Covid-19 update
Due to the travel and workplace attendance restrictions caused by Covid-19, SAS audit teams continue to have difficulties in performing and planning on-site audits. GSMA and the SAS auditing companies have developed alternative options that some sites can pursue to gain or maintain certification, depending on which scheme they are participating in (SAS-UP, SAS-SM) and where they are in the certification process.
These options include:
- Temporary extensions of certification (following remote assessment) for sites seeking renewal of existing certification (for SAS-SM and SAS-UP)
- Remote audits (for SAS-SM audits and some SAS-UP site and activity types)
- Hybrid audits (for SAS-UP renewal and repeat audits)
Details are available in the SAS Covid-19 Policy and Methodology Variation documents here.
Certification for affected sites is highlighted with relevant notes in the tables below. In addition, some sites have declared to GSMA that they have temporarily implemented business continuity measures in response to Covid-19 that affects their compliance with SAS. Details are being reviewed with the SAS auditors to ensure that compensating controls are being applied. These sites are highlighted (with Note #2) in the tables below.
New SAS applicants or participating sites are invited to contact sas@gsma.com with any questions or to pursue the available options.
SAS for UICC Production (SAS-UP)
The Universal Integrated Circuit Card (UICC) production (SAS-UP) supplier sites in the table below are currently accredited
Accreditation scope definitions are provided here.
Key to Entries
| Entry / Symbol | Certification Type | Scope |
| UICC | UICCP | Full | Provisional | Within scope (UICCs) |
| eUICC | eUICCP | Within scope (eUICCs) | |
| GSMA PKI | PKIP | Within scope (GSMA PKI certificates) | |
 |  |
Within scope (card form factor) | |
 |  |
Within scope (embedded form factor) | |
 |  |
Within scope (Wafer Level Chip Scale Packaging) | |
| – | N/A | Not carried out at this site |
P: Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
SAS-UP Accredited sites.
Supplier |
Site |
Certification Scope |
Valid to: |
Cert. |
|||
Generation of data for personalisation |
Personalisation |
Management of PKI certificates |
Post personalisation packaging |
||||
|
Ardentec Corporation [1] |
Hsinchu, Taiwan |
– |
|
– |
– |
May 2021 |
|
|
Beautiful Card Corporation |
Taipei, Taiwan |
UICC |
|
– |
|
Jul 2021 |
|
|
Beijing Huahong IC Design Co., Ltd. [1] |
Beijing, China |
UICC, eUICCp |
|
GSMA PKIp |
– |
Sep 2021 |
|
|
Beijing Watchdata Co., Ltd. [1] |
Beijing, China |
UICC |
|
– |
– |
Jan 2021 |
|
|
Chutian Dragon Co., Ltd. [1] |
Dongguan, China |
UICC |
|
– |
|
Feb 2021 |
|
|
Eastcompeace Technology Co., Ltd [1] |
Zhuhai, China |
UICC, eUICCp |
|
GSMA PKIp |
|
Feb 2021 |
|
|
E-Kart [1] |
Istanbul, Turkey |
UICC, eUICCp |
|
GSMA PKIp |
– |
Jun 2021 |
|
|
FutureCard Industries LLC |
Sharjah, UAE |
UICC |
|
– |
|
Jun 2021 |
|
|
Gemalto Southern Africa (Pty) Ltd [1] |
Gauteng, South Africa |
– |
|
– |
– |
Sep 2021 |
|
Barcelona, Spain |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2021 |
|
|
|
Giesecke+Devrient (China) Technologies Co., Ltd. |
Nanchang, China |
UICC, eUICC |
|
GSMA PKI |
|
Jun 2021 |
|
|
Giesecke+Devrient Mobile Security Canada, Inc. [2] |
Markham, Canada |
UICCp, eUICCp |
– |
GSMA PKIp |
– |
Jan 2021 |
|
|
Giesecke & Devrient MS India Private Limited [2] |
Chennai, India |
UICC, eUICC |
– |
GSMA PKI |
– |
Feb 2022 |
|
|
Giesecke & Devrient Secure Data Management GmbH |
Neustadt, Germany |
UICC |
|
– |
|
Jul 2021 |
|
|
