Internet-connected radio equipment that lets its holder or user move money, monetary value or virtual currency (the last as Directive (EU) 2019/713 on non-cash payment fraud defines it) must support features that protect against fraud. Recitals 13 and 14 describe the harm: data and credentials stolen from connected devices used for payments, with costs that fall on the payer, the payee and society through investigation and litigation. The requirement reaches phones, watches, wristbands, tags and other equipment with a payment, wallet or crypto-transfer function. The manufacturer must build in authentication of the user before a transfer, protection of the credentials and keys the transfer relies on, secure update of the payment-relevant software and resistance to tampering, and must document these in the technical file. The Commission's guidance on EN 18031-3 is strict here: the standard's secure update assessment criteria in clause 6.3.2.4 never confer a presumption of conformity for financial assets, so products relying on that clause always need a notified body.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.