Covid-19 update
Due to the travel and workplace attendance restrictions caused by Covid-19, SAS audit teams continue to have difficulties in performing and planning on-site audits. GSMA and the SAS auditing companies have developed alternative options that some sites can pursue to gain or maintain certification, depending on which scheme they are participating in (SAS-UP, SAS-SM) and where they are in the certification process.
These options include:
- Temporary extensions of certification (following remote assessment) for sites seeking renewal of existing certification (for SAS-SM and SAS-UP)
- Remote audits (for SAS-SM initial, renewal and repeat audits)
- Hybrid audits (for SAS-UP renewal and repeat audits)
Certification for affected sites is highlighted with relevant notes in the tables below. In addition, some sites have declared to GSMA that they have temporarily implemented business continuity measures in response to Covid-19 that affects their compliance with SAS. Details are being reviewed with the SAS auditors to ensure that compensating controls are being applied. These sites are highlighted (with Note #2) in the tables below.
New SAS applicants or participating sites are invited to contact sas@gsma.com with any questions or to pursue the available options.
SAS for UICC Production (SAS-UP)
The Universal Integrated Circuit Card (UICC) production (SAS-UP) supplier sites in the table below are currently accredited.
Accreditation scope definitions are provided here.
Key to Entries
| Entry / Symbol | Certification Type | Scope |
| UICC | UICCP | Full | Provisional | Within scope (UICCs) |
| eUICC | eUICCP | Within scope (eUICCs) | |
| GSMA PKI | PKIP | Within scope (GSMA PKI certificates) | |
 |  |
Within scope (card form factor) | |
 |  |
Within scope (embedded form factor) | |
 |  |
Within scope (Wafer Level Chip Scale Packaging) | |
| - | N/A | Not carried out at this site |
P: Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
SAS-UP Accredited sites.
Supplier |
Site |
Certification Scope |
Valid to: |
Cert. |
|||
Generation of data for personalisation |
Personalisation |
Management of PKI certificates |
Post personalisation packaging |
||||
Ardentec Corporation |
Hsinchu, Taiwan |
- |
|
- |
- |
Nov 2020 |
|
Arm Ltd. [2] |
London, UK |
eUICCp, UICCp |
- |
GSMA PKIp |
- |
Aug 2020 |
|
Beautiful Card Corporation |
Taipei, Taiwan |
UICC |
|
- |
|
Jul 2021 |
|
Beijing Huahong IC Design Co., Ltd. |
Beijing, China |
UICC, eUICCp |
|
GSMA PKIp |
- |
Sep 2021 |
|
Beijing Watchdata Co., Ltd.[1] |
Beijing, China |
UICC |
|
- |
- |
Jan 2021 |
|
Chutian Dragon Co., Ltd. |
Dongguan, China |
UICC |
|
- |
|
Aug 2020 |
|
Eastcompeace Technology Co., Ltd [1] |
Zhuhai, China |
UICC, eUICCp |
|
GSMA PKIp |
|
Feb 2021 |
|
E-Kart [1] |
Istanbul, Turkey |
UICC, eUICCP |
|
GSMA PKIP |
|
Dec 2020 |
|
FutureCard Industries LLC |
Sharjah, UAE |
UICC |
|
- |
|
June 2021 |
|
Gemalto |
Pont Audemer, France |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2021 |
|
Gemalto Sp z o. o |
Tczew, Poland |
UICC |
|
- |
- |
Dec 2020 |
|
Gemalto Southern Africa (Pty) Ltd |
Gauteng, South Africa |
- |
|
- |
- |
Sep 2021 |
|
Barcelona, Spain |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2021 |
|
|
Giesecke+Devrient (China) Technologies Co., Ltd. |
Nanchang, China |
UICC, eUICC |
|
GSMA PKI |
|
Jun 2021 |
|
Giesecke+Devrient Mobile Security Canada, Inc. [2] |
Markham, Canada |
UICCp, eUICCp |
- |
GSMA PKIp |
- |
Jan 2021 |
|
Giesecke & Devrient MS India Private Limited [2] |
Chennai, India |
