AGCO Technical Standards and GLI Certification: What Ontario Market Access Actually Requires

GLI-19 certification satisfies a significant portion of the technical compliance burden for Ontario’s regulated internet gaming market, but it does not, by itself, unlock market access. The Alcohol and Gaming Commission of Ontario (AGCO) operates a layered technical standards framework under the Registrar’s Standards for Internet Gaming that imposes Ontario-specific requirements on autoplay, spin speed, win presentation, and responsible gambling tooling that exist outside GLI-19’s scope. Compliance teams that treat a GLI-19 certificate as a finished product rather than a starting point will find gaps at the go-live review stage that are time-consuming and reputationally costly to resolve.

The Regulatory Foundation: Gaming Control Act, 1992 and the Registrar’s Standards

Ontario’s internet gaming market opened on 4 April 2022 under a framework established by the Gaming Control Act, 1992 and the AGCO’s Registrar’s Standards for Internet Gaming. The AGCO holds registration and enforcement authority over all operators and gaming-related suppliers (GRSs). iGaming Ontario (iGO), now an independent agency following its separation from the Ontario Lottery and Gaming Corporation in 2025, acts as the commercial counterparty and requires a separate Operating Agreement from every registered operator before gaming operations may commence.

The Registrar’s Standards are the primary technical and operational rulebook. They are organized across six risk themes: Entity-Level Controls, Responsible Gambling, Prohibiting Access to Designated Groups and Player Account Management, Ensuring Game Integrity and Player Awareness, and Public Safety and Protection of Assets. Standards within themes 2 (Responsible Gambling) and 4 (Game Integrity) are the most directly relevant to certification questions.

What Standard 4.08 Actually Requires

Standard 4.08 of the Registrar’s Standards for Internet Gaming (amended April 2023) is the gateway provision for all technical certification in Ontario. It states that all igaming games, random number generators, and components of igaming systems that accept, process, determine the outcome of, display, and log details about player bets, including any subsequent modifications, must either be approved by the Registrar or certified by an independent testing laboratory registered by the Registrar, as per the AGCO’s ITL Certification Policy, prior to being provided for any gaming site.

Two elements of Standard 4.08 demand precision. The ITL must be registered by the AGCO, not merely accredited internationally. An ITL certification issued before the laboratory completes AGCO registration has no standing in Ontario, the sequence of approvals is non-negotiable. Additionally, the AGCO’s Internet Gaming Go-Live Compliance Guide specifies that ITLs must also submit confirmation, typically an independent audit, that their testing methodology has been configured to the Registrar’s Standards for Internet Gaming. Configuration to GLI-19 alone does not satisfy this requirement if Ontario-specific provisions within the Standards have not been incorporated into the test plan.

Standard 4.09 extends the obligation beyond the moment of certification. Gaming systems and gaming supplies must be provided, installed, configured, maintained, repaired, stored, and operated in a way that ensures their integrity, safety, and security on an ongoing basis. Monitoring and testing must continue throughout the life of the system. The AGCO must be immediately notified of any suspected integrity or security problem.

What GLI-19 v3.0 Covers

GLI-19: Standards for Interactive Gaming Systems (currently version 3.0, published by Gaming Laboratories International) is the foundational standard against which most online casino platforms, RNGs, and game mathematics are evaluated globally. For Ontario purposes, it represents the most widely used vehicle for satisfying the technical certification requirement under Standard 4.08. Its scope encompasses the full stack of a conventional online gaming operation: server-side game logic, RNG design and statistical validation, game client presentation, account management, transaction processing, and reporting.

RNG Requirements Under GLI-19 Chapter 3

Chapter 3 of GLI-19 v3.0 sets out the requirements for all RNG types. Software-based RNGs derive their randomness from computer-based or software-driven algorithms without significant hardware input. Hardware-based RNGs derive randomness from small-scale physical events such as thermal noise, electric circuit feedback, or radioactive decay. Mechanical RNGs generate outcomes through physical laws.

For all RNG types, the standard requires that the ITL conduct a source code review of all core randomness algorithms, scaling algorithms, shuffling algorithms, and any other functions that play a critical role in the final random outcome. The review must cover potential sources of bias, implementation errors, and malicious code. Statistical testing requirements under GLI-19 section 3.2 include the chi-square test, overlaps test, coupon collector’s test, runs test, interplay correlation test, serial correlation test, and duplication tests. The standard also requires distributional independence: knowledge of numbers chosen in one draw must not provide information on numbers in a future draw, and where multiple values are selected within a single draw, knowing one value must not reveal any other within the same draw.

