Content for TS 24.501 Word version: 18.0.1

1… 3… 4… 4.4… 4.4.3… 4.5… 4.5.3… 4.6… 4.7… 4.9… 4.15… 5… 5.2… 5.3… 5.3.2… 5.3.7… 5.3.19… 5.4… 5.4.1.3… 5.4.2… 5.4.4… 5.4.5… 5.4.6… 5.5… 5.5.1.2.4 5.5.1.2.5… 5.5.1.3… 5.5.1.3.4 5.5.1.3.5… 5.5.2… 5.6… 5.6.2… 6… 6.1.4… 6.2… 6.3… 6.3.2… 6.3.3… 6.4… 6.4.1.4… 6.4.2… 6.5… 7… 8… 8.2.9… 8.3… 9… 9.11.2… 9.11.2.10… 9.11.3… 9.11.3.4… 9.11.3.8… 9.11.3.14… 9.11.3.18C… 9.11.3.29… 9.11.3.33… 9.11.3.39… 9.11.3.45… 9.11.3.50… 9.11.3.53A… 9.11.3.68… 9.11.3.75… 9.11.4… 9.11.4.10… 9.11.4.13… 9.11.4.16… 9.11.4.30… 9.12 10… A… B… C… D… D.6… D.6.3…

5.5.1.2.5 Initial registration not accepted by the network 5.5.1.2.6 Initial registration for emergency services not accepted by the network 5.5.1.2.6A Initial registration for initiating an emergency PDU session not accepted by the network 5.5.1.2.7 Abnormal cases in the UE 5.5.1.2.8 Abnormal cases on the network side
...

5.5.1.2.5 Initial registration not accepted by the network p. 318

If the initial registration request cannot be accepted by the network, the AMF shall send a REGISTRATION REJECT message to the UE including an appropriate 5GMM cause value.

If the initial registration request is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

In NB-N1 mode, if the registration request is rejected due to operator determined barring (see TS 29.503), the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the REGISTRATION REJECT message with 5GMM cause #76 or #78 was received without integrity protection, then the UE shall discard the message. If the REGISTRATION REJECT message with 5GMM cause #62 was received without integrity protected, the behaviour of the UE is specified in subclause 5.3.20.2.

Based on operator policy, if the initial registration request is rejected due to core network redirection for CIoT optimizations, the network shall set the 5GMM cause value to #31 "Redirection to EPC required".

If the initial registration request is rejected because:

all the S-NSSAI(s) included in the requested NSSAI are rejected; and
the UE set the NSSAA bit in the 5GMM capability IE to:
1. "Network slice-specific authentication and authorization supported" and:
  1. void;
  2. all default S-NSSAIs are not allowed; or
  3. network slice-specific authentication and authorization has failed or been revoked for all default S-NSSAIs and based on network local policy, the network decides not to initiate the network slice-specific re-authentication and re-authorization procedures for any default S-NSSAI requested by the UE; or
2. "Network slice-specific authentication and authorization not supported" and all default S-NSSAIs are either not allowed or are subject to network slice-specific authentication and authorization;
  1. void
  2. void

the network shall set the 5GMM cause value to #62 "No network slices available" and shall include the rejected S-NSSAI(s) in the rejected NSSAI of the REGISTRATION REJECT message. Otherwise, the network may include the rejected S-NSSAI(s) in the rejected NSSAI of the REGISTRATION REJECT message.

If the UE has set the ER-NSSAI bit to "Extended rejected NSSAI supported" in the 5GMM capability IE of the REGISTRATION REQUEST message, the rejected S-NSSAI(s) shall be included in the Extended rejected NSSAI IE of the REGISTRATION REJECT message. Otherwise the rejected S-NSSAI(s) shall be included in the Rejected NSSAI IE of the REGISTRATION REJECT message.

If the UE supports extended rejected NSSAI and the AMF determines that maximum number of UEs reached for one or more S-NSSAIs in the requested NSSAI as specified in subclause 4.6.2.5, the AMF shall include the rejected NSSAI containing one or more S-NSSAIs with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE in the REGISTRATION REJECT message. In addition, the AMF may include a back-off timer value for each S-NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE of the REGISTRATION REJECT message.

If the AMF receives the initial registration request along with the authenticated indication over N2 reference point on non-3GPP access and does not receive the indication that authentication by the home network is not required over N12 reference point, the network shall set the 5GMM cause value to #72 "Non-3GPP access to 5GCN not allowed".

