INTRODUCTION
India’s digital payments infrastructure has gained considerable economic importance, disrupting the legal landscape dominated by the Payment and Settlement Systems Act, 2007. UPI’s rapid evolution from a payment system overlay to the payments rails begs the question: can the Payment and Settlement Systems Act, 2007 still be the legal benchmark that is most suitable to regulate this new payment system?1
The Payment and Settlement Systems Act, 20072 was established to monitor and control India’s payment ecosystems and empower the Reserve Bank of India. Termed the UPI, the Unified Payments Interface3 is a real time payment infrastructure developed by the National Payments Corporation of India and based on real time, interoperable, secure payment frameworks amongst financial/ banking institutions and payments/routing applications. Payment systems have become the legal means of transacting easy small payment systems, merchant and person-to-person payment systems; therefore, there is a legal implication of systems dealing. The central idea of the author stems from this implication: the function of the payment systems requires a legal framework that is corresponding to that function.
While the terms operator, participant, authorization, clearing, and settlement contribute to an understanding of the payments system, they do not explain the complete context of the system. The Unified Payments Interface, as described by the National Payments Corporation of India, allows bank account holders to amalgamate all of their bank accounts into one app, enabling immediate interbank payment transfers. The Reserve Bank of India has noted that, when it comes to the number of transactions, the Unified Payments Interface dominates the Indian payment systems. Given the size and importance of this system, one can begin to understand the system as an infrastructure, and not a product.4
This Article employs the doctrinal research method which establishes governability by analysing the payment and settlement systems act (2007) against a regulatory circular, documentation, and admissible anti-fraud, privacy, and competition law. The method is synthetically structured due to the central problem of fragmentation. No uniform response meets the legal governance of payment rail (GR) systems for everyday participation in the economy.5
This Article is structured in four parts. The first part establishes that the Unified Payments Interface (UPI) is in functional terms of public digital infrastructure. The second part substantiates that the Payment and Settlement Systems (PS) Act, 2007 is axiomatically structuring settlement, whereas the third part explains the legal friction created by the settlement structuring. Essentially, the Article concludes that to preserve and provide legal friction, the right infrastructure duties model should be employed.6
FROM PAYMENT INNOVATION TO PUBLIC DIGITAL INFRASTRUCTURE
This part of the Article explains how the Unified Payments Interface (UPI) has no longer been a marginal legal technology in terms of economic participation, and outlines how interoperability, universality of use, and dependence of the technology are legal factors that justify line of digital legal infrastructure.7
A. Institutional design and infrastructural character
The Unified Payments Interface’s (UPI) institutional design does not resemble that of a proprietary payments product. This payment platform was constructed by the National Payments Corporation of India with the authority of the Reserve Bank of India8. This is where something like a hybrid institutional form comes into play. It is accurate that the State in the narrow sense is not the operating layer here of the system. This system is not a private closed loop, nor a bilateral bank system. It is designed with the participation of multiple banks, common technical guidelines, and interoperable access, which is what makes the system a shared public utility. This design, in fact, makes the system resemble a shared public utility rather than a traditional public product that is market exchanged.
The system’s interoperability is what sets it apart. For the first time, it is possible through the Unified Payments Interface to make bank and application and cross-faceted payments and transfers through proprietary networks. This is significant not only economically, but also legally, because it articulates a new dimension on the right to exclusion. In traditional proprietary payment systems, the absence of competition on the closed payment service is not necessarily a harm. In this case, where payments of various kinds through interoperable systems9 serve as the primary method of payment, the harm is created by the absence of competition. The law comes to the task of establishing rules to govern payment systems with the appropriate level of detail. The law will then also need to answer the questions of who’s entitled to operate in the system, under what conditions, and what criteria are used to structure and justify system access and exclusion.
The Unified Payments Interface’s (UPI) design increasingly targets mass users, embedding strategies for infrastructural inclusivity in its offerings. The National Payments Corporation of India has introduced Unified Payments Interface 123PAY10 for feature phone users and Unified Payments Interface Lite11 for transactions of a lower value. Such design moves exemplify that Unified Payments Interface is for a broad range of audiences and stakeholders and is now a public utility. When an infrastructural design serves all users irrespective of their transaction values, literacy, and available devices, the regulatory evaluation should refocus away from innovation criteria and towards continuity, fairness, resilience, and the right to redress.
