TLDRMONEY
Menu
Payments · 13 min read

UPI stays free for you. From 15 October, shops pay 0.4% above ₹2,000.

UPI payments up to ₹2,000 are free by law, and from 15 October 2026 the ones above it cost the shop 0.4%, capped at ₹300. You are charged nothing either way: the framework bars merchants, banks and apps from passing the fee on. That was settled on 15 September, a day after the Finance Ministry’s notification, and the government has since ruled out a rollback while trade bodies organise against it. Four older changes are already live: two-factor authentication since April 2026, a ₹5 lakh merchant transaction cap since September 2025, a 50-a-day limit on balance checks since August 2025, and masked phone numbers since 4 September 2026. The fraud compensation framework starts on 1 January 2027, and the one-hour payment delay everyone forwarded is still a discussion paper. Here is each one, sorted by status, with what it costs you.

Founder, TLDR Money · · Last updated

In August 2026, UPI handled 24.51 billion transactions worth ₹29.82 lakh crore, a record number of transactions for a single month. Two weeks later the government decided which of those payments stay free by statute, and the day after that a committee of banks and apps put a price on the rest.

Most of what is circulating about “new UPI rules” mixes things in very different states: rules already in force, a fee with a rate and a start date, a rule signed but not applicable until 2027, and proposals that are still only paper. One of them changes your Tuesday, one changes your rights, one changes what a shop keeps, and one might never happen.

Payments up to ₹2,000 by UPI, and all RuPay debit card payments, are protected from charges by law. Above ₹2,000 the merchant pays 0.4% from 15 October 2026, capped at ₹300, with a flat ₹5 in essential categories and nothing at all on person-to-person transfers, AutoPay mandates or small merchants. Four other changes are already live, one starts on 1 January 2027, and one is a discussion paper with no legal force at all — the one-hour payment delay you have probably seen forwarded as fact.

Status of each 2025–26 UPI change, as of 20 September 2026. Sources listed at the end.
Change Status In force from
No charges on UPI up to ₹2,000 or on RuPay debit cardsLaw14 September 2026
MDR on UPI payments above ₹2,000Decided, 0.4%15 October 2026
Masked phone numbers, non-mobile UPI IDsNPCI rule4 September 2026
Two-factor authentication, one dynamic factorLaw1 April 2026
P2M limit up to ₹5L per transactionLaw15 September 2025
50 balance checks per app per dayLaw1 August 2025
Fraud compensation frameworkSigned1 January 2027
One-hour lag, kill switch, mule-account capDiscussion paperNot proposed as a rule

UPI charges: 0.4% on shop payments above ₹2,000, from 15 October

Updated 20 September 2026. On 15 September this section said the rate was still open and the committee had not decided. It decided that day. The Ministry of Finance published the framework the same evening, and it starts on 15 October 2026.

What was decided

A merchant discount rate applies to some UPI payments from 15 October 2026, charged to the merchant rather than to you:

The Ministry of Finance puts 96% of merchant payments outside the framework, and person-to-person transfers, which it says carry about 70% of UPI value, are outside it entirely. Banks have been told not to let merchants pass the charge on, and UPI apps may not add a platform fee of their own. GST at 18% applies to the fee, which a registered merchant can claim back as input tax credit, and an amount equal to 5% of what is collected goes to a fund for signing up more small merchants.

Why the line sits at ₹2,000: only about 4% of person-to-merchant UPI payments by count are ₹2,000 or more, but they carry 67.2% of person-to-merchant value, according to CareEdge Ratings. Because most UPI money moves between people, CareEdge puts the value potentially in scope at about 19.5% of all UPI value in FY26. A ₹2,000 line keeps nearly every shop payment free and leaves most merchant money within reach of a fee.

