How Live Casino Studios Are Audited

Live casino regulation hinges on three verifiable quantities: the random number generator's period and distribution, the actual outcomes against expected outcomes, and the audit trail of every hand. This is not subjective. It is mathematical.

The RNG is the foundation. Live dealers use certified software RNG systems, usually provided by the game engine itself (Evolution Gaming, Pragmatic Play, NetEnt). The RNG generates a sequence of numbers used to determine card position, shuffle order, and outcome determination. For a standard 6-deck shoe, the mathematical state space is enormous; for a single shuffle, there are more than 5.2 quintillion possible orderings.

Key Concepts

Auditors verify three properties of the RNG. First: period length, the number of outputs before the sequence repeats. A proper RNG has a period longer than the number of hands you could possibly deal in any reasonable timeframe. Second: distribution, the property that each possible outcome is equally likely. This is tested by drawing large samples and comparing observed frequency to expected frequency using chi-squared tests. If the observed distribution significantly deviates from uniform, the RNG has failed. Third: independence, meaning each output is independent of previous outputs. Autocorrelation tests catch cases where the RNG has a memory.

The regulator (UKGC, MGA, Curaçao eGaming) requires evidence that the RNG has passed these tests. Not just once, but at installation and then periodically. Evolution Gaming, for example, uses AES encryption in their RNG. The mathematical guarantee is built in. But the guarantee is only useful if the software is actually the certified version.

Because this is the vulnerability: the software deployed on a table can be swapped. A live casino could run the certified RNG for the regulator's audit, then swap in a non-random system for actual play. This is difficult to detect unless you have camera evidence that the software is running as specified.

Regulators address this with video evidence. Every hand at every live casino is recorded from multiple angles. If a hand is disputed, the regulator can request the footage and the server logs. The card sequence visible in the video should match the RNG output in the logs. If they don't match, something is wrong.

For table games, regulators also check payout accuracy. If the game rules state that a Banker hand with a seven counts as 17, then every Banker seven dealt must be paid or collected according to the rules. This is tested by examining large sample hands and verifying that the payout percentage matches the expected house edge.

Expected house edge is calculated from the game rules and probability. In baccarat, the Banker bet has a 50.68 percent win rate (after accounting for ties), so over a large sample, the payout percentage should be approximately 50.68 percent for winning Banker bets. Over 100,000 hands, the confidence interval is tight. If actual payout is 48 percent or 52 percent, something is broken. If it's 45 percent, someone is stealing.

The mathematical test for this is called a proportions test. You observe the number of wins, calculate what proportion this is, and test whether this proportion is statistically consistent with the expected probability. If the p-value falls below 0.05, there is strong evidence the game has deviated from specification.

Another critical audit: the bet settlement. Every bet placed must be recorded, tracked, and settled. The server logs this. If someone claims a payout never happened, the logs show when the hand was settled and what was recorded. If the logs don't match the video, or if the payout log shows bets settled differently than the dealer's actions, it's a sign of fraud.

Regulators also audit the cold storage and backup systems. If the main server fails, do the backups restore correctly? Is there redundancy? A single server failure could erase the entire audit trail. Responsible operators maintain offsite backups and test recovery regularly. Regulators verify these systems exist.

Manual vs. automated settlement is a continuum. Some games use full automation: the dealer's actions are captured by computer vision, the system determines the outcome, and settlement is automatic. Others use manual settlement: the dealer calls the outcome and inputs it manually. Manual settlement requires extra verification because human error is a risk. Automated systems reduce this risk but introduce software risk.

Geolocation is also audited. Regulators require proof that players are in licensed jurisdictions. If you're logging in from the UK, you can play UK-licensed games. If you're in the US, most games are blocked. The location verification uses GPS and IP geolocation and sometimes additional factors. An audit verifies that the geolocation system is working and that blocked jurisdictions are indeed blocked.

The complete audit is a cycle. Quarterly, regulators examine the previous three months of hands, payout percentages, and logs. If everything is in spec, the license continues. If something is out of spec, there's investigation. If fraud is detected, there are fines and potential license revocation.

What makes this work is that the mathematics is unambiguous. Probability is objective. If the observed outcomes deviate from the expected distribution beyond the normal confidence interval, then either the RNG is broken, or someone is cheating. There's no third option. No subjectivity. Just math.