GLI-17 Bonusing Systems v1.3: How Casino Bonus Mechanics Get Certified

GLI-17: Standards for Bonusing Systems in Casinos, Version 1.3, released on 6 September 2011 by Gaming Laboratories International (GLI), is the technical certification standard that governs how casino bonusing systems are tested, approved, and audited before deployment. Suppliers seeking the Gaming Labs Certified® mark for a bonusing system must demonstrate that the system meets the integrity, security, and auditability requirements set out in this standard. What GLI-17 does not do is set bonus policy, wagering multiples, or player protection conditions, those layers belong to each jurisdiction’s regulator. Understanding where the standard’s scope ends and regulatory policy begins is essential for any supplier or operator deploying bonusing systems across multiple licensed markets.

What Does GLI-17 Cover, and What Does It Exclude?

GLI-17 v1.3 governs Bonusing Systems specifically: systems in which the host provides designated gaming devices with additional features that entitle players to special bonus awards based on events triggered at the gaming device. According to the standard’s Chapter 1 overview, bonus awards in scope are “those based on a gaming machine event or some external trigger which do not include triggers based upon specific patron account activity.” The standard uses examples such as multiplied jackpots, where the host system instructs the gaming device to multiply wins within a specified range, and nth-coin awards, where a percentage of play on participating machines reaches a randomly selected value.

Two adjacent standards define the boundaries. GLI-18 (Promotional Systems in Casinos, v2.1) governs patron-account-based promotional schemes, such as earned credits redeemable on a future visit, match-play awards, or cashback tied to player tracking. GLI-16 (Cashless Systems and Technologies) governs the electronic transfer of funds. GLI-17 expressly excludes cashless and promotional system requirements from its scope, stating that suppliers should refer to GLI-16 for cashless transactions and GLI-18 for promotional system regulations. Misidentifying which standard applies at the outset of a certification engagement is a common delay point.

GLI-17 also acknowledges three related standards that may apply in parallel to any given deployment: GLI-11 (Gaming Devices in Casinos), GLI-13 (On-Line Monitoring and Control Systems and Validation Systems in Casinos), and individual Gaming Board Minimum Internal Control Procedures. A bonusing system operating in a market with a strict MCS requirement, for example Ontario or New Jersey, will need its communication protocols assessed under both GLI-17 and GLI-13 simultaneously.

How Is the Standard Structured?

GLI-17 v1.3 is organised into two operative chapters covering gaming device requirements and central system requirements, preceded by a Chapter 1 overview that sets out purpose, scope, and referenced standards. The standard’s stated objectives, drawn directly from Chapter 1, include eliminating subjective criteria in certifying bonusing system operation, testing only those criteria that impact the credibility and integrity of gaming from both revenue collection and game play perspectives, ensuring bonusing systems are fair, secure, and auditable, and distinguishing between local public policy and laboratory criteria. That last principle is the most operationally significant: GLI explicitly states that it is “up to each local jurisdiction to set their public policy with respect to gaming.” Certification under GLI-17 addresses the technical floor, not the regulatory overlay.

The standard is deliberately technology-neutral. GLI-17 Chapter 1 states that the standard “does not specify any particular technology, method or algorithm” and is intended to allow a wide range of methods to achieve compliance while encouraging new approaches. Suppliers are not locked into any particular communication protocol or bonus-delivery architecture, provided the implemented solution satisfies the functional requirements for security, audit, and transparency.

Gaming Device Requirements Under Chapter 2

Section 2.1 of GLI-17 sets out the requirements that apply at the level of the individual gaming device participating in a bonusing scheme. These requirements are additive to those in GLI-11: a bonusing device must already satisfy the base gaming device standard before GLI-17 requirements are layered on top.

The standard requires that qualifying parameters and eligibility conditions for each bonus type be displayed to the patron at or near the gaming device. Where a bonus involves a variable outcome, such as a multiplier active during a bonusing session, the current multiplier value must be displayed. This transparency requirement ensures patrons can assess whether they are currently eligible for a bonus and what the applicable parameters are, without relying on opaque host-side logic.