B. Scale, dependency, and network centrality
Scale is a substantive change and changes the positive obligations of a system. The National Payments Corporation of India has published their data in January – March 2026. The data has shown an increase of 21,703.44 to 22,641.11 transactions (millions) in March, an almost 1,200 million increase from January. This data has shown a simultaneous increase in transaction value of 28,334,812.22 to 29,525,420.05 (Indian Rupee) as well an increase of 691 to 705 participating banks (of the system)12. Even a month or two change has shown the system to deep and get broader.
Figure 1 indicates that the broader expansion was only temporarily interrupted by the dip observed in February 2026. Of greater legal relevance is the fact that the number of engaged banks continued increasing, and the value and volume of the transactions sustained remarkably high levels. These factors indicate a long-term populism and, even more importantly, a long-term reliance13. A payment rail achieves infrastructural status when a large number of user and merchant communities begin to organise their conduct in a habitual way, based on the payment rail’s availability, interoperability, and low cost.
This payment rail’s integration into the habitual conduct of user and merchant communities is significant to public law reasoning. If public digital infrastructure becomes social infrastructure, even without State ownership, it will likely attract certain infrastructure duties/obligations. This is true if the system is demonstrably socially essential, if it is relatively more difficult for the average user to substitute it, and particularly, if the service provider’s or regulator’s governance decisions impact the service system’s availability for large-scale economic participation. From a doctrinal viewpoint, the question is if the Unified Payments Interface is similar to other systems in terms of coordination capabilities and value cascade in digital commerce.14
Figure 1. Unified Payments Interface monthly scale, January to March 2026.
Monthly volume and value remained unchanged, and the number of participating banks continued to grow, showing respondent banks’ tolerance, which is a separate indicator of infrastructural depth. Transaction dependence and participation breadth grew in the same period.
THE PAYMENT AND SETTLEMENT SYSTEMS ACT, 2007 AND THE LIMITS OF SETTLEMENT-CENTRIC REGULATION
In the domain of legislative hierarchy, the Act of 2007 is the most substantive statute. It was enacted to address the requests made by banks and officials to build a legal framework for the authorisation, supervision, and imposition of settlement finality15. This segment of the essay shows that the imposition of settlement finality, authorisation, and supervision functions of the ‘three pillars’ of infrastructure banking governance are crucial.
A. Statutory strengths of the existing framework
From a governance perspective, the first principles approach in the Act of 2007 is commendable. Section 4 of the Act16 prohibits any person or entity from establishing or running a payment system unless authorised by the Reserve Bank of India to do so. This, in conjunction with the Reserve Bank of India’s (RBI) own interpretive statements, allows the Reserve Bank of India to exercise dominance over the payment systems, as the RBI for payment systems is the sole operator. These provisions, as a theory and in practice, are ideally placed to deal with the first order functions of the governance of banking supervision, systemic control, and regulation.17
This Act is careful to consider the integrity of the overall system of settlements. Its provisions on the boundaries of the system of settlements, the supervisory and guidance system, and the system of settlements being final, show that the payments system cannot be considered like other private systems. Failures that occur in settlement systems may transmit system-wide risks to other participants within the system and erode confidence in the payment system. Therefore, the statutory centre of balance is on the safe management of the systems in operation. While such a system design may be suitable to address systems of clearing and settlement risks, it leaves little space to accommodate provisions that may be raised in relation to a payment system that has become a universal retail system.18
The Reserve Bank of India, by virtue of the powers provided by statute, has amended the statute by forming supervisory and comprehensive reporting systems that recognize the unique nature of the payments system. The payment system reports issued by the Reserve Bank of India19 show a system that encompasses the payment systems in India, the legal systems in India, and the systems of the Board of Regulation and Supervision of India’s Payment and Settlements, and a specific Section on the Unified Payment System and other technologies. This is a good example. The governance of systems within the infrastructure is still emerging, albeit to an extent, in the legal system.
B. Layered governance and interpretive gaps
The Unified Payments Interface (UPI) has a complex governance structure that involves multiple layers. The UPI itself is run by the National Payments Corporation of India, is surrounded by banks, and is accessed by users via third-party applications. In Abhijit Mishra v. Reserve Bank of India20, the High Court of Delhi made the decision that Google Pay, a third-party application provider, was not required to have separate authorisation under the Payment and Settlement Systems Act, 2007, and that Google Pay was acting within the right limits. Although it addressed the question the Court needed to answer, it also posed a larger problem. The Act does outline the limits of the system, yet at the application layer, the market control and the user experience (which includes the consumer) is the biggest gap.
