Section: 5.5.1.3.5 Mobility and periodic registration update not accepted by the network
Content: If the mobility and periodic registration update request cannot be accepted by the network, the AMF shall send a REGISTRATION REJECT message to the UE including an appropriate 5GMM cause value. If the mobility and periodic registration update request is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346. In NB-N1 mode, if the mobility and periodic registration update request is rejected due to operator determined barring (see 3GPP TS 29.503[ 5G System; Unified Data Management Services; Stage 3 ]  [20AB]), the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346. When the UE performs inter-system change from S1 mode to N1 mode, if the AMF is informed that verification of the integrity protection of the TRACKING AREA UPDATE REQUEST message included by the UE in the EPS NAS message container IE of the REGISTRATION REQUEST message has failed in the MME, then: a) If the AMF can retrieve the current 5G NAS security context as indicated by the ngKSI and 5G-GUTI sent by the UE, the AMF shall proceed as specified in subclause 5.5.1.3.4; b) if the AMF cannot retrieve the current 5G NAS security context as indicated by the ngKSI and 5G-GUTI sent by the UE, or the ngKSI or 5G-GUTI was not sent by the UE, the AMF may initiate the identification procedure by sending the IDENTITY REQUEST message with the "Type of identity" of the 5GS identity type IE set to "SUCI" before taking actions as specified in subclause 4.4.4.3; or c) If the AMF needs to reject the mobility and periodic registration update procedure, the AMF shall send REGISTRATION REJECT message including 5GMM cause #9 "UE identity cannot be derived by the network". If the REGISTRATION REJECT message with 5GMM cause #76 or #78 was received without integrity protection, then the UE shall discard the message. If the REGISTRATION REJECT message with 5GMM cause #62 was received without integrity protected, the behaviour of the UE is specified in subclause 5.3.20.2. Based on operator policy, if the mobility and periodic registration update request is rejected due to core network redirection for CIoT optimizations, the network shall set the 5GMM cause value to #31 "Redirection to EPC required". NOTE 1: The network can take into account the UE's S1 mode capability, the EPS CIoT network behaviour supported by the UE or the EPS CIoT network behaviour supported by the EPC to determine the rejection with the 5GMM cause value #31 "Redirection to EPC required". If the mobility and periodic registration update request is rejected because: a) all the S-NSSAI(s) included in the requested NSSAI (i.e. Requested NSSAI IE or Requested mapped NSSAI IE) are rejected; b) the UE set the NSSAA bit in the 5GMM capability IE to: 1) "Network slice-specific authentication and authorization supported" and; i) void; ii) all default S-NSSAIs are not allowed; or iii) network slice-specific authentication and authorization has failed or been revoked for all default S-NSSAIs and based on network local policy, the network decides not to initiate the network slice-specific re-authentication and re-authorization procedures for any default S-NSSAI requested by the UE; or 2) "Network slice-specific authentication and authorization not supported" and all subscribed default S-NSSAIs marked as default are either not allowed or are subject to network slice-specific authentication and authorization; and i) void; or ii) void; and c) no emergency PDU session has been established for the UE; the network shall set the 5GMM cause value of the REGISTRATION REJECT message to #62 "No network slices available" and shall include, in the rejected NSSAI of the REGISTRATION REJECT message, all the S-NSSAI(s) which were included in the requested NSSAI. If the UE has set the ER-NSSAI bit to "Extended rejected NSSAI supported" in the 5GMM capability IE of the REGISTRATION REQUEST message, the rejected S-NSSAI(s) shall be included in the Extended rejected NSSAI IE of the REGISTRATION REJECT message. Otherwise, the rejected S-NSSAI(s) shall be included in the Rejected NSSAI IE of the REGISTRATION REJECT message. In roaming scenarios, if the Extended rejected NSSAI IE is included in the REGISTRATION REJECT message, the AMF shall provide mapped S-NSSAI(s) for the rejected NSSAI. If the UE supports extended rejected NSSAI and the AMF determines that maximum number of UEs reached for one or more S-NSSAI(s) in the requested NSSAI as specified in subclause 4.6.2.5, the AMF shall include the rejected NSSAI containing one or more S-NSSAIs with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE in the REGISTRATION REJECT message. In addition, the AMF may include a back-off timer value for each S-NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE of the REGISTRATION REJECT message. If the mobility and periodic registration update request from a UE supporting CAG is rejected due to CAG restrictions, the network shall set the 5GMM cause value to #76 "Not authorized for this CAG or authorized for CAG cells only" and should include the "CAG information list" in the CAG information list IE or the Extended CAG information list IE in the REGISTRATION REJECT message. NOTE 2: The network cannot be certain that "CAG information list" stored in the UE is updated as result of sending of the REGISTRATION REJECT message with the CAG information list IE or the Extended CAG information list IE, as the REGISTRATION REJECT message is not necessarily delivered to the UE (e.g due to abnormal radio conditions). NOTE 3: The "CAG information list" can be provided by the AMF and include no entry if no "CAG information list" exists in the subscription. NOTE 3A: If the UE supports extended CAG information list, the CAG information list can be included either in the CAG information list IE or Extended CAG information list IE. NOTE 3B: It is unexpected for network to send REGISTRATION REJECT message to the UE with 5GMM cause value #76 in non-CAG cell and not indicate "Indication that the UE