BMW Key Programming: Complete Locksmith Guide (All Models)

BMW is the make where the money is made or lost in the first ten minutes, before a single tool comes out of the van. Two 3 Series saloons on the same driveway, three years apart, can be a twenty-minute add-key over the port and a two-hour bench job with the dashboard in pieces. The badge tells you nothing. The module does.

That is the whole difficulty with BMW key programming. Ford runs one system family across generations and Toyota telegraphs its changes. BMW replaced its immobiliser architecture six times in twenty-five years, kept the old one running alongside the new one on overlapping chassis, and then shipped an encrypted variant of one generation partway through a model run with no external marking. The F30 3 Series is routinely described as a CAS4 car in forum posts and tool menus. It is not, and never was. Quote it as one and you will be on site with the wrong plan.

This guide walks the six BMW security eras in order, with the procedure, the realistic job time and the honest tool position for each. Every specification here comes from the Keysolved BMW vehicle records rather than from memory, because on this make a remembered chip type is a wasted call-out.

The six BMW security eras

Work out which one you are standing in front of and the rest of the job follows.

• EWS3 / EWS4 (roughly 1998–2006) — a standalone immobiliser module under the driver's dash with a ring antenna round the ignition barrel. Bench work only.
• CAS1 / CAS2 / CAS3 (2003–2012) — the Car Access System takes over. Mostly clean over the port.
• CAS3+ encrypted, the "ISTAP" cars (roughly 2011–2012 builds, plus any older car a dealer flashed up) — the same hardware, different firmware, and a genuinely different job.
• CAS4 / CAS4+ (2010–2017) — F10 5 Series, F25 X3 and relatives. Split by MCU mask: 5M48H is easy, 1N35H is not.
• FEM / BDC (2012–2022) — the Front Electronic Module and the first-generation Body Domain Controller. All-keys-lost is bench.
• BDC2 / BDC3 (2018 onward) — G-series. Ethernet, not plain CAN, and an ISN that will not come off over the port.

The constant across every one of them is the ISN — the Individual Serial Number shared between the immobiliser module and the engine ECU. The two run a challenge-response on every start. A key the module has accepted will still crank and refuse to fire if that pairing is wrong, which is the single most common "the key works but the car will not start" call on this make. There is no customer PIN anywhere in the BMW range. The security is the ISN, and on the harder cars recovering it is the job.

Identify the module before you quote

How do you tell which BMW immobiliser you are dealing with? Read it off the tool, not off the year. Plug in, let the tool identify the module type, and only then price the work. Chassis code plus build date narrows it to two candidates; the tool settles it.

The traps worth knowing before you attend:

• The F30 is not a CAS4 car. The F30 3 Series launched on FEM in 2012 and stayed on FEM through the 2015 LCI to the end of production in 2019. CAS4 belonged to the F10 5 Series, the F25 X3 and the earlier F-chassis. The database records the F30 3 Series as FEM throughout.
• The F48 X1 is a BDC car, not a FEM car. Its F-series contemporaries the F20 1 Series and F30 3 Series are FEM. The F48 X1 is on the UKL2 platform with a first-generation BDC, shared with the X2 F39, X5 F15, X6 F16 and several MINI F-series models.
• Some 2020-on G20s are BDC3, not BDC2. The changeover is not a clean year line. BDC3 is the higher-security module and wants current tool software and licences. Read the module type with a spare key in hand before you commit.

If the OBD socket itself is giving you trouble, the make-by-make OBD port location guide covers the awkward ones. On BMW the port is in the driver's footwell on essentially everything, though a good number of F-series cars carry a clip-in blanking cap that has to come out first.

EWS3 and EWS4: bench work, no exceptions

The E46 3 Series, E39 5 Series and E53 X5 era runs on EWS — Elektronische Wegfahrsperre — a standalone module mounted under the driver's-side dash, inductively powering the key transponder through a ring antenna at the ignition barrel.

