Dissecting UPI: a DPI by NPCI which we cannot RTI

Nov. 16, 2023

Phew, that’s a lot of Is. The terms like Digital Public Infrastructure (DPI) and Digital Public Goods (DPG) have been used liberally at the G20 summit, and UPI is India’s poster child for all of this. This post will be a summary of a rabbit hole I dug about UPI, NPCI, and other things.

NPCI is the National Payments Corporation of India which is legally a non-profit controlled and funded by the RBI and a bunch of (mostly public) banks. It was started in 2008 and they manage every thing under the sun related to banking. IMPS, NACH, RuPay, UPI, BHIM, and many other systems which are used by Banks and ATMs in India.

RuPay and UPI are of specific interest to me because of how widespread they are. It is quite obvious why the Indian government wanted to start a card company. VISA and MasterCard - both US companies, had a duopoly in India’s cards industry and India needed homegrown tech as an alternative. RuPay cards are issued when accounts are opened under Pradhan Mantri Jan Dhan Yojana for example.

Now, one would expect UPI to be open after all this promotional drama. It is funded by NPCI which is in turn funded by RBI and public banks which is public money. But no.

The NPCI gets support from the state in different forms. RuPay cards, UPI payments, and other NPCI products enjoy zero-MDR. MDR is the amount a merchant pays to a payment processing company for their services. This essentially means the companies cannot charge money from merchants. Wondering why PhonePe is becoming a super app and selling health insurance in cricket world cup ads? You now know why. They cannot make money from UPI payments. This led to the death of small companies, as admitted by PhonePe in their report, and created a new duopoly: PhonePe and Google Pay, both US companies just like VISA and Master Card. NPCI now wants PhonePe and Google Pay to delete some rows from their users table and make sure they are under 30 percent market cap. Much wow. So, how is this functioning when no one is allowed to make money? The taxpayer! Banks get ₹1,300 crore from the government for not charging merchants. The Industry (PCI) is requesting the government to remove the zero-MDR policy or give them ₹4,000 crore. Would UPI become this big if there was an MDR? Maybe not but this sure isn’t sustainable. We already pay a surcharge at fuel stations when we use a credit card to cover these transaction costs, but it is waived by banks in most cases.

So, is NPCI really an independent non-profit or is it a public body? Someone filed an RTI application with NPCI, but in vain. There’s a case on this claiming that NPCI receives funding from the RBI and public banks and that audit of NPCI is conducted by CAG (which only audits government departments). My little digging also revealed that NGOs receiving >95% of funds from the government should be under RTI. But the NPCI says they are an indipendent body facing competition from 90 firms. I wonder if those 90 firms get to promote their products for free by the prime minister. Modi equates patriotism with using the RuPay card. “Everyone cannot go to the border for the security of the nation. We can serve the nation through RuPay card as well” he said. For UPI, he suggested a referral program cum pyramid scheme by asking each person to install and teach how to use the BHIM App, a product of NPCI, to 125 others.

As if those self-claimed 90 competitors weren’t enough, NPCI also tried something neu. No, that wasn’t a typo. They wanted to create competition by issuing licences to set up NEUs, short for new umbrella entity. Billionaires ganged up together under umbrellas, to compete with the biggest umbrella of all, the NPCI. But apparently, their umbrellas weren’t as creative and innovative as NPCI so they shut this neu thing down. If you get to issue licenses for your competitors to exist, are you in a level playing field?

Who owns what aside, is UPI really as open as they claim it to be? It is promoted as a DPG, DPI, what not. They stopped using the term DPG after the alliance created a definition specifically mentioning open source in it.

Digital Public Infrastructure: “networked open technology standards built for public interest, enabling governance, and a community of innovative and competitive market players working to drive innovation, especially across public programmes.” - UNDP

Digital public goods: “open-source software, open standards, open data, open AI systems, and open content collections that adhere to privacy and other applicable best practices, do no harm, and are of high relevance for attainment of the UN SDGs.” - DPG Alliance

UPI is not an app but a kind of network. It almost functions as a communication system sending messages between banks. Is the network open for anyone to participate in? No, you need to jump through a lot of hoops, get a bunch of licenses, NPCI needs to like you, and if everything goes well, have money to burn to fund those MDR losses. Can UPI be FOSS? There is a really interesting talk by Nemo (who doesn’t famously have an Aadhar) on building a FOSS UPI app. librefin works on this.

to be continued…


I write FOSS Weekly, a weekly review of FOSS news, if you are interested in subscribing.