On this page · 13 sections
- Where the 30% cap stands on 1 November 2026
- The numbers: September 2026 market shares
- What enforcement would look like
- Three scenarios for 1 January 2027
- Worked example: how far PhonePe and Google Pay are from 30%
- What it means for each player
- Decision table: what to do before 31 December, by role
- The merchant MDR question is still open
- Engineering implications: UPI Lite, UPI Circle, credit lines and multi-app
- India data and compliance note
- Implementation checklist for November and December 2026
- How eCorpIT can help
- References
Summary. As of 1 November 2026, NPCI has not extended the deadline. Under circular OC-210 of 31 December 2024, existing third-party UPI apps (TPAPs) above the 30% volume cap have until 31 December 2026 to comply, so from 1 January 2027 each must keep its share of UPI transactions over the preceding three months at or below 30%. NPCI's 2021 operating procedure says an app above 30% must stop onboarding new customers. In September 2026, PhonePe processed 10.91 billion transactions (45.57% of listed-app volume) and Google Pay 7.71 billion (32.23%), so both sit over the line. The deadline has moved twice before, in December 2022 and December 2024. The merchant discount rate (MDR) of 0.4% on merchant payments above ₹2,000, capped at ₹300, is also unsettled: due on 15 October, it was deferred on 13 October until after Diwali, and no new date had been notified by 1 November. Plan for three outcomes: a third extension, enforcement with exemptions, or a rewritten rule. The engineering work barely changes between them: onboarding throttles and waitlists for large apps, MDR-aware ledgers for merchants and aggregators, and UPI Lite, UPI Circle and credit lines for challengers.
About this article. This is for product and engineering leads at UPI apps, PSP banks, payment aggregators and merchants. We checked NPCI's 2021 operating procedure and its 2024 circular, RBI circulars, and dated reporting on NPCI's app-wise data and the MDR rates, as of 1 November 2026. It is not legal or financial advice; NPCI can issue a new circular at any time, so re-check before you act, and no company paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
Where the 30% cap stands on 1 November 2026
The rule is live on paper, the deadline is 31 December 2026, and NPCI has published nothing new. Circular OC-210, dated 31 December 2024, says that after considering various factors NPCI was giving existing TPAPs above the volume cap two more years, to 31 December 2026. Our searches on 1 November 2026 found no successor circular and no credible report of a further extension.
The first extension came in circular OC-159 of 2 December 2022, four weeks before the original deadline. The second was issued on 31 December 2024, the day the previous deadline expired. If NPCI publishes a new circular before you read this, it overrides everything below.
The table draws on the SOP and OC-210 for NPCI's instruments, TechCrunch for WhatsApp Pay, and MediaNama for the MDR dates.
| Date | Instrument | What it did |
|---|---|---|
| 5 Nov 2020 | NPCI/UPI/OC-97/2020-21 | Introduced the 30% volume cap per TPAP from 1 January 2021; existing apps above 30% got two years |
| 25 Mar 2021 | NPCI/UPI/SOP-01/2020-21 | Operating procedure: alerts at 25% to 27% and 27.1% to 30%, onboarding stop above 30% |
| 2 Dec 2022 | NPCI/UPI/OC159/2022-23 | Moved the compliance deadline from 31 Dec 2022 to 31 Dec 2024 |
| 31 Dec 2024 | NPCI/UPI/OC210/2024-25 | Moved the deadline to 31 Dec 2026; WhatsApp Pay's 100 million user limit lifted the same day |
| 15 Sep 2026 | DFS and NPCI MDR rates | Set 0.4% MDR on merchant payments above ₹2,000 from 15 October 2026 |
| 13 Oct 2026 | NPCI statement | Deferred MDR until after Diwali, date to be notified separately |
Two details are often missed. The cap applies to third-party apps; Business Today reported that UPI apps offered by banks are excepted. And the 2021 SOP counts volume on the payer side only. An app acting as payee (QR codes, soundboxes, collect requests it raises for merchants) faces no restriction and may keep onboarding customers and merchants to receive money.
