UPI Rules 2026: What RBI and NPCI Changed

UPI Rules 2026 in 30 Seconds

The latest UPI change is NPCI's increase in the on-device biometric payment approval limit from ₹5,000 to ₹10,000 per transaction from August 7, 2026. It does not raise the standard person-to-person UPI limit, does not make biometrics compulsory, and does not remove the UPI PIN. UPI rules do not come from one document or one authority. That distinction matters when a headline says the “RBI has changed the UPI limit” or “NPCI has introduced a new RBI rule”.

The Reserve Bank of India sets the regulatory framework for payment systems. Its rules cover matters such as payment authentication, recurring payments, customer protection, bank responsibilities and payment security. NPCI operates UPI and issues UPI-specific operating instructions to banks and payment apps. UPI itself was launched by NPCI in April 2016 under RBI's regulatory oversight.

This means a change in how a UPI transaction is approved may involve both bodies. RBI can set the principle that digital payments must use two separate forms of authentication, while NPCI can define how fingerprint or face authentication works inside UPI.

UPI Rules 2026: What Changed?

NPCI issued circular OC-226A on July 3, 2026, increasing the amount that can be authorised through on-device fingerprint or facial recognition from ₹5,000 to ₹10,000 per transaction.

The new ceiling came into effect on August 7, 2026.

This is the newest confirmed consumer-facing UPI limit change as of August 8.

The distinction is important. NPCI did not say that all UPI payments are now capped at ₹10,000. It changed only the amount for which a user may approve the transaction using on-device biometrics instead of entering a UPI PIN.

A payment above ₹10,000 is not automatically blocked. The applicable UPI transaction limit still depends on the payment type, while the payment may have to be authenticated through another permitted method.

The July circular also says that existing checks, compliance requirements and regulatory instructions remain applicable.

UPI business model and payment infrastructure: The Hidden Winners of India's UPI Boom Are Not the Payment Apps

UPI Rules 2026 at a Glance

NPCI first introduced on-device biometric authentication for UPI in October 2025.

New ₹10,000 Biometric UPI Rule

The rules go beyond changing ₹5,000 to ₹10,000.

NPCI's original October 2025 framework requires banks and UPI apps to obtain explicit customer consent before enabling biometric payment approval. A customer must also be able to opt out.

The framework also provides that:

1. Fingerprint or face authentication on the phone can be offered instead of the UPI PIN for eligible transactions.
2. A bank must check whether the customer is eligible before enabling the facility.
3. Apps must run device and security checks.
4. Rooted or jail-broken devices are to be restricted.
5. Fresh consent must be taken after the account is bound to a device again.
6. If a UPI PIN is changed or reset, biometric payment approval is disabled across UPI apps for that account until fresh consent is obtained.
7. If no biometric UPI transaction takes place for 90 days, the method is to be marked inactive and requires customer confirmation before being activated again.

NPCI also introduced UIDAI face authentication as an additional option for setting or resetting a UPI PIN, instead of relying only on debit card credentials or Aadhaar OTP.

Practical impact

For a user who has enabled the facility, a ₹7,000 grocery, fuel, retail or other eligible UPI payment may now be approved with the phone's supported biometric method if the bank and app have implemented the feature.

Before August 7, the same biometric route was limited to ₹5,000.

Availability can still differ between banks and apps because implementation depends on the participating bank, payment app, device and customer eligibility under the NPCI framework.

Why NPCI increased the limit: Biometric UPI crossed 611 million transactions

The limit increase did not arrive before adoption.

NPCI's press release index says biometric-authenticated UPI transactions, including RuPay Credit Card on UPI payments, crossed 600 million transactions in June 2026.

Data reported from NPCI puts the June figure at more than 611 million transactions worth ₹25,416 crore.

News4Bharat calculations based on those figures show:

• Average biometric transaction value was about ₹416.
• Biometric-authenticated transactions were about 2.7% of June's total UPI transaction count.

The second figure is a News4Bharat ratio estimate using NPCI's June total of 22.716 billion UPI transactions and the separately published 611 million biometric count. It should not be read as an NPCI-reported market share.

The ₹416 average is also relevant. It suggests that biometric UPI is being used mainly in the low-value segment even after the number of transactions crossed 600 million.

Latest RBI rule: Two security checks remain compulsory for covered digital payments

Another source of confusion concerns OTPs, UPI PINs and biometric authentication.

RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 became applicable from April 1, 2026.

The directions require covered digital payment transactions to use at least two distinct forms of authentication, except where RBI has provided an exemption.

RBI divides these forms into three broad groups:

• something the user knows, such as a PIN or password
• something the user has, such as a device, card or software token
• something the user is, such as a fingerprint or another biometric

At least one authentication factor for a digital payment other than a physical card transaction must be created or proved specifically for that transaction.

Did RBI ban SMS OTP?

No.

RBI has not banned OTPs.

The 2025 directions explicitly list SMS OTP among the permitted authentication methods. What RBI changed was the framework. Banks are no longer tied to dependence on SMS OTP as the only practical second method. They can use PINs, biometrics, tokens and other permitted options, provided the minimum requirements are met.

Can banks ask for another check even after two checks are completed?

Yes.

RBI allows the institution handling the customer's account to add more checks based on factors such as transaction location, device information, payment history and user behaviour if the transaction appears to carry higher fraud risk.

There is also a customer protection provision. RBI says that if a loss occurs from a transaction processed without complying with these authentication directions, the issuer must compensate the customer for the loss.

UPI AutoPay rules in 2026: What changed for recurring payments

Recurring UPI payments now sit under two connected frameworks.

RBI sets the rules for recurring digital debits. NPCI sets the UPI-specific process for managing those mandates.

RBI's 2026 e-mandate framework

On April 21, 2026, RBI issued the Digital Payments E-mandate Framework, 2026, bringing its earlier recurring-payment circulars into one document. It covers recurring payments through UPI, cards and prepaid payment instruments.

Under the framework:

• setting up a mandate requires an additional authentication check
• changing or withdrawing a mandate requires authentication
• the first transaction requires authentication
• customers must normally receive a notice at least 24 hours before the debit
• the notice must include the merchant, amount, debit date and mandate reference
• customers must have an option to stop a transaction or withdraw the mandate
• post-payment alerts must provide complaint information
• no customer charge can be imposed for using the e-mandate facility

FASTag and National Common Mobility Card balance replenishment are exempt from the 24-hour advance notice requirement.

UPI recipient-name and payment-safety rule: NPCI UPI Verified Name Update: What Users and Merchants Should Know

When can a recurring payment happen without another authentication check?

RBI permits recurring payments up to ₹15,000 per transaction without a fresh additional check after the mandate has been properly registered.

For insurance premiums, mutual fund subscriptions and credit card bills, the ceiling is ₹1 lakh per transaction. Payments above those limits require authentication.

These thresholds were not all created for the first time in April 2026. The Master Direction consolidated the earlier circulars into one rulebook and added provisions including complaint information in post-payment notifications and mapping mandates to reissued cards.

NPCI AutoPay portability: Your mandate is no longer tied to one app

NPCI made another change in October 2025.

Its AutoPay framework now allows a user to view active UPI AutoPay mandates in a UPI app of their choice and port a mandate from one UPI app to another.

The rule contains safeguards.

A mandate port must be initiated by the user. Apps are not allowed to use cashbacks, incentives, notifications, banners or similar methods to persuade a user to move the mandate. NPCI also says that a mandate can be ported only once in a rolling 90-day period.

User-initiated AutoPay management actions continue to require the UPI PIN.

NPCI required members already offering UPI AutoPay to enable the revised framework by December 31, 2025. Existing mandates were allowed to continue during the transition.

Practical example

Suppose a streaming subscription was originally created through App A.

Under the revised framework, the user can view eligible active mandates through another participating UPI app and port the mandate, subject to the NPCI conditions.

The payment instruction itself continues to be governed by RBI's recurring-payment rules.

UPI data: July 2026 set another monthly record

The regulatory changes are taking place as UPI transaction numbers continue to rise.

NPCI reports that UPI processed:

July 2026

• 741 participating banks
• 23,658.35 million transactions
• ₹29,87,880.49 crore in transaction value

June 2026

• 731 participating banks
• 22,716.07 million transactions
• ₹28,92,138.67 crore in transaction value

News4Bharat calculations using NPCI's monthly data show that between June and July:

1. transaction volume rose about 4.15%
2. transaction value rose about 3.31%
3. July averaged around 763 million UPI transactions a day
4. about 76.3 crore payments were processed each day
5. average daily transaction value was about ₹96,383 crore
6. the average value per transaction was about ₹1,263

July's ₹29.88 lakh crore also moved above the ₹29.53 lakh crore monthly record reported for March 2026 in the Finance Ministry's April review.

