Earlier this month, the Mega Unified Payments Interface (UPI) after the outage, which stuck millions of users, the National Payments Corporation of India (NPCI) has issued a circular to banks to deal with the future crisis.

The NPCI has asked banks to ensure that all API requests sent to UPI should be monitored and moderated in terms of proper use, stating that banks will start the first check transaction status API after 90 seconds from the introduction/authentication of the bank.

View 9-Autriya Guidelines issued by NPCI

1. PSP Bank/Acquisition Banks will ensure that all API requests sent to UPI are monitored and moderated in terms of proper use, for example. Restricting the high number of API to be repeated for similar transactions or old transactions etc.

2. PSP Bank/Acquisition Banks will ensure that the UPI does not have a batch processing of any non-financial API sent to the online system (by processing the file and converting to online request on high TPS).

3. PSP Bank/Acquisition Bank will start the first check transaction status API after 90 seconds from the introduction/certification of the original transaction. After changing the timer (reference UPI OC 214, dated 26 April, 2025), members can start it after 45 to 60 seconds after the revised communication of members NPCI.

4. PSP Bank/Acquisition Banks can initiate maximum 3 check transactions API, preferably within 2 hours from the introduction/authentication of original transactions.

5. Next, in the case of U48 error (transaction ID is not available or UPI system) within two 2 hours before the start of the original transaction, then the PSP bank / acquired bank will refer to NPCI settlement files (available for payment, payers or PSP banks) after completion of bank disposal cycle, alternatives will refer to the maximum dispute on UDIR (ADR). Status API can initiate which in turn checks the URCs (UPI backoffies) to achieve the final disposal status of the transaction.

6. PSP bank / acquisition banks, if they receive any error from the list mentioned in Annex 1, will consider the transaction as a failure and do not start further check transactions API.

7. PSP banks / acquired banks will audit their system by certificate panel auditor to review the use and existing system behavior, immediately and then on an annual basis.

8. The sender bank/PSP will have visibility on specific UPI APIs and will be responsible for it regularly.

9. In consultation with the NPCI Steering Committee, the selected UPI may also consider implementing the rate limit on API and is subject to other approval in the appointed time.

Digital payments through UPI were disrupted across the country on 12 April, affected by millions of users, local purchases, bill payments and business transactions were interrupted. Major banking apps such as SBI, ICICI and HDFC were also affected, which indicates a comprehensive problem within the UPI Network Infrastructure.