Why is UPI seeing frequent downtimes? | Explained

The story so far: In March and April, the Unified Payments Interface (UPI) system went down three times, causing significant disruptions in payments on apps like GPay and PhonePe, which rely on the system. One of the downtimes was caused by individual banks flooding the National Payments Corporation of India’s (NPCI) systems with transaction status checks.

How does UPI work?

UPI payments work based on an architecture that was inherited from the Immediate Payment Service (IMPS). For UPI payments to work, a bank is required to join the UPI system and allow users to access their own accounts through a linked phone number, on a Payment Service Provider (PSP)’s app, like PhonePe or GPay. Practically every commercial bank, public or private, is on the UPI system.

UPI is designed as an interoperable system, allowing any bank’s account holders to sign up for the service on any app, and even multiple apps at the same time. This resembles a peer-to-peer system, where individual banks are all talking to each other, but in reality, practically every transaction is routed through the systems of the NPCI. “The NPCI is essential in this process,” said Srikanth Lakshmanan, a member of the Cashless Consumer project, as it encrypts the PIN information — which only the bank knows — and sends the payment information forward to a payer’s bank, which then executes the transaction. “So if there’s a downtime in the NPCI, there’s no way your bank would get your PIN. This is where it is a single point of failure.”

Why did the NPCI have several outages?

The NPCI as an organisation is structured as a collective of banks, with public sector banks holding the bulk of its shareholding. This, Mr. Lakshmanan said, is because of the Payment and Settlement Systems Act, 2007, which mandates that organisations involved in clearing transactions in bulk have to be majority-owned by public sector banks. Led as it is by banks, the implementation too is largely left to them, though the NPCI has played a big role in designing and presiding over the UPI system. In the last few weeks, individual banks reportedly flooded the UPI system with “check transaction” requests, which payer banks use to verify that a payment has been completed. That hit the single point of failure at NPCI, and took the system offline briefly. To reduce the impact of downtime like this, the NPCI has created something called UPI Lite, which allows users to set aside up to ₹2,000 for payments without having to punch in a PIN. But even such payments go through the NPCI’s systems. “You don’t do a PIN authentication, but other communication still goes through NPCI,” Mr. Lakshmanan said. “The NPCI has to say this transaction originated from your device and so on. This is why even though UPI Lite doesn’t involve the PIN entry and decryption, it is still routed through NPCI since it’s fundamentally an interoperable system. While UPI Lite is light, it still requires NPCI to be in the middle.”

Why are banks peeved?

Banks have historically had a rocky relationship with UPI. While the system has revolutionised payments in India — just on Friday, there were over 58 crore transactions worth over ₹73,000 crore — they are largely unable to collect any significant fees on transactions, even though there are costs attached to each of these.

The RBI estimated that banks incur a cost of ₹0.80 per transaction, due to SMS notification costs (which telecom operators collect for commercial messages), and the costs incurred in maintaining and updating records of each payment. However, they are not able to charge a Merchant Discount Rate (MDR) for these services, leaving them with few incentives to keep to rigorous uptime standards. Individual banks go down far more frequently than the NPCI as a whole, and these outages result in increased payment decline events. System-wide downtimes are far fewer and shorter on commercial card networks like MasterCard and Visa, Mr. Lakshmanan said, as there is robust monitoring and service level agreements to enforce performance standards.

However, he said, the Ministry of Electronics and Information Technology has tried a “carrot and stick” approach, with its annual UPI incentive programme for banks, which comes attached with conditions that penalise banks whose performance suffers over the course of a year. The subsidy scheme compensates banks for their current inability to charge an MDR. “If you’re at the bottom [in terms of uptime], you get nothing,” Mr. Lakshmanan said.