Covid-19 update
Invitation to tender for the provision of SAS auditing services
GSMA is inviting tenders for SAS-UP and SAS-SM auditing services from October 2021, with services to begin in February 2022. Find out more.
Due to the travel and workplace attendance restrictions caused by Covid-19, SAS audit teams continue to have difficulties in performing and planning on-site audits. GSMA and the SAS auditing companies have developed alternative options that some sites can pursue to gain or maintain certification, depending on which scheme they are participating in (SAS-UP, SAS-SM) and where they are in the certification process.
These options include:
- Temporary extensions of certification (following remote assessment) for sites seeking renewal of existing certification (for SAS-SM and SAS-UP)
- Remote audits (for SAS-SM audits and some SAS-UP site and activity types)
- Hybrid audits (for SAS-UP renewal and repeat audits)
Details are available in the SAS Covid-19 Policy and Methodology Variation documents here.
Certification for affected sites is highlighted with relevant notes in the tables below. In addition, some sites have declared to GSMA that they have temporarily implemented business continuity measures in response to Covid-19 that affects their compliance with SAS. Details are being reviewed with the SAS auditors to ensure that compensating controls are being applied. These sites are highlighted (with Note #2) in the tables below.
New SAS applicants or participating sites are invited to contact sas@gsma.com with any questions or to pursue the available options.
SAS for UICC Production (SAS-UP)
The Universal Integrated Circuit Card (UICC) production (SAS-UP) supplier sites in the table below are currently accredited
Accreditation scope definitions are provided here.
Key to Entries
| Entry / Symbol | Certification Type | Scope |
| UICC | UICCP | Full | Provisional | Within scope (UICCs) |
| eUICC | eUICCP | Within scope (eUICCs) | |
 |  |
Within scope (2-step personalisation – Perso_SC) | |
 |  |
Within scope (2-step personalisation – Perso_UICC) | |
 |  |
Within scope (card form factor) | |
 |  |
Within scope (embedded form factor) | |
 |  |
Within scope (Wafer Level Chip Scale Packaging) | |
 |
N/A | GSMA PKI Live; site has demonstrated compliant controls with GSMA PKI certificate(s) in use*. |
 |
N/A | GSMA PKI Ready; site has demonstrated compliant controls for PKI certificate management with non-GSMA PKI certificates* |
| – | N/A | Not carried out at this site |
P: Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
* SAS-UP certificates issued prior to the publication of FS.05 v9.2 (21 Apr 2021) indicate the previous designation (provisional/full) for certification of this activity. Each site’s SAS-UP certificate will be reissued with the new designation following its next successful audit.
SAS-UP Accredited sites.
Supplier |
Site |
Certification Scope |
Valid to: |
Cert. |
|||
Generation of data for personalisation |
Personalisation |
Management of PKI certificates |
Post personalisation packaging |
||||
|
Advanced Semiconductor Engineering Inc. [3] |
Kaohsiung, Taiwan |
– |
|
– |
|
Mar 2022 |
|
|
Ardentec Corporation [3] |
Hsinchu, Taiwan |
– |
|
– |
– |
May 2023 |
|
|
Ardentec Singapore Pte Ltd [3] |
Singapore |
– |
|
– |
– |
Jul 2022 |
|
|
Beautiful Card Corporation [1] |
Taipei, Taiwan |
UICC |
|
– |
|
Jan 2022 |
|
|
Beijing Huahong IC Design Co., Ltd. [3] |
Beijing, China |
UICC, eUICC |
|
|
– |
Sep 2023 |
|
|
Beijing Watchdata Co., Ltd. [1] |
Beijing, China |
UICC |
|
– |
– |
Jan 2022 |
|
|
Chutian Dragon Co., Ltd. [3] |
Dongguan, China |
UICC |
|
– |
|
Feb 2023 |
|
|
Eastcompeace Technology Co., Ltd [3] |
Zhuhai, China |
UICC, eUICC |
|
|
|
Aug 2022 |
|
|
E-Kart [1] |
Istanbul, Turkey |
UICC, eUICCp |
|
|
– |
Dec 2021 |
|
|
Gemalto Southern Africa (Pty) Ltd [1] |
Gauteng, South Africa |
– |
|
– |
– |
Sep 2021 |
|
Barcelona, Spain |
UICC, eUICC |
|
|
|
Apr 2023 |
|
|
|
Giesecke+Devrient (China) Technologies Co., Ltd. [1] |
Nanchang, China |
UICC, eUICC |
|
|
|
Dec 2021 |
|
Markham, Canada |
UICC, eUICC |
– |
|
– |
Jul 2022 |
|
|
|
Giesecke & Devrient MS India Private Limited [2] |
Chennai, India |
UICC, eUICC |
– |
|
– |
Feb 2022 |
|
Neustadt, Germany |
UICC |
|
– |
|
Jul 2023 |
|
|
|
Giesecke y Devrient de Mexico S.A. de C.V. |
Tlalnepantla de Baz, Mexico |
UICC |
– |
– |
– |
Jan 2022 |
|
|
Goldpac Limited [3] |
Zhuhai, China |
UICCp |
|
– |
– |
Jun 2022 |
|
|
Hengbao Co., Ltd [3] |
Danyang, China |
UICC, eUICC |
|
|
|
Dec 2021 |
|
|
HB Technologies Algiers [1] |
Algiers, Algeria |
UICC |
|
– |
– |
Feb 2022 |
|
|
IDEMIA (Shenzhen) Technologies Company Limited [3] |
Shenzhen, China |
UICC, eUICC |
|
|
– |
Aug 2023 |
|
|
IDEMIA FRANCE SAS |
Vitré, France |
UICC, eUICC |
|
|
|
Jan 2022 |
|
|
IDEMIA Germany GmbH |
Flintbek, Germany |
UICC, eUICC |
|
|
|
Sep 2021 |
|
|
Idemia Syscom India Private Limited [3] |
Noida, India |
UICC, eUICC |
|
|
– |
Jan 2023 |
|
|
Infineon Technologies Dresden GmbH, [3] |
Dresden, Germany |
– |
|
– |
– |
Jun 2022 |
|
|
Inkript [3] |
Beirut, Lebanon |
UICC |
|
– |
– |
Aug 2023 |
|
|
JSC NovaCard |
Nizhny Novgorod, Russia |
UICC |
|
– |
– |
Dec 2021 |
|
|
Kigen (UK) Limited [3] |
Dublin, Republic of Ireland |
UICC, eUICC |
– |
|
– |
Sep 2022 |
|
|
KONA M Co., Ltd. [1] |
Jincheon-Gun, South Korea |
UICC |
|
– |
|
Sep 2021 |
|
|
MK Smart Joint Stock Company [1] |
Hanoi, Vietnam |
UICC |
|
– |
– |
Feb 2022 |
|
Hamburg, Germany |
UICC, eUICC |
– |
|
– |
Oct 2021 |
|
|
|
NXP Semiconductors Kaohsiung |
Kaohsiung, Taiwan |
– |
|
– |
|
Oct 2021 |
|
|
PT. Chengtian Weiye Indonesia [3] |
Bekasi, Indonesia |
– |
|
– |
– |
Apr 2023 |
|
|
Quadra Graphic [3] |
Belgrade, Serbia |
– |
– |
– |
|
Apr 2022 |
|
|
Samsung Electronics Co., Ltd. [1] |
Yongin, South Korea |
– |
– |
– |
– |
Jan 2022 |
|
|
SecureID Limited [1] |
Lagos, Nigeria |
– |
|
– |
– |
Dec 2021 |
