NPCI's Market Concentration Fix: Have You Tried Asking Nicely?
The 30% cap was always going to fail. Here are some ideas that at least have a chance.
On November 5, 2020, NPCI issued a circular mandating that no single UPI app could process more than 30% of total transaction volume. Players already above that threshold were given until December 31, 2022 to comply.
Four months later, in March 2021, an SOP was published providing more detail. Once a payment app crossed 30%, it would be required to stop onboarding new customers. Existing users could keep transacting normally. The SOP repeated this across multiple sections, with some insistence. Just a pause on new registrations, and patience.
To get there, the SOP built a three-level alert architecture. At 25-27%, NPCI would send an email. The Third-Party App Provider (TPAP) and its PSP bank would acknowledge it. At 27.1-30%, a second email, this time requiring the TPAP to furnish “evidence of actions taken.”
The only action available, I assume, would be to stop acquiring new users. A new customer trying to sign up for PhonePe or Google Pay would have to be told: We are too popular right now, please try some other app.
Cross 30%, and the app must stop new onboarding and submit an undertaking. At which point, NPCI may offer an exemption of up to six months. If the share is still not falling after the exemption, NPCI would “discuss the modalities.” If it continued beyond that, penalties under UPI Procedural Guidelines could be levied, or onboarding could be blocked from the central system entirely.
When the original deadline of December 31, 2022 finally arrived, it was extended by two years. When those two years elapsed, it was extended again. The deadline now stands at December 2026, six years after the first circular, and counting. In December 2026, one of two things will happen. NPCI will extend the deadline yet again, a familiar ritual of intent, or it will finally admit that enforcement was never genuinely on the table.
But Market Dominance in Itself Isn’t a Problem, Right?
In China, WeChat Pay and Alipay spent years as walled gardens: a WeChat Pay QR code could not be scanned by an Alipay user, and vice versa. The regulatory pressure to open these networks up took the better part of a decade and is still incomplete.
India built interoperability in from the start. A PhonePe user can pay a Google Pay user without either party noticing the difference. The network effect that makes a single messaging app or social network almost impossible to displace does not apply here in the same way. Better still, every user and merchant added to UPI, whether on Amazon Pay, Cred or Google Pay, strengthens the network for everyone. The rising tide lifts all boats.
And yet, the apps sitting on top of those rails have consolidated as sharply as any closed platform. In January 2026, PhonePe processed 9,914 million transactions — 46.6% of total UPI volume. Google Pay added another 34%. Together, 80.6% of all UPI transactions flowed through two apps. The remaining 83 apps on the platform collectively processed less than one-fifth of what PhonePe alone did.
UPI currently runs on a zero-MDR mandate: MDR, or merchant discount rate, is the small fee that payment networks typically charge merchants per transaction. For UPI, that fee is zero. Even if that ever changes, this is a space where MDR would remain tightly regulated. No dominant player is going to be allowed to ratchet up the price of a UPI transaction to extract monopoly rents. That is a genuine consumer protection, and it mostly works as intended.
At the same time, zero MDR has turned payments into a distribution channel rather than a product. For Google Pay, transaction data adds to an already vast consumer profile, sharpening a picture of what a customer wants, spends on, and worries about. For PhonePe, the payments app provides virtual real estate that hundreds of millions of people access dozens of times a day, and that real estate is then used to sell mutual funds, insurance, loans, flight tickets, and train bookings.
But where you have cross-selling at scale, you potentially have mis-selling at scale. PhonePe has no obligation to highlight the best mutual fund on the market. It will highlight the funds from its partner AMCs, or the ones paying it the highest trail commission. The UX can do the rest: dark patterns, nudges toward higher-margin products, pre-ticked consent boxes, friction applied asymmetrically to exits rather than entries. None of this is unique to the incumbents. But all of it becomes dangerous at 46% of a market.
In March 2020, a moratorium by the RBI on Yes Bank caused PhonePe to shut down completely for twenty-four hours. Yes Bank was PhonePe’s exclusive banking partner at the time. PhonePe has since diversified, but the episode pointed at something larger. A cyber incident, a regulatory action, a critical third-party failure — any of these could do the same today. What gets lost in that scenario is not just access to a payment rail. It is years of a user’s financial life: transaction history, saved billers, mandates, credit integrations, held inside an app they did not choose to make irreplaceable.
A payment app with 150 million daily active users also puts regulators in a bind. Any enforcement action against it risks disrupting payments for millions of ordinary users. So it gets delayed. Once and then again. That is the compounding logic of concentration. As a platform’s footprint grows, the cost of disciplining it rises. Eventually, it becomes too important to regulate on normal terms.
Switching Costs
There is a well-documented asymmetry in how people evaluate switching costs. Giving up a product you already use feels like a loss, and losses psychologically outweigh equivalent gains. The result is a persistent gap between how good a challenger’s product actually needs to be and how good it needs to feel to a user who is being asked to abandon something familiar. That gap is the moat for incumbents.
From roughly 915 million transactions in FY2018 to over 130 billion in FY2024, UPI’s growth curve was nearly vertical.
The vast majority of UPI’s current user base was acquired during the hypergrowth years, when PhonePe and Google Pay were the dominant, most-visible, most-aggressively-promoted options on the market. The habit loop was formed at the precise moment the market was being created, when there was no entrenched alternative to displace.
A user who started using UPI in 2017 or 2018 does not consciously think about their payment app today. They open it, scan the QR, get rewarded with that sweet sound of a successful transaction, and move on. The relationship with the app is, well, transactional.
Yet years of reliable experience have built something the user doesn’t notice until they’re asked to give it up. What happens if a transaction gets stuck on some app I’ve never used before? That fear, rational or not, is compounded by everything else that has quietly accumulated on the incumbent — transaction history going back years, saved billing numbers for electricity and gas connections, recurring autopay mandates for insurance premiums and loan EMIs, UPI Lite balances, credit line integrations. Switching is not just a habit change. It is a migration, and migrations have costs that most users have very few reasons to pay.
This raises a question about what a regulator should legitimately do at all. Behavioural lock-in earned through a genuinely good product is, in principle, legitimate competitive advantage. A regulator who tries to neutralise earned stickiness is punishing success and distorting the signal that markets are supposed to send. You would not mandate that a user switch from Google Search simply because familiarity makes them less likely to try Bing.
In most markets, an incumbent eventually charges for its dominance, and those charges create the opening a challenger needs: come in cheaper and get a foothold. Zero MDR closes that opening. The incumbent cannot monetise its position, but neither can a challenger undercut it on price. The only remaining axes of competition are product quality and distribution, and on both dimensions the incumbents, with their years of data, embedded habits, and Walmart-sized customer acquisition budgets, hold structural advantages that a new entrant cannot easily overcome.
The regulator’s legitimate target should be the structural barriers that prevent any challenger from reaching the scale at which competing habits could form at all. The question is not how to force users off PhonePe or Google Pay. It is how to lower the cost of forming a new habit somewhere else: through transaction history portability that lets users carry their financial data to a new app the way switching phones no longer means losing your contacts, photos, or even default settings.
The 30% cap addresses neither challenger incentives nor the data portability gap that makes switching difficult. It targets the symptom rather than the structure.
Data Portability
In October 2025, NPCI mandated that users be able to view and port autopay mandates across any UPI app of their choice. This matters for a reason beyond its immediate effect. It establishes a principle: that data generated by a user’s financial behaviour belongs to the user, not to the app that happened to record it. A right to data portability was included in the Personal Data Protection Bill of 2019 but did not survive to the final legislation. RBI and NPCI can rekindle it for the financial sector. That principle, if taken seriously and extended consistently, is the thread that unravels the switching cost problem from the inside.
The next logical step is transaction history. There is no reason a user switching apps should lose access to years of financial records. Standardised, exportable transaction history, in a format that any UPI app can ingest, would immediately reduce one of the most underappreciated switching costs. It would also solve a quieter problem: the fragmented transaction history of anyone who has ever used more than one app. The same logic extends to saved billers, splitting groups and credit line integrations.
The cleanest near-term path runs through NPCI itself, which has system-wide visibility on all UPI transactions and could develop a data portability utility that any app can plug into on customer consent. A more elegant architecture already exists in the Account Aggregator (AA) framework which was designed precisely around the idea that financial data belongs to the customer and should travel on consent. Extending AA’s scope to UPI-generated data would require onboarding TPAPs as Financial Information Providers and more difficult work of data standardisation. The dominant players will be least willing to cooperate. Making them the first to comply, through asymmetric obligations tied to market share, should be NPCI’s job.
True data portability will ensure that the cost of leaving is determined by the user’s preferences rather than by accumulated friction. That is what regulation is supposed to do.
Giving Challengers A Fight To Fight
Zero MDR is not one policy. It is two policies that have been bundled together and treated as inseparable.
The first policy is a public good commitment. Small-value, everyday payments should cost nothing. A vegetable vendor in rural Maharashtra should not pay to accept a ₹40 transaction. A migrant in Bengaluru sending remittances to his home in Nagaland should not have to pay an extra fee. That commitment is worth defending.
The second policy is a market structure choice. Nobody competes on price. Ever. For any transaction. That choice, reasonable as a temporary subsidy to drive adoption, has calcified into a permanent feature.
The costs of running this system have never been zero. Between FY22 and FY25, the government paid ₹8,276 crore in subsidies to banks and ecosystem participants to keep UPI transactions free. The government paid out ₹2,196 crore in FY26 and has budgeted ₹2,000 crore for FY27, against an industry ask of ₹10,000 crore. With 300 million transactions processed every day at zero MDR and ₹2,000 crore to cover it, the ecosystem is being slowly starved of the capital it needs to reach the next 300 million users.
The costs that are not recovered do not disappear. They get deferred. And deferred infrastructure investment has a way of making itself visible. NPCI operates the central infrastructure but derives no direct revenue from UPI transactions. Its capacity investment is funded by membership fees, government subsidies, and cross-subsidies from other products. As transaction volumes grow and subsidies are cut, the pressure on that funding model grows. On April 12, 2025, UPI’s payment success rate fell to between 50% and 80% for roughly five hours, the fourth disruption in three weeks. The root cause was a flooding of NPCI’s systems with automated status-check requests, a load the infrastructure was not built to absorb.
NPCI has already quietly acknowledged that zero MDR cannot hold everywhere. By mid-2024, NPCI was in advanced discussions to introduce an interchange of approximately 1.2% for credit line transactions on UPI. The circular was expected within weeks. It never came. But the acknowledgment had been made.
The Payments Council of India has already shown where we should go from here on. Zero MDR preserved for all merchants with annual turnover below ₹20 lakh, roughly 90% of the merchant base by count. A modest 30 basis points on transactions above that threshold, covering approximately 5 million large organised merchants who are already paying 2% for credit card acceptance and are unlikely to abandon UPI over a 30 bps charge. With that, preserve zero MDR for all transactions below a value threshold, say ₹2,000, across all merchant sizes. Above that threshold, introduce regulated interchange tiered by merchant size. A graded MDR structure, designed carefully, would give challengers a price axis to compete on. It would give NPCI a revenue argument for building portability infrastructure.
The 30% cap asked dominant players to shrink. True data portability removes artificial stickiness and empowers the customer. A graded MDR asks the ecosystem to grow in a way that makes room for someone else.
The first approach has had six years. Time for the alternatives?
*The usual disclaimer: views here are entirely my own.