NFC access conduct requirement: what the CMA’s iPhone proposal means for payment initiation
In short: Under the NFC access conduct requirement that the Competition and Markets Authority (CMA) proposed on 20 October 2026, Apple would have to open the iPhone’s contactless chip to other apps, including for account-to-account payments, on fair and reasonable terms. For a payment initiation provider, the fee structure and the security evidence Apple may ask for remain open. The consultation closes on 17 November 2026.
A payment initiation service provider (PISP) can already move money from a customer’s bank account to a merchant online. It cannot do the same with a tap of an iPhone at a shop till, because Apple reserves the phone’s near field communication (NFC) chip, the hardware behind contactless, for Apple Pay and Apple Wallet. The UK Competition and Markets Authority (CMA) proposed on 20 October 2026 to end that reservation, using its powers under the Digital Markets, Competition and Consumers Act 2024 (DMCC Act 2024). Apple would have to give other apps access to the chip on fair, reasonable and non-discriminatory terms. The CMA’s consultation closes on 17 November 2026.
The CMA has drafted the requirement to cover account-to-account (A2A) payments as well as card payments. The CMA is acting because Apple opened its own paid NFC & SE Platform in the UK in October 2024 and, two years later, the CMA found no evidence of any NFC app launching on it (para 1.13). In the European Economic Area, Apple has given free access since the European Commission accepted its commitments in July 2024, and by December 2025 Vipps, PayPal, Curve, BBVA and Klarna had launched alternative contactless payment services on the iPhone (para 1.14).
Key points
- The CMA proposes the NFC access conduct requirement under section 19 of the DMCC Act 2024, relying on the fair dealing and open choices objectives. Source: CMA consultation document, paras 2.7 and 2.8.
- Apple would have to provide access through host card emulation (HCE) or a secure element (SE), whichever the developer asks for. Source: draft conduct requirement, para 3.
- Account-to-account payments are named in the definition of an NFC transaction. Source: draft conduct requirement, para 2(y).
- Apple could charge a fee, capped by four pricing principles. The CMA provisionally considers it inappropriate to require free access where that would stop Apple recovering its costs and a return. Source: draft conduct requirement, paras 10 and 11; consultation, para 4.163.
- The requirement would come into force three months after any final decision, and Apple would have one month to submit an implementation plan. Source: consultation, para 4.257.
- On Android, Google told the CMA that HCE is free on all devices; the CMA has published no proposal on contactless access for Google’s platform. Source: consultation, para 4.140 and footnote 51; CMA Google case page.
The legal basis for the NFC access conduct requirement
The CMA may impose the NFC access conduct requirement because it designated Apple with strategic market status (SMS) in its mobile platform on 22 October 2025, under Part 1 of the DMCC Act 2024. The CMA treats NFC access as part of the iPhone operating system, which the designation covers. Under section 19(5), the CMA may impose a conduct requirement only if it considers the requirement proportionate for one or more of three objectives. Here the CMA relies on two: the fair dealing objective in section 19(6), that users are treated fairly and can deal with Apple on reasonable terms, and the open choices objective in section 19(7), that users can choose freely between Apple’s services and those of others.
Every conduct requirement must also be of a type permitted by section 20. Among the permitted types it relies on, the CMA may require Apple to trade on fair and reasonable terms (section 20(2)(a)), may prohibit Apple from restricting interoperability (section 20(3)(e)) and may prohibit Apple from treating its own products, here Apple Pay and Apple Wallet, more favourably (section 20(3)(b)). The CMA decides when the requirement comes into force (section 19(11)(a)). Once the requirement is in force, Apple must comply with it for the benefit of anyone a breach may affect, and under section 101 a person who suffers loss from a breach may sue Apple for damages, an injunction or other relief, in the High Court in England and Wales or the Competition Appeal Tribunal. The defences that apply to any claim for breach of statutory duty apply to that claim too.
What a payment initiation provider could ask Apple for
A PISP that requests access under the NFC access conduct requirement could use the NFC chip through whichever of the two technologies it chooses. Both are established technologies that Apple did not develop. HCE keeps sensitive data off the phone and sends a small number of single-use tokens to the device for each transaction. An SE is a dedicated security chip inside the phone that stores the sensitive data and manages the contactless exchange. The CMA’s provisional view is that both can be used securely for payments (para 4.46). Several stakeholders suggested that future uses, including A2A payments, could work well with HCE, while others pointed to the security benefits of an SE (para 4.45). Apple may require a developer that wants both technologies to apply for contactless access separately for each (interpretive note 5).
