UPI processed over 10 billion transactions a month in 2026. The infrastructure that makes that scale possible — NPCI's clearing layer, the bank rails beneath it, the PSP apps on top — is now acquiring an AI layer. That AI layer changes the governance problem fundamentally.
In 2025, banks governed AI models that advised on credit decisions and detected fraud after a human transaction. In 2026, AI models are authorising transactions, resolving disputes, and — under the Unified Agent Protocol — initiating payments autonomously on behalf of users. When AI acts, not just advises, the governance infrastructure needs to be different.
NPCI CEO Dilip Asbe stated it plainly at Mumbai Tech Week: "We must have a regulatory framework for the agentic world and once that's there, we can look at the orderly kind of implementation of use cases." India does not yet have that framework. Banks and PSPs operating in the UPI ecosystem need to build their governance infrastructure now, because the regulatory framework will arrive with expectations already set by the technology's deployment pace.
Three NPCI AI Initiatives That Create Governance Obligations
1. Sovereign AI Model — NPCI × NVIDIA
NPCI's collaboration with NVIDIA is building a payments-native AI foundation model trained on Indian financial data, governed under Indian data sovereignty requirements. The model underpins NPCI's AI services including FiMI — the financial LLM that currently serves over one million users for payment support tasks (mandate cancellation, dispute resolution, status queries).
The sovereign AI model matters for governance in three ways. First, it is infrastructure-level AI — its outputs affect every bank and PSP using NPCI's AI services. A systematic error in the model propagates to all participants simultaneously. Second, it is trained on aggregated payment data from across the Indian banking system, which creates privacy obligations under DPDP Act even when individual records are not exposed. Third, its governance is within NPCI's purview, not a third-party model provider's terms of service — which means banks using NPCI AI have a clearer path to regulatory oversight but also a direct accountability relationship with the model's performance.
2. Unified Agent Protocol (UAP) — Agentic UPI Payments
The Unified Agent Protocol is NPCI's framework for letting AI agents make small UPI payments autonomously — with pre-set spending limits and defined authorization scopes. Under UAP, a user delegates payment authority to an AI agent for specific categories: recurring subscriptions, utilities, split payments, micro-purchases. The agent can execute within that scope without per-transaction authentication.
UAP creates a new authorization boundary problem. When an AI agent initiates a payment, the question "did the user authorise this?" becomes "did the user authorise this agent, for this category, up to this amount, and is this specific transaction within that mandate?" That question must be answered at transaction time by the bank and PSP in the payment chain, not after the fact.
The governance infrastructure required: scope definition and enforcement at the PSP layer; real-time transaction monitoring against the declared agent mandate; anomaly detection for agents behaving outside their declared scope; and a complete audit trail of every agentic payment with the agent's authorization chain documented.
3. AI-Led Compliance Automation
NPCI is exploring AI-based workflows to compress the compliance and certification timeline for UPI participants from weeks to 7–10 days. NPCI issues 30+ operating circulars per year; currently, banks and PSPs manually review, assess, and implement each one. AI-assisted compliance analysis reads the circular, maps it to the participant's existing controls, identifies gaps, and suggests implementation steps.
When compliance analysis is AI-assisted, the AI's assessment of what a circular requires becomes a governance artefact. If the AI incorrectly concludes that a bank is already compliant when it is not, the bank may fail an RBI inspection based on AI-generated analysis. The governance requirement: AI-generated compliance assessments must be validated by a human compliance officer before they drive implementation decisions.
The Authorization Boundary Problem
The most significant governance challenge that agentic UPI payments creates is what security researchers call the authorization boundary problem. In a traditional payment, the authorization boundary is clear: the user authenticates with a PIN or biometric, and the bank confirms the user's identity before releasing funds. The chain is short: user → bank → UPI.
In an agentic payment, the chain is: user → AI agent → PSP → payer's bank → UPI → payee's bank. The user's intent is expressed once (when they configure the agent and its spending limits), and then the agent acts repeatedly within that expression of intent. Whether any individual transaction truly represents the user's intent is never re-confirmed.
This creates three failure modes that banks must govern:
Scope creep. An agent authorised to pay utilities begins paying for categories outside its mandate because a vendor misclassified a transaction, because the agent's scope definition was ambiguous, or because the agent's AI logic expanded its interpretation of the scope. Banks must monitor for transactions that do not match the declared agent scope.
