The Regulatory Requirement
Operators licensed under the Malta Gaming Authority (MGA), the United Kingdom Gambling Commission (UKGC), or the Curaçao eGaming License are required to maintain game integrity through documented technical controls. Each jurisdiction specifies the standards; they are not suggestions or best practices. They are requirements for licensure.
The MGA's standards require operators to use certified random number generators (RNGs), implement anti-collusion detection systems, maintain complete audit trails of all game activity, and submit to third-party testing by accredited laboratories. The UKGC has equivalent requirements, albeit with slightly different technical specifications. Curaçao has looser requirements but still mandates RNG certification and anti-fraud monitoring.
RNG Certification
A random number generator is the mechanical heart of online poker. The RNG generates the deck shuffle, the card distribution, the outcome of every hand. If the RNG is not truly random, the poker site can be programmed to cheat.
Operators must use RNGs that have been certified by independent laboratories. The major testing firms are GLI (Gaming Laboratories International), BMM Testlabs, and TST (Technical Systems Testing). These firms test the RNG to confirm it produces uniformly distributed outcomes, exhibits no bias toward specific cards or suits, and cannot be predicted or manipulated.
The certification is a one-time audit followed by periodic re-testing. An operator using a certified RNG and adhering to the software that uses it can reasonably claim the shuffles are fair.
Anti-Collusion Detection
Collusion is when multiple players work together to gain advantage over others. Player A folds to Player B in ways that leak money to Player B, then they split the winnings offline.
Operators must implement automated systems to detect suspicious play patterns. These systems track winning rates, fold patterns, bet sizing, hand selection, and cross-correlation between accounts. If two accounts fold to each other more often than chance would predict, the system flags them. If one account's playing patterns suddenly change when another account joins a table, the system flags them.
The systems are not perfect. Some collusion is subtle enough to evade detection. But operators are required to maintain these systems and to investigate flagged accounts. Players caught colluding are banned and funds are confiscated.
Account Segregation
Operators are required to hold player funds in segregated accounts, separate from operational funds. This is not a game-fairness measure; it is a solvency measure. If the operator goes bankrupt, player deposits are protected because they are not the operator's money to begin with.
This is why regulated operators ask for extensive identity verification (KYC, know-your-customer) and source-of-funds documentation (AML, anti-money-laundering). They must verify the money in the account actually belongs to the account holder. This compliance is burdensome but it is the cost of operating under a regulated jurisdiction.
Audit Trails
Every hand dealt on a regulated poker site is logged. The hand history includes cards dealt, community cards, betting action, and outcome. These logs are retained for a minimum period (typically 5-7 years) and are available to regulators upon request.
If a regulator receives a complaint about unfair play, they can audit the hand histories to determine what happened. They can verify the RNG produced a fair shuffle, verify that collusion did not occur, and verify that the outcome matched what the dealer should have dealt.
What This Does Not Prevent
Regulation prevents the operator from cheating. It does not prevent players from cheating if they have sufficient technical access (which they should not have, but bugs happen). It does not prevent soft play or angle-shooting between colluding players if the collusion is subtle and deniable. It does not prevent a regulator from being corrupt and approving a rigged operator.
But it does establish that a licensed operator has met a baseline of technical controls. A poker site licensed by the MGA or UKGC has been audited by third parties and is subject to ongoing compliance monitoring. An unlicensed poker site operating from a jurisdiction with no oversight has no such obligation.
Accordingly
Players using regulated operators have contractual and regulatory recourse if they are cheated. Players on unlicensed sites have none. The choice between them is not a choice about game fairness; the regulator cannot see inside players' heads or eliminate collusion by soft play. The choice is about whether the operator is bonded, insured, and obligated to meet minimum standards of conduct.