If the initial registration request from a UE supporting CAG is rejected due to CAG restrictions, the network shall set the 5GMM cause value to #76 "Not authorized for this CAG or authorized for CAG cells only" and should include the "CAG information list" in the CAG information list IE or the Extended CAG information list IE in the REGISTRATION REJECT message.

If the UE does not support extended CAG information list, the CAG information list shall not be included in the Extended CAG information list IE.

If the initial registration request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall operate as described in bullet j) of subclause 5.5.1.2.8.

If the UE's initial registration request is via a satellite NG-RAN cell and the network using the User Location Information provided by the NG-RAN, see TS 38.413, is able to determine that the UE is in a location where the network is not allowed to operate, the network shall set the 5GMM cause value in the REGISTRATION REJECT message to #78 "PLMN not allowed to operate at the present UE location".

If the AMF receives the initial registration request including the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE and the AMF determines that the UE is not allowed to use UAS services via 5GS based on the user's subscription data and the operator policy, the AMF shall return a REGISTRATION REJECT message with 5GMM cause #79 (UAS services not allowed).

If the UE initiates the registration procedure for disaster roaming and the AMF determines that it does not support providing disaster roaming services for the determined PLMN with disaster condition to the UE, then the AMF shall send a REGISTRATION REJECT message with 5GMM cause #80 (Disaster roaming for the determined PLMN with disaster condition not allowed).

Regardless of the 5GMM cause value received in the REGISTRATION REJECT message,

if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE in the REGISTRATION REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for roaming", the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for roaming" and remove the TAI(s) from the stored TAI list if present; and
if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the REGISTRATION REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for regional provision of service", the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for regional provision of service" and remove the TAI(s) from the stored TAI list if present.

Furthermore, the UE shall take the following actions depending on the 5GMM cause value received in the REGISTRATION REJECT message.

#3 (Illegal UE); or

#6 (Illegal ME).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.1;

In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall consider the entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.2.

If the UE is not performing initial registration for onboarding services in SNPN and the UE shall delete the list of equivalent PLMNs (if any) and enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events in case of SNPN if the UE maintains these counters;
to a UE implementation-specific maximum value.
delete the 5GMM parameters stored in non-volatile memory of the ME as specified in Annex C.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in TS 24.301 for the case when the EPS attach request procedure is rejected with the EMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a in TS 24.301. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to a UE implementation-specific maximum value.

If the UE is performing initial registration for onboarding services in SNPN, the UE shall reset the registration attempt counter, store the SNPN identity in the "permanently forbidden SNPNs" list for onboarding services, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to TS 23.122. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#7 (5GS services not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.1;

In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall consider the entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid for 5GS services until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.2.

If the UE is not performing initial registration for onboarding services in SNPN, the UE shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events in case of SNPN if the UE maintains these counters;

to a UE implementation-specific maximum value.

delete the 5GMM parameters stored in non-volatile memory of the ME as specified in Annex C.

#11 (PLMN not allowed).

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs and reset the registration attempt counter and store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in clause 5.3.19a.1. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to TS 23.122, and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in TS 24.502. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list, eKSI and attach attempt counter as specified in TS 24.301 for the case when the EPS attach request procedure is rejected with the EMM cause with the same value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same PLMN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#12 (Tracking area not allowed).

If:

the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

#13 (Roaming not allowed in this tracking area).

If:

the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

For 3GPP access, if the UE is registered in S1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in subclause 4.8.3. Otherwise the UE shall perform a PLMN selection or SNPN selection according to TS 23.122.

For non-3GPP access, the UE shall perform network selection as defined in TS 24.502.

#15 (No suitable cells in tracking area).

If:

the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

The UE shall search for a suitable cell in another tracking area according to TS 38.304 or TS 36.304.

If received over non-3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.2.7.

#22 (Congestion).

If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below; otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED, reset the registration attempt counter and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.

The UE shall stop timer T3346 if it is running.

If the REGISTRATION REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the REGISTRATION REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in TS 24.008.

The UE stays in the current serving cell and applies the normal cell reselection process. The initial registration procedure is started if still needed when timer T3346 expires or is stopped.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, and attach attempt counter as specified in TS 24.301 for the case when the EPS attach request procedure is rejected with the EMM cause with the same value.

