Multi-network SIMs and multi-IMSI

A SIM sold for use on many networks can work in two quite different ways. Knowing which one you have tells you how it behaves when a network fails or a device crosses a border.

Two kinds of multi-network SIM

• One identity, many roaming partners. The SIM carries one IMSI, the number that identifies the subscription to a network. Its home operator has roaming agreements with many networks, and the device roams on them. This is how most SIMs reach several countries.
• Several identities on one SIM. A multi-IMSI SIM holds a small program, called an applet, with a set of IMSIs from different operators. Only one is in use at a time. The applet swaps to another when its rules say so.

How a multi-IMSI SIM switches

The applet follows rules set by the SIM provider. Typical rules are these.

• The device has entered a new country, so use the IMSI meant for that country.
• Registration keeps failing, so try the next IMSI.
• A timer has run out without service, so try another IMSI.

After a swap, the device registers again under its new identity. That takes time and, for a battery device, energy. Within the active IMSI the device still picks a network by the normal selection rules.

The provider can change the list of IMSIs and the rules over the air, without anyone touching the device.

Still roaming in most places

Swapping IMSI does not make a device local. Most IMSIs on a multi-IMSI SIM belong to an operator in another country, so the device is roaming on that operator’s agreements. The rules on long-term roaming in the country where the device sits still apply. See permanent roaming rules by country.

How it differs from eSIM

An eUICC can hold several complete operator profiles and download new ones using the GSMA’s remote provisioning standards. Each profile is a full subscription with its own ICCID, and switching profiles restarts the SIM. A multi-IMSI SIM is one subscription from one provider, with identities swapped inside it. The two can be combined, because a profile on an eUICC can carry a multi-IMSI applet.

Why it matters

A multi-IMSI SIM can add routes onto networks and give a device a fallback when one route fails. It reaches only the networks its IMSIs have agreements with. Ask which IMSI a device will use in each country, and whether that IMSI is local there or roaming.

The identity a network sees

A network identifies a subscription by its IMSI. Under 3GPP TS 23.003 an IMSI has at most 15 digits: a 3-digit mobile country code (MCC), a 2- or 3-digit mobile network code (MNC) and the subscriber number (MSIN). A visited network uses the MCC and MNC to find the home network and asks it to authenticate the device. The USIM holds the IMSI in the file EF IMSI (TS 31.102), and the card holds the secret key that the home network uses to authenticate it.

So each IMSI is tied to one home network, its authentication data and its roaming agreements. Changing the IMSI changes all three.

Two designs

• Single IMSI. One IMSI, one home network. Coverage abroad comes from that operator’s roaming agreements, directly or through a roaming hub.
• Multi-IMSI. An applet on the SIM stores several IMSIs, each with its own credentials, and writes one at a time into the USIM. The extra IMSIs often come from sponsor operators. BEREC describes sponsored roaming as a dual IMSI solution where one IMSI range belongs to the sponsor network, so the end user has a second identity while roaming and can use all of the sponsor’s roaming agreements.

Only one IMSI is active at a time. The device registers with that IMSI and the other entries in the applet are idle.

How the applet works

There is no 3GPP or GSMA standard for the multi-IMSI applet itself. Each SIM vendor or provider writes its own. They are built on the standard card toolkit, ETSI TS 102 223 (Card Application Toolkit), with its 3GPP adaptation in TS 31.111. The toolkit gives the applet what it needs.

• Events. With SET UP EVENT LIST the applet asks the device to report the location status event. The device then sends an ENVELOPE (EVENT DOWNLOAD, Location status) when its service state or location information changes in idle mode. The status is normal service, limited service or no service (TS 102 223 clause 8.27). The location information carries the MCC and MNC of the serving cell.
• Local information. PROVIDE LOCAL INFORMATION reads the current location, access technology and network measurements on demand.
• Timers. TIMER MANAGEMENT runs timers on the card, for example to give up on an IMSI after a set time without normal service.
• Applying a change. The applet writes the new IMSI, and usually related files such as the network lists, then sends REFRESH. Modes such as NAA Initialization and Full File Change Notification or UICC Reset make the device read the USIM again and start a new registration. The mode matters: UICC Reset can restart some devices.

Typical rules look like this. The details, thresholds and order are set by each provider.

Signal strength is not a usual trigger. Within the active IMSI the device still chooses a network by TS 23.122, so steering by that IMSI’s home network and the network selection order apply as for any SIM.

Over-the-air updates

The provider manages the applet remotely, by SMS or a data bearer to the card, using the secured remote management defined by ETSI for UICC applications (ETSI TS 102 225 and TS 102 226, with 3GPP TS 31.115 and TS 31.116). It can add or remove IMSIs, change their order and change the switching rules without a site visit.

The cost of a switch

A switch is a new registration under a new identity. The device authenticates with a different home network, sets up a new data session and usually receives a new IP address, so open connections drop. Allow for this in retry and power budgets, and in any firewall rule that trusts a device’s address.

Still roaming in most places

In most countries the active IMSI belongs to an operator elsewhere, so the device is roaming on that operator’s agreements. The visited country’s rules on permanent roaming apply, and so do the sponsor’s contract terms. Industry members told BEREC that sponsored IMSI contracts often contain restrictions on permanent roaming. A device becomes a domestic subscriber only when it uses a local operator’s IMSI on that operator’s network. Support for LTE-M and NB-IoT also follows each IMSI’s own agreements, so a country can have LTE-M under one IMSI and not under another. See permanent roaming rules by country.

Multi-IMSI and eUICC profiles compared

The two can be combined. A profile on an eUICC can carry a multi-IMSI applet, and switching profiles then changes the whole set of IMSIs. See eSIM, eUICC and MFF2.

Practical points

• Ask which IMSI a device will use in each target country, and whether it is local or roaming there.
• Ask what triggers a switch, how long each timer is and whether the rules can be set per device or per group.
• Test how long a device takes to register after a switch, on the modules you use.
• Check LTE-M and NB-IoT roaming for the IMSI used in each country.