: the RNG certification had been submitted to a testing lab two weeks earlier. The lab’s current booking queue meant testing wouldn’t start for another four weeks. Testing and review would take six to eight weeks after that.

The platform wasn’t going to be certified for another three months minimum. The provisional licence was eleven weeks old before they could open.

Three months of staff costs, operational overhead, and opportunity cost because certification was treated as something to start after the licensing milestone rather than in parallel with it.

That pattern is common enough to be the standard outcome for operators who don’t plan certification correctly. This article covers what iGaming platform certification actually involves, how long it takes, and what planning decisions prevent it becoming the bottleneck.

What iGaming Platform Certification Covers

iGaming platform certification is separate from game certification, though the two are related and often confused. Game certification covers individual titles their RNG implementation, mathematics, and RTP accuracy. Platform certification covers the system that delivers those games to players the infrastructure, security architecture, player account management, regulatory reporting capability, and audit logging.

Specifically: the platform needs to demonstrate that it delivers games correctly and completely, that player account data is secure and tamper-evident, that transaction logs are complete and auditable, that the regulatory reporting system produces outputs in the format the licensing jurisdiction requires, and that the security architecture meets the technical standards of the applicable framework.

The MGA’s technical approval process covers all of these. The Curaçao Gaming Authority under the LOK requires equivalent verification before go-live. Neither accepts the platform provider’s assurance that the platform meets the standard they require independent testing laboratory confirmation.

The regulatory reporting component

Platform certification specifically includes regulatory reporting capability. The platform must produce statistical returns in the format the regulator requires, at the frequency required, with the data fields required. A platform that delivers excellent games and player experience but can’t produce regulatory reports in the correct format fails the certification requirement on that basis alone. Checking regulatory reporting capability before the certification process starts not during it saves weeks.

iGaming Platform Certification: Who Conducts the Testing

iGaming platform certification must be conducted by an approved independent testing laboratory. Self-certification or provider-issued certification has no standing with major regulators. The regulator publishes a list of approved labs. Only certification from those labs satisfies the requirement.

The major independent testing laboratories with broad multi-jurisdiction approval coverage including eCOGRA and iTech Labs operate globally and hold approvals from the MGA, the Curaçao Gaming Authority, and dozens of other regulatory jurisdictions. The right lab is the one with approval in every jurisdiction the operator currently holds or plans to hold a licence in. A certification from a lab not approved by the relevant regulator doesn’t satisfy the requirement regardless of the lab’s general reputation.

Lab selection and booking lead times

The most in-demand labs have booking queues. A new platform certification project may wait three to six weeks before testing begins. Combined with the testing period itself typically four to eight weeks depending on platform complexity the total elapsed time from first engagement to certificate can run to three to four months for a complex platform.

The implication is simple but consistently missed: lab engagement should happen at application submission, not after provisional licence receipt. The application is in. The operator books the lab. Both processes run in parallel. When the compliance review completes, the certification is ready or nearly ready. When lab booking happens after provisional licence receipt, the three-to-four-month certification period sits entirely outside the application timeline.

iGaming Platform Certification Scope: What Gets Tested

The scope of iGaming platform certification testing varies by regulator and lab, but the consistent elements across major jurisdictions cover six areas. Security architecture. Player account integrity. Transaction logging. Game delivery accuracy. Regulatory reporting. Responsible gaming tool integration.

Security architecture testing covers: encryption standards for data in transit and at rest, access control systems, vulnerability assessment, and penetration testing methodology. The lab doesn’t just check that security policies exist. It tests whether the implemented security meets the standard.

Player account integrity covers: whether account balances are accurately maintained, whether the system prevents unauthorised balance modification, and whether the audit trail for account changes is complete and tamper-evident. A platform that allows balance manipulation even inadvertently, even without a practical exploit fails this element.

Transaction logging requirements

Complete, accurate, and auditable transaction logs are a certification requirement. Every deposit, withdrawal, bonus crediting, and adjustment must be logged with sufficient detail for a regulator to reconstruct the full transaction history for any player account. Logs that are incomplete, that can be modified after the fact, or that don’t capture all required data fields fail the certification standard.

