// Standards
What Is eUICC and Remote SIM Provisioning?
If the eSIM is the headline, remote SIM provisioning (RSP) is the machinery that makes it work. It is the technology that lets a SIM download an operator profile over the air, switch networks without a physical swap, and be managed across thousands of devices from a single console. This article demystifies eUICC and RSP — including the GSMA standards SGP.02 and SGP.22 — without drowning you in jargon.
First, the vocabulary
eUICC is the reprogrammable chip (or software entity) that can hold multiple operator profiles. An eSIM is a device with an eUICC. A profile is the set of operator credentials — effectively “a SIM” delivered as software. Remote SIM provisioning is the secure process of downloading, enabling, disabling and deleting those profiles over the air. For the broader story, see the eSIM revolution, and for the practical trade-offs, eSIM vs physical SIM.
The two GSMA standards you will meet
SGP.02 — the M2M/IoT model
Designed for machines, SGP.02 uses a “push” model: a central system (the SM-SR/SM-DP) manages profiles on devices that have no screen or user. This is the standard behind industrial IoT, where a platform re-profiles a fleet of trackers or meters remotely. It is ideal when there is no human to scan a QR code.
SGP.22 — the consumer model
Designed for phones, tablets and wearables, SGP.22 uses a “pull” model: the user adds a plan by scanning a QR code or tapping in an app, and the device downloads the profile from an SM-DP+ server. This is what powers consumer eSIM and the travel-eSIM experience.
Both achieve the same magic — a SIM that changes in software — but they suit different worlds. A good provider supports the right one for your use case.
How a profile download actually works
In simplified terms: the device’s eUICC contacts a provisioning server, mutual authentication takes place using cryptographic keys baked into the eUICC, the encrypted profile is downloaded and installed, and it is then enabled. Security is end to end — profiles cannot be cloned or intercepted in transit — which is why eSIM is trusted by operators worldwide. These same security principles extend to the controls in our IoT SIM security guide.
Why RSP changes operations
- No field visits: change operator or fix a misconfigured device remotely.
- Localisation: push a local profile where permanent roaming is restricted.
- Lifecycle control: enable, disable and delete profiles as devices are deployed, paused or retired.
- Scale: manage thousands of profiles from one console rather than one device at a time.
This is exactly what the Extrafon Assets Management Platform provides — provisioning, steering and lifecycle management across a multi-network eSIM estate.
RSP and multi-network strategy
Remote provisioning is what makes a true multi-network approach practical: a device can carry a roaming profile for broad coverage and switch to a local profile where needed, all without anyone touching it. Combine RSP with tier-1 roaming and you get the best of both — reach and compliance.
What this means for selling connectivity
RSP also turns connectivity into a digital product. Because a consumer profile can be delivered instantly via QR code, businesses can sell data plans online and provision them in seconds — the foundation of the technology behind an eSIM store and the rise of new providers, as we discuss in the future of eSIM.
The bottom line
Remote SIM provisioning is the unglamorous engine of the eSIM era. Built on GSMA’s SGP.02 and SGP.22 standards, it lets profiles be downloaded, switched and managed securely over the air — for a single traveller’s phone or a million-device IoT fleet. Understand RSP and the rest of the eSIM world makes sense: it is simply connectivity that can be delivered, changed and retired in software, from anywhere.