VW & Audi Key Programming Guide: IMMO 4, BCM2, MQB & MLB Systems Explained
VW, Audi, Skoda, and Seat — the VAG group — uses some of the most technically advanced immobilizer systems in the automotive world. From the relatively straightforward IMMO 4 found in a 2008 Jetta, to the encrypted MQB platform in a 2019 Golf, to the locked BCM2 in a 2015 Audi A6 — every generation works differently and requires different tools, different knowledge, and a different approach. This guide explains every VAG immobilizer generation in plain language — what it is, what vehicles use it, and what a professional locksmith can actually do with it.
Why VAG Immobilizer Systems Are Different From Every Other Brand
Most automotive brands — Toyota, Honda, Ford, Hyundai — use a relatively consistent immobilizer architecture across their entire lineup. VAG is different. The Volkswagen Group has developed multiple distinct immobilizer platforms over 30 years, and they often run completely different systems across models sold in the same year. A 2015 VW Golf uses the MQB platform. A 2015 Audi A6 uses BCM2. A 2015 Audi Q7 uses MLB. Three different cars, same model year, three completely different programming approaches.
Understanding which system your vehicle uses is not optional — it determines whether a locksmith can help you at all, what tools are required, and whether the job can be completed on-site without towing to a dealer.
VAG immobilizer systems are also organized around what the industry calls Component Security (CS) — encrypted data shared between multiple modules in the vehicle. The key, the ECU, the dashboard, the transmission control unit, and sometimes the steering lock module all hold pieces of this data. Programming a new key means accessing and synchronizing all of these components. On older systems this is done purely via OBD2 port. On newer systems it requires reading data from individual modules or connecting to manufacturer servers.
The Complete VAG Immobilizer Generation Guide
On IMMO 4 vehicles, all-keys-lost is possible via OBD2 on most models. The locksmith connects to the vehicle, reads the security data from the instrument cluster, generates a dealer key, and programs it into the immobilizer. This process can be completed on-site without removing any modules.
The critical BCM2 distinction: locked vs unlocked. BCM2 modules manufactured before approximately 2013 are "unlocked" — all-keys-lost programming can be performed via OBD2 without needing to remove the BCM module. After 2013, VAG introduced a security measure that "locked" BCM2 modules from factory, making all-keys-lost impossible via OBD alone. To perform all-keys-lost on a post-2013 locked BCM2, the BCM module must first be unlocked using the Abrites VN020 special function license with an online connection to the Abrites server. This is not a procedure that can be completed offline or with standard tools.
MQB uses the Megamos AES (ID88) transponder — a significant upgrade from ID48. The security architecture stores Component Security in two parts: 16 bytes in the dashboard immobilizer module (the IMMO module and dashboard are the same unit in MQB) and 32 bytes of sync data shared across the ECU, transmission, and other modules.
MQB Gen 1 (V850 Renesas processor, 2013–2020): The first MQB generation uses a V850 Renesas processor in the dashboard. Autel IM608 Pro II supports all-keys-lost on V850 MQB vehicles via OBD2. If you have a working key, spare key programming is straightforward — the working key holds the necessary sync data. If all keys are lost, all CS data must be read from every participating module. Abrites AVDI handles both scenarios with full offline capability.
MQB Gen 2 / IMMO 5C (RH850 with crypto core, 2020+): Tiguan 2020+, Polo 2020+, T-Roc, and similar post-2020 models use a newer RH850 processor with a built-in crypto core. These vehicles use Hitag-Pro (ID5C) transponders. As of 2025, Abrites AVDI is the primary professional tool with support for these vehicles — most other tools cannot program keys for IMMO 5C vehicles.
Golf 8 / IMMO 5D (2020+): The Golf 8 introduced a completely new immobilizer structure. The IMMO module is no longer in the dashboard — it has been moved to a separate module, similar in concept to BCM2 but with a different underlying architecture. Full support is available through Abrites AVDI with specific function licenses.
The immobilizer architecture is similar in concept to BCM2 but with different underlying security structures. Component Security is split across multiple modules in a way that makes OBD-only access very limited. As of 2025, Abrites is actively developing MLB support as a major development milestone — full all-keys-lost capability is not yet widely available outside of dealer-level tools. Adding a spare key with a working original is possible on some MLB variants.
