New Delhi: Fresh on the heels of mega unified payments interface (UPI) outage earlier this month that left millions of users stranded, the National Payments Corporation of India (NPCI) has issued a circular to banks to tackle future crisis.
NPCI has asked banks to ensure that all the API requests (traffic) sent to UPI is monitored and moderated in terms of appropriate usage, stating that banks will initiate the first check transaction status API after 90 seconds from the initiation/authentication of the original transaction.
Check out the 9-Point Guidelines issued by NPCI
1. PSP banks/Acquiring Banks shall ensure that all the API requests (traffic) sent to UPI is monitored and moderated in terms of appropriate usage for e.g. restricting high number of repeat API’s for same transactions or older transactions etc.
2. PSP banks/Acquiring Banks shall ensure that there is no batch processing (by processing file and converting to online request at high TPS) of any of the non-financial APIs sent to UPI Online systems.
3. PSP banks/Acquiring banks shall initiate the first check transaction status API after 90 seconds from the initiation/authentication of the original transaction. After the timers are changed (ref. UPI OC 214, dated 26th April, 2025), members may initiate the same after 45 to 60 seconds of the initiation/authentication of original transaction, after NPCI revised communication.
4. PSP banks / Acquiring banks may initiate maximum of 3 check transaction status APIs, preferably within 2 hours from the initiation/authentication of the original transaction.
5. Subsequently, in case of U48 error (Transaction ID not present or not found in UPI System) within first two 2 hours from initiation of the original transaction, then PSP banks / Acquiring banks shall refer the NPCI settlement files (available to Payee, Payer or PSP banks) after the settlement cycle is completed, alternatively members may initiate a maximum of one check transaction status API on UDIR (Unified Dispute and Issue Resolution) which in turn checks URCS (UPI Backoffice) to fetch the final settlement status of the transaction.
6. PSP banks / Acquiring banks shall consider the transaction failed, if they receive an error from the list mentioned in Annexure 1 and shall not initiate further check transaction status API.
7. PSP banks / Acquiring banks shall audit their systems by Cert-in empanelled auditor on an immediate basis, to review the API usage and existing systems behaviour, and annually hereafter.
8. The remitter bank/PSP shall have visibility over specific UPI APIs and are responsible for regularly.
9. NPCI may also consider implementing rate limiters on select UPI API’s in consultation with steering committee and subject to other approvals in due course.
Digital payments via UPI had suffered a nationwide outage on April 12 affecting millions of users, hindering local shopping, bill payments and business transactions. Major banking apps from SBI, ICICI, and HDFC were also affected, pointing to a broader issue within the UPI network infrastructure.