What it costs, in rupees

Worked example, from 15 October. Groceries at ₹1,800: nothing, and by law nobody may charge either side. A washing machine at ₹12,000 from a large retailer: the retailer pays ₹48. A payment of ₹90,000: 0.4% would be ₹360, so the cap applies and the merchant pays ₹300. Fuel at ₹3,000: ₹5. A ₹5,000 mutual fund purchase: ₹1. A ₹1,200 SIP or a streaming subscription on AutoPay: nothing, because mandates sit outside the framework.

Whether it reaches you

Not as a line on your bill. The framework bars a surcharge, a convenience fee and an app platform fee, so the number at the counter should be the number on the label.

Prices are a different question. Shankar Thakkar, national secretary of the Confederation of All India Traders, told Business Standard that small retailers will look at splitting a payment in two, raising prices on unbranded goods, or asking for a bank transfer instead. A grocery store operator told Al Jazeera he already charges ₹5 on payments above ₹1,000 and will raise prices if the fee reaches him. None of that is a UPI charge; it is the ordinary way a business cost moves, and it is the part no rule reaches.

Merchants had already said as much before the rate was set. In a LocalCircles online survey released on 3 September 2026, drawing 32,796 merchant responses, 17% said they would bear an MDR of 0.3% or more and 41% said they would bear none. In the same organisation’s survey of UPI users, 53% said they would move away from UPI for higher-value payments if a fee were passed to them. Both are self-selected online panels, so read them as mood rather than measurement.

A week ago almost none of this was settled. Reported proposals ran from 5 to 7 basis points in August through 25 to 30 basis points in early September to 0.3% or 0.5% elsewhere. The figure chosen, 0.4%, sits at the top of that range.

The argument about it

The government has ruled out a rollback. A senior official told Business Today on 16 September that the decision was taken and there was no question of reversing it, and on 17 September the Finance Ministry rejected the claim that it had acted under American pressure. That claim came from Congress, whose Jairam Ramesh said the government “has given in to a US demand to get rid of zero MDR”; Rahul Gandhi has asked for the fee to be withdrawn, and Opposition parties have taken to calling it a “Modi tax”.

Traders are organising. CAIT Odisha met on 18 September and resolved to petition the Finance Minister through district collectors on 23 September, and to stop accepting UPI for seven days from 1 October if there is no movement. A day later the chair of the parliamentary finance committee, Bhartruhari Mahtab, and Congress MP Manish Tewari disagreed in public about whether that committee had recommended an MDR at all: its March report asked the department to explore a tiered revenue model, and Tewari says the charge itself never came back to the committee afterwards.

The practical effect for you lands in the first week of October: if a shop near you stops taking UPI, or puts up a sign preferring cash, this is why.

The law behind it

The Department of Financial Services issued S.O. 5067(E) on 14 September 2026 under section 10A of the Payment and Settlement Systems Act, 2007, naming two electronic modes of payment that may not be charged for: debit cards powered by RuPay, and UPI transactions up to ₹2,000. For those two, “no bank or system provider shall impose, whether directly or indirectly, any charge upon a person making or receiving a payment.” The protection covers both ends of the payment, you and the shop you pay, and it reaches indirect charges, so a fee cannot be renamed to get around it. Most legal reporting, LiveLaw’s included, reads the ₹2,000 limit as attached to UPI only, which leaves RuPay debit card payments protected at any amount.

The notification did not set the fee. It removed UPI payments above ₹2,000 from the protected list, which is what made a fee on them legally possible; NPCI’s UPI and Services Steering Committee, 22 members drawn from public sector, private and small finance banks, UPI apps, the Indian Banks Association and the Payments Council of India, then set the rate and the exemptions the next day.