For MLB vehicles with all keys lost, the most reliable solution currently involves Abrites AVDI with the appropriate VAG license — but not all models are supported. Always call to confirm before bringing a vehicle in.
Autel IM608 Pro II can unlock SFD gateways on most 2017+ VAG vehicles, making it possible to perform key programming in a single visit without needing additional hardware. This is one reason the Autel IM608 Pro is the preferred primary tool for modern VAG work.
Deep Dive: BCM2 Locked vs Unlocked — What It Means for You
The BCM2 split between locked and unlocked is one of the most important distinctions in VAG locksmith work — and one that many locksmiths get wrong.
Unlocked BCM2 (pre-2013): The BCM module communicates openly via OBD2. All-keys-lost programming can be performed entirely through the OBD2 port. The locksmith reads the CS data from the BCM, generates a dealer key, programs it to the vehicle. No module removal, no bench work, no server connection. Abrites AVDI offline mode handles this completely. Xhorse VVDI Key Tool Plus can also handle unlocked BCM2 for many models.
Locked BCM2 (post-2013): The BCM module is locked from factory and will not communicate the CS data via OBD2 under any normal circumstances. To unlock it, a technician must use Abrites AVDI with the VN020 special function license and an active internet connection to the Abrites server. The server performs an online authentication, unlocks the BCM, and then allows the CS to be read and a new key to be programmed. This is not a procedure that can be replicated offline or with other tools.
The practical implication: if you have lost all keys to a 2013–2016 Audi A4, A5, A6, Q5, or A8, the locksmith you call must specifically have Abrites AVDI with VN020 activated. Without it, the job cannot be completed without towing to an authorized Audi dealer.
Deep Dive: MQB — The Most Common System in DC & Maryland
MQB is the most relevant VAG platform for the Washington DC and Maryland market. The VW Golf 7, Jetta (2019+), Tiguan (2017+), and Passat B8 are all extremely common vehicles throughout the area. Here is exactly how key programming works on these vehicles.
With a working key present (spare key addition): The working key stores the 32-byte sync data needed for programming. The locksmith connects via OBD2, reads the 16-byte CS from the dashboard immobilizer module, reads the sync data from the working key, generates a new ID88 transponder key, and programs it into the vehicle. This process works entirely on-site and takes 45–75 minutes.
All-keys-lost on Gen 1 MQB (V850, 2013–2020): Without a working key, the locksmith must read the Component Security from all participating modules — the dashboard immobilizer, the ECU, and the transmission control unit. Each module holds a piece of the 32-byte sync data. Once all pieces are collected, a new dealer key can be generated and programmed. Autel IM608 Pro II supports MQB48 V850 all-keys-lost via OBD2 for Golf 7 (2013–2020), Tiguan (2016–2019), and Jetta (2018–2020). Abrites AVDI has broader coverage.
MQB Gen 2 IMMO 5C (RH850/crypto core, 2020+): The newer Tiguan, Polo, and T-Roc with the RH850 processor and crypto core require Abrites AVDI — Autel and most other tools do not currently support all-keys-lost on these vehicles. Spare key addition with a working key is possible on some models with Abrites.
