Running Both Standards: GLI-19, GLI-33, and Composite Submissions for Combined Casino and Sportsbook Platforms

Operators and suppliers building combined casino and sportsbook platforms routinely encounter a question that has no clean single-standard answer: which GLI standard governs the platform, and does certification under one remove any obligations under the other? For any platform hosting both RNG-based casino games and live sports wagering, both GLI-19 and GLI-33 apply concurrently, and each covers system components that the other does not. Structuring the submission correctly from the outset determines whether you clear testing in one pass or spend months resolving scope disputes with your testing laboratory.

What Each Standard Governs: The Non-Negotiable Scope Boundary

GLI-19: Standards for Interactive Gaming Systems (v3.0, revised July 17, 2020) is GLI’s primary technical standard for server-side RNG-based gaming. Its scope covers the Interactive Gaming System as an integrated whole: game server logic, random number generation and statistical validation, client rendering, account management, transaction processing, jackpot systems, and responsible gambling controls embedded at the system level. The standard is a living document and has been tailored periodically as the interactive gaming industry has evolved.

GLI-33: Standards for Event Wagering Systems (v1.1, revised May 14, 2019) was developed specifically for the event wagering sector. Its opening text is clear about intent: the standard “is intended to be used by regulatory bodies, operators, and industry suppliers as a compliance guideline for technologies and procedures pertaining to event wagering.” GLI-33 addresses the structurally different risk and integrity profile of sports betting, where outcomes are determined by real-world events rather than an RNG. Its core technical chapters cover wager placement and confirmation, odds management, event result settlement, player account management within the wagering context, external wagering system interoperability (host/guest configurations), and operational procedures.

“This standard is not intended to represent a set of prescriptive requirements that every Event Wagering System and operator shall comply with, however, it does establish a standard regarding the technologies and procedures used to facilitate these operations.”, GLI-33: Standards for Event Wagering Systems, v1.1, About This Standard

That flexibility in GLI-33 matters operationally: it means jurisdictions adopting GLI-33 may specify which chapters are mandatory and which are treated as guidance. Compliance teams must confirm with the relevant regulatory body which sections are directly mandated in their target market, rather than assuming all GLI-33 chapters carry equal weight in every jurisdiction.

When Does a Platform Require Both Standards?

A combined casino and sportsbook platform requires certification under both standards whenever the same production system processes both RNG-based game outcomes and real-event wagering transactions. The operative question is not whether the user interface presents a unified brand or a single wallet, it is whether the underlying system components include an Interactive Gaming System as defined by GLI-19 and an Event Wagering System as defined by GLI-33. If both are present, both certifications are required.

Shared account management infrastructure does not collapse the two standards into one. GLI-19’s player account requirements apply to the casino-side of the platform, GLI-33’s player account requirements apply to the wagering-side. Where a single account layer serves both product verticals, each vertical’s regulatory requirements must still be met independently. The architecture diagram submitted as part of the certification engagement must make these boundaries explicit.

The clearest signal that both standards apply is product inventory. If the platform offers any combination of the following, both GLI-19 and GLI-33 are in scope: slots, table games, live dealer, poker, bingo, keno (GLI-19 scope); and fixed-odds sports betting, in-play betting, exchange wagering, or any market whose outcome is determined by a real-world sporting or competition result (GLI-33 scope).

Does GLI-33 Certification Exempt Any Game Type from GLI-19?

No. Certification under GLI-33 does not exempt any component of a platform from GLI-19 obligations where GLI-19 requirements apply to that component. The two standards address distinct system architectures and do not substitute for each other.

There is one scenario compliance teams frequently misread: virtual sports products offered on a sportsbook interface. GLI-19 Section 4.17 addresses this directly. Where a Gaming Platform supports virtual event wagering, the standard states that the platform “shall meet the requirements specified for ‘Virtual Event Wagering’ within the [GLI-33 Standards for Event Wagering Systems].” This is a cross-reference, not a transfer of certification jurisdiction. The platform must satisfy GLI-33’s virtual event wagering chapter (Section 4.5) for the event wagering mechanics. GLI-19 Section 4.17 additionally requires that “the RNG utilized for virtual event wagering shall comply with applicable RNG Requirements of this [GLI-19] document.” Both obligations coexist. A GLI-33-only certification for a virtual sports product that sits on a GLI-19 Gaming Platform is incomplete.

