The rel 15.0 CA Common Service Administration under Docops, Section Administrating -> Resource Initialization Manager -> CA LMP, covers how this is done:
To load new keys, execute the CAS9 procedure.
You may want to create a different CAS9 procedure specifically for loading new keys.
There are steps documented on how to create a customized CAS9 procedure to load the keys. Those directions include a recommendation that the CARIMPRM member not be read when the CAS9 procedure is executed. This is optional and is to minimize the number of output messages.
Once the customized CAS9 PROC is created you enter the operator command: S CAS9,,,LMPKEYS
This will activate the new ACF2 key which will be immediately available---without an IPL.
To verify in ACF2 that this has completed successfully, enter the following operator command: F ACF2,LMPCHECK. If the adding of the key was unsuccessful, you will see a message like this: CAS9180E - CPU nnnnnn Requires a LMP key to run Prod (X1). This will be followed by in both a good and bad LMP key add, message: ACF79450 LMP VERIFICATION COMPLETE