UPI Payments and Neobanks in India: The 2026 Guide

Ten years ago, paying the vegetable vendor meant hunting for small change. Today it is a QR scan and a beep, and the money has moved bank-to-bank before the vendor looks up. UPI processed 25.47 billion transactions in October 2026 — about 822 million payments a day, worth ₹31.53 lakh crore across the month. Source: NPCI data as reported by Entrackr, November 1, 2026 (cross-checked against DD News figures for September 2026).

Yet for all that familiarity, most of us use UPI the way we use electricity: tap, it works, never ask how. That is mostly fine — until a payment fails, a scam arrives, or someone offers you a "neobank account" and you cannot tell what you are actually signing up for. This guide is the map. It covers how a UPI payment actually settles, the current limits, what wallets legally are, what neobanks legally are not, and what to do the day something goes wrong. It is the hub for our payments cluster — the niche UPI features get their own post, the app-by-app comparison another, and neobanks a third.

What UPI actually is

The Unified Payments Interface is a payments system built and operated by the National Payments Corporation of India (NPCI) — a not-for-profit umbrella organisation set up in 2008 by the banking industry under the guidance of the Reserve Bank of India and the Indian Banks' Association. UPI went live on a pilot basis in April 2016 with 21 member banks and opened to the public in August that year; the BHIM app followed in December 2016. Source: PIB backgrounder, "UPI: Transforming India's Payment Landscape", August 24, 2026.

The design idea that made UPI take off: one mobile app can move money from any bank account to any other, instantly, around the clock, using just a phone number, a virtual payment address (VPA) or a QR code. As of July 2026, 741 banks were live on the system. Source: PIB, August 24, 2026.

What actually happens when you tap Pay

Here is the honest plumbing, step by step. When you set up UPI, your app (say PhonePe or Google Pay) registers a VPA like yourname@ybl against a real bank account. When you authorise a payment with your UPI PIN, that is two-factor authentication in action — something you have (the SIM-bound device) plus something you know (the PIN).

Your instruction then travels: your app submits it to your bank (or the payment service provider acting for it), NPCI's switch routes it to the beneficiary's bank, the beneficiary bank credits the account, and confirmations travel back the same chain. The money moves bank account to bank account through the banking system. It never sits inside PhonePe or Google Pay.

That single fact answers a surprising number of questions. Why can you switch apps and keep the same money? Because the money was always in your bank. Why does a failed payment take a day or two to auto-reverse? Because the reversal walks the same chain through settlement cycles. And why does the app not decide your limit? Because the app is a wrapper around your bank, and your bank applies NPCI's caps.

The current limits, honestly tabulated

The standard per-transaction ceiling has been ₹1 lakh for years and it still is for ordinary person-to-person payments. The interesting part is the carved-out categories. In August 2024, NPCI raised the cap to ₹2 lakh for capital-market, collection, insurance and foreign-inward-remittance transactions, and to ₹5 lakh for tax payments, hospital and educational-institution payments, IPO applications and RBI Retail Direct investments, effective September 16, 2024. Source: NDTV report of NPCI circular OC-185, September 16, 2024; PIB, August 24, 2026.

A year later NPCI went further. From September 15, 2025, verified merchants in several categories can accept up to ₹5 lakh per UPI transaction, with cumulative daily caps: capital markets, insurance, government e-Marketplace and travel bookings at ₹10 lakh a day; credit-card bill and jewellery payments at ₹6 lakh a day; business-to-business merchant payments at ₹5 lakh per transaction with no daily cap; forex purchases through BBPS at ₹5 lakh. Source: Business Standard, September 10, 2025, cross-checked against Simpliance's digest of NPCI circular OC-185B (the circular PDF sits behind NPCI's bot-protected site) — as on 3 November 2026.

Two footnotes matter. First, these are ceilings: your bank and your app can and do set lower limits, and for many banks the practical everyday cap is well under ₹1 lakh until you raise it in settings. Second, none of the higher tiers applies to plain person-to-person transfers — you cannot send your cousin ₹5 lakh on UPI because a hospital can bill that way. Source: Business Standard, September 10, 2025.

