The Payment Terminal Already in Your Pocket
What if accepting card payments required no hardware at all? That is the promise of Tap-to-Pay — also known as SoftPOS or Tap-to-Phone: a simple application turns the merchant's Android smartphone into a contactless payment terminal. The customer taps their card or phone against the merchant's device, and the payment is collected. No TPE, no Bluetooth reader, no cables.
Don't confuse the two directions: in classic contactless payment, it is the customer's phone that emulates a card. With Tap-to-Pay, the roles flip — the merchant's phone plays the terminal and reads the customer's card through its NFC chip. A complete reversal of the acceptance model.
In Morocco, this technology is still emerging: deployment depends on local acquirers and payment schemes enabling it. But it deserves every merchant's attention today, because it could radically lower the barrier to card acceptance.
How Does Tap-to-Pay Work?
NFC Reading on the Merchant Side
Technically, the SoftPOS application uses the smartphone's NFC chip in reader mode: it talks to the customer's card (or mobile wallet) using the EMV Contactless protocol, exactly as a dedicated terminal would. Transaction data is encrypted at the moment of capture, then transmitted to the acquirer for online authorization.
Secure Element or HCE: The Two Sides of the Tap
To properly place SoftPOS, you have to distinguish the two roles in a contactless transaction. On the payer side, a phone emulating a card does so in one of two ways: either through an embedded Secure Element — a dedicated hardware chip that isolates payment data, the Apple Pay approach — or through HCE (Host Card Emulation), purely software-based card emulation where tokenized credentials are hosted in the cloud. This is the route Android opened in version 4.4, and the one Google Pay uses.
The Acceptance Side: Software Instead of a Secure Element
The same trade-off appears in mirror image on the acceptance side — the subject of this article. A classic terminal protects its cryptographic keys inside a physically tamper-resistant hardware Secure Element. A consumer smartphone has no secure element dedicated to payments: SoftPOS compensates with layered software defenses under permanent supervision:
- White-box cryptography: keys are fragmented and hidden inside the code, never stored in the clear
- Runtime protection (RASP): the app detects rooting, debugging, and code injection, and locks itself down on any anomaly
- Continuous attestation: a monitoring backend constantly verifies device integrity and can remotely revoke a compromised terminal
- End-to-end encryption: card data never travels in the clear through the Android system
PIN on Glass
For amounts above the contactless limit, the customer enters their PIN directly on the smartphone screen — known as "PIN on glass." The keypad is displayed in a randomized, isolated layout to prevent capture, and the PIN is encrypted from the first keystroke. This capability, long reserved for certified terminals, is now governed by a dedicated standard.
Who Is Tap-to-Pay For in Morocco?
The typical profile: a mobile professional or a small business for whom buying a terminal remains a barrier.
- Delivery riders: collect card payments at the customer's door, with no extra device to carry or charge
- Markets and souks: vendors equipped with a basic Android phone can accept cards where cash still rules
- Mobile artisans: plumbers, electricians, at-home hairdressers — payment happens on site, right after the job
- Queue busting: at peak hours, every salesperson becomes a mobile checkout point that relieves the register
- Businesses just starting out: test card acceptance without tying up capital in hardware, then move to a dedicated terminal once volume justifies it
Tap-to-Pay vs Classic POS Terminal: The Honest Comparison
| Criterion | Tap-to-Pay (smartphone) | Dedicated POS terminal |
|---|---|---|
| Hardware cost | Zero (existing phone) | Terminal purchase or rental |
| Mobility | Total — the device is already in your pocket | Good for portable models |
| Receipt printing | No — digital receipt by SMS or email only | Built-in thermal printer |
| Durability | Consumer phone, fragile under intensive use | Ruggedized hardware built for the counter |
| Battery | Shared with the phone's personal use | Dedicated, lasts the full day |
| Business management | Depends on the app | Catalog, stock, Z report built in (Smart POS) |
| Getting started | Download an application | Hardware delivery and setup |
The conclusion writes itself: Tap-to-Pay is not a replacement for the POS terminal — it is a complement. A high-volume restaurant will keep its Smart POS with printer and cash management; its delivery rider will collect payments with a phone.
