CMA Opens iPhone NFC API to Developers by Nov. 17 [2026]

The UK Competition and Markets Authority opened a formal consultation on October 20, 2026 that could force Apple to rebuild how contactless technology works on the iPhone. The proposal would require Apple to give developers access to both Host Card Emulation and Secure Element technology on iOS, a change that goes well beyond payments and reaches into the API layer that controls transit passes, digital IDs, car keys and loyalty cards on every iPhone sold in the UK.

For software teams building contactless features, the consultation is less a payments story than a platform-access story. Apple currently exposes only the Secure Element route to UK developers, a hardware-based approach that keeps payment credentials locked inside a protected chip on the device. The CMA wants Apple to also expose Host Card Emulation, a software-based approach that stores credentials off-device and lets an app emulate a contactless card without touching Apple’s own secure hardware. That is the technical distinction developers have been asking regulators to address since Apple opened its NFC and Secure Element platform to outside apps with iOS 18.1.

·

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What the CMA Actually Proposed on October 20

According to the CMA’s own announcement, the regulator is consulting on a proposed conduct requirement under the UK’s Digital Markets, Competition and Consumers Act 2024. The requirement would apply to Apple’s mobile platform specifically because the CMA has already designated that platform as holding Strategic Market Status, the same legal designation it used weeks earlier when it moved against Microsoft’s business software ecosystem, a story covered in our report on the CMA’s Microsoft proposals.

The mechanics are specific. Apple would have to provide access through both major contactless standards: Host Card Emulation and Secure Element. Apple currently offers only the Secure Element path in the UK. The CMA is not proposing to set a fixed access price or final commercial terms itself. Instead, it is proposing principles meant to ensure that whatever Apple charges third-party developers is “substantially lower” than Apple’s current fees, while still fairly rewarding Apple for the platform work it has done. That phrasing, pulled directly from the CMA’s materials, is deliberately vague on numbers because the regulator wants Apple and industry respondents to negotiate the specifics during the consultation window.

The consultation closes on Tuesday, November 17, 2026. The CMA has said a final decision will follow only after it has assessed the responses it receives, meaning nothing changes for developers on iPhone between now and at least late November, and likely longer once the regulator works through submissions from Apple, banks, fintech firms and transit operators.

HCE vs Secure Element: The Technical Split That Matters to Developers

The two architectures at the center of this consultation solve the same problem in different ways, and the difference shapes what a development team can actually ship.

Secure Element is a dedicated, tamper-resistant chip inside the device. Payment credentials, transit tokens or access keys are provisioned into that chip, and the operating system brokers access to it through a controlled API. This is the model Apple has run since the original Apple Pay launch, and it is the only route Apple currently lets outside developers use in the UK. Security teams generally like it because the sensitive data never touches the device’s general-purpose memory or an app’s own sandbox.

Host Card Emulation takes a different approach. Instead of relying on a dedicated chip, HCE emulates a contactless smart card entirely in software, with the relevant data stored off-device, typically on a bank’s or issuer’s own servers, and tokenized before it ever reaches the handset. Google popularized this approach on Android starting in 2013, and it is why Android banking apps and transit apps have been able to build their own tap-to-pay experiences without going through a single gatekeeper API. On iOS, Apple has never opened that path to third parties, which is the specific gap the CMA’s October 20 proposal targets.

Crucially, the CMA says its own evidence review found that neither approach carries inherent security weaknesses. That finding undercuts one of Apple’s standard defenses of the current setup, and it is the detail most likely to shape how the consultation plays out between now and November 17.

Why This Is a Developer Platform Story, Not Just a Banking Story

Coverage of this consultation has understandably focused on Apple Pay rivals, but the proposed conduct requirement is written around access to near field communication technology broadly, not around payments specifically. That framing matters for software teams outside fintech. A transit agency building its own ticketing app, a workplace issuing digital badges, a hotel chain building room-key software, or a carmaker building digital car keys all depend on the same underlying NFC stack that payments use. Today, any of those teams building for iPhone in the UK can only reach that stack through Apple’s Secure Element APIs, on Apple’s terms and at Apple’s current pricing.

