Flawed regulation can undermine the digital payment ecosystem

The National Payments Corporation of India’s (NPCI) announcement on the limits placed on Unified Payments Interface (UPI) transactions for third-party apps is flawed. Briefly, each third-party app, such as GPay or PhonePe, cannot exceed 30% of the total number of Unified Payment Interface (UPI) transactions. Typically, an obscure and technical regulatory change for a payments system does not draw sharp reactions. Still, given that the number of users and the volume of transactions are rapidly increasing every day, this move can potentially affect a lot of people.

The given justification for this rule by NPCI was to “address the risks and protect the UPI ecosystem as it further scales up”. Unfortunately, this justification raises more questions than provides answers. The new rule is both unnecessary and inconsistent for a set of reasons.

For one, there is no empirical evidence of this form of systemic failure until now (except the YES Bank episode, which is a different category altogether). Even if we consider this rule to be forward-looking, NPCI would have been better off seeking technological solutions to a potential technical problem, rather than using crude policy instruments such as placing limits.

Systemic risks are automatically lower when consumers, merchants, and third-party app developers are all multi-homing, meaning they simultaneously use more than one app for the same purpose. The UPI ecosystem is radically substitutable. In the case of failure, consumers and merchants can switch from one app to another without the slightest friction. Though two apps, PhonePe and GPay, dominate the UPI market (with roughly 80% of UPI transactions), consumers are not without choice — there are at least 52 UPI service providers, 189 issuers and around 21 third-party apps. Third-party app developers also can and do have tie-ups with multiple banks simultaneously, such that the YES bank-PhonePe fiasco will not be repeated.

Beyond being unnecessary, the rule is also improper, incomplete, and inconsistent. If the aim is to mitigate the systemic risk of failure of one big market player, the rule change should apply to all apps providing UPI services, and not just third-party apps. Is the systemic risk different when the app of a scheduled commercial bank fails as against a third-party app?

Two, in terms of systemic risk, the most significant one is that of the UPI architecture failing, which can instantly impact millions of users. Note that NPCI has a virtual monopoly over the UPI architecture and therefore consumers are left with no choice, apart from hard cash and cheques. Reserve Bank of India (RBI) should be taking a closer look at this risk.

Three, whether the justification for the rule is of systemic failure or that of potential market domination, NPCI (a private company, which is a consortium of banks) is not the proper authority to be making rules regarding payments. In the first case, it should be RBI regulating, and in the case of competition issues, it should be the Competition Commission of India looking into the matter.

There is uncertainty about how companies can reduce their share of the total transactions. Companies could place hourly, daily, or monthly limits on the number of transactions for each consumer; restrict the use of UPI to specific use cases; restrict transactions to above a certain minimum amount; or restrict the number of new installs by users.

In all these scenarios, it leads to uncertainty about the app functionality and potentially higher failure rate of transactions.

The better way to reduce systemic risk is to ensure greater competition and lower the entry barriers. The inordinate delay in permitting newer entrants to the market is inexcusable in this regard. Having a combination of third-party apps, domestic banks, and niche payment platforms is an effective solution to mitigate risk and should be preferred to the sledge hammer-like instrument of placing caps on the number of transactions.