DPI Brief — September 10, 2026
The 7th Global Fintech Fest 2026 (September 8–11, Mumbai) has turned this week into the densest stretch of DPI announcements of the year, with Prime Minister Narendra Modi inaugurating the event before 100,000+ delegates. Nearly every layer of the stack saw movement in the last 24 hours — from identity authentication tooling to agentic payments, network commerce strategy, and the data-protection compliance clock.
1. UIDAI opens Aadhaar face authentication to banks and fintechs [L1 — Identity]
At GFF 2026, UIDAI launched the Aadhaar Face Authentication SDK and a dedicated Sandbox, letting banks, insurers, fintechs and brokers embed Aadhaar-based face verification directly inside their own mobile apps. The shift is significant for two reasons. First, users no longer juggle multiple apps during onboarding — the face scan happens within a single banking or insurance app. Second, UIDAI Chairman Neelkantha Mishra said partners can run authentication locally on their own servers rather than routing every request through UIDAI’s central systems — a meaningful architectural change for critical infrastructure that Mishra noted faces “hundreds of attacks every day.” The SDK builds on face-auth technology indigenously developed with AI/ML and first launched in 2021.
2. Aadhaar prepares for 300 million authentications a day [L1 — Identity]
In the same GFF appearance, Mishra said Aadhaar currently processes around 100 million authentications daily and is preparing to scale to 250–300 million. Downloads of the Aadhaar app — which handles mobile number and address updates without an Aadhaar Seva Kendra visit — have jumped to nearly 60 million from 50 million just weeks earlier. Mishra described a “flywheel”: more app downloads encourage businesses to embed Aadhaar into workflows, driving further usage. UIDAI is also working on a 10-year technology roadmap covering AI-based fraud detection and post-quantum cryptography, and is examining Aadhaar authentication outside India. The scale targets signal that UIDAI expects authentication volume to triple as agentic and embedded use-cases multiply.
3. NPCI readies agentic UPI; UPI goes live at Resorts World Sentosa [L2 — Payments]
Reuters reports NPCI is preparing a Unified Agent Protocol (UAP) — a common framework for registering, verifying and authorising AI agents that transact through UPI, with spending caps, audit trails and identity checks. Early use cases reportedly build on existing delegation rails — UPI Circle (₹5,000 per transaction, ₹15,000 per month) and Reserve Pay blocks — with e-commerce platforms expected to lead adoption. NPCI has not formally confirmed the framework; the open question, flagged by industry commentary, is liability: who eats the loss when an agent pays wrongly. Meanwhile, NPCI International partnered Singapore’s FOMO Pay to bring UPI QR acceptance to Singapore merchants, with Resorts World Sentosa as the first — announced September 9. Context for the global push: UPI processed a record 24.51 billion transactions worth ₹29.82 lakh crore in August 2026, up 22% year-on-year, and per PIB now handles ~50% of global real-time payment volume across 11 countries.
4. ONDC pivots to logistics and mobility [L4 — Commerce]
ONDC’s FY26 annual report, reported September 9, shows the network is shifting focus toward logistics, mobility and transport while taking a more targeted approach to retail. Mobility is already a quiet success: 500,000+ metro and bus journeys are facilitated daily, roughly 30% of India’s online public-transport ticketing flows through the network, and 40+ consumer apps carry transit ticketing. On the supply side, farmers, artisans and rural producers recorded an 11-fold increase in order volumes in FY26 through network-based models. The pivot acknowledges that commodity retail e-commerce remains dominated by vertical platforms, while open-network economics work best where no single platform owns demand — precisely the case in mobility and rural commerce.
5. ABDM adoption warning; Aarogya Setu 2.0 pushed as PHR front-end [L5 — Sectoral]
Haryana’s additional chief secretary (health) Sumita Mishra warned that low private-sector adoption could slow the digital health mission — the state has 1.9 crore ABHA IDs (64.76% of population), but IDs without connected healthcare providers don’t make records portable. The Centre is countering with Aarogya Setu 2.0, launched June 29, now being actively promoted as a citizen-facing Personal Health Record app bundling ABHA management, record access, teleconsultation and AI health insights. The tension between identity-creation targets and actual network participation remains ABDM’s core challenge.
6. DPDP compliance clock ticks toward May 2027 [L7 — Trust]
With GFF celebrating fintech scale, the trust layer is quiet but consequential: the DPDP Act’s core substantive provisions and key Rules take full effect on May 13, 2027, per MeitY’s November 2025 notifications — giving data fiduciaries roughly 20 months. As agentic payments (item 3) move AI agents into the payment loop, DPDP obligations around consent, notice and grievance redressal will intersect directly with NPCI’s agent-registration and audit-trail design. MeitY has also opened a DPDP Act logo and tagline contest on MyGov (deadline September 30) as public-awareness groundwork begins.
Layer coverage today: L1 Identity ×2, L2 Payments, L4 Commerce, L5 Sectoral, L7 Trust. Sources: PIB, UIDAI statements at GFF 2026, NPCI/NPCI International announcements, ONDC FY26 annual report, MeitY notifications.