|
|
Shenzhen Chengtian Weiye Technology Company Limited [1] |
Shenzhen, China |
UICC |
|
– |
– |
Feb 2022 |
|
|
Shenzhen iGear Technology Inc [3] |
Shenzhen, China |
– |
|
– |
– |
Jul 2023 |
|
|
Sichuan Keydom Smart Technology Co.,Ltd [3] |
Chengdu, China |
– |
|
– |
– |
Jan 2022 |
|
|
STMicroelectronics srl [3] |
Caserta, Italy |
UICC, eUICC |
|
|
|
May 2023 |
|
Rousset, France |
– |
|
– |
– |
Sep 2023 |
|
|
Toa Payoh, Singapore |
– |
|
– |
– |
Jul 2023 |
|
|
|
TESNA Inc. [3] |
Pyeongtaek-Si, Korea |
– |
|
– |
– |
Mar 2022 |
|
|
Thales DIS France [3] |
Pont Audemer, France |
UICC, eUICC |
|
|
|
Apr 2023 |
|
|
Thales DIS France SA [3] |
Tours, France |
|
|
|
– |
Jun 2022 |
|
|
Thales DIS (Shanghai) Co., Ltd. |
Shanghai, China |
UICC, eUICC |
|
|
– |
Dec 2021 |
|
|
Thales DIS USA, Inc. [3] |
Montgomeryville, USA |
UICC, eUICC |
– |
|
– |
Jun 2023 |
|
|
Trasna Solutions d.o.o. [1] |
Gračanica, Bosnia & Herzegovina |
UICC |
|
– |
|
Mar 2022 |
|
|
United Security Printing |
Abu Dhabi, UAE |
UICC |
|
– |
|
Dec 2021 |
|
|
Valid Card Manufacturing (Suzhou) Co., Ltd [3] |
Suzhou, China |
UICC, eUICC |
|
|
|
Feb 2022 |
|
|
Valid Soluciones Tecnológicas S.A.U. |
Madrid, Spain |
UICC, eUICC |
|
|
|
Apr 2022 |
|
|
Workz Media FZ LLC [3] |
Dubai, United Arab Emirates |
UICC, eUICC |
|
|
|
Aug 2023 |
|
|
Wuhan Tianyu Information Industry Co., Ltd. – Lefeng Road [3] |
Wuhan, China |
UICC, eUICC |
|
|
|
Feb 2022 |
|
|
XH Smart Tech (China) Co., Ltd. [3] |
Zhuhai, China |
UICC |
|
– |
– |
Jan 2023 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
[3] Certification for this site has been issued following a Remote Audit, which is a temporary measure implemented by GSMA while Covid-19 restrictions are in place. See details on individual certificates.
SAS for Subscription Management (SAS-SM)
The subscription management service provider and data centre operations and management sites in the table below are currently accredited.
Accreditation scope definitions are provided here.
Key to Symbols
| Symbol | Certification Type |
 |
Within scope (full certification; locally hosted) |
 |
Within scope (provisional certification; locally hosted *) |
 |
Within scope (full certification; cloud hosted/hosting) |
 |
Within scope (provisional certification; cloud hosted/hosting *) |
| – | Not carried out at this site |
* Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
SAS-SM Accredited sites.
Supplier |
Site |
Scope of Certification |
Valid to: |
Cert. |
||||
Secure Routing |
Data Preparation |
Data Preparation+ (ref. SGP.22) |
Data Centre Operations & Management |
Discovery Service |
||||
|
A1 Systems [3] |
Moscow, Russia |
|
|
|
|
– |
Mar 2022 |
|
|
Amazon Web Services, Inc. [3] |
Sites in AWS US East Ohio region as specified on certificate |
– |
– |
– |
|
– |
Sep 2022 |
|
Noida, India |
|
|
|
|
– |
Nov 2022 |
|
|
Zhuhai, China |
|
|
|
|
– |
Mar 2022 |
|
|
|
Giesecke+Devrient Mobile Security Germany GmbH. [3] |
