Every LTE identity that must be unique across the world starts with the same three digits. They are the Mobile Country Code, and they tell a UE in which country a network, a cell or a subscription is located. This page shows where the MCC sits in each identity, how RRC and NAS encode it, and who assigns the values.

Mobile Country Code is a specific 3 digit number which is allocated for a country (or a region in a country) by ITU-T.

You can get the full list of MCC from ITU-T homepage.

Followings are the topics to be covered in this page.

• MCC in LTE identities
• MCC in RRC - PLMN-Identity
• MCC in NAS - BCD coding
• Allocation of MCC values
• Reference

MCC in LTE identities

Where does the MCC appear in an LTE system? It is the first part of the IMSI in the USIM, of the PLMN identity broadcast by a cell, and of the tracking area and cell identities built on it. The value is the same three digits in all of them.

3GPP TS 23.003 v20.0.0 clause 2.2 builds the IMSI from three parts. The MCC has three digits and identifies the country of domicile of the subscription. The MNC has two or three digits and identifies the home PLMN within that country. The MSIN identifies the subscription within the PLMN. Clause 2.3 then limits the IMSI to decimal digits only, with at most 15 digits in total.

The same MCC and MNC form the PLMN identity, PLMN-Id = MCC || MNC in clause 12.1. The network identities of LTE extend the PLMN-Id with a local part. The TAI adds a 2-octet TAC in clause 19.4.2.3, and the ECGI adds the 28-bit ECI in clause 19.6. The diagram below puts the three identities side by side.

Figure 1. The MCC leads the IMSI, the TAI and the ECGI. A UE can therefore compare the first three digits of a broadcast identity with its own IMSI and tell whether the cell is in its home country.

The length of the MNC is the part the digits alone do not reveal. It depends on the MCC, so a receiver must know the numbering of each country to split an IMSI correctly. A country may mix both lengths. In that case, 23.003 clause 2.2 forbids a 3-digit MNC that starts with the same two digits as a 2-digit MNC under the same MCC, such as MNC 12 and MNC 123. Its own example IMSI, 234150999999999, splits into MCC 234, MNC 15 and MSIN 0999999999.

The CGI page shows the ECGI in more detail. The sections below turn from the structure to the bits: first the RRC encoding in SIB1, then the NAS encoding in the TAI.

• MCC = 3 decimal digits : the first part of the IMSI and of the PLMN-Id.
• IMSI at most 15 digits : MCC, then a 2 or 3 digit MNC, then the MSIN.
• TAI and ECGI start with the PLMN-Id : followed by a 2-octet TAC or a 28-bit ECI.
• MNC length depends on the MCC : the digits alone do not show it.

MCC in RRC - PLMN-Identity

On the air interface, the UE learns the MCC of a cell from SIB1. RRC sends each digit as a separate integer rather than as packed BCD. It can also leave the MCC out of a PLMN entry, which a decoder must handle before it can print the PLMN.

SIB1 carries the PLMN identities of the cell in cellAccessRelatedInfo, as plmn-IdentityList. The list holds up to maxPLMN-r11 = 6 entries, one for each operator that shares the cell. The definitions below show how one entry is built.

Following is based on 36.331 v19.3.0 (Release 19)

PLMN-IdentityList ::=                   SEQUENCE (SIZE (1..maxPLMN-r11)) OF PLMN-IdentityInfo

PLMN-IdentityInfo ::=                   SEQUENCE {
    plmn-Identity                           PLMN-Identity,
    cellReservedForOperatorUse              ENUMERATED {reserved, notReserved}
}

PLMN-Identity ::=                   SEQUENCE {
    mcc                                 MCC                 OPTIONAL,                   -- Cond MCC
    mnc                                 MNC
}

MCC ::=                             SEQUENCE (SIZE (3)) OF
                                            MCC-MNC-Digit

MNC ::=                             SEQUENCE (SIZE (2..3)) OF
                                            MCC-MNC-Digit

MCC-MNC-Digit ::=                   INTEGER (0..9)

The field description of mcc in 36.331 says the first element is the first MCC digit, the second element the second digit, and so on. The condition MCC makes the field mandatory in the first entry of a PLMN-IdentityList, and in CellGlobalIdEUTRA, CellGlobalIdUTRA, CellGlobalIdGERAN and RegisteredMME. Elsewhere it is optional. When it is absent, the entry takes the MCC of the immediately preceding PLMN-Identity.

