UPI has become the go-to payment method for millions of Indians, whether it is a ₹50 chai or a ₹5 lakh insurance premium. As usage has grown, so have the challenges around fraud prevention, system stability, and the cost of running such a massive payment network.
Through 2025 and 2026, the RBI and NPCI have rolled out a series of updates to address these issues. These include tighter operational guidelines, stronger authentication requirements, revised transaction limits, and most recently, the introduction of a 0.4% Merchant Discount Rate (MDR) on select merchant payments above ₹2,000, effective from October 15, 2026.
For everyday users, UPI remains free. The changes are designed to make the system safer and more sustainable in the long run without adding friction to routine payments.
This article covers all the key UPI rule changes, what they mean for individuals and merchants, and how the new MDR framework actually works.
New Rules For UPI Payments: Key Takeaways
- Starting in April 2026, UPI transactions will need to implement two-factor authentication that includes a minimum of one dynamic security measure.
- Daily UPI limits generally remain ₹1 lakh, with higher limits available only for select categories.
- UPI transactions are tax-free, but business receipts via UPI remain fully taxable and traceable.
- From October 15, 2026, a 0.4% MDR applies to select merchant transactions above ₹2,000, capped at ₹300 per transaction.
- UPI remains free for consumers, and all person-to-person transfers and small merchants under the P2PM category are exempt.
- Routine UPI payments stay simple, with extra checks mainly for high-value or risky transactions.
New UPI Payment Rules & Key Updates (2026)
Recent updates from the RBI and NPCI are mostly about making UPI safer, keeping the system stable, and making everyday usage smoother.
Along with the operational changes rolled out in 2025, here are the key updates that users and businesses should be aware of in 2026, including the recently announced MDR framework.
Mandatory Two-Factor Authentication For Digital Payments (From 1 April 2026)
RBI’s “Authentication Mechanisms for Digital Payment Transactions Directions, 2025” requires that from 1 April 2026, all domestic digital payments, including UPI, use two authentication factors from different categories.
These include a PIN, a registered device or token, or biometric identification, with at least one dynamic factor for every transaction.
The rule targets fraud linked to static credentials like UPI PINs and SMS OTPs. SMS OTP remains allowed but not alone. Banks and UPI apps must comply with UPI by adding biometrics, secure in-app approvals, and extra checks for high-risk payments.
Extension Of The UPI Market Share Cap To December 31, 2026
NPCI proposed a rule capping any single third-party UPI app at 30 percent of total transaction volume to reduce concentration risk and promote competition.
The goal was to prevent UPI usage from being dominated by a few large platforms and give smaller apps room to grow. The compliance deadline has now been extended to 31 December 2026, giving the industry more time to adapt.
This benefits market leaders like PhonePe and Google Pay while supporting ecosystem stability and allowing smaller UPI apps a longer runway to scale.
International UPI QR Rule Changes
From April 2025, NPCI changed how international UPI payments work by removing the option to pay using saved or shared QR codes outside India.
If you’re paying abroad, the QR now has to be scanned live, in person. This move is mainly about tightening security and cutting down misuse.
While it’s not a 2026-only rule, it gives a clear hint of how NPCI plans to handle UPI’s global expansion, with fraud prevention taking priority as more countries come on board.
Emerging Platform Enhancements
While not formal regulatory rules, several product evolutions are aligned with NPCI goals and expected to mature in 2026:
- UPI Payment New Rules: NPCI continues to expand UPI AutoPay capabilities, including more flexible mandate management, aggregated views, and linked subscription handling.
- AI-Powered UPI Assistants & Grievance Tools: AI assistants like UPI HELP have been piloted to support user queries, complaints, and subscription management within UPI apps. This is expected to become more integrated through 2026.
- IoT & Multi-Device UPI Integrations: Pilot initiatives for UPI on Internet of Things devices and for joint accounts suggest future-proofing the platform. These are not regulatory rules but reflect NPCI’s innovation roadmap.
UPI Operational Guidelines (August 1, 2025)
NPCI, along with the RBI, has introduced tighter operational standards, improved system stability, and stronger user protection measures.
The guidelines are as follows:
1. Daily Limit on Balance Checks
UPI users can now check their account balance only 50 times per app per day. This limit prevents repeated background queries that overload the system.
After every successful transaction, apps display the updated balance, reducing the need for multiple manual checks and keeping information current.
2. Limit on Viewing Linked Bank Accounts
You can request the list of bank accounts linked to your UPI ID only 25 times per app per day. Excessive attempts may temporarily block further requests to prevent system strain.
If the list does not load, you must confirm before retrying, ensuring smoother operation and fewer unnecessary server requests.
3. AutoPay / Recurring Payment Restrictions
Scheduled payments like subscriptions or EMIs are allowed only in non-peak hours: before 10:00 AM, 1:00 PM–5:00 PM, and after 9:30 PM. This reduces server congestion during busy periods.
Each recurring payment can attempt once initially and retry up to three times if it fails, ensuring payments are completed without overwhelming the network.
4. Limits on Checking Transaction Status
If a transaction is pending, you can check its status three times with a gap of about 90 seconds between each attempt. This prevents repeated queries from overloading UPI servers.
The limit ensures apps update users efficiently while maintaining smooth performance for all transactions, avoiding delays or system crashes.
5. Recipient Bank Name Display
Before confirming any payment, UPI apps must show the recipient’s bank name. This step reduces the chances of sending money to the wrong account.
By verifying the bank along with the account number, users gain confidence, and errors in transfers are minimized, improving transaction security.
6. Compliance & Penalties
UPI apps and banks must implement all the new rules or face penalties, API access restrictions, and onboarding limits for new users.
