Messaging Layer Security (MLS) is an IETF standard for encrypting group and one-to-one messaging that RCS Universal Profile 3.0 uses to deliver interoperable E2EE between iPhone and Android.
Messaging Layer Security (MLS) is an open encryption protocol standardised by the IETF (RFC 9420) for securing conversations between two or more devices, with efficient key management for group chats. The GSMA built MLS into RCS Universal Profile 3.0 so that encrypted RCS would work across vendors, instead of relying on Google's earlier Signal-based layer that only protected Android-to-Android chats. Apple adopted this profile in iOS 26.5 (May 2026), which is why RCS between iPhone and Android can now be E2EE — as long as both carriers in the conversation have upgraded to Universal Profile 3.0; otherwise the chat silently falls back to unencrypted RCS or SMS.
For business senders the practical point is what MLS does not cover. RCS for Business (A2P) traffic travels from the brand's RBM platform through the operator to the handset; the MLS session exists between end-user devices, not between a brand's API and a customer. A2P RCS is therefore encrypted in transit but not device-to-device, and it should be treated like any other operator channel for sensitive content such as OTP or account data.
Example: a bank can show a verified sender, rich card and read receipt on an EE iPhone in 2026, but the encryption lock icon customers see in personal chats does not apply to that campaign message.
Apple RCS is live on iPhone. Which EU and UK carriers support it and how to plan campaigns with SMS fallback.
Why unregistered senders get filtered in the EU and UK, and what each country requires for sender ID registration.
Vivo, Claro and TIM coverage, iPhone status, where RCS beats SMS in Brazil and how to launch with SMS fallback.
