Consumer protection is where several developments in this roadmap reach merchants most directly. Pricing requirements already apply at checkout, while new subscription rules are expected from spring 2027. APP fraud reimbursement sits primarily with payment firms, and the CMA’s mobile platform work could change how merchants steer customers and access payment functionality. Consumer Duty can also apply where merchants participate in the distribution of regulated financial products.
Developments covered
Pricing transparency under the DMCC
Pricing transparency and fake-review requirements now apply directly to merchants, backed by the CMA’s direct enforcement powers.
The DMCC Act strengthened the rules on pricing transparency and fake reviews from April 2025, backed by the CMA’s direct consumer enforcement powers. Merchants must present the total price consumers will pay, including unavoidable fees, or explain how variable mandatory charges will be calculated where they cannot reasonably be determined in advance. Optional extras can still be presented separately, but mandatory charges cannot be introduced late in the customer journey. The regime also prohibits submitting or commissioning fake reviews and requires businesses publishing consumer reviews to take reasonable and proportionate steps to prevent and remove them. These are direct merchant obligations. The CMA can impose penalties of up to 10% of global annual turnover for breaches of relevant consumer protection law.
Key dates
- 6 April 2025: drip-pricing and fake-reviews rules in force, directly enforceable by the CMA.
- Ongoing: enforcement, with penalties reaching 10% of global turnover.
Legal issue/risk
- In force and biting. The first price shown must include all mandatory fees, web and in-app.
- That covers delivery, booking and service charges and compulsory add-ons. Existing drip-pricing is a live breach.
- Displayed reviews must be genuine and moderated, including third-party widgets. Outsourcing the widget does not outsource liability.
- Direct enforcement: the CMA finds a breach and penalises it without proceedings. No stage to negotiate.
- Penalties reach 10% of global turnover. Top exposure in this roadmap.
Next steps
- Confirm your checkout shows all-in pricing up front, including delivery, booking and service charges.
- Verify review sourcing and moderation against the fake-reviews rules, including any third-party review widget you display.
- See the CMA mobile platforms entry for the in-app payments and NFC strand.
Source
The DMCC Act collection.
Authorised push payment fraud reimbursement
The reimbursement obligation sits with payment firms, but merchants may feel its effects through fraud controls and commercial terms.
Mandatory APP fraud reimbursement has applied to in-scope Faster Payments since October 2024, with reimbursement costs generally shared equally between sending and receiving payment firms. The regime protects consumers, microenterprises and charities rather than imposing reimbursement liability directly on merchants. The regime is nevertheless relevant to merchant payments. PSPs are strengthening fraud controls and managing the cost of reimbursement, which can affect account-to-account payment journeys, risk controls and potentially commercial terms. The PSR’s 2026 independent evaluation found that firms were reimbursing 97% of claims that fell within the mandatory reimbursement policy.
Key dates
- 7 October 2024: reimbursement scheme live, £85,000 cap, 50/50 sending and receiving split.
- 1 July 2026: independent Frontier Economics review published. Losses down about £73 million a year, reimbursement of in-scope claims at 97%, with net benefit put at £17 million to £29 million.
- 2026 onward: the PSR is using its independent evaluation and supervisory work to assess the operation and effectiveness of the reimbursement regime.
Legal issue/risk
- No merchant reimbursement liability. The effect is pricing.
- Providers price the 50/50 split into account-to-account rails, so it belongs in any pay-by-bank versus card comparison.
- The forward risk is scope: extending liability to platforms would reach marketplace and classified-site operators.
- Extension needs Parliament, not the PSR, so it will not come from the December 2026 consultation. The argument is made there.
- If you carry third-party listings, treat scope extension as a live liability question.
Next steps
- Expect the reimbursement cost to reach you as passthrough from your providers, and factor it into acquiring and account costs.
- Follow the PSR's December 2026 consultation, where the platform and telco liability question sits.
- Engage through TPA on extending liability to platforms and telcos where fraud origination matters to your sector.
Source
CMA mobile platforms: Steering and NFC access
Proposed measures could widen payment steering and access to NFC functionality on mobile platforms.
The CMA is pursuing two interventions that could affect mobile payment journeys. Proposed steering requirements for Apple and Google would allow app developers to direct customers outside an app to complete transactions, subject to fair and reasonable terms. The consultations closed on 28 July 2026, with decisions expected later this year. Separately, the CMA is considering wider access to NFC functionality on iOS, which could enable third-party wallets and payment services to compete more directly with Apple Wallet. A call for evidence closed in July, with consultation on potential measures expected in autumn 2026. Neither intervention currently creates a merchant compliance obligation. The significance is commercial: steering could provide greater choice over where app transactions are completed, while NFC access could widen the range of contactless payment propositions available on iPhones.
Key dates
- October 2025: Apple and Google designated with strategic market status for their mobile platforms.
- 1 April 2026: voluntary commitments took effect, covering app review, ranking, data use and interoperability.
- 30 June 2026: CMA opens consultations on a steering conduct requirement and on NFC access.
- Autumn 2026 expected: CMA consultation on potential NFC access measures, informed by its June-July call for evidence.
- Later 2026: CMA decision on whether to impose binding conduct requirements.
Legal issue/risk
- Nothing binds you. The exposure is commercial optionality.
- A steering requirement would give app merchants a lawful route around platform commission.
- NFC access changes the case for your own wallet and your leverage with existing providers.
- Current commitments are voluntary. Nothing is enforceable until binding conduct requirements land, expected later in 2026.
- Decisions taken about you, not by you. The open consultations are the only influence point.
Next steps
- App-based merchants: model what removing platform commission on steered payments would be worth against current in-app volume.
- Retail and transit merchants: assess whether in-app contactless over open NFC would change your acceptance stack, and on what timeline.
- Watch the autumn 2026 NFC consultation and the CMA's decision on binding requirements.
Source
The CMA's programme of work across mobile platforms and its Apple and Google mobile platform cases.
Subscription contracts under the DMCC
New rules on subscription sign-up, reminders, cancellation, and cooling-off rights are expected from spring 2027.
The DMCC Act introduces a new statutory regime for subscription contracts. The Government currently expects the regime to commence in spring 2027, subject to the necessary secondary legislation. Businesses in scope will face requirements covering pre-contract information, reminder notices, cancellation, and cooling-off rights. Consumers will receive a 14-day initial cooling-off period. Further cooling-off rights will arise after a free or discounted trial ends and where a contract renews for 12 months or longer. Businesses will also need to provide prescribed reminder notices and make cancellation straightforward, including online cancellation where the subscription was entered into online. For subscription merchants, this is not simply a terms-and-conditions exercise. Compliance may require changes across sign-up, billing, notifications, cancellation and refund processes.
Key dates
- 24 May 2024: DMCC receives Royal Assent, including the subscription contracts provisions.
- Spring 2027: current expected commencement, confirmed in the government's April 2026 consultation response.
Legal issue/risk
- Lands on you directly, as system change not policy. Renewal reminders tie to contract length: a billing-engine build.
- Single-communication cancellation makes call-based and multi-step retention flows unlawful.
- The renewal cooling-off right creates refund liability at every renewal, with proportionate refunds requiring consumed-value calculations.
- Free trial-to-paid conversion is the most exposed journey.
- Commencement expected spring 2027, CMA-enforceable. Build window is now.
Next steps
- Map every recurring product against the reminder, cancellation and cooling-off requirements, separating billing-engine changes from copy changes.
- Model the refund exposure created by a cooling-off right that recurs at every renewal, not only at sign-up.
- Review free trial-to-paid conversion journeys first, as the most exposed.
Source
The DMCC Act collection.
Consumer Duty at the point of sale
Consumer Duty can apply where a merchant participates in the distribution of regulated financial products.
The FCA’s Consumer Duty can reach merchants involved in the manufacture or distribution of regulated retail financial products, including some point-of-sale credit and insurance arrangements. Firms within scope must act to deliver good outcomes for retail customers across products and services, price and value, consumer understanding and consumer support. For merchants, the important question is whether their role at checkout places them within the regulated distribution chain. Where it does, responsibilities may extend to how a financial product is presented, whether customers understand it, how the distribution arrangement operates and what information is shared with regulated partners. The Duty does not apply to every merchant merely because a regulated provider appears in the payment journey. Scope and responsibilities should therefore be established before treating this as a merchant-wide compliance requirement.
Key dates
- 31 July 2023: in force for open products, and from 31 July 2024 for closed ones.
- 16 March 2026: CP26/9 on modernising the redress system published by the FCA and the Financial Ombudsman.
- 15 July 2026: third-party Deferred Payment Credit lenders entered FCA regulation. Broking of DPC agreements by merchants remains exempt from FCA credit-broking regulation
- Later 2026: joint FCA and Financial Ombudsman policy statement expected on the two-stage complaints process and the fair and reasonable test.
Legal issue/risk
- Consumer Duty does not apply to a merchant merely because a regulated lender or payment provider appears at checkout.
- Establish whether the merchant itself is authorised or participates in manufacturing or distributing a regulated retail financial product.
- Broking regulated Deferred Payment Credit is specifically excluded from FCA credit-broking regulation.
- Where Consumer Duty does apply, relevant issues include products and services, price and value, consumer understanding and consumer support.
Next steps
- • Map every regulated credit and insurance product presented at checkout. • Confirm whether the merchant is authorised, an appointed representative, an exempt broker or outside the regulatory perimeter for each product. • For Deferred Payment Credit, confirm that the merchant is only carrying on exempt credit-broking activity and is not itself the regulated lender. • Where Consumer Duty applies, review customer communications, fair-value arrangements, product governance and customer support with the regulated provider.
Source
The CMA's programme of work across mobile platforms and its Apple and Google mobile platform cases.