Google Launches $10,000‑Year Android Registered App Stores Program, Tightening Third‑Party Marketplace Oversight
What Happened — Google announced the Android Registered App Stores (RAS) program, slated to go live on Dec 1 2026. The initiative lets approved third‑party marketplaces offer one‑tap installs and automatic background updates for Android apps. To qualify, a marketplace must register through the Android Developer Console, own a registered package name, distribute a standalone APK, and submit its entire catalog for Google’s malware scanning. Google also requires remediation of “major security vulnerabilities” and adherence to a set of security policies. The program carries a $10,000 annual registration fee and initially excludes U.S. users. Smaller marketplaces have expressed concern that the cost and strict vetting could be prohibitive.
Why It Matters for Trust & Control Assurance — The RAS rollout spotlights the need for robust third‑party risk management: organizations must verify that any external app store they rely on satisfies comparable security vetting and continuous monitoring requirements.
Who Is Affected — Mobile‑app developers, enterprises that distribute Android applications, and third‑party Android marketplace operators.
Recommended Actions —
- Map Google’s RAS security requirements to your own third‑party risk framework.
- Incorporate mandatory malware‑scan evidence and policy‑compliance attestations into vendor onboarding and continuous monitoring processes.
Technical Notes —
- Fee: $10,000 per year for each approved marketplace.
- Geography: U.S. users are excluded from the initial rollout.
- Security checks: Mandatory submission of app catalogs for Google’s automated malware scanning; requirement to address “major security vulnerabilities.”
- Update mechanism: One‑tap installs and automatic background updates for approved apps.
Source: TechRepublic Security