A shared cell therefore sends the country only once. Take a cell shared by PLMN 450-05 and PLMN 450-08. Its first entry sends mcc {4, 5, 0} and mnc {0, 5}, and its second entry sends only mnc {0, 8}. A decoder that prints the second entry without its predecessor shows no MCC at all. The SIB page shows where SIB1 sits among the other system information blocks.

The encoding is also compact. MCC-MNC-Digit is INTEGER (0..9), so unaligned PER codes each digit in 4 bits. MCC is a fixed SEQUENCE (SIZE (3)) and needs no length field, so a present MCC takes 12 bits plus the 1-bit presence flag. MNC is SIZE (2..3), so it adds a 1-bit length before its 8 or 12 bits.

• Each digit is an INTEGER (0..9) : not packed BCD.
• mcc is mandatory only in the first list entry : later entries may inherit it.
• Up to 6 PLMNs per cell : maxPLMN-r11 in SIB1.
• 12 bits for a present MCC : plus a 1-bit presence flag.

MCC in NAS - BCD coding

NAS carries the same digits in packed form. The TAI in 24.301 and the LAI in 24.008 share one 3-octet layout for MCC and MNC. The order of the digits in that layout is the part most often decoded wrongly.

24.301 v20.0.0 clause 9.9.3.32 codes the TAI as shown in the table below, and 24.008 v20.0.0 clause 10.5.1.3 uses the same octets for the LAI. Each octet holds two BCD digits, and the first digit of each pair sits in the low nibble, bits 4 to 1. Octet 3 mixes the two codes: MCC digit 3 is in the low nibble and MNC digit 3 is in the high nibble. With a 2-digit MNC, that high nibble is 1111.

Read as a hex string, PLMN 450-05 is 54 F0 50, and PLMN 310-410 is 13 00 14. A decoder that reads the high nibble first shows 45 0F 05 instead, which looks almost right and is easy to miss in a log. The F in octet 3 is the quickest check: it shows at once that the MNC has two digits.

The same clauses also say what happens with a corrupt value. If the MCC stored in the UE contains a digit outside 0 to 9, the UE sends it in full hexadecimal. The network then treats the TAI, or the LAI, as deleted. The MCC field itself is coded as in ITU-T Recommendation E.212, Annex A.

• Two BCD digits per octet : first digit in the low nibble.
• Octet 3 mixes MCC digit 3 and MNC digit 3 : MNC digit 3 = 1111 for a 2-digit MNC.
• 450-05 is 54 F0 50 : the F marks the 2-digit MNC.
• Same layout in TAI and LAI : 24.301 clause 9.9.3.32, 24.008 clause 10.5.1.3.

Allocation of MCC values

Who decides which country gets which code? The MCC belongs to the numbering plan of ITU-T Recommendation E.212, and 3GPP only refers to it. The list linked in the introduction is an older ITU Operational Bulletin, so the current assignment is best checked at the ITU.

23.003 clause 2.3 states that the ITU administers the allocation of MCCs, and it points to the ITU-T international numbering resources page for the current assignment. The MNC is assigned by the national numbering plan administrator of each country. The exception is the MNCs under the 90x MCC range, which the ITU administers itself.

The first digit of an MCC follows a geographic zone, as the table below shows. A large country can hold more than one MCC. The United States, for example, uses 310 to 316.

MCC 901 is the one value that names no country. 23.003 says so explicitly in its TMGI clause: MCC 901 does not identify any country and is assigned globally by the ITU. Test equipment uses a value outside the real assignments. The conformance test specification 36.508 v19.2.0 sets the home PLMN of its test USIM to 001-01, for example in clause 4.5.2E.1, so a lab network never collides with a live one.

• ITU administers the MCC : 23.003 clause 2.3 and ITU-T E.212.
• National administrators assign the MNC : except under MCC 90x.
• First digit = geographic zone : 2 Europe, 3 North America, 4 Asia and so on.
• 001-01 is the test PLMN : used by the 36.508 test USIM.

Reference

[1] 3GPP TS 23.003 v20.0.0 - clauses 2.2 and 2.3, IMSI; clause 12.1, PLMN Identifier; clause 19.4.2.3, TAI; clause 19.6, ECGI

[2] 3GPP TS 36.331 v19.3.0 - PLMN-Identity and PLMN-IdentityList information elements

[3] 3GPP TS 24.301 v20.0.0 - clause 9.9.3.32, Tracking area identity

[4] 3GPP TS 24.008 v20.0.0 - clause 10.5.1.3, Location Area Identification

[5] 3GPP TS 36.508 v19.2.0 - clause 4.5.2E.1, test USIM with HPLMN 001-01

[6] ITU-T Recommendation E.212 - The international identification plan for public networks and subscriptions