Are SRRC and CCC enough to put a cellular product on the air in mainland China?

No. SRRC issues the radio type approval (CMIIT ID) and CCC covers electrical safety and EMC. Neither guarantees attachment on a commercial network. Each of the three national operators (China Mobile, China Telecom, China Unicom) requires its own network acceptance: validation of the bands actually deployed, of the 5G NSA and SA profiles, of IMS behaviour, and inscription of the IMEI in the authorised-equipment database. Without that acceptance the module rarely attaches durably, or is filtered out during periodic clean-ups.

What differentiates the three operator programmes?

All three operators share an acceptance logic based on bands, 3GPP profiles and IoT platform, but they do not cover the same commercial footprint. China Mobile (CMCC) is the largest by subscriber base and runs the OneNET IoT platform. China Telecom has a strong NB-IoT presence and operates CTWing. China Unicom combines NB-IoT, LTE-M and 5G with its Lianhe IoT platform. Band allocations, preferred profiles and APN conventions differ: the same module does not behave identically across the three networks.

Which cellular modules are pre-approved by Chinese operators?

The major Chinese vendors (Quectel, Fibocom, China Mobile ML302, ZTE, Sunsea AIoT/SIMCom) maintain per-operator pre-approved references. Choosing a module already on an operator's list substantially reduces acceptance duration and cost: the integrator remains responsible for device-level validation (antennas, power supply, thermals, application firmware), but the module radio layer is already qualified on the operator's bands.

Are Chinese cellular bands compatible with a global module?

Partially. Band n78 (3.5 GHz) is widely deployed and common with other regions. Band n41 TDD is used by China Mobile, while n28 (700 MHz) is used by China Telecom and China Unicom. NB-IoT sub-bands use refarmed 700 and 900 MHz allocations. A global module covering n78, n41, n28 and the Chinese NB-IoT bands may be workable, but the power table and the firmware must be tailored to the MIIT plan and to each target operator's actual allocation.

How does eUICC for IoT work in mainland China?

eSIM for IoT in mainland China follows stricter rules than in Europe or North America. Profiles must be provisioned by an authorised Chinese operator. The three operators maintain their own SM-DP+ servers for IoT eUICC, and cross-border use of a foreign profile is not automatic. The consumer segment has historically been more constrained than industrial IoT. Any eUICC deployment in China must be aligned upstream with the target operator, before module choice.

What are the most frequent reasons for activation rejection?

Four causes dominate: APN misconfiguration (each operator has its own official APNs, generic or IoT-specific), IMEI not inscribed in the target operator's base, eUICC profile provisioned for the wrong operator, and a band or 5G profile (NSA, SA) configuration mismatched with the local allocation. None of these are detected by SRRC or CCC, which do not test network attachment.

Does operator acceptance need to be redone on every firmware revision?

Any modification of the cellular stack, the module firmware, the power table, the antennas or IMS behaviour typically triggers a review. Chinese operators follow a delta logic similar to North American operators: a minor application change may go through a lightweight review, while any change affecting the radio or the provisioning path requires a fresh test session and an updated IMEI range.

Does acceptance from one operator carry over to the others?

No. Each operator issues its own acceptance, runs its own approved-module list, its own recognised labs and its own IMEI catalogue. A product accepted on China Mobile is not automatically accepted on China Telecom or China Unicom. For a product targeting nationwide coverage, the three processes run in parallel after SRRC and CCC have been secured.

China Mobile, Telecom, Unicom: cellular IoT acceptance

Author Hugues Orgitello Last updated 27 May 2026 ~13 min read

Guide · Chinese cellular operators

Putting a cellular IoT product on the air in mainland China requires three layers of authorisation, only the first two of which are regulatory. SRRC, under MIIT, issues radio type approval (CMIIT ID). CCC, under SAMR, covers electrical safety and EMC. Neither mark is sufficient to make a module attach durably to a commercial network. A third layer, contractual rather than statutory, gates effective activation: acceptance by one of the three national operators, China Mobile (中国移动), China Telecom (中国电信) and China Unicom (中国联通), which together carry the entirety of the mainland cellular market. This page describes the articulation between regulator and operator, the commercial footprint of the three carriers, the bands actually deployed, the leverage of pre-approved modules, the eUICC rules specific to China, and the most frequent rejection causes at activation.

