You prove a competition draw is fair with four things: a draw method the rules accept, an entry list fixed when the competition closes, a record of every step, and a result that players can check. The CAP Code and the DCMS Voluntary Code of Good Practice for Prize Draw Operators set that standard, and some business banks ask for the evidence too. At Nera Marketing we have built 50+ UK competition websites. This guide covers the evidence layer: which methods hold up, RNG certification, what to record, how long to keep it, and what to publish.

How do you prove a competition draw is fair?

A draw is provably fair when someone outside your business can check four things after the event. The winner came from a method the rules allow. Every valid entry was in the pool. The pool was fixed before the draw ran. And the winning number belongs to a real order or postal entry. Each of those needs its own record.

Saying the draw was random is not evidence. ASA guidance says a bare statement that a random process was used is not enough, and the ASA has upheld complaints where a promoter could not show how its winners were picked.

The free entry route that makes a paid prize draw lawful is covered in our guide to how prize draws work under UK law. This article covers the evidence that each draw was run fairly.

What the CAP Code and the Voluntary Code require from a draw

CAP Code rule 8.24 requires prize draw winners to be chosen by the laws of chance, by or under the supervision of an independent person, unless a computer process that produces verifiably random results selects them. Voluntary Code clause 2.2 repeats that test, adds auditable results and certified drawing machines, and gives every entry an equal chance.

Rule	What it asks for	Evidence that answers it
CAP 8.24	Laws of chance, via an independent person or a verifiably random computer process	Draw method in your terms, the recording, the tool and range used
CAP 8.25	Instant wins awarded fairly and at random, with an independently audited statement	Prize allocation file and the audited statement
CAP 8.28.4	Entrants told how and when winners will be notified	Notification wording in your terms, the winner contact log
CAP 8.28.5	Show a valid award took place, ordinarily surname and county of major winners, and tell the ASA if challenged	Winners page, record of any winner objections
Voluntary Code 1.2	A transparent and robust complaints process	Complaints page and complaints log
Voluntary Code 2.1	A summary of how each draw is run, with a laws of chance statement	A “how this draw works” block on each competition page
Voluntary Code 2.2	Independent person, verifiably random and auditable computer process, or certified drawing machine; equal chance for every entry	Draw record with paid and postal entries in one pool
Voluntary Code 2.3	Information on the likelihood of winning, such as the maximum number of tickets	The ticket cap shown on the competition page
Voluntary Code 3.4	Your measures published on your website	A transparency or measures page

The Voluntary Code applies in Great Britain to prize draws with both a paid and a free entry route, and it has been in effect since May 2026. DCMS now asks signatories for evidence clause by clause, as our piece on the DCMS compliance review explains. For implementation steps, use the clause-by-clause Voluntary Code guide. Instant wins carry their own evidence burden under CAP 8.25, and the formats that work are set out in our guide to instant win mechanics.

Live draw, platform RNG or third-party service: which method holds up?

All three can meet CAP 8.24 if the evidence holds up afterwards. A live draw shows the process as it happens, a platform random number generator leaves a log, and a third-party service keeps a record outside your business. The weak options are the ones nobody can check later: a staff member picking a name, or a wheel spinner.

Method	What a viewer or auditor can check	Evidence it leaves	Watch out for
Google’s random number generator on a live stream	The range set from 1 to the number of valid entries, and the number generated on screen	The recording of the stream	The top of the range must match the entry count at close
Physical ball machine on a live stream	Each ball shown to the camera	The recording	The Voluntary Code refers to a certified physical drawing machine
Draw run inside the competition platform	The draw log against the entry pool	The platform audit trail and timestamp	Save the entry list as it stood at close
Independent person	A named, impartial person ran or supervised the draw	A signed statement from that person	Staff and agencies working on the promotion are unlikely to count
Third-party draw service	The provider’s record of the draw	The provider’s record or certificate	Check what the record shows and how long the provider keeps it

We favour a random number generator shown live on camera, because transparency is worth more to players than sophistication. Two operators we work with show both live approaches. Reddi Competitions runs its weekly draws with Google’s random number generator on screen. Rusboy Competitions uses a ball machine and holds each ball up to the camera before calling the winner. Both leave a recording that anyone can rewatch. The full setup, from closing entries to what never to show on screen, is in our guide to running a Facebook Live draw.

Third-party services suit operators who want a record held by someone else. RANDOM.ORG runs a draw service using atmospheric noise, with a record entrants can check. randomdraws.co.uk sells single draws from £30 and publishes RNG test reports from BMM, a gambling test lab. VeriDraw publishes a cryptographic commitment before tickets go on sale and issues a public certificate for each draw, with paid plans from £39 a month plus VAT. Read what each record actually shows before you rely on it.

Why a staff pick or a wheel spinner is the weak option

ASA guidance says staff, and agencies working on the promotion, are unlikely to count as independent. The ASA has upheld complaints where a staff member picked a winner from social media comments, and where a manager chose winners without supervision. It has said screenshots of a spreadsheet using a random function can be appropriate evidence.

Wheel spinners fail for a different reason. Many can be configured in advance, and a viewer cannot see how the wheel is set up, so the result cannot be verified. We advise against them for any paid-entry draw.

Do prize draw operators need RNG certification?

Neither section 8 of the CAP Code nor the Voluntary Code mentions RNG certification. The Code accepts a computer process with verifiably random and auditable results, or a certified physical drawing machine. Formal RNG certification belongs to licensed gambling, where the Gambling Commission requires licensees to have their random number generators tested by an approved test house.

The Commission’s list of approved test houses includes eCOGRA, Gaming Laboratories International (GLI), BMM Testlabs, Gaming Associates Europe and Quinel, and every approved house must hold ISO/IEC 17025 accreditation. A prize draw operator can still choose a tool one of these labs has tested. That strengthens your evidence, but the codes do not list it as a requirement.

