The mandate says digital, not NFC

The Premier League’s own wording is deliberately technology-neutral. A digital ticket is one delivered electronically, most commonly to a mobile phone, and assigned to a named supporter registered with the club. The league’s stated rationale is anti-touting and fraud prevention, and it points at “hidden or rotating barcodes” as the security mechanism. Nothing in that language requires a radio.

Clubs could have complied with a rotating QR code and been done with it. A significant number did not. They went to 13.56 MHz HF, wallet passes and tap entry, because the operational problem they actually needed to solve was not fraud. It was throughput.

The two-year grace period for promoted clubs is not a softening of the rule, it is an acknowledgement that stadium ingress is a capital project. A club coming up from the Championship is not just buying a ticketing platform. It is potentially retrofitting reader heads in every turnstile lane, rewiring, revalidating egress procedures, retraining stewards and running a season of parallel operation before it can safely switch anything off. Two years is roughly one procurement cycle plus one shakedown season. It is a realistic number, not a generous one.

Where the fifteen actually are

“Fifteen clubs with NFC deployed to some degree” hides a wide spread of maturity, and the differences are the story.

Arsenal has completed the transition. The club is on 100 per cent digital ticketing at the Emirates and its supporter-facing FAQ set now explains near field communication to fans as a matter of routine, alongside separate iPhone and Android guidance. It is worth being precise about one thing that has been misreported elsewhere: 31 August is simply Arsenal’s first home fixture of the campaign, not an enforcement deadline. There is no cutover pending there. Note also that Arsenal’s FAQs still address a rotating QR code on Android, and explicitly rule out screenshots, which points to a dynamic optical fallback running alongside the NFC path rather than a hard NFC-only estate.

Tottenham Hotspur has taken the most aggressive position in English football. Working with ticketing platform FortressGB, the club is removing QR codes from digital tickets and passes entirely for 2026/27 and asking every fan to tap. The club’s own reasoning is refreshingly unmarketed: QR scanning causes delays, often because of low screen brightness, and QR is easier to duplicate and reshare. Spurs are updating stadium signage and giving turnstile operators extra training for the changeover, which is the detail that tells you they expect a behavioural problem, not a technical one.

Liverpool has been running NFC passes at Anfield for a while and has the most mature pass lifecycle of the group. Season ticket holders and members hold a pass in Apple Wallet or Google Wallet that automatically updates itself with the next fixture they are due to attend, so there is nothing to re-download between games. Passes for the new campaign were issued from 22 June. Liverpool sets a device floor of iPhone 6 and above plus most Android handsets, and the same pass doubles as proof of membership for retail discounts in club stores, which is a neat piece of credential reuse.

Manchester City and Crystal Palace are the two confirmed VTAP reader deployments, City at the Etihad and Palace at Selhurst Park, with fans directed to tap on a dedicated reader at the lane.

The reader layer nobody is writing about

VTAP readers are made by Dot Origin, a UK company with more than twenty-five years in the smart card and NFC business, working in partnership with Apple and Google. Outside the Premier League the same hardware turns up across every La Liga stadium, at FC Porto and at Ascot Racecourse.

The product line matters because it maps neatly onto how venues actually retrofit. There are embedded NFC reader boards designed to go inside an existing turnstile head, which is the difference between a firmware and bracket job and ripping out the pedestal. There are standalone indoor and outdoor access control readers for gates and hospitality doors. There are USB and Bluetooth desktop, kiosk and point of sale units, which is how the same wallet pass ends up being read at a merchandise till or a hospitality check-in desk. And there are hybrid heads that accept NFC, contactless RFID cards, barcode and QR in a single unit.

That hybrid capability is doing a lot of quiet work. Clubs are not starting from nothing. Most have an installed base of physical contactless season cards, staff and contractor credentials, and accreditation media that still need to be read at the same lanes. A reader that handles a wallet pass and a legacy HF card without a second head on the pedestal is what makes a phased migration survivable.

What actually happens when a fan taps

This is the part missing from every consumer write-up. A wallet ticket is not a tag and it is not a stored barcode with a radio bolted on. It is a cryptographic credential presented by the handset in card emulation mode over the standard 13.56 MHz HF interface.