The key issue is even more evident when looking at the case of PayPal Payments Private Limited v. Financial Intelligence Unit-India21. The High Court of Delhi said that access to the payment and settlement system is primarily aimed at payment system operators, and is primarily focused on operators that receive, hold and pass on funding in the chain. The Court’s decision is of value because it outlines the Indian Court’s approach to the Payment and Settlement System and Settlement Function law. Although that approach is reasonable, it is still critical for the regulatory and control layers that structure user access and create the market in the application layer., to be protected. But the Court’s decision is still critical because the application layer is not governed by regulations that protect user access.
The framework incorporates systemic risk and authorization controls, but lacks tools for balance transparency, equal access, and delisting criteria, as well as application-layer accountability, and exclusion constructive transparency. These issues are important. In a networked retail system, governance comes as much through technical standards, onboarding rules, risk flags and data practices as through formal licensing. The current framework is silent on a governance practice as described, but is not clear on legal standards applicable to it.22
CONSTITUTIONAL AND REGULATORY FRICTIONS IN AN INFRASTRUCTURE-SCALE PAYMENTS RAIL
After a system becomes deeply integrated into the economic activities of a country, doctrinal questions become more complex, beyond the risk of settlement. They touch on privacy, the regulation of information, ways for users to seek redress, and the regulation of fraud and competition at the access level. This discusses issues that encompass more complex questions and explain why regulators cannot rely on contextual/spatial regulation.23
A. Privacy and data governance
Payment data is inherently sensitive and can be used to construct interpersonal connections, consumption, movements, professional lifestyle, etc. The Reserve Bank of India’s 2018 notification on payment system data storage “Payment system service providers that collect payment system data are required to store that payment system data within the borders of the national territory”24 clearly demonstrates that payment data is already considered to have systemic sovereignty or national significance. However, data sovereignty is neither minimisation, nor controls on access, nor back-end accountability and retention nor user transparency, nor the user information control and withdrawal right.
Those questions are best approached in the context of the right to privacy as a constitutional guarantee. The Supreme Court has recognized privacy as a constitutional right in Justice K. S. Puttaswamy (Retd.) v. Union of India25. Subsequently, in K. S. Puttaswamy (Aadhaar-5J.) v. Union of India26, the Court examined a large digital identity system using the lenses of proportionality, legitimate aim, and safeguards. The implications for payments are direct. If transaction rails can be continuously used to generate new data, payment regulation will need to address both data breaches and the acceptable boundaries of institutional surveillance in citizen’s economic activities. The law of infrastructure cannot afford to be oblivious to the law of data.
While the Digital Personal Data Protection Act, 202327 introduces a statutory framework to think about consent, notice, breach of duty, and digital personal data rights, a basic data law cannot replace payment regulation. Given the nature of payment systems, data is rapidly and uniformly exchanged in a seamless and interoperable flow. Therefore, payment regulation must be precise in defining user notice and processing rights in data flows during the settlement and risk as well as fraud control, and altering the balance of safety and speed of systems in favor of user control and processing rights.
B. Consumer protection, failed transactions, and cyber-fraud response
Consumer digital payment protection has likely improved more through circulars than through a single statute. The Reserve Bank of India’s circular in 2017 on the restriction of culpability in illegal electronic transactions of the bank28 was the first allocation of Culpability. The 2019 framework on turnaround time for payment systems and compensation for failed transactions29 brought in the first turnaround time and compensation for authorized payment systems compensation rules. Instruments such as these frameworks are significant as they bring predictability in reversal time and culpability allocation, and bring to forefront an important characteristic of trust in digital payment systems, beyond just speed. Loss reversal predictability is an important characteristic of trust in digital payment systems. Loss reversal predictor. A trust system in digital payment systems shall include speed and reversal predictability.
Consumer digital payment protection has improved more through circulars than drafts likely due to a unified regime. The Reserve Bank’s circular in 2017 on the restriction of culpability on illegal electronic transactions of the Bank was the first allocation of core Culpability. The 2019 framework on turnaround time for payment systems and compensation for failed transactions brought to the first turnaround time and compensation for payment systems compensation rules. Instruments like these frameworks are significant as they bring predictability in reversal time and culpability allocation and bring to the forefront an important characteristic of trust in digital payment systems beyond just speed. Loss reversal predictability is an important characteristic of trust in digital payment systems. Loss reversal predictability. A trust system in digital payment systems shall include speed and reversal predictability.30
State Bank of India v. Pallabh Bhowmick31 is an example to consider. The Gauhati High Court stated that if an unauthorized electronic transaction is a result of a third-party breach, and if a customer reports it in the stipulated time, customer liability can be stated as zero. The judgment is positive in that it attempts to counter the habitual perception that all digital loss is due to customer negligence. Secondly, it attempts to demonstrate that the negligence of a customer in the routine course of banking is not to be presumed and is to be established by the bank by the weight of the evidence. This is particularly true of frauds that are aided and abetted by the design of applications, impersonation and data compromise as opposed to intentional and clear wrongdoing by the customer.
The need for anti-fraud measures themselves to not be a source of new types of hardship form a new complex issue. In Anwar Sadath Puthar Kuzhikkal v. Union of India32, the Kerala High Court ordered the Reserve Bank of India to formulate a framework of standard operating procedures addressing the authority of banks to seize accounts for the purpose of financial cybercrime control. This case represents a new type of infrastructure trade off. In a high-speed payment system “payment rail”, the need for rapid measures in the case of fraud be addressed, but speed without due process may very well lead to the arbitrary deprivation of access to payment systems. A system of law should impose temporary restrains, notices, and de-freezing orders to ensure proper payment system order at all times, rather than to rely on improvised practices of payment system control.
C. Competition, access neutrality, and application-layer power
Furthermore, the payment system has its own competition. Unified Payments Interface (UPI) is highly successful due to its inherent system interoperability, large user base and strong network effects. Figure 2 illustrates the transaction throughput of various instant payment systems in India for March of 2026. According to the National Payments Corporation of India, for March 2026, UPI processed 22,641.11 million transactions33 while the Immediate Payment Service (IPS) processed 365.68 million34, which accounted for approximately 98.41% of the total transaction throughput of instant payment systems in India, while accounting for 79.96% of total payment value. A clear and key comparison is that UPI in India, has consistency in retail transaction dominance, and still a competing payment network is relevant for large value transactions.
This type of concentration should be analysed because of a lack of focus on infrastructure regulations in regard to access neutrality and market leverage at the application layer. In the case of Competition Commission of India v. Bharti Airtel Ltd35, the Supreme Court stated that sector regulations and competition laws should be consolidated but not collapsed. This is also essential concerning payments. Competition laws should be applicable in payments, especially if system and settlement orders from the Payment and Settlement Systems Act, 2007 are disrupted due to data practices, preference, exclusionary behaviour, or coercive practices.
The impact of competition and privacy are reflected in the case of WhatsApp LLC v. Competition Commission of India & Anr.36 where the court dismissed the stay of the competition investigation on the grounds of privacy issues. The dismissal of the appeal in WhatsApp LLC v. Competition Commission of India37 found that data privacy and the competition of privacy frameworks are both applicable to data sharing. For the Unified Payments Interface, even if the connectivity rails are interoperable, the competition of the infrastructure is still in the application layer and data. Proper governance and system control, especially when the system is authorized, are essential.
Figure 2. Unified Payments Interface and Immediate Payment Service shares, March 2026.
In March 2026, the Unified Payments Interface managed to gain the majority of instant-payment volume, while the Immediate Payment Service acquired the further majority of value. This situation, as opposed to volume, is important as it does not incorporate the dynamics of retail dependence and competitive potential.
