UPI rules: what changed in 2025 and what it means for startups

UPI, the Unified Payments Interface, is run by NPCI, an umbrella body for retail payments set up with the backing of the Reserve Bank of India (RBI). NPCI writes operating circulars that banks and apps such as PhonePe, Google Pay and Paytm must follow. RBI sets the wider payment rules under the Payment and Settlement Systems Act 2007.

Because NPCI works through circulars, the rules can change quickly and apply across every app at once. A startup that builds on UPI, as an app, a merchant platform or a payment aggregator, has to read each circular and adjust its product by the date given. The changes below are as of November 2026 and are summarised from news reports and the circulars they quote.

NPCI set caps on how often apps may use certain UPI functions, to reduce load on the system at busy hours. According to press coverage of the circular, a user could check a bank balance in one app at most 50 times a day, and apps were limited in how often they could view linked accounts and re-check the status of a pending payment. Coverage of the exact numbers for each function varies, so check NPCI's text before relying on a figure.

Autopay mandates, which collect recurring payments such as subscriptions and EMIs, were also moved away from peak hours. For a subscription startup, this means a recurring debit may land later in the day, so billing flows and retry logic need to allow for that.

• Balance checks: about 50 per app per day, as reported.
• Status checks on pending payments: limited and spaced out, as reported.
• Autopay debits: run outside peak windows.
• Apps must design screens so that users do not refresh again and again.

A collect request lets one person ask another for money, and the receiver approves it in the app. NPCI said in a circular dated 29 July 2025 that person-to-person (P2P) collect would not be processed after 1 October 2025. The reason given in news reports was fraud: scammers sent a request that looked like a refund, and victims approved it and lost money.

Pay requests that you start yourself, called push payments, are not affected. Collect for merchants is a different category. Businesses can still raise collect requests to customers in merchant flows, within NPCI's rules. A startup that built a bill-splitting or money-request feature on P2P collect had to move to other designs, such as payment links or QR codes.

The usual UPI limit for person-to-person transfers stayed at ₹1 lakh a day. For person-to-merchant (P2M) payments to verified merchants in some categories, NPCI raised limits from 15 September 2025. According to news reports, the categories included capital markets, insurance, travel, loan and EMI collections, credit card bill payments and a few others.

The reported limits were up to ₹5 lakh per transaction and up to ₹10 lakh in 24 hours for several of these categories. Banks and apps can set lower caps for their own users, so a customer may still hit a smaller limit. For fintechs in lending, insurance and investing, the change makes it practical to collect large premiums, instalments and investment amounts on UPI.

• P2P limit: unchanged at ₹1 lakh a day.
• P2M for selected verified merchants: up to ₹5 lakh per payment and ₹10 lakh a day, as reported.
• The limits are maximums; banks and apps may set lower ones.

An NPCI addendum dated 24 April 2025 told apps to show the recipient's bank-registered name before a payment is confirmed, not a nickname or a name typed by the user. Apps had to comply by 30 June 2025, according to the circular quoted in tax and legal websites. The rule covers P2P and person-to-merchant transfers.

The point is to reduce scams where a recipient's name is changed to look trusted. For app builders, it means removing any feature that edits the beneficiary name on the payment screen and relying on the name returned by the bank.

Founders in payments have to treat NPCI circulars as product requirements. Missing a deadline can lead to an app being restricted by its sponsor bank. Smaller fintechs usually reach UPI through a sponsor bank or a payment service provider, so the bank may add its own, stricter conditions.

Startups outside payments, such as e-commerce, travel or insurance companies, also feel the changes: autopay timing affects billing, higher P2M limits help large tickets, and the loss of P2P collect affects any product that sent payment requests between friends. The unit economics of UPI are covered in a separate guide on how UPI apps make money.

Two themes run through the 2025 circulars: keeping the network stable and cutting fraud. UPI handles a very large number of payments each day, and a spike in background calls, such as apps checking balances again and again, can slow the system for everyone. Caps on those calls spread the load more evenly.

The fraud theme explains the end of P2P collect and the bank-verified name rule. Scams that rely on tricking a person into approving a request, or on a recipient name that looks trustworthy, were a recurring problem. The circulars aim at the design of the apps, not at the user's behaviour, because a design that makes a mistake easy is a design that can be changed.

A practical response has four parts. First, keep a list of every NPCI circular that touches the product, with its date and the team that owns the change. Second, test the product under the new limits, including what the screen says when a payment fails because of a cap. Third, talk to the sponsor bank or payment service provider early, since their rules sit on top of NPCI's. Fourth, tell customers about changes that affect them, for example a new time for a subscription debit.

Smaller teams often learn about a rule from a news story. A better habit is to read the circular itself, since news summaries sometimes mix proposals with final rules, and numbers differ between outlets.

Rules named in news stories can be proposals, circulars or already live. Read which one it is, and who it applies to: apps, banks, merchants or users. A circular that says a limit is allowed does not force every bank to adopt it. Confirm the effective date in the circular itself.

This guide is general information and not legal advice. Check the latest NPCI circulars or ask a professional before changing a product.