If the UE is registering for onboarding services in SNPN, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to TS 23.122.

#27 (N1 mode not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter and shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set:

1) the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or

2) the SNPN-specific attempt counter for 3GPP access for the current SNPN in case of SNPN and the SNPN-specific attempt counter for non-3GPP access for the current SNPN;

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for the specific access type for which the message was received (see subclause 4.9).

If the message has been successfully integrity checked by the NAS, the UE shall disable the N1 mode capability also for the other access type (see subclause 4.9).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#31 (Redirection to EPC required).

5GMM cause #31 received by a UE that has not indicated support for CIoT optimizations or not indicated support for S1 mode or received by a UE over non-3GPP access is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall enable the E-UTRA capability if it was disabled, disable the N1 mode capability for 3GPP access (see subclause 4.9.2) and enter the 5GMM-DEREGISTERED.NO-CELL-AVAILABLE.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, TAI list, eKSI and attach attempt counter as specified in TS 24.301 for the case when the EPS attach procedure is rejected with the EMM cause with the same value.

#62 (No network slices available).

The UE receiving the rejected NSSAI in the REGISTRATION REJECT message takes the following actions based on the rejection cause in the rejected S-NSSAI(s):

"S-NSSAI not available in the current PLMN or SNPN"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN or SNPN as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current PLMN or SNPN until switching off the UE, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.2.2.

"S-NSSAI not available in the current registration area"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as described in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current registration area until switching off the UE, the UE moving out of the current registration area, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.2.2.

"S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the failed or revoked NSSAA as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over any access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed or deleted as described in subclause 4.6.1 and 4.6.2.2.

"S-NSSAI not available due to maximum number of UEs reached"

Unless the back-off timer value received along with the S-NSSAI is zero, the UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the maximum number of UEs reached as specified in subclause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over the current access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2.

If there is one or more S-NSSAIs in the rejected NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached", then for each S-NSSAI, the UE shall behave as follows:

stop the timer T3526 associated with the S-NSSAI, if running;
start the timer T3526 with:
1. the back-off timer value received along with the S-NSSAI, if a back-off timer value is received along with the S-NSSAI that is neither zero nor deactivated; or
2. an implementation specific back-off timer value, if no back-off timer value is received along with the S-NSSAI; and
remove the S-NSSAI from the rejected NSSAI for the maximum number of UEs reached when the timer T3526 associated with the S-NSSAI expires.

If the UE has an allowed NSSAI or configured NSSAI that contains S-NSSAI(s) which are not included in the rejected NSSAI the UE may stay in the current serving cell, apply the normal cell reselection process and start an initial registration with a requested NSSAI that includes any S-NSSAI from the allowed NSSAI or the configured NSSAI that is not in the rejected NSSAI. Otherwise the UE may perform a PLMN selection or SNPN selection according to TS 23.122 and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if the UE does not have an allowed NSSAI and each S-NSSAI in configured NSSAI, if available, was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in subclause 4.9.

If the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and,

if at least one S-NSSAI in the default configured NSSAI is not rejected, the UE may stay in the current serving cell, apply the normal cell reselection process, and start an initial registration with a requested NSSAI with that default configured NSSAI; or
if all the S-NSSAI(s) in the default configured NSSAI are rejected and at least one S-NSSAI is rejected due to "S-NSSAI not available in the current registration area",
1. if the REGISTRATION REJECT message is integrity protected and the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; or
2. if the REGISTRATION REJECT message is integrity protected and the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

Otherwise, the UE may perform a PLMN selection or SNPN selection according to TS 23.122 and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if each S-NSSAI in the default configured NSSAI was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in subclause 4.9.

If the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and has rejected NSSAI for the reached maximum number of UEs, and the UE wants to obtain services in the current serving cell without performing a PLMN selection or SNPN selection, the UE may stay in the current serving cell and attempt to use the rejected S-NSSAI(s) for the maximum number of UEs reached in the current serving cell after the rejected S-NSSAI(s) are removed as described in subclause 4.6.2.2.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU2 NOT UPDATED, reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#72 (Non-3GPP access to 5GCN not allowed).

When received over non-3GPP access the UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED. If the message has been successfully integrity checked by the NAS, the UE shall set:

the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN: or
the SNPN-specific attempt counter for non-3GPP access for that SNPN in case of SNPN;

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for non-3GPP access (see subclause 4.9.3).

