UPI rules and operating guidelines continue to evolve as the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) introduce changes related to payment security, system reliability and fraud prevention. Some updates are already in effect, while others remain proposals or apply only to specific types of transactions.
This guide separates UPI changes that are already in effect from proposals and upcoming measures, so you can understand which rules currently apply and which changes may come later.
Last updated: September 5, 2026
✅ What's Already Active
Mandatory Two-Factor Authentication
RBI's authentication directions require applicable domestic digital payment transactions to use at least two distinct authentication factors, unless an exemption applies. At least one factor must be dynamically created or proven for applicable transactions. Payment System Providers and Participants were required to comply with these directions from April 1, 2026.
UPI Balance Enquiry Limits — Since August 1, 2025
NPCI introduced limits on certain high-frequency UPI API requests from August 1, 2025. For example, customers can make up to 50 balance enquiries per UPI app during a rolling 24-hour period. These requests should be customer-initiated, and UPI apps may limit or stop balance-enquiry requests when necessary to manage system load.
💰 Transaction Limits: What Changed, What Didn't
Cross-Border UPI Gets Restrictive
NPCI discontinued QR Share & Pay for international UPI Global P2M transactions from April 4, 2025. This means users cannot make international merchant payments using saved or shared QR codes through this method. Live QR scanning at participating international merchant locations remains supported, subject to the availability of UPI Global and the user's bank or UPI app.
🛡️ Fraud Compensation: The Change Most People Missed
Under the revised RBI framework, eligible customers with qualifying fraudulent electronic banking transaction losses of up to ₹50,000 may receive compensation of 85% of the net loss or ₹25,000, whichever is lower, subject to the stated conditions. The framework applies to qualifying transactions undertaken on or after January 1, 2027. To qualify under the framework, the customer must report the fraudulent electronic banking transaction to the bank and through the National Cyber Crime Reporting Portal or Cyber Crime Helpline 1930 within five calendar days.
📝 What's Still a Proposal (Not Yet Final)
Important: The items below should not be described as current UPI rules unless RBI or NPCI subsequently issues a final notification or direction bringing them into effect.
⏳ 1-Hour Delay for Transfers Above ₹10,000
Larger transfers wouldn't go through instantly — money would sit for up to an hour, giving victims time to catch and stop fraudulent transfers.
🔴 A "Kill Switch" for Digital Payments
One control to instantly freeze all payment channels (UPI, net banking, cards) if your phone is lost or SIM compromised — instead of contacting each institution separately.
📊 30% Market Share Cap
Would prevent any single third-party UPI app from dominating the ecosystem. Compliance deadline extended to December 31, 2026.
⚠️ None of these are confirmed as final rules yet. Treat any headline claiming they're "already in effect" with caution until RBI or NPCI issues formal confirmation.
🙋 What This Means for You
For the average user making routine UPI payments, day-to-day changes aren't significant. The new rules mostly operate behind the scenes — added security for risky transactions, controlled high-frequency API usage, and fraud accountability shifting to banks. The bigger shifts, like the proposed transfer delay and kill switch, would matter more — but they're not law yet.
Official Sources
Final Thoughts
Between what's already in place and what's still being discussed, it's easy to see why news about UPI rules feels overwhelming.
The safest approach: check directly with your bank or your UPI app's official updates, and treat anything described as "proposed" or "RBI discussion paper" as exactly that — not yet something to adjust your habits for.
Post a Comment