India Prepares Guardrails for AI Agents to Pay Through UPI

India is preparing a framework that could allow artificial-intelligence agents to make small payments through the Unified Payments Interface without asking the user to approve every transaction. The proposed Unified Agent Protocol is expected to start with frequent, low-value purchases such as groceries, according to three sources cited by Reuters, and may be unveiled at Mumbai's Global Fintech Fest.

The initiative matters because UPI is not a niche payment network. Operated by the National Payments Corporation of India, it processed 24.51 billion transactions worth 29.82 trillion rupees, about $314 billion, in August. The IMF has described UPI as the world's largest retail fast-payment system by transaction volume. Adding delegated AI execution at that scale would turn agentic commerce from a card-network experiment into national payment infrastructure.

NPCI did not confirm the private details in the Reuters report. The launch timing, limits and liability structure therefore remain provisional. But the design described by the sources shows how India may separate useful automation from an unrestricted authority to spend.

Delegation instead of blanket permission

The protocol is expected to build on UPI Circle and Reserve Pay. UPI Circle lets a primary account holder delegate payment authority to another user. Reserve Pay allows funds to be blocked for multiple debits. Applied to an AI agent, those mechanisms could let a customer set the merchant category, maximum amount, time period and conditions under which a transaction may proceed.

Banks currently cap such blocks at 10,000 rupees for up to 90 days, although those parameters could be revised for agentic use. Merchants may be able to integrate directly, while users set rule-based instructions. The framework is expected to include spending limits, identity checks and audit trails. NPCI is also working on liability provisions, but Reuters' sources did not provide the allocation of responsibility.

That missing liability framework is central. If an agent buys the wrong item, follows a manipulated instruction or pays a fraudulent merchant, the system must determine whether the customer, bank, merchant, app developer or AI provider bears the loss. Conventional unauthorized-payment rules are difficult to apply when a user intentionally delegates authority but disputes how the software interpreted it.

Competition is already forming

Global card networks are building similar capabilities. Mastercard completed an authenticated agentic transaction in New Delhi in June, while Visa is developing agentic payments in India. Pine Labs has launched a protocol that allows AI agents to complete UPI payments after an initial authorization. Each model is competing to become the trust layer between a customer's intent and a merchant's payment request.

UPI's advantage is reach and low-friction bank connectivity. Google Pay and Walmart's PhonePe account for around three-quarters of monthly transaction volume, so their implementation choices could determine how quickly the protocol reaches consumers. That concentration also creates platform risk: an agentic standard may be open at the network level while distribution remains dominated by a few apps.

Security threats will differ from ordinary payment fraud. Attackers may try to manipulate product descriptions, agent prompts or merchant data rather than steal a card number. A technically authorized payment can still be economically unwanted. Effective controls will need to preserve the user's original intent, show why the agent acted and make revocation immediate.

More sophisticated uses, including purchases triggered by discounts or investments made within stated price thresholds, have been discussed. Financial transactions would require much tighter suitability, disclosure and conflict controls than grocery orders. An agent selecting an investment is not merely executing a payment; it may be giving or implementing regulated advice.

Why it matters

Agentic payments will succeed only if automation is bounded, observable and reversible. India's proposal is an attempt to encode those protections into a system that already handles billions of monthly transactions rather than leaving each app to invent its own rules.

For consumers, the benefit could be routine purchases completed within clear limits. For merchants, agents may become a new sales channel, but one that rewards structured data and verifiable offers. Banks and payment apps gain new transaction flows while accepting new fraud and dispute risks. Regulators face the larger question of how consent works when software acts between the customer and the payment rail.

If the protocol launches as described, UPI could provide one of the first large-scale tests of whether delegated AI can make payments without weakening accountability.

Sources: Reuters, NPCI, IMF on fast-payment systems