UPI Agent Registry: Who Authorized the Payment?

A UPI agent registry could help a payment system recognize the software asking to spend your money. It would still need proof of what you let that software do. A known agent can make a payment that falls outside your instructions.

Consider a hypothetical grocery order. A user lets an assistant buy a weekly basket within a set budget. The assistant picks a different seller and adds a monthly subscription. Even if it stays within the budget, did the user agree to those changes?

The system needs to link the agent to a clear mandate: the user’s recorded permission to spend, with limits it can check. India’s experience with human bank agents offers a useful lesson in how to keep that authority clear.

What should a UPI agent registry establish?

In September 2026, Reuters reported that NPCI was building a registry to vet and monitor AI agents making payments. The report cited unnamed sources. It said NPCI had not immediately responded to a request for comment and that liability for wrong or unauthorized payments remained an issue to address.

While the report gives grounds to discuss the design, it does not establish a final public specification. The controls proposed here are questions for banks and payment teams to test as official details emerge.

First, separate the parties. The developer builds the software, while the provider runs the service the user deals with. The payment app and bank may play separate roles in carrying out the request.

A registry entry should identify the agent and name the firm that answers for it. Before paying, the system must also check the user’s current mandate. Link those records securely and keep private spending details out of a public listing.

Learn from the bank-agent relationship

A person claiming to speak for a bank raises basic questions. Which bank appointed them? What work may they do? Where can a customer complain if something goes wrong?

For commercial banks within its scope, the RBI’s Branch Authorisation Directions, updated in October 2026, address business correspondents. These are people or firms that provide banking services on a bank’s behalf. The rules require defined written agreements and make the bank responsible for their actions, including those of their retail outlets and sub-agents.

The lesson is to keep the chain of authority visible. A badge or a familiar name tells a customer little unless they can check the appointment and its scope. Also check who supervises the work and receives complaints.

The rules for human bank agents do not automatically settle who bears a loss caused by software. Use the comparison to ask who appoints the agent, who checks its work, and who must deal with the user’s case.

Link the UPI agent registry to spending limits

Existing UPI delegation offers a reference. In its November 2025 announcement, NPCI BHIM Services described UPI Circle Full Delegation for trusted contacts. A primary user grants another user payment rights within a monthly cap and a set period. An AI registry would need its own verified rules.

A spending cap leaves several choices open. For example, the system may need to check the payee or allowed type of shop. It should also record whether the user allowed repeat purchases and when the mandate ends.

In the grocery case, a monthly subscription should trigger fresh approval if the user allowed only one order. Also decide how to handle a product swap or a change in delivery charges. Show those terms before the user agrees.

Put the limits in fields that software can check when it pays. Then make sure the plain-language terms match. Our payment API security guide explains why a known caller still needs checks on the action it requests.

Make the stop control work across the chain

Revocation means taking away permission. A user should have a clear way to stop future spending by an agent and see when that change takes effect. Keep that control distinct from changing apps or closing an account.

Also define what happens to a payment already in progress. Stopping future requests does not mean a completed transfer can be reversed. The user needs the correct status and a way to dispute a payment.

Next, test the timing across the service. Once an app says that a mandate has ended, check whether the provider and payment firms stop using it. A stored copy of an expired or revoked mandate must not allow fresh spending.

The provider should also be able to disable an agent whose access has been compromised. That protects users across the affected service. It serves a different purpose from one user’s choice to end a mandate.

Keep evidence that can resolve a dispute

A dispute may concern a wrong product, a wrong amount, or spending beyond the agreed scope. Those are different failures. Keep the user’s instruction and the mandate in force when the agent acted.

Also keep the offer the agent chose, the request it sent, and the payment result. Link those records so that each firm can trace its part in the case. Protect access to the personal data behind them.

Before launch, agree on who takes the complaint and gathers facts from the other firms. The user should not have to piece together the payment chain alone. Any promise about refunds or who bears a loss must match the rules and contracts that apply.

Our human review guide explains why staff need the source evidence behind an AI action. A summary from the same agent may miss the fact that caused the dispute.

Check agents after they join the registry

Registration should start an ongoing review. Look for behavior that differs from the agent’s approved purpose, such as a new pattern of payees. Also examine complaints and attempts to exceed a user’s limits.

After a software update, an agent may choose products or read instructions differently. Define when such changes need fresh tests or a review of its listing. The same agent name can hide a changed service.

Teams may need to restrict one mandate, suspend an affected agent, or raise a wider network alert. Set the evidence and authority needed for each response. Also provide a fair process to review a suspension and restore access.

Our AI sourcing guide can help teams examine the controls behind a service they buy. Ask what the provider can do when it spots a fault and how quickly that action reaches the payment system.

A UPI agent registry specification to test

Begin with an agent ID, the firm responsible for it, and a current status. Record the software version before relying on any checks or certification, and note the scope of those checks. The listing should explain what those checks prove.

Then link the agent to a protected mandate record for the payment it seeks to make. Include the allowed action and its limits, plus expiry and revocation status. Also keep proof of the user’s approval and later changes.

Finally, test a case from instruction to dispute. Change the payee, withdraw the mandate, and introduce a fault between the app and the bank. Check whether each firm can explain its decision and act on the current mandate.

The test of a UPI agent registry is whether the payment chain can answer a user’s question: who allowed this payment, under which terms? Build the identity record and mandate checks so that the answer holds up when someone complains.

For practical analysis of AI in financial services, subscribe to FinTech Briefing.