UK CMA Proposes Rules to Open Apple Pay to Rivals

Background: Apple Pay’s Position in the United Kingdom

Apple Pay entered the UK market in 2015 and quickly became the default contact‑less payment method on iPhones. Its seamless integration with iOS, the use of the Secure Element (SE) for storing encrypted card credentials, and the convenience of a single tap have driven high adoption rates. However, the ecosystem is tightly controlled:

• Developer access to NFC was only granted in 2024, after years of Apple limiting the hardware interface to its own wallet.
• Fees are charged to payment‑service providers for each transaction that passes through Apple’s SE, a model that has drawn criticism from banks and fintech startups.
• Secure Element‑only architecture prevents third‑party wallets from using alternative implementations such as Host Card Emulation (HCE) without Apple’s explicit permission.

Because of these constraints, no rival “wallet‑type” product has launched in the UK, even though competitors like Google Pay and Samsung Pay operate freely in many European markets. The UK Competition and Markets Authority (CMA) has now stepped in, proposing rule changes that could reshape the mobile payments landscape.

Technical Foundations: NFC, Secure Element, and Host Card Emulation

NFC Access in iOS

Near‑field communication (NFC) is the radio protocol that enables contactless payments. On iPhone, the NFC controller is paired with a Secure Element—a tamper‑resistant chip that stores payment credentials and performs cryptographic operations. Apple’s model requires developers to:

1. Sign a licensing agreement with Apple.
2. Pay per‑transaction or per‑device fees (the exact structure is not public but is known to be higher than typical merchant fees).
3. Use the Secure Element for any payment‑related data, ensuring that Apple retains control over the credential lifecycle.

Host Card Emulation (HCE)

HCE is a software‑based alternative that emulates a contactless smart card using the device’s main processor rather than a dedicated SE. It offers several advantages:

• Lower hardware dependency – no need to access the SE.
• Potentially reduced fees – the transaction does not pass through Apple’s proprietary payment pipeline.
• Flexibility for developers – easier integration with existing banking APIs.

The European Union forced Apple to open HCE for free in 2024 as part of its Digital Markets Act commitments. The CMA’s proposal seeks to extend the same freedom to the UK, arguing that “the evidence it reviewed did not suggest either approach was inherently insecure.”

Security Considerations

Apple’s argument centers on the belief that the Secure Element provides a higher security baseline. However, independent security audits of HCE implementations (e.g., Google’s) have demonstrated comparable protection when proper tokenization and encryption are enforced. The CMA’s stance—allowing HCE while maintaining security standards—mirrors the EU’s approach and could set a precedent for other jurisdictions.

CMA’s Proposed Changes and Their Rationale

The CMA’s consultation paper, due for response by November 17, 2026, outlines three core demands:

1. Reduced Access Fees – Apple must lower the per‑transaction charge for NFC usage, though a fee may still be permitted to cover infrastructure costs.
2. Mandatory HCE Support – iOS must expose an HCE API that works without the Secure Element, mirroring the EU’s free‑access model.
3. Transparent Licensing – The agreement terms must be published in a machine‑readable format, enabling developers to assess compliance costs quickly.

Apple’s response to Reuters emphasized that it “does not believe the CMA should require Apple to adopt an approach with lower privacy and security protections.” The company also highlighted ongoing engagement with regulators to find a “best‑interest” solution for users.

Why the CMA Is Acting Now

• Market Competition – The UK fintech sector is vibrant, with firms like Revolut and Monzo seeking to expand beyond banking into payments. Restrictive Apple policies limit their ability to offer a native iPhone experience.
• Consumer Choice – Users currently have only Apple Pay for contactless payments on iOS, whereas Android users can select from multiple wallets.
• Regulatory Alignment – Post‑Brexit, the UK aims to maintain a regulatory environment comparable to the EU’s Digital Markets Act, preventing a “digital divide” for UK consumers.

Implications for Developers and Consumers

For Fintech Developers

• Lower Barriers to Entry – Eliminating the Secure Element requirement means smaller startups can develop payment apps without negotiating costly licensing deals.
• Faster Time‑to‑Market – HCE APIs are already mature on Android; a comparable iOS offering would let developers port existing solutions with minimal re‑engineering.
• Potential Revenue Shifts – Reduced fees could improve margins for payment processors, possibly translating into lower costs for merchants.

For Consumers

• Increased Choice – Users could install a bank‑specific wallet that integrates loyalty programs, budgeting tools, and custom UI, all while retaining the same tap‑to‑pay experience.
• Security Transparency – With both SE and HCE options available, consumers can choose the model they trust more, backed by clear disclosures from the app provider.
• Potential for Innovation – Competition often drives new features such as offline payments, dynamic QR codes, or biometric‑enhanced authentication.

Real‑World Example

Consider a UK‑based challenger bank that currently relies on Apple Pay for contactless transactions. Under the CMA’s rules, the bank could launch its own app that uses HCE, offering a branded experience, integrated budgeting,

integrated budgeting, and real‑time transaction alerts, all without needing Apple Pay.

Potential Challenges and Industry Response

While the CMA’s proposals promise a more open ecosystem, several practical hurdles remain:

🔹 -----------
• Why It Matters: ----------------
• Possible Mitigation: ---------------------

🔹 *Security Assurance*
• Why It Matters: Regulators and consumers will scrutinise HCE‑based solutions for potential vulnerabilities such as relay attacks or token leakage.
• Possible Mitigation: Mandatory third‑party security certifications and continuous monitoring, similar to the EU’s framework, could reassure stakeholders.

🔹 *Apple’s Ecosystem Integration*
• Why It Matters: Apple’s tight integration of Apple Pay with Wallet, Safari, and Apple ID provides a seamless user experience that rivals may struggle to match.
• Possible Mitigation: Fintechs can leverage Apple’s “Sign in with Apple” and other APIs to maintain a cohesive experience while using HCE for payments.

🔹 *Fee Structure Negotiations*
• Why It Matters: Even with reduced fees, Apple may retain a baseline charge for NFC access that could still be prohibitive for very small players.
• Possible Mitigation: The CMA’s demand for transparent, machine‑readable licensing should enable developers to model costs accurately and lobby for further reductions.

🔹 *Developer Adoption Curve*
• Why It Matters: iOS developers are accustomed to the Secure Element workflow; shifting to HCE will require new tooling and testing.
• Possible Mitigation: Apple could publish comprehensive SDKs, sample code, and sandbox environments to accelerate adoption.

Read the full breakdown originally published at https://ltdeveloperblogs.github.io/posts/uk-proposes-new-ways-to-help-apple-pay-rivals/