What a Professional Locksmith Can Do — By Generation
| System | Vehicles (Examples) | Add Spare Key | All-Keys-Lost | Tool Required |
|---|---|---|---|---|
| IMMO 1 & 2 | Golf 3/4, early Jetta, early A3/A4 | ✔ Yes — OBD | ✔ Yes — OBD | Xhorse VVDI2 / Autel |
| IMMO 3 | Passat B5.5, Golf 4 late, Polo 9N | ✔ Yes — OBD | ✔ Yes — pre-coded key | Xhorse VVDI2 / Autel |
| IMMO 4 | Golf 5/6, Jetta A5/A6, Passat B6/B7, Tiguan gen1, A3 (8P) | ✔ Yes — OBD | ✔ Yes — OBD | Xhorse VVDI2 / Autel IM608 |
| IMMO 4+ | Passat B7, CC, some Touareg | ✔ Yes — OBD | ✔ Yes — OBD | Xhorse VVDI2 / Autel IM608 |
| BCM2 Unlocked | A4 B8 (pre-2013), A5, Q5, A6 C7 (pre-2013) | ✔ Yes — OBD | ✔ Yes — OBD | Abrites AVDI / Xhorse |
| BCM2 Locked | A4 B8 (2013+), A6 C7 (2013+), Q5, A7, A8 D4 | ✔ Yes — with working key | ⚠ Yes — Abrites VN020 online only | Abrites AVDI + VN020 |
| MQB Gen 1 (V850) | Golf 7 (2013–2020), Jetta (2019–2020), Tiguan (2017–2019) | ✔ Yes — OBD | ✔ Yes — OBD | Autel IM608 Pro / Abrites |
| MQB Gen 2 / 5C (RH850) | Tiguan (2020+), Polo (2020+), T-Roc | ⚠ Spare — Abrites only | ⚠ Limited — Abrites developing | Abrites AVDI only |
| Golf 8 / IMMO 5D | VW Golf 8 (2020+) | ⚠ Abrites only | ⚠ Abrites only | Abrites AVDI only |
| MLB | A4 B9 (2016+), A6 C8 (2018+), Q5 (2017+), Q7 (2016+), Cayenne (2018+) | ⚠ Spare — limited support | ✘ Very limited — in development | Abrites AVDI (partial) |
The Tools That Handle VAG Systems
The Most Common VAG Vehicles in Washington DC & Maryland — And What System They Use
The DC and Maryland market has a high concentration of VW and Audi vehicles. Here is exactly what immobilizer system the most common models use — so you know what to expect before you call.
| Vehicle | Year Range | IMMO System | On-Site Capable? |
|---|---|---|---|
| VW Jetta | 2005–2018 | IMMO 4 | ✔ Yes |
| VW Jetta | 2019+ | MQB Gen 1 | ✔ Yes |
| VW Golf 5/6 | 2005–2013 | IMMO 4 | ✔ Yes |
| VW Golf 7 | 2013–2019 | MQB Gen 1 (V850) | ✔ Yes |
| VW Golf 8 | 2020+ | IMMO 5D | ⚠ Abrites only |
| VW Passat B6/B7 | 2005–2015 | IMMO 4 / IMMO 4+ | ✔ Yes |
| VW Passat B8 | 2016+ | MQB Gen 1 | ✔ Yes |
| VW Tiguan 1st Gen | 2009–2017 | IMMO 4 | ✔ Yes |
| VW Tiguan 2nd Gen | 2018–2019 | MQB Gen 1 | ✔ Yes |
| VW Tiguan 2nd Gen | 2020+ | MQB Gen 2 / IMMO 5C | ⚠ Abrites spare only |
| Audi A3 (8P) | 2003–2012 | IMMO 4 | ✔ Yes |
| Audi A3 (8V) | 2013–2020 | MQB Gen 1 | ✔ Yes |
| Audi A4 (B8) | 2008–2012 | BCM2 Unlocked | ✔ Yes |
| Audi A4 (B8) | 2013–2015 | BCM2 Locked | ⚠ Abrites VN020 |
| Audi A4 (B9) | 2016+ | MLB | ⚠ Spare only / limited |
| Audi Q5 (1st Gen) | 2008–2017 | BCM2 | ✔ Yes (pre-2013 unlocked) |
| Audi Q5 (2nd Gen) | 2017+ | MLB | ⚠ Limited |
| Audi A6 (C7) | 2011–2018 | BCM2 | ⚠ Locked post-2013 |
| Audi Q7 (1st Gen) | 2005–2015 | IMMO 4 (EZS-Kessy) | ✔ Yes |
| Audi Q7 (2nd Gen) | 2016+ | MLB | ⚠ Limited |
What Capitol Locksmith DC Can Handle On-Site in DC & Maryland
- ✔ All IMMO 1, 2, 3 vehicles — Golf 3/4, early Jetta, Passat B4/B5
- ✔ IMMO 4 — Golf 5/6, Jetta A5/A6, Passat B6/B7, Tiguan gen 1, A3 (8P)
- ✔ IMMO 4+ — Passat B7, CC (all-keys-lost and spare key)
- ✔ BCM2 Unlocked (pre-2013) — A4 B8, A5, Q5, A6 C7 (all-keys-lost via OBD)
- ✔ BCM2 Locked (post-2013) — all-keys-lost via Abrites AVDI + VN020 online
- ✔ MQB Gen 1 (V850) — Golf 7, Jetta 2019+, Tiguan 2017–2019, Passat B8
- ✔ SFD gateway unlock — all 2017+ VAG vehicles
- ⚠ MQB Gen 2 / IMMO 5C (Tiguan 2020+, Polo 2020+) — spare key with Abrites; all-keys-lost in development
- ⚠ Golf 8 / IMMO 5D — Abrites AVDI, confirm before booking
- ⚠ MLB A4 B9, A6 C8, Q5 gen 2, Q7 gen 2 — spare key possible with working key; all-keys-lost limited
- ⚠ Porsche Cayenne 2018+ (MLB) — confirm by VIN before booking
- ⚠ Audi RS / special models — confirm by VIN and year
There are VAG vehicles that are beyond the current capability of any independent locksmith — not just us, but any locksmith operating outside of the VAG dealer network. We believe in telling you this directly rather than having you pay a service call fee only to discover on-site that the job cannot be completed.