If the CMA’s proposal becomes final, those same teams would gain a second, software-based integration path through HCE, which historically has been easier and cheaper to build against than hardware-backed secure element provisioning. That is the same tradeoff Android developers have navigated for over a decade: HCE lowers the integration bar and removes Apple as a mandatory counterparty, while Secure Element remains the higher-assurance option for teams that want hardware-backed key storage.

It also echoes a wider fight over who controls the developer tooling layer on major platforms. The same question of who sets the terms for third-party integration is playing out in the race between GitHub Copilot and Cursor over coding-agent API access, where platform owners and independent tool makers are negotiating similar tradeoffs between control, pricing and openness.

For engineering leaders tracking platform-access fights more broadly, this sits alongside other recent moves to pry open walled developer ecosystems, a pattern also visible in Cloudflare’s decision to expose thousands of commands to outside tooling and in Microsoft’s recent changes to how VS Code governs agent access to host systems. The common thread is regulators and platform owners alike wrestling with how much low-level API surface to expose to third parties, and at what price.

Apple’s Response

Apple has pushed back on the scope of the proposal while defending its existing developer access. An Apple spokesperson said the company “has made it possible for developers in the UK and around the world to securely offer contactless transactions directly within their apps through the NFC and SE Platform, for everything from in-store payments and transit passes to car keys and event tickets,” according to a statement reported by the Express & Star.

On the security question specifically, an Apple spokesperson said the company does “not believe the CMA should require Apple to adopt an approach with lower privacy and security protections,” a position reported by Computerworld in its coverage of who stands to benefit from the UK’s push on Apple Pay. That argument is aimed squarely at HCE, which stores credentials off-device rather than inside Apple’s hardware-isolated Secure Element, and it signals that Apple’s submission during the consultation window will likely center on security framing rather than outright refusal.

What CMA Leadership Is Saying

Sarah Cardell, who chairs the UK Competition and Markets Authority, framed the proposal as a response to specific complaints from challenger firms. “We have heard that high fees, strict terms, and technical restrictions relating to Apple’s contactless technology make it too difficult for challengers to innovate and compete,” Cardell said, according to the CMA’s official announcement.

Cardell also described the proposal’s intended effect on UK software development more broadly. “By removing barriers to entry, we can help create the conditions for brilliant British businesses with great ideas to develop new products and services here, from payment apps and digital IDs to travel passes and digital keys,” she said, in comments reported by Finextra. In a separate statement, Cardell said the proposals “open the door to more innovation, more choice and economic growth, including in the UK’s important fintech sector.”

How This Compares to the EU’s Earlier Move on Apple

The UK is not acting in isolation. Reuters, in reporting carried by Fidelity, noted that the European Union secured commitments from Apple requiring wallet developers to get access to the iPhone’s NFC chip using Host Card Emulation, letting third-party apps process contactless payments without routing through Apple Pay or Apple Wallet. That EU process ran under antitrust commitments rather than the UK’s newer Digital Markets, Competition and Consumers Act framework, and Apple has applied different terms outside the EU, including continuing to charge associated fees in markets where it is not bound by the EU deal.

That gap is exactly what the CMA’s October 20 consultation is trying to close for the UK market specifically. Rather than copying the EU’s commitment-based approach, the UK is using its own Strategic Market Status powers to propose a UK-specific conduct requirement, which gives the CMA more direct control over enforcement if Apple does not comply once a final decision is made.

Market	Legal mechanism	HCE required	SE required	Status as of Oct 20, 2026
United Kingdom	Digital Markets, Competition and Consumers Act 2024, Strategic Market Status conduct requirement	Proposed, not final	Already available	Consultation open, closes Nov 17, 2026
European Union	Antitrust commitments from Apple	Required under EU commitments	Already available	In effect
United States	No equivalent federal mandate identified	Not required	Already available	No change reported

The Historical Path From Apple Pay to Open Access

Apple’s contactless architecture has been largely unchanged in principle since the original Apple Pay launch, when the company explained that each provisioned card receives a unique Device Account Number that is encrypted and stored in the Secure Element rather than on Apple’s servers or the device’s general storage. That hardware-isolated design became the template for every contactless feature Apple has shipped since, including the NFC and Secure Element Platform it opened to outside developers for transit passes, car keys and event tickets.

