NPCI Chief Defends UPI MDR Framework Citing AI Cyber Threats and Rising Infrastructure Costs

NPCI Introduces Economic Model to Combat Rising Cyber Threats

National Payments Corporation of India (NPCI) MD and CEO Dilip Asbe has mounted a vigorous defense of the newly introduced merchant discount rate (MDR) on UPI merchant payments, arguing that a market-driven economic model is essential to fund escalating cybersecurity and infrastructure costs. Speaking at the 13th SBI Banking & Economics Conclave on September 24, Asbe warned that AI cyber threats, particularly Anthropic's Claude Mythos, pose unprecedented risks to India's payment systems.2

2

AI-Driven Cybersecurity Measures Demand Massive Investment

Asbe revealed that hackers now possess tools more powerful than those deployed within parts of the payment infrastructure. "The ability and the tools with the hackers are really very powerful compared to what we could actually use inside. And somewhere AI is fairly expensive to use, and we'll have to continue to invest, use AI to make our systems fully protected... (so that) the trust in the payment system is fully maintained," he stated.1

1

Banks and payment companies must continuously invest in AI-driven cybersecurity measures to protect their systems and retain users' trust, according to NPCI Chief Dilip Asbe.

Hardware Costs Surge Five-Fold as Infrastructure Demands Escalate

The NPCI chief highlighted dramatic increases in hardware costs that have strained budgets across the payments ecosystem. Server hardware that cost around ₹20 Lakh a year ago now costs nearly ₹1 Cr—a five-fold increase. "From NPCI perspective, in fact, we have almost utilised our IT budgets of this year and just got one-fourth or one-fifth of the material which we had already planned for," Asbe explained.2

2

He emphasized that insufficient investment across the ecosystem has slowed digital payments penetration, making the MDR framework necessary to sustain growth.

UPI MDR Framework Targets Large Merchants While Protecting Small Businesses

Under the MDR framework taking effect October 15, eligible UPI merchant payments exceeding ₹2,000 will attract an MDR of 0.4%, capped at ₹300 per transaction. Transactions in fuel, railways, telecom, insurance, and capital markets will attract lower or fixed charges.1

1

Asbe estimates the framework could generate ₹13,000 Cr to ₹15,000 Cr during its first year. Critically, around 96% of UPI transactions by volume and 75% by value will remain outside the charging framework. About 75% of merchants accepting UPI payments have never received a single transaction exceeding ₹2,000 and will remain unaffected.

Payment Companies Commit Fresh Investments Following MDR Introduction

Payment infrastructure providers have already announced significant expansion plans enabled by the new revenue model. PhonePe announced it would hire more than 20,000 frontline sales personnel and deploy more than 50 Lakh payment devices over the next year, with roughly half targeting rural areas. The company cited the MDR framework as enabling long-term investments in merchant onboarding and payment infrastructure.1

1

Pine Labs CEO Amrish Rau announced plans to deploy 10 Lakh soundboxes across India, stating, "We wanted to invest back into the payments ecosystem as new monetisation opportunities emerged."1

1

Large Businesses to Bear Majority of MDR Collections

Businesses processing more than ₹1,000 Cr in digital payments annually are expected to contribute around 80% of total MDR collections. Another 10% would come from merchants processing more than ₹1 Cr annually.1

1

Since these merchants already accept credit cards and pay higher MDR fees, NPCI believes they are unlikely to pass the additional cost to consumers. Asbe acknowledged that merchants accounting for the remaining 10% of chargeable payment value might attempt to pass costs to customers, adding that "the banks, NPCI, the acquirers, and the payment aggregators will have to work towards ensuring that the charges are not passed back."2

2

Claude Mythos Emerges as Key Threat to Financial Systems

Asbe specifically named Anthropic's Claude Mythos as one of the threats the MDR revenue will address. Indian regulators have treated Mythos as a significant threat since April, when Finance Minister Nirmala Sitharaman chaired a meeting with bank chiefs and Reserve Bank of India officials, calling the risks "unprecedented."2

2

NPCI has sought early access to Mythos to identify vulnerabilities in India's payment systems, while the Securities and Exchange Board of India named the AI model in a May circular as a concern for market infrastructure.