New Zealand Sets Testing Rules as Online Casino Licence Auction Starts on 29 September

New Zealand is moving ahead with its online casino licensing regime this week, and the Department of Internal Affairs (DIA) has now published a discussion paper on the Testing and Monitoring Requirements for Online Casino Game Technology. For PSPs and casino platform suppliers, the useful part is simple: licensing is not just about who gets a seat at the table, but what has to be proven about games, RNGs (random number generators), infrastructure, and ongoing supervision.

1. New Zealand will issue 15 licences by the end of this year. According to Complete iGaming, the Expression of Interest phase is already underway, and the next step is a two-week “silent auction” beginning on Tuesday 29 September.
2. The draft names three approved independent testing laboratories: GLI Australia, Quality Assurance Laboratories, and BMM Australia. Any of them can certify applicants’ games and systems, which matters because certification is being built into the licensing path from the start, not left as an afterthought.
3. Before getting a licence, applicants must submit a Games Register and RNG Register. They must show that the games they plan to offer — including live dealer titles — and their RNGs have been tested by one of the approved labs. They also have to disclose their critical technology suppliers and the location of their data centres or cloud servers, backed by ISO 27001 certification or an equivalent standard.
4. Once the licence is live, operators must file an updated register, and their CEO or chief compliance officer must confirm that all technology complies with the rules. That covers third-party technology, infrastructure, operating systems, databases, and game software — in other words, the whole stack, not just the flashy front end the regulator sees in the pitch deck.
5. The draft also requires regular vulnerability assessments and penetration tests on each operator’s platform, along with continuous monitoring of the system and RTP (return to player). Operators must retain all testing documentation. New games and RNGs need external testing, while existing ones must be retested if a change affects, or could affect, fairness.

There is one practical carve-out: minor changes that do not affect fairness can be handled through internal testing, but only if the operator has strong development, testing, and release controls in place. The draft lists source-code security, version control, access controls, segregation of duties, peer review, and separate development, testing, and production environments.

New Zealand will also accept testing performed for other regulators in some cases, covering games, RNGs, live dealer operations, and platform systems, as long as the tests provide sufficient assurance. For suppliers already working across multiple regulated markets, that can reduce duplicate certification work — but only if the existing test package is strong enough for the DIA.