UICC, eUICC |
- |
GSMA PKI |
- |
Feb 2022 |
|
Giesecke & Devrient Secure Data Management GmbH |
Neustadt, Germany |
UICC |
|
- |
|
Jul 2021 |
|
Giesecke y Devrient de Mexico S.A. de C.V. |
Tlalnepantla de Baz, Mexico |
UICC |
- |
- |
- |
Jan 2022 |
|
Hengbao Co., Ltd |
Danyang, China |
UICC, eUICCp |
|
GSMA PKIp |
|
Dec 2021 |
|
HB Technologies Algiers |
Algiers, Algeria |
UICC |
|
- |
- |
Feb 2021 |
|
IDEMIA (Shenzhen) Technologies Company Limited [1] |
Shenzhen, China |
UICC, eUICC |
|
GSMA PKI |
- |
Oct 2020 |
|
IDEMIA FRANCE SAS |
Vitré, France |
UICC, eUICC |
|
GSMA PKI |
|
Jan 2022 |
|
IDEMIA Germany GmbH |
Flintbek, Germany |
UICC, eUICC |
|
GSMA PKI |
|
Sep 2021 |
|
Idemia Syscom India Private Limited [1] |
Noida, India |
UICC |
|
- |
- |
Jan 2021 |
|
Infineon Technologies Dresden GmbH |
Dresden, Germany |
- |
|
- |
- |
Dec 2020 |
|
Inkript |
Beirut, Lebanon |
UICC |
|
- |
|
Mar 2021 |
|
JSC NovaCard |
Nizhny Novgorod, Russia |
UICC |
|
- |
- |
Dec 2021 |
|
KONA M Co., Ltd. |
Jincheon-Gun, South Korea |
UICC |
|
- |
|
Sep 2020 |
|
MK Smart Joint Stock Company |
Hanoi, Vietnam |
UICC |
|
- |
- |
Aug 2021 |
|
NXP Semiconductors Germany GmbH |
Hamburg, Germany |
UICC, eUICC |
- |
GSMA PKI |
- |
Oct 2021 |
|
NXP Semiconductors Kaohsiung |
Kaohsiung, Taiwan |
- |
|
- |
|
Oct 2021 |
|
PT. Chengtian Weiye Indonesia |
Bekasi, Indonesia |
- |
|
- |
- |
Oct 2020 |
|
Samsung Electronics Co., Ltd. |
Yongin, South Korea |
Check certificate for scope. |
Jan 2021 |
|
|||
SecureID Limited |
Lagos, Nigeria |
- |
|
- |
- |
Dec 2020 |
|
Shanghai Chengtian Smart Card Co., Ltd |
Shanghai, China |
- |
|
- |
- |
Aug 2021 |
|
Shenzhen iGear Technology Inc |
Shenzhen, China |
- |
|
- |
- |
Jul 2021 |
|
Shenzhen Chengtian Weiye Technology Company Limited |
Shenzhen, China |
UICC |
|
- |
- |
Aug 2021 |
|
STMicroelectronics srl |
Caserta, Italy |
UICC, eUICC |
|
GSMA PKI |
|
Nov 2020 |
|
STMicroelectronics [2] |
Rousset, France |
- |
|
- |
- |
Mar 2021 |
|
STMicroelectronics [2] |
Toa Payoh, Singapore |
- |
|
- |
- |
Jul 2021 |
|
TESNA Inc. [1] |
Pyeongtaek-si, South Korea |
- |
|
- |
- |
Sep 2020 |
|
Thales DIS Deutschland GmbH. |
Filderstadt, Germany |
UICC |
|
- |
|
Nov 2020 |
|
Thales DIS Mexico S.A. de C.V. |
Cuernavaca, Mexico |
UICC, eUICC |
|
GSMA PKI |
|
Aug 2021 |
|
Thales DIS (Shanghai) Co., Ltd. |
Shanghai, China |
UICC, eUICC |
|
GSMA PKI |
- |
Dec 2021 |
|
Thales DIS USA, Inc. [1] |
Montgomeryville, USA |
UICC, eUICC |
- |
GSMA PKI |
- |
Dec 2020 |
|
United Security Printing |
Abu Dhabi, UAE |
UICC |
|
- |
|
Dec 2021 |
|
Valid Card Manufacturing (Suzhou) Co., Ltd |
Suzhou, China |
UICC, eUICC |
|
Non-GSMA PKI |
|
Dec 2020 |
|
Valid Soluciones Tecnológicas S.A.U. |
Madrid, Spain |
UICC, eUICC |
|
GSMA PKI |
|
Apr 2022 |
|
Workz Group Technology d.o.o. |
Gračanica, Bosnia & Herzegovina |
UICC |
|
- |
- |
Sep 2021 |
|
Workz Media FZ LLC |
Dubai, United Arab Emirates |
UICC, eUICC |
|
GSMA PKI |
- |
Aug 2020 |
|
Wuhan Tianyu Information Industry Co., Ltd. |
Wuhan, China (Huazhong Univ. Pk.) |
UICC |
|
- |
|
Oct 2020 |
|
Wuhan Tianyu Information Industry Co., Ltd. |
Wuhan, China (Lefeng Rd.) |
UICC, eUICCp |
|
GSMA PKIp |
|
Aug 2020 |
|
XH Smart Tech (China) Co., Ltd. |
Zhuhai, China |
UICC |
|
- |
- |
Jan 2021 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
SAS for Subscription Management (SAS-SM)
The subscription management service provider and data centre operations and management sites in the table below are currently accredited.
Accreditation scope definitions are provided here.
