UPI New Rules 2026: What Every User Must Know Before Sending Money

Introduction

400 million users. Billions of transactions every month. And starting April 1, 2026 — a fundamentally different set of rules governing how every single rupee moves through India's most-used payment system.

The new UPI rules aren't a minor patch. They're a structural reset. The RBI and NPCI have spent the better part of two years watching fraud numbers climb, watching OTP-based systems get cracked by SIM-swap scams and phishing rings, and watching auto-debit mandates silently drain accounts without users even knowing. The response is here. It's comprehensive. And a lot of regular users are completely unaware it's happening tomorrow.

Here's everything that changed, what it means on the ground, and what users and merchants need to adjust.

The Biggest Shift: OTP Is No Longer Enough

This is the one that will actually affect daily habits.

From April 1, 2026, the Reserve Bank of India is making Two-Factor Authentication mandatory for all digital payments, including those made through UPI, debit and credit cards, and mobile wallets — meaning OTP alone will no longer be sufficient to complete a transaction. Users will now need at least two verification layers. A PIN, biometric, or device-bound token — plus something dynamic. Something generated fresh for each transaction.

Static credentials are the core problem. The new rule targets fraud linked to static credentials like UPI PINs and SMS OTPs. SMS OTP remains allowed but not alone. Banks and UPI apps must now layer in biometrics, secure in-app approvals, or additional checks for anything flagged as high-risk.

Not every transaction will feel the friction equally. The rules introduce a risk-based approach — low-risk payments involving small amounts on a known device may proceed quickly, while high-risk payments involving a new device or large amount will require extra verification. The goal is to avoid turning every ₹50 chai payment into a security interrogation. But the baseline has moved. Significantly.

Transactions Must Now Finish in 10 Seconds

Speed improvements were already in the works. But February 2026 locked them in.

Under the new regulations, UPI transactions and API responses must be completed within 10 seconds — reduced from the previous 30-second window, which often resulted in payments getting stuck or delayed. That stuck-payment problem was infuriating and common. Anyone who has stood at a counter watching a spinner circle while their UPI app hangs knows exactly what that felt like. That window just got three times tighter.

The backend logic behind this matters too. The API — which serves as the communication between the UPI app, the user's bank, and the recipient's bank — must now respond within that 10-second window, making the entire payment process smoother and faster, particularly during peak periods like sales or month-ends. 

Transaction Limits: What's Changed, What Hasn't

Limits are staying mostly stable. But the exceptions matter.

The standard UPI transaction limit for most users remains capped at ₹1 lakh per day, with a higher limit of ₹5 lakh per day permitted for payments to specific categories of verified merchants. Tax payments, travel bookings, and government subscriptions fall under the higher bracket.

Brand new UPI users face a tighter window. During the first 24 hours after registration, the total transaction limit is capped at ₹5,000, regardless of the standard limit set by the user's bank. That's a fraud-prevention measure. It catches bad actors trying to exploit freshly linked accounts before any behavioral pattern can form.

UPI 123Pay — the version designed for feature phones — now has a per-transaction limit of ₹10,000, doubled from the earlier ₹5,000 cap updated in October 2024. A small but meaningful upgrade for rural users still transacting on basic handsets.

One thing users often miss: NPCI sets the ceiling, but banks can set their own lower floors. Individual banks may impose lower internal limits, which users can typically view and, in some cases, modify within their banking app or by contacting the bank directly. The NPCI limit is the maximum possible. The user's actual limit may be lower.

The Auto-Debit Problem RBI Finally Addressed

This is the messy one. And it's been a long time coming.

AutoPay failure rates hit 55–90% in August 2025. Users didn't just lose money — they also lost subscriptions they actually wanted, due to silent payment failures with zero communication. No alert. No retry notification. Just a cancelled subscription and a confused user.

The mandate interoperability rule is the fix. The NPCI rolled out a mandate interoperability rule by October 2025 — UPI apps must now let users view all their active recurring mandates regardless of which app created them, and even port them between apps. Every UPI app must now include a dedicated "Manage Mandates" section. 

And regulators went further than just mandate visibility. The RBI's draft amendment explicitly bans deceptive UI/UX practices in banking apps, prohibiting patterns including subscription traps, hidden fees, false urgency, default add-ons, and complex cancellation flows. Dark patterns in fintech — that category of design tricks that lock users into recurring charges they never intended — are now a compliance issue, not just a consumer complaint.

Dormant UPI IDs Will Get Blocked

This one catches people off guard.

If a UPI ID has not been used for a long time, it may be temporarily set to dormant status. To reactivate it, the user will need to undergo re-verification. The intent is to prevent misuse of old, forgotten accounts — which have historically been exploited by fraudsters who gain access to a SIM card or old device.

Users who have multiple UPI IDs across different apps — especially ones tied to old phone numbers — should verify those accounts are active. Alternatively, accept that they'll hit a verification wall the next time they try to send money from a long-dormant ID.

Charges: What Costs Money and What Doesn't

A persistent rumor keeps circulating about GST on UPI transactions. Time to kill it clearly.

The Ministry of Finance has maintained a clear stance: the act of transferring money via UPI is not a taxable service. Standard peer-to-peer transfers remain free. Bank-to-bank UPI payments carry no interchange fee. Full stop.

Where charges do exist: for PPI transactions — payments made through digital wallets rather than direct bank accounts — interchange fees of up to 1.1% apply on transactions above ₹2,000, and these are borne by merchants, not consumers. Merchants using wallet-linked QR codes should be aware of this. The cleanest way to avoid it is to route transactions directly through bank-linked UPI rather than wallet-based flows.

UPI transactions are tax-free for users, though business receipts via UPI remain fully taxable and traceable. For merchants, every UPI receipt is a documented transaction. That traceability cuts both ways — it simplifies reconciliation but also closes the window on unreported revenue.

What's Coming by October 2026

The April 1 changes are the domestic layer. But the RBI is expanding the scope.

Card issuers have until October 1, 2026, to ensure all non-recurring, cross-border card-not-present transactions meet the same rigorous authentication benchmarks applied domestically. Indian travelers shopping on international websites will eventually face the same 2FA requirements they encounter at home. Full parity across domestic and international payments — that's where the RBI is heading by year-end.

The balance inquiry limit is also now in force. UPI users can now check their account balance only 50 times per app per day — a cap introduced to prevent repeated background queries that overload the system. After every successful transaction, apps display the updated balance automatically, reducing the need to manually refresh. For regular users, 50 checks per day is more than enough. For developers running automated payment flows, this is a hard constraint to build around.

For Merchants: The Backend Just Got Stricter

Payment platforms and merchants must adapt backend integrations to align with API capping and limit rules — refining error handling, retry logic, and monitoring of transaction status calls to remain within permitted thresholds. The new operational limits reduce server load and protect system stability during peak demand. But merchants running high-volume integrations need to audit their API call patterns now, not after April.

For selected verified categories — including tax payments, educational fees, and healthcare payments — higher limits up to ₹10 lakh per day may be allowed under the new UPI rules. Merchants in these categories should confirm verification status with their payment service provider.

Conclusion

UPI is currently used in eight countries and, according to the IMF, has become the world's largest real-time retail payment system. That scale comes with responsibility. The 2026 rule changes — 2FA, faster processing, mandate visibility, dormant account protocols — are the infrastructure catching up to the volume.

For the average user, the shift is mostly invisible until it isn't. The PIN-and-biometric flow will become second nature fast. The mandate management section in every UPI app will finally give users a way to see what's auto-debiting their accounts each month. And the fraud vectors that have plagued the system — SIM swaps, phishing, silent recurring charges — will become measurably harder to execute.

Starting tomorrow, UPI gets harder to exploit. Slightly more steps. Considerably more secure. That's the trade-off regulators made — and on balance, it's probably the right one.