As an implementation option, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to TS 23.122.

If received over 3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.1.2.7.

#73 (Serving network not authorized).

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs, reset the registration attempt counter, store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to TS 23.122, and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in TS 24.502. If the message has been successfully integrity checked by the NAS, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

#74 (Temporarily not authorized for this SNPN).

5GMM cause #74 is only applicable when received from a cell belonging to an SNPN. 5GMM cause #74 received from a cell not belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall reset the registration attempt counter and store the SNPN identity in the "temporarily forbidden SNPNs" list for the specific access type for which the message was received and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the registration request is not for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to TS 23.122. If the registration request is for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to TS 23.122. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#75 (Permanently not authorized for this SNPN).

5GMM cause #75 is only applicable when received from a cell belonging to an SNPN with a globally-unique SNPN identity. 5GMM cause #75 received from a cell not belonging to an SNPN or a cell belonging to an SNPN with a non-globally-unique SNPN identity is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall reset the registration attempt counter and store the SNPN identity in the "permanently forbidden SNPNs" list for the specific access type for which the message was received and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the registration request is not for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to TS 23.122. If the registration request is for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to TS 23.122. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

#76 (Not authorized for this CAG or authorized for CAG cells only).

This cause value received via non-3GPP access or from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED, store the 5GS update status according to clause 5.1.3.2.2, and reset the registration attempt counter.

If 5GMM cause #76 is received from:

a CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall:
1. replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN;
2. replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or
  
  NOTE 12:
  When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.
3. remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry.
Otherwise, then the UE shall delete the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN. In the case the "allowed CAG list" for the current PLMN only contains a range of CAG-IDs, how the UE deletes the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN is up to UE implementation. In addition:
1. if the entry in the "CAG information list" for the current PLMN does not include an "indication that the UE is only allowed to access 5GS via CAG cells" or if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and the updated "allowed CAG list" for the current PLMN includes one or more CAG-IDs, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to TS 38.304 or TS 36.304 with the updated "CAG information list";
2. if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and the updated "allowed CAG list" for the current PLMN does not include any CAG-ID, then the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in TS 23.122 with the updated "CAG information list"; or
3. if the "CAG information list" does not include an entry for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to TS 38.304 or TS 36.304 with the updated "CAG information list".
a non-CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall:
1. replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN;
2. replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or
  
  NOTE 13:
  When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.
3. remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry.
Otherwise, the UE shall store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN, if any. If the "CAG information list" stored in the UE does not include the current PLMN's entry, the UE shall add an entry for the current PLMN to the "CAG information list" and store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN. If the UE does not have a stored "CAG information list", the UE shall create a new "CAG information list" and add an entry with an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN.
In addition:
1. if the "allowed CAG list" for the current PLMN includes one or more CAG-IDs, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to TS 38.304 with the updated CAG information; or
2. if the "allowed CAG list" for the current PLMN does not include any CAG-ID, then the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in TS 23.122 with the updated "CAG information list".

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#77 (Wireline access area not allowed).

5GMM cause #77 is only applicable when received from a wireline access network by the 5G-RG or the W-AGF acting on behalf of the FN-CRG. 5GMM cause #77 received from a 5G access network other than a wireline access network and 5GMM cause #77 received by the W-AGF acting on behalf of the FN-BRG are considered as abnormal cases and the behaviour of the UE is specified in subclause 5.5.1.2.7.

When received over wireline access network, the 5G-RG and the W-AGF acting on behalf of the FN-CRG shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2), shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI, shall reset the registration attempt counter, shall enter the state 5GMM-DEREGISTERED and shall act as specified in subclause 5.3.23.

#78 (PLMN not allowed to operate at the present UE location).

This cause value received from a non-satellite NG-RAN cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location" and shall start a corresponding timer instance (see subclause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to TS 23.122.

#79 (UAS services not allowed).

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED. ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the UE re-attempt the registration procedure to the current PLMN, the UE shall not include the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of REGISTRATION REQUEST message.

#80 (Disaster roaming for the determined PLMN with disaster condition not allowed).

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED, enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall not attempt to register for disaster roaming on this PLMN for the determined PLMN with disaster condition for a period in the range of 12 to 24 hours. The UE shall not attempt to register for disaster roaming on this PLMN for a period in the range of 3 to 10 minutes. The UE shall perform PLMN selection as described in TS 23.122.