The E46 3 Series records give a PCF7935 transponder in the Hitag 2 family, 433.92 MHz, HU92 blade, and a VL2020 rechargeable battery in the diamond key that tops up in the ignition slot. The early 1998–99 oval key uses a CR2016 instead. The bulk of the run is EWS3 or EWS3.3 on a Motorola MC68HC11EA9 processor, mask sets 0D46J and 2D47J. Late cars from roughly 2004 move to EWS4 on an MC68HC912, mask 2L86D, with different adapter wiring.

The transponder is write-only. It is written from the EWS dump and never cloned, which rules out the whole cloning shortcut that works on so many other makes of this age. If you want the wider picture on which chips clone and which have to be enrolled, the transponder chip cross-reference chart maps the families across makes.

EWS3 add-key or all-keys-lost procedure

Both jobs are the same job on this platform. There is no add-key shortcut.

1. Verify the vehicle and confirm ownership — V5C and customer identification before anything else.
2. Identify EWS3 versus EWS4 first. The processor and the adapter wiring differ, and getting this wrong costs you the trip.
3. Remove or clip onto the EWS module under the driver's-side dash.
4. Read the Motorola EEPROM. CGDI Prog BMW is the bread-and-butter route here; VVDI Prog reads it with the XDNP50 solderless adapter clipped to the MCU; the Autel XP400 Pro does the same read with the IM608 Pro II preparing the slot.
5. Write a virgin PCF7935 to a free slot — the module holds ten pre-calculated slots.
6. Re-flash the module and refit.
7. Cut the HU92 blade to the door or ignition lock.
8. Test: engine start and remote lock and unlock.
9. Time: 60–90 minutes for a straightforward EWS3, longer if the conformal coating on the MCU pins needs scraping for a clip read.

Worth saying plainly: the classic AK90 and AK90+ do exactly this job for a fraction of the money. They are not in the Keysolved tool records, but they remain the traditional E46 key tool and a perfectly sound choice if EWS is occasional work for you. Buying an IM608 Pro II for E46 work alone would be silly.

CAS1 to CAS3: mostly a clean port job

The Car Access System arrived on the E60 5 Series in 2003 and the E90 3 Series in 2005. CAS owns the immobiliser and the remote receiver in one module, and for most of this generation the job is straightforward.

The E90 3 Series records split the generation into three variants, and the differences matter when you order parts:

• CAS2 remote-head key (2005–2007): PCF7942, Hitag 2, 868 MHz, HU92 blade, VL2020 slot-charged battery.
• CAS3 / CAS3+ remote-head key (2007–2012): PCF7945, Hitag 2, 868 MHz, HU92 blade, VL2020.
• CAS3+ Comfort Access smart key (2008–2012): PCF7953, Hitag 2, 868 MHz, and — the detail that catches people — a user-replaceable CR2032, not the slot-charged VL2020. The Comfort Access key is a different part in every respect from the non-CA key on the same car.

Note too that only two Comfort Access keys can hold active proximity at once. A customer who wants four working fobs is going to be disappointed on two of them.

CAS2 or CAS3 add-key procedure

1. Confirm ownership, then plug into the OBD socket in the driver's footwell, behind the hinged flap.
2. Select BMW, then CAS2 or CAS3, then Add Key. The tool reads the ISN over the port.
3. Prepare the key on the programmer — PCF7942 for CAS2, PCF7945 for CAS3 — and write it to a free CAS slot.
4. Cut the HU92 blade.
5. Test start and remote.
6. Time: 25–40 minutes.

All-keys-lost, and the one question that decides it

Is the CAS3+ encrypted? Everything hangs on this. CAS2, CAS3 and unencrypted CAS3+ run all-keys-lost over the port: the tool reads the CAS, recovers the ISN and writes to a slot. Encrypted CAS3+ — the "ISTAP" cars, roughly 2011–2012 builds and any older car a dealer flashed via ISTA-P — needs a CAS firmware downgrade to go over the port, and that downgrade can brick the module if voltage drops mid-flash.

