diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index 887602c..451c521 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -657,6 +657,28 @@
 	return vlr_subscr_tx_gsup_message(vsub, &gsup_msg);
 }
 
+/* Initiate Check_IMEI_VLR Procedure (23.018 Chapter 7.1.2.9) */
+int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub)
+{
+	struct osmo_gsup_message gsup_msg = {0};
+	uint8_t imei_enc[GSM23003_IMEI_NUM_DIGITS+2]; /* +2: IE header */
+	int len;
+
+	/* Encode IMEI */
+	len = gsm48_encode_bcd_number(imei_enc, sizeof(imei_enc), 0, vsub->imei);
+	if (len < 1) {
+		LOGVSUBP(LOGL_ERROR, vsub, "Error: cannot encode IMEI '%s'\n", vsub->imei);
+		return -ENOSPC;
+	}
+	gsup_msg.imei_enc = imei_enc;
+	gsup_msg.imei_enc_len = len;
+
+	/* Send CHECK_IMEI_REQUEST */
+	gsup_msg.message_type = OSMO_GSUP_MSGT_CHECK_IMEI_REQUEST;
+	OSMO_STRLCPY_ARRAY(gsup_msg.imsi, vsub->imsi);
+	return vlr_tx_gsup_message(vsub->vlr, &gsup_msg);
+}
+
 /* Tell HLR that authentication failure occurred */
 int vlr_subscr_tx_auth_fail_rep(const struct vlr_subscr *vsub)
 {
@@ -991,6 +1013,29 @@
 	return rc;
 }
 
+/* Handle Check_IMEI_VLR result and error from HLR */
+static int vlr_subscr_handle_check_imei(struct vlr_subscr *vsub, const struct osmo_gsup_message *gsup)
+{
+	if (!vsub->lu_fsm) {
+		LOGVSUBP(LOGL_ERROR, vsub, "Rx %s without LU in progress\n",
+			 osmo_gsup_message_type_name(gsup->message_type));
+		return -ENODEV;
+	}
+
+	if (gsup->message_type == OSMO_GSUP_MSGT_CHECK_IMEI_RESULT) {
+		if (gsup->imei_result == OSMO_GSUP_IMEI_RESULT_ACK)
+			osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_ACK, NULL);
+		else
+			osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_NACK, NULL);
+	} else {
+		LOGVSUBP(LOGL_ERROR, vsub, "Check_IMEI_VLR failed; gmm_cause: %s\n",
+			 get_value_string(gsm48_gmm_cause_names, gsup->cause));
+		osmo_fsm_inst_dispatch(vsub->lu_fsm, VLR_ULA_E_HLR_IMEI_NACK, NULL);
+	}
+
+	return 0;
+}
+
 /* Incoming handler for GSUP from HLR.
  * Keep this function non-static for direct invocation by unit tests. */
 int vlr_gsupc_read_cb(struct osmo_gsup_client *gsupc, struct msgb *msg)
@@ -1060,6 +1105,10 @@
 			gsup.message_type);
 		rc = -GMM_CAUSE_MSGT_NOTEXIST_NOTIMPL;
 		break;
+	case OSMO_GSUP_MSGT_CHECK_IMEI_ERROR:
+	case OSMO_GSUP_MSGT_CHECK_IMEI_RESULT:
+		rc = vlr_subscr_handle_check_imei(vsub, &gsup);
+		break;
 	default:
 		/* Forward message towards MSC */
 		rc = vlr->ops.forward_gsup_msg(vsub, &gsup);
diff --git a/src/libvlr/vlr_core.h b/src/libvlr/vlr_core.h
index c249dff..41b8800 100644
--- a/src/libvlr/vlr_core.h
+++ b/src/libvlr/vlr_core.h
@@ -7,5 +7,6 @@
 int vlr_subscr_req_lu(struct vlr_subscr *vsub) __attribute__((warn_unused_result));
 int vlr_subscr_req_sai(struct vlr_subscr *vsub, const uint8_t *auts,
 		       const uint8_t *auts_rand) __attribute__((warn_unused_result));
+int vlr_subscr_tx_req_check_imei(const struct vlr_subscr *vsub);
 void vlr_subscr_update_tuples(struct vlr_subscr *vsub,
 			      const struct osmo_gsup_message *gsup);
diff --git a/src/libvlr/vlr_lu_fsm.c b/src/libvlr/vlr_lu_fsm.c
index 8640d2b..a97e97a 100644
--- a/src/libvlr/vlr_lu_fsm.c
+++ b/src/libvlr/vlr_lu_fsm.c
@@ -653,6 +653,8 @@
 	OSMO_VALUE_STRING(VLR_ULA_E_ID_IMSI),
 	OSMO_VALUE_STRING(VLR_ULA_E_ID_IMEI),
 	OSMO_VALUE_STRING(VLR_ULA_E_ID_IMEISV),
+	OSMO_VALUE_STRING(VLR_ULA_E_HLR_IMEI_ACK),
+	OSMO_VALUE_STRING(VLR_ULA_E_HLR_IMEI_NACK),
 	OSMO_VALUE_STRING(VLR_ULA_E_HLR_LU_RES),
 	OSMO_VALUE_STRING(VLR_ULA_E_UPD_HLR_COMPL),
 	OSMO_VALUE_STRING(VLR_ULA_E_LU_COMPL_SUCCESS),
@@ -1229,9 +1231,17 @@
 				       LU_COMPL_VLR_E_NEW_TMSI_ACK, NULL);
 		break;
 	case VLR_ULA_E_ID_IMEI:
+		/* Got the IMEI from ME, now send it to HLR */
+		vlr_subscr_tx_req_check_imei(lfp->vsub);
+		break;
+	case VLR_ULA_E_HLR_IMEI_ACK:
 		osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
 				       LU_COMPL_VLR_E_IMEI_CHECK_ACK, NULL);
 		break;
+	case VLR_ULA_E_HLR_IMEI_NACK:
+		osmo_fsm_inst_dispatch(lfp->lu_compl_vlr_fsm,
+				       LU_COMPL_VLR_E_IMEI_CHECK_NACK, NULL);
+		break;
 	case VLR_ULA_E_LU_COMPL_SUCCESS:
 		lu_fsm_discard_lu_compl_fsm(fi);
 
@@ -1362,7 +1372,9 @@
 				 S(VLR_ULA_E_LU_COMPL_FAILURE) |
 				 S(VLR_ULA_E_NEW_TMSI_ACK) |
 				 S(VLR_ULA_E_ID_IMEI) |
-				 S(VLR_ULA_E_ID_IMEISV),
+				 S(VLR_ULA_E_ID_IMEISV) |
+				 S(VLR_ULA_E_HLR_IMEI_ACK) |
+				 S(VLR_ULA_E_HLR_IMEI_NACK),
 		.out_state_mask = S(VLR_ULA_S_DONE),
 		.name = OSMO_STRINGIFY(VLR_ULA_S_WAIT_LU_COMPL),
 		.action = lu_fsm_wait_lu_compl,