RE-THINKING REGULATION THROUGH AN INFRASTRUCTURE LENS
There is currently a misguided premise stemming from treating the problem as one of compliance, when it is actually a question of rethinking the entire system. The law as it stands acknowledges the Unified Payments Interface as systemically important. What is missing, however, is a system that would underpin its importance with enforceable obligations in terms of fairness, transparency, resilience, and coordinated oversight.38
A. Why infrastructure classification matters
To designate the Unified Payments Interface as public digital infrastructure is not a case of rhetorical exaggeration. From an analytical point of view, it is correct. A payment system warrants being treated as infrastructure when it is, from an economic, social, and operational point of view, indispensable to everyday transactions, replaceable only at great cost to the user and with a risk of exclusion. The contrasting digital sovereignty and payment system infrastructure literature has classified the instant payment system infrastructure as an example of how a state’s capacity, standards, and public coordination are interlinked. This distinction, in an increasingly privatised legal paradigm, is critical.39
The infrastructure lens alters what duties come into focus. It is no longer simply a question of whether the system can self-settle safely. Other duties come into consideration such as, whether onboarding is conducted in a transparent manner. Or, whether removal decisions are made in a manner that is open to review. Also, whether technical standards are published with sufficient clarity, whether user complaints are addressed trans-institutionally, and whether application-layer actors exploit access to a common rail in an exclusionary manner. Tension is also evident in the literature on instant payments, when competing private-sector constructs are either public platforms, or are publicly supported platforms, and regains the value of the argument for explicit legal provisions.40
B. The shape of statutory reform
The Payment and Settlement Systems Act, 2007 should be revised to expand the act to the definition of systemically important retail payment infrastructure41. That definition would not modify the existing authorisation framework, but it would impose systemically important scalable infrastructures with increased public accountability. The first obligations would be focused on access. Application developers and member organisations should be required to follow published criteria on, onboarding, suspension, termination, and sequence in that order, with reasoning and review rights provided to the impacted.
Second are duties of transparency and procedural regularity. Technical circulars and ecosystem standards that significantly shape markets ought to be published, archived, and explained in a more organised way. A comparable rationale can be applied to anti-fraud measures. Temporary constraints can be managed, but must occur within limits for notification, review and documentation, and restoration. The proportionality rule applied by the Supreme Court in Internet and Mobile Association of India v. Reserve Bank of India42 is useful here as it argues for strong impact regulation in response to identifiable proportional risk not the broader precautionary.
Third are the duties of data governance. The Digital Personal Data Protection Act, 202343 is a useful foundational law. However, payment governance should lay down parameters for data to be used for fraud, reconciliation, and regulatory reporting and to the minimum extent necessary for settlement. The purpose is not to impose a consent burden, but to separate necessity for regulatory reporting from commercial data governance. This is important when an individual can only transact digitally through the use of an assisted service.44
C. Institutional coordination and redress design
Creating an entirely new regulatory body may not be necessary to achieve institutional reform. Since settlement integrity and monetary confidence of the public are still the responsibility of the Reserve Bank of India, it should still be the first among the payments regulatory colleagues. More should be done in terms of explicit enforcement of the law. Competition authorities should employ enforcement measures in respect to market dominance and exploitative conduct. Data governance structures should develop standards in policy that articulate notice, retention, and rights to the data. The Reserve Bank of India should make efforts to understand its ecosystem. This includes obligations of resilience, access, to account for fraud, and to account for the operators. System obligations help delineate the extent of the ecosystem of the Reserve Bank of India and aid to define the limits of over and under regulation of the ecosystem.45
The design of the Redress System should be based on users, not on institutional organs. Presently, complaints like failed transactions, unauthorized transactions, accounts sidelined, and data grievances are remedied/distributed among different outlets and layers including banks, different systems of payment, operators, Online Dispute Resolution systems, and the Ombudsman systems46. As a public digital infrastructure, this should ensure the establishment of a prosecution linking harmonized layers and units of complaint, operable units of responsibility, and time-bound cross-integrated cooperation systems. The law should not expect users to identify the right institutional defendant in a layered ecosystem of digital payments.
CONCLUSION
The challenge posed to the doctrine by Unified Payments Interface (UPI) is not a lack of innovation but the success of large-scale innovation. What created a small value and an access payment system that allows people to practice commerce, in a controlled and secure manner, that links the different domains of the informal economy, is a pay rail that has been built as part of a legal system.47
The Payment and Settlement Systems Act, 2007 continues to be essential since authorization, supervision, and settlement finality remain core legal functions. However, those functions are no longer sufficient when the system serves as digital public infrastructure. Case law on privacy, proportionality, and the protection of consumers, as well as anti-fraud due process, and the law of competition already suggests the migration of legal systems. Therefore, the law should shift from a settlement-focused system to one that places digital infrastructure obligations to ensure fair access, transparency, and resilience, as well as governance of data in a responsible manner that includes redress mechanisms integrated into systems.48
The wider lesson is conceptual. Currently, legal structures applicable to the introduction of new technologies are likely to become inadequate during periods of social reliance. India’s payment law is currently at that point. The re-evaluation of the regulatory framework of the Payment and Settlement Systems Act, 2007 is thus a reflection of the enactment of a payment mechanism in public digital infrastructure.49
SUGGESTIONS
The future regulations for India’s payment architecture aim to restore some accountability where none currently exists for the households, merchants, and public and private organisations and institutions who have come to rely on formal payment systems for their uninterrupted access to payment ecosystems.