GLI-33 Section 4.5 adds a further routing distinction. Where virtual event wagering is “conducted by a gaming device” rather than the full Event Wagering System, the standard directs the reader to GLI-11: Standards for Gaming Devices. This matters for operators who deploy virtual sport terminals as self-contained gaming devices rather than as a product offered through the core Event Wagering System. In that configuration, GLI-11 governs the device, not GLI-33. Compliance teams must identify which product delivery model applies before determining the applicable certification path. The three possible configurations are virtual sports through the full EWS (GLI-33), virtual sports through the Gaming Platform (GLI-19 cross-referencing GLI-33), and virtual sports on a gaming device (GLI-11). These are not interchangeable, and the certification path depends entirely on platform architecture.

The RNG Obligation Across Standards

RNG certification is the most technically demanding component in a combined submission and the one most likely to generate scope disputes. GLI-19 Chapter 3 sets out detailed requirements for cryptographic RNG strength, statistical independence testing, seed management, and continuous monitoring of hardware-based RNGs. The RNG used in the determination of game outcomes must be cryptographically strong, meaning it must be resistant to direct cryptanalytic attack, known input attack, and state compromise extension attack.

GLI-33 Section 4.5.2 takes a different approach for virtual event wagering RNG requirements. A cryptographic RNG “shall comply with the applicable jurisdictional requirements set out for RNGs. In the absence of specific jurisdictional standards, the ‘Random Number Generator (RNG) Requirements’ chapter of the GLI-11 Standards for Gaming Devices shall be used as applicable.” This creates a layered default: jurisdiction first, then GLI-11 if the jurisdiction is silent. For platforms where a common RNG serves both the casino-side games and the virtual sports product, the RNG must satisfy GLI-19 Chapter 3 for the casino scope and the applicable jurisdictional or GLI-11 standard for the virtual event scope. Where those requirements differ, the more stringent standard applies for the component in question. Compliance teams should confirm with their testing laboratory which RNG evaluation path the jurisdiction mandates before architecture is finalised.

Structuring the Composite Submission

The GLI Composite Submission Requirements document (v2.0, revised March 23, 2020) governs the packaging, documentation, and procedural requirements for any submission to GLI. It applies across all submission types, including those spanning Interactive Gaming Systems and Event Wagering Systems on the same platform. Section 2.9 specifically addresses “Gaming and Wagering System Submissions,” covering systems directly involved in the conduct of gaming or wagering, naming Server Based Gaming Systems, Interactive Gaming Systems, and Event Wagering Systems in the same category. A combined casino-and-sportsbook submission will draw requirements from both the general submission chapter and the gaming and wagering system chapter.

The submission letter is the structural foundation of any certification engagement. The Composite Submission Requirements v2.0 specifies that each submission letter, dated within one week of receipt by GLI, must identify the jurisdictions for which certification is requested and the items submitted for certification. For a combined platform, the letter must explicitly identify both the Interactive Gaming System components (the casino platform) and the Event Wagering System components (the sportsbook). Leaving one vertical implicit in a submission letter is a common cause of delayed approval, because GLI engineers will need to resolve what is in scope before testing begins.

Multi-party submissions add another layer of procedural complexity. Where the casino platform and the sportsbook are provided by different technology suppliers, both suppliers may need to be licensed in the target jurisdiction before their components can be approved. The Composite Submission Requirements v2.0 notes that “all suppliers who are part of the submission ‘group’ may need to be licensed in the jurisdiction(s) where the submission is being approved.” One company must be designated as the primary contact: that party submits on company letterhead, receives the GLI internal file number, is billed for all costs, and receives the approval letter upon completion. The primary contact may then release copies of the approval letter to associated manufacturers. Compliance teams at combined-platform operators must resolve the primary contact designation early, as it determines commercial and contractual obligations before a single line of source code is reviewed.

“Upon completion, the primary contact company will receive the approval letter, provided the submission meets the jurisdictional requirements. The primary contact company may then release copies of the approval letter to any associated manufacturer(s).”, GLI Composite Submission Requirements v2.0, Chapter 1

Documentation Requirements Specific to Combined Platforms

Source code completeness is a hard requirement across both standards. The Composite Submission Requirements v2.0 states that all source code submitted “shall be correct, complete, and able to be compiled” and that “the result of the compiled object code shall be identical to that in the storage medium submitted for evaluation.” For combined platforms, this means source code for both the casino-side RNG and game logic and the sportsbook’s wagering engine, wager placement controls, and settlement logic must each meet this threshold independently. A submission that provides complete source for the casino components but omits the sportsbook engine will not proceed past the intake review.