The numbers: September 2026 market shares
The SOP requires NPCI to report app-wise volumes on its website, but NPCI publishes no total for listed apps. We rely on two dated analyses of that dataset: MediaNama's September 2026 breakdown of 24 October and Inc42's August breakdown of 16 September. The table uses MediaNama's figures; the Navi and super.money shares are our arithmetic.
| App | Sept 2026 transactions | Sept 2026 share | Sept 2025 share | Distance from 30% |
|---|---|---|---|---|
| PhonePe | 10.91 billion | 45.57% | 46.47% | 15.6 points over |
| Google Pay | 7.71 billion | 32.23% | 35.43% | 2.2 points over |
| Paytm | 1.94 billion | 8.1% | not in source | under |
| Navi | 1.14 billion | about 4.8% | not in source | under |
| super.money | 405.1 million | about 1.7% | not in source | under |
These shares use MediaNama's denominator of 23.93 billion transactions through NPCI-listed apps. Total UPI volume in September was 24.07 billion, worth ₹29.37 trillion, up 22.6% from 19.63 billion a year earlier. Against total volume, PhonePe's share is 45.3% and Google Pay's 32.0%.
The trend is slow. The two leaders held 81.9% combined in September 2025 and 77.8% in September 2026. On Inc42's figures they held 78.6% in July and 78.3% in August, while Navi climbed from 3.7% in June to 4.4% in August. Kotak Mahindra Bank's apps moved up to ninth place in September, from 11th.
These are not compliance figures, as MediaNama itself points out. The SOP measures an app against all UPI volume over three months, leaves cashback, refunds and similar credits out of the app's own count, and adds on-us transactions that never pass through NPCI's central system. A rough rolling estimate for July to September 2026 puts PhonePe near 45.8% and Google Pay near 32.3% (arithmetic below).
What enforcement would look like
The 2021 SOP is the only published enforcement playbook, and it is more gradual than the headlines suggest.
Alerts first. At 25% to 27%, NPCI writes to the app and its PSP banks, which must acknowledge. At 27.1% to 30%, they must show evidence of corrective action, such as moderating onboarding, promotions or cashback.
Onboarding, not transactions. Above 30%, the app and its PSP banks must stop onboarding new customers and give NPCI an undertaking. A new customer is a new device-binding request; a user who changes phone, upgrades the app or adds a backup handle on the same app is not new. Existing users' transactions are not to be declined, as far as possible.
Exemptions and moderation. On the app's request through its PSP bank, NPCI can grant an exemption of up to six months, which it may extend. During it, the app may run moderated onboarding: accepting up to 50% of the onboarding requests it received over the previous three months, under an action plan NPCI approves.
Penalties and central blocking. If a breach is not remedied, NPCI can levy penalties under the UPI Procedural Guidelines and block new-user onboarding for that app from its central system.
A scripted waitlist message. The SOP gives sample wording for turned-away users: the app explains that NPCI rules bar apps above 30% share from adding customers, states its current share, apologises, and promises to notify the user when onboarding reopens.
PhonePe's chief executive Sameer Nigam set out the incumbents' objection in 2022. He told Moneycontrol, as MediaNama reported, that no app can cut its own share without actively refusing service to users.
Three scenarios for 1 January 2027
We do not assign probabilities. History favours extension, and we found no report of NPCI ever applying the onboarding stop to PhonePe or Google Pay. But the leaders' combined share is drifting down, and NPCI lifted WhatsApp Pay's user limit on the same day it last extended the deadline.
| Scenario | Signal to watch | What changes on 1 January | Who feels it first |
|---|---|---|---|
| A. Third extension | A new NPCI circular, in December if it follows the 2022 and 2024 pattern | Nothing operational; the date moves again | Challengers whose investor pitch leans on the cap |
| B. Enforcement under the 2021 SOP | No circular by 31 December, or one confirming the date | PhonePe and Google Pay face onboarding stops or moderated onboarding, likely with exemption requests | New smartphone users, steered to other apps; challengers with onboarding capacity |
| C. Rule rewritten or dropped | A circular changing the percentage, measure or scope | Depends on the new rule | Everyone's compliance models |
Scenario C is not idle speculation. In September 2024, Inc42 reported, citing TechCrunch's sources, that NPCI was considering allowing apps more than 40% share. NPCI never confirmed it, and the December 2024 circular kept 30%. The SOP also says NPCI will, in due course, extend the cap to other UPI players if growth or new concentration risk calls for it, so banks should not assume they will stay outside it forever.
Worked example: how far PhonePe and Google Pay are from 30%
This arithmetic uses the September figures above and Inc42's July and August data. It is illustrative, not a forecast.
September only. 30% of 24.07 billion is 7.22 billion transactions. PhonePe processed 10.91 billion, so it was 3.69 billion over: about 123 million a day, against September's record daily average of 802 million. Google Pay processed 7.71 billion, 0.49 billion over.
Rolling three months. July to September volume was 23.66 + 24.51 + 24.07 = 72.24 billion, so the 30% line is 21.67 billion. PhonePe's July volume, estimated from Inc42's 46.1% share, is 0.461 × 23.66 = 10.91 billion; adding 11.25 billion for August and 10.91 billion for September gives 33.07 billion, about 11.40 billion over, or 45.8% of the total. Google Pay's July estimate is 0.325 × 23.66 = 7.69 billion; with about 7.9 billion in August and 7.71 billion in September it reaches 23.30 billion, about 1.63 billion over, or 32.3%.
What an onboarding freeze does. Suppose enforcement stopped all new users, each app's volume stayed flat, and UPI kept growing at September's 22.6% annual rate:
- PhonePe falls to 30% when monthly UPI volume reaches 10.91 / 0.30 = 36.37 billion. That takes ln(36.37 / 24.07) / ln(1.226), about 2.0 years.
- Google Pay falls to 30% at 7.71 / 0.30 = 25.70 billion: ln(25.70 / 24.07) / ln(1.226), about 0.32 years, or roughly 4 months.
Existing users transact more over time, so flat volume is optimistic. If each app's volume grew at half the market rate (11.3% a year), the time becomes ln(current share / 0.30) / ln(1.226 / 1.113): about 4.3 years for PhonePe, starting from 45.3%, and about 8 months for Google Pay, starting from 32.0%.
The takeaway: enforcement would not hand challengers the incumbents' existing volume; it would redirect new users. Under these assumptions Google Pay could get under 30% within a year. PhonePe cannot get there quickly without exemptions or a rule change, which is NPCI's December problem.
What it means for each player
Third-party apps above the cap. PhonePe and Google Pay need to be ready for Scenario B even if they expect Scenario A: an onboarding throttle that can run at 0%, 50% or 100% without an app release, a waitlist that captures intent, and a clean split between new device bindings and re-bindings. Revenue is exposed too. Covering PhonePe's IPO pause in March 2026, MediaNama reported that its payments business earned ₹3,231.7 crore in the first half of FY26, over 82% of revenue, and judged that the cap would dent that revenue. In September, Inc42's sources said PhonePe was now aiming to list in February or March 2027, which puts the cap decision inside its IPO window.
Banks and PSP banks. Banks' own apps sit outside the TPAP cap, and the SOP makes PSP banks part of enforcement. A sponsor bank should map which apps sit in which alert band, rehearse the acknowledgement and undertaking process, and confirm that on-us volume is reported before the third day of each following month, after which NPCI ignores it.
Merchants and aggregators. The cap does not apply to merchants, but a shifting payer-app mix changes checkout success rates; see our piece on multi-PSP UPI checkout. The nearer issue is MDR.
