My Nexus 5 is now working with ASB Virtual!!

It took me a few hours, but I've detailed the fix below so it will hopefully save someone else the time in future!

Short Version

While the phone wasn't rooted, there were remnant files from a previous rooting (not by me!).  A stock re-flash of the phone resolved the issue.

Long Version

After speaking to the ASB support specialist team, we noticed that there was no option for 'Android Pay' in the 'Tap and Pay' settings.  This was a bit strange because it's pretty much standard on NFC capable Androids plus one of the team had a Nexus 5 which was working fine with ASB Virtual.

On a hunch I tried manually installing Android Pay from the Play Store, thinking that perhaps there were some bundled components which were required, but I was unable to install it due to apparently having 'No compatible devices'.

This set me off on a fairly lengthy research mission to work out why my device was considered 'Incompatible'.

I found out that Android Pay and similar apps like ASB Virtual, use the Google 'SafetyNet' framework built into the Android OS to verify whether a device is clean and unmodified.  I found a SafetyNet checking app which can test this and it returned the result of 'CTS Profile Match: False':

While I wasn't really able to determine exactly what this means, it did get me thinking about what could be causing the check to fail, including whether the phone had been rooted without my knowledge.  After running a root checker app I was surprised to see that it came back as 'rooted'! 

The phone is apparently 'brand new', but who knows, maybe the seller had to unlock it or something?  There was no other signs that the phone was rooted and when I installed SuperSU it indicated that it couldn't run because the phone wasn't rooted!?  A number of other unrooting apps failed, so I followed these instructions to attempt to unroot the device manually.  However, because the device wasn't actually rooted, it wasn't possible to perform a manual unroot.

I was going to root the device in order to unroot it, but decided to re-flash it with a stock image using these instructions and the USB Driver here.  I didn't install the full SDK in the end, I just extracted the required folder using 7-Zip.

After the re-flash I had Android Pay in the 'Tap and Pay' options, and SafetyNet passed:

ASB Virtual activated without issue and I have now successfully made a payment with the phone!

So the moral of the story is: even if you think your phone is not rooted, it pays to check!

Other Useful Information

- An unlocked bootloader doesn't affect the results of the SafetyNet check
- The phone image must be a stock / signed ROM to pass the SafetyNet check

 Thanks to the ASB team who were very willing to help and put me on the right track to get this resolved!