How tournament anti-cheat differs from the client you run at home

When you load an esport title at home, the anti-cheat client begins scanning memory, monitoring process handles and matching signatures before the first round is served. It must act in real time. At a tournament, the security apparatus runs on a different clock. The ESL rulebook does not name a scanner; it opens with a blanket ban on cheating and then spends most of its integrity section describing demos, retention periods and admin review. The gap is not a sign of laxity. It is the difference between a machine that distrusts everything instantly and a process that distrusts nothing until a recording has been picked apart.

That difference shapes the entire approach. Every player must record a point-of-view demo of each map, from the first buy to the last, and keep it. The anti-cheat team analyses the GOTV demo, the server-side log of every tick. If a protest is filed, all match media must be kept for at least fourteen days until the case is closed. No signature heuristics. No pop-up ban. Just a body of evidence and an admin who will eventually rule.

What tournament anti-cheat actually monitors

ESL’s rules require match media, not a real-time list of loaded modules. The point-of-view demo shows exactly what the player saw. The in-eye demo can be demanded of an accused player if the anti-cheat team decides it is needed. RGL, another competitive league, randomly requests demos from teams so that a player’s ability to produce a clean POV recording can be tested in any anti-cheat case. The monitoring is of the record, not of the machine.

The rules also dictate what cannot happen. Incomplete demos are weighed by an admin, who decides whether they are treated as missing. Edited demos are strictly forbidden; if a replay has been manipulated, the admin team determines the sanction separately. Players may not upload match media to personal web space or an external host. The file the player produces is trusted only if it stays where the organisers put it.

Why demos matter more than a client on the player’s machine

A home anti-cheat must distrust everything and react fast. Tournament integrity has time. The GOTV demo gives the review team a server-authoritative record of every tick, so they do not need to trust the player’s hardware at all. The point-of-view demo fills in the perspective, and the two can be synchronised to replay a suspect round until the movement makes sense or it does not.

The burden sits on the player to keep the record. If a demo is incomplete, the admin decides how to treat it; a missing recording does not automatically mean a cheating finding, but it removes one layer of exculpation. And because all match media must survive a fourteen-day protest window, nobody can delete a file and hope the question goes away. That is not a stronger scanner. It is a process built to outlive the match.

How integrity bodies frame the job

The Esports Integrity Commission states its mission as providing “integrity oversight of esports,” covering cheating, match manipulation and doping. Its published summary of one large retrospective review illustrates the scale: roughly 99,650 video demos examined, a dataset of about 15.2 terabytes. The result was 37 sanctioned coaches.

Thirty-seven. The number is small because the review was not an automated sweep of every suspicious tick. It was a targeted investigation of a specific exploit, using the demo archive to prove or disprove each case. An integrity body assembled a finding that could survive a challenge; a desktop anti-cheat sends an alert and hopes for a hit.

What the rules say about evidence handling

The ESL rulebook builds a custody chain. A player records a full POV demo per map. The anti-cheat team works from the GOTV demo. If a protest opens, match media is held for fourteen days. An incomplete demo triggers an admin’s judgement, not an automatic penalty. An edited demo is treated as a violation in its own right, separate from whatever cheating it might conceal. And players are forbidden from uploading match media to any external host, shutting the obvious vector for a doctored file swap.

RGL’s anti-cheat FAQ adds that demos are requested from teams at random, verifying that a player can produce a POV recording on demand. The system does not assume the machine is clean. It assumes the record will be checked, and it designs the rules so that the integrity of the record is preserved from the moment the client saves it.

What remains unspoken

The rulebooks omit any mention of a software-layer scan on tournament machines. The process is designed to work even if a local client is untrustworthy. A statistical spike can prompt a review, but the ESL rules do not call a flag a verdict. The anti-cheat team analyses the demo; an admin decides the penalty. A flag asks, an admin answers.

The commission’s review tallied 99,650 demos and 15.2 terabytes, yet did not publish the heuristics that selected subjects. Organisers do not disclose every check. The quiet is not an absence; it is a choice that keeps detection thresholds away from the people who would study them.

The final finding on a protest may arrive after the match. The evidence stays in place until the case closes. Tournament anti-cheat is, in the end, a paper trail that no real-time scan can write.

• Whether the event requires POV demos, GOTV, or both.
• Whether the rulebook says who may request additional demos and under what standard.
• Whether the integrity process distinguishes between a flag for review and a final finding.