Pre-personalization

What Is Pre-Personalization?

Pre-personalizationPre-personalizationManufacturingLoading transport keys and serial numbers before main personalization.Click to view → is the initial manufacturing step that loads transport keys, card serial numbers, and a basic file system onto blank smart card chips before they are shipped to a personalization bureau for final cardholder-specific data loading. This step establishes a secure handoff point in the supply chain, ensuring that only authorized personalization systems can communicate with the card and load sensitive data.

Pre-personalization is sometimes called "pre-perso" and is distinct from electrical personalization, which writes the actual cardholder credentials.

What Gets Loaded

During pre-personalization, the card chip receives:

Transport Key Security

Transport keys serve a specific purpose: they protect the card during transit from the chip manufacturer or card vendor to the personalization bureau. The bureau replaces transport keys with production keys during the personalization process.

The transport key lifecycle follows strict procedures:

1. Generation -- transport keys are generated during a key ceremony at the chip vendor.
2. Loading -- keys are loaded onto each chip during pre-personalization, diversified per card using the CSN.
3. Distribution -- key material is securely transmitted to the personalization bureau (encrypted, via HSM-to-HSMHSMSecurityPhysical device for key management.Click to view → transfer).
4. Replacement -- during personalization, the bureau opens a secure channel using the transport key, then replaces it with the issuer's production keys.
5. Destruction -- transport keys are zeroized from the bureau's HSM after all cards in the batch are personalized.

Supply Chain Protection

Pre-personalization creates a critical security boundary. A card with only transport keys cannot process live transactions or authenticate to production systems. If cards are intercepted during shipping, the transport keys (known only to the manufacturer and the intended personalization bureau) prevent unauthorized data loading.

This is especially important for EMV payment cards and government PIV cards, where a compromised supply chain could result in fraudulent cards entering circulation.