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in subclause 5.5.1.2.7.

5.5.1.2.6 Initial registration for emergency services not accepted by the network p. 331

Upon receiving the REGISTRATION REJECT message including 5GMM cause #5 "PEI not accepted", the UE shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the REGISTRATION REJECT message is received,

over 3GPP access; or
over non-3GPP access and is integrity protected;

and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

Upon receiving the REGISTRATION REJECT message including 5GMM cause value which is not #5 "PEI not accepted", the UE shall perform the actions as described in subclause 5.5.1.2.5 with the following addition: the UE shall inform the upper layers of the failure of the procedure.

If the initial registration request for emergency services fails due to abnormal cases, the UE shall perform the actions as described in subclause 5.5.1.2.7 and inform the upper layers of the failure to access the network or the failure of the procedure.

In a shared network, upon receiving the REGISTRATION REJECT message, the UE shall perform the actions as described in subclause 5.5.1.2.5, and shall:

inform the upper layers of the failure of the procedure; or

NOTE 3:
The upper layers can request implementation specific mechanisms, e.g. procedures specified in TS 24.229 that can result in the emergency call being attempted to another IP-CAN.
attempt to perform a PLMN selection in the shared network and, if an initial registration for emergency services was not already attempted with the selected PLMN and the REGISTRATION REQUEST message, for which the REGISTRATION REJECT message was received, is:
- not for sending a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing emergency PDU session", initiate an initial registration for emergency services with the selected PLMN; or
- for sending a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing emergency PDU session", and:
  1. the selected PLMN is an equivalent PLMN, initiate an initial registration for emergency services with the selected PLMN; and
  2. the selected PLMN is not an equivalent PLMN, perform a PLMN selection and initiate an initial registration for emergency services with the selected PLMN if an initial registration for emergency services was not already attempted with the selected PLMN.

In a shared network, if the initial registration request for emergency services fails due to abnormal cases, the UE shall perform the actions as described in subclause 5.5.1.2.7 and shall:

inform the upper layers of the failure of the procedure; or

NOTE 4:
The upper layers can request implementation specific mechanisms, e.g. procedures specified in TS 24.229 that can result in the emergency call being attempted to another IP-CAN.
attempt to perform a PLMN selection in the shared network and, if an initial registration for emergency services was not already attempted with the selected PLMN and the REGISTRATION REQUEST message is:
- not for sending a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing emergency PDU session", initiate an initial registration for emergency services with the selected PLMN; or
- for sending a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing emergency PDU session", and:
  1. the selected PLMN is an equivalent PLMN, initiate an initial registration for emergency services with the selected PLMN; and
  2. the selected PLMN is not an equivalent PLMN, perform a PLMN selection and initiate an initial registration for emergency services with the selected PLMN if an initial registration for emergency services was not already attempted with the selected PLMN.

5.5.1.2.6A Initial registration for initiating an emergency PDU session not accepted by the network p. 332

If the network cannot accept an initial registration request with 5GS registration type IE set to "initial registration" and for sending a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "initial emergency request", the UE shall perform the procedures as described in subclause 5.5.1.2.5. Then if the UE is in the same selected PLMN where the last initial registration request was attempted, the UE shall:

inform the upper layers of the failure of the procedure; or

NOTE 1:
This can result in the upper layers requesting implementation specific mechanisms, e.g. procedures specified in TS 24.229 can result in the emergency call being attempted to another IP-CAN.
attempt initial registration for emergency services.

If the network cannot accept an initial registration request with 5GS registration type IE set to "initial registration", for establishing an emergency PDU session and the PDU session needs to be established due to handover of an existing PDN connection for emergency bearer services, the UE shall perform the procedures as described in subclause 5.5.1.2.5. Then if the UE is in the same selected PLMN or equivalent PLMN where the last initial registration request was attempted, the UE shall attempt initial registration for emergency services.

If the initial registration request, with 5GS registration type IE set to "initial registration" and for initiating an emergency PDU session, fails due to abnormal case b) in subclause 5.5.1.2.7, the UE shall perform the actions as described in subclause 5.5.1.2.7 and inform the upper layers of the failure to access the network.

If the initial registration request, with 5GS registration type IE set to "initial registration" and for initiating an emergency PDU session, fails due to abnormal cases c), d) or e) in subclause 5.5.1.2.7, the UE shall perform the actions as described in subclause 5.5.1.2.7. Then if the UE is in:

the same selected PLMN where the last initial registration request was attempted and the PDU session does not need to be established due to handover of an existing PDN connection for emergency bearer services, the UE shall:
- inform the upper layers of the failure of the procedure; or
  
  NOTE 3:
  This can result in the upper layers requesting implementation specific mechanisms, e.g. procedures specified in TS 24.229 can result in the emergency call being attempted to another IP-CAN.
- attempt initial registration for emergency services; or
the same selected PLMN or equivalent PLMN where the last initial registration request was attempted and the PDU session needs to be established due to handover of an existing PDN connection for emergency bearer services, attempt initial registration for emergency services.

5.5.1.2.7 Abnormal cases in the UE p. 333

The following abnormal cases can be identified:

Timer T3346 is running.

The UE shall not start the registration procedure for initial registration unless:

the UE is a UE configured for high priority access in selected PLMN;
the UE needs to perform the registration procedure for initial registration for emergency services;
the UE receives a DEREGISTRATION REQUEST message with the "re-registration required" indication;
the UE in NB-N1 mode is requested by the upper layer to transmit user data related to an exceptional event and:
- the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in TS 24.368 or the USIM file EFNASCONFIG in TS 31.102); and
- timer T3346 was not started when N1 NAS signalling connection was established with RRC establishment cause set to "mo-ExceptionData"; or
the UE needs to perform the registration procedure with 5GS registration type IE set to "initial registration" for initiating of an emergency PDU session, upon request of the upper layers to establish the emergency PDU session.

The UE stays in the current serving cell and applies the normal cell reselection process.

The lower layers indicate that the access attempt is barred.

The UE shall not start the initial registration procedure. The UE stays in the current serving cell and applies the normal cell reselection process. Receipt of the access barred indication shall not trigger the selection of a different core network type (EPC or 5GCN).

The initial registration procedure is started, if still needed, when the lower layers indicate that the barring is alleviated for the access category with which the access attempt was associated.

ba.

The lower layers indicate that:

access barring is applicable for all access categories except categories 0 and 2 and the access category with which the access attempt was associated is other than 0 and 2; or
access barring is applicable for all access categories except category 0 and the access category with which the access attempt was associated is other than 0.

If the REGISTRATION REQUEST message has not been sent, the UE shall proceed as specified for case b. If the REGISTRATION REQUEST message has been sent, the UE shall proceed as specified for case e and, additionally, the registration procedure for initial registration is started, if still needed, when the lower layers indicate that the barring is alleviated for the access category with which the access attempt was associated.

T3510 timeout.

The UE shall abort the registration procedure for initial registration and the NAS signalling connection, if any, shall be released locally if the initial registration request is neither for emergency services nor for initiating a PDU session for emergency services with request type set to "existing emergency PDU session". The UE shall proceed as described below.

REGISTRATION REJECT message, other 5GMM cause values than those treated in subclause 5.5.1.2.5, and cases of 5GMM cause values #11, #15, #22, #31, #72, #73, #74, #75, #76, #77 and #78, if considered as abnormal cases according to subclause 5.5.1.2.5.

If the registration request is neither an initial registration request for emergency services nor an initial registration request for initiating a PDU session for emergency services with request type set to "existing emergency PDU session", upon reception of the 5GMM causes #95, #96, #97, #99 and #111 the UE should set the registration attempt counter to 5.

The UE shall proceed as described below.

Lower layer failure or release of the NAS signalling connection received from lower layers before the REGISTRATION ACCEPT or REGISTRATION REJECT message is received.

The UE shall abort the registration procedure for initial registration and proceed as described below.

UE initiated de-registration required.

The registration procedure for initial registration shall be aborted, and the UE initiated de-registration procedure shall be performed.

De-registration procedure collision.

If the UE receives a DEREGISTRATION REQUEST message from the network in state 5GMM-REGISTERED-INITIATED the de-registration procedure shall be aborted and the initial registration procedure shall be progressed.

h) Change in the current TAI.

If the current TAI is changed before the registration procedure for initial registration is completed, the registration procedure for initial registration shall be aborted and re-initiated immediately.

