Definition
eUICC (Embedded Universal Integrated Circuit Card) is a SIM chip standard that supports remote SIM provisioning (RSP) defined by GSMA specifications. The device comes pre-installed with an eUICC card. After reaching the target country, it can remotely download and activate the local carrier profile without physically changing the SIM, achieving 'manufactured once, deployed globally.'
eUICC supports storing multiple profiles and can switch between different operators. The RSP platform (such as GSMA SGP.02/SGP.22) is responsible for the lifecycle management of profiles including download, activation, and deletion. eUICC is related to the concept of eSIM; eSIM generally refers to consumer electronics, while eUICC focuses on IoT and industrial scenarios.
Technical Features
eUICC uses a Hardware Security Module (HSM) to protect keys and profiles, preventing tampering. It supports OTA updates, profile switching, and fault recovery. In cross-border scenarios, devices can switch operator profiles automatically or manually based on geographic location, cost, and network quality.
Use Cases
eUICC is a core technology for cross-border IoT connectivity in cross-border e-commerce, cross-border logistics, asset tracking, international automotive networking, and overseas smart hardware. Devices may move across multiple countries along with logistics; eUICC supports remote card writing and operator switching, avoiding the need to purchase multiple SIM cards in multiple countries, significantly reducing procurement and operational costs for multi-country deployment. SimtoLink covers over 200 countries and regions, supporting eUICC and RSP services.
Finishing Over-the-Air Provisioning with the Bootstrap Identity
What a profile download means on the card
For an IoT SIM service, an eUICC means the chip can hold several operator profiles and enable one of them by remote provisioning, without opening the device to swap a plastic card. At shipment the device often enables a bootstrap profile first. Its only job is to attach to some network after it arrives, so it can pull the local operator's operational profile from the provisioning platform. Once that profile is enabled, the external identity, the authentication parameters, and the billing relationship all switch to the new profile. The bootstrap profile can be kept for fallback, or disabled by policy.
The download itself consumes data on the bootstrap identity, and power must not drop in the middle. The profile carries key material. The secure domain inside the chip checks it. The module only provides the radio. A soldered card is not the same as "usable in the destination country." Until download and enablement finish, the device in that country may see only the bootstrap network, or it may not register at all. The switch is atomic. A restart halfway through can leave the device on neither the old profile nor the new one.
What the first attach in the destination country requires
The bootstrap identity must still be allowed to attach in the arrival country, the provisioning platform must be reachable from that network, and the device needs enough power and a stable antenna to finish one complete download. If a bulk export makes the bootstrap identity "factory test only, suspended at the border," the device loses its download path the moment it lands. The subscription scope of the local profile, whether it includes voice, and whether it may roam again, have to be signed for the service. Do not assume the bootstrap plan is inherited. Assets that travel back and forth need a decision in advance: keep two profiles and switch by country, or download again on each arrival.
After enablement the identity changes. If the asset ledger records only the identity from the factory, later suspension, resumption, and usage alarms cannot find the device. Operator rights on the provisioning platform, download counts, and failure rollback should be rehearsed before enablement, not tried for the first time after the cabinets have shipped.
The bootstrap identity is suspended after the switch
A common mistake is to cancel the bootstrap identity the moment the switch succeeds, then discover that the operational profile has the wrong APN or SMS center. The device can no longer return to the bootstrap identity and download again. Another is a mismatch between platform and chip: the platform says enabled, the chip is still on the bootstrap profile, and billing does not match connectivity. If the factory uses one bootstrap identity for a power-on test, and that test exhausts the bootstrap plan or trips risk control, the whole batch leaves the factory unable to start a download.
Copying a consumer scan-to-activate flow onto an unattended device also fails. Nobody on site can confirm a code, and the download request stays pending. Repeated enablement clicks on a weak network can create several unfinished profiles and fill the chip. Acceptance should record bootstrap attach, download progress, the new identity after enablement, and whether a deliberately wrong parameter can fall back to a profile that can still register.
Service parameters do not automatically become correct with the profile. The new operator profile solves attach and authentication. The APN name, the SMS center, and the addresses the device may visit may still have to be written again by the device or the platform. If firmware has those parameters fixed to the bootstrap-era values, the device still cannot reach the service network after a successful switch. It looks like a provisioning failure, but the identity has already changed. The sign that a switch is complete is a successful registration of the new identity and one application-level handshake from the service host, not merely an "enabled" flag on the provisioning platform. Fallback must return to a profile that can complete that handshake, not to a bootstrap identity that has radio and no service parameters. Downloads for a batch should be staggered. If hundreds of devices pull the same bootstrap plan in the same minute, they drag down the provisioning platform or the radio, while a single-device trial looks perfectly normal.