DPI Deep Dive — Tuesday | September 15, 2026

Layer 2 — Payments & Financial Rails — did not have a quiet week; it had a constitutional one. The Global Fintech Fest (September 8–11) turned Mumbai into a trade show for UPI’s next decade, and then, on September 14, the government quietly rewrote the price list. A gazette notification under the Payment and Settlement Systems Act now guarantees zero charges on UPI payments up to ₹2,000 and on RuPay debit card payments — and by doing so, formally opens the door to merchant fees on everything above that line. ^{1 2 3} The same week, NPCI unveiled UPI Tap & Pay and the AI-powered MyUPI support layer, ⁴ confirmed — through leaks and platform launches — that it is building a registry to let AI agents pay on UPI, ⁵ and drew its first cross-border acceptance deal in Singapore even as the Prime Minister told the fintech industry to take UPI global and stop paying foreign card networks’ tolls. ^{6 7} The through-line: India’s payments rail is simultaneously renegotiating its price, its future operators, its physical form, and its borders — and the consumer’s seat at that table is still a folding chair.

1. The ₹2,000 Line: Zero-MDR Ends by Notification

The week’s most consequential payment story arrived on a Monday, without a stage. The Finance Ministry notified changes specifying UPI transactions up to ₹2,000 and RuPay-powered debit card payments as protected “electronic modes of payment” under the Payment and Settlement Systems Act, 2007 — no bank or system provider may impose any direct or indirect charge on a person making or receiving payments through these modes. ^{2 3} The drafting is the point: the earlier blanket bar on fees for UPI is replaced by a thresholded guarantee, which means everything above ₹2,000 is now, legally speaking, chargeable. Reuters reported it plainly — the notification paves the way for charges on larger UPI transfers, with any fee to be paid by merchants rather than consumers, and a final decision still pending. ¹

The enabling legislation was passed a month ago. In August, Parliament cleared the Taxation and Other Laws (Amendment) Bill, 2026, amending Section 10A of the PSS Act to let the Centre notify which electronic payment modes are exempt from merchant discount rate (MDR) — unwinding, by statute, the zero-MDR regime imposed in 2020 to jumpstart adoption. ⁸ What’s coming into focus is a reported framework of around 40 basis points on select high-value merchant transactions, split 40% to issuing banks and 30% each to third-party app providers and acquiring banks — at 40 bps, roughly 16 bps to the issuing bank and 12 bps each to the TPAP and acquirer. ^{8 9} The parliamentary finance committee’s justification is real: the government’s incentive scheme has never fully covered banks’ costs of running free infrastructure, and something that cannot charge must eventually be subsidised or degraded. ⁹

The consumer ledger is more mixed than the industry’s. Person-to-merchant payments are 63% of UPI volume, and 86% of those merchant payments were below ₹500 in FY2026 ¹⁰ — the ₹2,000 line protects the entire daily-commerce tail, from the vegetable vendor to the kirana store. The exposure sits in the middle ticket: electronics, travel bookings, school fees, the ₹5,000–₹50,000 payments where a 40 bps fee is real money for a small merchant deciding between UPI and a card machine. And “merchants pay, not consumers” is a comfortable fiction everywhere MDR exists — fees pass through into prices, the only question is transparency. This publication’s own cost research has documented that UPI’s “free” was always a shifted cost — subsidies, cross-subsidies, and uncompensated infrastructure — so the honest position is not “MDR is a betrayal” but “MDR without disclosure is a transfer.” The consumer ask writes itself: if the 40 bps framework lands, publish the notified split, mandate merchant-level disclosure for chargeable transactions, and keep the incentive scheme audited — because the moment fees arrive, the government’s justification for paying NPCI’s bills quietly evaporates.

The cross-layer angle: This is Layer 2 repricing Layer 4 (commerce) — every merchant onboarding decision and every checkout page changes if MDR lands. And it brushes Layer 7: the DPDP-era argument that data flows should be consented and priced applies with equal force to payment flows, which are currently neither.

2. Agentic UPI: The Registry Before the Rules

While the Fest showcased agentic AI as its headline theme, the structurally important development was in the plumbing. Reuters reported, citing three sources, that NPCI is building a registry to verify and monitor AI agents that transact on UPI — the registry will form part of a planned Unified Agentic Protocol (UAP), initially vetting agents paying on UPI and later extending to cards, bill payments and other rails. ⁵ The same reporting was explicit about the gap: agent identity and spending limits can be engineered, but liability for wrong or unauthorised payments “will need to be addressed through regulation.” ¹¹ NPCI has not formally confirmed the protocol; the final transaction limits, liability allocation and rollout timeline all remain pending. ¹²

