“AI is fairly expensive to use, and we’ll have to continue to invest, use AI to make our systems fully protected… (so that) the trust in the payment system is fully maintained. So again, a lot of investments will be required on that,” said Dilip Asbe, Managing Director and Chief Executive Officer (MD and CEO) of the National Payments Corporation of India (NPCI).

Asbe defended the merchant discount rate (MDR) on Unified Payments Interface (UPI) payments at the 13th State Bank of India (SBI) Banking & Economics Conclave on September 24. The MDR takes effect on October 15. Under the framework, person-to-merchant (P2M) UPI payments above Rs 2,000 attract a 0.4% MDR, capped at Rs 300 per transaction. Fuel, railways, telecom, insurance and capital markets payments attract lower or fixed charges.

Who pays: Asbe estimated that the MDR will raise Rs 13,000 crore to Rs 15,000 crore in its first year.

  • 96% of UPI transactions by volume and 75% by value fall outside the charge.
  • About 75% of merchants accepting UPI have never received a single payment above Rs 2,000.
  • Businesses processing over Rs 1,000 crore a year in digital payments will pay about 80% of MDR collections.
  • Merchants processing over Rs 1 crore a year will pay another 10%.

According to NPCI, the largest merchants already pay higher MDR on credit cards and are unlikely to pass the new charge to customers. Asbe acknowledged that the remaining merchants might. “The remaining 10%, yes, there is a possibility, and the banks, NPCI, the acquirers, and the payment aggregators will have to work towards ensuring that the charges are not passed back,” he said. He did not say how.

Why NPCI says it needs the money: Asbe said hardware costs have risen sharply, and NPCI has almost used up its own budget. “The 20 lakh server what we used to buy till last year, right now the same server costs about 1 crore. The costs have gone 5x. From NPCI perspective, in fact, we have almost utilised our IT budgets of this year and just got one-fourth or one-fifth of the material which we had already planned for,” he said.

He added that insufficient investment across the ecosystem has slowed the growth of digital payments.

Asbe said the largest participants in UPI must spend ahead of demand. “We will have to continue to invest to ensure that the capacity, the resiliency in UPI, at least the top players, the top 10, 15 banks, top app providers, top acquirers must invest ahead of time in the IT,” he said.

Payment companies announce spending: PhonePe said on September 24 it would hire more than 20,000 frontline sales staff over the next year and deploy more than 50 lakh payment devices over the next 12 months, with about half of those devices going to rural India. The company said the MDR framework lets it take a long view and invest in merchant expansion. It also cited a dedicated fund that earmarks 5% of MDR collections for small merchant expansion. Pine Labs announced plans to deploy 10 lakh soundboxes. “With new monetization levers emerging, we want to walk the talk by investing back into the ecosystem and deepen digital payments adoption,” said Pine Labs CEO B Amrish Rau.

How UPI got here: The Centre removed MDR on UPI and RuPay debit card payments in 2020. At the time, MediaNama founder Nikhil Pahwa wrote, “By removing MDR, the Government of India has effectively destabilised a well-established market norm of incentives in digital payments, and will end up creating perverse incentives in the payments ecosystem.”

  • In August, the Finance Ministry said an NPCI-led “UPI and Services Steering Committee” would decide the MDR once Parliament amended Section 10A of the Payment and Settlement Systems Act, 2007.
  • Finance Minister Nirmala Sitharaman said the MDR would let banks and fintechs “invest more in infrastructure, innovation & security”.
  • PhonePe, Paytm and MobiKwik chief executives have backed the charge. Fuel pump dealers, retailers and industry bodies have opposed it.
  • A Public Interest Litigation (PIL) in the Supreme Court challenges the September 14 Finance Ministry notification and the MDR framework announced a day later.

Asbe names Mythos: Asbe also cited Anthropic’s Claude Mythos as one of the threats the MDR money will address. “The second issue, sir, is this whole cyber risk with the new risk coming in in terms of Mythos and the global models. The ability and the tools with the hackers are really very powerful compared to what we could actually use inside,” he said.

Indian regulators have treated Mythos as a threat to the financial system since April.

  • Sitharaman chaired a meeting with bank chiefs, Reserve Bank of India (RBI) officials and Ministry of Electronics and Information Technology (MeitY) representatives on April 23 and called the risks “unprecedented”. NPCI sought early access to Mythos to find vulnerabilities in India’s payment systems.
  • The Securities and Exchange Board of India (SEBI) named Mythos in a May 5 circular.
  • In June, a small number of Indian cyber, telecom, banking and finance organisations got controlled access to Mythos under Anthropic’s Project Glasswing. Anthropic has not named them.
  • India’s data localisation rules require payment system providers to store transaction data in India, while Mythos runs on US-based servers.

Why it matters: From October 15, merchants will pay up to 0.4% on UPI payments above Rs 2,000, and Asbe has admitted some will pass the charge to customers. The main public reason for the charge is security. NPCI heads the UPI and Services Steering Committee, which the Finance Ministry tasked with deciding the MDR, and its chief rests that security case on NPCI’s own costs and threat assessment. He did not say how much of the Rs 13,000 crore to Rs 15,000 crore will go into security or who will spend it. So neither the merchants nor the customers paying for it can check whether it delivers.

Also read: