The Competition and Markets Authority, the UK competition regulator, opened a consultation on 20 October 2026 on imposing an NFC Access Conduct Requirement on Apple. Behind the legal title sits a hardware question: Apple would have to grant third-party iOS apps access to the NFC controller in an iPhone by Host Card Emulation as well as by Secure Element, with the choice of method belonging to the requesting developer rather than to Apple.
The requirement would be imposed under Part 1 of the Digital Markets, Competition and Consumers Act 2024, which lets the CMA set binding conduct rules on firms it has designated as holding Strategic Market Status, a finding of substantial and entrenched market power in a digital activity. Apple received that designation for its mobile platform on 22 October 2025, and NFC access was flagged as a candidate intervention in that decision and in the CMA’s interventions roadmap for Apple of 23 July 2025. Responses close at 5pm on 17 November 2026, to [email protected], and Apple has confirmed it will not use confidentiality provisions to stop parties responding.
HCE or Secure Element, at the developer’s choice
Apple has historically reserved the NFC hardware and software on iPhone for Apple Pay and Apple Wallet. In October 2024 it opened a route in the UK and other jurisdictions through its NFC and SE Platform, but that route is Secure Element only. A secure element is a dedicated, tamper-resistant chip embedded in the handset which holds the credential and manages the NFC exchange locally, so a transaction completes without a network round trip.
Host Card Emulation inverts the model. The credential stays off the device on a remote server, which sends a limited number of one-time-use tokens down to the handset, and the card emulation runs in software on the application processor rather than on a secure chip. Android has supported HCE since Android 4.4 in 2013, and the consultation document is explicit that neither HCE nor SE was developed by Apple and that neither is specific to any platform or technology provider. Both ride the same 13.56 MHz high-frequency air interface, so to a reader at a terminal a tap is a tap. The RFID glossary covers the underlying terms.
Apple argued that any intervention should be confined to SE. The CMA is rejecting that, and its central evidence is an absence: two years after the NFC and SE Platform became available, it found no evidence of any NFC app launching in the UK using it. Mastercard Wallet Services was announced on the platform in July 2026 and Visa Token Service support for iOS secure element use cases in September 2026, but the CMA treats that as some movement against a need for much broader uptake. The counts of developers authorised for or applying to the platform are redacted in the published document.
Build time is the other half of the argument. Banks and fintechs already running HCE in the European Economic Area or on Android told the CMA they could repurpose those systems for the UK in two weeks to three months, against 12 months or more for a secure element build. A bank starting from scratch put HCE at 12 to 18 months and SE at 18 months or more. Applet certification, SE-specific code and the extra provisioning and credential lifecycle management are what stretch the schedule.
The European comparison is concrete. In July 2024 the European Commission accepted legally binding commitments from Apple to provide HCE-based NFC access for payments across the EEA free of charge, with supporting functionality including default wallet choice. On 9 December 2024, Vipps MobilePay, the Norwegian and Danish payments app, became the first developer anywhere to launch an alternative to Apple Pay on iPhone. PayPal followed in Germany in May 2025, Curve in June 2025, BBVA with BBVA Pay with Visa in Spain in October 2025, and Klarna with Tap to Pay across 14 markets in December 2025.
The stakeholder view is not uniformly anti-SE. Two banks said that if forced to pick one technology they would take SE for its better offline behaviour, though both backed a dual-technology approach, and several respondents treat SE as the value-added route for high-assurance credentials and standards that mandate a secure element.
The definition reaches well past payments
The draft defines an NFC Transaction as presenting, receiving, authenticating or verifying cryptographically protected information, for payment and non-payment use cases alike. It names in-store contactless payments, transit, account-to-account payments and stablecoin on the payment side, and digital identity services, loyalty cards, car and hotel keys and corporate badges on the non-payment side. That breadth is the part worth reading twice if you work in access control or credential issuance rather than payments: a physical access credential, a hotel key or a mobile employee badge delivered through a vendor’s own iOS app, instead of as a pass inside Apple Wallet, would sit inside the scope of the obligation.
Express Mode and Power Reserve: the transit parity clause
Paragraph 8 of the draft decides whether third-party transit and access apps are viable at all. It would oblige Apple to provide interoperable access to all of the iOS functionality used by Express Mode and Power Reserve. Express Mode is Apple’s feature that lets a compatible credential be used in a contactless transaction without the user unlocking the device or authenticating the transaction. Power Reserve keeps those credentials working for a limited period when the handset has too little power for iOS to run normally.
Those two features are what make a phone work at a ticket gate. Without them, a third-party transit app would demand an unlock and a biometric check at every tap, which fails the dwell time a gate allows. The draft would let a third-party app holding default NFC status complete unauthenticated taps wherever Apple Pay and Apple Wallet would not require authentication, and transact with the screen on or off.
Fees, defaults and the compliance clock
Pricing is where the fight will be. Apple’s structure for the NFC and SE Platform combines a periodic provisioning fee per credential with a per-transaction fee. Stakeholders told the CMA that makes entry commercially unviable: one said the per-transaction charge means the effective cost of a bank-enabled wallet rises as average transaction value falls, which hits debit cards hardest; another said the economics break outright where a customer loads a card into a third-party wallet and then rarely uses it, because the transaction fee the wallet earns is lower than the fee it pays Apple. Concerns were also raised about the fixed-fee element and about charges stepping up above a user threshold. The per-tap figures card issuers actually pay are redacted in the published document.
The CMA’s position is that those fees are too high to support viable entry, that the underlying technology was not developed by Apple and is often provided for free or with minimal fees by other mobile providers such as Google, and that it would therefore expect any resulting fees to be “low and substantially lower than Apple’s current charges”. Rather than set a price, the draft sets four principles each fee must satisfy: cost-based, value-based, flexibility and administrative simplicity. The value-based principle requires adjusting for Apple’s market power, and Apple must exclude costs relating to its own downstream products that use NFC access. The flexibility principle requires fee structures that reflect usage frequency and how revenue is generated per NFC tap, with developers able to switch between structures.
The rest is plumbing, and plumbing is where access remedies usually fail. Access must stay effective and of adequate quality, with no unjustified restriction through contractual terms, technical design requirements, app review or enforcement practices, and it must be continuous, with suspension allowed only on a credible threat of serious harm to iOS security, privacy or integrity, or to UK end-users. Developer commercial information could be used only in connection with providing access, ring-fenced from staff working on Apple Wallet, Apple Pay or any competing Apple product. UK end-users would also have to be able to set a third-party app as the Default NFC App, defined as the app iOS launches automatically on a tap unless a different contactless app is open on screen at that moment, and Apple would have to expose a Default Status API so a developer can check whether its app holds that status.
If imposed, the requirement would come into force three months after the final decision. Apple would file an implementation plan within one month, the first iOS version released after that decision would have to carry the necessary technical infrastructure, and compliance reports would follow every three months. The prize the CMA puts on the other side of that work: the UK accounts for roughly 11% of the global fintech sector, 58% of UK adults used mobile payments regularly in 2025 on UK Finance figures, and around 22 million people in the UK use Apple Wallet and Apple Pay at least monthly on the CMA’s estimate.
Read more at https://assets.publishing.service.gov.uk/media/6ad772868ef5e8a9fc8ed610/Consultation_document__NFC_access_.pdf