Regulator and operator, two distinct logics

The most common framing error among European and North American product teams is to treat China as a single window. The Chinese cellular market in fact stacks three successive layers, executed in this order, none of which substitutes for another.

The first layer is the SRRC / CMIIT ID radio type approval issued by MIIT (Ministry of Industry and Information Technology). It covers spectral occupancy, power and harmonics on the sub-bands opened by MIIT notifications. Without it, the product cannot be imported or placed on the market. See the dedicated guide SRRC / CMIIT, mainland China radio for the detailed mechanism, the CMIIT ID format and the role of the local representative.

The second layer is CCC (China Compulsory Certification, 3C mark), administered by CNCA under SAMR, covering electrical safety and EMC outside radio. See CCC / 3C, China product safety and EMC for the scope, the applicable GB standards and the procedure.

The third layer is operator acceptance. It is not the regulator's remit but the carriers'. Each of the three national operators imposes its own network qualification on any module or cellular product seeking durable attachment to its infrastructure. This qualification validates the bands actually deployed by the operator, the supported 3GPP profiles, IMS behaviour, eUICC provisioning, and gates inscription of the IMEI in the authorised-equipment base.

Layered scheme, cellular authorisation in mainland China

Layer	Authority	Scope	Product identifier	Consequence if missing
1. Radio (SRRC)	MIIT, regulator	Bands, power, spectral occupancy	CMIIT ID	Customs seizure, commercial withdrawal
2. Safety + EMC (CCC)	CNCA under SAMR	Electrical safety, EMC outside radio	CCC number + 3C logo	Import block, distributor sanctions
3. Network acceptance	Operator (CMCC, CT, CU), contractual	Attach, deployed bands, IMS, eUICC, 5G profiles	IMEI inscribed in operator base	Activation refused, SIM blocked

Layers 1 and 2 are statutory: their absence is sanctioned under Chinese law. Layer 3 is contractual: its absence does not expose to a fine, but the product simply does not work on the target network. For a cellular IoT product sold in mainland China, all three layers are in practice necessary.

The three national operators, comparative footprint

The Chinese cellular market is divided between three national operators. No consumer MVNO carries significant weight today, and the entirety of the commercial cellular network passes through one of these three infrastructures.

China Mobile (CMCC, 中国移动)

China Mobile is the largest of the three by mobile subscriber count and by connected-device estate. Historically anchored on TD-LTE, the operator has built a dense 5G footprint on band n78 (3.5 GHz) and makes intensive use of band n41 TDD. On the IoT side, its OneNET platform (open.iot.10086.cn) provides connectivity, device management and data-integration layers for vertical solutions.

CMCC also operates the China Mobile IoT Open Platform, which formalises module integration and device certification. The China Mobile pre-approved module list is published and maintained; in practice it drives module selection on the integrator side.

China Telecom (CT, 中国电信)

China Telecom historically ran CDMA2000, then transitioned to LTE and 5G. The operator was an early and heavy investor in NB-IoT on sub-GHz, and retains a strong presence in industrial IoT and smart metering. Its operator IoT platform is CTWing (ctwing.cn). On 5G, China Telecom and China Unicom share part of the n78 deployment under a co-build and access-network sharing arrangement.

China Telecom acceptance emphasises NB-IoT conformance (coverage enhancement levels, PSM and eDRX behaviour, multi-cell attach) and LTE Cat-1 / Cat-1 bis stability for industrial applications.