The power itself comes from the Taxation and Other Laws (Amendment) Act, 2026 — not, as several outlets first reported it, a standalone payments bill. It was introduced in the Lok Sabha on 4 August 2026, passed there without debate on 6 August, cleared the Rajya Sabha by voice vote on 10 August, and received Presidential assent on 17 August 2026. It amends three statutes at once: the Income-tax Act 2025, the Finance Act 2026, and the Payment and Settlement Systems Act 2007. The payments change is one amendment to section 10A of the 2007 Act:

So the zero-charge protection was not repealed. It was unhooked from tax law and rehung on executive discretion: whatever the government notifies stays free, and whatever it leaves off the list does not. Person-to-person transfers are a case in point. They are free in the framework and the Ministry says they will stay free, but the notification draws its line by amount rather than by who is being paid, so a ₹10,000 transfer to your brother is free by policy rather than by the text of S.O. 5067(E).

RBI Governor Sanjay Malhotra, asked about MDR after the 5 August policy announcement, declined to speculate and made one observation: costs have to be paid by someone, and consumers may already be paying indirectly, through the wider economy rather than on a screen.

Zero MDR was paid for with a government incentive to banks for RuPay debit card and low-value BHIM-UPI merchant payments: ₹2,000 crore in the 2026–27 Budget, against about ₹2,196 crore in 2025–26. UPI has always cost money to run. Until 15 October that cost sat with the government.

Already live

Your phone number is now masked

NPCI circular NPCI/UPI/OC-234/2026-27, Safeguarding User Information in UPI, issued on 5 June 2026 with a compliance deadline of 4 September 2026, requires UPI apps and member banks to mask mobile numbers, UPI IDs and account numbers across customer-facing screens. The person you pay sees only the last four digits of your mobile number, and on QR payments the number stays hidden even after the payment completes. Apps must also let you create a UPI ID that is not your phone number and set it as your default.

What changed for you: if your UPI ID is still your mobile number, the full number used to appear to people you paid. Setting a name-based UPI ID as your default in your app removes the number from the ID as well.

Two-factor authentication, with one dynamic factor

RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (RBI/2025-26/79, issued 25 September 2025) require every domestic digital payment to use two distinct authentication factors, at least one of which is dynamic — unique to that specific transaction. An SMS OTP still qualifies as a factor, but no longer on its own.

Exemptions include card-present transactions, e-mandates after the first payment, FASTag and NETC, prepaid gift instruments, and small-value offline payments. Card issuers have until 1 October 2026 for cross-border card-not-present transactions.

What changed for you: almost nothing visible. Your UPI PIN on a device-bound app already clears the bar. You will notice it at the edges — re-registering after a phone change, or a transaction the bank’s risk engine flags and escalates to biometrics.

Merchant limits went up. Yours did not.

From 15 September 2025, NPCI raised the per-transaction cap for person-to-merchant payments to ₹5 lakh and the daily aggregate to ₹10 lakh — but only for verified merchants in specified categories: insurance premiums, capital markets, travel, collections and the Government e-Marketplace.

Person-to-person transfers stay at ₹1 lakh per day.

Worked example. You want to put ₹4 lakh into a mutual fund. Since September that is one UPI transaction instead of four, because a capital-markets platform sits in an eligible merchant category. You want to send your brother ₹4 lakh toward a flat deposit. That is still four days of P2P transfers — or NEFT, or RTGS, which has no upper ceiling. Your own bank may also set a lower daily cap than NPCI’s, which you can usually check and raise inside its app.

Balance checks now have a ceiling

Following an NPCI circular of 21 May 2025 on high-frequency API usage, live since 1 August 2025: 50 balance enquiries per app, per day. Twenty-five requests a day for fetching the accounts linked to your mobile number. Pending-transaction status checks limited to three per transaction, with a 90-second gap. Autopay mandates moved out of the peak windows of 10:00–13:00 and 17:00–21:30. In exchange, apps now display your updated balance automatically after each successful payment.

If you run two UPI apps, that is 50 each — the cap is per app, not per person.

Signed, but not in force until 1 January 2027

The fraud compensation framework, and the date most articles get wrong

On 24 June 2026, RBI finalised its Commercial Banks – Responsible Business Conduct (Third Amendment) Directions, 2026, replacing the older regime on limiting liability in unauthorised electronic banking transactions with a broader framework covering fraudulent electronic banking transactions.

The draft, issued 6 March 2026, proposed a start date of 1 July 2026. The final version deferred it by six months, to 1 January 2027. A lot of live articles still say July 2026. They are quoting the draft.

What it establishes, for transactions on or after 1 January 2027:

Worked example. January 2027. You lose ₹40,000 to a fake customer-care number that walks you through “verifying” your account. You report it to your bank and to 1930 within four days. 85% of ₹40,000 is ₹34,000, which is above the cap — so you receive ₹25,000. Net loss to you: ₹15,000, and you have spent your one lifetime claim.

Change one variable. You lose ₹80,000 instead. The compensation mechanism does not apply at all, because it is built for losses up to ₹50,000. Your recourse falls back to establishing bank negligence or a third-party breach — where liability is zero, but the burden of proof and the 45-day clock both sit with the bank.

Miss the five-day window and a defined right becomes an open-ended dispute.

The framework exists because reported digital payment fraud has scaled with the system. Cases on the National Cyber Crime Reporting Portal went from 2.6 lakh in 2021 to 28 lakh in 2025, and value from ₹551 crore to ₹22,931 crore over the same period.

Proposed only, not law

The one-hour lag, the kill switch and the mule-account cap

On 9 April 2026, RBI published a discussion paper, Exploring Safeguards in Digital Payments to Curb Frauds, with four options:

  1. A one-hour lag on authorised push payments above ₹10,000, with a cancellation window for the payer.
  2. An extra authentication layer via a nominated “trusted person” for transactions above ₹50,000 by senior citizens aged 70 and over, and by persons with disabilities.
  3. A ₹25 lakh annual credit cap on accounts without enhanced due diligence, to choke mule networks.
  4. Customer-controlled limits, including a single kill switch to disable all digital payment channels at once.

Comments closed on 8 May 2026. RBI said it would review feedback before issuing draft guidelines. Nothing here is a rule. Banks and fintechs pushed back hard on the one-hour lag, and merchant payments were proposed as exempt in any case. If you have seen a message saying your UPI transfers are now delayed by an hour, that is a discussion paper being read as a notification.

What this adds up to

Four of these changes are already in your pocket, and the masked phone number is the only one you are likely to see. One gives you a defined, capped right from 1 January 2027 that you will only discover if something goes wrong. One settles the question of UPI charges: free up to ₹2,000, 0.4% to the merchant above it from 15 October, and nothing added at the counter. And one is a proposal that half the internet has already reported as law.

Payments are not the only place this happens. India also replaced its entire income tax statute this year, and almost nothing about what you owe changed — which did not stop a great deal of coverage implying otherwise.

The common thread is that your payment rails are getting more instrumented — more checks, more alerts, more logged events per rupee moved. From 1 January 2027, every electronic transaction over ₹500 generates an SMS. If you are paying rent, three SIPs, a house-help transfer and forty-odd small merchants a month across two banks and a credit card, that is a great many more messages arriving and not one more unit of clarity about where your money went.

More alerts is not more insight — it is the same information, arriving faster, in a place designed for reading one message at a time. That gap is what automatic expense tracking in India exists to close, and it is why the capture method matters: an app that reads email alerts rather than your SMS inbox sees the same transactions without asking for the permission that also exposes your OTPs. The small recurring charges are the ones this matters most for, because they are the ones no single alert ever makes look expensive.

Questions worth asking

Will UPI start charging a fee?

Yes, but not to you, and not on most payments. From 15 October 2026 a merchant discount rate of 0.4% applies to eligible person-to-merchant payments above ₹2,000, capped at ₹300 on payments of ₹75,000 and above. The merchant pays it, and banks and UPI apps may not pass it on to you as a surcharge or a platform fee. Person-to-person transfers, payments up to ₹2,000, UPI AutoPay mandates and small merchants taking up to ₹1 lakh a month remain at zero. The Ministry of Finance puts 96% of merchant payments outside the framework.