A customer could make a PISP’s app the Default NFC App, the app iOS launches when the phone meets a terminal (draft para 23). The default app would get the same or equivalent presentation, timing and authentication features as Apple Wallet (interpretive note 9). Apple would have to provide an interface that tells an app whether it is the customer’s default, with no limit on the number of calls (draft paras 24 and 25). Apple’s NFC platform offers no such interface today (para 4.247); for default browsers, Apple limits calls to four a year (para 4.248). Apple would also have to keep the commercially sensitive information it receives from developers away from the Apple Wallet and Apple Pay teams (draft paras 21 and 22). It would have to run an authorisation process with published timelines and give reasons for any refusal (draft paras 15 to 19). For a product that combines a payment service with platform access, the regulatory perimeter and market entry page explains how the two sets of rules are mapped before a build starts.
Security standards and authentication for account-to-account payments
Apple may refuse access where the proposed use does not comply with applicable laws or applicable industry standards (draft para 3). For card payments the reference standard is EMVCo certification (interpretive note 6). The Financial Conduct Authority (FCA) told the CMA that the standards for in-store Open Banking and A2A uses had not yet been determined, and that they could require either technology or both (para 4.34). For a new use case with no agreed or recognised standard, Apple may ask the developer for objective evidence that its privacy and security protections are proportionate (interpretive note 8). If Apple treats in-store A2A payments as such a use case, a PISP would have to make its own security case. Apple may also restrict or suspend access, without notice, where non-compliance with law or standards causes or threatens serious harm, but it must show that the step is strictly necessary (draft paras 6 and 7).
A PISP’s obligations under the Payment Services Regulations 2017 (PSRs 2017) would stay as they are; the NFC access conduct requirement applies to platform access only (footnote 147). Payment initiation remains a payment service under paragraph 1(g) of Part 1 of Schedule 1. A small payment institution may not provide it (regulation 14(4)), so the provider must be an authorised payment institution, an authorised e-money institution or a credit institution (regulation 138(1)). The payer’s bank must still give the PISP access to an online account under regulation 69. Regulation 100(1)(b) requires strong customer authentication (SCA) when a payer initiates an electronic payment transaction, and regulation 100(4) requires the bank to let the PISP rely on the bank’s own authentication procedures. Express Mode, which would let some transactions complete without unlocking the phone (draft para 8), suits transit and similar uses. At the till, a PISP payment is likely to depend on the customer’s bank completing SCA, unless an exemption in the technical standards applies (regulation 100(5)).
Fees under the NFC access conduct requirement and how a PISP would pay them
Apple could charge for access, but each fee would have to be fair, reasonable and non-discriminatory, and Apple would have to show the CMA that it is (draft para 10). No fee could exceed the level produced by four principles (draft para 11):
- cost, including a reasonable rate of return on Apple’s investment;
- value, adjusted to remove the effect of Apple’s market power;
- flexibility, so that fee structures reflect how often and how a developer’s customers use NFC, whether the use is new, and whether and how the developer earns revenue on each tap;
- administrative simplicity.
Developers would be able to choose between fee structures and switch later. Apple could not count costs twice or recover costs of its own downstream products (draft para 12). In the CMA’s provisional view, the fee should be the lowest at which Apple is fairly paid (para 4.141). It considers it inappropriate to require free access where that would stop Apple recovering its costs and an appropriate return (para 4.163), and it has not sought to replicate the European Economic Area approach on price (para 4.264).
When a customer pays by card, the merchant’s bank pays an interchange fee to the bank that issued the card, and in 2025 card issuers paid Apple a fee for each Apple Pay tap in shops (para 5.90(b)). Apple’s current structure combines usage-based fees with fees per stored credential (para 4.202). The CMA tested whether a card wallet copying Apple Pay could cover Apple’s current fees from interchange, and found that it could do so only on a very specific set of assumptions or with substantial cross-subsidy. A provider that receives no interchange fee or other payment on each transaction would need lower fees still (para 4.144). A payment a PISP initiates from the customer’s bank account is not a card payment and carries no interchange fee, so the PISP has to meet Apple’s charge from what it charges the merchant or from other income, which is why the flexibility principle in draft para 11 matters to a PISP. A PISP can answer questions 6.9 and 6.10 with its break-even fee and its view on choosing between tariffs, and the CMA will weigh that evidence before it settles the requirement.
