Certificate scope, component by component
A certificate applies to a build and to nothing above it. It names a studio, a title, a version number and the suite that version passed. It is silent on the cashier, the bonus terms, the support desk and the company behind them, and no accredited lab issues a certificate for an operator at all. The table sets out which object each of our three labs signs.
| Certified object | Lab | What the certificate covers | Re-test trigger |
|---|---|---|---|
| Random number generator | iTech Labs | Entropy source, seeding method, output distribution, period length | Any change to the generator or its seeding |
| Slot build, per title and version | iTech Labs, BMM Testlabs | Paytable, measured return against declared, feature frequency, maximum win cap | Every new version the studio ships |
| Live table rules | Gaming Laboratories International | Drawing rules, payout schedule, commission, side-bet maths | A rule or payout change at the studio |
| Build integrity | All three | Hash of the approved binary against the one the casino loads | Checked on every load |
| Jackpot controller | BMM Testlabs | Contribution rate, reseed value, must-drop ceiling | A change to the contribution rate |
None of this needs to be taken on trust. Open any casino game in the casino, open its information panel, and the build version, the declared return and the signatory lab are printed there. The floor average across the catalogue is 96.2%, and the per-title slot figures that average is drawn from are listed on ACE66 Slot.
What the RNG test method actually covers
The generator is tested before the game around it is. The lab examines the entropy source, the seeding method and the period before repetition, then runs the raw output through a standard battery: a chi-square test on symbol frequency, a serial correlation test, a runs test, a gap test and a poker-hand test. The sample is large enough that a bias of a fraction of a percentage point registers, which is the only threshold that matters.
The game is tested next, by simulation rather than by inspection. A slot build is run through between a hundred million and a billion simulated spins and the measured return is compared with the declared figure, with a tolerance in the region of two tenths of a percentage point at that sample size. Feature triggers are counted against the declared frequency and the maximum win cap is tested by forcing the top combination. A build that pays differently from its own information panel does not pass.
Two limits are worth stating. The test describes a distribution across millions of rounds of real-money play and says nothing about a given hour. And it does not apply to the dealer tables, where the cards and the wheel are physical: there the lab audits the shuffle procedure, the card-recognition system and the payout schedule, and the table specifications that result are listed on ACE66 Live Casino.
What triggers a security check on an account
Five events raise a risk score high enough to interrupt a session. A device fingerprint we have not seen on the account before, which on a mobile account usually means a new phone or a reinstalled app. A sign-in from a location that is implausibly far from the previous one given the interval. A change to the payout bank or wallet. A password reset followed by a withdrawal request inside twenty-four hours. And a device that iovation has already flagged elsewhere in its network.
What the check does depends on the band. In the lower band it is a one-time code to the registered number and the session continues. In the upper band the account is held pending documents, which is a forty-eight hour review rather than a closure, and the balance is untouched throughout. ThreatMetrix supplies the session-shape signals and iovation the device reputation; neither has access to anything outside the session, and we do not read a player's contacts, messages or stored files.
Support may verify an account against the registered phone number, the date of birth on file, the amount of the last deposit and the rail it arrived on. A check in the lower band adds seconds to a sign-in; the upper band is rare enough that most accounts never meet it, and the balance is spendable again the moment the documents clear. The sign-in requirements and the recovery procedure are specified on ACE66 Login.
The dispute procedure, step by step
Every case runs through the same seven steps, and the clock on each one is published rather than estimated at the time. Step one is yours: open the case with the round ID from bet history, the account number and the timestamp. Nothing can be checked without the round ID, because that is the key the game studio uses to pull its own server log.
| Step | What you supply | What we do | Clock |
|---|---|---|---|
| 1. Open | Round ID, account number, timestamp | Log the case and issue a reference number | Same day |
| 2. Classify | Nothing further | Route to the cashier, the risk desk or the studio | Within 4 hours |
| 3. Cashier case | Bank or wallet reference | Trace the transfer with the rail | 24 hours |
| 4. Account lock | The documents requested | Risk desk review and release | 48 hours |
| 5. Bonus release | Nothing further | Audit the turnover ledger against the offer | 72 hours |
| 6. Round outcome | Nothing further | Studio pulls the server log for that round | 5 to 10 working days |
| 7. Finding | Nothing further | Written finding with the log attached | On completion |
A finding is issued in writing in every case and the log travels with it, whether or not the finding favours the member. Where a correction is owed it is credited as cash rather than as bonus credit, and carries no wagering requirement. Where it is not, the log shows why, and a member is entitled to read it rather than be told about it. The routes a case can be opened through, with the hours on each, are listed on the contact page.
