CMA iPhone NFC access proposal: HCE wallets, Apple fees and UK fintech plans for 2027

Summary. This is a proposal, not a rule. On 20 October 2026 the Competition and Markets Authority (CMA) proposed an NFC access conduct requirement under the Digital Markets, Competition and Consumers Act 2024 that would oblige Apple to give developers contactless access to the iPhone for UK users through host card emulation (HCE) or the secure element (SE), whichever the developer asks for, on fair, reasonable, transparent and non-discriminatory terms. The consultation closes on 17 November 2026, and on 13 November the case page showed no final decision or decision date. Today UK developers can only use Apple's paid NFC & SE Platform, and the CMA found no evidence of any UK app launching on it, while in the European Economic Area (EEA), where HCE access has been free since July 2024, five rival tap-to-pay apps have launched. Apple could still charge, at fees the CMA expects to be substantially lower than today's. The requirement would take effect three months after a final decision, and banks told the CMA that existing HCE products could reach UK iPhones within two weeks to three months. Our view: respond if you can, design for HCE now, and keep SE as a parallel track.

About this article. For product, engineering and payments leads at UK banks, fintechs, transit operators and wallet providers. On 13 November 2026 we checked every date, paragraph reference and requirement against the CMA's consultation document, case pages and press release, the DMCC Act 2024 and Payment Services Regulations 2017, and Apple's developer documentation. This is general information, not legal advice; the CMA has not decided, and Apple sets its own terms. No vendor or regulator paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What the CMA proposed on 20 October 2026, and what is still open

The proposal sits on the CMA's case page for Apple's mobile platform, last updated on 5 November 2026 with a change of decision makers, not a decision. The CMA designated Apple with strategic market status (SMS) for its mobile platform on 22 October 2025. That lets it impose conduct requirements under section 19 of the DMCC Act 2024, and section 19(11) says a requirement comes into force at a time the CMA decides.

The 147-page consultation document rests on two statutory objectives, fair dealing and open choices (paras 2.7 and 2.8). Its draft requirement, in chapter 3, has these main elements.

Two points carry the commercial weight. The first is technology choice. HCE keeps sensitive data off the device and sends a small number of one-time-use tokens to the phone, so a bank does not need an applet certified and installed on Apple's chip (para 1.11). The second is default status. Field detect and double-click already launch a default contactless app on Apple's SE platform. What developers lack is a way to check whether their app is the default: the NFC platform offers none, and for default browsers Apple caps the equivalent check at four calls a year (paras 4.247 and 4.248).

Scope details matter too. The draft covers consumers ordinarily based in the UK with an Apple account registered there, including while they travel abroad temporarily, and it excludes smartwatches, so Apple Watch is outside it. Apple would also have to keep developers' commercially sensitive information away from its Wallet and Pay teams.

The CMA is not setting Apple's price, and it has not copied the EEA approach on pricing (para 4.264). A wallet choice screen or similar measure would be considered only once access is in place (footnote 17).

How UK iPhone NFC access works today: Apple's NFC & SE Platform

Apple's NFC & SE Platform lists the United Kingdom as eligible, with iOS 18.1 or later on iPhone XS or later. It supports in-store payments, car keys, closed-loop transit, corporate badges, student IDs, home and hotel keys, merchant loyalty and event tickets; government ID, added in iOS 26.4, covers only the EU, New Zealand and the US.

The route runs through Apple at every stage. Your Apple Developer Program Account Holder submits a request; you sign a binding agreement that covers commercial terms and any fees, plus a confidentiality agreement; you onboard in Apple Business Register and request the entitlement; an independent accredited lab reviews your applet before Apple verifies, signs and hosts it; and you build provisioning, presentment, lifecycle and presentment intent flows to Apple's specifications. App Review then needs a TestFlight build, test login details, a test credential, screenshots or video of a terminal transaction, and video of the presentment intent API in use.

Payment apps need a licensed financial institution or payment service provider behind them, PCI DSS and EMVCo compliance, written vulnerability policies, and prompt notice to Apple of any actively exploited vulnerability.

Apple does not publish its UK NFC fees. The CMA describes a mix of usage-based and per-credential fees (para 4.202), and records complaints about a fixed fee element, charges that rise past a user threshold, non-negotiable use-case terms, and Apple's freedom to change, deny or delay access. Apple argues that any intervention should focus only on SE (para 1.15). Mastercard (July 2026) and Visa (September 2026) announced services to help developers build on the platform, and Mastercard said it expected consumers to see new capabilities by the end of 2026. The CMA calls this some movement, not proof that access works (para 1.13).

HCE vs SE: what the choice changes for your build

The CMA's provisional view is that both technologies can be used securely for payments (para 4.46). Multiple banks and fintechs told it that HCE products already running on Android or in the EEA could launch in the UK in two weeks to three months, against 12 months or more for SE (para 4.23). A bank starting from nothing said 12 to 18 months for HCE and more than 18 for SE (para 4.24). The table also draws on Apple's EEA HCE page.

HCE suits card wallets, loyalty and most closed-loop schemes. SE still makes sense where a standard expects hardware storage or a credential must work offline for long periods. The CMA notes that the Car Connectivity Consortium digital key standard currently works only with SE, while EMVCo card standards and the EU digital identity wallet standards work with both, and that SE may help high-risk uses such as digital identity (paras 4.32, 4.33, 4.46 and 4.50). For identity checks, our EUDI Wallet acceptance guide covers the in-person presentation standards. Since Apple may require separate applications for each technology, plan HCE and SE as separate entitlement requests.

The EEA precedent: what happened after Apple opened HCE

Apple's EEA HCE page says its commitments to the European Commission apply from 17 July 2024, last ten years and give eligible developers free access, with default payment app choice, field detect, double-click and Face ID, Touch ID or passcode authentication. The CMA lists what followed (para 1.14, footnotes 19 to 23).

In the UK, by contrast, not a single firm has launched a rival wallet-type product. Two details of the EEA scheme help UK planning. HCE entitlements are issued per bundle ID and list the application identifiers (AIDs) your app answers to, so adding an AID means re-submitting. And Apple lets HCE developers test outside the EEA on up to 100 devices running iOS 18.2 or later, so a UK team can rehearse an HCE build today.

Where the EEA uses a monitoring trustee and an NFC Appeal Board, the UK draft puts complaints on Apple, backed by CMA compliance reports every three months (para 4.259). Once a requirement is in force, section 101 of the DMCC Act also lets anyone who suffers loss from a breach sue.

Fees: what the pricing principles mean for a business case

Under draft paragraph 11, no fee could exceed the level set by four principles:

• Cost: Apple's direct and indirect costs, plus a reasonable return on investment.

• Value: the value of Apple's services, adjusted to remove the effect of its market power.

• Flexibility: structures reflecting usage frequency, whether the use case is new, and whether the developer earns revenue per tap.

• Administrative simplicity: clear fees whose terms do not hold back take-up.

Developers could choose and later switch fee structures. Apple would have to show the CMA that its fees comply, could not count costs twice, and could not recover costs of its own products that use NFC (draft paragraphs 10 to 12). The CMA's provisional view is that the fee should be the lowest at which Apple is fairly paid (para 4.141), and that free access would be inappropriate where it stops Apple recovering its costs and a return (para 4.163).

The CMA found that a card wallet copying Apple Pay could cover Apple's current fees from interchange only under very specific assumptions or with substantial cross-subsidy, and that models without interchange need lower fees still (para 4.144). An account-to-account (A2A) payment carries no interchange, so a payment initiation provider must fund Apple's fee from merchant charges or other income, as Bratby Law points out. For scale, the CMA says UK card issuers paid Apple a total in a redacted range of up to £150 million in per-tap fees for in-store Apple Pay in 2025 (para 5.90).

Until Apple publishes compliant terms, treat the fee as a variable:

            Monthly NFC cost       = (active iPhone users x taps per user x fee per tap)
                         + (stored credentials x fee per credential)
Break-even fee per tap = revenue per tap - your own processing cost per tap
Example inputs:          50,000 users x 20 taps a month = 1,000,000 taps
Every 0.1p per tap     = 1,000,000 x £0.001 = £1,000 a month, £12,000 a year
          

The 0.1p step is a sensitivity unit, not an estimate of Apple's fee; include a per-credential charge too. Google told the CMA that HCE is free on all Android devices (footnote 176), so the iPhone fee will set your blended cost per tap. Any NFC fee would sit alongside App Store commission, which our comparison of Google Play and App Store fees in the US and UK covers.

Timeline: what happens between now and a 2027 launch

The CMA will decide after assessing responses and has set no date. The steering requirement is a signal. The CMA opened that consultation on 30 June 2026 and said it would decide later this year, with no date; it published responses on 14 August 2026, and on 13 November 2026 the case page still showed no final steering decision. Our guide to the UK App Store steering rules tracks that case. The dates below come from the case page, the call for evidence and the consultation.

