🇮🇳 Payments in India

The institutional foundation: RBI, NPCI, PRB

The National Payments Corporation of India (NPCI) runs India’s retail payment infrastructure. It was incorporated on December 21, 2008, as a section 25 company, a not-for-profit status that became section 8 of the Companies Act 2013. It was set up as a joint initiative of the Reserve Bank of India (RBI) and the Indian Banks’ Association under the Payment and Settlement Systems Act, 2007. It started with 10 promoter banks. Today it has 67 shareholders: public-sector, private, foreign, and cooperative banks, regional rural banks, small finance banks, payments banks, and payment system operators. India is the only major market where retail payment infrastructure is run by a single not-for-profit company, with no commercial bank consortium and no competing private schemes.

UPI, IMPS, RuPay, NACH, AePS, Bharat Connect, FASTag, and the national ATM switch are all run by the same operator. A foreign company therefore does not have to negotiate scheme by scheme, as it would in Europe or the US. The applicable framework consists of NPCI operating circulars and, above them, RBI regulation. The governance of that regulation changed in 2025. The Payments Regulatory Board Regulations, 2025, which took effect on May 9, 2025, replaced the Board for Regulation and Supervision of Payment and Settlement Systems (BPSS) with a Payments Regulatory Board (PRB). The board has six members: three from the RBI, including the Governor, who chairs it, and three appointed by the central government. Payments regulation now sits with a body that includes members from outside the central bank, whereas the BPSS was an internal RBI committee.

1 lakh        = 100,000            = 1e5      written  ₹1,00,000
1 crore       = 10,000,000         = 1e7      written  ₹1,00,00,000
1 lakh crore  = 1,000,000,000,000  = 1e12     written  ₹1,00,000 crore

Real examples:
  UPI, July 2026    : ₹29.88 lakh crore  = 2.988e14 ₹  (~$360B)
  RTGS, year 2025   : ₹2,206 lakh crore  = 2.206e17 ₹  (wholesale settlement)
  UPI P2P limit     : ₹1 lakh / day      = 1e5 ₹       (~$1,200)

UPI: how the rail is built

Unified Payments Interface (UPI), run by NPCI since 2016 under an RBI mandate, is an instant account-to-account transfer rail. Payments are addressed by proxy rather than by account number and IFSC code. The proxy can be a Virtual Payment Address written name@bank, a mobile number, a QR code, or a merchant ID. Funds never leave bank accounts. The standard flow involves no e-money, no float, and no intermediary holding funds. Final settlement is in central bank money through the RBI’s RTGS, which has run 24×7 since December 2020.

UPI separates the app the user interacts with from the bank that holds the account. A Third-Party Application Provider (TPAP) such as PhonePe, Google Pay, Paytm, or BHIM provides the interface without issuing or holding accounts. It relies on a sponsor PSP bank, the only direct participant on the rail. A merchant that “integrates UPI” therefore connects to an aggregator or a bank, never directly to NPCI. This split determines who holds the license, who holds the funds, and who is responsible for KYC. Any Indian integration project starts by identifying these three roles.

Accepting payments in India: aggregators, licenses, escrow

Every Indian payment passes through a chain of intermediaries that no foreign merchant can bypass. The actual chain runs merchant → payment aggregator (PA) or acquiring bank → PSP bank → NPCI → payer’s bank. The payment aggregator carries the legal burden. Its status was completely overhauled by the Reserve Bank of India (Regulation of Payment Aggregators) Directions, 2025, published on September 15, 2025, which replace the regime based on the 2020 guidelines. The Directions split aggregation into three categories, each requiring a separate authorization.

• Net worth: ₹15 crore when applying, ₹25 crore by the end of the third financial year, maintained thereafter.
• Segregation: merchant funds flow through an *escrow account held with a Scheduled Commercial Bank in India*; the aggregator’s own funds may not sit there.
• Customer due diligence: merchant due diligence under the Master Direction on KYC, 2016, central registry checks, background checks, and ongoing transaction monitoring.
• Reporting: monthly transaction statistics to the RBI, a quarterly auditor’s certificate on escrow operations, an annual net worth certificate, and a cybersecurity audit report.
• Transition timeline: applications due by December 31, 2025; otherwise, aggregation activity must stop by February 28, 2026.

Emerging-market pay-in/pay-out is a service in which a provider collects through a country’s local payment methods, then pays the merchant out in a hard currency. Global merchants that prefer not to set up an Indian entity usually take this route. A provider such as dLocal collects through local methods (UPI, RuPay cards, and net banking) and repatriates the funds in hard currency. This business has its own pricing and its own FX constraints, distinct from those of an acquiring agreement.

Zero MDR and the economics of acceptance

The MDR (merchant discount rate) is the fee a merchant pays its acceptance chain on every payment it collects. India is the only major market to have set the merchant fee at zero by law on its national rail and its domestic debit scheme. Since January 1, 2020, under Section 269SU of the Income-tax Act 1961, the MDR has been zero by regulation on RuPay debit cards and BHIM-UPI. The law bans the fee outright, rather than capping it or leaving it to the market. The effect is on the structure of issuing. RuPay debit issuing no longer has a business model for the issuer. It exists only through regulatory mandate and government incentives, the exact opposite of the Visa/Mastercard model, where the issuer earns interchange out of the merchant fee.

Because the rail charges merchants nothing, its cost is funded outside the transaction. The government covers it through an incentive program renewed every fiscal year, which compensates banks and acquirers for low-value BHIM-UPI transactions. Whether this setup is sustainable is the main debate in Indian payments. In March–April 2026, the parliamentary Standing Committee on Finance recommended reinstating an MDR for large merchants, arguing that without it the ecosystem is financially unsustainable. The options discussed target merchants above a turnover threshold and transactions above ₹2,000, and exempt small merchants and consumers. The Finance Ministry denied at the time that any plan had been finalized. NPCI settled the question on September 15, 2026, with a fee that applies from October 15, 2026.

RuPay, co-badging, and the decline of debit

RuPay, launched by NPCI in 2012, is India’s domestic card scheme. According to NPCI, more than 760 million RuPay cards had been issued across all products as of 2024. India had 1,005.2 million debit cards and 111.2 million credit cards in circulation in June 2025 (RBI, Payment System Report). Usage trends matter more than the size of the card base. Debit is collapsing. Debit card transaction volume fell from 408 crore to 133 crore between 2021 and 2025, an average annual decline of 24.4% (RBI, Payment Systems Report 2026). Credit, by contrast, is growing 27% a year. Debit is losing ground to UPI, which provides the same account-to-account payment with no merchant fee and no physical instrument to present.

RuPay Credit Card on UPI lets a RuPay credit card be linked to a UPI ID and used by scanning a merchant QR code, with authentication by UPI PIN. The merchant accepts credit on a QR code, with no terminal. The scope is narrow: cash withdrawals at the merchant, P2P transfers, and card-to-card payments are excluded, and standard UPI limits apply. No Visa or Mastercard equivalent exists on this rail. That functional exclusivity explains RuPay’s breakthrough in credit, with an estimated 16 to 18% market share in 2025 according to secondary sources that have not been cross-checked.

• National Common Mobility Card (NCMC), since 2019: an open transit card, interoperable across city networks and built on RuPay with an offline wallet. It is India’s open loop transit model, which several countries in the region are watching.
• NETC / FASTag, since 2016: interoperable RFID tolling, mandatory on national highways and backed by prepaid instruments. A closed but massive rail, it gave the RBI hands-on experience in regulating PPIs.
• National Financial Switch (NFS), transferred from IDRBT to NPCI in 2009: the national interbank ATM switch. Rarely mentioned in analyses, it nonetheless underpins interoperability across India’s entire ATM network.
• e-RUPI, since 2021: a purpose-bound digital voucher delivered by SMS or QR code, with no account or app needed on the beneficiary’s side. It is a conceptual forerunner of the programmability now being tested with central bank digital currency.

Aadhaar, AePS, and financial inclusion rails

Aadhaar is the 12-digit identifier issued by the UIDAI, India’s identity authority, backed by online biometric and demographic authentication. It is the identity layer underneath Indian payments, and one that Western markets lack. It powers bank e-KYC and account seeding, the process that links a bank account to an Aadhaar number so that social benefits can be paid into it. It also supports two payment rails in their own right: AePS for in-person transactions and APBS for bulk disbursements.

The Aadhaar Enabled Payment System (AePS), run by NPCI since 2011, supports withdrawals, deposits, balance inquiries, and payments by fingerprint at a banking correspondent, with no card or phone. The rail underpins rural financial inclusion: biometric authentication means users need no payment instrument. It is also the target of documented fraud, including identity theft, harvesting of biometric data, and misappropriation by service point operators.

On the disbursement side, NPCI’s National Automated Clearing House (NACH) carries direct benefit transfers through the Aadhaar Payment Bridge System (APBS). What sets this rail apart is addressing: the beneficiary is identified by their Aadhaar number, not an account number. The government can thus pay hundreds of millions of people without maintaining an up-to-date bank account database itself, because NPCI keeps the mapping between ID and account. No other country runs a subsidy rail at this scale on identity-based addressing.

Recurring payments: NACH, e-NACH, UPI AutoPay

A recurring payment mandate is the authorization a payer gives a creditor to debit their account at regular intervals. In India, subscriptions, loan installments (EMI), insurance premiums, and systematic investment plans (SIP) rely on two families of mandates. NACH, run by NPCI, is the bulk clearing rail for recurring debits and disbursements. Its digital version, e-NACH, registers a mandate online via Aadhaar, net banking, or debit card, with no paper and no wet signature. UPI AutoPay is the equivalent on the UPI rail: the mandate is tied to the payer’s UPI ID and executed by the switch.

The legal framework for these mandates was completely rewritten on April 21, 2026. The Digital Payments – E-mandate Framework, 2026 (circular RBI/CO.DPSS.POLC.No.S56/02.14.003/2026-27) repeals the circulars issued between 2019 and 2024 and consolidates them into a single text. It applies equally to cards, UPI, and prepaid payment instruments (PPIs), for both domestic and cross-border recurring transactions. It took effect immediately.

• The first transaction under a mandate always requires an additional factor of authentication (AFA). No exceptions.
• After that, AFA is not required up to ₹15,000 per transaction. Above that amount, it is required again at the time of debit.
• Threshold raised to ₹1 lakh per transaction for three categories: insurance premiums, mutual fund subscriptions, and credit card bill payments.
• Mandatory pre-debit notification at least 24 hours before each debit, stating the payee’s name, the amount, the date and time of the debit, the mandate reference, and the purpose.
• Right to opt out of individual transactions and to revoke the mandate, confirmed with AFA.
• No charge to the customer for using the e-mandate service, and a mandatory post-debit notification that explains how to file a complaint.
• Dispute and complaint handling process to be set up by the collecting entity.

Tokenization, authentication, data localization

Three obligations shape the technical compliance of any payment company in India, and none has an exact equivalent elsewhere: mandatory tokenization of card data, two-factor authentication with a dynamic factor, and full localization of payment data in India. All three are legally enforceable and apply on top of PCI DSS, independently of it.

The RBI’s 2025–26 annual report, published in May 2026, records 10,114 fraud cases totaling ₹48,021 crore reported by banks and financial institutions during the fiscal year. The previous year saw 23,722 cases worth ₹32,803 crore. The number of cases fell while amounts rose sharply, as older cases were brought onto the books. The RBI has said it is studying deliberately adding friction to payment flows to counter authorized push payment fraud, in which the payer approves a payment to the fraudster. It is also exploring a universal mechanism to immediately block all debits from an account across every digital channel.

• Check before signing: the provider’s exact license (PA-O, PA-P, PA-CB) and when it was granted. Aggregators that had not applied by December 31, 2025, had to stop operating by February 28, 2026.
• Check the footprint: where the processing and storage servers actually are, not just where the provider is headquartered.
• Check banking redundancy: a single PSP bank is a continuity risk, as the end of Paytm Payments Bank showed.
• Check the authentication flow: compliance with the September 2025 Directions since April 1, 2026, including a dynamic factor other than SMS OTP.
• Check mandates: 24-hour pre-notification actually implemented, with the right to opt out, on the chosen rail.

UPI outside India: acceptance, links, stack export

The Indian rail’s international expansion is led by NPCI International Payments Limited (NIPL), NPCI’s export arm. It covers three distinct businesses, with different counterparties and different contracts. The first is UPI acceptance abroad for Indian travelers. The second is linking two national instant payment systems for person-to-person transfers. The third is selling the software stack to another country that wants its own rail.

UPI acceptance is expanding through successive bilateral agreements with Bhutan, Nepal, Sri Lanka, Mauritius, the United Arab Emirates, Singapore, Qatar, Oman, and France. Cambodia joined more recently, through an NIPL–ACLEDA Bank partnership in June 2026. With around ten countries by mid-2026, this amounts to coverage for Indian travelers, not a global acceptance network. A merchant outside India that displays the UPI QR code therefore reaches only visitors with Indian bank accounts, not customers in its home market.

Central bank digital currency (CBDC) is the last piece of India’s payments picture. The RBI’s e₹ (Digital Rupee) pilot launched in 2022 as a closed user group, initially with 13 banks and 26 cities. It had ₹771.7 crore in circulation as of March 31, 2026, down 24% year over year (RBI, 2025–26 annual report). That contraction shows how much the pilot is struggling. In a country where UPI is free, instant, and universal, retail CBDC has no economic case. The use cases still being explored are targeted programmability, with subsidy programs in Gujarat, Puducherry, and Chandigarh, and wholesale cross-border payments.