DPI Brief — August 18, 2026
L2: Parliament Clears Path for UPI Merchant Fees — But Consumers Stay Shielded
The Taxation and Other Laws (Amendment) Bill, 2026 has amended Section 10A of the Payment and Settlement Systems Act, 2007, removing the statutory prohibition that barred banks and payment companies from levying a Merchant Discount Rate (MDR) on UPI transactions. The change, passed in the just-concluded Parliament session, empowers the UPI Steering Committee to implement targeted charges — effectively transitioning the network from a fully subsidised public good to a commercially viable utility.
Critically, the amendment is enabling, not prescriptive. No MDR has been imposed yet. The actual decision on which transaction categories attract fees, at what rate, and from when remains with the UPI Steering Committee and the government through future notifications. Person-to-person (P2P) transfers are explicitly excluded — consumers will not pay transaction charges. The legislative intent targets the merchant side: P2M transactions above a yet-unspecified threshold (media speculation centres on ₹2,000) may attract MDR, with large merchants expected to bear the cost rather than consumers.
Industry estimates suggest government subsidies currently cover only 11% of the real cost of running UPI infrastructure. With monthly transaction volumes exceeding 14 billion, the fiscal burden of zero-MDR was becoming unsustainable. A Business Standard analysis identifies six rules the government must still settle before any charges can actually begin: the threshold, the rate structure, exemptions for small merchants, revenue-sharing between banks and NPCI, and the grievance mechanism.
L2: Qatar Post Launches UPI-Powered Remittance Service for Indian Expats
On August 15, Qatar Post launched PosTransfer, a cross-border remittance service that allows Indian expatriates in Qatar to send money directly to UPI-enabled bank accounts in India. The service was developed in partnership with India Post, the Universal Postal Union’s Interconnection Platform (UPU-IP), and NPCI International Payments Limited (NIPL).
This is a meaningful extension of UPI’s international reach. Qatar has a large Indian diaspora that regularly sends remittances home, and PosTransfer bridges Qatar Post’s physical branch network with India’s digital payment rails. The service follows similar bilateral UPI remittance corridors already operational with Nepal, UAE, Singapore, and Sri Lanka — part of NIPL’s broader strategy to make UPI the default rail for inbound remittances to India.
L1/L7: WhatsApp’s Age-Verification Trial Runs Into India’s DPDP-Aadhaar-DigiLocker Architecture
Meta has begun testing an age confirmation feature on WhatsApp in India, ahead of the Digital Personal Data Protection (DPDP) Act’s implementation. However, as Biometric Update reports, the trial faces a structural challenge: India’s draft DPDP implementation rules propose two specific mechanisms for verifying children’s ages on social media platforms.
The first is an Aadhaar-linked DigiLocker system where a parent’s Aadhaar credentials are associated with their child’s account, allowing platforms to send a yes-or-no age query. The second is an electronic token system where a government ID is converted into an encrypted credential sharing only name and age. WhatsApp’s proprietary self-declaration approach may not satisfy either pathway, potentially putting it at odds with the forthcoming rules. The tension highlights a broader question for all Significant Data Fiduciaries: can platform-native age verification coexist with the state’s preference for DPI-mediated credential verification?
L7: NIELIT Launches CYBER KUSHTI 2026 — CERT-In as Knowledge Partner
The National Institute of Electronics and Information Technology (NIELIT), under MeitY, has launched CYBER KUSHTI 2026, a nationwide cybersecurity and AI hackathon. The competition is the official parallel technical track of the 3rd National Conference on Cyber Security, Digital Forensics and Intelligence (NCCDFI 2026), organised with the Information Sharing and Analysis Center (ISAC Foundation) under the National Security Database.
CERT-In serves as the knowledge partner. Registration is free and open to students and independent researchers in teams of three until September 10. The focus on “testing human judgment in security assessments” signals a welcome shift beyond automated vulnerability scanning toward adversarial reasoning — the kind of skill gap India’s cybersecurity workforce urgently needs.
L1: LPG e-KYC Deadline Five Days Away — Aadhaar Integration Under Pressure
The August 23 deadline for mandatory LPG e-KYC verification — covering Indane, HP Gas, and Bharat Gas connections — is now five days out. Consumers who cannot complete verification via the Aadhaar-based app or the oil company’s mobile application have been advised to visit their distributor with original documents. The drive underscores how Aadhaar eKYC remains the default identity verification layer for citizen services, even as questions about fallback mechanisms for those without Aadhaar access persist.
Covered layers: L1 (Identity), L2 (Payments), L7 (Trust). Sources: Business Standard, Biometric Update, NIELIT/SarkariTel, Qatar News Agency, Outlook Money.
L2: Parliament Clears Path for UPI Merchant Fees — But Consumers Stay Shielded
The Taxation and Other Laws (Amendment) Bill, 2026 has amended Section 10A of the Payment and Settlement Systems Act, 2007, removing the statutory prohibition that barred banks and payment companies from levying a Merchant Discount Rate (MDR) on UPI transactions. The change, passed in the just-concluded Parliament session, empowers the UPI Steering Committee to implement targeted charges — effectively transitioning the network from a fully subsidised public good to a commercially viable utility.
Critically, the amendment is enabling, not prescriptive. No MDR has been imposed yet. The actual decision on which transaction categories attract fees, at what rate, and from when remains with the UPI Steering Committee and the government through future notifications. Person-to-person (P2P) transfers are explicitly excluded — consumers will not pay transaction charges. The legislative intent targets the merchant side: P2M transactions above a yet-unspecified threshold (media speculation centres on ₹2,000) may attract MDR, with large merchants expected to bear the cost rather than consumers.
Industry estimates suggest government subsidies currently cover only 11% of the real cost of running UPI infrastructure. With monthly transaction volumes exceeding 14 billion, the fiscal burden of zero-MDR was becoming unsustainable. A Business Standard analysis identifies six rules the government must still settle before any charges can actually begin: the threshold, the rate structure, exemptions for small merchants, revenue-sharing between banks and NPCI, and the grievance mechanism.
L2: Qatar Post Launches UPI-Powered Remittance Service for Indian Expats
On August 15, Qatar Post launched PosTransfer, a cross-border remittance service that allows Indian expatriates in Qatar to send money directly to UPI-enabled bank accounts in India. The service was developed in partnership with India Post, the Universal Postal Union’s Interconnection Platform (UPU-IP), and NPCI International Payments Limited (NIPL).
This is a meaningful extension of UPI’s international reach. Qatar has a large Indian diaspora that regularly sends remittances home, and PosTransfer bridges Qatar Post’s physical branch network with India’s digital payment rails. The service follows similar bilateral UPI remittance corridors already operational with Nepal, UAE, Singapore, and Sri Lanka — part of NIPL’s broader strategy to make UPI the default rail for inbound remittances to India.
L1/L7: WhatsApp’s Age-Verification Trial Runs Into India’s DPDP-Aadhaar-DigiLocker Architecture
Meta has begun testing an age confirmation feature on WhatsApp in India, ahead of the Digital Personal Data Protection (DPDP) Act’s implementation. However, as Biometric Update reports, the trial faces a structural challenge: India’s draft DPDP implementation rules propose two specific mechanisms for verifying children’s ages on social media platforms.
The first is an Aadhaar-linked DigiLocker system where a parent’s Aadhaar credentials are associated with their child’s account, allowing platforms to send a yes-or-no age query. The second is an electronic token system where a government ID is converted into an encrypted credential sharing only name and age. WhatsApp’s proprietary self-declaration approach may not satisfy either pathway, potentially putting it at odds with the forthcoming rules. The tension highlights a broader question for all Significant Data Fiduciaries: can platform-native age verification coexist with the state’s preference for DPI-mediated credential verification?
L7: NIELIT Launches CYBER KUSHTI 2026 — CERT-In as Knowledge Partner
The National Institute of Electronics and Information Technology (NIELIT), under MeitY, has launched CYBER KUSHTI 2026, a nationwide cybersecurity and AI hackathon. The competition is the official parallel technical track of the 3rd National Conference on Cyber Security, Digital Forensics and Intelligence (NCCDFI 2026), organised with the Information Sharing and Analysis Center (ISAC Foundation) under the National Security Database.
CERT-In serves as the knowledge partner. Registration is free and open to students and independent researchers in teams of three until September 10. The focus on "testing human judgment in security assessments" signals a welcome shift beyond automated vulnerability scanning toward adversarial reasoning — the kind of skill gap India’s cybersecurity workforce urgently needs.
L1: LPG e-KYC Deadline Five Days Away — Aadhaar Integration Under Pressure
The August 23 deadline for mandatory LPG e-KYC verification — covering Indane, HP Gas, and Bharat Gas connections — is now five days out. Consumers who cannot complete verification via the Aadhaar-based app or the oil company’s mobile application have been advised to visit their distributor with original documents. The drive underscores how Aadhaar eKYC remains the default identity verification layer for citizen services, even as questions about fallback mechanisms for those without Aadhaar access persist.
Covered layers: L1 (Identity), L2 (Payments), L7 (Trust). Sources: Business Standard, Biometric Update, NIELIT/SarkariTel, Qatar News Agency, Outlook Money.