Messaging Layer Security (MLS)

What is Messaging Layer Security (MLS)?

Messaging Layer Security (MLS) is an IETF standard for encrypting group and one-to-one messaging that RCS Universal Profile 3.0 uses to deliver interoperable E2EE between iPhone and Android.

Messaging Layer Security (MLS) is an open encryption protocol standardised by the IETF (RFC 9420) for securing conversations between two or more devices, with efficient key management for group chats. The GSMA built MLS into RCS Universal Profile 3.0 so that encrypted RCS would work across vendors, instead of relying on Google's earlier Signal-based layer that only protected Android-to-Android chats. Apple adopted this profile in iOS 26.5 (May 2026), which is why RCS between iPhone and Android can now be E2EE — as long as both carriers in the conversation have upgraded to Universal Profile 3.0; otherwise the chat silently falls back to unencrypted RCS or SMS.

For business senders the practical point is what MLS does not cover. RCS for Business (A2P) traffic travels from the brand's RBM platform through the operator to the handset; the MLS session exists between end-user devices, not between a brand's API and a customer. A2P RCS is therefore encrypted in transit but not device-to-device, and it should be treated like any other operator channel for sensitive content such as OTP or account data.

Example: a bank can show a verified sender, rich card and read receipt on an EE iPhone in 2026, but the encryption lock icon customers see in personal chats does not apply to that campaign message.

Related terms

• End-to-End Encryption
• GSMA Universal Profile
• RCS Business Messaging
• Verified Sender Profile

Related BSG products

• RCS Messaging
• 2FA

Further reading

• Apple RCS on iPhone: What Changes for Business Messaging in EU and UK