When a UE attaches to the mobile network, the RAN selects the appropriate core network for the UE taking into account, among other things (TS 38.300
UE's selected PLMN;
UE location information (including the serving cell as known to the serving RAN node).
With NTN it is possible to deploy very large cells over large portions of a continent (possibly covering different countries), with the different core networks for the various countries connected to the same NTN RAN (MOCN network sharing scenario). In such a scenario, it may not always be possible to correctly determine the appropriate core network for a connecting UE, especially close to country borders, because the serving cell information may not be granular enough.
Furthermore, a malicious UE might "fake"
its selected PLMN in order to attempt connecting to a different core network. Upon such an attempt the AMF will disconnect the UE and inform the RAN node via an appropriate NGAP cause value, so the RAN can take appropriate action on subsequent attempts by the same UE.
The UE may send GNSS measurements to the RAN over RRC, but this has at least the following drawbacks:
In principle, just as a malicious UE could fake its selected PLMN, it could also fake its GNSS measurements;
Sending GNSS measurements over RRC before AS security is set up raises security and privacy issues.
Because of the above, relying only on signalling GNSS measurements over RRC is not considered a viable solution to this issue.
As recommended in SA3 LS to RAN2 (R2-2204458) the location information is sent after NAS security is established. Even after NAS security establishment, user consent for obtaining UE location information may also be required depending on regional regulation and policy.
The RAN can also request radio measurements (intra-RAT neighbours, inter-RAT neighbours, WLAN, etc.) from the UE; these may be used to drive NNSF and to learn from the environment.
Some further observations:
At least some of the information the UE supplies to the network will have to be considered as trusted, to avoid extreme conclusions (at least RRC measurements cannot be faked);
Core networks connecting to the same shared RAN will always require some degree of common coordination / configuration: this is typically the case for network sharing (especially MOCN). For NTN, this may include e.g. specific timer settings/behaviour for UE connection attempts;
Due to mere traffic load considerations, it may not be desirable to cover whole portions of a continent, including multiple countries, with a single cell. Therefore, in real deployments the served cell information may typically be more granular than in the extreme case envisaged so far.
The above has been deemed sufficient to mitigate the issue in Rel-17.
A 5G system with satellite access shall be able to determine a UE's location in order to provide service (e.g. route traffic, support emergency calls) in accordance with the governing national or regional regulatory requirements applicable to that UE. (clause 18.104.22.168 of TS 22.261
Because of this, even when providing services over entire continents with NTN, there is no "globally harmonized"
set of requirements that overrules local ones. This is also valid for UE location information. In this respect, there is no difference between NTN and terrestrial networks.
Because of the above, for NTN the same required granularity for UE location information estimated via GNSS should be considered as for terrestrial networks.
Network operators of 3GPP defined non-terrestrial network, have to know reliably the location information of a UE attached to the network in order to select the appropriate core network. Once the appropriate core network has been selected for a UE, it is possible to support some services subject to national regulations or other operational constraints.
In TR 23.737
, the list of such services has been identified in key issue #10:
Public Warning System (PWS)
Lawful interception (LI)
Emergency services (EMS)
Charging and Tariff notifications
In TR 22.926
, it has been identified that "To support regulated services and features (e.g. Public Warning System, Charging and Billing, Emergency calls, Lawful Intercept, Data Retention Policy in cross-border scenarios and international regions, Network access), 3GPP networks should have the capability to locate each UE in a reliable manner and determine the policy that applies to their operation depending on their location and/or context."
Furthermore, in 
, it is pointed out that "any solution addressing extraterritorial (e.g. international maritime zone and aeronautical) use cases should provide means to notify the HPLMN on roaming in and out of those areas, including the cases when the serving PLMN has not changed."
Relying only on the GNSS based location information reported by the UE is not considered reliable by SA3-LI 
The UE reported location information (for example determined with its GNSS receiver), could be erroneous due to intentional (e.g. maliciously tampering by user or by 3rd party) or unintentional (e.g. interference) causes, hence it cannot be considered trusted by network operators.
Already 3GPP has defined a network based functionality to verify the reported UE location with the identifier of the serving cell. However, radio cells in non-terrestrial networks, may be larger than the ones of terrestrial networks and may cover borders between two or more countries. Therefore, such Cell Id information may not be sufficient to discriminate the country in which the UE is located.
It is expected that solutions combining both UE reported GNSS information and network based information for verification of UE location can improve the reliability of core network selection in non-terrestrial networks. This is important for
Services subject to national regulations or other operational constraints. (e.g. Public Warning System (PWS), Lawful interception (LI), Emergency services (EMS), Charging and Tariff notifications).
Cases where the UE reported location information (for example determined with its GNSS receiver), could be erroneous due to intentional (e.g. maliciously tampering by user or by 3rd party) or unintentional (e.g. interference) causes.
NTN radio cells larger than terrestrial network radio cells and possibly covering borders between two or more countries.
In order to define an appropriate network based solution to verify UE location, it is necessary to determine requirements for the verification accuracy. Note that these requirements should not be assumed to be the same as the regulatory requirements applicable to the UE location in terms of Accuracy, Reliability (related to law enforcement and liability), Latency and Privacy as identified in Annex A
As identified in Annex A.2
, SA3-LI recommends in S3i200056 
that "The logical location shall unambiguously map to the geographical area of the UE physical location. Granularity of such geographical areas needs to be able to provide network location accuracy comparable with terrestrial networks."
In terrestrial networks, verification is based on Cell Id and hence, the targeted granularity is related to cell size. Similar granularity should be considered for NTN. Terrestrial macro cell size is assumed to be up to 5-10 km diameter.
Most UE positioning functionality is typically UE-associated, i.e., it assumes that a UE context is present for the UE being positioned. This means that the UE itself has already completed the initial access procedures. Because of this, all observations and mitigations already discussed in Rel-17 are still relevant and applicable.