Live Dealer, RNG, Provably Fair & What a Licence Actually Is

Desk research. This glossary explains how live dealer studios, random number generators, provably fair systems and gambling licences actually work, using regulator registers, published operator pages and Malaysian government sources. It does not describe first-hand testing of any operator, and no performance claim on this page is our own measurement. How we work: our review process.

Four words appear on almost every Malaysia-facing casino homepage, and you are meant to read them as one big reassurance: live dealer, RNG, provably fair and licensed (berlesen). They are not one idea. They are four separate claims, made by four different parties, checkable in four different ways — and only one of them can be looked up by a stranger in a public register.

This page defines each term in plain English, with the Bahasa Malaysia phrasing used in Malaysian lobbies and one concrete example each, then sets out the two-minute check that separates a real licence from a picture of one. It completes our glossary set alongside the RTP, house edge & volatility glossary, the bonus terms glossary, the withdrawal glossary and the slot mechanics glossary.

Jump to a term:

• Live dealer
• RNG
• Provably fair
• What a licence is

The Four Terms at a Glance

Three of those four cannot be checked by an outsider at all. The licence can. That is why it is the one worth two minutes of your time before you deposit anything.

Live Dealer (Permainan Live)

A live dealer game is a real table — real cards, a real wheel — run by a human dealer in a broadcast studio and streamed to you, with cameras and optical character recognition reading each card or pocket and settling every seat at the same time. The outcome is physical, not computed.

That is the genuine difference from a slot: nobody generates the result, they observe it. Everyone sitting at that table sees the same shoe.

Two things Malaysian players get wrong. First, “live” is not always fully physical — several formats layer a computed element on top, such as the drawn multipliers in Lightning-branded games. Second, and far more important: the studio’s licence is not the casino’s licence. Studios such as Evolution are regulated where they supply; the site carrying the feed is a separate business with separate permissions, or none at all.

Concrete example. A Malaysian lobby streams a licensed studio’s baccarat table and captions it “licensed live casino”. What has been verified there is the studio. The operator taking your RM100 deposit may hold no licence whatsoever — and if it refuses to pay, the studio is not who you complain to. For which brands carry which studios, see our live casino guide for Malaysia.

RNG (Penjana Nombor Rawak)

An RNG is the algorithm that decides a slot or virtual table game’s outcome — it produces a number sequence that is mapped to reel positions or card draws, and the result of your spin is fixed the instant you press the button. The reels turning afterwards are animation, not suspense.

RNGs are examined by independent test laboratories — GLI, BMM Testlabs and iTech Labs are the names you will see — which run statistical batteries against a specific game build on a specific date.

Here is the part that matters in Malaysia: a test laboratory is not a licensing authority. These labs are ISO-accredited and they certify software; they do not authorise a business to take your money, and none of them publishes a public client register you can search. So when a site displays an “iTech Labs” or “BMM certified” badge with no certificate linked, the honest description is not publicly verifiable — not “false”, and not “certified” either.

Concrete example. Our Mega888 provider page records exactly that shape of problem: the app publishes no RTP figure, no paytable and no provider attribution, and we could verify no licence — the PAGCOR badge describes a licensing route that no longer exists, and the BMM mark is not publicly verifiable either way. No link, no time of day and no agent changes an RNG’s odds; if you want the maths behind that, read RTP, house edge and volatility.

Provably Fair

Provably fair is a cryptographic seed-commitment scheme, used mainly by crypto casinos: the site commits to its secret before you bet and later reveals it, so you can recompute the round and confirm nothing was changed after the fact. It is a maths receipt, nothing more.

Three parts. The casino generates a server seed and shows its SHA-256 hash before you play — a commitment it cannot alter afterwards. You supply a client seed. A nonce counts up each round. The outcome combines all three, normally with HMAC-SHA256. When the server seed is rotated and published, you rerun the function and compare.

What it proves is narrow: that those rounds were not tampered with. It does not prove the house edge is small, it does not replace RNG laboratory testing, and — the point most badges rely on you missing — it is not a licence.

Concrete example. You set your client seed to saya123, place ten bets, then rotate the server seed. The site publishes the old seed; you hash it, confirm it matches the commitment shown before bet one, and recompute all ten results. They match — and that tells you nothing about whether the operator is licensed, solvent, or willing to pay you.

What a Licence Is (Lesen)

A gambling licence is a permission issued by a government regulator to a named legal company, covering named domains, recorded in a register that the regulator itself publishes — and carrying a route to complain to somebody with power over the operator. Remove any one of those four parts and it is not a licence.

The Malaysian position settles a lot of arguments: no Malaysian authority issues online casino licences. Gambling here is governed by the Common Gaming Houses Act 1953 and the Betting Act 1953, and the Court of Appeal ruled in 2023 that online gambling is an offence under the 1953 Act. Every online casino you can reach from Malaysia is licensed offshore or licensed nowhere; “licensed in Malaysia” (berlesen di Malaysia) does not exist.

The dead-seal problem is worth spelling out, because it is the single most common false claim on Malaysia-facing sites. Curaçao used to license through four master licensees, each with its own number: Cyberluck Curaçao N.V. (1668/JAZ), Gaming Curaçao, trading as Gaming Services Provider N.V. (365/JAZ), Curaçao Interactive Licensing N.V. (5536/JAZ) and Antillephone N.V. (8048/JAZ). An xxxx/JAZ number is therefore not automatically a Gaming Curaçao reference, whatever a footer says.