For cryptographic RNGs, GLI-19 section 3.3 imposes resistance to three attack types. A direct cryptanalytic attack is defeated by ensuring that past RNG output cannot be used to predict future values. A known input attack is defeated by ensuring the RNG is not seeded from a time value alone and resists state inference after initial seeding. A state compromise extension attack is defeated by requiring the RNG to periodically modify its state through external entropy. Hardware-based RNGs must additionally implement dynamic output monitoring to detect and disable play upon malfunction or statistical degradation, as required under section 3.3.3.

RTP Requirements Under GLI-19 Section 4.7

GLI-19 section 4.7.1 sets the global baseline for payout percentages. Each house-banked game must theoretically pay out a minimum of 75% during the expected lifetime of the game, unless the regulatory body specifies otherwise. The minimum applies to all wagering configurations: if a game is played continuously at any single bet level or line configuration, the 75% floor must be satisfied for that configuration independently. For games affected by player skill, the minimum must be met under the optimal method of play providing the greatest theoretical return.

The AGCO has not publicly published a jurisdiction-specific RTP floor above the GLI-19 baseline for Ontario. The Registrar retains discretion to set alternative thresholds on a product-by-product or operator-specific basis. The ITL must maintain operator documentation, including PAR sheets, recording the theoretical RTP for each house-banked game, the date and nature of any changes affecting RTP, and periodic comparisons between theoretical and actual payout percentages under section A.6 of GLI-19.

GLI-19 v3.0 Chapter	Subject	Key Requirement
Chapter 3 (§3.2)	RNG Statistical Testing	Chi-square, runs, serial correlation, duplication tests, source code review mandatory
Chapter 3 (§3.3)	Cryptographic RNG Security	Resistance to direct cryptanalytic, known input, and state compromise extension attacks
Chapter 3 (§3.3.3)	Hardware RNG Monitoring	Dynamic output monitoring, game play must disable on malfunction detection
Chapter 4 (§4.6.5)	Random Event Probability	Probability of any chance event must be constant unless otherwise denoted by game artwork
Chapter 4 (§4.7.1)	Minimum RTP	75% minimum for house-banked games, higher jurisdictional floors override
Chapter 4 (§4.7.2)	RTP Display	If displayed, must explain how RTP was determined and how the player may realise it
Appendix A (§A.6)	RTP Records	PAR sheets, change records, and theoretical vs actual comparisons required

Ontario’s Responsible Gambling Technical Requirements: Where GLI-19 Does Not Reach

The most operationally significant gap between GLI-19 certification and Ontario compliance readiness lies in the responsible gambling (RG) technical requirements embedded in Standards 2.16 through 2.22 of the Registrar’s Standards. These provisions are Ontario-specific player protection rules that go beyond what GLI-19 evaluates as a global standard.

Autoplay Prohibition

Standard 2.16 of the Registrar’s Standards states that game designs and features shall help to prevent extended, continuous, and impulsive play and facilitate low risk play behaviours. Under the explicit requirements of that standard, games must not provide autoplay features for slots. This is a categorical prohibition with no carve-out. GLI-19 does not contain a corresponding mandatory prohibition on autoplay, its scope reflects the regulatory diversity of jurisdictions that adopt the standard globally, some of which permit autoplay. A product that passes GLI-19 certification with autoplay functionality enabled cannot be deployed in Ontario without that feature disabled or removed and the modification recertified.

Spin Speed Floor

Standard 2.18 requires that it be a minimum of 2.5 seconds from the time a game is started until the next game cycle can be commenced. It must always be necessary to release and then depress the start button, or take equivalent action, to commence a game cycle. A player should commit to each game cycle individually, continued contact with a button, key, or screen must not initiate a new game cycle. The standard defines a game cycle as beginning when the player depresses the start button and ending when all money or money’s worth staked or won has been either lost or delivered to, or made available for collection by, the player and the start button or equivalent becomes available to initiate the next game.

Standard 2.19 reinforces this floor by prohibiting any feature that permits a customer to reduce the time until the result is presented. Turbo, quick spin, and slam stop are named as examples, though the requirement is not exhaustive. This standard does not apply to bonus or feature games where an additional stake is not wagered.

The 2.5-second inter-game interval for slots under AGCO Standard 2.18 mirrors the UKGC’s RTS 14D requirement, which prompted a £122,835 settlement with Stakelogic in June 2026 after that supplier self-reported that its Tiger Temple 88 game operated with a 1.97-second cycle time. According to iGamingBusiness, June 2026, the settlement followed a broader portfolio retest. The Ontario provision carries the same policy objective, and compliance teams should treat it as equally enforcement-prone.

Win Presentation and Net Position Display

Standard 2.20 prohibits the use of auditory or visual effects associated with a win for returns that are less than or equal to the last total amount wagered. Near-miss celebrations, whether audio or animation implying a win when the return does not exceed the stake, are impermissible. Standard 2.21 requires that gaming sessions clearly display the customer’s net position (total winnings minus total losses since the start of the session) in Canadian dollars. These requirements directly shape game client presentation and must be verified against the production configuration of every title, not merely against the base game template certified by the ITL.

Simultaneous Slots Play

Standard 2.17 prohibits the gaming system from offering functionality that facilitates playing multiple slots games at the same time. Split-screen or multi-screen functionality that achieves this result is specifically identified as prohibited. Combining multiple slots titles in a way that facilitates simultaneous play is not permitted.

AGCO Standard	Requirement	Covered by GLI-19?
2.16	No autoplay for slots	No, Ontario-specific prohibition
2.17	No simultaneous multi-slots play	No, Ontario-specific prohibition
2.18	Minimum 2.5-second inter-game interval, no continuous hold-to-spin	Partial, GLI-19 does not mandate a universal spin floor
2.19	No turbo, quick spin, or slam stop	No, Ontario-specific prohibition
2.20	No win-associated effects for returns equal to or less than stake	No, Ontario-specific requirement
2.21	Net position displayed in CAD throughout session	No, Ontario-specific presentation requirement
4.08	All games/RNGs certified by AGCO-registered ITL	Partial, ITL must be AGCO-registered, methodology must be Ontario-configured

How the ITL Certification Process Works in Ontario

Under the AGCO’s ITL Certification Policy (Appendix C of the Internet Gaming Go-Live Compliance Guide), ITL certification is a form of written assurance issued by registered ITLs confirming that tested technology meets the relevant Registrar’s Standards for Internet Gaming. For Live Dealer games, the relevant Casino Electronic Gaming Devices and Gaming Systems Minimum Technical Standards also apply.

Technology subject to mandatory certification includes all games, RNGs, and components of igaming systems that accept, process, determine outcome, display, and log details about player bets. This encompasses slot games, table games, sport and event betting systems, poker, and other card games. For Live Dealer games, the certification requirement extends to physical RNGs with electronic elements and similar physical equipment with electronic components.

Certification may begin before an operator or GRS has received a registration from the AGCO. However, ITLs may not issue certifications until they have completed registration with the AGCO as a Gaming-Related Supplier and submitted confirmation, such as an independent audit, that their testing methodology has been configured to the Registrar’s Standards for Internet Gaming. This confirmation requirement is what ensures that the ITL’s version of GLI-19 testing has been adapted to Ontario-specific provisions, including the RG technical requirements described above.

Even though the GRS that manufactures the game will typically be the entity that obtains the certification, the obligation to assure the AGCO that the game is certified rests with operators and GRSs who run critical gaming systems.

Certification scope does not cascade automatically. A certified platform does not certify the individual game titles running on it, and a certified game does not certify the remote gaming server (RGS) or platform beneath it. Operators building aggregated game libraries must map each layer of their technical architecture before engaging the ITL, to prevent scope disputes mid-engagement that can extend timelines by weeks.

The Control Activity Matrix: The Compliance Deliverable GLI Certification Does Not Produce

Standard 1.02 of the Registrar’s Standards requires operators and GRSs who run critical gaming systems to develop a Control Activity Matrix (CAM). The CAM summarizes all controls related to the gaming site, including controls performed by third-party suppliers and platform providers. It is a distinct regulatory deliverable from the ITL certification, and its absence at go-live is a common source of AGCO follow-up.

The Internet Gaming Go-Live Compliance Guide distinguishes between operators assessed as elevated risk and those that are not. Elevated-risk operators, meaning those new to igaming with minimal regulated-market experience, those with histories of significant non-compliance, or those whose gap analysis reveals poor familiarity with the Standards, must submit the CAM to the AGCO as part of the go-live process. Non-elevated-risk operators must submit within three months of their go-live date. The risk assessment is made by the AGCO based on multiple factors, and operators should not assume they will fall into the lower-risk category without explicit AGCO confirmation.