This ensures all participants follow NPCI guidelines consistently, maintaining system reliability and protecting users from service disruptions.
Daily Transaction Limits
This table outlines the revised UPI transaction limits for specific categories as notified by NPCI, highlighting the per-transaction and daily caps applicable from 15 September 2025.
| Category | Enhanced Limit | Cumulative Limit (24 Hours) |
|---|---|---|
| Capital Markets | ₹5 lakh | ₹10 lakh |
| Insurance | ₹5 lakh | ₹10 lakh |
| Government e-Marketplace (EMD / Tax Payments) | ₹5 lakh | ₹10 lakh |
| Travel | ₹5 lakh | ₹10 lakh |
| Credit Card Payments | ₹5 lakh | ₹6 lakh |
| Business/Merchant | ₹5 lakh | NAAA |
| Collections | ₹5 lakh | ₹10 lakh |
| Jewellery | ₹2 lakh | ₹6 lakh |
| FX-Retail with BBPS | ₹5 lakh | ₹5 lakh |
| Digital Account Opening for Term Deposit | ₹5 lakh | ₹5 lakh |
| Digital Account Opening – Initial Funding | ₹2 lakh | ₹2 lakh |
Note: Daily UPI transaction limits are determined by individual banks within the UPI network and may vary from one bank to another based on internal risk and policy controls. Generally, for major banks such as HDFC Bank, Axis Bank, etc., it is ₹1 lakh.
Transaction Charges and Surcharge / Interchange Fee
UPI remains completely free for consumers. Whether you are transferring money to a friend, paying a shopkeeper, or settling a bill at a restaurant, you will not be charged anything for using UPI.
For merchants, the picture has changed. Until September 2026, bank-linked UPI payments carried no processing charges for merchants either, with the only exception being wallet-based UPI transactions, where interchange fees of 0.5% to 1.1% applied at the merchant level.
However, from October 15, 2026, NPCI has introduced a Merchant Discount Rate (MDR) of 0.4% on select Person-to-Merchant (P2M) UPI transactions above ₹2,000. This is a processing fee deducted from the merchant’s settlement amount. The customer continues to pay only the listed price, and merchants are not permitted to pass this cost on to buyers.
For transactions of ₹75,000 or more, the MDR is capped at ₹300 per transaction, regardless of the payment amount. Small merchants under the P2PM category receiving up to ₹1 lakh per month through UPI QR codes remain fully exempt from MDR.
Certain categories also attract concessional rates. Railways, telecom, insurance, fuel, and utility transactions above ₹2,000 pay a flat ₹5 per transaction instead of 0.4%. Capital market payments are charged at 0.02%, also capped at ₹300. UPI AutoPay mandates carry no MDR at all.
The interchange fees on wallet-based UPI payments continue to apply separately, as before.
Source: NPCI FAQs
Impact of New UPI Rules On Individual Users and Merchants
The updated UPI rules affect how payments are authorised, processed, and monitored.
While everyday usage remains largely unchanged, both users and merchants will notice differences in security, limits, and compliance over time.
Let’s have a look at how these might affect or not affect them.
Impact On Individual Users
For individual users, the new UPI rules are designed to strengthen security without disrupting everyday payment habits.
- Routine, low-value UPI payments will continue to work as usual with minimal friction.
- New UPI registrations or device changes may trigger temporary limits during a short cooling period.
- From 2026, transactions may require additional authentication, such as biometrics or secure in-app approval.
- High-value or unusual payments may face extra verification steps based on risk assessment.
- Overall fraud risk is reduced, particularly against SIM-swap attacks, phishing, and unauthorized access.
Impact On Merchants and Businesses
For merchants and businesses, the updated rules focus on improving reliability, payment clarity, and regulatory compliance.
- Higher category-based UPI limits allow smoother handling of large-value customer payments.
- Merchants receiving P2M payments above ₹2,000 will need to account for the new 0.4% MDR in their payment-processing costs from October 2026 onwards. Small merchants under the P2PM framework are exempt.
- Improved operational guidelines reduce transaction failures and settlement inconsistencies.
- Stronger authentication lowers disputed transactions and improves payment traceability.
- Clearer audit trails make reconciliation and compliance easier during tax and GST reviews.
- Businesses must continue to treat all UPI receipts as business income and meet GST obligations.
- Merchants should also review settlement reports regularly, as the MDR will be deducted at the settlement level rather than being billed separately.
Related Reads:
Conclusion: New UPI Rules Focus More On The Security Of Users
The UPI rule changes through 2025 and 2026 are focused on two things: making the system safer and making it financially sustainable for the long run.
For most users, everyday payments will continue to feel exactly the same. The additional security layers are designed to catch fraud, not slow you down. Person-to-person transfers remain free at all values, and over 95% of merchant transactions fall below the ₹2,000 MDR threshold, so they stay free too.
For merchants handling higher-value payments, the 0.4% MDR is a new cost to factor in, but it is significantly lower than credit card processing fees, and small merchants are fully protected through exemptions.
FAQs
Not really. Extra steps usually show up only for big or unusual transactions where added security is needed.
SMS OTP isn’t going away. It just can’t be the only security step anymore and will be used along with another method, like biometrics or app approval.
Using UPI doesn’t create any tax by itself. But if the money you receive is income or business revenue, it’s taxable.
Not for every payment. From October 15, 2026, merchants accepting P2M UPI payments above ₹2,000 will bear a 0.4% MDR on select transactions, with a cap of ₹300 per transaction. Payments up to ₹2,000 remain free, and small merchants under the P2PM category receiving up to ₹1 lakh per month are fully exempt.
NPCI sets the overall rules, but banks decide their own limits, so the daily cap can differ depending on which bank your UPI account is linked to.
