Strategic Analysis of the eSIM Ecosystem for POS Terminals in Brazil

💡 TL;DR (Too Long; Didn't Read)

The adoption of eSIM (eUICC) technology for Point of Sale (POS) terminals in Brazil is both a regulatory necessity (due to ANATEL's prohibition of permanent roaming) and a strategic opportunity. The architecture should be based on the modern GSMA SGP.32 standard to avoid vendor lock-in and ensure flexibility. Although current hardware from major OEMs (Gertec, Ingenico, PAX) still relies on physical SIMs, this creates a gap for strategic partnerships. Effective management of a POS fleet requires a Connectivity Management Platform (CMP) with robust APIs, primarily offered by specialized MVNOs. The most advantageous business model is 'pooled data', which, combined with eSIM operational efficiencies, significantly reduces Total Cost of Ownership (TCO).

---

Section 1: The Fundamental Technology - Understanding the Shift to eSIM in IoT

This section establishes the technological foundation, explaining why eSIM is not just an incremental change, but a paradigm shift for the deployment and management of connected devices like Point of Sale (POS) terminals. It details the evolution of underlying standards, which is critical for making future-proof architectural decisions.

1.1. From Physical SIM to eUICC: Fundamental Concepts and Strategic Advantages for POS

The transition from the traditional removable SIM (Subscriber Identity Module) card to integrated solutions represents a fundamental evolution in how devices connect to cellular networks. At the center of this transformation are two interconnected concepts: eSIM (Embedded SIM) and eUICC (Embedded Universal Integrated Circuit Card). eSIM typically refers to the physical format, a secure chip soldered directly onto the device's circuit board (known as MFF2 format), while eUICC is the secure software component that resides in that chip. It's the eUICC that has the ability to store multiple carrier profiles and enables Remote SIM Provisioning (RSP), the technology that makes Over-the-Air (OTA) connectivity profile management possible. Although the terms are often used synonymously, the distinction is crucial: eSIM is the hardware, and eUICC is the technology that makes it programmable and flexible, and can exist in any format, including removable ones.

For the POS terminal ecosystem, adopting eUICC technology offers a set of strategic advantages that directly address pain points associated with deploying and managing large device fleets:

• Simplified Logistics and Manufacturing: The most immediate advantage is eliminating the need to manage inventories of physical SIM cards from different carriers for different regions. POS manufacturers and distributors can produce and distribute a single hardware SKU (Stock Keeping Unit) globally. The appropriate connectivity profile is downloaded and activated only when the device is deployed to its final destination, drastically reducing supply chain complexity.
• Enhanced Durability and Security: POS terminals, especially mobile ones (mPOS), operate in demanding environments, subject to vibrations, drops, and temperature variations. A soldered eSIM is inherently more robust and resistant to physical and environmental damage than a removable SIM with its mechanical slot. Additionally, the integrated nature of eSIM prevents physical tampering, such as unauthorized SIM removal or replacement, a fraud and misuse vector. This physical security is a crucial complement to the logical security required in payment transactions.
• Remote Lifecycle Management: The ability to remotely activate, switch, and deactivate connectivity profiles is transformative. It eliminates the need for "truck rolls" — sending technicians to the field to physically access terminals — which is a significant operational expense. For a fleet of thousands of POS terminals distributed throughout Brazil, the ability to resolve connectivity issues or switch carriers through a centralized portal reduces costs and increases terminal uptime.
• Future-Proofing: A POS terminal's lifecycle can extend for several years. During this period, network technologies evolve (e.g., the transition from 4G to 5G or adoption of LPWAN networks like LTE-M and NB-IoT), and commercial relationships with carriers can change. A device equipped with eUICC can adapt to these changes through OTA updates, ensuring the hardware investment remains viable and connected throughout its lifespan, without requiring physical replacement.

1.2. The GSMA Standards Landscape: A Comparative Analysis

eUICC functionality is governed by technical specifications developed by GSMA (Global System for Mobile Communications Association). Understanding the evolution of these standards, from M2M-focused SGP.02 to IoT-centric SGP.32, is fundamental, as the choice of underlying architecture has profound commercial and operational implications.

1.2.1. SGP.02 (M2M): The Legacy Standard and Its Limitations

GSMA's first specification for non-consumer devices, known as SGP.01 (architecture) and SGP.02 (technical specification), was designed primarily for the Machine-to-Machine (M2M) market, with the automotive sector as the main use case. This architecture operates on a "push" model, where a central server, the SM-SR (Subscription Manager - Secure Router), "pushes" a new carrier profile to the device.

