The National Payments Corporation of India (NPCI) is reportedly taking a firm stance against unauthorised use of virtual IDs generated for Unified Payments Interface (UPI) transactions. According to a report in Economic Times, certain fintech firms have been offering a service that allows businesses to authenticate users using their UPI IDs, a practice that violates NPCI and Reserve Bank of India guidelines.
All member banks and third party payment apps have also received a copy of the
letter.
In a letter to fintech companies, NPCI has instructed them to discontinue these
unauthorised services. The letter states that UPI APIs are solely for facilitating UPI
payments and user verification for fraud prevention and should not be used for
any other purpose.
“NPCI has observed instances of unauthorised use of UPI APIs by certain
participants. In accordance with the guidelines set forth…the UPI APIs provided by for required verification of users for fraud prevention. These APIs must not be
used independently for any other purposes other than the above mentioned,” the
letter read.
Identity verification platforms, payment aggregators, and other fintechs have been
offering this service by leveraging UPI application processing interfaces (APIs)
provided by NPCI. These APIs enable businesses to integrate their systems and
facilitate information flow.
NPCI has emphasised that participating members are prohibited from entering into
commercial arrangements with third parties for the provision of “APIs as a
service.” Any violations of these guidelines will be dealt with strictly, including
penalties or cessation of UPI services. “Any violation of these compliance
guidelines will be dealt with the utmost severity, including the imposition of
penalties or cessation of UPI services,” the letter added.
By using the NPCI network for UPI payments, these platforms can verify various
details of a user, such as their name, bank account status, mobile number, and
alternate UPI IDs. This information is valuable for consumer-facing brands to
authenticate users, prevent fraud, and build stronger customer profiles.