is only allowed to access 5GS via CAG cells" for the serving PLMN in the Extended CAG information list or the CAG information list. If the UE does not support extended CAG information list, the CAG information list shall not be included in the Extended CAG information list IE. If the mobility and periodic registration update request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall operate as described in bullet i) of subclause 5.5.1.3.8. If the UE's mobility and periodic registration update request is via a satellite NG-RAN cell and the network determines that the UE is in a location where the network is not allowed to operate, see 3GPP TS 23.502[ Procedures for the 5G System (5GS) ]  [9], the network shall set the 5GMM cause value in the REGISTRATION REJECT message to #78 "PLMN not allowed at the present UE location". NOTE 4: When the UE accessing network for emergency services, it is up to operator and regulatory policies whether the network needs to determine if the UE is in a location where network is not allowed to operate. If the AMF receives the mobility and periodic registration update request including the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE and the AMF determines that the UE is not allowed to use UAS services via 5GS based on the user's subscription data and the operator policy, the AMF shall return a REGISTRATION REJECT message with 5GMM cause #79 “UAS services not allowed”. If the mobility and periodic registration update request from a UE supporting MINT is rejected due to a disaster condition no longer being applicable in the current location of the UE, the network shall set the 5GMM cause value to #11 "PLMN not allowed" or #13 "Roaming not allowed in this tracking area" and may include a disaster return wait range in the Disaster return wait range IE in the REGISTRATION REJECT message. If the UE initiates the registration procedure for disaster roaming and the AMF determines that it does not support providing disaster roaming services for the determined PLMN with disaster condition to the UE, then the AMF shall send a REGISTRATION REJECT message with 5GMM cause #80 “Disaster roaming for the determined PLMN with disaster condition not allowed”. If the AMF receives the mobility and periodic registration update request over non-3GPP access and detects that the N3IWF used by the UE is not compatible with the allowed NSSAI and the UE has indicated its support for slice-based N3IWF selection in the REGISTRATION REQUEST message, the AMF may send a REGISTRATION REJECT message with 5GMM cause #81 "Selected N3IWF is not compatible with the allowed NSSAI" and may provide information for a suitable N3IWF in the REGISTRATION REJECT message indicating the suitable N3IWF that is compatible with the requested NSSAI. If the AMF receives the mobility and periodic registration update request over non-3GPP access and detects that the TNGF used by the UE is not compatible with the allowed NSSAI and the UE has indicated its support for slice-based TNGF selection in the REGISTRATION REQUEST message, the AMF may send a REGISTRATION REJECT message with 5GMM cause #82 "Selected TNGF is not compatible with the allowed NSSAI" and may provide information for a suitable TNAN in the TNAN information IE in the REGISTRATION REJECT message indicating the suitable TNGF that is compatible with the requested NSSAI. If the AMF received multiple TAIs from the satellite NG-RAN as described in 3GPP TS 23.501[ System architecture for the 5G System (5GS) ]  [8], and determines that, by UE subscription and operator's preferences, all of the received TAIs are forbidden for roaming or for regional provision of service, the AMF shall include the TAI(s) in: a) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE; or b) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE; or c) both; in the REGISTRATION REJECT message. Regardless of the 5GMM cause value received in the REGISTRATION REJECT message via satellite NG-RAN, - if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE in the REGISTRATION REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for roaming", the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for roaming"; and - if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the REGISTRATION REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for regional provision of service", the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for regional provision of service". In a shared network, the UE shall construct the TAI of the cell from one of the PLMN identities as specified in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] and the TAC received on the broadcast system information. Whenever a REGISTRATION REJECT message is received by the UE: - with the 5GMM cause #11 "PLMN not allowed", the chosen PLMN identity shall be stored in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [17] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [22]) then the UE shall start timer T3245 and proceed as described in subclause 5.3.19A; - with the 5GMM cause #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", #15 "no suitable cells in tracking Area", or #62 "No network slices available", the constructed TAI shall be stored in the suitable list; or - as a response to registration procedure for mobility registration update initiated in 5GMM-CONNECTED mode, the UE need not update forbidden lists with the selected PLMN identity or the constructed TAI, respectively. Furthermore, the UE shall take the following actions depending on the 5GMM cause value received in the REGISTRATION REJECT message. #3 (Illegal UE); or #6 (Illegal ME). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.19a.1. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid until the UE is switched off, the entry is updated or the timer T3245 expires as described in subclause 5.3.19a.2. In case of SNPN, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in subclause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.19a.2. If the UE is not registered for onboarding services in SNPN, the UE shall delete the list of equivalent PLMNs (if any) or the list of equivalent SNPNs (if any), and shall move to 5GMM-DEREGISTERED.NO-SUPI state. If the message has been successfully integrity checked by the NAS, then the UE shall: 1) set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events to UE implementation-specific maximum value in case of PLMN if the UE maintains these counters; 2) set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events to UE implementation-specific maximum value in case of SNPN if the UE maintains these counters; and If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a of 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15]. If the UE is in EMM-REGISTERED state, the UE shall move to EMM-DEREGISTERED state. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If the UE is registered for onboarding services in SNPN, the UE shall reset the registration attempt counter, store the SNPN identity in the "permanently forbidden SNPNs" list for onboarding services, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for the current SNPN to the UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value. #7 (5GS services not allowed). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.19a.1; In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid for 5GS services until the UE is switched off, the entry is updated or the timer T3245 expires as described in subclause 5.3.19a.2. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in subclause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.19a.2. If the UE is not registered for onboarding services in SNPN, the UE shall move to 5GMM-DEREGISTERED.NO-SUPI state. If the message has been successfully integrity checked by the NAS, then the UE shall: 1) set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events to UE implementation-specific maximum value in case of PLMN if the UE maintains these counters; 2) set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events to UE implementation-specific maximum value in case of SNPN if the UE maintains these counters; and If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. If the UE is registered for onboarding services in SNPN, the UE shall reset the registration attempt counter, store the SNPN identity in the "permanently forbidden SNPNs" list for onboarding services, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for the current SNPN to the UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value. #9 (UE identity cannot be derived by the network). The UE shall set the 5GS update status to 5U2 NOT UPDATED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall enter the state 5GMM-DEREGISTERED. If the UE has initiated the registration procedure in order to enable performing the service request procedure for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 3GPP TS 23.167[ IP Multimedia Subsystem (IMS) emergency sessions ]  [6]. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access. If the rejected request was neither for initiating an emergency PDU session nor for emergency services fallback, the UE shall subsequently, automatically initiate the initial registration procedure. NOTE 5: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. #10 (implicitly de-registered). The UE shall enter the state 5GMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped 5G NAS security context or partial native 5G NAS security context. If the UE has initiated the registration procedure in order to enable performing the service request procedure for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 3GPP TS 23.167[ IP Multimedia Subsystem (IMS) emergency sessions ]  [6]. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access. If the rejected request was neither for initiating an emergency PDU session nor for emergency services fallback, the UE shall perform a new registration procedure for initial registration. NOTE 6: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM state as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. #11 (PLMN not allowed). This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in subclause 5.3.19a.1, delete the list of equivalent PLMNs, reset the registration attempt counter. For 3GPP access, the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. For non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18]. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list, eKSI and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same PLMN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value. If the UE receives the Disaster return wait range IE in the REGISTRATION REJECT message and the UE supports MINT, the UE shall delete the disaster return wait range stored in the ME, if any, and store the disaster return wait range included in the Disaster return wait range IE in the ME. #12 (Tracking area not allowed). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter. If: 1) the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE is not included in the REGISTRATION REJECT message, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message; or 2) the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list, eKSI and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. #13 (Roaming not allowed in this tracking area). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access the UE shall delete the list of equivalent PLMNs (if available) or the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter. For 3GPP acess the UE shall change to state 5GMM-REGISTERED.PLMN-SEARCH, and for non-3GPP access the UE shall change to state 5GMM-REGISTERED.LIMITED-SERVICE. If the UE is registered in S1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in subclause 4.8.3. Otherwise if: 1) the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or 2) the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. For 3GPP access the UE shall perform a PLMN selection or SNPN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5], and for non-3GPP access the UE shall perform network selection as defined in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18]. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. If the UE receives the Disaster return wait range IE in the REGISTRATION REJECT message and the UE supports MINT, the UE shall delete the disaster return wait range stored in the ME, if any, and store the disaster return wait range included in the Disaster return wait range IE in the ME. #15 (No suitable cells in tracking area). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). The UE shall reset the registration attempt counter and shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE. If the UE has initiated the registration procedure in order to enable performing the service request procedure for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GC according to the emergency services support indicator (see 3GPP TS 36.331[ Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification ]  [25A]). If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access. Otherwise, the UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C]. If: 1) the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list, if present. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or 2) the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and shall remove the current TAI from the stored TAI list, if present. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. If received over non-3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.3.7. #22 (Congestion). If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.3.7. The UE shall abort the registration procedure for mobility and periodic registration update. If the rejected request was not for initiating an emergency PDU session, the UE shall set the 5GS update status to 5U2 NOT UPDATED, reset the registration attempt counter and change to state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE. The UE shall stop timer T3346 if it is running. If the REGISTRATION REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE. If the REGISTRATION REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [12]. The UE stays in the current serving cell and applies the normal cell reselection process. The registration procedure for mobility and periodic registration update is started, if still necessary, when timer T3346 expires or is stopped. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. If the registration procedure for mobility and periodic registration update was initiated for an MO MMTEL voice call (i.e. access category 4), or an MO MMTEL video call (i.e. access category 5), or an MO IMS registration related signalling (i.e. access category 9) or for NAS signalling connection recovery during an ongoing MO MMTEL voice call (i.e. access category 4), or during an ongoing MO MMTEL video call (i.e. access category 5) or during an ongoing MO IMS registration related signalling (i.e. access category 9), then a notification that the request was not accepted due to network congestion shall be provided to upper layers. NOTE 8: Upper layers specified in 3GPP TS 24.173[ IMS Multimedia telephony communication service and supplementary services; Stage 3 ]  [13C] and 3GPP TS 24.229[ IP multimedia call control protocol based on Session Initiation Protocol (SIP) and Session Description Protocol (SDP); Stage 3 ]  [14] handle the notification that the request was not accepted due to network congestion. If the UE is registered for onboarding services in SNPN, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. #27 (N1 mode not allowed). The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). Additionally, the UE shall reset the registration attempt counter and shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set: 1) the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or 2) the SNPN-specific attempt counter for 3GPP access for the current SNPN and the SNPN-specific attempt counter for non-3GPP access for the current SNPN in case of SNPN; to the UE implementation-specific maximum value. The UE shall disable the N1 mode capability for the specific access type for which the message was received (see subclause 4.9). If the message has been successfully integrity checked by the NAS, the UE shall disable the N1 mode capability also for the other access type (see subclause 4.9). If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED. Additionally, the UE shall reset the tracking area updating attempt counter and enter the state EMM-REGISTERED. #31 (Redirection to EPC required). 5GMM cause #31 received by a UE that has not indicated support for CIoT optimizations or not indicated support for S1 mode or received by a UE over non-3GPP access is considered an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). The UE shall reset the registration attempt counter and enter the state 5GMM- REGISTERED.LIMITED-SERVICE. The UE shall enable the E-UTRA capability if it was disabled and disable the N1 mode capability for 3GPP access (see subclause 4.9.2). If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. #62 (No network slices available). The UE shall abort the registration procedure for mobility and periodic registration update procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE. Additionally, the UE shall reset the registration attempt counter. The UE receiving the rejected NSSAI in the REGISTRATION REJECT message takes the following actions based on the rejection cause in the rejected S-NSSAI(s): "S-NSSAI not available in the current PLMN or SNPN" The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN or SNPN as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current PLMN or SNPN over any access until switching off the UE, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2. "S-NSSAI not available in the current registration area" The UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current registration area over the current access until switching off the UE, the UE moving out of the current registration area, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2. "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the failed or revoked NSSAA as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over any access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclause 4.6.1 and 4.6.2.2. "S-NSSAI not available due to maximum number of UEs reached" Unless the back-off timer value received along with the S-NSSAI is zero, the UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the maximum number of UEs reached as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over the current access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclauses 4.6.1 and 4.6.2.2. NOTE 8: If the back-off timer value received along with the S-NSSAI in the rejected NSSAI for the maximum number of UEs reached is zero as specified in subclause 10.5.7.4a of 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [12], the UE does not consider the S-NSSAI as the rejected S-NSSAI. If there is one or more S-NSSAIs in the rejected NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached", then for each S-NSSAI, the UE shall behave as follows: a) stop the timer T3526 associated with the S-NSSAI, if running; b) start the timer T3526 with: 1) the back-off timer value received along with the S-NSSAI, if a back-off timer value is received along with the S-NSSAI that is neither zero nor deactivated; or 2) an implementation specific back-off timer value, if no back-off timer value is received along with the S-NSSAI; and c) remove the S-NSSAI from the rejected NSSAI for the maximum number of UEs reached when the timer T3526 associated with the S-NSSAI expires. If the UE has an allowed NSSAI or configured NSSAI and: 1) at least S-NSSAI of the allowed NSSAI or configured NSSAI is not included in the rejected NSSAI, the UE may stay in the current serving cell, apply the normal cell reselection process and start a registration procedure for mobility and periodic registration update with a requested NSSAI that includes any S-NSSAI from the allowed S-NSSAI or the configured NSSAI that is not in the rejected NSSAI. 2) all the S-NSSAI(s) in the allowed NSSAI and configured NSSAI are rejected and at least one S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" and: i) the REGISTRATION REJECT message is integrity protected, the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message and the REGISTRATION REJECT message is received from one of the TAI(s) in the current registration area, the UE shall store the TAI(s) belonging to the registration area in the list of "5GS forbidden tracking areas for roaming". If the REGISTRATION REJECT message is received from a TAI not in the current registration area, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming". The UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C]; or ii) the REGISTRATION REJECT message is integrity protected and the UE is operating in SNPN access operation mode and the REGISTRATION REJECT message is received from one of the TAI(s) in the current registration area, the UE shall store the TAI(s) belonging to current registration area in the list of "5GS forbidden tracking areas for roaming" for the current SNPN. If the REGISTRATION REJECT message is received from a TAI not in the current registration area, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming". If the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-REGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C]. 3) otherwise, the UE may perform a PLMN selection or SNPN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if the UE does not have an allowed NSSAI and each S-NSSAI in the configured NSSAI, if available, was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in subclause 4.9. If the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and, 1) if at least one S-NSSAI in the default configured NSSAI is not rejected, the UE may stay in the current serving cell, apply the normal cell reselection process, and start a registration procedure for mobility and periodic registration update with a requested NSSAI with that default configured NSSAI; or 2) if all the S-NSSAI(s) in the default configured NSSAI are rejected and at least one S-NSSAI is rejected due to "S-NSSAI not available in the current registration area", i) if the REGISTRATION REJECT message is integrity protected and the UE is not operating in SNPN access operation mode and the REGISTRATION REJECT message is received from one of the TAI(s) in the current registration area, the UE shall store the TAI(s) belonging to current registration area in the list of "5GS forbidden tracking areas for roaming". If the REGISTRATION REJECT message is received from a TAI not in the current registration area, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming". The UE shall memorize the TAI(s) was stored in the list of "5GS forbidden tracking areas for roaming" for S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" and enter the state 5GMM-REGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C]; or ii) If the REGISTRATION REJECT message is integrity protected and the UE is operating in SNPN access operation mode and the REGISTRATION REJECT message is received from one of the TAI(s) in the current registration area, the UE shall store the TAI(s) belonging to current registration area in the list of "5GS forbidden tracking areas for roaming". If the REGISTRATION REJECT message is received from a TAI not in the current registration area, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming". The UE shall memorize the TAI(s) was stored in the list of "5GS forbidden tracking areas for roaming" for S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-REGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C]. 