1. Statutorily recognise infrastructure-grade retail payment systems: Payments and settlement issues should extend the ability of the legislature to define, under the payment and settlement systems act of 2007, payment systems that are of systemic relevance to the payment and settlement systems and to the extent that the act itself can ensure access, ascertain and document system reliability and provide clear processes for remedy/aid to the system.
2. Publish access and delisting criteria: The operator and regulator should establish clear criteria for public documentation of criteria for onboarding, suspension, termination, and restoration, so that all clear justification and timelines eliminate the possibility of opaque operational discretion.
3. Create a unified user-redress layer: The transport of grievances and complaints regarding failed transactions, unauthorized losses, merchant complaints, account locking, and complaints regarding and/or related to end-user data, shall be operable in one interface, and end users should be footwear agnostic to banks, applications, or system operators.
4. Codify due process for account freezing: While some degree of short term and immediate measures to protect banks and the system from potential losses related to cyber fraud are permissible, it should exist within a clear rubric on duration, notification timelines, a systematic review and/ restoral process after its duration.
5. Separate operational data from commercial reuse: Payment-specific regulations should state what constitutes the essentials for settlement, fraud detection, reconciliation, control of processing, and lawful supervision. Reasons for further processing should be reported in understandable ways and justified, especially where the user has little practical way of avoiding the processing.
6. Mandate stronger transparency for ecosystem circulars: Directives of the ecosystem and the technical standards influencing participant accessibility and market practices should be published and archived. Crucial circulars should explain the purpose, because legal obligations should not be disguised in operational documentation.
7. Embed competition-sensitive obligations at the application layer: In addition to real-time interoperability, interface non-discrimination and transparency obligations should be prescribed. Application developers that command a significant share of the market ought not to be allowed to use their access to the common real to the detriment of competing services or to impose coercive and colluded conditions for services.
8. Strengthen automated and human review in dispute resolution: First-tier user dissatisfaction should be focused on Online Dispute Resolution, but, in cases of fraud, freeze orders, or complicated factual complaints, users should be able to opt for a higher level of resolution, including a trained human. Enormous and complex networks should be automated to provide faster service, but should not provide the service in the place of networks.
9. Require periodic infrastructure audits: Apart from settlement and cyber security integrity, accessibility to and management of the network, the quality of complaint management, and concentration and operational rule risks should also include retail large payment systems. To enhance public accountability, a non-confidential summary of the obtained results should be published.
10. Build formal inter-regulatory coordination: The Reserve Bank of India alongside competition constitutions and data governance bodies must implement a standing coordination agreement regarding pertinent payment issues of a significant scale. Such an agreement would streamline communication in the avoidance of jurisdictional delays, addressing privacy, competition and systemic risk issues in a collaborative manner, rather than in opposition to one another.
*****
Footnotes
1. Reserve Bank of India, “Payments Vision 2025” 1 (June, 2022).
2. The Payment and Settlement Systems Act, 2007 (Act 51 of 2007), s. 4.
3. Unified Payments Interface, available at: https://www.npci.org.in/product/upi (last visited on April 28, 2026).
4. Reserve Bank of India, “Annual Report 2024-25” 142 (2025).
5. Mike McConville and Wing Hong Chui, Research Methods for Law 91 (Edinburgh University Press, Edinburgh, 2nd edn., 2017).
6. Yochai Benkler, The Wealth of Networks: How Social Production Transforms Markets and Freedom 76 (Yale University Press, New Haven, 1st edn., 2006).
7. Smriti Parsheera, “Stack Is the New Black?: Evolution and Outcomes of the India-Stackification Process”, 52 Computer Law & Security Review 105947 (2024).
8. Bank for International Settlements, “The Organisation of Digital Payments in India: Lessons from the Unified Payments Interface” 61 (December, 2024).
9. About UPI, available at: https://www.npci.org.in/product/upi/about-upi (last visited on April 29, 2026).
10. UPI 123PAY, available at: https://www.npci.org.in/product/upi-123pay (last visited on April 30, 2026).
11. UPI Lite, available at: https://www.npci.org.in/product/upi/upi-lite (last visited on April 30, 2026).
12. Unified Payments Interface Product Statistics, available at: https://www.npci.org.in/product/upi/product-statistics (last visited on May 2, 2026).
