SM-DP+ Certificate Custody in MVNO Operations

Certificate controls in eSIM RSP operations are often treated as a security workstream until a profile release is disputed, a tenant exits, or an SM-DP+ credential requires emergency rotation. The commercial issue is SM-DP+ certificate custody: it establishes which party can authorise profile issuance, preserve audit evidence, and absorb the financial consequences of an unauthorised or unavailable release path across a multi-tenant estate.

Certificate custody is a wholesale-control question

Certificate governance belongs in the host agreement and wholesale schedule, not solely in an implementation annex. The contract should distinguish legal ownership, physical or logical custody of private keys, and delegated authority to approve profile release. Those rights may sit with different parties. An MNO may own the certificate domain, an MVNE may operate the release workflow, and an MVNO may originate the order. Treating those roles as equivalent leaves the liability chain incomplete.

A host retaining root control can protect its numbering assets, IMSI ranges and profile-policy exposure. That control still carries a service obligation. Where a tenant has a time-sensitive release requirement, the host must define approval coverage, authorised contacts, cut-off times and emergency escalation. Without those commitments, retained control can become an unpriced constraint on activation revenue. The host controls the credential, while the tenant bears the commercial effect of delay.

The MVNE should not rely on pooled administrative credentials across tenants, even when several brands share one platform instance. Tenant-specific roles, approval records and release logs are necessary to show who requested, authorised and executed each action. Pooled access weakens incident attribution. It also complicates a tenant exit because the operator may be unable to revoke one party’s authority without changing access for others. Platform consolidation can reduce operating cost, but it should not collapse the contractual separation between tenants.

Revenue-share agreements should classify a failed, delayed or wrongly issued profile before the first incident occurs. The event may be a host-platform failure, an MVNE operating error or an MVNO-originated order defect. Each classification should map to evidence standards, settlement treatment and remediation cost. The same boundary should remain consistent across BSS/OSS order ownership, MNP handling and customer-support obligations. A party should not control the release decision while disclaiming the operational record required to settle it.

Profile-release controls affect churn, settlement and exit economics

A controlled release path separates order acceptance, profile generation, release approval and exception handling. The separation matters most where the MVNE also provides fulfilment or customer care, because one supplier may otherwise create the order, approve the release and classify the resulting incident. Contracts should identify the system of record at each stage and state which timestamp governs performance. The commercial clock may start at a valid order, at profile generation or only after approval evidence is complete. That distinction changes reported compliance and service-credit exposure.

Release commitments need measurable windows rather than broad availability language. A workable SLA covers normal approval periods, daily cut-offs, emergency-access rules, failed-download remediation and escalation ownership. It should also define exclusions for incomplete or conflicting order data. A platform can remain technically available while profiles accumulate in an approval queue. Infrastructure uptime alone therefore says little about activation conversion. For settlement purposes, the relevant measure is whether an eligible profile reached a releasable state within the contracted window.

Delay has an immediate revenue effect. An abandoned activation can write off acquisition spend, profile inventory cost and fulfilment expense before recurring revenue begins. A completed activation that requires repeated support contacts can also increase early-life churn. The agreement should state which losses are recoverable and which remain ordinary commercial risk. Direct remediation costs are easier to evidence than projected lifetime margin, so parties often cap recovery through service credits. If that approach is used, the credit threshold should reflect the economics of failed activations rather than a nominal percentage of the platform fee.

Tier-2 MNO, Southeast Asia, ~18M subscribers reviewed an MVNE arrangement in which delegated release access had been priced as a standard platform feature. The host nevertheless retained all remediation liability for erroneous profile issuance, including investigation, replacement and customer support. The revised term sheet separated release authority from incident cost allocation. It introduced monthly exception reporting, named approval roles and a cost schedule for avoidable reissuance. The change did not remove delegated access. It priced the control boundary and gave finance teams evidence to reconcile profile incidents against wholesale invoices.

Suspension and revocation require a clear hierarchy. Fraud, credential compromise and regulatory intervention may justify immediate host action. Commercial arrears and settlement disputes should normally follow notice, cure and escalation periods. Termination provisions must then address unused profile inventory, in-flight downloads, profile migration, certificate rotation and final support. If profiles remain technically valid after the commercial relationship ends, the contract should specify whether they may be retained, disabled or transferred, and which party funds the final reconciliation.

Price governance as an operating control, not a compliance add-on

Certificate governance creates identifiable costs across the full tenant lifecycle. Issuance, managed key custody, routine rotation, emergency replacement, audit extraction and post-termination retention should appear in the wholesale schedule. Where a HSM or managed custody service supports several tenants, allocation should follow controlled roles or certificate domains rather than profile volume alone. A low-volume tenant with bespoke approvals and extensive audit requirements may consume more control capacity than a high-volume tenant using standard policy.

Service credits should attach to demonstrable control failures. Examples include an unauthorised release, a missed approval window, an unavailable emergency role or incomplete audit evidence. They should not apply automatically where the MVNO supplied invalid order data or where a regulatory hold prevented release. This distinction protects settlement discipline. It also prevents a general availability metric from masking failures in the specific workflow that generates activation revenue.

Certificate issuance and renewal

One-off or annual charge; assign to the legal certificate owner and state whether it is recoverable through tenant onboarding fees.

Key custody and privileged access

Recurring platform cost; price by tenant, certificate domain or controlled access role, not solely by profile volume.

Profile-release SLA

Define standard and exception windows, evidence requirements, service-credit threshold and exclusions for MVNO order-quality failures.

Emergency rotation

Pre-agreed incident rate card and approval authority; distinguish compromised-key events from scheduled cryptographic maintenance.

Tenant exit and audit retention

Specify profile disposition, log-retention period, certificate revocation process and the party funding final reconciliation.

The governance pack should be recurring and settlement-ready. At minimum, it should report certificate inventory, authorised operators, privileged-access changes, release exceptions, revoked credentials and tenant-level profile balances. Monthly reporting supports invoice reconciliation. Quarterly reviews should test whether the commercial model still covers the control burden as markets, IMSI ranges, profile volumes and support responsibilities expand. A tenant entering a second jurisdiction may add approval and retention requirements without producing an equivalent increase in near-term volume.

Incident cost allocation also needs a pre-agreed waterfall. The sequence should cover containment, forensic review, profile replacement, customer communications, credit exposure and regulatory engagement. Caps and exclusions can remain, but the agreement should establish who authorises each workstream and how third-party costs are approved. Otherwise, the party controlling emergency action can commit expenditure that another party is later expected to absorb. That structure invites settlement disputes at the point when operational attention should remain on containment.

As eSIM estates become more multi-tenant, certificate governance will move from a security annex into the core economics of the host agreement. MNOs and MVNEs that price custody, release authority and incident recovery explicitly will protect settlement discipline while reducing avoidable activation and churn exposure. The objective is not to centralise every control. It is to ensure that each right, obligation and cost follows the party able to exercise or mitigate it.