3) otherwise, the UE may perform a PLMN selection or SNPN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if each S-NSSAI in the default configured NSSAI was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in subclause 4.9. If 1) the UE has allowed NSSAI for the current PLMN or SNPN or configured NSSAI for the current PLMN or SNPN or both and all the S-NSSAIs included in the allowed NSSAI or the configured NSSAI or both are rejected; or 2) the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and all the S-NSSAIs included in the default configured NSSAI are rejected, and the UE has rejected NSSAI for the maximum number of UEs reached, and the UE wants to obtain services in the current serving cell without performing a PLMN selection or SNPN selection, the UE may stay in the current serving cell and attempt to use the rejected S-NSSAI(s) for the maximum number of UEs reached in the current serving cell after the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU2 NOT UPDATED, reset the tracking area updating attempt counter and enter the state EMM-REGISTERED. #72 (Non-3GPP access to 5GCN not allowed). When received over non-3GPP access the UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED. If the message has been successfully integrity checked by the NAS, the UE shall set: 1) the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or 2) the SNPN-specific attempt counter for non-3GPP access for that SNPN in case of SNPN; to the UE implementation-specific maximum value. NOTE 10: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3). The UE shall disable the N1 mode capability for non-3GPP access (see subclause 4.9.3). As an implementation option, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If received over 3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.3.7. #73 (Serving network not authorized). This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs, reset the registration attempt counter, store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18]. If the message has been successfully integrity checked by the NAS, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the tracking area updating attempt counter and enter the state EMM-DEREGISTERED. #74 (Temporarily not authorized for this SNPN). 5GMM cause #74 is only applicable when received from a cell belonging to an SNPN. 5GMM cause #74 received from a cell not belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list ngKSI and the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter and store the SNPN identity in the "temporarily forbidden SNPNs" list or "temporarily forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN as specified in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "temporarily forbidden SNPNs for access for localized services in SNPN" (if the SNPN was selected according to subclause 4.9.3.1.1 bullet a0) of 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is not registered for onboarding services in SNPN, for 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] and for non-3GPP access the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE amd perform network selection as defined in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18]. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value. #75 (Permanently not authorized for this SNPN). 5GMM cause #75 is only applicable when received from a cell belonging to an SNPN with a globally-unique SNPN identity. 5GMM cause #75 received from a cell not belonging to an SNPN or a cell belonging to an SNPN with a non-globally-unique SNPN identity is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list ngKSI and the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter and store the SNPN identity in the "permanently forbidden SNPNs" or "permanently forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN as specified in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] list for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "permanently forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "permanently forbidden SNPNs for access for localized services in SNPN" (if the SNPN was selected according to subclause 4.9.3.1.1 bullet a0) of 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is not registered for onboarding services in SNPN, for 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] and for non-3GPP access the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE amd perform network selection as defined in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18]. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value. #76 (Not authorized for this CAG or authorized for CAG cells only). This cause value received via non-3GPP access or from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3.ROAMING NOT ALLOWED, store the 5GS update status according to subclause 5.1.3.2.2, and reset the registration attempt counter. If 5GMM cause #76 is received from: 1) a CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall: i) replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN; ii) replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or NOTE 10: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored. iii) remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry. Otherwise, the UE shall delete the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN, if the CAG-ID(s) are authorized based on the "Allowed CAG list". In the case the "allowed CAG list" for the current PLMN only contains a range of CAG-IDs, how the UE deletes the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN is up to UE implementation. In addition: i) if the entry in the "CAG information list" for the current PLMN does not include an "indication that the UE is only allowed to access 5GS via CAG cells" or if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and one or more CAG-ID(s) are authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C] with the updated "CAG information list"; ii) if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and no CAG-ID is authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] with the updated "CAG information list"; or iii) if the "CAG information list" does not include an entry for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] or 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [25C] with the updated "CAG information list". 2) a non-CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall: i) replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN; ii) replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or NOTE 11: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored. iii) remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry. Otherwise, the UE shall store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN, if any. If the "CAG information list" stored in the UE does not include the current PLMN's entry, the UE shall add an entry for the current PLMN to the "CAG information list" and store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN. If the UE does not have a stored "CAG information list", the UE shall create a new "CAG information list" and add an entry with an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN. In addition: i) if one or more CAG-ID(s) are authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304[ NR; User Equipment (UE) procedures in Idle mode and in RRC Inactive state ]  [28] with the updated CAG information; or ii) if no CAG-ID is authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5] with the updated "CAG information list". If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, reset the tracking area updating attempt counter and enter the state EMM-REGISTERED. #77 (Wireline access area not allowed). 5GMM cause #77 is only applicable when received from a wireline access network by the 5G-RG or the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device). 5GMM cause #77 received from a 5G access network other than a wireline access network and 5GMM cause #77 received by the W-AGF acting on behalf of the FN-BRG are considered as abnormal cases and the behaviour of the UE is specified in subclause 5.5.1.3.7. When received over wireline access network, the 5G-RG and the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device) shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2), shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI, shall reset the registration attempt counter, shall enter the state 5GMM-DEREGISTERED and shall act as specified in subclause 5.3.23. NOTE 12: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3). #78 (PLMN not allowed to operate at the present UE location). This cause value received from a non-satellite NG-RAN cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.3.7. The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location" and shall start a corresponding timer instance (see subclause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [5]. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, and tracking area updating attempt counter as specified in 3GPP TS 24.301[ Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 ]  [15] for the case when the normal tracking area updating procedure is rejected with the EMM cause with the same value. #79 (UAS services not allowed). The UE shall abort the registration procedure for mobility and periodic registration update procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE. Additionally, the UE shall reset the registration attempt counter. The UE may re-attempt the registration procedure to the current PLMN for services other than UAS services and shall not include the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of REGISTRATION REQUEST message unless the UE receives a CONFIGURATION UPDATE COMMAND message including the service-level-AA service status indication in the Service-level-AA container IE with the UAS field set to "UAS services enabled". If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU2 NOT UPDATED, reset the tracking area updating attempt counter and enter the state EMM-REGISTERED. #80 (Disaster roaming for the determined PLMN with disaster condition not allowed). The UE shall abort the registration procedure for mobility and periodic registration update procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE. Additionally, the UE shall reset the registration attempt counter. The UE shall not attempt to register for disaster roaming on this PLMN for the determined PLMN with disaster condition for a period in the range of 12 to 24 hours. The UE shall not attempt to register for disaster roaming on this PLMN for a period in the range of 3 to 10 minutes. The UE shall perform PLMN selection as described in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition, the UE shall set the PLMN-specific attempt counter of the PLMN which sent the reject message for the determined PLMN with disaster condition to the UE implementation-specific maximum value. If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU2 NOT UPDATED, reset the tracking area updating attempt counter and enter the state EMM-REGISTERED. #81 (Selected N3IWF is not compatible with the allowed NSSAI). The UE shall abort the registration procedure for mobility and periodic registration update procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the N3IWF identifier IE is included in the REGISTRATION REJECT message and the UE supports slice-based N3IWF selection, the UE may use the provided N3IWF identifier IE in N3IWF selection as specified in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18] prior to an immediate consecutive initial registration attempt to the network, otherwise the UE shall ignore the N3IWF identifier IE. #82 (Selected TNGF is not compatible with the allowed NSSAI). The UE shall abort the registration procedure for mobility and periodic registration update procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the TNAN information IE is included in the REGISTRATION REJECT message and the UE supports slice-based TNGF selection, the UE may use the provided TNAN information IE in TNAN selection as specified in 3GPP TS 24.502[ Access to the 3GPP 5G Core Network (5GCN) via non-3GPP access networks ]  [18] prior to an immediate consecutive registration attempt to the network, otherwise the UE shall ignore the TNAN information IE. Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in subclause 5.5.1.3.7.