How Does UPI Work?
UPI is India's real-time, interoperable bank-to-bank payment layer, run by NPCI on top of IMPS rails. Here is what happens in a payment, who built it and how large it has become.
By Sushant Kataria· 6 min read
UPI is India's real-time, interoperable bank-to-bank payment layer, run by the National Payments Corporation of India on top of Immediate Payment Service (IMPS) rails. In plain terms, money moves from one bank account to another in seconds through a shared switch, using a Virtual Payment Address instead of raw account numbers, with a UPI PIN as the second factor.
That architecture is why a street stall and a metro ticket machine can take the same payment method as a bank's own app. The customer never has to know which bank sits behind the merchant's QR code.
Who runs it, and when it launched
The Unified Payments Interface is operated by the National Payments Corporation of India (NPCI), under the regulatory oversight of the Reserve Bank of India. A Ministry of Finance briefing describes UPI as a payment system authorised under the Payment and Settlement Systems Act, 2007. NPCI was set up as an initiative of the RBI and the Indian Banks' Association under that Act, to build shared retail payment infrastructure rather than leave every bank to invent its own closed loop.
A government note on UPI's decade records the launch sequence. UPI went live on a pilot in April 2016 with 21 member banks, then opened to the public in August 2016. A ten-year commemorative release dates that public launch to 25 August 2016 and notes the first public month handled about 90,000 transactions. The BHIM (Bharat Interface for Money) app followed in December 2016: a Lok Sabha reply dates the launch to 30 December 2016, around the DigiDhan Mela rollout.
What happens in a payment
A PIB overview of UPI's design is still the clearest official sketch of the customer experience. You do not share your account number and IFSC for everyday sends. You use a Virtual Payment Address (VPA), the familiar name@bank or name@handle string, or you scan a QR code that encodes the payee's details. Both payment (you push money) and collection (someone requests money) are possible, with no need to pre-add a beneficiary.
Under the hood, the path looks like this:
- You open a UPI app from any participating payment service provider (PSP): a bank app, BHIM or a third-party app linked to your bank account.
- You enter or scan the payee, amount and purpose. For a collect request, the payee's app has already asked your handle; your phone shows the request for approval.
- You confirm with your UPI PIN, the second factor that authorises the debit. Official materials describe UPI as using two-factor authentication and end-to-end encryption.
- Your PSP (the remitter side) sends the instruction to NPCI's UPI switch.
- NPCI routes it to the issuer bank (yours) and the acquirer or beneficiary bank (the payee's). The payer's app and the payee's bank need not be the same brand.
- The issuer bank debits; the beneficiary bank credits. To the customer, the money appears in real time, round the clock. The same PIB design note states that UPI works on the IMPS platform: the older Immediate Payment Service supplies the bank-to-bank messaging behind instant retail transfers.
- Banks settle among themselves after the switch clears the payment. Customers see an instant ledger change; interbank obligations are netted and settled in the background on the system's settlement cycles.
That split, instant customer experience on shared public rails, is why UPI feels like chat-app money while still moving ordinary bank deposits denominated in the rupee.
Collect, pay, QR and the product family
Pay requests are the everyday push: you initiate. Collect requests let a merchant or friend pull a confirmation from you. Merchants lean on static and dynamic QR codes; dynamic codes can carry the amount so the customer does not type it. Intent flows from commerce apps sit beside those stickers.
The product line has widened well beyond the 2016 core. RBI publications summarise the additions:
- UPI Lite holds a small on-device balance for low-value, PIN-light spends. An RBI press release raised the Lite wallet limit to ₹5,000 and the per-transaction limit to ₹1,000.
- UPI 123PAY brings feature phones in through IVR, missed-call, app and proximity-sound flows; the same release lifted its per-transaction limit to ₹10,000.
- RuPay credit cards on UPI let cardholders pay from a credit line through the same VPA and QR habits; RBI later allowed pre-sanctioned credit lines on the network as well.
- UPI AutoPay (e-mandates), extended to UPI in January 2020, covers recurring bills, subscriptions, SIPs and EMIs after an authenticated registration.
A Deputy Governor's speech also flags offline NFC payments (UPI Lite X). All of it rides the same switch and the same bank accounts.
Why users pay nothing (and the debate)
Person-to-merchant UPI has been free at the point of sale because of a deliberate zero Merchant Discount Rate (MDR) policy. A Cabinet note explains that since January 2020, MDR was made zero for RuPay debit cards and BHIM-UPI transactions through amendments tied to the Payments and Settlement Systems Act, 2007 and the Income-tax Act, 1961. The government has funded incentive schemes that reimburse banks and providers for low-value small-merchant P2M traffic, so the rails stay free for users while costs do not fall entirely on acquirers.
That bargain is contested. Banks and some fintechs argue that free P2M at massive scale squeezes the economics of the apps and acquiring banks that keep QR stickers everywhere. A PIB clarification on sustainability insists UPI will remain free for citizens' everyday transfers, while any future MDR would be limited and merchant-side.
Scale, concentration and safety
According to the ten-year PIB release citing NPCI, July 2026 set a monthly record of 2,366 crore transactions (23.66 billion) worth ₹29.88 lakh crore. For FY 2025–26, volume reached 24,162 crore transactions and value about ₹314 lakh crore. UPI's share of India's digital payments stood at 84% in that year. A companion Lok Sabha reply put onboarded users at 55.49 crore as of June 2026. P2M dominates volume (about 63%), while P2P still dominates value (about 71%): lots of tiny merchant taps, fewer but larger person-to-person sends.
App-level volume is concentrated. Third-party providers such as PhonePe and Google Pay sit on top of the common rails and handle a large share of what customers tap. An official PIB explainer described Google Pay as one of the three leading UPI apps(https://static.pib.gov.in/WriteReadData/specificdocs/documents/2022/nov/doc20221116125801.pdf). The RBI has separately stressed the need to minimise concentration risk in UPI, including by pushing multibank models for large third-party apps.
Abroad, NPCI International Payments Ltd. (NIPL), described in the July 2026 Lok Sabha reply as a wholly owned NPCI subsidiary from April 2020, partners with foreign systems. UPI is live for P2M or P2P corridors with partners in Bhutan, Singapore, the UAE, France, Mauritius, Sri Lanka, Nepal, Qatar, Greece and Cambodia, among others listed there. The UPI-PayNow linkage with Singapore, launched on 21 February 2023, is the flagship P2P remittance bridge, with a daily limit of ₹60,000 for permitted purposes. Those corridors ride the same kind of long-haul connectivity that moves the rest of the internet's traffic.
Safety is the other half of scale. Measures listed in the same Lok Sabha reply include risk-based transaction limits, checks against unauthorised mobile-number changes, and tighter app security frameworks. Practical habits still matter: never share your UPI PIN or OTP, treat unexpected collect requests as hostile, and verify a merchant QR before paying large amounts. The network moves rupees at phone speed; the PIN is what keeps those rupees yours.
UPI works because India built a public switch, forced interoperability and priced the consumer experience at zero while the banks still settle real money. The sticker on the cart is only the interface.