This is an area where platform providers sometimes discover compliance gaps during certification that weren’t visible during development. The development team built a logging system that looked complete. The certification process revealed edge cases where transactions weren’t being captured correctly.

Responsible gaming tool integration in certification

iGaming platform certification checks whether the responsible gaming tools integrate correctly with the payment layer. Deposit limits that exist as account settings but don’t enforce at the payment processing level fail the technical certification check. Self-exclusion that blocks platform login but doesn’t block payment processing fails. The certification confirms these integrations are technically correct it doesn’t verify that they stay correct after subsequent platform updates.

iGaming Platform Certification and Platform Providers

Platform providers companies supplying gaming platforms to B2C operators face their own iGaming platform certification requirements. Under the MGA B2B Critical Gaming Supply licensing framework, platform providers are critical suppliers whose technology must meet the same technical standards that operators face in their go-live certification.

The practical implication: operators choosing a platform provider should confirm that the provider’s platform has current MGA technical approval, not just that the provider claims MGA B2B licensing. The B2B licence is a corporate compliance credential. The platform certification is a technical compliance credential. An operator who discovers during their own certification process that the platform provider’s technical approval lapsed six months ago has a serious timeline problem.

Provider certification versus operator certification

There’s a distinction between a platform provider’s certification of their base platform and an operator’s certification of their specific deployment. A platform provider with certified technology doesn’t automatically certify each operator’s configuration. The operator’s customisations, additional integrations, and specific configuration choices may take the deployed platform outside the scope of the provider’s existing certification.

Operators need to confirm with both the platform provider and the testing lab what scope of certification the provider’s existing certificate covers and what additional certification the operator’s specific deployment requires. Assuming the provider’s certification covers everything consistently produces scope surprises during the operator’s own go-live certification.

What B2B licensing requires for platform providers and what it means for operators relying on those platforms is covered in iGaming B2B licensing in 2026.

The Timeline for iGaming Platform Certification

The total elapsed time for iGaming platform certification from the decision to start through to certificate in hand runs to three to four months for a standard platform, longer for complex configurations.

Lab selection and engagement: one to two weeks to select the appropriate lab, confirm approval status in all relevant jurisdictions, submit the certification request, and agree scope and timeline.

Booking queue: two to six weeks before testing begins, depending on lab workload. This period is entirely outside the operator’s control and is the most consistent source of timeline surprise for operators who didn’t engage early.

Technical preparation and documentation: while waiting in the queue, the platform provider and operator need to prepare the technical documentation the lab will review architecture documentation, security standards, test environment access, transaction logging samples, regulatory reporting output samples. Preparation that happens in parallel with the queue wait is preparation that doesn’t extend the timeline.

Testing period: four to eight weeks depending on platform complexity. Complex configurations with custom integrations, multiple jurisdictional deployments, or unusual security architectures take longer.

Review and certificate: one to two weeks from test completion to formal certificate issue.

iGaming Platform Certification After Go-Live: Ongoing Obligations

iGaming platform certification isn’t a one-time exercise. The certificate covers the platform as it was when testing was conducted. Material changes to the platform after certification may require recertification.

What typically requires recertification or at least regulatory notification: changes to the core game delivery infrastructure, security architecture changes, modifications to the player account management system, changes to the transaction logging mechanism, updates to the regulatory reporting system. Not every platform update triggers recertification cosmetic changes, minor UI updates, and routine maintenance don’t. But development teams working on agile release cycles need a process for identifying which releases contain changes that trigger notification or recertification obligations.

Without that process, changes go live without regulatory notification. The platform’s certification status then moves away from the approved version. This is exactly the kind of compliance gap that appears in annual compliance audits and generates remediation requirements.

Annual certification maintenance

Some jurisdictions require annual confirmation that the certified platform remains in the configuration covered by the existing certificate. This isn’t a full recertification it’s a documented review confirming no material changes have occurred that would invalidate the certificate. Operators who treat certification as a one-time event and don’t track this requirement miss the annual confirmation deadline, which is itself a compliance gap.