Concrete example. Malaysia-facing brand Cili88 publishes the footer line “Licence: Gaming Curacao 8048/JAZ”, which we record in our Cili88 review. That one line fails twice. Gaming Curaçao’s master licence was 365/JAZ, and it expired on 18 August 2024, taking every sub-licence and seal issued under it. 8048/JAZ belonged to a different master licensee entirely, Antillephone N.V., and ran to 28 November 2024. The name and the number never went together — and both are dead in any case, because Curaçao replaced the master-licensee model when the National Ordinance on Games of Chance (LOK) took force on 24 December 2024.

Shared and expired seals travel in groups. When we traced a cluster of Malaysia-facing brands sharing one dead Curaçao seal image, the pattern turned out to be a single network: see the doorway network investigation.

The Two-Minute Licence Check

Curaçao now licences operators directly through the Curaçao Gaming Authority, so any xxxx/JAZ number presented as current in 2026 comes from a system that no longer exists. Do this before you deposit:

1. Find the number. A licence claim with no reference number is decoration. Scroll to the footer and look for one.
2. Click the seal. A real seal is a link. It must land on the regulator’s own domain — not a PDF, not a flat image, not a dead link.
3. Read what comes back. A genuine register entry returns three things: the licensed company’s legal name, its current status, and the exact domain covered. If the site you are standing on is not listed, the licence does not cover it.

Where the registers actually live:

Three notes before you use that table. The old Curaçao hostname gcb.cw did not resolve on our fifth consecutive check on 1 September 2026, so a seal pointing at it is a dead link by definition — use cga.cw. A PAGCOR offshore licence aimed at players outside the Philippines has no licensing route behind it any more: the Philippines’ Republic Act 12312 — signed 23 October 2025, published 29 October 2025 and in force fifteen days later — removed PAGCOR’s power to license offshore gaming, so a current offshore PAGCOR claim shown to a Malaysian player should be treated as unsupported. And a licence issued in Curaçao, Malta or anywhere else gives you a complaints route in that jurisdiction only — no Malaysian regulator can order an offshore operator to pay you.

What Each Badge Actually Proves

Read down the right-hand column. Three of the four badges are completely silent on the only question that decides whether you can get your money back. The brands that clear our own licence and payments checks are listed on our best online casino Malaysia page; the ones that failed them are on the blacklist, and the current pattern of fake claims is tracked in Scam Watch.

18+ only, and 21+ at most Malaysia-facing operators. Understanding licences and certification helps you judge who you are dealing with — it does not make gambling profitable, and the house edge applies to every round regardless of who tested the software. Gambling is restricted in Malaysia under the Common Gaming Houses Act 1953 and the Betting Act 1953, gambling is prohibited for Muslims under state Syariah law, and no Malaysian regulator can compel an offshore operator to pay you. Play only with money you can afford to lose. If gambling is causing you or someone close to you harm, support is available — see our responsible gambling page.

FAQ: Live Dealer, RNG and Licences

Is a Curaçao licence number ending in /JAZ still valid in 2026?

No. An xxxx/JAZ reference belonged to the master-licence system that Curaçao replaced when the National Ordinance on Games of Chance took force on 24 December 2024. The two most-quoted master licences were already dead before that: 365/JAZ expired on 18 August 2024 and 8048/JAZ ran only to 28 November 2024. Current Curaçao licences are issued directly by the Curaçao Gaming Authority and verify at cert.cga.cw.

Adakah provably fair bermaksud kasino itu berlesen?

Tidak — dan inilah kekeliruan paling mahal di halaman ini. Provably fair ialah semakan matematik ke atas pusingan individu, dijalankan oleh perisian kasino itu sendiri. Lesen pula ialah kebenaran kerajaan yang direkodkan dalam daftar awam. Sebuah laman boleh provably fair sepenuhnya dan pada masa yang sama langsung tidak berlesen.

Can a casino change the result of a live dealer game?

A physical live table’s result comes from real cards or a real wheel and settles at the same moment for every seat, so the outcome is observed rather than generated. The realistic risk with an unlicensed operator was never the shuffle — it is whether your withdrawal is honoured, which is a licensing and payments question, not a dealing one.

Adakah mana-mana kasino dalam talian berlesen di Malaysia?

Tiada pihak berkuasa Malaysia mengeluarkan lesen kasino dalam talian. Perjudian dalam talian adalah kesalahan di bawah Akta Rumah Judi Terbuka 1953, seperti yang disahkan oleh Mahkamah Rayuan pada 2023. Mana-mana pengendali yang boleh anda capai adalah berlesen di luar negara atau tidak berlesen langsung — jadi soalan yang bermakna ialah pengawal selia yang mana, dan sama ada daftarnya menyenaraikan pengendali itu.

Is an iTech Labs or BMM badge with no certificate fake?

Not fake — not publicly verifiable, which is a different finding. These are genuine ISO-accredited test laboratories, but they certify software rather than licensing businesses, and none of them publishes a searchable public client register. Without a linked certificate naming the operator and the game build, there is nothing to check — and an unverifiable badge on a page that also carries an expired licence number is itself worth weighing.

What can I do if an unlicensed casino keeps my money?

Call the National Scam Response Centre on 997 — the two government listings disagree on its hours, the NFCC’s own NSRC page says 8.00am to 8.00pm daily while malaysia.gov.my says 24 hours, so call your bank’s own 24-hour fraud line if it does not answer — and check the payee account on Semak Mule. Lodge a police report at the nearest station within 24 hours as well: official sources still conflict on whether the 997 call alone is enough, so do both. Our blacklist records the operators we have flagged, and the withdrawal and KYC glossary covers what a legitimate payout process looks like.