Is UPI free up to ₹2,000?

Yes, by law. S.O. 5067(E), issued by the Finance Ministry on 14 September 2026 under section 10A of the Payment and Settlement Systems Act, 2007, says no bank or system provider may impose any charge, directly or indirectly, on a person making or receiving a UPI payment of up to ₹2,000. That protects both you and the shop you pay. RuPay debit card payments are covered too, and most legal reporting reads the ₹2,000 limit as applying to UPI only. The same ₹2,000 line is where the merchant fee starts from 15 October 2026.

Will I pay extra when I pay a shop more than ₹2,000 by UPI?

Not as a charge. From 15 October 2026 the shop pays 0.4% on a payment above ₹2,000, so ₹48 on a ₹12,000 bill, and the framework bars it from adding a surcharge or convenience fee. What a shop can still do is raise its prices, prefer cash or ask for a bank transfer, and trade bodies have said members will consider all three. Small merchants taking up to ₹1 lakh a month through a P2PM QR code pay nothing.

What is the UPI transaction limit in India now?

Person-to-person transfers are still capped at ₹1 lakh a day — that did not change. What changed on 15 September 2025 is the person-to-merchant cap, which NPCI raised to ₹5 lakh per transaction and ₹10 lakh a day, and only for verified merchants in specified categories: insurance premiums, capital markets, travel, collections and the Government e-Marketplace. Your own bank may apply a lower ceiling than NPCI’s, which you can usually check and raise inside its app.

How long do I have to report a UPI fraud to be compensated?

Five calendar days, from 1 January 2027, when RBI’s finalised fraud framework takes effect. Report to your bank and to the National Cyber Crime Reporting Portal or helpline 1930 within that window and your liability for a third-party breach is zero. Where the loss came from the bank’s own negligence, liability is zero whether or not you reported. Separately, bona fide victims of fraud up to ₹50,000 can claim 85% of the net loss or ₹25,000, whichever is lower — once in a lifetime.

Are UPI payments now delayed by one hour?

No. A one-hour lag on push payments above ₹10,000 was one of four options in an RBI discussion paper published on 9 April 2026, with a cancellation window for the payer. Comments closed on 8 May 2026 and RBI said it would review feedback before issuing draft guidelines. No delay has been notified, banks and fintechs pushed back on it, and merchant payments were proposed as exempt in any case. If you have seen a forward saying otherwise, it is a discussion paper being read as a rule.

Related

Automatic expense tracking in India Where the transaction data comes from, what it can and cannot see, and why the capture method decides how much access you hand over. Tracking without SMS permission Why an app that reads email instead of your SMS inbox sees the same transactions without ever seeing an OTP. Apple Pay is live in India, on one bank’s credit cards Who can use it today, why UPI and RuPay are missing, and how much of your spending Apple Wallet can show. More on payments Everything in this category.

More alerts is not more clarity

From January 2027 every transaction over ₹500 sends you an SMS. TLDR Money will read the transaction alerts your bank already sends — read-only, from your Gmail, never your SMS inbox — and turn them into what you spent, what you own, and how far you are from the date your money covers your life.

It will be funded by subscription alone, which is the same structural point the MDR debate is making in public: somebody always pays, and it is worth knowing who.

Join the waitlist

We’ll email you when it’s ready. No spam, ever.

Sources

Status as of 20 September 2026. The zero-charge protection for UPI payments up to ₹2,000 is law and the 0.4% framework above it takes effect on 15 October 2026, though trade bodies are still pressing for it to be withdrawn, and one item above is a discussion paper — so check the Finance Ministry, RBI and NPCI notification pages before relying on any of it. This is an explanation of what has been published, not legal or financial advice. TLDR Money is not a registered investment adviser and earns no commission on any product mentioned. The worked examples are illustrative; your own numbers and circumstances will differ.