UK Regulator Proposes Mandating HCE Access for iPhone Payment Rivals

The UK’s Competition and Markets Authority (CMA) has proposed new regulations that would require Apple to support host card emulation (HCE) for developers creating contactless payment apps on iPhones. According to a report by MacRumors citing Reuters, the regulator aims to reduce barriers that currently prevent rivals from launching competitive alternatives to Apple Pay in the United Kingdom.

The CMA argues that Apple’s current fees and technical restrictions make it prohibitively difficult for competitors to enter the market. The regulator’s proposals would grant developers additional methods to access the iPhone’s near-field communication (NFC) technology. This hardware feature allows users to complete transactions by holding their device near a payment terminal, a function currently dominated by Apple’s own wallet service.

Regulatory Context and Technical Requirements

Apple initially opened NFC access to third-party developers in the UK during 2024. However, companies seeking to build competing payment applications must sign specific agreements with Apple and pay associated fees. Furthermore, these developers are required to utilize the iPhone’s Secure Element, a dedicated chip designed to store sensitive data such as payment credentials. The CMA contends that these conditions stifle competition and limit consumer choice in the digital payments sector.

The regulator is now proposing that Apple also support host card emulation (HCE). This alternative technology allows payment applications to function without relying on the Secure Element. By mandating HCE support, the CMA expects to substantially lower the access fees Apple charges developers, although the regulator acknowledges that Apple would still be permitted to charge some amount for access.

Comparison with European Union Rules

Apple already offers free HCE access to developers in the European Union, a change implemented under commitments agreed upon in 2024. The CMA highlights that rival payment applications have successfully launched in the EU since those rules took effect. In contrast, no competing wallet-type product has launched in the UK under Apple’s current terms. This disparity suggests that the technical and financial barriers in the UK are significantly higher than those in Europe.

As Threat Times reported on October 20, 2026, the CMA had previously sought to mandate fair NFC access on iOS devices to boost competition in the digital payments sector. The current proposals represent a more detailed framework for achieving that goal, specifically targeting the technical requirements and fee structures that developers must navigate.

Corporate Response and Consultation Period

Apple has pushed back against the regulator’s approach, telling Reuters that developers can already offer contactless services using existing technology. The company stated it does not believe the CMA should require an approach with lower privacy and security protections. Apple indicated it would continue to engage constructively to reach an outcome it considers in the best interest of its users.

The CMA responded that the evidence it reviewed did not suggest that HCE was inherently insecure compared to the Secure Element. The proposals are currently open for public consultation until November 17, 2026. The CMA will review responses to these proposals before making a final decision on whether to implement the new rules.

What should you do?

Security professionals and payment service providers should monitor the consultation period ending November 17, 2026, to understand potential changes to UK iOS development requirements. Organizations relying on Apple’s Secure Element for payment credentials should assess the security implications of potential shifts toward host card emulation. Developers should prepare for possible fee reductions and technical adjustments if the CMA finalizes its proposals. Companies operating in both the UK and EU should align their compliance strategies to accommodate differing regulatory environments.

What to do and how to stay safe: Apple

• Review the CMA’s consultation documents before November 17, 2026, to understand proposed technical changes.
• Assess the security posture of current payment apps using the Secure Element versus potential HCE implementations.
• Monitor official announcements from the CMA for final decisions on fee structures and access requirements.
• Ensure compliance with existing UK and EU regulations while preparing for potential regulatory shifts.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is host card emulation (HCE)?

HCE is a technology that allows payment apps to work without using the iPhone's Secure Element chip.

When does the consultation period end?

The proposals are open for consultation until November 17, 2026.

Does Apple currently offer HCE in the UK?

No, Apple requires developers in the UK to use the Secure Element and pay fees.