The draft also says the first iOS version released after a final decision must contain the functions needed for access (draft paragraph 4(a)). As one planning scenario, not a forecast: a decision in the first quarter of 2027 would mean the requirement in force in the second quarter, with UK HCE entitlements and fees to follow. Anyone with a sufficient interest, Apple included, can ask the Competition Appeal Tribunal to review the decision, but that does not suspend it unless the Tribunal directs otherwise. Treat every date after 17 November 2026 as unconfirmed and re-check the case page monthly.

What UK banks, fintechs and transit apps should plan

Our planning view, not the CMA's:

UK banks and card issuers

For issuers, the question is channel cost: Apple Pay keeps working, and the case for a bank wallet rests on loyalty features, in-store spend data and a fee below what you pay per Apple Pay tap; run the worksheet against your Apple Pay costs. Banks already contracted on the SE platform could request the new terms (draft paragraph 20).

Fintechs and payment initiation providers

For A2A tap-to-pay, three questions stay open. The FCA told the CMA that standards for in-store Open Banking and A2A had not yet been set and could require HCE, SE or both (para 4.34). Without a recognised standard, Apple may ask for objective evidence that your privacy and security protections are proportionate (interpretative note 8). And the requirement changes platform access only, leaving Payment Services Regulations 2017 obligations as they are (footnote 147). Strong customer authentication still applies when a payer initiates an electronic payment (regulation 100), and a small payment institution registration cannot cover payment initiation (regulation 14(4)). If you also plan recurring payments, see our guide to commercial variable recurring payments in 2027.

Transit and ticketing apps

Express Mode lets Apple Wallet complete a tap without unlocking or authenticating, and Power Reserve keeps it working for a limited time after the battery runs too low for iOS (draft paragraphs 2(j), 2(z) and 8). Questions 6.5 to 6.8 ask what terminal changes and security risks this access would bring, so this part may change. If narrowed, an app needing Face ID before every gate will lose to Wallet.

Build checklist: the next 90 days

1. Respond if you can. Aim for 5pm on 17 November 2026. An NDA with Apple should not stop you, and Apple has said it will not use other confidentiality terms to block responses. Questions 6.9 and 6.10 ask for break-even fees and tariff preferences; give real numbers.

1. Inventory your use cases. List each credential, its scheme, its AIDs and whether it must work offline.

1. Abstract the presentment layer. Wrap Apple's CardSession (HCE) and CredentialSession (SE) APIs behind one interface.

1. Reuse your token service. Confirm that your token lifecycle, limited-use key replenishment and device binding can serve iOS.

1. Prepare the security file. PCI DSS scope, EMVCo or scheme approvals, a vulnerability policy and incident notice process are Apple prerequisites on both routes.

1. Design the default-app journey. Plan prompts around the default status API, and avoid Apple Pay or Wallet marks and look-alikes, which Apple bans.

1. Set up a test rig. The Xcode Simulator cannot run NFC card emulation; budget iPhone XS or later handsets and terminals.

1. Brief your board. Show the fee sheet and the 2027 timeline as ranges, with a stop-go point at the final decision.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our iOS developers can scope an HCE port from Android or the EEA, or run HCE and SE tracks in parallel until the CMA decides. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. Proposed NFC access conduct requirement for Apple's mobile platform, consultation, 20 October 2026 — Competition and Markets Authority

1. Apple's mobile platform, case page, last updated 5 November 2026 — Competition and Markets Authority

1. Consultation document: NFC access conduct requirement, Apple's mobile platform, 20 October 2026 (PDF) — Competition and Markets Authority

1. CMA outlines proposals to unlock contactless technology on Apple iPhone, 20 October 2026 — Competition and Markets Authority

1. Digital Markets, Competition and Consumers Act 2024, section 19 — legislation.gov.uk

1. NFC & SE Platform for secure contactless transactions — Apple Developer

1. HCE-based contactless NFC transactions for apps in the European Economic Area (EEA) — Apple Developer

1. Digital Markets, Competition and Consumers Act 2024, section 101 — legislation.gov.uk

1. NFC access conduct requirement: what the CMA's iPhone proposal means for payment initiation, 22 October 2026 — Bratby Law

1. CMA consults on new requirements for Apple and Google's mobile platforms, 30 June 2026 — Competition and Markets Authority

1. Issues relating to NFC access on iOS, call for evidence, 30 June 2026 — Competition and Markets Authority

1. Digital Markets, Competition and Consumers Act 2024, section 103 — legislation.gov.uk

1. Payment Services Regulations 2017, regulation 100 — legislation.gov.uk

1. Payment Services Regulations 2017, regulation 14 — legislation.gov.uk