Security and Certification: The PCI MPoC Standard
The PCI Security Standards Council — the body that defines card payment security standards — published the MPoC (Mobile Payments on COTS) standard, which specifically governs solutions turning consumer devices into payment terminals. It unifies the earlier CPoC (contactless only) and SPoC (software PIN) standards, and requires:
- Evaluation of the solution by an accredited security laboratory
- Continuous monitoring of devices in production, with remote revocation
- Strict requirements for PIN protection and card data encryption
For merchants, the rule of thumb is simple: never use a Tap-to-Pay solution that does not rest on a recognized certification and a licensed acquirer. Ease of installation is no substitute for regulatory rigor.
The Limits You Should Know
- Android with NFC only: the technology requires a recent Android smartphone with an NFC chip. On iPhone, Tap to Pay acceptance only exists in countries where Apple has enabled it with partner providers
- Connectivity is mandatory: every transaction is authorized online, and security attestation requires a regular connection — there is no offline mode comparable to a dedicated terminal's
- No paper receipt: in contexts where a printed receipt is expected, a digital receipt does not always suffice
- One device for everything: personal phone and payment tool become one, raising real questions of battery, breakage, and separation of uses
Where Does Morocco Stand?
Let's be precise: Tap-to-Pay is an emerging technology in Morocco. Its rollout depends on local acquirers and payment schemes enabling it, and on candidate solutions being validated within the Moroccan regulatory framework. No certified offer is broadly available to the general market today — which is exactly what makes this a topic worth watching closely.
Is the Smartphone Base Ready?
According to StatCounter, roughly 70% of smartphones in circulation in Morocco run Android — a considerable theoretical base for SoftPOS. But not all of that base is equipped: the African market is dominated by entry-level devices — according to TechCabal, about 80% of smartphones sold in Africa in 2025 cost under 200 dollars — a segment where an NFC chip is far from standard. With no reliable statistic on the exact NFC-capable share of the Moroccan fleet, the qualitative reality stands: only a minority of the entry-level base is Tap-to-Pay ready today.
Three signals to watch in the coming months:
- Tap-to-Phone activation by Moroccan acquirers and the card networks present in the market
- The first MPoC certifications of solutions aimed at the Moroccan market
- Small-merchant inclusion programs, for which SoftPOS is a natural lever
Another development to watch: Mastercard is expected to unveil Cloud Tap-to-Pay (part of Mastercard Cloud Commerce) at GITEX Africa in Marrakech — a solution that turns everyday NFC smartphones and low-cost devices into secure payment terminals by shifting 90% of the contactless payment software kernel into the cloud. Less critical software on the device means an even lower hardware and certification barrier for entry-level Android — the very illustration of this article's thesis: the hardware barrier of payments, from the Secure Element to the kernel itself, is progressively dissolving into software and the cloud.
How to Get Ready with Aslan
Aslan operates as a Principal Agent of a payment institution licensed by Bank Al-Maghrib, and is closely tracking SoftPOS developments for the Moroccan market. While the technology matures, mobile merchants can already collect payments without a terminal through QR code payment, which requires no hardware, and established points of sale can equip themselves with a full Smart POS terminal.
Developers and integrators who want to prepare their checkout flows can explore our technical documentation to connect their applications to the Aslan payment ecosystem today.
FAQ: Tap-to-Pay in Morocco
Is Tap-to-Pay available in Morocco today?
The technology is in its emerging phase: deployment depends on local acquirers and payment schemes enabling it. No certified offer is yet broadly available in the Moroccan market — watch for announcements from licensed players.
How is this different from Apple Pay or Google Pay?
Apple Pay and Google Pay are for paying: the customer's phone emulates a card. Tap-to-Pay is for accepting: the merchant's phone becomes the terminal that reads the card.
Is it as secure as a real terminal?
Solutions certified under PCI MPoC compensate for the missing hardware secure element with end-to-end encryption, runtime protections, and continuous monitoring with remote revocation. The level of rigor is comparable — but only for certified solutions.
What phone do I need to accept Tap-to-Pay payments?
A recent Android smartphone with NFC, an up-to-date system, and an internet connection. Rooted or modified phones are rejected by integrity checks.
Will Tap-to-Pay replace POS terminals?
No. It extends card acceptance to mobile professionals and small merchants, but the dedicated terminal keeps its advantages: printer, ruggedness, dedicated battery, and built-in business management. The two models will coexist.