On iPhone that exchange runs over Apple’s Value Added Services protocol. The reader broadcasts an identifier for the pass issuer it is looking for, the phone selects the matching pass without the fan having to open anything, and returns a payload encrypted to a key pair the venue controls. On Android the equivalent is Google’s Smart Tap, which negotiates a session key with the reader and returns a signed pass payload the same way. In both cases the reader is not “scanning” anything the user can see. There is no visual representation of the credential to copy.

Two practical consequences follow. First, the value that comes off the tap is not a static number, so intercepting one transaction does not give you a reusable ticket. Second, because the pass and its keys live on the device, the handset does not need a data connection at the gate. Network dependence sits on the venue side, at the reader and the validation host, which is exactly where a stadium operator can engineer redundancy. That is a materially different failure profile from a fan standing in the rain trying to load a web ticket on congested cellular.

The anti-touting consequence is the one the league cares about. A barcode, even a rotating one, is a picture, and a picture can be photographed off a screen and sold. A wallet pass has no picture to sell. Arsenal’s FAQs make the point to fans directly, telling them a screenshot will not get them through the gate, and Tottenham cite duplication and resharing as a reason for dropping QR entirely. Transferring a ticket then has to go through the club’s own transfer flow, which is precisely where a club wants the audit trail to sit.

Why throughput is the real driver

Consider the arithmetic of a 60,000 seat bowl. The overwhelming majority of that crowd arrives inside a 40 minute window before kick off, through a fixed number of lanes. Every second of average dwell time per fan at the turnstile multiplies out across tens of thousands of transactions into queues on the concourse and outside the ground.

An optical scan is a chain of things that can go wrong. The screen has to be awake, bright enough for the imager, held at the right angle and distance, and not obscured by a case, a wet phone, a glove or low winter sun. Auto-brightness fights you. Any one of those failures turns into a retry, a steward intervention and a stalled lane.

A tap has almost none of that. It is a proximity event over a few centimetres, it works in darkness and rain, it does not care about screen brightness or orientation, and on iPhone with Express Mode enabled it does not require the fan to unlock the device or open an app at all. Tottenham’s public reasoning and Manchester City’s turnstile upgrade programme point at the same conclusion: the queue, not the fraudster, is what pushed these clubs to radio.

The friction that does not make the press release

None of this is free. Liverpool’s own guidance carries a blunt warning: do not delete the pass from your wallet once it is downloaded, because it may not be possible to re-download it. Pass reissue is the hardest part of any wallet credential programme, and telling supporters to be careful is a mitigation, not a fix. A lost or replaced handset on a matchday morning is a box office problem, and every club needs a manned fallback path for it.

There is a device floor, too. Liverpool’s iPhone 6 and above line is generous, but it is still a line, and older or budget Android handsets with unreliable NFC stacks will produce a tail of failed taps for a steward to resolve at the lane. Any fan without a smartphone is dependent on club discretion. The Premier League has kept that door open, allowing clubs to issue alternative formats to supporters with reasonable grounds, including disabilities that make digital tickets difficult to buy or use. How generously individual clubs interpret “reasonable grounds” is now a genuine accessibility question, and it will be tested in public during the first few matchdays.

And a tap-only estate concentrates risk. Removing the QR fallback, as Tottenham are doing, removes the thing that saves you when a reader head fails or a phone will not cooperate. It is a defensible decision, but it moves the burden onto reader reliability, spares holding and steward training.

What to watch next

The opening weekend of 21 to 23 August is the first real load test of the mandate at scale, and Arsenal’s first home fixture, expected around 31 August, will be watched as an example of a completed transition operating at full capacity rather than as a deadline. Beyond that, the obvious next question is open loop. The readers going into these turnstiles already speak the same 13.56 MHz language as a contactless bank card, and hybrid units already handle physical HF credentials. Whether clubs move from a wallet pass to accepting the card the fan bought the ticket with, as transit operators did, is the interesting part of this story that has not started yet.