For accounting meter integrity, GLI-17 s.2.1 specifies how bonus wins must flow through the mandatory meters defined in GLI-11. The Coins-Out meter shall not reflect bonus wins paid by the host to the gaming device. The Machine Paid External Bonus Payout meter must reflect bonus wins paid through the gaming device. The Attendant Paid External Bonus Payout meter must reflect bonus wins paid by hand. The standard includes an explicit note: where a bonus award transferred to a gaming device results in a handpay, the Attendant Paid External Bonus Payout meter must increment for the full value of the award. Where the relevant meter is not supported by the communication protocol in use, this requirement may be waived only if an alternative method to audit handpaid bonus awards exists and is documented.

“The central system shall have the ability to produce logs for all complete bonus transactions to include the same information required on gaming machine audit logs. In addition, these logs shall be capable of being filtered by: a) Machine number, b) Time/Date, and c) Type.”, GLI-17 Bonusing Systems in Casinos v1.3, s.2.3.1

Central System Security Requirements

Section 2.2 of GLI-17 addresses host-side security for the bonusing system. The communication process must be “robust and stable enough to secure each bonus award transaction such that failure event(s) can be identified and logged for subsequent audit and reconciliation.” This requirement has direct testing implications: GLI evaluates whether the system correctly identifies and logs transaction failures, not simply whether it completes transactions under normal conditions.

Communication failure handling is specified at s.2.2.2. Where a bonus transaction fails due to a communication failure, messages indicating the reason for the failure must be displayed to the patron or available through a diagnostic function at the game or system level. The standard goes further: the bonusing system must recognise the failure of bonus win payment and notify appropriate casino personnel so that manual procedures can be implemented to ensure proper payment. Certification testing must therefore verify that failure modes do not silently drop bonus awards.

Modification of critical parameters is governed by s.2.2.3. All changes to factors that materially affect bonusing outcomes must be logged, with access to make those changes restricted to authorised users. The standard requires a verified login for any node accessing critical bonusing applications or associated databases, a limit on the number of stations from which critical applications or databases can be accessed, and a further restriction on the set of users with the permission levels required to adjust critical parameters. This three-layer access control model is a common area of laboratory scrutiny during initial certification.

Diagnostic functionality is addressed at s.2.2.5. Any diagnostic capability available at the device or system level must be controlled such that all activity is traceable to a specific individual. Bonusing diagnostic activity that affects gaming machine associated meters must be capable of being audited by the local regulatory group. This extends the audit obligation from production transactions to maintenance and test operations.

Audit Trails and Financial Reporting

Section 2.3 of GLI-17 requires the central system to produce complete logs for all bonus transactions. These logs must carry the same information fields required on gaming machine audit logs, making cross-referencing between device-level records and system-level records a straightforward reconciliation exercise. The filtering capability, by machine number, time/date, and transaction type, is a mandatory feature, not an optional enhancement. Regulators in markets such as Ontario (under the AGCO Registrar’s Standards for Internet Gaming) and New Jersey (under Division of Gaming Enforcement technical standards) rely on this filtering capability for targeted audit reviews.

Section 2.4 requires the system to produce financial reports covering bonus summaries and detail-level records. Revenue collection integrity depends on accurate machine-level accounting, particularly the correct separation of bonus payouts from base game payouts in the meter hierarchy. Regulatory review depends on the ability to extract transaction-level records for any time period the regulatory group specifies, without requiring bespoke system modifications.

Bonus Approval and the Jurisdiction Layer

GLI-17 s.1.4 contains a note that carries significant practical weight: “All bonuses should require formal submission to and written approval from the local regulatory group who may respond to unconditionally approve, require additional constraints be placed on the bonuses to resolve any issues, or disallow the bonus.” GLI certification of the bonusing system is a precondition for deployment, but each bonus program within that system requires separate regulatory approval in the relevant jurisdiction.

The standard explicitly acknowledges that the “possible permutations and effects concern subtleties best left to the discretion of the individual jurisdiction.” A supplier with a GLI-17 certified bonusing system must still map each bonus mechanic against the approval process of every market in which it is to be offered. A system certified in Nevada may deploy the same underlying technology in Ontario, but the bonus parameters must be filed with and approved by the AGCO before going live.