China Unicom (CU, 中国联通)

China Unicom is the third operator by size and historically ran WCDMA and then LTE FDD. Like China Telecom, it has deployed NB-IoT on sub-GHz and shares part of the 5G n78 infrastructure with CT. China Unicom also has presence on LTE-M (Cat-M1) for industrial segments. Its operator IoT platform is Lianhe IoT (iot.10010.com).

China Unicom acceptance covers similar technical registers to China Telecom (NB-IoT, Cat-1, Cat-M, 5G), with its own APN conventions and its own recognised laboratories.

Comparative scope table

Criterion	China Mobile (CMCC)	China Telecom (CT)	China Unicom (CU)
Operator IoT platform	OneNET	CTWing	Lianhe IoT
5G mid-band predominant	n78 (3.5 GHz), n41 TDD	n78 (3.5 GHz), shared with CU	n78 (3.5 GHz), shared with CT
5G sub-GHz / refarming	n28 (700 MHz) depending on area	n28 (700 MHz)	n28 (700 MHz)
NB-IoT sub-GHz	900 MHz refarmed	800 / 900 MHz refarmed	900 MHz refarmed
LTE-M (Cat-M)	Limited deployment	Limited	More active on selected segments
NB-IoT priority	High, sensor estate	Very high, historical metering	High, industrial estate
Acceptance identifier	IMEI inscribed in CMCC base	IMEI inscribed in CT base	IMEI inscribed in CU base

This page deliberately avoids exact figures (subscribers, IoT estate, market share): operator communications, MIIT regulator releases and industry analyst counts do not converge, and an integration guide should not arbitrate between them. The operational conclusion does not depend on those figures: a product targeting full nationwide coverage must run the three acceptance processes in parallel.

Chinese cellular bands, effective plan

Chinese cellular allocations differ from European and North American plans on three axes: 5G mid-band concentrated on n78, band n41 TDD heavily used by China Mobile, and NB-IoT sub-GHz on specific refarmed sub-bands.

3GPP band	Frequency	Operators deploying	Typical use in China
n78	3.3 - 3.8 GHz TDD	CMCC, CT, CU	5G mid-band, primary national deployment
n41	2.5 GHz TDD	CMCC (predominant)	5G and LTE TDD, urban capacity
n79	4.8 - 4.9 GHz TDD	CMCC	5G capacity complement
n28	700 MHz FDD	CT, CU (subject to refarming)	5G sub-GHz, extended coverage
B3	1800 MHz FDD	CU, CT	LTE FDD
B5	850 MHz FDD	CU, CT (refarming)	LTE FDD sub-GHz
B8	900 MHz FDD	CMCC, CT, CU (refarming)	NB-IoT, low-rate LTE
B34, B39, B40, B41	TDD	CMCC	Historical LTE TDD
NB-IoT 900 MHz	refarmed B8	CMCC, CT, CU	Sub-GHz NB-IoT
NB-IoT 800 MHz	refarmed	CT (predominant)	Industrial NB-IoT and metering

The effective plan evolves through successive MIIT notifications, in line with refarming programmes and 5G SA rollout. For a project under specification, the useful band table always depends on the target operator and the deployment area. Rule of thumb: a global multi-band module is rarely optimal for the Chinese market; a module marketed by a Chinese vendor on the target operator's pre-approved list delivers coverage and attach-stability gains hard to obtain otherwise.

Pre-approved cellular modules, the industrialisation lever

The Chinese cellular module market is dominated by a handful of Chinese vendors, several of which maintain close working relationships with the three national operators. Choosing a module already pre-approved on the target operator is the single most structuring decision of an acceptance programme.

Main vendors

Quectel (Shanghai): broad portfolio of LTE Cat-1 / Cat-4 / Cat-M / NB-IoT and 5G modules, frequent presence on all three operators' pre-approved lists;
Fibocom (Shenzhen): consumer and industrial LTE and 5G modules, presence across the three operators;
China Mobile (module subsidiary, ML302 family and derivatives): modules designed in direct alignment with the CMCC infrastructure, naturally pre-approved on CMCC;
ZTE (Shenzhen): industrial cellular and 5G modules, historical operator partnerships;
Sunsea AIoT / SIMCom (Shanghai): LTE and NB-IoT modules widely deployed in the Chinese industrial segment;
MeiG Smart Technology, Neoway, Lierda: other vendors present mainly on NB-IoT and LTE-M segments.

