UPI Internals : This is how it works

Yes, we’re talking about – UPI payments are next generation payment platform enables secure, reliable, fast transactions in just few steps, and transaction time is less than 3 seconds, quite popular in India, started with BHIM now Paytm, PhonePe, Google Pay, and many more are integrated with UPI.

What is UPI? 

UPI is a payment system launched by the National Payments Corporation of India (NPCI) in April 2016. It is a bank-led system that allows customers to make instant, real-time payments using their smartphones. The system is interoperable, meaning that customers of different banks can send and receive money using UPI.

Why UPI?

1. UPI allow QR based payment transaction, reduce time to make a payment.
2. UPI offers merchants a low–cost and efficient way to receive payments.
3. UPI payments are credited to the merchant‘s bank account in real–time, which allows them to keep track of their finances more easily.
4. UPI also allows merchants to accept payments from customers without having to share their bank account details or other personal information.
5. It allows merchants to create and manage invoices easily.
6. It allows to enable autopay / setup mandates.
7. UPI Lite allows offline transactions.
8. 2Factor security by default

Scale of UPI?

As per NPCI, this is the latest data from July, 2022.

2 Factor Security Authentication for UPI

• Mobile Device Signature : The first level of security is device fingerprinting. When one links his bank account with an UPI app, device details including IMEI are taken to the NPCI servers. So a combination of the user’s mobile no & device id act as one factor.
• UPI PIN : The next factor is the MPIN. When a user links his bank account with a UPI app, he is required to set an MPIN. This MPIN needs to be keyed in for every transaction.

Future of UPI?

• More security, enabling biometric for transactions
• Outside India, Adoption of UPI has been growing. Nepal, UAE, Singapore are working with NPCI to enable UPI in their banking echo-systems.
• Till 4 July 2022, India already initiated talks with 30 countries for UPI integration.
• Singapore – UPI is accepted at merchant locations to ease transaction experience of Indian tourists. The Reserve Bank of India (RBI) and Monetary Authority of Singapore (MAS) will operationalise interoperability between UPI and PayNow from July, 2022.
• Bhutan – On 13 July 2021, UPI made available to Bhutan through Royal Monetary Authority of Bhutan. Bhutan became the first country to accept UPI transactions through the BHIM app.
• Malaysia – In 2021, Malaysian company Merchantrade Asia partnered with NIPL to send remittance in India through UPI infrastructure.
• United Arab Emirates also enabled to offer real time remittance and signed signed MoU with NIPL in August 2021. NIPL tied up with Mashreq bank in 2021 to increase UPI person-to-person (P2P) and person to merchant (P2M) transactions in UAE.
• Nepal – On 17 February 2022, NIPL announced that it will deploy UPI in Nepal for person to person (P2P), person to merchant (P2M) and to enable cross border remittances with India in collaboration with Nepal’s Manam Infotech and Gateway Payments Service.
• France – NIPL signed MoU with French payment company Lyra Network, that will allow Indian tourists and students make payment using UPI in France.
• Australia – During a bilateral virtual summit on 21 March 2022, India proposed early integration of UPI with Australian New Payment Platform to improve higher education access and tourism potential.
• India and Russia expressed interest in continuing dialogue on accepting UPI and Faster Payments System (FPS) of Central Bank of Russia within their respective national payment infrastructures.

Registration

1. Sandeep wants to open an account and provides his phone number +91 12345678
2. Sandeep performs OTP (One-Time Password) phone verification
3. Sandeep sets up VPA (Virtual Payment Address) bob@axis
4. Sandeep’s payment app creates VPA with the acquiring bank
5. The acquiring bank returns with VPA
6. The payment app returns VPA to Bob Link to Bank Account
7. Sandeep wants to link his SBI bank account with VPA bob@axis. The request is forwarded to NPCI(National Payments Corporation of India).
8. NPCI acts as a switch between acquiring banks and issuing banks. It resolves the account detail from VPA with different issuing banks.
9. Sandeep authenticates with account details and sets the PIN, which is used for 2FA. This goes all the way to the issuing bank.

Direct payment

1. Sandeep scans QR Code of Divya’s UPI ID divya@okicici and the amount
   INR 100.
2. PhonePe verifies the detail and forwards the request to
   NPCI via ICICI bank.
3. NPCI requests Axis Bank to resolve the detail for
   sandeep@ybl.
4. NPCI creates a transaction id for this transaction.
5. NPCI deducts Sandeep’s HDFC bank account by INR 100 and associate that with transaction id
6. NPCI sends an instruction to SBI bank and add INR 100
   to Divya’s account in SBI bank and associate it with transaction id.
7. Upon success, NPCI notifies the payment apps via
   acquiring banks.

UPI Architecture

• NPCI maintains central repository of Account No. + IFSC Code linked to a particular mobile number through it’s UPI interface.
• Whenever it receives request to transfer money from a registered VPA (Virtual Payment Address) along with device information through PSP UPI Apps like PhonePe, Google Pay, Paytm, BHIM, or any other, it creates a transaction.
• Then it checks if bank account selected is having sufficient funds.
• If it has sufficient funds, it puts a lock on the account through request, and initiate the fund transfer request to another VPA (UPI address eventually) then through it’s central repository, it finds out corresponding account information.
• Then it initiates IMPS / AEPS transfer to the payee.

References:

• NPCI
• Product Booklet
• Statistics
• ByteByteGo Blog UPI
• Wiki