New entrants. Business Today counted 17 new TPAPs in 2024, including Aditya Birla Capital Digital and Flipkart. The cap has applied to every new TPAP since 1 January 2021, and under Scenario B, KYC, device binding and SIM checks must hold up under a surge of first-time users. Our explainer on SIM binding for messaging apps from January 2027 covers the device-binding rules arriving at the same time.
Decision table: what to do before 31 December, by role
| If you are | Do this in November and December | Why |
|---|---|---|
| A TPAP above 25% share | Put onboarding behind a server-side throttle; draft the waitlist message; prepare an exemption request with your PSP banks | The SOP's alerts start at 25%; onboarding stops above 30% |
| A challenger TPAP under 10% | Load-test onboarding (KYC, device binding, SIM checks) at several times normal peak; ship UPI Lite and UPI Circle | Displaced new users go to apps that can take them |
| A bank or PSP bank | Map sponsored apps to alert bands; rehearse undertakings; review your own app's onboarding funnel | Bank apps are outside the TPAP cap; PSP banks carry enforcement duties |
| A merchant or payment aggregator | Tag every payment by funding source and payee type; update reconciliation for MDR plus GST; render installed apps dynamically | MDR start date is pending; payer-app mix may shift |
| A founder launching a TPAP in 2027 | Build rolling three-month share monitoring and a throttle into v1 | The cap has applied to new TPAPs since 1 January 2021 |
The merchant MDR question is still open
MDR is separate from the cap but lands in the same window, and it gives TPAPs a direct revenue line on larger merchant payments after years of zero MDR. The Department of Financial Services and NPCI published the rates on 15 September 2026. Per MediaNama's summary of NPCI's FAQ:
- Person-to-merchant (P2M) payments above ₹2,000: 0.4%, capped at ₹300 for payments of ₹75,000 and above.
- Capital-market payments: 0.02%, capped at ₹300.
- Railways, telecom, insurance, fuel, electricity, water and piped gas: flat ₹5 per payment above ₹2,000.
- Exempt: payments up to ₹2,000, person-to-person transfers, and small (P2PM) merchants receiving up to ₹1 lakh a month. A merchant above ₹1 lakh a month for three consecutive months moves to P2M.
- UPI AutoPay recurring payments do not carry the prescribed rate, and RuPay credit cards on UPI and bank credit lines follow separate credit-product rules. MediaNama's October reports put loan repayments through AutoPay mandates at a flat ₹5.
NPCI quotes the rates excluding GST, and tax experts expect 18% GST on top. On a ₹3,000 payment that is ₹12 of MDR plus ₹2.16 GST; on ₹1 lakh, ₹300 plus ₹54.
Then the rollout stalled. Merchant bodies and fintechs asked NPCI to delay until January 2027. On 13 October, two days before the start date, NPCI's UPI and Services Steering Committee deferred implementation until after Diwali, with the date to be notified separately and the fee structure unchanged. No date had been notified by 1 November. Separately, on 28 September the Supreme Court declined to stay the MDR and issued notice to the Centre, the RBI and NPCI on a petition challenging it. PhonePe, Paytm and MobiKwik back the 0.4% rate. Build so the start date is a configuration value, not a release.
Engineering implications: UPI Lite, UPI Circle, credit lines and multi-app
Challengers need volume per user without new device bindings. For incumbents near the cap, the same features push share up. The limits below come from the RBI, NPCI and Razorpay's summary of NPCI's UPI Circle guidelines.
| Feature | Current limits | Why it matters in 2027 | Build note |
|---|---|---|---|
| UPI Lite | ₹1,000 per payment, ₹5,000 wallet balance (RBI, December 2024) | PIN-less small payments without a real-time call to the bank's core system | Design top-up and balance display carefully |
| UPI Circle | Up to 5 secondary users; full delegation up to ₹15,000 a month and ₹5,000 per payment | Brings people without their own linked bank account onto UPI | Primary and secondary users may use different apps |
| Credit line on UPI | Scheduled commercial bank credit lines since September 2023; small finance banks added after the RBI's December 2024 policy statement | Credit becomes a UPI funding source outside the standard MDR | Since June 2026, prudential norms follow the underlying loan |
UPI Lite. The RBI raised the limits from ₹500 and ₹2,000 on 4 December 2024. Lite suits frequent small payments, and payments up to ₹2,000 stay at zero MDR.
UPI Circle. NPCI describes delegated payments for a secondary user with or without a bank account linked to UPI, with examples such as a college student, an older parent or household help. Per Razorpay's summary of NPCI's guidelines, primary and secondary users can each use any UPI app, so a challenger can win the secondary user without the primary switching. Ask your PSP bank how such payments are attributed under the payer-app rule.
Credit lines. The RBI's September 2023 circular, updated in February 2025, adds pre-sanctioned bank credit lines to the savings, overdraft, wallet and credit-card accounts UPI can already use. On 23 June 2026 the RBI said these lines carry the prudential norms of the underlying loan, whatever the payment channel. Our UPI 2026 builders' note covers the product case.
Funding-source-aware ledgers. MDR depends on payee type, category, amount and funding source, and P2PM status turns on a three-month test, the same length as the cap's window. Store these attributes at write time. The sample below is illustrative only, not an NPCI format:
# Illustrative attributes to persist per UPI transaction (not an NPCI format)
txn_id: "T2027010100001"
payer_app_handle: "@exampleapp" # the TPAP the volume counts against
initiation_mode: "intent" # intent | qr | collect | autopay
funding_source: "savings" # savings | overdraft | credit_line | rupay_credit | upi_lite
payee_type: "P2M" # P2P | P2PM | P2M
merchant_category: "fuel" # flat Rs 5 vs 0.4% vs 0.02%
amount_paise: 350000
mdr_rule_version: "pending-start-date"
Onboarding throttles and checkout. A TPAP should be able to change onboarding intake with a server-side flag, keep re-binding working, and log every decision for the PSP bank. At checkout, do not hardcode a three-icon app grid, and keep status polling within NPCI's limits, covered in our guide to UPI's OC-215 API caps.
India data and compliance note
Device-binding records, payer handles, UPI Circle relationships and credit-line usage are personal data under the Digital Personal Data Protection Act, 2023, and payment system data must be stored only in India under the RBI's 2018 storage directive. A waitlist that stores phone numbers needs a stated purpose, a retention limit and a deletion path. A ledger that tags funding source for MDR should not become a credit-profiling dataset without consent. Our DPDP Act engineering playbook covers the controls. Confirm your obligations with your PSP bank, aggregator and counsel.
Implementation checklist for November and December 2026
- Name one owner to check NPCI's UPI circulars and press releases daily from 1 December.
- Recompute your rolling three-month share when NPCI publishes October app data.
- TPAPs: ship a server-side onboarding throttle (0%, 50%, 100%) and test it behind a flag.
- TPAPs: build the waitlist screen from the SOP's sample wording, with a DPDP-compliant retention policy.
- TPAPs: separate new device bindings from re-bindings in analytics.
- PSP banks: rehearse alert acknowledgements and undertakings with each sponsored app.
- Merchants and aggregators: store funding source, payee type and category on every payment; show MDR and 18% GST as separate reconciliation lines; keep the MDR start date in configuration.
- Challengers: load-test KYC and device binding at several times current peak, and ship UPI Lite and UPI Circle before January.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. We build onboarding throttles, waitlist flows, MDR-aware transaction ledgers and UPI Lite, UPI Circle and credit-line features with your PSP bank or aggregator, as set out on our fintech and payments app development page. Talk to us at /contact-us/.
Last updated: 1 November 2026.