If the REGISTRATION COMPLETE message needs to be sent and a tracking area border is crossed when the REGISTRATION ACCEPT message has been received but before a REGISTRATION COMPLETE message is sent and:

if the current TAI is in the TAI list, the UE sends the REGISTRATION COMPLETE message to the network; and
otherwise, the registration procedure for initial registration shall be aborted and the registration procedure for mobility registration update shall be initiated.

If a 5G-GUTI was allocated during the registration procedure, this 5G-GUTI shall be used in the registration procedure.

Transmission failure of REGISTRATION COMPLETE message indication with change in the current TAI.

If the current TAI is still part of the TAI list, the UE resends the REGISTRATION COMPLETE message to the network; and
otherwise, the registration procedure for initial registration shall be aborted and the registration procedure for mobility registration update shall be initiated.

Transmission failure of REGISTRATION COMPLETE message indication without change in the current TAI from lower layers.

It is up to the UE implementation how to re-run the ongoing procedure.

Transmission failure of REGISTRATION REQUEST message indication from the lower layers.

The registration procedure for initial registration shall be aborted and re-initiated immediately.

Timer T3447 is running.

The UE shall not start the registration procedure for initial registration with Follow-on request indicator set to "Follow-on request pending" unless:

the UE is a UE configured for high priority access in selected PLMN; or
the UE needs to perform the registration procedure for initial registration for emergency services.

The UE stays in the current serving cell and applies the normal cell reselection process. The registration procedure for initial registration is started, if still necessary, when timer T3447 expires or timer T3447 is stopped.

UE is not registered to the access other than the access the REGISTRATION ACCEPT message is received and the 5GS registration result value in the 5GS registration result IE value in the REGISTRATION ACCEPT message is set to "3GPP access and non-3GPP access".

The UE shall consider itself as being registered to only the access where the REGISTRATION ACCEPT message is received.

For the cases c, d and e, the UE shall proceed as follows:

Timer T3510 shall be stopped if still running.

If the registration procedure is neither an initial registration for emergency services nor for establishing an emergency PDU session with registration type not set to "emergency registration", the registration attempt counter shall be incremented, unless it was already set to 5.

If the registration attempt counter is less than 5:

if the initial registration request is not for emergency services, timer T3511 is started and the state is changed to 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION. When timer T3511 expires the registration procedure for initial registration shall be restarted, if still required.

If the registration attempt counter is equal to 5

the UE shall delete 5G-GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs (if any), and ngKSI, start timer T3502 and shall set the 5GS update status to 5U2 NOT UPDATED. The state is changed to 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION or optionally to 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection, SNPN selection according to TS 23.122.
if the procedure is performed via 3GPP access and the UE is operating in single-registration mode:
- the UE shall in addition handle the EMM parameters EPS update status, EMM state, 4G-GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs and eKSI as specified in TS 24.301 for the abnormal cases when an EPS attach procedure fails and the attach attempt counter is equal to 5; and
- the UE shall attempt to select E-UTRAN radio access technology and proceed with appropriate EMM specific procedures. Additionally, The UE may disable the N1 mode capability as specified in subclause 4.9.

5.5.1.2.8 Abnormal cases on the network side p. 335

The following abnormal cases can be identified:

Lower layer failure
If a lower layer failure occurs before the REGISTRATION COMPLETE message has been received from the UE and timer T3550 is running, the AMF shall locally abort the registration procedure for initial registration, enter state 5GMM-REGISTERED and shall not resend the REGISTRATION ACCEPT message. If a new 5G-GUTI was assigned to the UE in the registration procedure for initial registration, the AMF shall consider both the old and the new 5G-GUTI as valid until the old 5G-GUTI can be considered as invalid by the AMF or the 5GMM context which has been marked as deregistered in the AMF is released. If the old 5G-GUTI was allocated by an AMF other than the current AMF, the current AMF does not need to retain the old 5G-GUTI. During this period the network may use the identification procedure followed by a generic UE configuration update procedure if the old 5G-GUTI is used by the UE in a subsequent message.
Protocol error
If the REGISTRATION REQUEST message is received with a protocol error, the AMF shall return a REGISTRATION REJECT message with one of the following 5GMM cause values:

#96
invalid mandatory information;

#99
information element non-existent or not implemented;

