India's NPCI introduces UPI fees citing AI cyber threats

India's National Payments Corporation (NPCI) is set to introduce a merchant discount rate (MDR) on certain Unified Payments Interface (UPI) transactions effective October 15. This new charge aims to finance critical investments needed to protect the payment system against evolving cyber threats, including those leveraging artificial intelligence.

Dilip Asbe, Managing Director and CEO of NPCI, stated that the MDR will apply to person-to-merchant (P2M) UPI payments exceeding 2,000 Indian rupees (approximately $24). The rate is set at 0.4%, capped at 300 rupees per transaction. Asbe projected that the MDR would generate between 13,000 to 15,000 crore rupees (approximately $1.5 to $1.8 billion) in its first year. He noted that 96% of UPI transactions by volume and 75% by value will remain outside the scope of this charge.

Asbe justified the implementation of the MDR by citing significant increases in hardware costs and NPCI's constrained IT budgets. He specifically mentioned AI-driven cyber risks, such as those posed by advanced models like Anthropic's Claude Mythos, which necessitate continuous investment to ensure system security and maintain trust. Large merchants processing over 1,000 crore rupees annually in digital payments are expected to bear approximately 80% of the collected MDR.

While acknowledging that some smaller merchants might pass the charge on to consumers, Asbe indicated that most merchants, who already face higher MDRs on credit card transactions, are unlikely to do so. India's Finance Ministry has previously stated that the MDR would enable banks and fintech firms to invest further in infrastructure, innovation, and security. Payment companies like PhonePe and Pine Labs have announced plans to reinvest in the ecosystem, citing the emergence of new monetization avenues.