Your Car’s Security Data Is Not Public Information.
When a locksmith programmes a key or resets your immobiliser, they access the most sensitive part of your vehicle. A transponder code. An immobiliser network. Data that could be used to clone your key. Since 2023, European law has restricted access to this data to certified operators only — and most locksmiths in East London are not certified. We are.
Approved
Repair & Maintenance
Information
Since 2023, Accessing Your Car’s Security Data Requires Certification. Most Locksmiths Don’t Have It.
SERMI — the Security, Vehicle Repair and Maintenance Information scheme — was introduced under EU Regulation 2018/858 and adopted in UK legislation to solve a specific problem: the wrong people getting access to immobiliser codes, transponder data, and electronic security systems. Before SERMI, any locksmith could request this data. After SERMI, only certified operators can. The certification requires criminal record checks, insurance, and a formal accreditation process — and it expires. You cannot hold it indefinitely.
The locksmith industry remains largely unregulated in the UK. Anyone can trade as an auto locksmith with no licence, no insurance requirement, and no criminal record check. But since 2023, the data that powers modern automotive locksmith work — immobiliser codes, transponder programming data, security access information — sits behind a legal gate.
To access it legitimately, you need SERMI certification. That means a criminal background check, a formal accreditation process verified by an independent certification body, and proof of adequate insurance. The certification is not permanent — it must be renewed. Lose compliance and it lapses.
- ✓Criminal background check — mandatory before certification is issued or renewed
- ✓Identity verification — personal, not business-level only
- ✓Insurance thresholds — verified as a condition of access to security data
- ✓Formal accreditation process — assessed by an independent certification body
- ✓Certificate expiry — cannot be held indefinitely; compliance must be maintained
- ✓Data access logging — security information requests are traceable under the framework
What Does “Security Data” Actually Mean for Your Car?
Immobiliser codes, transponder programming, what gets accessed during a key replacement job
Explained
▾
Modern vehicle keys are not blanks cut to a shape. They contain a transponder chip — a microprocessor that communicates with your car’s immobiliser. When the car detects the correct coded signal from that transponder, it allows the engine to start. Without it, or with the wrong code, the immobiliser activates and the engine will not run.
Replacing or programming a key means accessing the immobiliser network and writing the correct transponder code to a new key. To do that, a locksmith must obtain the security data for your specific vehicle from the manufacturer’s systems. That data — your car’s security codes — is what SERMI controls access to. In the wrong hands, it could be used to clone a key silently. That is precisely why the regulation exists.
- ✓Transponder code — the unique identifier the immobiliser recognises
- ✓Immobiliser pin or security token — required to write new keys to the system
- ✓ECU/BCM security parameters — on some vehicles, module-level security data
- ✓Key slot data — which key positions are active, which have been deleted
There have been multiple documented cases in the UK of vehicle security data being obtained through non-compliant channels and used in keyless entry theft operations. SERMI does not guarantee your locksmith is skilled. It guarantees they passed a background check, hold insurance, and accessed your vehicle’s security data through a legally controlled, logged route.
Who Is Actually Coming to Your Vehicle?
SERMI background checks · What uncertified operators skip · Why it matters when someone accesses your security systems
Verified
▾
An auto locksmith programmes a key that starts your car and grants physical access to everything inside it. They request security data that — in the wrong hands — could be used to silently duplicate that key. The individual doing this work has had more access to your vehicle’s security architecture in one hour than most people ever will.
SERMI certification requires that every individual operating under the scheme has undergone a criminal background check. Not the business. The person. Identity confirmed. Record checked. Insurance verified. The certification is personal — it cannot be transferred to a colleague who hasn’t been through the same process.
- ✓Criminal background check — a requirement, not a choice
- ✓Identity verified at personal level before certification is issued
- ✓Insurance confirmed as part of the accreditation process
- ✓Certificate is personal and non-transferable
Our technician carries their SERMI certificate. It is a physical document confirming that this individual — not just the company — has been background-checked and certified to access vehicle security data.
For fleet operators, SERMI certification provides a clear, documentable standard for supplier compliance records — with a defined legal framework you can reference.
What Happens If Something Goes Wrong?
Insurance under SERMI · The gap uncertified operators leave you with · Your actual route to resolution
Covered
▾
Modern vehicle key programming involves your ECU, your BCM, and your immobiliser network. An error — the wrong data written, an interrupted programming cycle, incorrect security parameters — can cause hundreds or thousands of pounds in diagnostic and repair costs. If your locksmith carries no verifiable insurance, that cost lands entirely with you.
SERMI certification requires adequate insurance as a condition of access to vehicle security data. It is not a voluntary declaration. It is a prerequisite — and it is checked as part of the certification process, not taken on trust.
- ✓Public liability — damage or injury to third parties during our work
- ✓Professional indemnity — financial loss resulting from errors in our work
- ✓Verified as part of SERMI certification — not self-reported
- ✓Certificates available on request for commercial customers
An uncertified operator has no formal framework requiring them to hold insurance. If your ECU is damaged during an incorrect programming attempt, you are pursuing a private individual with no verified cover. There is no formal complaints route. There is no certification body. There is only you, and them, and no paper trail that obligates them to anything.
Why “I’ve Been Doing This for 20 Years” Is Not the Answer.
Experience vs. legal authorisation · Why SERMI matters regardless of how good your locksmith is
Critical
▾
A skilled locksmith who is not SERMI certified may well be able to do the job. That is not the issue. The issue is the route they took to access your vehicle’s security data — and what happens to that data afterwards. Skill does not make unauthorised access to security-sensitive information acceptable. It makes it more sophisticated.
SERMI is not a competency test. It is a legal access control. It exists to ensure that the individual handling your immobiliser codes and transponder data has been background-checked, is insured, and is accessing that information through a logged, regulated channel. No amount of experience substitutes for that.
- ✕No background check required before accessing your car’s security systems
- ✕Insurance not verified — or may not exist at all
- ✕Security data sourced through non-compliant channels — not logged or regulated
- ✕No formal complaints route if something goes wrong
- ✕Claims of experience are self-declared and unverifiable
- ✕Data handling entirely at their discretion
- ✓Criminal background check completed before certification issued
- ✓Insurance independently verified as part of the accreditation process
- ✓Security data accessed through regulated, logged, legally-compliant channels
- ✓Certificate is personal, non-transferable, and available to view on request
- ✓Technical competency demonstrated through formal assessment
- ✓Certification document available for your records or supplier compliance file
Vehicle Manufacturers on the SERMI Scheme
SERMI-certified operators are authorised to access security data for these manufacturers through officially controlled, legally-compliant channels. If your vehicle is on this list, your locksmith must hold current SERMI certification to work on it legitimately.
Regulated
19 Makes
Abarth
Alfa Romeo
Chrysler
Citroën
Dodge
DS Automobiles
Fiat
Ford
Jaguar
Jeep
Lancia
Land Rover
Maserati
Nissan
Opel
Peugeot
Toyota
Vauxhall
VolvoWe are an independent automotive service provider. References to vehicle manufacturers, trademarks, logos and model names are made strictly for identification, compatibility and informational purposes. All trademarks are the property of their respective owners.
Straight answers. No sales language.