Three UPI rule changes are already law: two-factor authentication with one dynamic factor since April 2026, a ₹5 lakh merchant transaction cap since September 2025, and a 50-a-day limit on balance checks since August 2025. One more is signed but does not start until 1 January 2027 — the fraud compensation framework, which most articles still date to July 2026 because they are quoting the draft. On 10 August 2026 Parliament passed the bill that makes charging for UPI legally possible, though it charges nothing and is still awaiting Presidential assent. And the one-hour payment delay everyone forwarded remains a discussion paper. Here is the sorted version, with what each one actually costs you.
In July 2026, UPI moved ₹29.9 lakh crore across 23.66 billion transactions — a record month. Six days later, both Houses of Parliament passed the bill that could end the part where it is free.
Most of what is circulating about “new UPI rules” mixes three very different things: rules already in force, rules signed but not yet applicable, and proposals that are still only paper. That distinction matters more than any individual rule. One of them changes your Tuesday, one changes your rights, and one might never happen.
Sorted by status, not by headline. Three changes are already live. One is signed and starts on 1 January 2027. One has passed both Houses but charges nothing and is not yet assented to. And one is a discussion paper with no legal force at all — the one-hour payment delay you have probably seen forwarded as fact.
| Change | Status | In force from |
|---|---|---|
| Two-factor authentication, one dynamic factor | Law | 1 April 2026 |
| P2M limit up to ₹5L per transaction | Law | 15 September 2025 |
| 50 balance checks per app per day | Law | 1 August 2025 |
| Fraud compensation framework | Signed | 1 January 2027 |
| Power to allow MDR on UPI | Passed both Houses | Awaiting assent; no charge notified |
| One-hour lag, kill switch, mule-account cap | Discussion paper | Not proposed as a rule |
RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (RBI/2025-26/79, issued 25 September 2025) require every domestic digital payment to use two distinct authentication factors, at least one of which is dynamic — unique to that specific transaction. An SMS OTP still qualifies as a factor, but no longer on its own.
Exemptions include card-present transactions, e-mandates after the first payment, FASTag and NETC, prepaid gift instruments, and small-value offline payments. Card issuers have until 1 October 2026 for cross-border card-not-present transactions.
What changed for you: almost nothing visible. Your UPI PIN on a device-bound app already clears the bar. You will notice it at the edges — re-registering after a phone change, or a transaction the bank’s risk engine flags and escalates to biometrics.
From 15 September 2025, NPCI raised the per-transaction cap for person-to-merchant payments to ₹5 lakh and the daily aggregate to ₹10 lakh — but only for verified merchants in specified categories: insurance premiums, capital markets, travel, collections and the Government e-Marketplace.
Person-to-person transfers stay at ₹1 lakh per day. Unchanged.
Worked example. You want to put ₹4 lakh into a mutual fund. Since September that is one UPI transaction instead of four, because a capital-markets platform sits in an eligible merchant category. You want to send your brother ₹4 lakh toward a flat deposit. That is still four days of P2P transfers — or NEFT, or RTGS, which has no upper ceiling. Same money, different rails, entirely different friction. Your own bank may also set a lower daily cap than NPCI’s, which you can usually check and raise inside its app.
Following an NPCI circular of 21 May 2025 on high-frequency API usage, live since 1 August 2025: 50 balance enquiries per app, per day. Twenty-five requests a day for fetching the accounts linked to your mobile number. Pending-transaction status checks limited to three per transaction, with a 90-second gap. Autopay mandates moved out of the peak windows of 10:00–13:00 and 17:00–21:30. In exchange, apps now display your updated balance automatically after each successful payment.
If you run two UPI apps, that is 50 each — the cap is per app, not per person.
On 24 June 2026, RBI finalised its Commercial Banks – Responsible Business Conduct (Third Amendment) Directions, 2026, replacing the older regime on limiting liability in unauthorised electronic banking transactions with a broader framework covering fraudulent electronic banking transactions.
The draft, issued 6 March 2026, proposed a start date of 1 July 2026. The final version deferred it by six months, to 1 January 2027. A lot of live articles still say July 2026. They are quoting the draft.
What it establishes, for transactions on or after 1 January 2027:
Worked example. January 2027. You lose ₹40,000 to a fake customer-care number that walks you through “verifying” your account. You report it to your bank and to 1930 within four days. 85% of ₹40,000 is ₹34,000, which is above the cap — so you receive ₹25,000. Net loss to you: ₹15,000, and you have spent your one lifetime claim.
Change one variable. You lose ₹80,000 instead. The compensation mechanism does not apply at all, because it is built for losses up to ₹50,000. Your recourse falls back to establishing bank negligence or a third-party breach — where liability is zero, but the burden of proof and the 45-day clock both sit with the bank.
The five-day window is the part worth internalising. It is the difference between a defined right and an open-ended dispute.
The framework exists because reported digital payment fraud has scaled with the system. Cases on the National Cyber Crime Reporting Portal went from 2.6 lakh in 2021 to 28 lakh in 2025, and value from ₹551 crore to ₹22,931 crore over the same period.
The vehicle is the Taxation and Other Laws (Amendment) Bill, 2026 — not, as several outlets reported it, a standalone payments bill. It was introduced in the Lok Sabha on 4 August 2026, passed there without debate on 6 August, and cleared the Rajya Sabha by voice vote on 10 August. As of this update it has not received Presidential assent, so it is not yet an Act. It amends three statutes at once: the Income-tax Act 2025, the Finance Act 2026, and the Payment and Settlement Systems Act 2007.
The payments change is one amendment to section 10A of the 2007 Act, and the mechanism is more precise than “UPI can now be charged”:
So the zero-charge protection is not repealed. It is unhooked from tax law and rehung on executive discretion. Whatever the government notifies stays free; whatever it leaves off the list does not. That is the entire change, and it is why nothing about your payments is different this morning.
The number that explains the whole debate: transactions above ₹2,000 are roughly 5% of UPI volume but around 65% of UPI value. A threshold at ₹2,000 exempts almost every transaction while capturing most of the money.
What has actually been decided about a rate: nothing. Finance Minister Nirmala Sitharaman told Parliament the amendment “should not be interpreted as imposing a charge or tax on UPI transactions”, that UPI would remain free for consumers, and that no MDR framework has yet been finalised. Reporting says a UPI and Services Steering Committee headed by NPCI would work out whether any MDR applies, and at what scope.
The reported numbers are worth reading as a spread rather than a figure, because the spread is the honest signal. Industry proposals have been reported at 5 to 7 basis points — 0.05% to 0.07% — on transactions above ₹2,000 for merchants above roughly ₹1 crore to ₹1.5 crore of annual turnover, which would leave around 90% of merchants exempt. Other reporting puts the range under consideration at 0.25% to 0.4%. For scale, the MDR that existed before the 2020 ban was around 0.3%. None of these figures appear in the bill. When credible outlets are a factor of five apart, it is because there is nothing settled to report.
RBI Governor Sanjay Malhotra, asked about it after the 5 August policy announcement, declined to speculate and made one observation worth sitting with: costs have to be paid by someone, and consumers may already be paying indirectly, passed through the wider economy rather than shown on a screen.
That is the honest frame. UPI’s zero-MDR era was funded by government incentive reimbursements to banks for low-value merchant payments. “Free” described who saw the bill, not whether one existed.
On 9 April 2026, RBI published a discussion paper, Exploring Safeguards in Digital Payments to Curb Frauds, with four options:
Comments closed on 8 May 2026. RBI said it would review feedback before issuing draft guidelines. Nothing here is a rule. Banks and fintechs pushed back hard on the one-hour lag, and merchant payments were proposed as exempt in any case. If you have seen a message saying your UPI transfers are now delayed by an hour, that is a discussion paper being read as a notification.
Three of these changes are already in your pocket and you did not notice. One gives you a defined, capped right you will only discover if something goes wrong, five months from now. One has just cleared Parliament and could quietly change the economics of every merchant you pay, without changing a single thing you see. And one is a proposal that half the internet has already reported as law.
Payments are not the only place this happens. India also replaced its entire income tax statute this year, and almost nothing about what you owe changed — which did not stop a great deal of coverage implying otherwise.
The common thread is that your payment rails are getting more instrumented — more checks, more alerts, more logged events per rupee moved. From 1 January 2027, every electronic transaction over ₹500 generates an SMS. If you are paying rent, three SIPs, a house-help transfer and forty-odd small merchants a month across two banks and a credit card, that is a great many more messages arriving and not one more unit of clarity about where your money went.
Which is the actual problem. More alerts is not more insight — it is the same information, arriving faster, in a place designed for reading one message at a time. That gap is what automatic expense tracking in India exists to close, and it is why the capture method matters: an app that reads email alerts rather than your SMS inbox sees the same transactions without asking for the permission that also exposes your OTPs. The small recurring charges are the ones this matters most for, because they are the ones no single alert ever makes look expensive.
Not yet, and nothing has been levied. Both Houses of Parliament passed the Taxation and Other Laws (Amendment) Bill, 2026 on 10 August 2026. It does not charge anything. It moves the decision on which payment modes stay free from tax law to the government’s discretion, by notification. A charge would still need Presidential assent, a notification naming UPI, and a framework the Finance Ministry says has not been finalised. Reported rates and thresholds are press reporting, not text in the bill.
Person-to-person transfers are still capped at ₹1 lakh a day — that did not change. What changed on 15 September 2025 is the person-to-merchant cap, which NPCI raised to ₹5 lakh per transaction and ₹10 lakh a day, and only for verified merchants in specified categories: insurance premiums, capital markets, travel, collections and the Government e-Marketplace. Your own bank may apply a lower ceiling than NPCI’s, which you can usually check and raise inside its app.
Five calendar days, from 1 January 2027, when RBI’s finalised fraud framework takes effect. Report to your bank and to the National Cyber Crime Reporting Portal or helpline 1930 within that window and your liability for a third-party breach is zero. Where the loss came from the bank’s own negligence, liability is zero whether or not you reported. Separately, bona fide victims of fraud up to ₹50,000 can claim 85% of the net loss or ₹25,000, whichever is lower — once in a lifetime.
No. A one-hour lag on push payments above ₹10,000 was one of four options in an RBI discussion paper published on 9 April 2026, with a cancellation window for the payer. Comments closed on 8 May 2026 and RBI said it would review feedback before issuing draft guidelines. No delay has been notified, banks and fintechs pushed back on it, and merchant payments were proposed as exempt in any case. If you have seen a forward saying otherwise, it is a discussion paper being read as a rule.
From January 2027 every transaction over ₹500 sends you an SMS. TLDR Money reads the transaction alerts your bank already sends — read-only, from your Gmail, never your SMS inbox — and turns them into what you spent, what you own, and how far you are from the date your money covers your life.
It is funded by subscription alone, which is the same structural point the MDR debate is making in public: somebody always pays, and it is worth knowing who.
Join the waitlistNo spam, ever.
Status as of 13 August 2026. One item above has passed both Houses but is not yet assented to, and one is a discussion paper — both can still change or lapse, so check the RBI and NPCI notification pages before relying on any of it. This is an explanation of what has been published, not legal or financial advice. TLDR Money is not a registered investment adviser and earns no commission on any product mentioned. The worked examples are illustrative; your own numbers and circumstances will differ.