Britain’s Competition and Markets Authority has launched a consultation that would compel Apple to loosen control of the iPhone’s near-field communication (NFC) technology used for contactless payments, digital keys, tickets and similar services. The proposals, announced on 20 October 2026, call for substantially lower access fees and require Apple to open the platform through both of the main international standards—its existing secure-element approach and host-card emulation—rather than the single secure pathway it currently offers in the UK. Consultation runs until 17 November before any final decision.
The CMA frames the move as a boost for Britain’s fintech sector, which it says generates roughly £214 billion (US$286 billion) in turnover and supports more than 360,000 jobs. Chief executive Sarah Cardell argues that high fees, strict terms and technical restrictions make it too hard for challengers to innovate, and that wider access would deliver more choice, lower costs and new products ranging from account-to-account payments to digital IDs and workplace keys. Contactless already accounts for 39 percent of UK payments, up from 3 percent a decade ago, and more than 60 percent of adults use digital wallets, with Apple Wallet the most popular. The regulator notes that alternative wallet-style products have appeared in the EU after earlier forced openings, while none have launched under current UK terms.
Apple states that it already enables developers in the UK and elsewhere to offer contactless transactions — payments, transit passes, car keys, event tickets — directly inside their own apps through its NFC and secure-element platform. That platform, it says, keeps sensitive credentials protected by the highest security standards, allows competition between wallets, and prevents the company itself from seeing or storing users’ card details. An Apple spokesperson put the position plainly: “We do not believe the CMA should require Apple to adopt an approach with lower privacy and security protections. We will continue to engage constructively to reach an outcome that is in the best interest of our users.”
The distinction matters. A secure element is a dedicated, tamper-resistant hardware chip that isolates cryptographic operations and credentials from the main operating system. Host-card emulation, by contrast, routes those functions through software on the host processor, typically relying on tokenization, short-lived credentials and backend checks. Industry analyses consistently treat the hardware secure element as offering stronger physical attack resistance and a smaller attack surface; HCE is regarded as more scalable and cheaper to deploy but inherently more exposed if the device or its software is compromised. Apple’s design deliberately keeps long-lived secrets off the main processor and outside Apple’s own servers. The CMA asserts that neither standard raises “inherent” security concerns and that both would enable services already available in Europe. That claim sits uneasily with the architectural difference and with Apple’s repeated insistence that further forced concessions would lower the protections users currently enjoy.
Consumer outcomes under the present system are hard to dismiss. Apple Wallet’s popularity reflects preference for a seamless, biometric-authenticated experience that has helped drive contactless adoption rather than evidence of a market failure requiring heavy-handed intervention. Apple has already opened controlled access on commercial terms that preserve its security model. Demanding both cheaper fees (via pricing principles the CMA expects will produce “substantially lower” charges) and an additional, less isolated technical pathway effectively asks the company that invested in the hardware, software integration and certification regime to subsidize rivals while accepting a broader attack surface. Such regulatory design risks trading the reliability that has made contactless routine for a proliferation of options whose security depends more heavily on each developer’s implementation and on continuous network connectivity.
MacDailyNews Take: Britain’s fintech sector can and should compete. Nothing prevents banks, payment firms and app developers from offering distinctive services, open-banking flows, or non-payment credentials under existing rules. What the CMA proposals prioritize is easier and cheaper entry for competitors over preserving the integrity of the platform most UK adults already trust for everyday payments. Apple’s position is simple: users’ privacy and security should not be subordinated to UK regulators’ whims. Forcing a dilution of standards that have scaled contactless use to nearly two-fifths of all transactions is more likely to introduce friction and risk security and privacy than to unlock meaningful gains for consumers.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
Like
or dislike
this post below!
The post UK regulator’s bid to crack open Apple Pay puts competitors’ interests ahead of user security and privacy appeared first on MacDailyNews.