#100
conditional IE error; or

#111
protocol error, unspecified.
T3550 time-out
On the first expiry of the timer, the AMF shall retransmit the REGISTRATION ACCEPT message and shall reset and restart timer T3550.
This retransmission is repeated four times, i.e. on the fifth expiry of timer T3550, the registration procedure for initial registration shall be aborted and the AMF enters state 5GMM-REGISTERED. If a new 5G-GUTI was allocated in the REGISTRATION ACCEPT message, the AMF shall consider both the old and the new 5G-GUTIs as valid until the old 5G-GUTI can be considered as invalid by the AMF or the 5GMM context which has been marked as de-registered in the AMF is released. If the old 5G-GUTI was allocated by an AMF other than the current AMF, the current AMF does not need to retain the old 5G-GUTI. During this period, if the old 5G-GUTI is used by the UE in a subsequent message, the AMF acts as specified for case a) above.
REGISTRATION REQUEST message received after the REGISTRATION ACCEPT message has been sent and before the REGISTRATION COMPLETE message is received, if the REGISTRATION COMPLETE message is expected.
1. If one or more of the information elements in the REGISTRATION REQUEST message differ from the ones received within the previous REGISTRATION REQUEST message, the previously initiated the registration procedure for initial registration shall be aborted if the REGISTRATION COMPLETE message has not been received and the new registration procedure for initial registration shall be progressed; or
2. if the information elements do not differ, then the REGISTRATION ACCEPT message shall be resent and the timer T3550 shall be restarted. In that case, the retransmission counter related to T3550 is not incremented.
More than one REGISTRATION REQUEST message with 5GS registration type IE set to "initial registration" received and no REGISTRATION ACCEPT message or REGISTRATION REJECT message has been sent.
1. If one or more of the information elements in the REGISTRATION REQUEST message with 5GS registration type IE set to "initial registration" differs from the ones received within the previous REGISTRATION REQUEST message with 5GS registration type IE set to "initial registration", the previously initiated the registration procedure for initial registration shall be aborted and the new the registration procedure for initial registration shall be executed;
2. if the information elements do not differ, then the network shall continue with the previous the registration procedure for initial registration and shall ignore the second REGISTRATION REQUEST message.
REGISTRATION REQUEST message with 5GS registration type IE set to "initial registration" received in state 5GMM-REGISTERED.
If a REGISTRATION REQUEST message with 5GS registration type IE set to "initial registration" is received in state 5GMM-REGISTERED the network may initiate the 5GMM common procedures; if it turned out that the REGISTRATION REQUEST message was sent by a genuine UE that has already been registered, the 5GMM context, if any, are deleted and the new REGISTRATION REQUEST is progressed, otherwise if network considers REGISTRATION REQUEST message was not sent by a genuine UE based on authentication procedure the network shall maintain the 5GMM-context, if any, unchanged.

NOTE 1:
The network can determine that the UE is genuine by executing the authentication procedure as described in subclause 5.4.1.
REGISTRATION REQUEST message with 5GS registration type IE set to "mobility registration updating" or "periodic registration updating" received before REGISTRATION COMPLETE message, if the REGISTRATION COMPLETE message is expected.
Timer T3550 shall be stopped. The allocated 5G-GUTI in the registration procedure for initial registration shall be considered as valid and the registration procedure for mobility and periodic update shall be progressed as described in subclause 5.5.1.3.
DEREGISTRATION REQUEST message received before REGISTRATION COMPLETE message, if the REGISTRATION COMPLETE message is expected.
The AMF shall abort the registration procedure for initial registration and shall progress the de-registration procedure as described in subclause 5.5.2.2.
UE security capabilities invalid or unacceptable
If the REGISTRATION REQUEST message is received with invalid or unacceptable UE security capabilities (e.g. no 5GS encryption algorithms (all bits zero), no 5GS integrity algorithms (all bits zero), mandatory 5GS encryption algorithms not supported or mandatory 5GS integrity algorithms not supported, etc.), the AMF shall return a REGISTRATION REJECT message.

NOTE 2:
5GMM cause value to be used in REGISTRATION REJECT message is up to the network implementation.
Based on operator policy, if the initial registration request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall reject the initial registration with a 5GMM cause value other than the 5GMM cause #76 (Not authorized for this CAG or authorized for CAG cells only).

NOTE 3:
5GMM cause #7 (5GS services not allowed), 5GMM cause #11 (PLMN not allowed), 5GMM cause #27 (N1 mode not allowed), 5GMM cause #73 (Serving network not authorized) can be used depending on the subscription of the UE and whether the UE roams or not.