13. Smriti Parsheera, “Stack Is the New Black?: Evolution and Outcomes of the India-Stackification Process”, 52 Computer Law & Security Review 105947 (2024).
14. Julie E. Cohen, Between Truth and Power: The Legal Constructions of Informational Capitalism 142 (Oxford University Press, New York, 1st edn., 2019).
15. The Payment and Settlement Systems Act, 2007 (Act 51 of 2007), ss. 10, 18, 23.
16. The Payment and Settlement Systems Act, 2007 (Act 51 of 2007), s. 4.
17. Avtar Singh, Banking and Negotiable Instruments 156 (Eastern Book Company, Lucknow, 4th edn., 2018).
18. M.L. Tannan, Banking Law and Practice in India 171 (LexisNexis, Gurgaon, 29th edn., 2025).
19. Reserve Bank of India, “Payment and Settlement Systems in India: Journey in the Second Decade of the Millennium” 5 (2021).
20. 2023 SCC OnLine Del 5094.
21. 2023 SCC OnLine Del 4336.
22. Reserve Bank of India, “Payments Vision 2025” 13 (June, 2022).
23. M.P. Jain, Indian Constitutional Law 121 (LexisNexis, Gurgaon, 8th edn., 2022).
24. Reserve Bank of India, “Storage of Payment System Data” (Department of Payment and Settlement Systems, April, 2018).
25. (2017) 10 SCC 1.
26. (2019) 1 SCC 1.
27. The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), ss. 4, 5, 8.
28. Reserve Bank of India, “Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions” (Department of Banking Regulation, July, 2017).
29. Reserve Bank of India, “Harmonisation of Turn Around Time (TAT) and Customer Compensation for Failed Transactions Using Authorised Payment Systems” (Department of Payment and Settlement Systems, September, 2019).
30. Reserve Bank of India, “Online Dispute Resolution (ODR) System for Digital Payments” (Department of Payment and Settlement Systems, August, 2020).
31. 2024 SCC OnLine Gau 1519.
32. 2025:KER:88312.
33. Unified Payments Interface Product Statistics, available at: https://www.npci.org.in/product/upi/product-statistics (last visited on May 2, 2026).
34. Immediate Payment Service Product Statistics, available at: https://www.npci.org.in/product/imps/product-statistics (last visited on May 2, 2026).
35. (2019) 2 SCC 521.
36. 2021 SCC OnLine Del 2308.
37. Competition Appeal (AT) Nos. 1 and 2 of 2025 (NCLAT, 4 November 2025).
38. Lawrence Lessig, Code: Version 2.0 93 (Basic Books, New York, 2nd edn., 2006).
39. Nikita Aggarwal and Douglas W. Arner, “Digital Sovereignty and Payments” in John A. Frost, et.al. (eds.), Digital Sovereignty in the BRICS Countries 93 (Cambridge University Press, Cambridge, 1st edn., 2025).
40. Maria Lucia Passador and Ignacio Tirado, “Central Banks as Regulators and (also) Operators of Instant Payments Schemes: Confronting the Criticisms of Needless Intervention and Unfair Competition”, 19 Capital Markets Law Journal 248 (2024).
41. Reserve Bank of India, “Payments Vision 2025” 12 (June, 2022).
42. (2020) 10 SCC 274.
43. The Digital Personal Data Protection Act, 2023 (Act 22 of 2023), ss. 7, 8, 11.
44. Julie E. Cohen, Between Truth and Power: The Legal Constructions of Informational Capitalism 178 (Oxford University Press, New York, 1st edn., 2019).
45. Reserve Bank of India, “Payment and Settlement Systems in India: Journey in the Second Decade of the Millennium” 30 (2021).
46. Reserve Bank of India, “The Reserve Bank: Integrated Ombudsman Scheme, 2021” (November, 2021).
47. Bank for International Settlements, “The Organisation of Digital Payments in India: Lessons from the Unified Payments Interface” 63 (December, 2024).
48. V.N. Shukla, Constitution of India 98 (Eastern Book Company, Lucknow, 13th edn., 2017).
49. Lawrence Lessig, Code: Version 2.0 121 (Basic Books, New York, 2nd edn., 2006).