Are UPI payments becoming chargeable in 2026?

This issue needs to be separated from RBI and NPCI's confirmed payment rules.

No general customer charge on ordinary UPI transactions has been announced as of August 8, 2026.

The current debate follows proposed changes to the legal framework governing digital payment charges. Reuters reported that policymakers have considered merchant fees for selected higher-value payments, including models linked to transaction value and merchant turnover, but no final fee structure had been decided.

On August 8, the Payments Council of India also said consumers should continue to use UPI without payment charges and supported keeping small merchants outside any merchant-fee system. That is an industry position and should not be described as a new RBI or NPCI rule.

The distinction is simple:

Legal ability to introduce a fee is not the same thing as a fee being imposed.

News4Bharat has covered the issue separately here: UPI Charges 2026: Will UPI Payments Become Chargeable?.

Who is affected by the new UPI rules?

Ordinary UPI users

The most visible change is the ₹10,000 biometric approval ceiling. Users who enable the facility may approve more payments with a fingerprint or face instead of typing the UPI PIN. The feature remains optional.

Users are also affected by the 50-per-app daily balance-check limit, the removal of person-to-person Collect requests, bank-verified recipient names and the new AutoPay management rules.

People making high-value payments

Users paying insurance premiums, travel companies, capital market entities, credit card bills and other specified merchants can use limits above the normal person-to-person ceiling where the transaction and merchant meet NPCI's requirements.

Subscription users

Users with recurring payments get a clearer RBI framework for advance notifications, cancellations and payment thresholds, while NPCI's AutoPay portability rules allow mandate management across participating apps.

Banks and UPI apps

Banks and apps must implement the authentication, customer consent, device checks, mandate management, transaction-limit and system-request requirements laid down by RBI and NPCI.

Regulation tracker: RBI and NPCI UPI timeline

What happens next iN UPI?

Three dates and policy areas now need attention.

1. First, the ₹10,000 biometric limit is already live from August 7, 2026. The next practical stage is implementation across more participating banks, apps and supported devices. NPCI's circular instructs banks and UPI apps to communicate the revised limit to customers.
   
2. Second, RBI has an October 1, 2026 deadline for card issuers to put in place specified authentication and risk checks for certain cross-border online card transactions. This is part of RBI's wider authentication framework, rather than a UPI-only provision.
   
3. Third, December 31, 2026 remains the current compliance deadline for NPCI's long-delayed rule limiting a single third-party UPI app to 30% of UPI transaction volume. Reuters reported in July 2026 that the deadline remains in place.
   

There is also the UPI charging debate. A merchant fee is being discussed, but a discussion, enabling law or industry proposal should not be reported as a live UPI charge until the competent authority issues the final applicable rules.

News4Bharat POV

The ₹5,000 to ₹10,000 increase will attract attention because it is easy to explain. But viewed together, RBI and NPCI's changes point to a wider shift in how UPI is being managed.

The first phase of UPI growth was based on a common user journey: open an app, select a recipient or scan a QR code, enter a PIN and make the payment.

The newer framework is separating the payment limit from the method used to approve the payment.

The second shift is toward user control. Verified recipient names, removal of person-to-person payment requests, AutoPay portability, advance debit notices and the ability to withdraw mandates all put more information before a payment leaves the account.

The third shift is scale. UPI has moved from 703 participating banks in March to 741 in July 2026, while July alone processed 23.66 billion transactions worth nearly ₹30 lakh crore. At that level, even a balance enquiry or transaction-status request becomes a system-capacity issue when multiplied across hundreds of millions of users.

Sources:

• NPCI UPI Circulars
  
• NPCI UPI Product Statistics
  
• RBI Authentication Mechanisms for Digital Payment Transactions Directions, 2025
  
• RBI Digital Payments E-mandate Framework, 2026
  
• Ministry of Finance UPI 10-year data
  

About this report

News4Bharat reviewed RBI directions, NPCI circulars, NPCI transaction statistics and Government of India payment data for this explainer. Regulatory claims are based on primary documents wherever available. Secondary reports are used only for developments where a final or consolidated primary source was unavailable. Calculations identified as News4Bharat analysis were derived from published official data. The regulatory cut-off is August 8, 2026.