While functional, this approach presents significant limitations for mass and flexible POS terminal deployment:

• Integration Complexity: For a new carrier profile (the "receiving" carrier) to be downloaded, complex technical and commercial integration between the "donor" carrier's RSP platform and the receiver's is required. This process is expensive, time-consuming, and creates a significant barrier to supplier switching.
• Vendor Lock-in: The SGP.02 model creates strong dependence (lock-in) between the eUICC and the initial RSP platform provider. In practice, profile switching is so burdensome that it's rarely executed, which nullifies much of eSIM's flexibility promise.
• SMS Dependency: The architecture often depends on SMS to "wake up" the device and initiate a profile management operation. This makes it unsuitable for low-power IoT devices or those operating on networks that don't reliably support SMS, like some LPWAN networks.

1.2.2. SGP.32 (IoT): The New Paradigm for Scalability and Flexibility

Recognizing M2M standard limitations, GSMA launched a new specification in May 2023, SGP.31 (architecture) and SGP.32 (technical), designed specifically for the IoT ecosystem. This new architecture represents a fundamental shift, adopting a more flexible model based on the consumer standard (SGP.22), but adapted for massive, zero-touch deployments.

SGP.32's key advantages are:

• Elimination of Carrier-to-Carrier Integration: The most significant change is eliminating the need for complex integrations between carrier platforms. Profile switching control is transferred to a central entity managed by the company or its connectivity service provider, the eIM (eSIM IoT Manager). This drastically reduces friction and costs associated with switching connectivity providers.
• Designed for Mass IoT: The standard was conceived from the start to manage device fleets at scale. It uses lightweight communication protocols (like CoAP over UDP), suitable for power and bandwidth-constrained devices. The "intent" of a profile change is moved from the device to the cloud-based eIM, enabling true automation and remote management without physical or user interaction.
• Market Readiness: Rapid adoption of this standard is evident. Leading providers like IDEMIA and G+D have already announced GSMA-certified end-to-end solutions for SGP.32, signaling that the ecosystem is rapidly maturing and that new deployments can and should be built on this modern foundation.

The decision of which GSMA standard to adopt is therefore the most critical architectural choice for developing a "generic" POS product. Building on SGP.02 would ground the product in legacy technology that compromises flexibility and customer control. In contrast, an SGP.32-based architecture allows carrier independence to be a core value proposition, offering a powerful competitive differentiator aligned with long-term fleet management needs.

1.3. Key Architectural Components: SM-DP+, eIM and the Future of Remote Provisioning

The SGP.32 architecture is composed of several elements that work together to enable secure and scalable remote provisioning:

• SM-DP+ (Subscription Manager - Data Preparation+): This is the secure backend, typically operated by an MNO or RSP provider, responsible for generating, encrypting, and storing carrier profiles for secure download to the eUICC. The SGP.32 standard leverages existing SM-DP+ infrastructure from the consumer eSIM world, ensuring broad carrier compatibility.
• eIM (eSIM IoT Remote Manager): The eIM is the central orchestration point in SGP.32 architecture. It's the cloud-based platform that a company (or its service provider) uses to manage the eSIM profile lifecycle in its device fleet. Through the eIM, the fleet manager can instruct a device or group of devices to download, activate, deactivate, or delete carrier profiles, without needing permission or involvement from the currently active carrier.
• IPA (IoT Profile Assistant): The IPA is a small software component that resides on the device (IPAd - IPA on device) or on the eUICC itself (IPAe - IPA on eUICC). Its function is to communicate with the eIM and execute profile management commands on the eUICC. The IPA acts as the field agent that executes policies defined centrally in the eIM.

1.4. Bootstrap and "Out-of-the-Box" Connectivity: Enabling Zero-Touch Deployment

A fundamental challenge in eSIM deployment is the "first connection problem": how does a new device, without an active carrier profile, connect to the internet for the first time to download its intended operational profile? The solution to this problem is "bootstrap" connectivity.

A bootstrap profile is an initial connectivity profile, small and often temporary, that is pre-loaded onto the eUICC during manufacturing. This profile allows the device to connect to a cellular network "out-of-the-box," anywhere in the world, establish a connection to the RSP platform, and download the final operational profile of the carrier chosen by the customer.

Leading providers like Thales offer sophisticated solutions for this challenge. Thales Instant Connect, for example, provides a generic provisioning subscription that is only billed when used. This means a POS manufacturer can produce thousands of devices without incurring connectivity costs while devices are in stock or in transit. The cost is only generated when the device is first powered on and uses bootstrap connectivity to download its final profile, significantly optimizing costs and simplifying manufacturing. Similarly, G+D's AirOn360® Intelligent Online platform also provides this "ultra-light bootstrap" capability.

Bootstrap connectivity is not just a technical feature; it's a critical enabler of the business model for a generic and globally deployable POS product. Without it, the promise of "zero-touch" deployment collapses, as it would require manual intervention (e.g., connecting the device to Wi-Fi) for initial provisioning. Therefore, any product strategy must include a robust bootstrap solution, either through partnership with a specialized provider or by negotiating a bootstrap profile with a global connectivity partner. The reliability and cost model of this initial connection are fundamental to the solution's Total Cost of Ownership (TCO).

