IDEMIA Alternatives for Credential Issuance and eSIM Operations: The Certified Core and the Layer Above It

Why organisations start looking for an IDEMIA alternative

IDEMIA sits in two very different procurement conversations, and the frustration in each has a different shape. On the government side, a motor vehicle agency or identity programme is dealing with credential issuance: driver licences and identity cards, central production, biometrics, and increasingly mobile credentials. On the telecom side, an operator or a virtual network operator is dealing with SIM and eSIM lifecycle: profile production, remote provisioning, activation, and swaps.

In both cases the trigger is rarely the certified component failing. It is the workflow around it. A DMV cannot change an exception process without a change request because the vendor owns the issuance workflow as well as the card. An operator wants a device trade in journey that activates an eSIM in three taps, and discovers the constraint is the ordering and entitlement layer rather than the provisioning platform. Somebody then types the vendor's name plus alternative into a search bar, when the actual question is which parts of the stack they should own.

What IDEMIA genuinely does well

Start with what is genuinely difficult. Producing a secure physical credential means substrates, laser engraving, optically variable features, tamper evidence, a controlled production facility, and a supply chain that survives audit. Biometric matching at national scale is a specialist discipline with decades of research behind it. On the connectivity side, eSIM provisioning runs on infrastructure that must be certified under GSMA security accreditation, hold operator credentials, and interoperate with a device ecosystem that changes constantly.

IDEMIA, formed from the merger of Oberthur Technologies and Safran Identity and Security, operates across both of those worlds, which is unusual. If your requirement is a credential that must resist counterfeiting or a provisioning platform that must satisfy accreditation and device compatibility across dozens of manufacturers, that capability is the product and it is not reproducible with a development budget. Anyone telling you otherwise is selling you a very expensive lesson.

Where the surrounding stack actually strains

Certification is a strength and a constraint at the same time. Systems that must remain accredited change slowly and deliberately, which is correct for the secure core and frustrating when it governs the customer journey attached to it. Release cadence in a certified environment is not something a customer negotiates.

The second strain is the bundle. When issuance workflow, exception handling, appointment logic, and reprint rules ship with the credential contract, an agency ends up paying for a change request every time policy shifts. The same pattern appears in telecom, where activation journeys, dealer tooling, and entitlement rules travel with the provisioning platform and cannot easily be reshaped to match a new commercial offer. Third is per credential and per profile economics. Costs track volume, which is fine when volume is flat and uncomfortable when a mobile credential programme or an eSIM push succeeds faster than forecast. Fourth is integration burden into systems the vendor does not own: the agency's core registration and titling platform on one side, the operator's business and operations support stack on the other. Fifth is data portability, which in this domain means enrolment records, credential history, and profile state, all of which are regulated and none of which should ever be trapped in an undocumented format.

Your realistic options, competitors included

For government identity and credential issuance, Thales, Veridos, and Valid are the names that appear in most competitive procurements, and several jurisdictions split the contract, buying card production from one supplier and issuance software from another or from a systems integrator. That split is worth pricing even if you end up rejecting it, because it reveals how much of your cost is the card and how much is the workflow.

For eSIM and SIM lifecycle, Thales and Giesecke and Devrient are the established alternatives, with Kigen and Workz among the providers serving operators and device makers who want more flexible arrangements. Multi-vendor eSIM setups are increasingly normal. The interfaces are standardised by GSMA specifications precisely so operators are not locked to one provisioning vendor, which gives you more room to move here than in most enterprise software categories.

When staying is the right call

Stay if your credential or profile production is reliable, audited, and accepted, because those outcomes are the entire point and replacing a certified supplier consumes years. Stay if your volumes are modest, since certification and accreditation costs are fixed and small programmes get the best value by sharing a supplier's infrastructure. Stay if you are mid-contract on a programme with statutory deadlines, such as a mobile driver licence rollout or a network migration, because vendor changes and deadlines do not coexist happily. And stay if your complaint is about the customer journey, because you can fix that without touching the vendor at all.

When a custom layer pays back

Build the orchestration layer. For an agency that means the parts of issuance that encode your policy rather than the vendor's: eligibility checks, document verification workflow, appointment and queue management, exception and fraud review queues, reprint and correction handling, and a status service so a resident can find out where their credential is without calling. All of that sits above the production interface and none of it requires touching the secure core.

For an operator it means activation and entitlement orchestration: the ordering journey, device eligibility and compatibility rules, dealer and retail tooling, eSIM transfer and device change flows, self service swap and replacement, and the analytics that tell you where activations fail. The provisioning platform performs the profile operation; your layer decides who is allowed to ask for it, what happens when the device is unsupported, and how a failed activation gets recovered without a call centre. That decision logic is your commercial product, and it changes every quarter, which is exactly why it should not live inside a certified system on someone else's release cycle.

Migration reality in a regulated stack

If you are genuinely changing a certified supplier, plan in years and phases rather than months. Enrolment and credential records are regulated data with retention obligations, so export scope, format, and chain of custody need to be settled before anything else. Run production in parallel with a low volume segment first, verify credential acceptance in the field, and only then scale. In telecom, profile state is the equivalent sensitive asset, and any transition needs to preserve the ability to service subscribers whose profiles were issued under the previous arrangement.

If you are building a layer instead, the migration is much smaller but the discipline is the same. Define the interface to the certified system, build validation that fails loudly rather than silently, and run the new journey alongside the existing one for a subset of traffic. Retraining is significant for counter staff and dealer channels, and those groups need the new flow to be faster than the old one within the first week or they will route around it.

Plan the accreditation conversation early. Anything your layer touches near the certified core will be reviewed, and the questions are predictable: what data crosses the boundary, where it is stored, who can see it, and how access is logged. Teams that design for that from the first sprint pass review with minor findings. Teams that treat it as a launch task discover that a security review can add months to a project that was otherwise finished.

What each path costs

Credential and provisioning contracts are quoted per unit against committed volumes over multi-year terms, with production infrastructure, certification, and support built in. Those numbers are large because the underlying capability is capital intensive, and they are usually defensible. On the custom side, from Digital Heroes delivery experience: an orchestration layer covering eligibility, exception queues, status services, and dealer or counter tooling above an existing certified platform runs roughly $60k to $150k in 12 to 20 weeks. A fuller self service, entitlement, and analytics platform with several integrations runs roughly $150k to $350k. Card personalisation, secure element provisioning, and biometric matching are not on that menu at any budget.

The honest recommendation

Split the stack in your head before you split it in procurement. The certified core is a buy decision and will stay one. The policy layer, the customer journey, the exception handling, and the analytics are yours, and every quarter you leave them inside a vendor contract is a quarter you pay change request pricing for decisions that are properly your own. Change certified suppliers only when quality, cost against benchmark, or accreditation status genuinely justifies a multi-year programme. Otherwise, keep the core, take back the workflow, and get your bargaining position from the standardised interfaces that exist precisely so buyers are not trapped.