diff --git a/hlr/HLR_Tests.ttcn b/hlr/HLR_Tests.ttcn
index 4c158fd..f309575 100644
--- a/hlr/HLR_Tests.ttcn
+++ b/hlr/HLR_Tests.ttcn
@@ -1196,6 +1196,176 @@
 	vc_conn.done;
 }
 
+/* Test create-subscriber-on-demand during Check IMEI (OsmoMSC would be set to "check-imei-rqd early") */
+private function f_TC_subscr_create_on_demand_check_imei_early() runs on HLR_ConnHdlr {
+	var GSUP_PDU res; /* save various return values to prevent ttcn3 compiler warnings */
+	var charstring imsi_pattern := "*IMSI: " & hex2str(g_pars.sub.imsi) & "*";
+
+	/* Random MSISDN and CS+PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 cs+ps");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d*"); /* last line, hence not matching "\d\d\d\n" */
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*[CP]S disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, ?);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 ps");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*PS disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, ?);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and CS NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 cs");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*PS disabled*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*CS disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and no NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 none");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*PS disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* No MSISDN and no NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand no-msisdn none");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: none*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*PS disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* No MSISDN and CS+PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand no-msisdn cs+ps");
+	f_perform_CHECK_IMEI(g_pars.sub.imsi, '12345678901234'H, result := OSMO_GSUP_IMEI_RESULT_ACK);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: none*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*[CP]S disabled*");
+	res := f_perform_UL(g_pars.sub.imsi, omit);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	setverdict(pass);
+}
+testcase TC_subscr_create_on_demand_check_imei_early() runs on test_CT {
+	var hexstring imsi := f_rnd_imsi('26242'H);
+	var HLR_ConnHdlrPars pars := valueof(t_Pars(imsi));
+	var HLR_ConnHdlr vc_conn;
+
+	f_init(false);
+	vc_conn := f_start_handler(refers(f_TC_subscr_create_on_demand_check_imei_early), pars);
+	vc_conn.done;
+}
+
+/* Test create-subscriber-on-demand during LU (Location Update) */
+private function f_TC_subscr_create_on_demand_ul() runs on HLR_ConnHdlr {
+	var GSUP_PDU res;
+	var charstring imsi_pattern := "*IMSI: " & hex2str(g_pars.sub.imsi) & "*";
+
+	/* Random MSISDN and CS+PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 cs+ps");
+	res := f_perform_UL(g_pars.sub.imsi, ?);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d\n*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*[CP]S disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 ps");
+	res := f_perform_UL(g_pars.sub.imsi, ?);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d\n*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*PS disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and CS NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 cs");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d\n*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*PS disabled*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*CS disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* Random MSISDN and no NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 none");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d\n*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*PS disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* No MSISDN and no NAM (LU must fail) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand no-msisdn none");
+	res := f_perform_UL(g_pars.sub.imsi, ?, 7 /* GPRS services not allowed */);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: none*");
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*CS disabled*PS disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	/* No MSISDN and CS+PS NAM (LU must pass) */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand no-msisdn cs+ps");
+	res := f_perform_UL(g_pars.sub.imsi, omit);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: none*");
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*[CP]S disabled*");
+	f_vty_subscr_delete(VTY, g_pars.sub);
+
+	setverdict(pass);
+}
+testcase TC_subscr_create_on_demand_ul() runs on test_CT {
+	var hexstring imsi := f_rnd_imsi('26242'H);
+	var HLR_ConnHdlrPars pars := valueof(t_Pars(imsi));
+	var HLR_ConnHdlr vc_conn;
+
+	f_init(false);
+	vc_conn := f_start_handler(refers(f_TC_subscr_create_on_demand_ul), pars);
+	vc_conn.done;
+}
+
+/* Test create-subscriber-on-demand during SAI (SendAuthInfo) */
+private function f_TC_subscr_create_on_demand_sai() runs on HLR_ConnHdlr {
+	var GSUP_PDU res;
+	var charstring imsi_pattern := "*IMSI: " & hex2str(g_pars.sub.imsi) & "*";
+
+	/* HLR creates the subscriber on demand. Then the IMSI is known, but there is no auth data, so the HLR returns
+         * the "slightly inaccurate cause 'IMSI Unknown' via GSUP". The MS is able to do a LU afterwards. */
+	f_vty_config(VTY, "hlr", "subscriber-create-on-demand 3 cs+ps");
+	res := f_perform_SAI(g_pars.sub.imsi, 2 /* IMSI Unknown */ );
+
+	/* Verify that it was created before the LU */
+	f_vty_subscr_show(VTY, g_pars.sub, pattern imsi_pattern);
+	f_vty_subscr_show(VTY, g_pars.sub, pattern "*MSISDN: \d\d\d*"); /* last line, hence not matching "\d\d\d\n" */
+	f_vty_subscr_show_nomatch(VTY, g_pars.sub, pattern "*[CP]S disabled*");
+
+	/* Location update */
+	res := f_perform_UL(g_pars.sub.imsi, ?);
+	f_vty_subscr_delete(VTY, g_pars.sub);
+	setverdict(pass);
+}
+testcase TC_subscr_create_on_demand_sai() runs on test_CT {
+	var hexstring imsi := f_rnd_imsi('26242'H);
+	var HLR_ConnHdlrPars pars := valueof(t_Pars(imsi));
+	var HLR_ConnHdlr vc_conn;
+
+	f_init(false);
+	vc_conn := f_start_handler(refers(f_TC_subscr_create_on_demand_sai), pars);
+	vc_conn.done;
+}
+
 /* TODO:
   * UL with ISD error
   * UL with ISD timeout
@@ -1236,6 +1406,9 @@
 	execute( TC_gsup_check_imei() );
 	execute( TC_gsup_check_imei_invalid_len() );
 	execute( TC_gsup_check_imei_unknown_imsi() );
+	execute( TC_subscr_create_on_demand_check_imei_early() );
+	execute( TC_subscr_create_on_demand_ul() );
+	execute( TC_subscr_create_on_demand_sai() );
 };
 
 };