Section 2: The Hardware Ecosystem - From Silicon to Terminal

This section anchors technological possibilities in market reality, analyzing key hardware players, from chip manufacturers to dominant POS terminal OEMs in Brazil. It will identify the current state of eSIM adoption and the critical hardware gap that must be addressed.

2.1. Leading eUICC Manufacturers and Their Offerings (Thales, G+D, IDEMIA)

The foundations of eSIM hardware are provided by a small group of global high-tech companies specialized in digital security. These companies not only manufacture secure chips (eUICCs), but also provide the software platforms (RSP) that manage them.

• Thales: A global giant in digital identity and security, Thales offers a comprehensive portfolio of secure elements, including rugged industrial SIMs and eSIMs in various formats. The company is at the forefront of innovation with solutions like Thales Instant Connect for bootstrap connectivity and Thales Adaptive Connect, its SGP.32-compatible eSIM management platform. Thales highlights its strong support for OEMs (Original Equipment Manufacturers) throughout the design, testing, and integration process, positioning itself as a strategic partner for device manufacturers.
• Giesecke+Devrient (G+D): A German company with a long history in security, G+D pioneered eSIM management with its AirOn360® platform. This platform is notable for supporting all relevant GSMA standards (SGP.02, SGP.22, and the latest SGP.32), offering an end-to-end solution, from eUICC to management software. G+D actively promotes eSIM benefits, such as simplified logistics and sustainability (through its "Green eSIM" initiative), and is driving adoption of newer standards like SGP.32 and factory provisioning (SGP.42).
• IDEMIA: A leading provider of identity and security solutions, IDEMIA has a strong and established presence in Brazil, highlighted by its strategic partnership with TIM Brasil to provide eSIM management solutions. Its Smart Connect M2M/IoT platform is designed to intelligently and simultaneously manage SGP.02 and SGP.32 standard workflows, ensuring a smooth transition for customers migrating from legacy systems. IDEMIA was the first company to announce a fully GSMA-certified end-to-end solution for the SGP.32 standard, demonstrating technical leadership and market readiness.

2.2. Analysis of POS Terminal Manufacturers in the Brazilian Market

Despite the maturity and availability of eUICC technology from silicon vendors, its integration into POS terminals commercialized in Brazil is still in an incipient phase. Analysis of technical specifications of the most popular models from major manufacturers reveals continued dependence on physical SIM cards.

• Gertec: As one of the largest Brazilian manufacturers of commercial automation and payment methods, Gertec has significant presence in the local market. However, analysis of its SmartPOS models, such as GPOS700, GPOS700 Mini, and TSG800, shows that while they offer 4G cellular connectivity, specifications consistently list slots for physical SIMs (e.g., "1 SIM Card | 2 SAM" or "Dual SIM"). There is no publicly available information in research materials indicating a roadmap or imminent plans from Gertec for adopting integrated eSIMs in their devices.
• Ingenico: A global leader with strong penetration in Brazil, Ingenico offers a wide range of terminals. The APOS A8 model, a popular Android terminal, clearly specifies slots for "1 SIM" and "2 SAM" in its datasheet. While Ingenico's broader strategy focuses on modern Android-based platforms and cloud services, hardware specifications of common models in the region don't mention eSIM integration.
• PAX Technology: Another important global player, PAX also relies on physical SIMs in its popular models. The A920 Pro datasheet, for example, details configurations like "1 x Micro SIM + 2 x PSAM". PAX announced an eSIM solution called Airlink in April 2024, but its initial launch is explicitly focused on "major North American networks," indicating its availability in Brazil is not immediate. The company's historical press releases about Brazil focus on sales volumes and partnerships, not on introducing eSIM technology.

2.3. Hardware Integration Challenges and Opportunities for a Generic Product

The analysis from the previous section reveals a fundamental disconnect: the software and platform ecosystem for eSIM is mature and rapidly advancing towards standards like SGP.32, but POS hardware currently deployed and mass-sold in Brazil is not natively equipped with eUICCs.

This creates a scenario of both challenge and opportunity. The challenge is that a "generic" eSIM-based solution cannot simply be implemented on the vast installed base of existing terminals. The opportunity, however, is significant. The main obstacle to mass eSIM adoption in the Brazilian POS market is not lack of technology, but rather the hardware upgrade cycle itself. POS terminals have a multi-year lifespan, meaning installed base replacement is a slow process. A company developing a generic eSIM solution can create a decisive competitive advantage by establishing a strategic partnership with a POS OEM.

Particularly, the absence of a public eSIM roadmap from Gertec, a dominant local player, represents a unique strategic opportunity. While global players like PAX already have eSIM initiatives in other regions, Gertec may be looking for knowledge and a technology partner to develop its next generation of terminals. A company with a robust eSIM solution could position itself as Gertec's strategic technology partner, integrating its solution directly into Gertec's future product line and thus gaining immediate access to a massive distribution channel in the Brazilian market.