Contactless Payments: What UK Small Businesses Need to Know
The mandatory contactless cap was removed in March 2026, but most banks kept it. What that means at your till, and why you should stop advertising a limit.
For roughly five years, the answer to "what is the contactless limit?" was a single number that every business could put on a sign. That is no longer true, and any business still displaying a limit on a laminated card by the till is now displaying something that may be wrong for the customer in front of them.
On 19 March 2026 the Financial Conduct Authority's removal of the mandatory 100 pound single-transaction contactless cap took effect. Card issuers may now set their own limits, including no limit at all, and customers can set their own controls. In practice, several of the largest UK banks, including Lloyds, HSBC, Barclays, NatWest, Santander and Monzo, have said they are keeping the 100 pound figure in place for the time being.
The result is a period where the limit depends on which bank issued the card and what that particular customer has chosen. This article explains what that means operationally, how contactless differs from Chip and PIN and mobile wallets, and what your staff need to understand.
What changed, precisely
Before the change, the ceiling was a regulatory requirement. After it, the ceiling is a commercial decision made by each card issuer, within their own risk controls.
Three consequences follow.
- There is no single national limit to quote. Two customers can present cards with different limits.
- A decline is not necessarily a problem with your terminal. It may be the issuer's own threshold or the customer's chosen setting.
- Consumer protection did not change. A customer whose lost or stolen card is used fraudulently remains entitled to reimbursement provided they report it promptly.
The practical advice for a business is to stop stating a figure. "Contactless accepted" is accurate. A specific ceiling may not be.
Contactless, Chip and PIN, and mobile wallets
These are three different things and staff frequently conflate them.
| Method | How the customer is verified | Practical limit |
|---|---|---|
| Contactless card | Tap; no PIN in most cases | Set by the card issuer, and by the customer |
| Chip and PIN | Card inserted, PIN entered | No contactless ceiling applies |
| Mobile wallet | Fingerprint, face or device passcode | Generally none, because the customer is authenticated on the device |
Mobile wallets, meaning Apple Pay, Google Pay and Samsung Pay, have never been subject to the contactless card cap. The reason is that the customer authenticates biometrically on their own device at the moment of payment, which satisfies Strong Customer Authentication requirements in a way that a simple tap does not.
This is worth knowing because it gives you a genuine answer when a contactless card is declined for value: a customer with the same card in their phone wallet may well be able to pay without difficulty, and inserting the card and entering the PIN is always available.
Periodic re-authentication
Separately from any single-transaction limit, customers are occasionally asked for their PIN after a run of contactless payments. This is a Strong Customer Authentication control, not a fault, and it is designed to confirm periodically that the card is in the hands of its owner.
Staff should treat a PIN prompt as routine. Telling a customer the machine is playing up when the system is working correctly undermines confidence unnecessarily.
What customers now expect
Contactless has moved from a convenience to a default across most of UK retail and hospitality. Two expectations follow from that.
Speed. The value of contactless to you is throughput. A queue at eight in the morning moves at the pace of your slowest step, and if that step is a terminal waiting for a connection, contactless has not bought you much.
Choice. Some customers will still want to insert a card. Some will want to pay by phone or watch. Some will want cash. Refusing any of these narrows your market for no gain.
Security: what you are and are not responsible for
Accepting contactless does not expose you to card data you would not otherwise hold. The card number is not revealed to your terminal in usable form, and you should never be in a position to record it.
Your obligations sit under the Payment Card Industry Data Security Standard, currently PCI DSS v4.0.1, mandatory since 1 April 2025. For a business taking payments only through a physical terminal, this generally means completing a Self-Assessment Questionnaire annually through your acquirer rather than undergoing a formal audit.
Sensible practice at the counter:
- Never write down or photograph card details
- Check terminals daily for signs of tampering or substitution
- Keep terminal software current
- Limit who can access payment devices and reports
- Complete the annual self-assessment when asked, to avoid a non-compliance charge
If a customer disputes a contactless payment they say they did not make, the dispute runs through the chargeback process with your acquirer. Keeping clear transaction records is the practical protection.
Staff briefing you can use
Five things every person on your till should know.
- Contactless limits are now set by the customer's bank, so we do not quote a figure
- If contactless is declined for value, offer Chip and PIN or a phone wallet
- A PIN request after several taps is a normal security check, not a fault
- We never write down a card number, for any reason
- If a terminal looks altered or has been swapped, stop using it and report it
What this means for your equipment
Any terminal currently in service in the UK already handles contactless, Chip and PIN and mobile wallets. The March 2026 change does not require new hardware.
What may be worth reviewing is whether your terminal's software is current, since issuer limit changes are handled upstream but terminals still need to be maintained, and whether the connection is fast enough that contactless actually delivers the speed you are paying for.
There is a fuller discussion of matching hardware to trade in our guide to choosing the right card machine.
Key takeaways
- The mandatory contactless cap was removed on 19 March 2026
- Most large UK banks have chosen to keep the previous figure for now, so limits vary by issuer
- Stop displaying a specific contactless limit; it may not apply to that customer
- Mobile wallets have no equivalent cap because the customer authenticates on their device
- A PIN prompt after several taps is a routine security check
- Existing terminals need no replacement because of the rule change
How Jos Finserv Can Help
Jos Finserv can help eligible UK businesses review how they accept payments and explore the options available to them, including businesses whose current terminal or agreement no longer suits how they trade.
Jos Finserv is a broker rather than a payment provider or a bank. We cannot change what a customer's card issuer permits, and availability of any payment solution depends on provider criteria and the individual business.
Looking for a card payment solution for your business?
Explore the payment options available through Jos Finserv and discuss your requirements with the team.
Important: Contactless limits are set by card issuers and may be adjusted by cardholders; they are outside the control of any merchant or broker. Regulatory positions described here reflect published information at the time of writing and may change. Payment solutions are subject to provider eligibility criteria, and pricing and terms vary. Nothing in this article is a quote or personalised advice.
Want us to look at your own numbers?
Tell us how to reach you and we will come back with what is actually available for a business like yours. We are paid by the provider, not by you, so this costs you nothing either way.
- We read your current statement and explain it in plain terms
- No obligation, and no pressure to move if you are already well placed
- One conversation, not a sequence of calls
Prefer to work it out yourself first? Use the card fee calculator, or check whether finance is worth exploring.