Do not gamble on an OBD downgrade with no working key in your hand. On an encrypted CAS3+ all-keys-lost, go to the bench:

1. Confirm ownership and back up what you can.
2. Pull the CAS module.
3. Read the MCU on the bench. VVDI Prog is the recognised standard for the 0L15Y and 1L15Y masks; Yanhua Module 1 – BMW CAS clips on with no soldering and a correspondingly low brick risk.
4. Alternatively, read the ISN straight off the DME — MSD80, MSD81, MSV80 or N55 — and build a dealer key from it.
5. Refit, confirm the CAS–DME ISN agrees, write and cut the new key.
6. Test start with every key.
7. Time: 90–150 minutes on the bench route. The OBD route on an unencrypted unit is 40–60 minutes.

If you do take the OBD downgrade on an encrypted unit for an add-key, put the car on a proper stabilised supply first. Not a jump pack. A supply.

CAS4 and CAS4+: read the mask, not the year

The F10 5 Series ran CAS4 for its entire life and never moved to FEM. The F10 records show the split cleanly, and it is a mask-set split rather than a model-year one:

• CAS4, mask 5M48H (2010–2013): PCF7953, Hitag Pro, 433.92 MHz, HU100R blade, CR2032. Add-key and all-keys-lost both run over the port. No ISN read required.
• CAS4+, mask 1N35H (2013–2017): PCF7953, Hitag Pro, 433.92 MHz, HU100R, CR2032 — same key, harder module. All-keys-lost needs the 32-bit ISN first, read from the DME or recovered from the CAS4 EEPROM on the bench.

That 5M48H all-keys-lost is one of the friendliest jobs on the whole make and worth knowing about. With no key present, press the brake and switch the lights on to wake communications, then follow the dealer-key routine and enrol the new fob at the start slot.

CAS4 5M48H all-keys-lost procedure

1. Confirm ownership. Put the car on a stable supply.
2. Plug in. Wake communications: brake pressed, lights on.
3. Select BMW, then CAS4 or CAS4+, then the all-keys-lost or dealer-key flow. Lonsdor K518Pro, VVDI Key Tool Plus, CGDI Prog BMW and the Autel IM608 family all run this over the port.
4. Write the PCF7953 and enrol it at the start slot.
5. Cut the HU100R blade.
6. Test crank and remote with each key.
7. Time: 45–70 minutes.

CAS4+ 1N35H all-keys-lost procedure

1. Confirm ownership. Stable supply on.
2. Try the ISN over the port first — Autel's ISN Code Management will read it from the supported DME families, and Abrites AVDI holds ISN read, write and change within its BMW licence.
3. If the DME is unsupported or the encrypted module will not release it, take the ISN from the DME on the bench with Yanhua Module 3 – BMW ISN DME, or pull the CAS4 and read the 1N35H EEPROM with VVDI Prog or Yanhua Mini ACDP-2.
4. Build the dealer key from the recovered ISN.
5. Enrol at the start slot, refit anything removed.
6. Test crank and remote.
7. Time: 2–3 hours. Price it as such.

FEM and BDC: add-key over the port, all-keys-lost on the bench

From 2012 the Front Electronic Module took over immobiliser duty on the F20 and F30, and the first-generation Body Domain Controller did the same on the F48, F39, F15 and F16. The pattern is consistent across both: with a working key you are over the port in half an hour, and without one you are taking a module out.

The F30 records give a PCF7953 Hitag Pro transponder, HU100R blade, CR2450 battery, with the FEM in the passenger-side A-pillar or kick-panel area and a 95128 EEPROM inside it.

FEM or BDC add-key procedure

1. Confirm ownership. Fit a battery stabiliser — above 13V is not optional on these.
2. Connect and select BMW, then F-series, then FEM or BDC, then Key Learn. Both Abrites BN016, which covers CAS4, FEM and BDC chassis across the F-series, and Autel's BMW package handle this.
3. The tool reads the FEM and authorises a new key slot.
4. Write the Hitag Pro key on the tool coil.
5. Activate it: hold the new key against the LF aerial ring to the right of the steering column and hold Start/Stop for about ten seconds.
6. Test lock, unlock, proximity if Comfort Access is fitted, and engine start.
7. Time: 30–45 minutes.

