In a recent circular, the National Payments Corporation of India (NPCI) has directed all banks and PSP (Payment Service Providers) to moderate and regulate the use of 10 significant, most-used APIs (Application Programming Interfaces), or requests initiated by customers and other stakeholders on the UPI network by July 31, 2025.
These include raising requests for balance inquiry, autopay mandate execution, checking transaction status, and more. This means that going ahead, UPI users will only be able to undertake these transactions a specific number of times during the day.
“PSP banks and/or acquiring banks shall ensure all the API requests (in terms of velocity and TPS — transactions per second limitations) sent to UPI are monitored and moderated in terms of appropriate usage (customer-initiated and PSP system-initiated)”, highlights the circular dated May 21, 2025.
Failure to meet these directions could result in API restrictions, penalties, suspension of new customer onboarding, or other measures deemed appropriate by NPCI for PSPs and banks, the circular further added. Additionally, all PSPs will have to submit an undertaking to NPCI by August 31, 2025, stating that all system-initiated APIs must be “queued and rate-limited”.
According to the circular, all non-customer-initiated APIs must be restricted during peak hours, which are defined as 10 AM to 1 PM and 5 PM to 9:30 PM during the day. Read on to know that these API moderations will impact your UPI transactions post-July.
Requests for balance enquiry, list of linked account numbers to be restricted
The balance enquiry API, through which UPI users can initiate a request for checking their account balance, has been restricted to 50 per app per customer per day from July 31. This means that, for instance, if you use both Paytm and PhonePe, you will only be able to check your account balances on these apps 50 times each within 24 hours. This might be an inconvenience to traders and other users who check their balances or transactions extremely frequently, says Musharraf Hussain, Chief Operating Officer, Ezeepay. However, this is being done so that UPI’s infrastructure core remains stable and available for use by all. “Traders and frequent users who want to check their balances or transaction status may be inconvenienced by the imposed rate limits and mandatory wait time to avoid system overload, which had caused outages before (including a 90-second delay from the time a check transaction status API call was initiated),” says Hussain.
The circular highlights that UPI apps must build adequate infrastructure to must limit or stop balance enquiries during peak hours. And also, to avoid repeated raising of such queries, banks will also have to send the available balance in a customer’s account with each successful transaction notification.
This also means that customers might not be able to get a real-time, updated balance of their accounts on PSP apps, says Pavan Kumar, Chief Product Officer, NPST. However, NPCI has clarified that customers will continue to get real-time, updated balances of their bank accounts even after these directions have been implemented.
Autopay mandate will only work in non-peak hours
Autopay mandates on UPI, which allow users to authorise their bank to automatically debit a specific amount from their account on a recurring basis (daily, monthly, or a pre-decided frequency) for various purposes like daily SIP, Netflix subscriptions, or more, will only be executed during non-peak hours.
“A maximum of 1 attempt, with 3 retries per mandate, can be initiated at moderated TPS only during non-peak hours for autopay mandate”, the circular explains. Note that customers can create autopay mandates even during peak hours, but their execution will only take place during non-peak hours.
For the check transaction API, which lets PSPs and banks request transaction status, the circular compels banks and PSPs to stagger calls to the first check transaction status API for at least 90 seconds from when the transaction is authenticated, and to keep calls limited to a maximum of three in any two-hour window. Also, banks shall treat transactions as failed for certain identified error codes and cease repeated “check transaction status” API calls for such transactions.
Moreover, every acquiring bank will have to get an annual audit done on its system by auditors empanelled with CERT-In, with the first audit report to be submitted on or before August 31 this year.
“Out of the 10 APIs whose usage restrictions have been specified by NPCI, only one is financial (autopay mandate). The other nine are non-financial, thereby meaning financial transactions will not be significantly disrupted during peak hours”, says Kumar.
Similarly, the list account request, which helps a user to find the list of all accounts that are associated with their mobile number, can only be initiated 25 times per app within every 24 hours by one customer. Moreover, this can be triggered only once the customer selects the issuer bank in the UPI app, and will be retried only after customer consent.
