NPCI Introduces New Guidelines for UPI Number-Based Transactions

The National Payments Corporation of India (NPCI) has announced significant changes to the framework governing UPI number-based payments. Effective April 1, 2025, these new regulations aim to enhance the security, transparency, and efficiency of digital transactions across various platforms such as Google Pay, Paytm, and PhonePe.

The updated guidelines, introduced through an addendum to NPCI’s earlier circular, outline crucial modifications in the management of UPI numbers. The primary focus is on reducing errors caused by mobile number recycling, ensuring explicit user consent for seeding or porting UPI numbers, and introducing standardized protocols for data updates. These changes are expected to streamline interoperability among banks, third-party payment providers (TPAPs), and users while preventing fraudulent transactions arising from outdated or reassigned mobile numbers.

Changes in UPI Number Management: Strengthening Transaction Integrity

The revised NPCI directive, issued under NPCI/UPI/OC-115E/2024-25, builds upon the previous guidelines established in 2021. These adjustments were formulated based on recommendations from the UPI Steering Committee meeting held in July 2024. One of the most significant aspects of the new framework is its emphasis on preventing transaction errors linked to mobile number churn, where a previously assigned number gets reassigned to a new user.

Under the new policy, banks and payment service provider (PSP) apps are mandated to regularly update their databases through the Mobile Number Revocation List (MINRL) or Digital Intelligence Platform (DIP). These updates must occur at least once a week to minimize errors arising from outdated user data. By implementing these regular refreshes, the NPCI aims to ensure that users no longer face failed or misdirected transactions due to mobile number changes.

Highlights:

Banks and PSP apps must update mobile number records at least once a week.
The Mobile Number Revocation List (MINRL) and Digital Intelligence Platform (DIP) will be used for updates.
The policy aims to minimize errors caused by mobile number churn.

User Consent for UPI Number Seeding: Enhancing Transparency

A crucial aspect of the new NPCI directive is the introduction of explicit consent mechanisms for UPI number seeding. Going forward, UPI apps must obtain a clear and affirmative opt-in from users before linking or porting their UPI numbers. This means users will now have the ability to control how their mobile numbers are associated with their UPI accounts, reducing the risk of unauthorized seeding.

To ensure a fair and transparent process, the consent mechanism must not include any pre-selected options. Users should be able to manually opt in if they wish to activate or transfer their UPI number. Furthermore, UPI apps are required to present this consent request in an easily understandable and non-intrusive manner, avoiding any misleading prompts that could pressure users into giving consent.

Highlights:

Users must manually opt in before their UPI number is linked or ported.
No pre-selected consent options are allowed in the UPI interface.
Apps must present consent requests in a non-intrusive and transparent manner.

Restrictions on Timing of Consent Collection: Preventing Unfair Practices

To safeguard users from being pressured into making hasty decisions, NPCI has also placed restrictions on when consent for UPI number seeding can be collected. Specifically, apps are prohibited from requesting consent before or during a transaction. This rule is designed to prevent instances where users might feel compelled to grant permission out of fear that their transaction could fail if they do not comply.

Additionally, all messaging related to seeding or porting UPI numbers must be clear and should not mislead users into thinking that their ability to receive payments is dependent on giving consent. This measure is expected to eliminate confusion and promote user confidence in managing their UPI accounts.

Highlights:

Apps cannot request consent before or during a transaction.
Messaging must not mislead users into believing consent is mandatory for payments.

Allowing Local UPI Number Resolution for PSP Apps

To further enhance the efficiency of UPI transactions, the NPCI has allowed PSP apps to resolve UPI numbers locally in cases where NPCI’s central resolution system experiences delays. This means that if a payment service provider encounters lag in retrieving UPI number details from NPCI’s servers, it can temporarily rely on its own local records to process the transaction.

However, PSP apps must report such instances on a monthly basis to ensure compliance and prevent any potential misuse. While this provision aims to improve transaction speed, the NPCI has emphasized that this local resolution should only be used as a backup mechanism in rare cases of system delays.

Highlights:

PSP apps can resolve UPI numbers locally in case of central system delays.
Apps must report such instances monthly to NPCI for compliance monitoring.

Compliance Deadline: Transition Period for UPI Members

All UPI member entities, including banks, PSP apps, and third-party providers, are required to fully implement these new guidelines by March 31, 2025. This deadline provides stakeholders with sufficient time to upgrade their systems and processes to align with NPCI’s directives.

The updated framework is expected to significantly enhance security, prevent fraudulent transactions, and improve user experience by reducing errors linked to outdated mobile numbers. Additionally, these changes reinforce user control over their UPI-linked numbers, ensuring transparency and fairness in digital payment operations.

Highlights: