DPI Brief — October 10, 2026

Coverage window: 9 October 2026, 08:00–10 October 2026, 08:00 IST.

The most consequential signal today is a CERT-In warning about payment and lending firms’ back-end controls, not a reported compromise of UPI itself. Elsewhere, a proposed UPI merchant fee remains unresolved, TRAI has opened a consultation on a broadcast-system audit manual, and Maharashtra’s postal circle has published a new snapshot of its financial-inclusion services. Several other DPI layers had no fresh dated official notice in the sources checked.

1. CERT-In flags attacks on lending and payment intermediaries

In an advisory dated 9 October, CERT-In/CSIRT-Fin described campaigns targeting NBFCs, digital lenders, fintech firms, payment service providers and wallet operators. It says attackers have compromised exposed applications or APIs, obtained payment-gateway or partner-bank credentials, and initiated disbursals directly—bypassing checks normally applied during loan creation, KYC, beneficiary verification and transaction-limit enforcement. CERT-In also describes fraudulent transfers through IMPS/NEFT and funds reaching mule accounts.

The distinction matters: the advisory does not say UPI has been breached. It points to failures in the financial firms and service integrations around lending and payouts. CERT-In’s defensive recommendations include MFA, session-based API authentication, eliminating long-lived static tokens, a second approval for fund movement, payout checks against approved records, and real-time monitoring and reconciliation. These are controls for providers, not steps that customers can take to secure a compromised back end.

2. UPI MDR decision remains unsettled

NPCI’s MDR FAQ describes a 0.4% rate on eligible person-to-merchant UPI transactions above ₹2,000, capped at ₹300 for transactions of ₹75,000 or more. The published rollout date has been 15 October. On 9 October, Moneycontrol reported that the UPI Steering Committee meeting called to consider a requested deferment did not take place, citing two sources; it reported no decision on a revised date.

That report is not an NPCI circular. No official change to the published date was located by this brief’s cutoff, so a January 2027 shift should not be treated as confirmed—and the fee should not be described as applying to every UPI payment. Merchants should rely on a formal NPCI notice for any change in eligibility, rates or timing.

3. TRAI opens a draft audit-manual consultation

TRAI published a draft audit manual for DRM-based digital addressable systems on 9 October, with comments due by 30 October. The consultation concerns audit procedures for broadcasting and cable services, rather than Aadhaar or UPI. It is nevertheless a trust-and-accountability item: clear audit procedures can make it easier to test whether digital subscriber-management and access-control systems follow the applicable rules. This is a draft, not an adopted standard. Interested stakeholders can review the draft and submit comments through TRAI’s consultation page.

4. Maharashtra Post publishes a local inclusion snapshot

A PIB release on Maharashtra Circle’s National Postal Week, posted on 9 October, reports 1.92 crore India Post Payments Bank accounts and 1.14 crore direct-benefit-transfer beneficiaries. It also reports 8.37 lakh Aadhaar enrolments and updates. The figures are for Maharashtra Circle, measured as of 30 September 2026 or during FY 2026–27 to that date—not national totals. The release describes a service bundle using Aadhaar e-KYC, UPI, AePS and DBT through postal and doorstep banking. These are reported reach measures; they do not by themselves show how frequently accounts are used or whether transfers arrive without errors.

Seven-layer scan

  • L1 Identity: No new UIDAI notice verified; Maharashtra Post reported circle-level Aadhaar enrolments and updates.
  • L2 Payments: No official NPCI revision to the MDR schedule located; the reported committee meeting did not yield a confirmed decision.
  • L3 Documents: No fresh DigiLocker, eSign or API Setu release verified.
  • L4 Commerce: No new ONDC or GeM notice verified.
  • L5 Sectoral: No new ABDM/ABHA or AgriStack notice verified.
  • L6 Governance: No fresh CPGRAMS or eOffice update verified.
  • L7 Trust: CERT-In/CSIRT-Fin’s financial-sector warning and TRAI’s open consultation are the clearest dated developments.

Watch next: an official NPCI circular before 15 October; whether financial firms act on CERT-In’s payout and API controls; and comments or a final version of TRAI’s manual after the 30 October deadline.