Standard 1.02 also requires that operators have their control activities assessed by an independent oversight function for alignment with the Standards. This is a separate assurance requirement from the ITL certification. The output must be available to the AGCO on request.

What the Go-Live Gap Analysis Must Cover

The AGCO requires each operator to submit a gap analysis as part of the registration application process. The gap analysis must demonstrate the operator’s understanding of the Registrar’s Standards and its path to compliance with each applicable Standard. The Internet Gaming Go-Live Compliance Guide states explicitly that operators who demonstrate a poor understanding of the Standards or significant gaps with respect to the Standards through their gap analysis will be assessed as elevated risk.

For compliance teams conducting the gap analysis, the Standards that most commonly expose gaps for operators entering from other regulated jurisdictions include the RG technical requirements (2.16, 2.22), the game integrity certification chain (4.08, 4.09), and the control environment requirements (1.01, 1.02). Operators who hold licences in the UK, Malta, or other regulated European markets will find that some requirements, particularly on spin speed and win presentation, parallel their existing obligations, while the autoplay prohibition is more absolute than some European implementations. For a detailed comparison of the Ontario and Alberta frameworks, see the AGCO vs AGLC standards comparison, which maps both sets of requirements side by side.

Operators should pay particular attention to the scope limitation in Standard 4.08: the obligation to assure the AGCO that games are certified rests with the operator and GRSs who run critical gaming systems, even when certification was obtained by the game developer or content supplier. Operators cannot rely on supplier assurances without independently verifying that the certifying ITL is AGCO-registered and that the certification covers the Ontario-specific Standards.

Ongoing Obligations After Certification

Standard 4.09 makes clear that certification is a point-in-time assurance, not a permanent licence to deploy. Ongoing monitoring and testing must continue throughout the life of the gaming system and gaming supplies. Any subsequent modifications to certified games, RNGs, or igaming system components trigger the re-certification obligation under Standard 4.08, the amendment to that Standard in April 2023 confirmed that modifications are expressly included within scope.

The AGCO’s Internet Gaming Notification Matrix defines three categories of ongoing information: incident-based notifications, scheduled reports of data indicators, and other regulatory submissions. Operators and GRSs use two exchange mechanisms, with iAGCO used for incident notifications and regulatory submissions and a separate secure channel for monthly data reporting. Any change to a certified component that materially affects game outcome determination, RTP, or player-facing RG controls must be notified and, depending on the nature and magnitude of the change, may require recertification before the modification is deployed to production.

The GLI Change Management Program Guide v1.0 provides a framework for managing changes to certified products without requiring full recertification for every minor update. Compliance teams entering Ontario for the first time should review whether their existing change management processes align with both the GLI framework and the AGCO’s notification requirements before deploying incremental game updates.

For a broader view of how Ontario’s technical standards framework sits within the global landscape of iGaming compliance obligations, including the dual-entity conduct-and-manage model and the full scope of the Registrar’s Standards, see Ontario iGaming at Year Three: AGCO Compliance Lessons for New Entrants, which synthesises three years of enforcement patterns and audit findings. Compliance officers managing multi-jurisdiction portfolios who are also preparing for GLI-19 and GLI-33 certification decisions across different product verticals should consult the GLI-19 vs GLI-33 standard selection guide, which covers the architectural and jurisdictional factors that determine which standard governs a given product type.

Operators and suppliers with jurisdiction-specific questions about AGCO certification timelines, ITL registration status, or interpretation of the Registrar’s Standards should consult qualified legal counsel with Ontario gaming regulatory experience and contact the AGCO’s Technology Regulation and iGaming Compliance Branch directly at iGamingCompliance@agco.ca.

Key Resources

AGCO Registrar’s Standards for Internet Gaming, the primary rulebook for all internet gaming operators and GRSs in Ontario, including Standards 2.16, 2.22 and 4.08, 4.09. Available at agco.ca.

AGCO Internet Gaming Go-Live Compliance Guide, covers the CAM, ITL Certification Policy (Appendix C), gap analysis, and notification matrix requirements for Ontario market entry. Available at agco.ca.

GLI-19: Standards for Interactive Gaming Systems v3.0, the foundational standard for RNG certification, game mathematics, and interactive gaming platform requirements used by AGCO-registered ITLs. Available at gaminglabs.com.

Gaming Control Act, 1992 (Ontario), the enabling statute under which the AGCO Registrar holds authority to issue registrations and set Standards. Available at ontario.ca/laws.