Agent compromise. If an AI agent is compromised — through prompt injection, through manipulation of the agent's context, or through a vulnerability in the agent's underlying model — an attacker can initiate payments within the agent's authorised limits without the user's knowledge. This is the agentic equivalent of card fraud, but the attacker operates within the user's own authorization scope. Existing fraud detection models are not trained to detect this pattern.
Cascading authorisation failures. In a multi-agent payment orchestration — where one AI agent delegates to another, which delegates to a third — the authorization chain can become unverifiable. RBI FREE-AI Recommendation 9 specifically addresses this: each node in a multi-agent chain must maintain and verify the authorization scope received from its upstream principal.
RBI FREE-AI and What It Requires of Payment Participants
RBI's FREE-AI framework (August 2025, 26 recommendations) was primarily written for banks and NBFCs, but several recommendations apply directly to payment systems AI deployments.
FREE-AI Recommendations — Payment Systems Relevance
| Recommendation | Payment Systems Application |
|---|---|
| Rec 3: Shared AI Infrastructure | NPCI sovereign AI model is shared infrastructure; banks using it bear downstream governance responsibility |
| Rec 9: Agentic Authorization | Each participant in the UPI chain must verify the agent's authorization scope at transaction time |
| Rec 14: Systemic Risk | Correlated AI failure across payment participants creates macro-financial risk; RBI assessment required |
| Rec 19: Audit Trail | Every agentic payment must have a complete, tamper-evident authorization chain documented |
| Rec 22: Customer Recourse | When an agent initiates an unauthorized payment, the bank must provide a documented dispute pathway |
Five Governance Requirements for Banks in the UPI AI Stack
1. Agent registry. Banks that allow AI agents to initiate UPI payments must maintain a registry of authorized agents: agent identity, declared scope, spending limits, authorization expiry, and the user's consent record. This registry is the foundation for scope enforcement and dispute resolution.
2. Scope enforcement at transaction time. Before executing a payment initiated by an AI agent, the PSP and payer bank must verify that the transaction is within the agent's declared scope. This is not a post-hoc reconciliation check — it is a real-time control at transaction authorization time. Scope enforcement requires the transaction to be classified against the agent's mandate (category, amount, counterparty, time of day) before authorization.
3. Anomaly detection for agentic behavior. Traditional fraud detection models are trained on human transaction patterns. An AI agent executing payments has a different behavioral signature — it may transact at off-hours, in rapid succession, or in patterns that would be unusual for a human but normal for an agent. Banks need new detection models trained to identify when an agent is behaving outside its historical pattern (which may indicate compromise) without false-flagging normal agentic behavior.
4. Multi-agent chain documentation. For payments that flow through multiple AI agents — for example, a personal finance AI that delegates to a bill-payment agent that delegates to a payment execution agent — the bank must be able to reconstruct the complete authorization chain for any transaction. This is both a FREE-AI requirement and a customer dispute resolution requirement: if a customer disputes an agentic payment, the bank must prove the authorization chain was intact.
5. Kill switch and scope revocation. When a user wants to revoke an agent's payment authority — or when the bank detects anomalous agentic behavior — there must be a mechanism to immediately suspend the agent's authorization and prevent further transactions. This kill switch must operate in real time (before the next transaction clears) and must propagate through the entire authorization chain.
What Zytra Covers for Payment AI Governance
Zytra's agentic AI security module (Prism Agentic) covers the specific governance requirements that UPI AI creates for banks and PSPs:
- D-09 Prompt Injection detection — guardrails against attacks that attempt to hijack a payment agent's authorization scope through manipulated inputs
- D-10 Authorization scope enforcement — real-time validation that every agent action (payment initiation, mandate creation, limit modification) is within the declared authorization scope
- D-11 Multi-agent authorization chain — tracking and verification of authorization propagation across multi-agent payment orchestrations
- FiMI and payment LLM guardrails — output monitoring for NPCI's FiMI and similar payment chatbots covering mis-statement of UPI limits, incorrect dispute guidance, and unauthorized payment advice
- Audit trail for FREE-AI compliance — tamper-evident, hash-chained audit packs for every agentic payment event, exportable for RBI inspection
Assess Your Payment AI Governance Readiness
Free 141-dimension AI risk assessment for banks and PSPs in the UPI ecosystem — mapped to FREE-AI, MRMF, and emerging agentic payment governance requirements.
Start free assessment