The UK’s Competition and Markets Authority (CMA) has put Apple’s control over iPhone contactless payments under a sharper microscope. Its new proposal argues that Apple’s current fees and conditions for access to the iPhone’s NFC payment capabilities may be holding back financial-technology businesses, and it points toward a remedy that would make that access broader and cheaper.
This is a payments story first, but it is also a familiar platform story: the fight over who gets to build on the most important hardware features inside a device people already own. On an iPhone, a tap at a shop terminal can involve a merchant, a bank, a card network, a wallet provider, the phone’s secure systems and Apple’s platform rules. The CMA’s concern is that Apple occupies a uniquely powerful point in that chain.
The regulator says Apple Wallet is the UK’s most popular contactless-payment option, while no competing wallet-type product has launched in the country. Its proposed intervention would seek access to the main contactless standards used internationally, enabling UK firms to offer services that are already possible in the European Union.
What the CMA is proposing
The proposal has two related goals. First, the CMA wants Apple to open Wallet-related access to internationally used contactless standards. Second, it wants that access to be commercially viable, with charges it expects to be substantially lower than Apple’s present fees.
Rather than publishing a regulator-set price, the CMA proposes using principles to guide how rates are determined. That distinction matters. A fixed tariff would be a direct decision on the price of access; principles leave room for the parties and the eventual framework to determine the exact commercial terms, while still trying to prevent fees from becoming a practical barrier to entry.
The consultation is scheduled to close on November 17, 2026. The CMA will assess responses before making a final decision, so none of the proposed changes should be treated as a completed requirement yet.
NFC, explained without the acronym pile-up
NFC, or Near-Field Communication, is the short-range wireless technology behind many tap-to-pay interactions. A phone is held close to a payment terminal, and the devices exchange the information needed to process the transaction. The same general tap-based approach can be used beyond shop payments, including transit passes, car keys and event tickets.
For a wallet competitor, raw NFC radio access is not the whole job. The service also needs a secure method to authorize a payment and a reliable user interaction that feels immediate at the checkout. Apple’s existing approach includes iPhone capabilities such as Face ID authentication and double-click-to-pay. These are significant because they connect an app’s transaction to the phone’s established security and interface mechanisms.
Apple refers to the relevant set of capabilities as the NFC and Secure Element Platform. The Secure Element is the security-focused portion of the device architecture used in sensitive contactless transactions. The technical debate is therefore not simply whether an app can talk to a payment terminal. It is about what access third parties receive, how authentication works, which standards are supported, and whether those businesses can participate without costs or terms that make the product uneconomic.
Why the UK market is central to the argument
The CMA frames the issue against the scale of the country’s financial-technology sector. It says the UK’s fintech industry supports more than 360,000 jobs. It also says contactless technology now accounts for 39 percent of all UK payments. When tapping a phone or card is this commonplace, access to the technology underpinning those taps can shape which companies get a realistic chance to compete.
The regulator’s position is not that digital wallets are inherently uncompetitive. Its concern is narrower and more structural: Apple’s fees and access terms could prevent fintechs and other businesses from innovating and growing. A market can appear convenient to customers while still being difficult for new providers to enter if one company controls the essential device-level route to the transaction.
The absence of a launched rival wallet-type product in the UK is an especially notable part of the CMA’s case. It does not, by itself, prove why competitors have not emerged. But it is the market outcome the regulator is attempting to address, alongside what it characterizes as burdensome access terms.
Europe is the most relevant comparison
The proposal resembles an arrangement Apple made in Europe in 2024. Under that commitment, developers could access NFC technology for tap-and-go payments as well as iOS features including Face ID and double-click-to-pay. That agreement avoided an antitrust penalty that could have reached 10 percent of Apple’s worldwide annual turnover.
Apple subsequently offered third-party access to related functions in other regions beginning with iOS 18.1. UK developers can access relevant functionality too, but the CMA’s view is that the UK setup still leaves them within Apple’s ecosystem and subject to fees that differ materially from the European position.
That comparison explains why the CMA is focusing not only on whether access technically exists. In platform competition, nominal access and usable access are different things. A developer may be able to use a feature in principle, yet still struggle to make a viable product if the commercial terms are too costly or the permitted implementation is too narrow.
The CMA says its evidence indicates that neither of the technologies at issue creates inherent security concerns. That is an important qualification to the regulator’s argument: it is not presenting expanded access as a tradeoff that necessarily requires abandoning security. Instead, it is proposing that competing providers should be able to use the relevant standards while retaining appropriate protections.
Apple says security and privacy cannot be treated as an afterthought
Apple has objected to the direction of the proposal. The company says developers in the UK and elsewhere can already offer contactless transactions in their own apps through the NFC and Secure Element Platform. It specifically points to uses ranging from in-store payments and transit passes to car keys and event tickets.
Apple’s argument is that its existing solution supports innovation and wallet competition while protecting sensitive user data with high security standards. It does not believe the CMA should mandate an approach that it considers weaker on privacy and security, though it says it will continue engaging with the regulator.
That makes the eventual policy question more precise than “open” versus “closed.” The hard part is deciding what kind of access is sufficient for meaningful competition, which security controls remain necessary, and how those controls should be implemented. Apple’s position is that its platform model is a protection, not merely a restriction. The CMA’s preliminary position is that broader access need not create an inherent security problem.
What could change for developers and iPhone users
If the CMA ultimately adopts a measure along the lines proposed, the immediate beneficiaries would likely be UK businesses seeking to build or expand contactless services on iPhone. That does not guarantee a wave of new wallet apps, lower consumer prices, or any particular product launch. Those outcomes depend on business decisions, consumer trust, bank relationships and the final requirements.
Still, a more workable access model could give developers more room to decide how a contactless service is presented and bundled. The relevant use cases are broader than replacing one payment wallet with another. Apple itself identifies transit, keys and tickets as contactless transaction categories. For services whose value depends on a fast tap at a gate, reader or terminal, the underlying platform rules can be as consequential as the design of the app.
For users, the practical standard is likely to be simple: any alternative needs to remain quick, trustworthy and easy to authenticate. A system that creates more choices but makes checkout confusing will have limited appeal. Conversely, a system that preserves a familiar tap-and-authenticate flow while giving customers additional trusted providers could make the change visible chiefly through greater choice.
For companies building digital services, the wider lesson is that operating-system features can be competitive infrastructure. The best software idea may still depend on permissions, security APIs, hardware access and commercial terms dictated by the platform owner. That tension is also present in other consumer technologies, including AI assistants; platform conveniences and safeguards can require closer scrutiny than their marketing suggests.
The important unresolved questions
The consultation stage leaves several major details open. The CMA has signaled a desire for principles on pricing rather than its own price schedule, but the exact principles will matter enormously. A small difference in access cost, eligibility or technical scope can determine whether a prospective competitor can operate at all.
There is also the question of scope. The proposal refers to the main contactless standards used internationally, a formulation designed to help UK firms bring services already available in the EU to the UK. But the final form of any requirement will determine which services qualify and what Apple must make available to support them.
Finally, there is the continuing dispute over the security baseline. The CMA says its evidence does not show inherent security concerns in the technologies under discussion. Apple argues that the regulator should not force a less protective system. Those positions may overlap in their stated aim of secure contactless transactions, but they disagree about whether the proposed access model reaches that aim.
For now, the proposal is a significant signal rather than a finished rule. It places the UK alongside Europe in scrutinizing how mobile-platform gatekeepers control contactless payments, and it focuses attention on an often-invisible part of daily life: the permissions and fees behind a two-second tap.
