𝐍𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐏𝐚𝐲𝐦𝐞𝐧𝐭𝐬 𝐂𝐨𝐫𝐩𝐨𝐫𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐈𝐧𝐝𝐢𝐚 had notified on 25th May this year about issuance of 𝐆𝐮𝐢𝐝𝐞𝐥𝐢𝐧𝐞𝐬 𝐨𝐧 𝐔𝐬𝐚𝐠𝐞 𝐨𝐟 𝐔𝐧𝐢𝐟𝐢𝐞𝐝 𝐏𝐚𝐲𝐦𝐞𝐧𝐭𝐬 𝐈𝐧𝐭𝐞𝐫𝐟𝐚𝐜𝐞, commonly referred to as UPI. It further notifies on 𝐀𝐩𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐏𝐫𝐨𝐠𝐫𝐚𝐦𝐦𝐢𝐧𝐠 𝐈𝐧𝐭𝐞𝐫𝐟𝐚𝐜𝐞

(API) [APIs allow various entities, such as banks, payment service providers (PSPs), merchants, and third-party applications, to connect securely with the UPI network.]

They have come into enforcement from this very day. The new guidelines aim to prevent misuse and increase efficiency of the transactions by also enhancing the security aspect.

It focuses majorly on the aspect of controlling excessive traffic by putting control over balance checks (for each app used by the user), requests for checking linked account views and 𝐭𝐫𝐚𝐧𝐬𝐚𝐜𝐭𝐢𝐨𝐧 𝐬𝐭𝐚𝐭𝐮𝐬 𝐜𝐡𝐞𝐜𝐤𝐬  being limited to only 3 times at a gap of 90 seconds each.

The 𝐀𝐮𝐭𝐨-𝐩𝐚𝐲 𝐭𝐫𝐚𝐧𝐬𝐚𝐜𝐭𝐢𝐨𝐧𝐬 would take place as follows:

Before 10:00 AM, Between 1:00 PM to 5:00 PM and post 9:30 PM.

The UPI Applications are required to put a control over 𝐀𝐮𝐭𝐨𝐦𝐚𝐭𝐞𝐝 𝐀𝐏𝐈 𝐑𝐞𝐪𝐮𝐞𝐬𝐭𝐬 such as validating payment address or otherwise block it.

Penny drop APIs and banks are mandated to obtain explicit customer consent and use UPI ID with 𝑴𝑪𝑪 7413 (MCC is a 4-digit number classifying types of goods/services a business offers) as per the 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐏𝐞𝐫𝐬𝐨𝐧𝐚𝐥 𝐃𝐚𝐭𝐚 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐀𝐜𝐭, 𝟐𝟎𝟐𝟑 ‘𝐂𝐨𝐧𝐬𝐞𝐧𝐭’ 𝐦𝐚𝐧𝐝𝐚𝐭𝐞.

{The Penny Drop Verification API validates a bank account number and the Indian Financial System Code (IFSC) associated with it by making a transaction of 1 rupee (a penny drop)}

Other rules include:

– Balance can be checked only 50 times per day, exceeding which will block the balance checks for the next 24 hours on the application.

– Up to 25 bank accounts can be linked each day on the UPI App.

– Payees registered bank name to be displayed by the UPI Apps promoting transparency.

– As of before these new guidelines, the cap for transaction was Rs. 1 Lakhs, now for Capital markets, insurance, foreign inwards- Rs. 2 Lakhs and Rs. 5 Lakhs for tax payments, payments to educational institutes, hospitals, IPOs have been allowed. The UPI limit for per month/week has been left at the discretion of the banks.

{The notification dated 25/05/2025 can be accessed via: https://www.npci.org.in/PDF/npci/upi/circular/2025/UPI-OC-No-215-A-FY-2025-26-Guidelines-on-usage-of-UPI-APIs.pdf}

Leave a comment

This is a blog aiming to provide its readers with basic legal-tech knowledge that is necessary in the current times.

The author (www.linkedin.com/in/adv-annanya-deshpande) is a cyber law enthusiast and a keen researcher on the theme of Cyber Law and Artificial Intelligence. She aims to share the basic knowledge of the legal-tech world to the commoners and also the professionals.

The Blog post provides with short/brief reads, regarding the ongoing trends, Statutory viewpoints, the tussle between practicality and the letter of law, while also explaining the basic terms used in the field of AI and technology.

The author is always open to constructive criticism and feedback. Collaborations are welcomed! Any insight can be communicated via the feedback form/ LinkedIn.