How Jurisdictions Layer on Top of GLI-17

The most significant jurisdiction-specific overlay on GLI-17 certified systems in 2025 and 2026 comes from the UKGC’s changes to LCCP SR Code 5.1.1 (Rewards and Bonuses). Following the Autumn 2023 consultation, the UKGC determined to cap wagering requirements on promotional offers at a maximum of 10 times, ban the mixing of products within incentives, and restructure the LCCP SR Code 5.1.1 obligations. A bonus that requires turnover across both casino and sports betting cannot be structured as a single mixed incentive under the revised code. These changes entered force on 19 December 2025. Remote gambling licensees in Great Britain must ensure that any bonusing system, whether GLI-17 certified or deployed on a GLI-19 certified interactive gaming platform, enforces a wagering requirement at or below 10x. A GLI-17 certified system whose parameter controls allow operators to set wagering multiples above 10x is technically compliant with the standard but non-compliant with LCCP if deployed in the UK market without a hard cap at the platform or configuration layer.

Jurisdiction	Regulator	Key Bonus Policy Requirement	Effective Date
Great Britain	UKGC	Wagering requirements capped at 10x, no product mixing within incentives (LCCP SR Code 5.1.1)	19 December 2025
Malta	MGA	Full material-information disclosure including wagering/deposit requirements, with player progress visibility (MGA Commercial Communications Committee Guidelines)	Ongoing
Ontario, Canada	AGCO	Bonus advertising only on gaming site or via direct opt-in player communication, no unsolicited inducement advertising (Registrar’s Standards Standard 2.05)	April 2022 (ongoing)
Alberta, Canada	AGLC	Bonus and promotion advertising prohibited except via direct opt-in communications, aligned with Ontario model	13 July 2026 (market launch)
All GLI-17 markets	Local regulatory group	Written approval required for each bonus program prior to deployment	Per GLI-17 s.1.4

In Malta, the MGA’s Commercial Communications Committee Guidelines require that any promotional scheme, including a bonus offer, must not be misleading and must provide the player with “clear, intelligible, unambiguous and easy-to-follow information including all the relevant material information.” This includes wagering and deposit requirements displayed with sufficient prominence and in intelligible examples. Authorised persons must ensure players can view their progress toward fulfilling bonus conditions in real time. A GLI-17 or GLI-19 certified system that does not surface this progress information at the player interface is non-compliant with MGA requirements regardless of its certification status.

In Ontario, AGCO Registrar’s Standard 2.05 requires that advertising and marketing communicating gambling inducements, bonuses, and credits be offered only on the operator’s gaming site or directly to players who have given consent. Systems that trigger automatic promotional communications to all registered players, rather than only to those who have consented, place the operator in breach of the Registrar’s Standards. The AGCO’s Go-Live Compliance Guide identifies Standard 2.05 compliance as a specific pre-launch verification item. Alberta, whose regulated iGaming market opened on 13 July 2026 under the AGLC Standards and Requirements for Internet Gaming, has codified equivalent advertising restrictions, confirming the same opt-in model for bonus communications.

“The authorised person shall ensure that players can constantly view their progress in fulfilling the requirements in order to benefit from any opportunity or advantage granted by the promotional scheme.”, MGA Commercial Communications Committee Guidelines

What Does Certification Testing Actually Examine?

GLI-17 certification proceeds in phases consistent with the GLI testing methodology. Initial laboratory testing evaluates the bonusing system in conjunction with gaming devices in a controlled laboratory environment. The laboratory tests communication protocol robustness, parameter modification controls, audit trail completeness, and the correct operation of the mandatory meter hierarchy defined in GLI-11. On-site certification then verifies that the system’s communications and configuration function correctly on the casino floor prior to production deployment, consistent with the two-phase certification model described in the adjacent GLI-18 standard.