The features that actually matter

UPI has grown far beyond the QR scan. These are the pieces worth knowing, in rough order of usefulness:

• AutoPay and mandates. Recurring payments — SIP instalments, insurance premiums, subscriptions — run on pre-authorised mandates you approve once. This is how most mutual fund SIPs now collect money, and why they no longer fail when you are on holiday.
• UPI Lite and UPI 123Pay. Lite is an on-device wallet for small payments (currently ₹1,000 per transaction, ₹5,000 wallet) that works when the network does not; 123Pay brings UPI to keypad phones at up to ₹10,000 per transaction. We cover the mechanics, the catches and the credit-line rules in our UPI Lite, 123Pay and Credit Line explainer.
• UPI Circle. Launched in 2024, it lets a primary user authorise someone else — a parent paying through your account, or you paying through a grandparent's — with spending limits you set. Source: PIB, August 24, 2026.
• Credit Line on UPI. Since September 2023, banks can attach a pre-approved loan as a funding account in your app. It is a real loan with bureau consequences; the dedicated post covers it in depth.
• RuPay credit card on UPI. RuPay credit cards can be linked as a UPI funding account, so a QR payment can draw on card credit instead of your balance. NPCI runs the product; acceptance and interchange rules are NPCI's, and merchant acceptance above small values varies. Source: NPCI's RuPay Credit Card on UPI product page, as checked November 3, 2026.
• Authentication upgrades. From 2025, payments can be authorised with your phone's fingerprint or face unlock, and UPI PIN setup can run on Aadhaar face authentication — aimed at first-time users without easy card access. Source: PIB, August 24, 2026.

One more frontier: UPI now works in 11 countries, with Greece and the Maldives the latest additions — you pay Indian-style from an Indian app at foreign QR codes. Source: PIB, August 24, 2026.

Will you ever be charged? The MDR question

For consumers, person-to-person UPI is free and has stayed free. The live debate is merchant-side: a framework for a merchant discount rate (MDR) — 0.4% on specified person-to-merchant transactions above ₹2,000, capped at ₹300 on transactions of ₹75,000 and more — was scheduled to take effect on October 15, 2026. NPCI's steering committee deferred it past the festive season on October 13, 2026; a revised date has not been announced. Payments up to ₹2,000 and all P2P transfers remain outside the levy. Source: Entrackr, November 1, 2026, cross-checked against ThePrint and The Week, October 13, 2026 — no official NPCI page fetchable at the time of writing.

If it comes back as designed, you still pay nothing at a vegetable cart; the merchant bears the fee on larger card-machine-style transactions. Watch whether merchants quietly add handling charges for it — that is where consumers have historically felt MDR regimes.

Wallets: the PPI licence reality

The money you load into a Paytm-style wallet or a prepaid card is legally a prepaid payment instrument (PPI) — not a bank deposit. PPIs are issued by banks and by non-bank companies licensed by the RBI under the Payment and Settlement Systems Act, and the rules live in the RBI's Master Directions on Prepaid Payment Instruments, issued August 27, 2021 and updated as recently as September 30, 2026. Source: RBI Master Directions on PPIs (MD-PPIs, 2021).

The numbers in that document, current as on November 3, 2026:

• Small (min-KYC) PPIs: loads capped at ₹10,000 a month and ₹1,20,000 a financial year; balance can never exceed ₹10,000.
• Full-KYC PPIs: the amount outstanding cannot exceed ₹2,00,000 at any time; transfers to non-registered beneficiaries are capped at ₹10,000 a month, while pre-registered beneficiaries can receive up to ₹2,00,000 a month.
• Cash loading: limited to ₹50,000 a month.
• Cash withdrawal: up to ₹2,000 per transaction and ₹10,000 a month, on bank and non-bank PPIs alike.
• Interoperability: full-KYC wallets must interoperate through UPI, which is why you can now pay from a wallet into someone's bank account.

What this means for you is simple. A wallet is a prepaid liability of the company that issued it, not an insured deposit. If the issuer fails, DICGC deposit insurance — which protects bank deposits up to ₹5 lakh per bank — does not apply the way it does to your savings account. Wallets are spending tools; keep balances in them small and sweep big money into a bank. Our DICGC explainer covers what deposit insurance does and does not cover.

What "neobank" legally means in India (spoiler: it is not a bank)

Here is the sentence worth remembering: there is no standalone digital-bank licence in India. The RBI licenses banks under the Banking Regulation Act, and no category of "digital-only bank" exists in that framework. Every Indian "neobank" you can name — Jupiter, Fi, Niyo and the rest — is a fintech company that built an app and runs it on top of a licensed partner bank, which is where your money legally sits. Source: Pw India, "The evolution of neobanks in India", and the International Bar Association's neobanks-in-India analysis, both checked November 3, 2026.

This is not a secret. NITI Aayog published a discussion paper in November 2021 proposing a licensing and regulatory regime for digital banks; the RBI has not adopted it, and no such licence exists as of November 2026. Source: PIB release on the NITI Aayog discussion paper, November 2021; The Hindu BusinessLine on the RBI's position, 2022.