Data handling and retention periods
Five categories of data sit on an account: identifiers, verification documents, financial records, bet records and session metadata. Each has a stated life. Bet history and cashier entries are visible to the member for twenty-four months and retained beyond that in the compliance record. Session metadata, meaning device fingerprints and risk scores, is held for twelve months.
Verification documents are encrypted at rest and are not shared with the game studios, who never see an identity at all. What a studio receives is an anonymised session token, a stake and a currency, never a player's name. Nothing is sold to a third party and nothing is passed to an advertiser, and the marketing opt-out is a switch on the account page rather than a request to support.
Closing an account removes the playing record from the casino. The financial and compliance trail is retained for the period the licence requires, which is not a discretion we hold, and any balance is paid out first under the usual cashier rules. The document list and the stages a payout passes through are set out on ACE66 Withdraw.
Funds, fees and the name-match rule
Member balances are held separately from operating funds. The cashier accepts Touch 'n Go, DuitNow, Boost, GrabPay and FPX through Maybank, CIMB, Public Bank and Hong Leong, with a RM10 minimum landing under a minute. Those are the payment options in full, all of them settling in ringgit: there is no crypto rail and no payment accepted outside the cashier. Payouts run from RM50 to a daily ceiling of RM50,000 and clear in 3 to 15 minutes.
There is no fee schedule here because we charge nothing on either side: not on a deposit, not on a payout, not on a dormant balance, and nothing is deducted from a requested amount or from a cashback credit. A bank or an e-wallet may apply its own charge under its own terms, which shows on their statement rather than ours.
One rule rejects more payouts than every other rule combined: the name on the receiving account must match the name on the member account exactly. A spouse's account, a company account or a nickname is refused by the rail itself, not by a person deciding. The first payout on a new account also carries a one-off document check, which is why it is the slow one and the ones after it are not.
The same casino cashier posts money the other way. A first real money deposit of RM10 or more can take the 120% deposit bonus to a ceiling of RM1,688; a verified phone number draws RM8 before any deposit at all; and 1.2% of settled turnover comes back daily at 8pm as cash rather than as bonus credit, on online slot and dealer game stakes alike. Each of the three is a named line on the same ringgit statement, and the name-match rule above governs all of it on the way out. None of this specification reads differently because an account was opened today.
Document versions and change notice
Every published document on this platform carries a version number and an effective date: the terms, the bonus rules including the welcome bonus, the weighting table and the cashier sheet. A change to terms is posted in the casino notice panel seven days before it takes effect. A change to a rate or a limit takes effect from publication and is never applied backwards.
Each accepted bet stores the version in force at the moment of acceptance, alongside the odds or the paytable that applied. That stamp is what a dispute is settled against, so a rule written next month cannot reach a wager settled last week. If a finding ever appears to contradict that, the round ID will show which version the system used.
The figures quoted across this site come from one cashier record, and the room-by-room reference built from it is on ACE66 Casino. Where a page here and the casino disagree, the casino is correct, because it reads the live record.
What an offshore licence obliges, and what it cannot provide
The obligations are specific and worth listing. Member funds held apart from operating funds. Terms published before they bind. A complaints route with stated turnarounds, which is the table further up. Game builds submitted to an accredited lab. Transaction records retained for a set period. An annual audit of the platform's financial statements.
What it does not provide is equally specific. There is no Malaysian regulator to appeal to, because no Malaysian authority licenses an online casino at all and no Malaysian online gambling licence exists to be issued. There is no local deposit protection scheme and no statutory compensation fund. The protections here are contractual and technical, which is precisely why every clause of the specification is written out in full instead of summarised as a badge.
Members must be 21 or over. The Common Gaming Houses Act 1953 and the Betting Act 1953 are the statutes in force, and neither creates a licence an online operator can hold in this market.