Specific test scenarios target communication failure handling: the laboratory verifies that a communication break between the bonusing host and a gaming device results in a logged failure, a patron-visible or diagnostically accessible notification, and a personnel alert enabling manual resolution. This failure-mode testing is where many first submissions encounter deficiencies. Systems that handle the happy path correctly but lose transaction integrity under failure conditions require remediation before certification can proceed.

Access control testing verifies the three-layer security model at s.2.2.4: authenticated login for any node accessing critical bonusing databases, physical and logical access limits on the number of stations with access to critical applications, and role-based permission controls on the users who can adjust critical parameters. The laboratory will attempt to access or modify critical bonusing parameters without the requisite credentials to confirm that the controls are effective, not merely documented.

GLI-17 and Responsible Gambling Controls: The Intersection

GLI-17 does not itself contain responsible gambling requirements. The standard addresses technical integrity, accurate meter accounting, secure parameter control, complete audit trails, and leaves player protection policy to jurisdictional regulators. The systems certified under GLI-17 are, however, increasingly subject to responsible gambling constraints imposed at the jurisdictional level that have direct technical implications for how bonusing systems must be configured.

The UKGC’s ban on product mixing within incentives, effective 19 December 2025, requires that bonusing systems track wagering contribution by product category and enforce the single-product restriction at the engine level, not merely in terms and conditions. A system whose configuration layer cannot separate casino wagering contributions from sports betting contributions cannot implement this requirement in a technically verifiable way. Operators deploying GLI-17 certified systems in Great Britain must confirm with their supplier that the parameter controls support product-category contribution tracking.

Self-exclusion interactions with bonusing systems represent a second compliance intersection. Where a player has self-excluded under GAMSTOP in Great Britain, BetGuard in Ontario, or OASIS in Germany, the bonusing system must not issue bonus awards to that player’s account. AGCO enforcement illustrates the stakes: in its $105,000 penalty against theScore in May 2026, the AGCO cited failures in player monitoring and intervention that allowed a high-risk patron to continue wagering without appropriate responsible gambling controls being applied. According to the AGCO enforcement notice, that case involved player interaction obligations under Standard 2.10 rather than bonusing system controls specifically, but it demonstrates the enforcement posture regulators bring to system-level player protection failures.

For operators subject to responsible gambling compliance obligations across multiple jurisdictions, bonusing system configuration must be treated as a market-specific exercise rather than a single global deployment. A GLI-17 certified system provides the certifiable technical foundation, each jurisdiction’s regulatory requirements determine how that system must be parameterised before it can lawfully operate. Operators and compliance teams should consult qualified legal counsel for jurisdiction-specific application of bonus policy requirements, particularly as the UKGC’s LCCP SR Code 5.1.1 amendments continue to be implemented and interpreted by licensees. To begin your certification assessment, review the GLI Certification hub, which provides an overview of the full Gaming Laboratories International standards family and how individual certifications interact across jurisdictions.

Key Resources

GLI Standard #17, Standards for Bonusing Systems in Casinos, Version 1.3 (Gaming Laboratories International, September 6, 2011): The primary technical standard. Available through GLI’s standards library at gaminglabs.com.

UKGC LCCP SR Code 5.1.1, Rewards and Bonuses (UK Gambling Commission): Governs the 10x wagering cap and product-mixing ban in force from 19 December 2025. See the Autumn 2023 consultation response on socially responsible incentives at gamblingcommission.gov.uk.

MGA Commercial Communications Committee Guidelines (Malta Gaming Authority): Sets out material-information disclosure and player progress requirements for promotional schemes. Available at mga.org.mt.

AGCO Registrar’s Standards for Internet Gaming, Standard 2.05 (Alcohol and Gaming Commission of Ontario): Governs opt-in consent requirements for bonus and inducement advertising. Available at agco.ca.

GLI-11 Standards for Gaming Devices, v3.0, GLI-13 On-Line Monitoring and Control Systems, GLI-16 Cashless Systems and Technologies, GLI-18 Standards for Promotional Systems in Casinos (Gaming Laboratories International): Adjacent standards that govern the technical environment in which GLI-17 certified bonusing systems operate.