A telecoms access remedy applied to a handset
The CMA has drafted the NFC access conduct requirement in the shape of the access conditions Ofcom may impose on a telecoms network provider with significant market power under section 87 of the Communications Act 2003 (CA 2003). In each case the provider must give access on request, handle requests fairly, avoid undue discrimination, publish its terms and price access on a cost basis. The two differ on the price itself. Ofcom may set a price control where section 88 is met. The CMA proposes principles, leaves Apple to set the fee and justify it, and reserves the power to impose more specific requirements later (para 4.122).
| What the access provider must do | Telecoms network with significant market power (CA 2003) | Apple’s NFC chip (draft conduct requirement, DMCC Act 2024) |
|---|---|---|
| Give access on request | Entitlements to network access as Ofcom directs, s 87(3) | Access through HCE or SE as the developer requests, para 3 |
| Handle requests fairly | Fairness and reasonableness in making and answering requests, s 87(5)(a) | Authorisation process with published timelines and reasons for refusal, paras 15 to 19 |
| Avoid undue discrimination | Condition not to discriminate unduly, s 87(6)(a) | Terms not unduly discriminatory, including between HCE and SE users, para 9 |
| Publish terms | Publication of terms and conditions, s 87(6)(c) | Terms published, with 30 days’ notice of changes other than fee reductions, paras 13 and 14 |
| Price access | Price controls and cost orientation, s 87(9), where s 88 is met | Fee capped by cost, value, flexibility and simplicity principles, set by Apple, paras 10 to 12 |
| Reward investment | Regard to the provider’s investment, s 88(2)(a) | Reasonable rate of return on investment in NFC access, para 11 |
The CMA took a similar approach to fees when it proposed steering conduct requirements for Apple and Google in June 2026.
How the NFC access conduct requirement compares with Android and the EU
A PISP that wants to offer in-store payments across the UK has to access Android phones as well as iPhones, and on Android it can do so now. Google told the CMA that host card emulation is free on all Android devices, including its own Pixel phones, and that it gives third parties free access to the secure element on Pixel phones; on other Android phones, secure element access depends on the manufacturer (para 4.11(b), footnotes 51 and 176). Google Wallet and Samsung Pay both use HCE for payments (para 4.11(b)). On Android, an app can also check whether it is the default contactless app, and Google sets no limit on how often it may do so (para 5.77(c)).
Google offers these terms by its own choice. Google told the CMA that it keeps HCE open and free to make Android more attractive than Apple’s platform (para 4.140). The CMA designated Google with strategic market status in its mobile platform on 22 October 2025, but as at 22 October 2026 the CMA has published no proposal on contactless access for Google’s platform: the CMA’s Google case page lists only its commitments and the proposed steering requirement. If the CMA imposes the NFC access conduct requirement on Apple and Apple breaches it, a PISP that suffers loss could sue Apple under section 101. On Android, a PISP would rely on Google keeping its current terms.
If Apple must offer HCE under the NFC access conduct requirement, a PISP could use the same technology on both platforms. Several stakeholders told the CMA that differences between platforms and jurisdictions add cost to entry (para 4.25). Several banks and fintechs said that HCE products already built for Android, or for iPhones in the European Economic Area, could be rolled out in the UK within two weeks to three months, against twelve months or more for a secure element product (para 4.23). The CMA provisionally concluded that HCE products are likely to reach the UK market faster (para 4.29).
In the European Economic Area, two EU measures apply. The first binds Apple alone: in July 2024 the European Commission made binding Apple’s commitments under Article 102 of the Treaty on the Functioning of the European Union (Case AT.40452) to give third-party developers free NFC access for payments through HCE, with supporting functions such as default wallet choice, for ten years. The CMA records that Apple now also gives secure element access in the EU for government ID (footnote 50). The second binds both Apple and Google as designated gatekeepers. Under Article 6(7) of the Digital Markets Act, each must give other providers, free of charge, effective interoperability with the same hardware and software features as are available to its own services, subject to strictly necessary and proportionate measures to protect the integrity of the device. The Commission issued binding specification measures to Google under Article 6(7) on 16 July 2026 for rival AI assistants on Android, as set out in the analysis of the DMA specification decisions on Google; the EU and UK rules on in-app payments are compared in the analysis of DMA in-app payments. The CMA has chosen not to replicate the EU approach on price (para 4.264), so under the NFC access conduct requirement Apple could charge a fee in the UK.