The RNG testing that forms part of the platform certification process and how to plan its timeline to avoid it becoming the go-live bottleneck is covered in online gaming RNG testing in 2026. How platform certification relates to the broader game certification requirements is in game certification in iGaming in 2026. And how certification fits within the full casino launch timeline is in how to start an online casino in 2026.

iGaming Platform Certification and Aggregator-Supplied Content

The intersection of iGaming platform certification and game aggregator supply chains creates a specific compliance question that operators sometimes miss. Platform certification covers the operator’s platform infrastructure. Game certification covers the individual titles. The aggregator sits in the middle.

Content delivered through an aggregator is still content on the operator’s certified platform. If an aggregator delivers an uncertified game version because a studio updated the game without completing recertification that uncertified content is running on an operator’s certified platform. The platform’s certification doesn’t extend to the content delivered through it. The content needs its own certification regardless of how it arrives.

Most operators discover this gap during their first thorough compliance review of the aggregator-supplied content library. The platform is certified. The aggregator is contracted. The specific game versions currently live may not have current certificates.

The practical check is clear: before go-live, operators should obtain current certificate documentation from the aggregator for every title in the library. They should also confirm that each certificate covers the specific version currently delivered and create a notification process for future content updates.

How aggregator-supplied content certification works and what operators need to verify before signing aggregator agreements is in iGaming game aggregators in 2026.

Frequently Asked Questions

What is iGaming platform certification and why is it required?

iGaming platform certification is the independent technical verification that a gaming platform meets the technical standards required by a licensing jurisdiction. It covers security architecture, player account integrity, transaction logging completeness, game delivery accuracy, regulatory reporting capability, and responsible gaming tool integration. It’s required because regulators need independent confirmation not operator or platform provider assurance that the platform operates correctly and securely. Without a current platform certificate from an approved testing laboratory, operators cannot receive go-live approval in major licensing jurisdictions.

How long does iGaming platform certification take?

Three to four months from initial lab engagement to certificate for a standard platform. The main components: one to two weeks for lab selection and engagement, two to six weeks in the lab’s booking queue before testing starts, four to eight weeks for the testing period depending on platform complexity, and one to two weeks for certificate issue after testing completes. Operators most consistently underestimate the booking queue period because they cannot control it. That is why they should start certification at application submission rather than after provisional licence receipt.

What does iGaming platform certification cover?

Security architecture encryption, access controls, penetration testing. Player account integrity balance accuracy, tamper-evident audit trails, unauthorised modification prevention. Transaction logging completeness, accuracy, and auditability of all financial transaction records. Game delivery correct and complete delivery of game content. Regulatory reporting system capability to produce statistical returns in the regulator’s required format and frequency. Responsible gaming tool integration confirms that deposit limits, self-exclusion, and other tools work correctly at the technical level. They must not exist only as account settings.

Who can conduct iGaming platform certification?

Only independent testing laboratories approved by the relevant licensing jurisdiction. The regulator publishes its list of approved labs. Certification from a lab not on that list doesn’t satisfy the requirement regardless of the lab’s general reputation. The same lab may hold approval in some jurisdictions but not others. Operators targeting multiple jurisdictions need to confirm their chosen lab holds approval in all relevant markets before committing to an engagement.

Do platform providers need their own certification separate from operators?

Yes. Platform providers supplying critical gaming technology to MGA-licensed operators require their own B2B licensing and their own platform certification. An operator using a platform from a provider with current technical certification benefits from that certification but the provider’s certificate covers the base platform. The operator’s specific deployment, customisations, and additional integrations may require further certification beyond what the provider’s existing certificate covers. Operators should confirm with both the provider and the testing lab exactly what scope the provider’s certification covers before assuming it extends to their deployment.

What happens to iGaming platform certification when the platform changes?

Material changes to the platform may require recertification or at minimum regulatory notification before they go live. Material changes include updates to core game delivery infrastructure and security architecture. They also include changes to player account management systems, transaction logging mechanisms, and regulatory reporting systems. Cosmetic and minor maintenance updates typically don’t require recertification. Development teams need a compliance review process in the release pipeline to identify which changes are material and trigger certification obligations. Without that process, material changes go live without notification, which is a compliance finding in annual audits.