Operational gain from a pre-approved module

With a module already pre-approved on the target operator:

the module radio layer is already qualified on the bands actually deployed;
the power table and cellular firmware have been validated in an operator-recognised lab;
IMS behaviour (for modules supporting VoLTE) has already been reviewed;
eUICC provisioning is aligned with the operator's SM-DP+ when the module supports eSIM.

The integrator's residual work then focuses on device-level acceptance: integrated antennas, power supply, thermal management, application firmware, network behaviour under real-world conditions. This module + device structure is analogous to the North American side (see PTCRB for the general mechanism, which sits on top of AT&T, Verizon and T-Mobile operator acceptance).

Conversely, a module not pre-approved by the target operator forces a full module qualification before the device qualification, lengthening the calendar and raising the risk of returns on the power table and on attach stability.

eUICC for IoT in mainland China

eSIM for IoT in mainland China operates under a more restrictive framework than in most other jurisdictions. Three principles structure practice.

Principle 1: the profile must be provisioned by an authorised Chinese operator. The three national operators each maintain their own SM-DP+ for IoT eUICC, and their own profile catalogues. A foreign profile downloaded from an SM-DP+ located outside China does not attach to a mainland cell without a specific roaming arrangement and cannot be treated as a local connectivity solution.

Principle 2: the industrial IoT perimeter is more open than the consumer perimeter. The GSMA SGP.32 specifications, dedicated to IoT, are better framed for industrial deployments with prior operator agreement. For the consumer segment, the historical pattern in mainland China has been more constrained than in other regions, with usage and provisioning restrictions that evolve through regulator notifications and operator policy.

Principle 3: operator acceptance explicitly covers the LPA and the SM-DP+. Acceptance is not limited to radio testing: it validates that the LPA (Local Profile Assistant), embedded in or external to the device, behaves correctly against the operator's SM-DP+, that it downloads, enables, disables and deletes profiles in accordance with the GSMA SGP.22 and SGP.32 specifications. A non-conforming LPA, or an eUICC not on the operator's accepted list, is a recurring rejection cause.

For any project integrating eSIM in mainland China, upstream alignment with the target operator, before module and eUICC vendor selection, is not optional.

Network activation conditions and provisioning

Once SRRC, CCC and operator acceptance have been secured, effective activation on the target network still depends on several configuration items being correctly set on both operator and product sides.

HSS / HLR provisioning on the operator side

The product's IMEI must be inscribed in the operator's authorised-equipment base (HSS, Home Subscriber Server for 4G and 5G; legacy HLR). This inscription is performed by the operator at the close of the acceptance process, on an IMEI range supplied by the manufacturer. Any IMEI outside the range is treated as unauthorised, either filtered immediately or removed during a periodic clean-up.

APN configuration

Each operator publishes one or several official APNs according to service profile:

CMCC: generic APNs (cmnet, cmwap) and dedicated IoT APNs for OneNET and machine plans;
CT: generic APNs (ctnet, ctlte, etc.) and dedicated CTWing APNs for IoT;
CU: generic APNs (3gnet, etc.) and dedicated Lianhe IoT and IoT-plan APNs.

The APN must be configured on the device consistently with the subscribed plan. A generic APN configured on an IoT plan, or the reverse, leads to attach refusal or to data-routing absence despite a successful attach.

IMEI whitelisting and SIM / IMEI binding

Some operator offerings, particularly in industrial IoT, bind the SIM to a declared IMEI or IMEI range. Any module change or SIM swap outside the declared range triggers a protection: the SIM is deactivated until regularised on the operator side. This protection is useful against fraud, but must be documented in the product's after-sales procedure; otherwise a field module replacement halts service.