Key to Symbols
| Symbol | Certification Type |
 |
Within scope (full certification; locally hosted) |
 |
Within scope (provisional certification; locally hosted *) |
 |
Within scope (full certification; cloud hosted/hosting) |
 |
Within scope (provisional certification; cloud hosted/hosting *) |
| - | Not carried out at this site |
* Provisional certification: The site has a complete set of operational systems, processes and controls in place in all areas of the relevant SAS Standard, and has demonstrated compliance with the security requirements defined in the Standard in the absence of live production. Full certification will be awarded after a successful SAS audit of live production.
SAS-SM Accredited sites.
Supplier |
Site |
Scope of Certification |
Valid to: |
Cert. |
||||
Secure Routing |
Data Preparation |
Data Preparation+ (ref. SGP.22) |
Data Centre Operations & Management |
Discovery Service |
||||
A1 Systems [3] |
Moscow, Russia |
|
|
|
|
- |
Mar 2021 |
|
Arm Inc. [2] |
Austin, USA |
|
|
- |
|
- |
Feb 2021 |
|
London, UK |
|
|
- |
|
- |
Nov 2020 |
|
|
Bharti Airtel Ltd[1] |
Noida, India |
|
|
|
|
- |
Nov 2020 |
|
Eastcompeace Technology Co., Ltd |
Zhuhai, China |
|
|
|
|
- |
Feb 2022 |
|
Kista, Sweden |
- |
- |
|
|
- |
Jul 2021 |
|
|
Giesecke & Devrient Professional Services GmbH |
Munich, Germany |
|
|
|
|
|
Apr 2021 |
|
Giesecke+Devrient (China) Technologies Co., Ltd. (Shanghai) [1] |
Shanghai, China |
|
|
|
|
|
Sep 2020 |
|
Giesecke & Devrient Mobile Security America, Inc. |
Atlanta, USA |
|
|
|
|
|
Mar 2021 |
|
Giesecke & Devrient Mobile Security Iberia, SAU |
Barcelona, Spain |
|
|
|
|
|
Mar 2021 |
|
Hengbao Co., Ltd |
Danyang, China |
|
|
- |
|
- |
Dec 2020 |
|
IDEMIA America Corp. |
Sterling, U.S.A |
|
|
|
|
- |
Jan 2022 |
|
IDEMIA Technologies Romania S.R.L. |
Bucharest, Romania |
|
|
|
|
- |
Jan 2022 |
|
Invigo Offshore SAL |
Beirut, Lebanon |
|
|
|
|
|
Sep 2020 |
|
Microsoft Corporation [3] |
Cloud region comprising sites PAR20, PAR21, PAR22, MRS20; France |
- |
- |
- |
|
- |
Jun 2021 |
|
Monty UK Global Ltd [3] |
London, UK |
- |
- |
|
|
- |
Apr 2021 |
|
Oasis Smart Sim Europe SAS |
Paris, France |
|
|
- |
|
- |
Nov 2020 |
|
Protahub A.Ş. |
Istanbul, Turkey |
|
|
|
|
- |
Nov 2020 |
|
Reliance Jio Infocomm Ltd |
Mumbai, India |
|
|
|
|
- |
Mar 2022 |
|
Saudi Telecom Company [2] |
Riyadh, Saudi Arabia |
- |
- |
|
|
- |
Oct 2020 |
|
Telenor Group [1] |
Oslo, Norway |
|
|
|
|
- |
Jan 2021 |
|
Thales DIS France SA[1] |
Tours, France |
|
|
|
|
|
Jan 2021 |
|
Thales DIS (Shanghai) Co., Ltd. |
Shanghai, China |
|
|
|
|
- |
Sep 2021 |
|
Thales DIS USA, Inc. |
Dallas, USA |
|
|
|
|
|
Mar 2021 |
|
Truphone Limited |
London, United Kingdom |
|
|
|
|
|
Dec 2021 |
|
Truphone Limited |
Amsterdam, The Netherlands |
|
|
|
|
|
Sep 2020 |
|
Valid Spain |
Madrid, Spain |
|
|
|
|
- |
Mar 2022 |
|
Valid USA Inc [1] |
Chicago, USA |
|
|
|
|
|
Jan 2021 |
|
Vodafone Idea Limited NDC3 |
Thane, India |
|
|
|
|
- |
Sep 2020 |
|
Workz Media FZ LLC |
Dubai, United Arab Emirates |
|
|
- |
|
- |
Jul 2021 |
|
Notes:
[1] Renewal of SAS certification for this site is delayed due to Covid-19 related restrictions. Some or all aspects of this site’s certification that would normally expire have been temporarily extended due to these exceptional circumstances. An audit to reconfirm the site’s SAS-compliance in the relevant areas will be scheduled as soon as possible once restrictions are lifted.
[2] The site has declared to GSMA that it has temporarily implemented business continuity measures in response to Covid-19 that affects its compliance with SAS. See details on individual certificates. Interested parties are invited to contact the site directly for more details.
[3] Certification for this site has been issued following a Remote Audit, which is a temporary measure implemented by GSMA while Covid-19 restrictions are in place. See details on individual certificates.
If you would like to receive an email when the list of accredited sites changes, please provide your details below: