This is a summary of eCOGRA’s Online Gambling Certification Scheme and describes the process of certifying online gambling products. This scheme is classified as a Type 1a scheme in accordance with ISO/IEC 17067:2013. Online gambling products are certified against jurisdictional requirements based on a client’s request. Conformity assessments are conducted in accordance with ISO/IEC 17065:2012.
Online gambling products include, but are not limited to:
- RNG driven games (Slots, table games, virtual sports, video poker, etc);
- Betting products (real event-based wagering);
- Random number generators;
- Casino platforms and websites;
- Internal control systems including regulator reporting systems; and
- Information security management systems.
2. APPLICABLE STANDARDS
The relevant assessable certification standards for eCOGRA’s Online Gambling Certification Scheme include:
- ISO/IEC 17000:2004 Conformity Assessment – Vocabulary and general principles
- ISO/IEC 17020:2012 Conformity assessment — Requirements for the operation of various types of bodies performing inspection
- ISO/IEC 17025:2017 Testing and calibration laboratories
- Jurisdictional specific requirements/standards/specifications
eCOGRA has established legally enforceable agreements for the provisions of conformity assessment activities it undertakes with its clients. The agreements cover all eCOGRA’s office sites and facilities, as well as all clients’ sites and facilities.
Use of certificates
eCOGRA is the owner of this certification scheme and controls all decisions on certifications. Certification agreements provide all the information to the client regarding the use of certificates.
Incorrect or fraudulent references to the certification scheme or the misleading use of certificates and other misleading mechanism for indicating a product is certified, found in documentation or other publicity shall be dealt with by eCOGRA in a suitable manner.
Management of impartiality
Conformity assessment activities are undertaken impartially and structured and managed in a way to safeguard impartiality. eCOGRA ensures that all staff and committees who are involved in the conformity assessment activities are not exposed to commercial, financial, or other pressures that could compromise their impartiality and independence. To obtain and maintain independence, eCOGRA’s decisions are based on objective evidence of conformity (or nonconformity) obtained, and that its decisions are not influenced by other interests or by other parties.
Liability and financing
eCOGRA ensures that potential liabilities/risks arising from its certification operations are mitigated and the amount of professional indemnity insurance cover reflects the risks associated with the services provided, which covers all geographic locations and all activities of eCOGRA’s operations. eCOGRA ensures that it has the financial stability and resources required for all its conformity assessment activities.
eCOGRA makes its services available to all applicants whose activities fall within the scope of eCOGRA’s operations. The policies and procedures under which eCOGRA operates, ensures that there is no discrimination towards potential applicants and that they do not inhibit access by potential clients.
eCOGRA, through legally enforceable agreements, has a policy and arrangements to manage the confidentiality of all information obtained or created during the performance of conformity assessment activities at all levels of its organisation. eCOGRA informs the client, in advance, of the information it intends to place in the public domain. All other information, except for information that is made publicly accessible by the client, is considered as confidential and not shared. Information about a client that is obtained from sources other than the client, shall be treated as confidential.
Publicly available information
eCOGRA maintains and provides all relevant information via online media platforms or upon request. Online platforms include the eCOGRA website
All clients applying for certification services shall provide eCOGRA with the necessary information, including but not limited to:
- Details of the product to be certified (name, version, etc.);
- Relevant assessable jurisdictional requirements related to the product;
- Details of the client (name, physical addresses, relevant legal obligations, etc.);
- General information of the client (human and technical resources, relationship to a parent organization, etc.);
- Information concerning all outsourced processes used by the client that will affect its conformity to requirements. This includes other legal entities for producing the certified products;
- All other information needed in accordance with the relevant certification requirements.
eCOGRA conducts a review of the information obtained from the client submission to ensure that:
- The information about the client is sufficient to conduct the certification process;
- Differences in understanding between the client and eCOGRA are resolved, including the agreement of standards and other normative documents;
- The scope of certification requested is defined;
- eCOGRA has the resources available, competence and capability to perform all evaluation and certification activities.
Based on the scope of the client’s certification needs, the client will be assigned a client relationship manager who will handle the certification activities. The client relationship manager will ensure that the work that needs to be conducted is assigned to competent staff.
The scope of certification is based on a combination of the client’s request and jurisdictional specific requirements. The client relationship manager ensures that the evaluation of the client’s product does not fall outside this agreed scope.
Once the evaluation process has been completed, a review of all the documentation, information and results is performed by senior management not involved in the evaluation process.
eCOGRA is responsible for and retains authority for its decisions relating to certification. The certification decision is decided by at least a single senior management member based on information, results, their review and other relevant findings during the entire certification process. In some cases, the certification decision is assigned to multiple senior management members. All certification decisions are made by eCOGRA.
If eCOGRA decides to grant the certification, the client will be provided with a final certification report that provides information on the certification findings in accordance with the agreed upon scope. If eCOGRA decides not to grant the certification, they shall notify the client and provide the reasons for this decision.
eCOGRA will issue the client a formal certificate in accordance with the following conditions:
- A decision to grant or extend the certification has been made;
- Certification requirements are fulfilled;
- The certification agreement has been signed.
Directory of certified products
eCOGRA maintains a directory of all certified products. This includes all working documents as well as the formal certificate of the certified product. The information retained includes, but is not limited to:
- Identification of the product;
- The standards and other normative documents to which conformity has been certified;
- Identification of the client.
eCOGRA will make available the required documents to relevant parties upon request.
Changes affecting certification
eCOGRA works in an ever-changing industry and therefore requirements and standards are updated and changed. In the case that International or jurisdictional requirements/standards/specifications are updated or changed, eCOGRA will communicate these updates and changes to all affected clients. eCOGRA will then verify the implementation of the changes by the client and shall act accordingly.
In cases where the client has initiated changes, eCOGRA will review, verify and take appropriate actions regarding the certification.
Termination, reduction, suspension or withdrawal of certification
eCOGRA perform ‘point in time’ product certifications with digital signatures of critical software evaluated where applicable, and therefore would not suspend certifications, but rather supersede them upon additional conformity assessment.
When a nonconformity with certification requirements is substantiated, eCOGRA will consider and decide upon appropriate action. This includes but is not limited to:
- Superseding of the certification once non-conformity has been rectified and re-assessed;
- Withdrawal of the certification if information from client is not correct;
- Termination of the certification if non-conformities are not addressed.
eCOGRA will supersede a certificate if the product has had a major update since the initial point in time conformity assessment. The product will go through the same full conformity assessment process and a new certificate will be issued which supersedes the previous certificate.
eCOGRA reserves the right to withdraw its certification if any non-conformities are subsequently detected by or reported to eCOGRA.
Complaints and appeals
eCOGRA considers the professional handling of complaints, appeals and feedback from clients and staff to be very important. The description of the process is available to an interested party via the eCOGRA website.
eCOGRA is responsible for all decisions at all levels of the complaints and appeals handling process. eCOGRA ensures that any submission, investigations, and decisions on appeals shall not result in any discriminatory actions against the organisation or individual making the appeal (appellant).