The companies say so themselves, in the fine print most people never read. Jupiter's own app-store disclosure states: "Jupiter is a marketplace which offers different products... Jupiter itself is not a bank and doesn't hold or claim to hold a banking license. The Savings Account, Fixed Deposit, co-branded VISA debit and credit card are issued by Federal Bank. All funds in the account are insured up to approved limits by DICGC." Source: Jupiter Money listing on Google Play, as on November 3, 2026.

Why does this matter to you in practice? Three reasons. Your deposits legally sit in the partner bank, so DICGC's ₹5 lakh per-bank insurance attaches there — the neobank app cannot "go bust with your money" the way a wallet can, but only up to that per-bank cap. The app can vanish while the account survives: Fi Money's banking wind-down in March 2026 pushed all existing account-holders to Federal Bank's own FedMobile app, and that is exactly what happened — the accounts stayed, the experience changed. And the fintech cannot change what the bank charges; fees, rates and service live with the licensed bank. Source: fi.money homepage banner, November 3, 2026.

If the app is the reason you opened the account, understand that apps can disappear. If the rate or the zero-balance feature is the reason, check which bank actually holds the money, and read our best-neobanks explainer for the landscape and its catches.

Safety: the scams that actually work

UPI itself is technically solid — encrypted, two-factor, bank-rail-settled. Nearly every UPI loss begins with a human trick, not a technical break. The RBI has catalogued the standard playbook in its BE(A)WARE booklet on the modus operandi of financial fraudsters. Source: RBI press release and booklet, April 2020, as mirrored on bank sites. These are the three patterns you will actually meet:

• Screen-share scams. A caller posing as bank support, a courier firm or a government office persuades you to install a screen-sharing app (AnyDesk-style) or to stay on a video call while you "verify" something. They watch your OTP and UPI PIN entry in real time. The defence is procedural: no legitimate institution asks you to install an app or share a PIN. Uninstall any screen-share app the moment a stranger requests it.
• Collect-request tricks. To receive money you only ever share your VPA or show your QR. When a "collect request" pops up with a scary message — "your account will be blocked, approve to reactivate" — approving it means paying, not receiving. Read the request: the arrow matters more than the words. Source: pattern described in RBI's BE(A)WARE booklet.
• QR-payment confusion. The classic: someone buying something from you online says "scan this QR and enter your PIN to receive the payment." Scanning a QR with PIN entry always sends money out. There is no QR flow that credits you via your PIN. The rule is one line: PIN means paying.

Underneath all three sits one habit: treat your UPI PIN like an ATM PIN. Nobody legitimate ever needs it — not your bank, not NPCI, not the app's "verification team".

If something goes wrong: the complaint ladder

Work the ladder in order, and do the first two steps fast — speed is what freezes money in a fraud: report within the golden hour. Source: I4C's description of the CFCFRMS system, i4c.mha.gov.in.

1. Report the fraud first. Call 1930, the national cybercrime helpline running in all States and UTs, or file at cybercrime.gov.in. The Citizen Financial Cyber Fraud Reporting System behind it is connected live to 85 banks, payment intermediaries and wallets, which is what lets a fast report hold the money in the fraudster's account. Source: Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs, as on November 3, 2026.
2. Raise it in your UPI app. Every app has an in-app dispute flow against the transaction ID. This creates the formal trail.
3. Escalate to your bank or PSP, then to NPCI's UPI complaint channel if unresolved within the stipulated timelines.
4. Take it to the RBI Ombudsman at cms.rbi.org.in if the regulated entity still has not resolved it. The RBI's complaint portal handles UPI disputes against banks and PPI issuers under the Reserve Bank Integrated Ombudsman Scheme. Source: RBI Complaints portal and cms.rbi.org.in, as on November 3, 2026.

For plain failed payments (money debited, not credited), steps 2 and 3 usually auto-resolve within a couple of working days — UPI has a built-in reversal cycle. For genuine fraud, step 1 before everything else; minutes matter more than paperwork.

The map in one table

One rail, three different legal realities. Knowing which is which is most of payments safety.

Where to go next in this cluster

If you came here for the features: our UPI Lite, 123Pay and Credit Line on UPI post covers the three niche layers in depth, including where refunds land and what a missed credit-line payment does to your score. If you are choosing an app: the best UPI apps comparison explains what is identical across them (spoiler: the rail) and what genuinely differs. If you are curious about the neobank wave — Jupiter, Fi's wind-down, Niyo's travel-card partnerships, slice's odd path to actually becoming a bank — the best neobanks in India post walks the landscape and its catches. And if the deeper question is where to keep the money these apps move, start with the savings-account comparison and the DICGC explainer.

This guide is educational, not financial advice. Limits and rules change; verify current figures on NPCI and RBI pages before acting on any number here.