Golf 8 all-keys-lost: Full all-keys-lost on the Golf 8's new IMMO 5D architecture is currently limited to Abrites AVDI with specific licensing — and even with Abrites, some VIN ranges may require additional procedures. Confirm before booking.
MLB all-keys-lost (A4 B9, A6 C8, Q7 gen 2, Q5 gen 2, Cayenne 2018+): All-keys-lost on MLB platform vehicles is currently in development at Abrites and not yet broadly available outside of authorized Audi and Volkswagen dealers. Adding a spare key with a working original may be possible — call to confirm.
If you have a vehicle in this category and have lost all keys — the most cost-effective option may be to contact an authorized VW or Audi dealer directly. We will always tell you this if it applies to your vehicle, rather than attempt a job that cannot be completed.
Common Questions About VAG / VW / Audi Key Programming in DC & Maryland
Can a locksmith program a VW key without going to the dealer in Washington DC?
Yes — for most VW models sold in the DC and Maryland market. VW Jetta, Golf 5/6/7, Passat B6/B7/B8, and Tiguan (2017–2019) can all be handled on-site by a professional locksmith with the correct equipment. All-keys-lost on Golf 7 and Jetta 2019+ is possible via OBD2 with Autel IM608 Pro II. No dealer visit required for these models.
Can a locksmith program an Audi key without the dealer in Washington DC?
For most Audi models built before 2016, yes. Audi A3 (8P and 8V), A4 B8, A5, Q5 first generation, and A6 C7 can all be handled on-site. The main exception is post-2013 locked BCM2 all-keys-lost, which requires Abrites AVDI with VN020 online — a capability Capitol Locksmith DC has. For newer MLB-platform Audi A4 B9, A6 C8, and Q5 second generation, call first to confirm.
What is the difference between VW IMMO 4 and MQB?
IMMO 4 is the immobilizer system used in VW Golf 5 and 6, Jetta A5 and A6, and Passat B6 and B7 (approximately 2005–2015). It stores security data in the instrument cluster (NEC+24C32 or NEC+24C64 chip) and uses ID48 pre-coded transponders. MQB is the platform introduced in 2013 with the Golf 7 — it uses a completely different architecture with the Megamos AES (ID88) transponder, stores 16-byte Component Security in the dashboard module and 32-byte sync data across multiple modules, and requires different tools and procedures.
Why does my Audi A4 say "all keys lost is not possible" when I contact locksmiths?
If your Audi A4 is a B8 chassis made after 2013, the BCM2 module is locked. Most locksmiths do not have the Abrites AVDI with VN020 special function license required to unlock it. Capitol Locksmith DC uses Abrites AVDI — call (202) 993-9919 with your VIN and we confirm before dispatching.
My VW says "key not recognized" or "steering lock error" — what does this mean?
On VAG IMMO 4 vehicles, a "key not recognized" message typically means the transponder has lost synchronization with the ECU, or the key is damaged. On MQB vehicles, it often means the ID88 chip has failed or the key has lost its pairing with the vehicle's IMMO module. A "steering lock error" on older VAG models (pre-2013) may indicate an ELV (electronic steering lock) fault — a separate issue from the key itself. All of these can be diagnosed on-site. Call (202) 993-9919 with your vehicle year, make, and model and we confirm what the likely cause is before arriving.