What has changed is the regulatory environment around that architecture, not the architecture itself. The CMA’s push traces back to a call for evidence on NFC access on iOS that ran from June 30 to July 21, 2026, a shorter evidence-gathering phase that fed directly into the formal consultation opened on October 20. That is a notably fast turnaround by regulatory standards, roughly three months from evidence call to a concrete proposed conduct requirement, reflecting how much pressure the CMA is under from challenger banks and fintech firms arguing that Apple’s current terms keep them boxed out of a market Apple effectively controls through the iPhone’s installed base.

Apple Pay itself has continued expanding commercially during the same period the CMA was building its case, including a launch in the Philippines in August 2026 and a rollout for Axis Bank-issued cards in India in September 2026. That growth highlights why the stakes around UK access terms matter commercially to Apple well beyond the UK alone: whatever pricing principles the CMA settles on could become a reference point other regulators point to when they examine Apple’s terms in their own markets.

What Developers and Fintechs Should Watch Before November 17

Engineering and product teams with a stake in iOS contactless features have a narrow but concrete window to act. The consultation is open for public and industry responses until November 17, 2026, and the CMA has explicitly said Apple agreed not to use confidentiality provisions to prevent third parties from responding. That detail matters because earlier platform disputes have sometimes been slowed by parties unable to discuss commercially sensitive terms publicly.

Teams building digital wallets, transit ticketing, access control, or loyalty products for iPhone should treat this as the moment to document the specific technical and commercial barriers they have hit with Apple’s current Secure Element-only access, since that is exactly the kind of evidence the CMA is soliciting. Banks and fintech firms that have previously complained about Apple’s fees have the clearest incentive to respond, but any software team whose roadmap depends on iPhone NFC access has a reason to weigh in before the deadline.

Market and Competitive Impact

The immediate market impact is limited, precisely because nothing is final. Apple Pay remains the default contactless experience on iPhone in the UK today, and no rival wallet can yet route a transaction through HCE on iOS. But the proposal changes the calculus for any company weighing whether to invest engineering time in an iOS contactless product. A firm that previously ruled out building a UK iPhone tap-to-pay feature because Apple’s Secure Element terms made the economics unworkable now has a concrete regulatory process to watch, with a defined date by which the shape of any new access terms should start to become clearer.

Open banking providers stand to gain the most visibility from this proposal, since the CMA’s own framing explicitly calls out that opening NFC technology would support the expansion of open banking, letting more people pay directly from their bank accounts rather than through card networks routed through Apple’s wallet. That is a notable alignment between two separate strands of UK financial regulation, open banking policy and platform competition policy, both pushing in the same direction on iPhone access.

The timing also lands in the middle of a busy stretch for Apple’s hardware roadmap. The company is still working through supply constraints on the foldable iPhone Duo, and it has an Oct. 28 hardware event on the calendar covering a touch-enabled MacBook and iPad mini. Any resources Apple has to put toward building and testing a new HCE access layer for UK developers will compete with those launches for engineering attention.

Stakeholder	Current access on iPhone (UK)	What changes if the proposal is finalized
Bank-issued wallet apps	Secure Element only, via Apple Pay integration	Potential direct HCE integration, bypassing Apple Pay routing
Open banking payment apps	No dedicated NFC tap-to-pay path	Possible new tap-to-pay flows funded directly from bank accounts
Transit and ticketing operators	Secure Element only	Software-based HCE option for ticket issuance and validation
Independent app developers	Secure Element access on Apple’s current fee terms	Lower, CMA-reviewed fee principles expected to apply
Apple	Full control of UK contactless access terms	Required to support HCE and charge “substantially lower” fees

Predictions for the Next Six Months

Several outcomes look likely as this consultation plays out, based on how similar Strategic Market Status proceedings have moved at the CMA and how Apple has responded to comparable EU commitments.

• Apple will submit a detailed response before November 17 that leans heavily on security and privacy arguments against HCE, echoing the spokesperson comments already reported, rather than challenging the CMA’s authority to act outright.
• Challenger banks and fintech trade bodies will file the bulk of substantive technical submissions, since they have the clearest commercial incentive and the most documented evidence of friction with Apple’s current Secure Element terms.
• A final CMA decision is unlikely to land before early 2026 wraps into a formal implementation period, given the regulator has not set a timeline beyond “after assessing responses,” and comparable Strategic Market Status cases have taken months between consultation close and final order.
• If a final requirement is adopted, Apple will likely propose an implementation period measured in months rather than weeks, mirroring how it phased in EU-mandated changes rather than shipping access overnight.
• Other national regulators outside the EU and UK will likely cite this UK proceeding as a reference point in their own reviews of Apple’s mobile platform terms, extending the practical reach of whatever pricing principles the CMA settles on.

The Legal Mechanism Behind the Proposal

It is worth being precise about what legal tool the CMA is using, since it shapes how enforceable any eventual decision will be. The proposal follows the CMA’s earlier designation of Apple’s mobile platform as holding Strategic Market Status under the UK’s Digital Markets, Competition and Consumers Act 2024. That designation is what lets the CMA propose a binding conduct requirement rather than simply issuing non-binding guidance or recommendations. It is the same legal lever the CMA used days earlier when it proposed designating Microsoft’s business software ecosystem with Strategic Market Status, and the same framework underpinning the CMA’s broader program of work across mobile platforms, which has already produced finalized commitments from Apple and Google covering app review, app ranking and data use.

For developers, that legal detail matters because a conduct requirement, once finalized, carries real enforcement teeth under the Act, unlike a voluntary commitment that a company could in theory renegotiate more easily. If the CMA ultimately adopts a binding HCE access requirement, Apple’s compliance options narrow considerably compared with the EU’s commitment-based process.

Frequently Asked Questions

What did the CMA actually announce on October 20, 2026?
The UK Competition and Markets Authority opened a consultation on a proposed conduct requirement that would make Apple give developers access to both Host Card Emulation and Secure Element contactless technology on the iPhone, rather than just Secure Element as it does today in the UK.

Is this change already in effect?
No. It is a proposal under consultation. The consultation closes on November 17, 2026, and the CMA says it will make a final decision only after it has assessed the responses it receives.

What is the difference between HCE and Secure Element?
Secure Element stores payment or identity credentials inside a protected, hardware-based chip on the device. Host Card Emulation stores the equivalent data off-device, typically with the card issuer, and emulates a contactless card through software rather than dedicated hardware.

Will this make Apple Pay less secure?
The CMA says its evidence review found neither HCE nor Secure Element carries inherent security weaknesses. Apple has publicly disagreed with being required to support an approach it argues could lower privacy and security protections, though it has not detailed a specific technical vulnerability.

Does the EU already have this kind of access?
Yes. The European Union secured commitments requiring Apple to give wallet developers HCE-based access to the iPhone’s NFC chip, letting third-party apps process contactless payments without going through Apple Pay or Apple Wallet. Apple has applied different fee terms outside the EU.

What will developers be able to build if the proposal is finalized?
Potentially software-based tap-to-pay wallets, open banking payment apps that pay directly from bank accounts, transit ticketing apps, and other contactless products built without routing exclusively through Apple’s Secure Element APIs.

How does this relate to the CMA’s Microsoft case?
Both proceedings use the same Strategic Market Status powers under the UK’s Digital Markets, Competition and Consumers Act 2024. The CMA proposed designating Microsoft’s business software ecosystem with Strategic Market Status just days before opening this Apple NFC consultation, part of a broader pattern of UK platform oversight across major tech companies.

What should a company affected by this do before November 17?
Submit evidence to the CMA’s open consultation documenting specific technical or commercial barriers encountered with Apple’s current Secure Element-only access in the UK. Apple has agreed not to use confidentiality provisions to block third parties from responding.

Related Coverage

• Dream Labs Raises $90M for a Universal Robot API [2026]
• Claude Code Plugins Hit 341 Tools as Cursor Fires Back [2026]
• GitHub Copilot to Drop 3 AI Models by Nov. 16 [2026]
• FSU Opens 40,000-Sq-Ft Tech Incubator Oct. 21 [2026]
• What's New in Android's October 2026 System Updates: v26.41