Aschheim, Germany |
|
|
|
|
|
Apr 2023 |
|
|
Giesecke+Devrient Mobile Security Germany GmbH. [3] |
Munich, Germany |
|
|
|
|
|
Apr 2023 |
|
|
Giesecke+Devrient (China) Technologies Co., Ltd. (Shanghai) [3] |
Shanghai, China |
|
|
|
|
|
Sep 2022 |
|
|
Giesecke & Devrient Mobile Security America, Inc. [3] |
Atlanta, USA |
|
|
|
|
|
Mar 2023 |
|
|
Giesecke & Devrient Mobile Security Iberia, SAU [3] |
Barcelona, Spain |
– |
– |
|
|
|
Jun 2023 |
|
|
Hengbao Co., Ltd [3] |
Danyang, China |
|
|
|
|
|
Sep 2022 |
|
|
IDEMIA America Corp. |
Sterling, U.S.A |
|
|
|
|
– |
Jan 2022 |
|
|
IDEMIA Technologies Romania S.R.L. [3] |
Bucharest, Romania |
|
|
|
|
– |
Jan 2022 |
|
|
Invigo Offshore SAL [3] |
Beirut, Lebanon |
|
|
|
|
|
Mar 2023 |
|
Dublin, Republic of Ireland |
|
|
|
|
|
Jun 2022 |
|
|
|
Links Field Networks Ltd. [3] |
Shenzhen, China |
– |
– |
|
|
– |
Dec 2021 |
|
|
Microsoft Corporation [3] |
Sites in France Central and France South Microsoft Azure regions as specified on certificate |
– |
– |
– |
|
– |
Jun 2022 |
|
|
Microsoft Corporation [3] |
Sites in Central US, East US and East US 2 Microsoft Azure regions as specified on certificate |
– |
– |
– |
|
– |
Jun 2022 |
|
|
Monty Mobile UK [3] |
London, UK |
– |
– |
|
|
– |
Feb 2022 |
|
|
Nordic eSIM [3] |
Copenhagen, Denmark |
|
|
|
|
– |
Jul 2022 |
|
|
NovaCard JSC [3] |
Nizhny Novgorod, Russia |
|
|
|
|
– |
Sep 2022 |
|
Paris, France |
|
|
|
|
– |
Nov 2021 |
|
|
|
Protahub A.Ş. [1] |
Istanbul, Turkey |
|
|
|
|
– |
Nov 2021 |
|
|
Redtea Mobile PTE. LTD. [3] |
Amsterdam, Netherlands |
– |
– |
|
|
– |
Jun 2022 |
|
|
Reliance Jio Infocomm Ltd |
Mumbai, India |
|
|
|
|
– |
Mar 2022 |
|
Riyadh, Saudi Arabia |
|
|
|
|
– |
Jan 2022 |
|
|
|
Tele2 [3] |
Rostov-on-Don, Russia |
|
|
|
|
– |
Jan 2022 |
|
|
Telenor Group [3] |
Oslo, Norway |
|
|
|
|
– |
Jan 2022 |
|
|
Thales DIS France SA [3] |
Tours, France |
|
|
|
|
|
Jan 2023 |
|
|
Thales DIS (Shanghai) Co., Ltd. [3] |
Shanghai, China |
|
|
|
|
– |
Sep 2023 |
|
|
Thales DIS USA, Inc. [1] |
Dallas, USA |
|
|
|
|
|
Sep 2021 |
|
|
Truphone Limited [2] |
London, United Kingdom |
|
|
|
|
|
Dec 2021 |
|
Amsterdam, The Netherlands |
|
|
|
|
|
Mar 2022 |
|
|
Moscow, Russia |
|
|
|
|
|
Mar 2022 |
|
|
|
VALID SOLUCIONES TECNOLÓGICAS S.A.U. [3] |
Madrid, Spain |
|
|
|
|
– |
Mar 2022 |
|
|
Valid USA Inc [3] |
Chicago, USA |
|
|
|
|
|
Jan 2022 |
|
Thane, India |
|
|
|
|
– |
Sep 2021 |
|
|
|
Workz Media FZ LLC [3] |
Dubai, United Arab Emirates |
|
|
|
|
– |
Jul 2023 |
|
|
Wuhan Tianyu Information Industry Co., Ltd. [3] |
Wuhan, China |
|
|
|
|
|
Nov 2023 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
[3] Certification for this site has been issued following a Remote Audit, which is a temporary measure implemented by GSMA while Covid-19 restrictions are in place. See details on individual certificates.
If you would like to receive an email when the list of accredited sites changes, please provide your details below: