UPI has emerged as the primary method for many individuals in India to make payments, ranging from grocery purchases to business transactions.
With the rise in usage, concerns regarding fraud, limits, and system strain have also intensified.
To address this, the RBI and NPCI have implemented a set of new UPI regulations, with some currently in force and others set to be effective in 2026.
These modifications are not intended to interfere with everyday transactions, but rather to enhance the safety and reliability of the system.
This article outlines the changes happening and their implications for users and merchants.
New Rules For UPI Payments: Key Takeaways
- Starting in April 2026, UPI transactions will need to implement two-factor authentication that includes a minimum of one dynamic security measure.
- Daily UPI limits generally remain ₹1 lakh, with higher limits available only for select categories.
- UPI transactions are tax-free, but business receipts via UPI remain fully taxable and traceable.
- UPI is costless for users, although merchants incur interchange fees for wallet-based UPI transactions.
- Routine UPI payments stay simple, with extra checks mainly for high-value or risky transactions.
New UPI Payment Rules & Key Updates (2026)
Recent updates from the RBI and NPCI are mostly about making UPI safer, keeping the system stable, and making everyday usage smoother.
Along with the operational changes already rolled out in 2025, these are the key things users and businesses should be aware of as 2026 approaches.
Mandatory Two-Factor Authentication For Digital Payments (From 1 April 2026)
RBI’s “Authentication Mechanisms for Digital Payment Transactions Directions, 2025” requires that from 1 April 2026, all domestic digital payments, including UPI, use two authentication factors from different categories.
These include a PIN, a registered device or token, or biometric identification, with at least one dynamic factor for every transaction.
The rule targets fraud linked to static credentials like UPI PINs and SMS OTPs. SMS OTP remains allowed but not alone. Banks and UPI apps must comply with UPI by adding biometrics, secure in-app approvals, and extra checks for high-risk payments.
Extension Of The UPI Market Share Cap To December 31, 2026
NPCI proposed a rule capping any single third-party UPI app at 30 percent of total transaction volume to reduce concentration risk and promote competition.
The goal was to prevent UPI usage from being dominated by a few large platforms and give smaller apps room to grow. The compliance deadline has now been extended to 31 December 2026, giving the industry more time to adapt.
This benefits market leaders like PhonePe and Google Pay while supporting ecosystem stability and allowing smaller UPI apps a longer runway to scale.
International UPI QR Rule Changes
From April 2025, NPCI changed how international UPI payments work by removing the option to pay using saved or shared QR codes outside India.
If you’re paying abroad, the QR now has to be scanned live, in person. This move is mainly about tightening security and cutting down misuse.
While it’s not a 2026-only rule, it gives a clear hint of how NPCI plans to handle UPI’s global expansion, with fraud prevention taking priority as more countries come on board.
Emerging Platform Enhancements
While not formal regulatory rules, several product evolutions are aligned with NPCI goals and expected to mature in 2026:
- UPI Payment New Rules: NPCI continues to expand UPI AutoPay capabilities, including more flexible mandate management, aggregated views, and linked subscription handling.
- AI-Powered UPI Assistants & Grievance Tools: AI assistants like UPI HELP have been piloted to support user queries, complaints, and subscription management within UPI apps. This is expected to become more integrated through 2026.
- IoT & Multi-Device UPI Integrations: Pilot initiatives for UPI on Internet of Things devices and for joint accounts suggest future-proofing the platform. These are not regulatory rules but reflect NPCI’s innovation roadmap.
UPI Operational Guidelines (August 1, 2025)
NPCI, along with the RBI, has introduced tighter operational standards, improved system stability, and stronger user protection measures.
The guidelines are as follows:
1. Daily Limit on Balance Checks
UPI users can now check their account balance only 50 times per app per day. This limit prevents repeated background queries that overload the system.
After every successful transaction, apps display the updated balance, reducing the need for multiple manual checks and keeping information current.
2. Limit on Viewing Linked Bank Accounts
You can request the list of bank accounts linked to your UPI ID only 25 times per app per day. Excessive attempts may temporarily block further requests to prevent system strain.
If the list does not load, you must confirm before retrying, ensuring smoother operation and fewer unnecessary server requests.
3. AutoPay / Recurring Payment Restrictions
Scheduled payments like subscriptions or EMIs are allowed only in non-peak hours: before 10:00 AM, 1:00 PM–5:00 PM, and after 9:30 PM. This reduces server congestion during busy periods.
Each recurring payment can attempt once initially and retry up to three times if it fails, ensuring payments are completed without overwhelming the network.
4. Limits on Checking Transaction Status
If a transaction is pending, you can check its status three times with a gap of about 90 seconds between each attempt. This prevents repeated queries from overloading UPI servers.
The limit ensures apps update users efficiently while maintaining smooth performance for all transactions, avoiding delays or system crashes.
5. Recipient Bank Name Display
Before confirming any payment, UPI apps must show the recipient’s bank name. This step reduces the chances of sending money to the wrong account.
By verifying the bank along with the account number, users gain confidence ,and errors in transfers are minimized, improving transaction security.
6. Compliance & Penalties
UPI apps and banks must implement all the new rules or face penalties, API access restrictions, and onboarding limits for new users.
This ensures all participants follow NPCI guidelines consistently, maintaining system reliability and protecting users from service disruptions.
Daily Transaction Limits
This table outlines the revised UPI transaction limits for specific categories as notified by NPCI, highlighting the per-transaction and daily caps applicable from 15 September 2025.
| Category | Enhanced Limit | Cumulative Limit (24 Hours) |
|---|---|---|
| Capital Markets | ₹5 lakh | ₹10 lakh |
| Insurance | ₹5 lakh | ₹10 lakh |
| Government e-Marketplace (EMD / Tax Payments) | ₹5 lakh | ₹10 lakh |
| Travel | ₹5 lakh | ₹10 lakh |
| Credit Card Payments | ₹5 lakh | ₹6 lakh |
| Business/Merchant | ₹5 lakh | NAAA |
| Collections | ₹5 lakh | ₹10 lakh |
| Jewellery | ₹2 lakh | ₹6 lakh |
| FX-Retail with BBPS | ₹5 lakh | ₹5 lakh |
| Digital Account Opening for Term Deposit | ₹5 lakh | ₹5 lakh |
| Digital Account Opening – Initial Funding | ₹2 lakh | ₹2 lakh |
Note: Daily UPI transaction limits are determined by individual banks within the UPI network and may vary from one bank to another based on internal risk and policy controls. Generally, for major banks such as HDFC Bank, Axis Bank, etc., it is ₹1 lakh.
Transaction Charges and Surcharge / Interchange Fee
UPI transactions remain free for customers, with no charges or surcharges on peer-to-peer or merchant payments. However, when UPI payments are made through prepaid payment instruments such as wallets, interchange fees apply at the merchant level.
The interchange fee is similar in concept to the merchant discount rate used in card payments and is meant to cover the costs of processing, authorising, and settling transactions. In such cases, the fee is paid by the merchant to the payment service provider.
For example, when a customer pays via UPI using a wallet through a PhonePe QR code, the merchant bears the interchange fee payable to the service provider.
The applicable interchange rates typically range between 0.5 percent and 1.1 percent, depending on the type of service.
Impact of New UPI Rules On Individual Users and Merchants
The updated UPI rules affect how payments are authorised, processed, and monitored.
While everyday usage remains largely unchanged, both users and merchants will notice differences in security, limits, and compliance over time.
Let’s have a look at how these might affect or not affect them.
Impact On Individual Users
For individual users, the new UPI rules are designed to strengthen security without disrupting everyday payment habits.
- Routine, low-value UPI payments will continue to work as usual with minimal friction.
- New UPI registrations or device changes may trigger temporary limits during a short cooling period.
- From 2026, transactions may require additional authentication, such as biometrics or secure in-app approval.
- High-value or unusual payments may face extra verification steps based on risk assessment.
- Overall fraud risk is reduced, particularly against SIM-swap attacks, phishing, and unauthorized access.
Impact On Merchants and Businesses
For merchants and businesses, the updated rules focus on improving reliability, payment clarity, and regulatory compliance.
- Higher category-based UPI limits allow smoother handling of large-value customer payments.
- Improved operational guidelines reduce transaction failures and settlement inconsistencies.
- Stronger authentication lowers disputed transactions and improves payment traceability.
- Clearer audit trails make reconciliation and compliance easier during tax and GST reviews.
- Businesses must continue to treat all UPI receipts as business income and meet GST obligations.
Related Reads:
Conclusion: New UPI Rules Focus More On The Security Of Users
The new UPI rules are really about tightening the system without breaking what already works. For most people, day-to-day payments will feel the same, just safer in the background.
The extra security is meant to stop fraud, not slow you down. For businesses, the rules bring more clarity, better reliability, and fewer grey areas around compliance.
Overall, UPI is moving from rapid growth to long-term stability, and that’s a good thing for everyone using it daily.
FAQs
Not really. Extra steps usually show up only for big or unusual transactions where added security is needed.
SMS OTP isn’t going away. It just can’t be the only security step anymore and will be used along with another method, like biometrics or app approval.
Using UPI doesn’t create any tax by itself. But if the money you receive is income or business revenue, it’s taxable.
No. Normal bank-linked UPI payments are still free. Charges apply only when customers pay through UPI wallets, and even then, the fee is paid by the merchant, not the customer.
NPCI sets the overall rules, but banks decide their own limits, so the daily cap can differ depending on which bank your UPI account is linked to.