What to send when your bank asks for an RNG certificate

Banks ask about draws too. One operator we work with was approved for a Revolut business account and later received a verification check asking for three documents. The third was “RNG certificates or independent audit reports verifying the fairness of draw mechanics”, with the words “if applicable” after it. That operator ran its own draws, so there was no RNG certificate to send.

The first two requests, licences and a legal opinion, are answered by a legal opinion letter, because it explains why no licence is needed and confirms the lawful basis. For the draw question, send what you hold: the draw method from your terms, the draw records for recent competitions, the recordings, and the certificate or record from any third-party service you use. Our guide to business bank verification checks covers which banks accept competition operators in the first place.

What to record for every draw

Keep one record per draw that would let a stranger replay what happened. The draw record Nera Marketing recommends has nine parts covering the entry pool, the method, the result and what happened after the draw. Most of them come straight out of the platform.

1. The closing time, and whether the competition closed on its end date or on sell-out.
2. The entry list at close, with paid and postal entries in one pool, and the total count.
3. The draw method and tool, with the number range used.
4. The recording of the draw, or screenshots of each step for an automatic draw.
5. The winning number, matched to the order or postal entry that holds it.
6. Who ran the draw, and the name of any independent person present.
7. The winner contact log: when you made contact and when they replied.
8. Evidence of prize delivery, such as a delivery confirmation or handover photo.
9. Any redraw, disqualification or date change, with the reason written down.

Draw from paid and postal entries only

Build the pool from paid orders and valid postal entries. Remove cancelled, refunded and unpaid orders before the draw, then check the count against the number of tickets sold. If a live draw runs from 1 to the wrong number, the draw cannot be defended.

Put postal entries in the same pool

Clause 2.2 asks for an equal chance for every entry, paid or free. For a manual or live draw, each postal entrant is added to the draw list with an assigned number. For an automatic draw, the postal entry is entered as an order so it receives tickets from the same pool as paid entries. Write a policy for postal entries that arrive after the draw has closed. One operator found two postal entries in their PO box after the competitions had already ended.

Check unique winner settings before the draw

Unique winner settings can fail a draw that sold well. One competition we supported offered 10 prizes with unique winners switched on. It sold 25 tickets to only 3 different customers, so the prizes could not be awarded. Check the setting against the number of distinct entrants first.

How long should you keep draw records?

Neither section 8 of the CAP Code nor the Voluntary Code sets a retention period for draw records. UK GDPR says personal data should be kept no longer than necessary and leaves the period for you to set and justify. In practice that means a written retention policy that covers draws, with a period long enough to answer a challenge.

The ICO’s guidance on storage limitation confirms UK GDPR sets no fixed periods. CAP 8.28.5 expects you to give the ASA the winner information and winning entry if a promotion is challenged, so the record has to outlast any realistic complaint. Our Voluntary Code guide suggests at least 12 months for draw logs as a working minimum. Agree the final period with your solicitor, particularly for high-value prizes.

Plan for erasure requests too. A player can ask you to delete their data while the draw record still needs to show who was in the pool. Decide in advance how your policy handles that, and take advice if a request arrives for a recent draw.

What to publish so players can check the draw themselves

Publish enough for an entrant to check their own place in the draw without seeing anyone else’s data. That means how the draw works, the maximum number of tickets, a masked entry list, the winning number with a surname and county or a handle, and the recording.

• A “how this draw works” summary on every competition page, including the laws of chance statement (Voluntary Code 2.1).
• The maximum number of tickets, so entrants can work out their odds (Voluntary Code 2.3).
• An entry list with names masked, so each entrant can find their own numbers.
• The winning number and the winner’s surname and county or handle, with a way for winners to object (CAP 8.28.5).
• The live recording, or the draw log for automatic draws.

Show winners from the first winner. Hiding names until a prize tier has several winners means low prize-count tiers never publish anything. One operator worried players would “think something dodgy is going on when they can’t see who has won”, and that is what happens. Never put personal data on a live stream: ticket numbers are all viewers need. State the draw method and notification process in the draw and winner selection clause in your terms.

How Nera Engine and Nera Shield handle draw evidence

Nera Marketing builds the draw evidence into the platform itself. On the Nera Engine platform each competition is set to an automatic draw at the end date, an automatic draw on sell-out, or a live draw, and every entry and outcome is written to an audit trail.

Unique winner logic is a per-competition setting, so one customer cannot sweep several prizes unless the operator allows it. Our builds support a public winners page, a public entry list and name masking. For live draws, the platform holds the entry list and the operator holds the recording, so keep both together in the draw record.

The Nera Shield compliance layer adds the free entry route, the skill question and the player protections the Voluntary Code asks for. The draw tools come as standard on the competition websites we build, with packages from £2,995. Nera Marketing signed the Voluntary Code as a web developer, and we build its draw clauses into the sites we deliver.

When a player, the ASA or a bank challenges a draw

Answer a challenge from the record, never from memory. Pull the draw record, match the winning number to the order or postal entry that holds it, and send the person asking what they are entitled to see. What that is depends on who is asking.

1. A player: respond through your published complaints process (Voluntary Code 1.2), confirm their entries were in the pool, and point them to the recording.
2. The ASA: provide the winner information and winning entry (CAP 8.28.5), plus the evidence of the draw method required by CAP 8.24.
3. A bank: send the draw method from your terms, recent draw records and any third-party certificate.
4. DCMS: map your evidence to the clause numbers, with a live link against each one where you can.

A draw that leaves a record can be checked by anyone who asks. That is the standard the CAP Code and the Voluntary Code set, and it is the standard Nera Marketing builds to.