Giesecke y Devrient de Mexico S.A. de C.V. |
Tlalnepantla de Baz, Mexico |
UICC |
– |
– |
– |
Jan 2022 |
|
|
Hengbao Co., Ltd [1] |
Danyang, China |
UICC, eUICCp |
|
GSMA PKIp |
|
Dec 2021 |
|
|
HB Technologies Algiers |
Algiers, Algeria |
UICC |
|
– |
– |
Feb 2021 |
|
|
IDEMIA (Shenzhen) Technologies Company Limited [3] |
Shenzhen, China |
UICCp, eUICCp |
|
GSMA PKIp |
– |
Aug 2021 |
|
|
IDEMIA FRANCE SAS |
Vitré, France |
UICC, eUICC |
|
GSMA PKI |
|
Jan 2022 |
|
|
IDEMIA Germany GmbH |
Flintbek, Germany |
UICC, eUICC |
|
GSMA PKI |
|
Sep 2021 |
|
|
Idemia Syscom India Private Limited [1] |
Noida, India |
UICC |
|
– |
– |
Jan 2021 |
|
|
Infineon Technologies Dresden GmbH |
Dresden, Germany |
– |
|
– |
– |
Dec 2020 |
|
|
Inkript |
Beirut, Lebanon |
UICC |
|
– |
|
Mar 2021 |
|
|
JSC NovaCard |
Nizhny Novgorod, Russia |
UICC |
|
– |
– |
Dec 2021 |
|
London, UK |
UICCp, eUICCp |
– |
GSMA PKIp |
– |
Feb 2021 |
|
|
|
KONA M Co., Ltd. [1] |
Jincheon-Gun, South Korea |
UICC |
|
– |
|
Mar 2021 |
|
|
MK Smart Joint Stock Company |
Hanoi, Vietnam |
UICC |
|
– |
– |
Aug 2021 |
|
|
NXP Semiconductors Germany GmbH |
Hamburg, Germany |
UICC, eUICC |
– |
GSMA PKI |
– |
Oct 2021 |
|
|
NXP Semiconductors Kaohsiung |
Kaohsiung, Taiwan |
– |
|
– |
|
Oct 2021 |
|
|
PT. Chengtian Weiye Indonesia [1] |
Bekasi, Indonesia |
– |
|
– |
– |
Apr 2021 |
|
|
Samsung Electronics Co., Ltd. |
Yongin, South Korea |
– |
– |
– |
– |
Jan 2021 |
|
|
SecureID Limited |
Lagos, Nigeria |
– |
|
– |
– |
Dec 2020 |
|
|
Shanghai Chengtian Smart Card Co., Ltd |
Shanghai, China |
– |
|
– |
– |
Aug 2021 |
|
|
Shenzhen iGear Technology Inc |
Shenzhen, China |
– |
|
– |
– |
Jul 2021 |
|
|
Shenzhen Chengtian Weiye Technology Company Limited |
Shenzhen, China |
UICC |
|
– |
– |
Aug 2021 |
|
|
STMicroelectronics srl [1] |
Caserta, Italy |
UICC, eUICC |
|
GSMA PKI |
|
May 2021 |
|
|
STMicroelectronics [2] |
Rousset, France |
– |
|
– |
– |
Mar 2021 |
|
|
STMicroelectronics [2] |
Toa Payoh, Singapore |
– |
|
– |
– |
Jul 2021 |
|
|
TESNA Inc. [1] |
Pyeongtaek-si, South Korea |
– |
|
– |
– |
Mar 2021 |
|
|
Thales DIS Deutschland GmbH. [1] |
Filderstadt, Germany |
UICC |
|
– |
|
Nov 2020 |
|
|
Thales DIS France [1] |
Pont Audemer, France |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2021 |
|
|
Thales DIS Mexico S.A. de C.V. [1] |
Cuernavaca, Mexico |
UICC, eUICC |
|
GSMA PKI |
|
Aug 2021 |
|
|
Thales DIS (Shanghai) Co., Ltd. [1] |
Shanghai, China |
UICC, eUICC |
|
GSMA PKI |
– |
Dec 2021 |
|
|
Thales DIS Sp. z o. o [1] |
Tczew, Poland |
UICC |
|
– |
– |
Dec 2020 |
|
|
Thales DIS USA, Inc. [1] |
Montgomeryville, USA |
UICC, eUICC |
– |
GSMA PKI |
– |
Jun 2021 |
|
|
United Security Printing |
Abu Dhabi, UAE |
UICC |
|
– |
|
Dec 2021 |
|
|
Valid Card Manufacturing (Suzhou) Co., Ltd |
Suzhou, China |
UICC, eUICC |
|
Non-GSMA PKI |
|
Dec 2020 |
|
|
Valid Soluciones Tecnológicas S.A.U. |
Madrid, Spain |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2022 |
|
|
Workz Group Technology d.o.o. |
Gračanica, Bosnia & Herzegovina |
UICC |
|
– |
– |
Sep 2021 |
|
|
Workz Media FZ LLC [1] |
Dubai, United Arab Emirates |
UICC, eUICC |
|
GSMA PKI |
– |
Feb 2021 |
|
|
Wuhan Tianyu Information Industry Co., Ltd. [1] |
Wuhan, China (Lefeng Rd.) |
UICC, eUICCp |
|
GSMA PKIp |
|
Feb 2021 |
|
|
XH Smart Tech (China) Co., Ltd. |
Zhuhai, China |
UICC |
|
– |
– |
Jan 2021 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
[3] Certification for this site has been issued following a Remote Audit, which is a temporary measure implemented by GSMA while Covid-19 restrictions are in place. See details on individual certificates.
SAS for Subscription Management (SAS-SM)
The subscription management service provider and data centre operations and management sites in the table below are currently accredited.
Accreditation scope definitions are provided here.
Key to Symbols
| Symbol | Certification Type |
 |
Within scope (full certification; locally hosted) |
 |
Within scope (provisional certification; locally hosted *) |
 |
Within scope (full certification; cloud hosted/hosting) |
 |
Within scope (provisional certification; cloud hosted/hosting *) |
| – | Not carried out at this site |
* Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
SAS-SM Accredited sites.
Supplier |
Site |
Scope of Certification |
Valid to: |
Cert. |
||||
Secure Routing |
Data Preparation |
Data Preparation+ (ref. SGP.22) |
Data Centre Operations & Management |
Discovery Service |
||||
|
A1 Systems [3] |
Moscow, Russia |
|
|
|
|
– |
Mar 2021 |
|
|
Arm Inc. [2] |
Austin, USA |
|
|
– |
|
– |
Feb 2021 |
|
Noida, India |
|
|
|
|
– |
Nov 2022 |
|
|
|
Eastcompeace Technology Co., Ltd [3] |
Zhuhai, China |
|
|
|
|
– |
Feb 2022 |
|
Kista, Sweden |
– |
– |
|
|
– |
Jul 2021 |
|
|
|
Giesecke+Devrient Mobile Security Germany GmbH. |
Munich, Germany |
|
|
|
|
|
Apr 2021 |
|
|
Giesecke+Devrient (China) Technologies Co., Ltd. (Shanghai) [3] |
Shanghai, China |
|
|
|
|
|
Sep 2022 |
|
|
Giesecke & Devrient Mobile Security America, Inc. |
Atlanta, USA |
|
|
|
|
|
Mar 2021 |
|
|
Giesecke & Devrient Mobile Security Iberia, SAU [1] |
Barcelona, Spain |
|
|
|
|
|
Jun 2021 |
|
|
Hengbao Co., Ltd |
Danyang, China |
|
|
– |
|
– |
Dec 2020 |
|
|
IDEMIA America Corp. |
Sterling, U.S.A |
|
|
|
|
– |
Jan 2022 |
|
|
IDEMIA Technologies Romania S.R.L. [3] |
Bucharest, Romania |
|
|
|
|
– |
Jan 2022 |
|
|
Invigo Offshore SAL [1] |
Beirut, Lebanon |
|
|
|
|
|
Mar 2021 |
|
London, UK |
|
|
– |
|
– |
May 2021 |
|
|
|
Microsoft Corporation [3] |
Cloud region comprising sites PAR20, PAR21, PAR22, MRS20; France |
– |
– |
– |
|
– |
Jun 2021 |
|
|
Monty UK Global Ltd [3] |
London, UK |
– |
– |
|
|
– |
Apr 2021 |
|
Paris, France |
|
|
|
|
– |
Aug 2021 |
|
|
|
Protahub A.Ş. [1] |
Istanbul, Turkey |
|
|
|
|
– |
May 2021 |
|
|
Reliance Jio Infocomm Ltd |
Mumbai, India |
|
|
|
|
– |
Mar 2022 |
|
Riyadh, Saudi Arabia |
|
|
|
|
– |
Oct 2021 |
|
|
|
Telenor Group [1] |
Oslo, Norway |
|
|
|
|
– |
Jan 2021 |
|
|
Thales DIS France SA [1] |
Tours, France |
|
|
|
|
|
Jan 2021 |
|
|
Thales DIS (Shanghai) Co., Ltd. [1] |
Shanghai, China |
|
|
|
|
– |
Sep 2021 |
|
|
Thales DIS USA, Inc. |
Dallas, USA |
|
|
|
|
|
Mar 2021 |
|
|
Truphone Limited |
London, United Kingdom |
|
|
|
|
|
Dec 2021 |
|
|
Truphone Limited [3] |
Amsterdam, The Netherlands |
|
|
|
|
|
Sep 2021 |
|
|
VALID SOLUCIONES TECNOLÓGICAS S.A.U. [1] |
Madrid, Spain |
|
|
|
|
– |
Mar 2022 |
|
|
Valid USA Inc [1] |
Chicago, USA |
|
|
|
|
|
Jan 2021 |
|
Thane, India |
|
|
|
|
– |
Sep 2021 |
|
|
|
Workz Media FZ LLC [3] |
Dubai, United Arab Emirates |
|
|
|
|
– |
Jul 2021 |
|
|
Wuhan Tianyu Information Industry Co., Ltd. [3] |
Wuhan, China |
|
|
|
|
|
Nov 2021 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
[3] Certification for this site has been issued following a Remote Audit, which is a temporary measure implemented by GSMA while Covid-19 restrictions are in place. See details on individual certificates.
If you would like to receive an email when the list of accredited sites changes, please provide your details below: