India's UPI at Scale: Infrastructure Realities for Payment Operators

India's Unified Payments Interface processed 24,161.69 crore transactions (about 241.6 billion) worth ₹314.23 lakh crore (roughly $3.7 trillion) in FY2025-26 (April 2025–March 2026), up from 18,586.60 crore transactions worth ₹260.56 lakh crore in FY2024-25 — a 30% year-on-year volume increase (Minister of State for Finance Pankaj Chaudhary, written reply to Lok Sabha, 20 July 2026). July 2026 set a fresh monthly record on top of that: 23.66 billion transactions worth ₹29.88 lakh crore, up 22% year-on-year by volume, surpassing the previous record of 23.20 billion set in May 2026 (NPCI monthly data, July 2026). For operators building payment infrastructure that touches South Asia or the Indian diaspora globally, UPI is not a nice-to-have integration — NPCI put the platform's user base at roughly 55.49 crore (554.9 million) as of June 2026, and it is the payment modality of record for a large majority of India's digitally active population.

What that means operationally is more nuanced than the headline numbers suggest. UPI's architecture is open but layered — making it a flagship example of global payments infrastructure built at government scale. Its zero-MDR policy was, until August 2026, protected by statute; it is now a reversible government notification instead. Its international expansion is accelerating but unevenly implemented across corridors. Each of these dimensions has direct consequences for how operators should design integrations, model unit economics, and plan compliance posture.

The Technical Stack: VPA, NPCI Switch, and the PSP Layer

UPI runs on IMPS (Immediate Payment Service) infrastructure managed by the National Payments Corporation of India (NPCI), with a real-time settlement layer built on top. The architecture has three distinct tiers:

Member banks — 731 banks were live on UPI as of June 2026, up from roughly 675 a year earlier. They hold customer accounts, handle KYC, and expose APIs to the NPCI switch for credit/debit operations. Every UPI transaction ultimately debits one member bank and credits another.

The NPCI switch — the central routing and settlement engine. It receives transaction requests, resolves VPA-to-account mappings, routes credit requests to the destination bank, and confirms settlement. Average processing time is under 1.5 seconds for the NPCI leg; end-to-end transaction time depends on member bank latency.

PSPs and Third-Party Apps (TPAPs) — the interface layer that users actually interact with. PhonePe, Google Pay, Paytm, and bank-native apps all operate as TPAPs. PSPs handle VPA creation, user authentication, and API communication with the NPCI switch. Critically, TPAPs do not hold money — they are pure routing and interface layers. By transaction volume, PhonePe and Google Pay together still account for the large majority of UPI flow (PhonePe alone processed roughly 10.86 billion of July 2026's 23.66 billion transactions), with Paytm a distant third — figures that shift monthly and should be re-checked against NPCI's published app-wise data before being used in a pitch or model.

NPCI has repeatedly deferred the rule capping any single TPAP's share of UPI volume at 30% — a threshold introduced in November 2020 and aimed squarely at PhonePe and Google Pay's combined dominance, which together still exceeds 30% each by most measures. The original compliance deadline was 31 December 2022; NPCI pushed it to 31 December 2024, then to 31 December 2026 (announced December 2024) — the second extension. Operators should treat the cap as a moving target rather than a fixed constraint: it has never been enforced, and nothing publicly signals the December 2026 date will hold either.

Virtual Payment Addresses

The VPA (or UPI ID) is the identifier that makes UPI operationally distinct from most other instant payment systems — though a comparable alias-routing architecture underpins PromptPay in Thailand, which uses phone numbers and national IDs to resolve bank accounts in real time. A VPA looks like username@bankname (e.g., merchant123@hdfc) and maps to a specific bank account via the DICT maintained by NPCI. Users can create multiple VPAs per account and can use a VPA from any TPAP regardless of which bank holds the underlying account.

For merchants, this means the QR code (or payment link) encodes a VPA, not a bank account number. From an operator integration standpoint, this provides a stable identifier that survives bank account migrations — as long as the VPA-to-account mapping is updated in NPCI's DICT. It also means that for reconciliation, VPA is the canonical identifier, and operators must map VPAs back to their internal merchant records rather than relying on bank account numbers.

UPI Collect vs UPI Intent

UPI has two primary payment flows. Collect is a pull request: the merchant initiates a payment request to the customer's VPA, the customer approves via their TPAP, and the debit executes. Intent (also called UPI Intent or QR-based flow) is a push: the customer scans a QR or taps a deep link, which opens their preferred TPAP pre-populated with the merchant's VPA and amount, and the customer confirms.

For e-commerce, Intent flows dominate because they require no prior relationship between the merchant and the customer's VPA. Collect flows are more common in invoice-based B2B contexts where the payee knows the payer's VPA in advance. Operators building merchant integrations should default to UPI Intent/QR flows and treat Collect as a supplementary channel.

The MDR Debate: What Operators Need to Model

UPI's zero-MDR policy for bank-account-funded merchant payments has been government policy since January 2020. The government has provided an incentive pool to partially compensate PSPs and banks for processing costs. From 15 October 2026, that blanket zero-MDR position no longer describes every merchant payment.

Parliament amended the Payment and Settlement Systems Act, 2007 in August 2026 to let the government specify fees by notification. The Department of Financial Services then published a 15 September FAQ setting 0.4% MDR on selected bank-account-funded UPI person-to-merchant payments above ₹2,000 from 15 October 2026. The fee is capped at ₹300 for transactions of ₹75,000 or more. Payments at or below ₹2,000, person-to-person transfers, qualifying P2PM micro-merchants receiving up to ₹1 lakh monthly through UPI QR, and UPI AutoPay mandates remain outside the prescribed MDR. Railways, telecom, insurance and fuel have a stated ₹5 flat rate above ₹2,000; capital-market transactions have a separate 0.02% rate capped at ₹300. Credit-linked UPI, including RuPay credit cards, follows separate product rules. These exceptions mean 0.4% is not a universal UPI rate.

One carve-out already exists and predates this year's law change: RuPay credit cards used through UPI have never been covered by the zero-MDR mandate, which only ever applied to bank-account-funded UPI and RuPay debit. Interchange/MDR of roughly 1.1–2% (varying by merchant category code) applies to RuPay-credit-on-UPI transactions above ₹2,000; transactions at or below ₹2,000 remain fee-free for small merchants. If your integration routes UPI payments funded by a RuPay credit card, model this cost now — it is current, not proposed.

What This Means for Operators

An operator modelling UPI economics should separate payment amount, merchant classification and funding source before applying a fee. The scheduled 15 October change is a concrete rate change for selected bank-funded P2M transactions, not merely a possibility created by the August legislation. It does not impose a fee on the consumer or ordinary P2P transfers. Confirm the applicable category and the acquiring bank's implementation before revising merchant pricing.

Operators routing high-value B2B transactions via UPI should confirm their PSP's fee model explicitly, including the ₹300 cap and any category-specific rate. RuPay-credit-funded UPI flows already carry separate interchange economics and are not governed by the new bank-account-funded P2M schedule.

Transaction Limits and B2B Constraints

NPCI sets UPI transaction limits that member banks can restrict further but not exceed. The standard per-transaction cap is ₹1 lakh ($1,200) for most use cases. Selected categories have higher limits:

• UPI 123Pay (IVR-based UPI for feature phones): ₹10,000 per transaction (raised from ₹5,000 by RBI, October 2024)
• UPI Lite (offline/low-connectivity, stored on device): ₹1,000 per transaction, ₹5,000 balance (raised from ₹500/₹2,000, December 2024)
• Standard UPI (P2P and general P2M): ₹1 lakh per transaction — unchanged
• Verified merchant categories (capital markets/mutual funds, insurance, travel, credit card bill payments, collections, Government e-Marketplace, forex retail): ₹5 lakh per transaction, ₹10 lakh daily aggregate — effective 15 September 2025 per NPCI circular

For B2B operators facing UPI's transaction cap — and cross-border B2B payment friction more broadly — the ₹1 lakh cap is the primary constraint. Vendor payments, payroll, and high-value invoice settlements that exceed this threshold require either stacking multiple UPI transactions (operationally clunky, audit trail fragmentation) or using RTGS/NEFT for amounts above the UPI limit. Most operators doing meaningful B2B volume in India maintain a dual-rail approach: UPI for transactions under ₹1 lakh, NEFT/RTGS for higher amounts.

UPI's International Expansion: The Real Operator Picture

NPCI International (NIPL) is the entity responsible for UPI's global rollout, and this list moves fast — verify it against NIPL's own announcements before relying on it. As of August 2026, UPI merchant/QR acceptance is live in ten countries: Singapore, Bhutan, Nepal, Sri Lanka, Mauritius, France, UAE, and Qatar (the original 2023–2025 cohort), plus two 2026 additions — Cambodia (via ACLEDA Bank, live 3 June 2026) and Greece (via Eurobank, live 30 June 2026, demonstrated in the presence of Commerce and Industry Minister Piyush Goyal). Cyprus has a signed NIPL–Eurobank Cyprus MoU announced in mid-2025 but was not yet live as of this writing. NIPL is separately reported to be scoping Southeast Asian corridors — Indonesia, Malaysia, Thailand — for further bilateral linkages (Business Standard, June 2026).

The most operationally significant live deployment is UPI-PayNow (Singapore), which went live in February 2023 as a bilateral linkage between India's NPCI switch and Singapore's PayNow infrastructure. Indian users can send up to ₹60,000/day to Singapore PayNow accounts using a phone number or VPA, with real-time settlement and RBI-approved FX conversion. This is the only UPI cross-border corridor where the transaction initiates from an Indian bank account to a foreign bank account using UPI rails end-to-end — other markets typically support only inbound UPI payments (Indian tourists paying merchants abroad). In August 2026, NIPL also launched a Qatar-specific inbound remittance rail with Qatar Post — Indian expatriates in Qatar can push money to Indian bank accounts via UPI rails, a different flow from the outbound PayNow corridor.

Cross-border UPI transaction volumes jumped from 37,060 in FY24 to 755,445 in FY25, and reached roughly 1.49 million in just the first nine months of FY26 (April–December 2025) — already nearly double the full FY25 total. The growth is real, but the absolute volumes remain small compared to domestic flows of tens of billions of transactions per month — this is a corridors-in-construction story, not a mature cross-border infrastructure.

Integration Realities for Non-Indian Operators

For operators outside India wanting to accept UPI:

• Inbound only: Most non-Indian operators can accept UPI payments from Indian tourists and diaspora through PSPs like Nuvei, Stripe, or Adyen's India integrations. The transaction flow involves a licensed Payment Aggregator (PA) in India as the intermediary between the operator and NPCI.
• Requires PA licensing or partnership: Direct NPCI membership is not available to foreign entities — it's RBI, not NPCI, that authorises PAs. Since RBI's September 2025 consolidated Payment Aggregator Directions, cross-border collection specifically requires PA-Cross Border (PA-CB) authorisation, a category capped at ₹25 lakh per transaction with foreign exchange routed only through an Authorised Dealer bank. Foreign operators almost never apply for authorisation directly — the standard route is partnering with an already-authorised Indian PA (Razorpay, PayU, Cashfree, and CCAvenue are commonly cited names) rather than seeking one's own licence.
• FX risk sits with the PA: For cross-border UPI transactions, the PA converts INR to the merchant's settlement currency. Operators should negotiate FX spread explicitly — PA-quoted rates typically embed 0.5–1.5% spread above mid-market.
• Settlement timing: UPI settlement in India is T+1 in INR to the PA's nodal account. Cross-border settlement to the operator's foreign bank account adds an additional T+1–2 for international wire, making effective settlement T+2 to T+3.

Fraud Exposure and the Dispute Architecture

UPI transactions are irrevocable once confirmed — there is no chargeback mechanism equivalent to card dispute rights. RBI has established the Dispute Resolution Mechanism (DRM) through NPCI, which handles cases where the customer's account was debited but the merchant did not receive credit (a failed transaction scenario), but this is distinct from consumer-initiated fraud disputes.

For merchant fraud (customer disputes a transaction they did actually authorize), resolution goes through the member bank's grievance process and ultimately the RBI Banking Ombudsman. Resolution timelines can stretch to 30–90 days. This creates asymmetric risk for certain merchant categories — particularly digital goods and travel — where the product or service has been delivered before any dispute is filed.

Sardine and other behavioral fraud vendors have built UPI-specific risk models, but the fundamental exposure is social engineering: the customer authorizes a fraudulent transaction willingly. Operators accepting UPI in high-risk verticals should factor the absence of chargeback rights into their fraud provisioning models, as the financial exposure timeline is longer than equivalent card disputes.

The operators who build UPI correctly understand that they are integrating a public infrastructure with regulatory constraints, subsidy dynamics, and dispute mechanics that differ fundamentally from card rails — not just a cheaper version of instant bank transfer.

Recurring billing on UPI: For operators running subscriptions or instalment plans in India, UPI AutoPay is the mandate framework NPCI built for recurring debits. Customers authorise a mandate once; subsequent debits execute without per-transaction additional-factor authentication (AFA) up to ₹15,000 for general subscriptions and utility billing. Insurance premiums, mutual fund SIPs, and credit card bill payments get a higher AFA-free ceiling of ₹1 lakh per debit — which is why those three categories are the dominant recurring use case on UPI rather than a limiting factor. Digital subscription renewals below ₹15,000 are the other major segment, and the economics beat card-on-file recurring for the majority of Indian subscription price points.

Delegated payments: NPCI's UPI Circle, rolled out across major TPAPs through 2025 and now broadly available in 2026, lets a primary account holder delegate payment authority — full or partial — to a trusted secondary user without giving that person their own bank-linked UPI account. It's relevant for operators building household, family-plan, or small-team spending features on top of UPI rather than a payments-acceptance concern, but it changes who can legitimately authorise a debit on a given VPA, which matters for fraud and authentication logic.

For a side-by-side comparison of UPI against Pix, SPEI, PromptPay, and four additional real-time rails — MDR model, identifier architecture, cross-border readiness, and licensing path — see the Real-Time Payment Rails Comparison Matrix.