FEM or BDC all-keys-lost procedure

With no key the module will not release its data over the port. This is bench work.

1. Confirm ownership. Stabilised supply on throughout.
2. Remove the FEM or BDC — passenger-side A-pillar or kick panel. On the BDC the fuse compartment is integrated into the housing, so photograph the fuse positions before anything comes out.
3. Read the 95128 EEPROM. Yanhua Module 2 – BMW FEM/BDC reads it over solder-free pogo pins with no chip-off. Save a backup before you change anything.
4. Calculate the immobiliser password and read the DME ISN — Yanhua Module 3 for that, with the B38 or B48 interface board on the F48 engine family — so the module-to-DME sync survives.
5. Write the new key and refit the module.
6. Activate at the steering-column coil.
7. Test start with every key.
8. Time: 2–3 hours.

One live caveat on the BDC: Component Protection applies at module level, so a BDC moved into a different vehicle will throw CP faults that only BMW ISTA with a dealer online session will clear. That is not a job you can finish in the van.

BDC2 and BDC3: the G-series job

The G20 3 Series, G30 5 Series and their relatives run the second-generation Body Domain Controller, which absorbs CAS, FRM, JBE and gateway functions into one unit behind the front passenger kick panel. The G20 records give an NCF2951 Hitag Pro transponder — ID49 — at 433.92 MHz, HU100R, CR2032.

Two things change here. First, the G-series talks over Ethernet, so you need a BMW ENET or DoIP lead and not a plain CAN cable. Second, the ISN is held encrypted in the BDC EEPROM and does not come off over the port at all in an all-keys-lost.

Add-key over the port is now realistic on current software. Autel's own IMMO release notes record key learning in OBD mode for BDC module bootloader V85 and higher, and Abrites draws the same line, specifying BDC versions 85 or higher for its OBD key programming. Below that bootloader version you are on the bench regardless of what the tool box promises.

G20 BDC2 add-key procedure

1. Confirm ownership. Connect with a BMW ENET or DoIP lead, lifting the blanking plug in the footwell if one is fitted. Connect with the alarm disarmed.
2. With the working key, switch the ignition on — Start/Stop without the brake.
3. Go IMMO, BMW, G-Series, BDC2 or BDC3, Add Key.
4. Let the tool read the working key and prepare the new fob; present the new 433.92 MHz key when prompted.
5. Test lock, unlock and push-button start. Repeat for further spares.
6. Time: 40–60 minutes.

G20 BDC2 all-keys-lost procedure

1. Confirm ownership. Put a 13.5V supply on the car and keep it there.
2. Back up the BDC coding over the port first, so lighting, locking, windows and Comfort Access can be restored afterwards. Photograph the fuse and connector positions.
3. Disconnect the battery and remove the BDC from the front passenger footwell — a few screws and two multi-pin plugs.
4. Mount it on a bench platform. Yanhua Module 38 – BMW BDC02 is the established route, solderless pogo-pin, no soldering. Take a full EEPROM backup before touching anything.
5. Read the ISN from the BDC EEPROM, and from the DME separately if the tool asks for it.
6. Write the new key or keys, refit the BDC, reconnect, restore the coding over the port.
7. Confirm the ISN is synced to the DME. A mismatch throws engine-start-blocked faults.
8. Test push-start with every new key.
9. Time: 3–4 hours. This is a workshop job, not a roadside one.

MINI is a BMW

Worth treating as part of the same guide, because the architecture is shared. The R56 MINI Hatch runs CAS3 or CAS3+ with the module sitting inside the dashboard above the instrument cluster — upper dash trim off to reach it. The key is a PCF7945A, Hitag 2 or ID46, 433.92 MHz, HU92 blade, with a VL2020 that is soldered to the PCB rather than a replaceable coin cell.

The R56 is the one BMW-group car where Smart Pro with ADS2263 earns its keep outright: it handles CAS3 and CAS3+ all-keys-lost over the port with no PIN and no working key, programming transponder and remote together. Most other tools want bench work for a CAS3+ all-keys-lost on this car. If you carry a Smart Pro already, this is a job the expensive tablets do not do better.

Also know that the ELV — the electronic steering lock — is a recognised R56 failure component. It interfaces with CAS3 and can prevent ignition when it fails, which presents as an immobiliser problem and is not one. The immobiliser fault diagnosis guide covers separating the two.

Tool coverage, honestly

Eleven tools carry confirmed coverage on the F30 FEM alone, and much the same names recur across every BMW record. Where they actually sit:

Tier 1 — buy these if BMW is core work

• Yanhua Mini ACDP-2 with Modules 1, 2, 3 and 38. The most complete bench answer across every era from CAS through BDC2, clip-on and solderless throughout, which keeps brick risk genuinely low. If you only take one BMW-specific purchase, take this.
• CGDI Prog BMW. Strong from EWS3 through CAS4, works offline, and notably good at rescuing a CAS bricked during someone else's failed downgrade. The honest limitation: the legacy CGDI Prog BMW does not do G20 BDC2 — that needs the current A2 hardware.
• Autel MaxiIM IM608 Pro II with the XP400 Pro and G-BOX3. Broadest coverage of any single tablet and the best OBD add-key position on the G-series, but it requires an active subscription and an online tablet during the job. All-keys-lost on the G20 is not supported over the port whatever the menu suggests.

Tier 2 — capable, with conditions

• Xhorse VVDI BMW paired with VVDI Prog. The pairing covers add-key over the port and bench reads across EWS, CAS and FEM properly. G-series BDC2 all-keys-lost arrived via VVDI Key Tool Plus and Multi Prog in late-2025 firmware and is still thinner on independent reports than the Yanhua or CGDI routes — verify your firmware coverage before you attend.
• Abrites AVDI with PROTAG. Licence-gated by chassis, and the licences are not cheap, but the ISN read, write and change capability is genuinely useful on the hard CAS4+ jobs. Requires an active maintenance subscription.
• Lonsdor K518Pro. Clean on CAS2 and CAS4 5M48H. Its FEM all-keys-lost claim is advertised but less demonstrated on the F30 specifically than the BMW-dedicated tools, so treat it as a workable fallback rather than a first pick. BDC2 all-keys-lost costs roughly 35 credits per session on the Lonsdor platform.

Tier 3 — situational

• Advanced Diagnostics Smart Pro. The UK trade standard generally, and outstanding on the MINI R56 CAS3+ all-keys-lost specifically. On the F-series it is by dump, and on the G-series it is not the tool.
• Launch X-PROG 3 and OBDSTAR X300 Classic G3. Both appear in BMW coverage. One locksmith has logged in the community tips that on an R56 CAS3++ all-keys-lost, the X300 G3 refused the ISN read from the DME while the X-PROG 3 accepted it and completed the job without removing the CAS — a useful thing to know if you carry both.

For the wider picture beyond BMW, the 2026 key programmer coverage matrix counts confirmed coverage across all thirteen tools.

Common pitfalls

Ordering the wrong frequency fob This is the most expensive BMW mistake and the easiest to avoid. F30 keys are 868 MHz up to roughly 2016, then 433 or 434 MHz from about 2016 onward. There is no clean cut-off date. Check inside the battery flap or test the fob before ordering. A locksmith left a tip on the F25 X3 record that says it better than any procedure can: take a 433 MHz and an 868 MHz key with you.

Treating the F30 as a CAS4 car Covered above, and still worth repeating because tool menus and forum posts both perpetuate it. The F30 is FEM from launch to end of production. The NCF2951 chip you will see quoted alongside it belongs to the G-series BDC2, not the F30 — the F30 is PCF7953 throughout.