For the casino vertical within a combined submission, the gaming and wagering system documentation requirements include game mathematics (PAR sheets) for each game submitted, details of all progressive jackpot and incrementing jackpot features, virtual event wagering details if applicable, and a description of all third-party service provider integrations. For the sportsbook vertical, the equivalent documentation covers wagering rules for all markets, a description of how wager settlement is conducted, in-play wagering processes if offered, and operational procedures under GLI-33 Appendix A (Operational Audit of Business Processes) and Appendix B (Operational Audit of Technical Security Controls). Where the same system architecture documentation covers shared infrastructure, such as a shared network diagram, shared database schema, or shared security controls, that documentation must address both standards’ requirements in a single coherent set of materials rather than as separate disconnected documents.

Network architecture documentation requirements for combined platforms are particularly detailed. Both GLI-19 and the Composite Submission Requirements v2.0 require network diagrams showing internal and external IP addresses, controls to prevent unauthorised modification to device configurations, LAN and VLAN design including all functional subnets and firewalls, and details of remote connections used to support system operations. Where the casino platform and sportsbook share network infrastructure, a single unified network diagram annotated to show which segments serve which product vertical is operationally simpler and reduces the risk of inconsistency across documents.

Change Management After Initial Certification

Maintaining dual certifications on a live combined platform introduces ongoing change management obligations. The Composite Submission Requirements v2.0 establishes that all modifications require re-testing, examination, and re-certification by GLI. A modification to existing or new software functionality must include identification of the previously submitted software version, a description of the software changes (including change management classifications), the modules affected, and the new source code for the entire programme to allow verification.

For combined platforms, a change to the casino game engine that does not touch the sportsbook components triggers a GLI-19 re-certification workflow only, while a change to the odds management or wager settlement logic triggers a GLI-33 workflow. A change to shared infrastructure, such as the account management layer, the wallet, or the RNG service where that service is common to both verticals, will trigger re-evaluation under both standards. Compliance teams should maintain a change management register that maps each system component to its governing standard, so that the certification impact of any proposed change can be assessed before development work begins, not after it is complete.

Modification submissions do not require resubmission of unchanged documentation. If the paytable and mathematics are unchanged for a game programme, the submitting party may reference previous documentation. This carve-out can reduce turnaround time significantly on minor software changes where the mathematical model is unaffected. Teams should confirm with their GLI client services representative which documentation elements can be carried forward by reference versus which must be resubmitted in full.

Jurisdictional Adoption and Regulator-Specific Requirements

Neither GLI-19 nor GLI-33 is self-executing. Both standards become mandatory requirements only where a regulatory body has adopted them, in whole or in part, as the applicable technical standard for its jurisdiction. AGCO’s Registrar’s Standards for Internet Gaming in Ontario and AGLC’s Standards and Requirements for Internet Gaming in Alberta both reference GLI certifications as part of their supplier compliance pathway, though each regulator specifies which standards apply to which product categories. Operators entering Canadian provincial markets should confirm the precise GLI standard references within the registrar’s standards documentation rather than assuming blanket adoption. The AGCO vs AGLC standards comparison provides jurisdiction-specific detail on how each province’s framework structures these obligations.

Jurisdictions such as the Netherlands (KSA) and Denmark (Spillemyndigheden) publish their own technical requirements that govern what accredited testing laboratories must assess, and those documents do not wholesale adopt either GLI standard. Operators targeting those markets must work to the jurisdiction’s published technical requirements, using a GLI-accredited laboratory to test conformance to the local standard, which may differ materially from GLI-19 or GLI-33 in specific chapters. Jurisdiction-by-jurisdiction analysis is mandatory before any submission planning begins.

For markets where the MGA Gaming Act (Cap. 583) or the UKGC Remote Technical Standards govern the technical compliance framework, operators should treat GLI certification as one input into a broader technical compliance submission rather than as a standalone approval. Both the MGA and the UKGC accept third-party technical audit and certification evidence but set their own technical requirements that may diverge from GLI standards in specific areas, including RNG statistical standards and responsible gambling system controls. Compliance teams should align GLI certification planning with the target jurisdiction’s own technical rulebook from the outset.

Key Resources

GLI-19: Standards for Interactive Gaming Systems, Version 3.0 (July 17, 2020). Available at www.gaminglabs.com. Governs Interactive Gaming System certification including RNG, game logic, account management, and live game requirements.

GLI-33: Standards for Event Wagering Systems, Version 1.1 (May 14, 2019). Available at www.gaminglabs.com. Governs Event Wagering System certification including wager placement, odds management, settlement, virtual event wagering, and external system interoperability.

GLI Composite Submission Requirements, Version 2.0 (March 23, 2020). Available at www.gaminglabs.com. Governs submission packaging, documentation, source code requirements, and multi-party submission procedures for all GLI product categories, including Interactive Gaming Systems and Event Wagering Systems.