New German legislation allows access to the iPhone's NFC antenna

- all large phone manufacturers have left the NFC antenna in the phone "open", meaning that a card stored in any e-wallet on the phone will be able to access that NFC antenna in order to perform mobile contactless payments; 

- Except Apple, which has "closed" the NFC antenna in the iPhone so that only a card/token stored in the Apple wallet will be able to access the NFC antenna and communicate with a contactless terminal. A card/token stored in another e-wallet on the phone (e.g. in a bank wallet) cannot have access to the NFC antenna and therefore cannot be used to make a mobile contactless payment. In order for a mobile contactless payment to take place with an iPhone, the card issuer needs to first enter into an agreement with Apple that will allow the cards it issues to be loaded into the Apple Pay wallet, and then used to make mobile contactless payments. It is our understanding that such agreement comes with a fee that the issuer needs to pay to Apple; in economic terms this means that the issuer has to share its interchange fee revenue (which is regulated for consumer cards in the EEA) with Apple. It is also our understanding that the Apple Pay standard agreement is pretty much imposed by Apple upon issuers on a "take it or leave it" basis. 

This requirement is imposed on so-called "system enterprises", but a PSP may also qualify as a system enterprise if it owns a technical infrastructure to which other PSPs would need access in order to provide payment services or e-money services. 

As an exception to the above access requirement, infrastructures that are only used by 10 or less PSPs are not subject to the access requirement. Furthermore, a system enterprise is not subject to the obligation if it has less than 2 million registered users. Those thresholds are to be assessed at the level of the entire corporate group to which the system enterprise belongs (rather than on an individual company level). In terms of timing, those thresholds are assessed on the day that the PSP makes the request for access.

System enterprises can legally refuse to grant access to an infrastructure if there are objective reasons to deny that access, such as for example a concrete threat to the safety and integrity of its technical infrastructure services. The system enterprise bears the burden of proof of the existence of a "concrete threat". In addition, the system enterprise should be able to demonstrate that it has made reasonable efforts in order to minimise the security risk of that concrete threat materialising.