| Platform and territory | How a payments app can use the NFC chip | Price | Legal basis |
|---|---|---|---|
| iPhone, UK (proposed) | HCE or SE, as the developer chooses; today SE only, through Apple’s NFC & SE Platform | Fee set by Apple under the CMA’s principles, at the lowest level at which Apple is fairly paid | Proposed conduct requirement, s 19 DMCC Act 2024 |
| Android, UK | HCE on Android devices; SE on Pixel and, on other devices, as the manufacturer allows | HCE free; SE free on Pixel, otherwise set by the manufacturer | Google’s own terms; no CMA proposal on contactless access |
| iPhone, EEA | HCE for payments; SE for government ID | Free for HCE | AT.40452 commitments (Article 102 TFEU); Article 6(7) DMA |
| Android, EEA | HCE on Android devices; SE as for the UK | Not stated in the CMA consultation | Google’s own terms; Article 6(7) DMA applies to Android generally |
Viewpoint
I read the NFC access conduct requirement as an access remedy of the kind telecoms regulation has applied to networks since the Communications Act 2003, now applied to the hardware inside a handset. On mechanics, the CMA has drafted most of what a PISP needs: default status, a default-status interface without call limits, a firewall around developer information and a refusal process with reasons. A PISP needs both platforms to cover the UK market, and Android already offers HCE free, so the level of Apple’s fee will weigh heavily in the business case. For A2A payments, the security standard and that fee remain open.
The FCA has told the CMA that the standards for in-store A2A payments have not yet been set (para 4.34). Until they are, Apple may judge each PISP’s security case for itself under interpretive note 8. On price, a PISP can pay Apple only from what it charges merchants or from other income. Whether it can afford to depends on the fee structure Apple sets under the flexibility principle in draft para 11. The consultation asks developers for their break-even fee and their views on tariffs, and a PISP can answer both. Once a requirement is imposed, a developer that suffers loss from a breach may also sue Apple directly under section 101, alongside any enforcement by the CMA.
Frequently asked questions
What is the NFC access conduct requirement?
The NFC access conduct requirement is a rule the CMA proposed on 20 October 2026 under section 19 of the Digital Markets, Competition and Consumers Act 2024. It would oblige Apple to give developers access to the iPhone’s NFC chip through host card emulation or a secure element, on fair, reasonable and non-discriminatory terms, so that apps other than Apple Pay and Apple Wallet can make contactless transactions. The consultation closes on 17 November 2026.
Does the NFC access conduct requirement cover account-to-account payments by a PISP?
Yes. The draft defines an NFC transaction to include account-to-account payments, and several stakeholders suggested such payments could work well with host card emulation. The FCA told the CMA that standards for in-store account-to-account payments have not yet been determined. For a use case with no recognised standard, Apple may ask a developer for objective evidence that its privacy and security protections are proportionate.
Would NFC access on the iPhone be free in the UK?
Not necessarily. Apple could charge a fee, but the fee could not exceed the level produced by cost, value, flexibility and simplicity principles, and Apple would have to justify it to the CMA. The CMA expects fees to be low and substantially lower than Apple’s current charges, but has not proposed to replicate the free access Apple provides in the European Economic Area.
Does the NFC access conduct requirement apply to Android?
No. The proposed requirement applies only to Apple. Google told the CMA that host card emulation is free on all Android devices and that it gives free secure element access on its own Pixel phones. Google offers these terms by its own choice, and the CMA has published no proposal on contactless access for Google’s platform. In the European Economic Area, Apple and Google must each give other providers free interoperability with the same device features their own services use, under Article 6(7) of the Digital Markets Act.
Does NFC access change a PISP’s obligations under the PSRs 2017?
No. The NFC access conduct requirement applies to platform access only (consultation, footnote 147). A payment initiation service provider must still be an authorised payment institution, an authorised e-money institution or a credit institution. The payer’s bank must still give it access to an online account under regulation 69 of the Payment Services Regulations 2017, and strong customer authentication applies under regulation 100 when the payer initiates the payment.
For advice on platform access and the payments perimeter for an account-to-account or tap-to-pay product, or on responding to the CMA consultation, contact Rob Bratby at Bratby Law.
