NPCI tightens UPI API rules to boost resilience, fraud controls

By Vriti Gothi

In a move set to elevate the resilience and efficiency of India’s digital payments landscape, the National Payments Corporation of India (NPCI) has announced a major upgrade to the Unified Payments Interface (UPI) platform, effective 1 August 2025. These measures represent a critical milestone in NPCI’s ongoing digital transformation strategy, reinforcing UPI’s stature as the backbone of India’s rapidly expanding real-time payments infrastructure.

The enhancements focus on optimising technical reliability, strengthening fraud prevention, and advancing customer experience through smarter API management. Banks and payment service providers (PSPs) are now required to implement revised standards across key UPI functions, including balance enquiries, mandate execution, transaction verification, and account information retrieval. These changes follow an extensive analysis of user behaviour and transaction volume patterns across India’s financial ecosystem.

Under the updated framework, usage of UPI’s most-frequented APIs such as Balance Enquiry, List Account, and Transaction Status will now be governed by newly enforced thresholds and retry limits. For instance, users will be able to initiate a maximum of 50 balance enquiries and 25 account-list retrievals per UPI application in a rolling 24-hour period. Transaction status checks will be limited to three attempts per transaction with a mandatory 90-second interval between each, designed to mitigate excessive server load and improve overall system responsiveness.

AutoPay mandate executions will be permitted only within designated non-peak windows, including early mornings, mid-afternoon hours, and post-evening periods. Each mandate will be executed once per cycle, with a provision for up to three retries in the event of failure. If all attempts are unsuccessful, the mandate will be automatically cancelled. This refined scheduling protocol is intended to reduce processing strain during peak hours while offering predictable and transparent payment workflows for end users.

Another key update introduces a mandatory display of the recipient’s registered name and the transaction ID prior to transfer authorisation. This measure aims to reduce the risk of inadvertent or fraudulent payments by ensuring transaction clarity and intentionality.

These operational guidelines are underpinned by a firm compliance mandate. Entities that fail to integrate the updated standards risk facing API access restrictions or a freeze on new user onboarding. By introducing these enforcement mechanisms, NPCI seeks to harmonise performance and accountability across the ecosystem, ensuring all UPI participants adhere to shared service quality benchmarks.

These strategic changes are designed to deliver long-term benefits to both users and the wider industry. For customers, the upgraded system promises faster, more reliable transactions, fewer disruptions during high-volume periods, and heightened transparency during digital interactions. The clarified and limited retry protocols are expected to reduce failed transactions and improve trust in recurring payment arrangements. Furthermore, by curbing high-frequency queries and optimising backend processing, the system achieves greater scalability without compromising on speed or security.

For the industry, this represents a proactive shift toward future-readiness. With UPI transaction volumes continuing to climb crossing hundreds of millions per day the stability and efficiency of the infrastructure is paramount. These enhancements also reinforce India’s leadership in digital financial services, offering a model of robust, scalable payment design that is well-suited for international adoption and interoperable expansion, including for value-aligned financial models such as Shariah-compliant banking.