5G NSA and SA profiles

Chinese 5G deployment still combines NSA and SA depending on area and operator. The 5G profile supported by the module and enabled on the device must be consistent with the target cell. A wrong NSA / SA profile configuration can produce unstable behaviour (camping on LTE while a 5G SA cell is available, or failed 5G NSA attach attempts on a pure SA cell).

Operator-recognised labs and articulation with North American programmes

Acceptance testing is performed in labs recognised by the target operator. Labs recognised for SRRC are not automatically recognised for operator acceptance; each operator publishes or communicates its own list, sometimes by invitation. The most active labs are of Chinese origin; international labs (Bureau Veritas, DEKRA, Element, Sporton) have variable local presence. For a foreign manufacturer, the most efficient channel to identify the right lab is through the vendor of the pre-approved module, who knows the labs that qualified its module and their operator-side contacts.

The Chinese stack (SRRC + CCC + operator acceptance) bears a conceptual analogy with the North American stack (FCC + PTCRB + operator acceptance), but none of it transfers. A module already qualified through PTCRB and accepted by AT&T, Verizon or T-Mobile should be treated as wholly new for China: the radio layer is tested differently (bands, MIIT plan), safety + EMC flows through CCC, and operator acceptance is replayed from scratch on CMCC, CT or CU.

Procedure, step by step

Without committing to a specific calendar, the typical sequencing is as follows.

Frame the target coverage: single operator or all three, geographic area, technologies (NB-IoT, LTE Cat-1, LTE Cat-M, 5G NSA, 5G SA).
Select a cellular module pre-approved on the target operator from a Chinese vendor, explicitly verifying the module's presence on the pre-approved list at the project's start date.
Designate a local representative registered with MIIT for SRRC and a CCC agent for the 3C mark. See SRRC / CMIIT, mainland China radio and CCC / 3C.
Run SRRC on the full product radio and CCC in parallel on safety and EMC outside radio.
Open the acceptance dossier with the target operator (CMCC, CT or CU), using a lab recognised by the operator, typically on the recommendation of the pre-approved module's vendor.
Align eUICC choices with the operator (target SM-DP+, LPA, profile catalogue, SIM / IMEI binding) before final selection of the module and the eUICC vendor.
Run the acceptance tests: attach, band behaviour, 5G NSA / SA profiles, IMS, eUICC, application behaviour on the target APNs. Obtain IMEI inscription in the operator's base (HSS).
Repeat for the other operators if target coverage includes CT, CU in addition to CMCC (or any combination): the work is not poolable, each process is autonomous.
Maintain the acceptance: change management on hardware and firmware, tracking of MIIT notifications and operator requirements (5G SA rollouts, 2G / 3G sunsets, sub-GHz refarming).

Common pitfalls

Pitfall	Consequence
Assuming SRRC + CCC are enough to activate a cellular product	The product works on the bench but does not attach durably on commercial networks
Selecting a global module not present on the target operator's pre-approved list	Full module + device acceptance cycle, longer calendar, risk on power table and attach
Configuring a generic APN for an IoT service, or the reverse	Successful attach but no data routing, or service refusal depending on the plan
Provisioning an eUICC profile on the wrong operator	No attach on the target cell, after-sales service blocked
Neglecting IMEI inscription in the operator's base	Immediate or periodic filtering, durable SIM block
Treating the three operators as technically equivalent	Bands, 5G NSA / SA profiles and APN requirements differ; configuration must be per operator
Reusing without review a PTCRB / OPC integration validated in North America	None of it transfers; full SRRC + CCC + operator acceptance cycle to run from scratch
Selecting an acceptance lab without verifying its recognition by the operator	Tests run and then rejected, lost cycle
Modifying the RF chain or the LPA after acceptance without redeclaring	Acceptance invalidated, acceptance review and IMEI inscription to relaunch
Ignoring SIM / IMEI binding on certain IoT operator offerings	After-sales module replacement halts service until operator-side regularisation