Assuming the Comfort Access key is the same part On the E90 CAS3+ the non-CA key is a PCF7945 with a slot-charged VL2020. The Comfort Access key is a PCF7953 with a user-replaceable CR2032. They are not interchangeable and the programming path is different — the CA key must be written as a smart key, not a blade key, and proximity registered afterwards.

A flat key that is not flat The VL2020 in pre-Comfort-Access BMW keys is rechargeable and tops up in the ignition slot. A customer reporting a dead key on an E46 or E90 very often just needs the key reinserted and driven for a while. Diagnose before you sell.

Losing the car to a downgrade An encrypted CAS3+ firmware downgrade over the port can brick the CAS if voltage drops mid-flash. Stabilised supply, every time, and never attempt it on an all-keys-lost when the bench route is available.

Leaving the BDC locked to your tool After some bench all-keys-lost paths the BDC is left bound to the aftermarket tool and will refuse a later dealer key. Yanhua's own bench platform documentation is explicit that the all-keys-lost function modifies the original immobiliser data and that dealer keys will no longer work afterwards. Run the restore step where the tool offers one, and tell the customer either way. Finding this out at a main dealer two years later is how a good job becomes a complaint.

Forgetting the Digital Key If the car has BMW Digital Key active — phone-as-key, from roughly late 2019 — clear the digital keys from the vehicle before any BDC bench work.

FAQ

Can you programme a BMW key without the original?

Yes, on every generation, but the route varies enormously. CAS2, CAS3, unencrypted CAS3+ and CAS4 5M48H run all-keys-lost over the OBD port in under an hour. EWS, encrypted CAS3+, CAS4+ 1N35H, FEM, BDC and BDC2 all require the module on the bench, or at minimum the ISN recovered from the engine ECU. Budget two to four hours for the bench jobs.

Does BMW use a PIN or security code?

No. There is no customer PIN anywhere in the BMW range. Authentication rests on the ISN shared between the immobiliser module and the engine ECU. On the harder generations recovering that ISN is the job, which is why "no PIN" does not mean "easy".

Can BMW keys be cloned?

No. Every BMW transponder from EWS onwards is written to a module slot rather than copied. The PCF7935 on EWS cars is write-only, and the Hitag 2 and Hitag Pro chips on CAS, FEM and BDC cars are rolling-code and not cloneable. Anyone offering a cloned BMW key is describing something else.

Why does the engine crank but not start after programming?

The transponder has been accepted by the immobiliser module but the module-to-DME ISN pairing is wrong. Cycle the ignition off, wait, and retry first. If it persists, the ISN needs resynchronising between the immobiliser module and the engine ECU — on CAS and FEM cars that usually means reading the ISN from the DME and matching it.

Do I need a special cable for G-series BMWs?

Yes. From the G-series onward BMW communicates over Ethernet, so a BMW ENET or DoIP lead is required. A standard OBD-to-tablet cable will not establish communication, and the resulting "no comms" will look like a module fault when it is a cable.

What do I need to prove before working on a BMW?

The same as any key job, and it matters more on premium makes. Take the V5C, confirm the registered keeper against customer identification, and record what you checked. The SERMI scheme, which governs access to security-related repair information for independent operators across Europe, applies in the UK on a voluntary basis — an accredited certificate is increasingly what separates a professional operation from a rogue one in a customer's eyes.

Before you quote the job

BMW rewards preparation more than almost any other make. The difference between a forty-minute add-key and a four-hour bench job is not the badge on the bonnet or the year on the V5C — it is a module type and, on CAS4, a mask set printed on a chip. Read it off the tool before you price the work, carry both key frequencies on F-series calls, and put a proper supply on anything that involves a flash.

Look up the exact chassis, chip, frequency, blade profile and confirmed tool coverage for the car in front of you in the Keysolved BMW records before you set off. Twenty-four BMW and seven MINI vehicle records are in there, each with the OBD port location, the add-key and all-keys-lost procedures and the per-tool field notes that decide whether the job is one you can finish today.