The design perimeter leaked elsewhere. Business Standard reported the framework is expected to start with low-value, frequent purchases — groceries first — with users setting rules and spending caps before an agent can transact. ¹² NPCI chairman Ajay Kumar Choudhary compressed the philosophy at GFF: AI agents can read intent, but they cannot approve payments — approval remains a human act even when execution is delegated. ¹³ And NPCI is not just talking: it launched two agentic AI platforms at the Fest, AiNxt and AtOM (Agentic Orchestration & Messaging), to automate enterprise workflows across the payments ecosystem. ¹⁴

The comparison that matters came from Singapore. MAS Managing Director Chia Der Jiun told the Fest — by video — that Singapore’s financial industry had already published SAFR (Safeguards for Agentic Finance at Runtime) in July, setting out runtime requirements: establishing an agent’s identity and authority, evaluating agent actions against controls before execution, and maintaining clear audit records. ¹³ India, in other words, is not defining the global conversation; it is joining one that already started, from the strongest possible negotiating position — the world’s largest retail fast-payment system by volume, which processed 24.51 billion transactions worth ₹29.82 lakh crore in August alone. ¹⁵ Whatever NPCI decides about agent identity will be watched in every market building agentic commerce, from China’s Payment & Clearing Association guidelines to the agent registries Amazon, Google and Microsoft are assembling. ⁵

The unresolved consumer question is the one Startup Fortune put best: the technology for software to spend your money is no longer interesting — who eats the loss is. ¹² UPI works today because the authorising action is unambiguous: you enter the PIN, you made the payment. Agentic payments blur that clean line — a user approves a budget on Monday and the agent spends it on Friday, and the dispute machinery of Story 4 suddenly has to adjudicate between a person and their software. An agent registry creates a record of approved software identities; it does not create consent standards, revocation UX, or liability rules. Those are regulatory choices, and this week showed the regulation hasn’t caught up to the plumbing.

The cross-layer angle: Agentic payments are Layer 2 being re-operatorised by Layer 1 (agent identity) under Layer 7 (trust and safety) rules that don’t yet exist in Indian law. The DPDP Act governs personal data; nothing yet governs delegated spending authority — the moment an agent’s spending pattern becomes a behavioural profile, UAP quietly becomes a data protection problem too.

3. Tap & Pay: The Card Experience Comes to UPI, Just As Apple Pay Nears

The most visible launch of the week was the most physical. RBI Governor Sanjay Malhotra unveiled UPI Tap & Pay on September 10: tap your NFC-enabled phone on a POS terminal, payment done — no app opened, no QR scanned, and no PIN for transactions up to ₹5,000, with the PIN entered on the terminal itself above that. ^{4 15} NPCI positioned it for low-connectivity environments: the tap authenticates locally, deliberately designed to work where the network doesn’t. ¹⁵ It builds directly on the biometric authentication stack launched at GFF 2025 — biometric-authenticated UPI transactions crossed 6.29 billion as of August 31, 2026 ¹⁶ — and supports RuPay credit cards on the UPI rail alongside UPI Lite, the offline wallet variant that allows no-PIN payments up to ₹500 and offline spends up to ₹2,000 from a pre-loaded balance. ¹⁷

Timing is strategy. Reuters connected the launch to the expected full launch of Apple Pay in India — a beta has been available for some time, with a full rollout anticipated by October. ¹⁵ The read-through: NFC is the one payment form factor where India’s QR-native rail has been absent, and card networks own that absence. By standardising tap-to-pay on UPI — and by routing RuPay credit through the same terminal interaction — NPCI is neutralising the POS moat before a deep-pocketed entrant lands on it. The consumer consequence is a genuine convergence: a tap that works the same whether the instrument behind it is a RuPay credit card, a UPI Lite wallet, or a direct bank debit.

The consumer case is real but has a specific failure mode. Tap-to-pay removes friction at the exact moment when friction is fraud’s last checkpoint — the PIN entry where a user consciously confirms. ₹5,000 PIN-less is a generous ceiling, and loss-of-device risk now carries a fivefold weight versus the ₹500 offline-Lite allowance. The mitigation shipped the same day, which is why Story 4 matters: if the rail is going to make spending faster, it owes the user an equally fast way to stop spending.

The cross-layer angle: This is Layer 2 adopting Layer 1’s biometric infrastructure (6.29 billion authentications and counting) to compete with global card form factors — payment rails and identity rails visibly fusing into one tap.

4. MyUPI: A Grievance Layer Gets Built Into the Rail

The launch with the least stage presence and the most consumer value was MyUPI — UPI Help 2.0 — built on NPCI’s in-house payments-focused Small Language Model, FiMI. ^{4 16} It gives users a single view of their UPI transactions and AutoPay mandates across every bank and app — the first time the ecosystem’s fragmentated transaction history has been stitched into one pane. ¹⁶ On top of that, a set of User Controls that read like a fraud-response kit: a Safety Switch to request declining UPI debit transactions the moment a compromise is suspected; UPI Number Delink to sever a mobile number from receiving UPI payments; Payee Context-based Information surfacing beneficiary details before a payment is authorised; and Automated Chargeback Processing to move disputes without the current app-hopping maze. ^{16 18}

The context is a rail where recourse is the weakest link. UPI is real-time and effectively irrevocable — the money is gone before the victim finishes dialling the helpline, which is exactly the window the Safety Switch attacks. And the scams haven’t slowed: this very week, UP’s cyber police arrested a gang in Basti for collecting cash against fake UPI payment screenshots — proof that the attack surface is as much social engineering as system engineering. ¹⁹ MyUPI’s bet is that the rail itself should carry the grievance infrastructure — dispute initiation, mandate visibility, payee verification — rather than leaving it to twenty inconsistent TPAP implementations.

The honest caveat: this is Layer 6 (grievance and redress) being built into Layer 2 by the operator, not by the RBI’s Ombudsman machinery. That’s faster and better-designed — an LLM-powered help layer will resolve more cases in an hour than the Ombudsman route does in a month — but it also means the payments operator is grading its own disputes. Automated chargeback processing in particular needs published service-level commitments and an escalation path that lands outside NPCI, or “automated” will eventually mean “automatically denied.” A consumer protection index for fintech — one of the Prime Minister’s own GFF asks ⁶ — would be a natural place to publish those numbers.

The cross-layer angle: Layer 2 absorbing Layer 6’s function — the dispute-resolution experiment that DPDP grievance officers and the telecom’s fraud-reporting flows should be watching closely.

5. The Border Week: Modi’s Mandate and the Singapore QR

Layer 2’s international week bookended the Fest. On September 8, the Prime Minister used the GFF stage to set direction: UPI’s next phase should connect with payment systems of countries with large Indian diasporas, high trade volumes, or willing partners — and India should stop being merely a user of payment technologies designed elsewhere, moving to setting its own rules and standards. ^{6 7} He framed the consumer prize precisely: Indians are the world’s largest remitters, a slice of every remittance evaporates as transaction cost, and UPI linkages can keep that money home while making it arrive faster. ⁷ UPI’s footprint now spans 11 countries, with the Singapore PayNow linkage the flagship — payments between the two countries, Modi said, can now happen almost like transactions between two cities. ^{6 20}

The execution followed a day later. NIPL, NPCI’s international arm, announced a partnership with Singapore payment institution FOMO Pay on September 9 to enable UPI QR acceptance across FOMO Pay’s merchant network — with Resorts World Sentosa, one of the country’s largest destinations, among the first merchants live, letting Indian visitors book and pay through its website with their home UPI apps. ^{21 22} The market logic is blunt: Singapore received 1.2 million Indian visitors in 2025, and every QR-enabled merchant is incremental spend captured without card interchange. ²¹

It’s worth being precise about what this is. QR acceptance through a local acquirer is not a bilateral linkage — the Indian tourist’s payment still travels as a UPI transaction into a local acquiring relationship, not as a PayNow-style account-to-account corridor. Acceptance scales fast (it’s a merchant-signing exercise) but serves only inbound tourists; remittance-cost reduction, the core of Modi’s pitch, needs the harder linkage work on the outbound side. The consumer watch-items for the year ahead: whether new corridors arrive with published FX markups (the UPI global rollout’s historical weakness) and whether the “transactions between two cities” framing survives contact with correspondent banking economics.

The cross-layer angle: Layer 2 expanding into Layer 4’s territory — trade and travel — and pulling Layer 1 (Aadhaar-linked VNeID-style verification debates aside, KYC and identity portability) into cross-border scope. Global UPI is DPI diplomacy with a checkout button.

The Week’s Ledger

Read together, the seven days describe a rail negotiating every parameter at once: price (MDR above ₹2,000, pending notification), operators (a registry for AI agents, with liability left deliberately to regulation), form (NFC tap, converging with the card experience just as Apple Pay arrives), recourse (MyUPI’s Safety Switch and automated chargebacks), and borders (Singapore QR acceptance, remittance mandate). What holds it together is ambition; what strains it is governance capacity. The MDR framework needs disclosure rules before fees, not after. The agent protocol needs liability allocation before grocery carts, not after the first disputed purchase. And the grievance layer needs an independent escalation path before “automated” becomes a euphemism. The rail earned its scale by being free, fast, and universal. The next decade gets decided by whether it can stay all three while learning to charge, to delegate, and to cross borders — and whether the consumer’s folding chair at that table comes with a say, or just a seat.