India’s Agentic Payment Push Leaves Liability Unclear

India already has payment tools for delegated spending and blocked funds. AI agents add another layer because software may interpret a user’s instruction before deciding what to buy. 

The issue came into focus at the Global Fintech Fest held in Mumbai this month. The National Payments Corporation of India (NPCI) had planned to unveil its Unified Agentic Protocol, or UAP, at the event but put the launch on hold pending regulatory clearance, Business Standard reported, citing people familiar with the decision. Customer protection, governance and liability are among the issues still being worked through.

Reuters separately reported that NPCI is developing a registry to verify and monitor AI agents making payments for users. The registry is expected to form part of UAP. 

UPI processed 24.51 billion transactions worth ₹29.82 trillion in August, with 752 banks live on the network, up about 22% in volume from a year earlier. 

Even limited use of AI agents on a system that large would quickly make questions about authority, mistakes and disputes more than a technical concern.

UPI Already Supports Some Forms of Delegation

UPI Circle allows a primary user to give another person limited authority to spend from an account. Under full delegation, the limit is ₹5,000 per transaction and ₹15,000 a month, and a primary user can authorize up to five secondary users. NPCI launched the feature in 2024 and later expanded full delegation on the BHIM app.

In October 2025, NPCI extended UPI Circle to certain IoT devices and software profiles, including AI profiles, in a closed user group. The circular still required debit transactions through IoT devices to follow an explicit user action.

Software can sit inside a delegated-payment arrangement, but the current rules do not give it broad authority to decide independently what to buy.

UPI Reserve Pay addresses another part of the problem. It lets a customer block up to ₹10,000 for a merchant for up to 90 days, with later debits drawn from that amount. The customer can modify or revoke the block.

NPCI’s operating circular says those debits should follow a customer purchase action on the merchant’s platform. Reserve Pay can therefore limit how much money is available, but its existing rules do not give an AI agent discretion over the purchase itself.

From October 15, a 0.4% merchant discount rate will apply to most person-to-merchant UPI payments above ₹2,000, while smaller payments remain exempt. Reuters has reported that NPCI expects early agentic-payment use cases to focus on small, frequent purchases. 

That becomes important when software is asked to do more than execute a fixed instruction. A user might tell an agent to replenish household supplies within a budget, book a flight below a certain fare, or buy an item once its price falls far enough.

Anand, founder and chief executive of banking and regtech infrastructure company PaySprint, said India’s existing systems provide a head start.

“Closer than most people realize, because India is not starting from zero,” Anand said.

He said the bigger challenge is identifying the agent, linking it to the user who authorized it and recording the limits placed on what it can do.

“Today, UPI trusts a human and a device. An agent is neither,” Anand said.

Piyush Goel, founder and chief executive of Beyond Key, said the infrastructure itself is not the main obstacle.

“India already has excellent UPI infrastructure and account aggregator frameworks, so the plumbing is largely ready,” Goel said. “The real gap is trust. Banks and regulators still need standardized ways to recognize an agent as a legitimate actor and to audit its decisions.”

NPCI is examining the same basic problem. Ajay Kumar Choudhary, its non-executive chairman and independent director, told GFF that NPCI is studying protocols to identify and authorize digital agents while preserving auditability and settlement finality.

“Decision making and execution must remain separate,” Choudhary said. “AI may recommend, but authentication and final settlement must follow deterministic, auditable rules.” 

Current Payment Rules Do Not Fit Agent Decisions

India’s payment rules were designed around people, merchants and recurring instructions. An AI agent purchasing and interpreting a broad instruction does not fit neatly into those categories.

The RBI’s consolidated Digital Payments E-mandate Framework, issued in April, shows where the difficulty may arise.

An e-mandate can cover a fixed or variable recurring payment. The customer can set a maximum value for a variable mandate, and the first transaction requires additional authentication. Most later debits require at least 24 hours’ notice. FASTag and National Common Mobility Card replenishments are exempt from that requirement.

The framework also says payments made under e-mandates “shall not be subject to any other limits/controls set by the customer.”

That provision would need scrutiny if an existing mandate structure were ever used for agentic payments. RBI has not said UAP will operate under the e-mandate framework, and the framework should not be treated as UAP’s regulatory home.

A monthly insurance premium is predetermined. An instruction to book a flight below ₹10,000 leaves the software to choose when to buy, which itinerary to select, and sometimes which seller to use.

Anand said such authority should be “explicit, bounded, revocable and auditable.” 

Ankush Sabharwal, founder and chief executive of CoRover.ai, put the boundary more plainly: “The AI never sets its own limits. That stays with the human.”

The agent can stay within its mandate and still misunderstand what the customer wanted, a problem Anand calls an “interpretation failure.” 

“Agents will look statistically abnormal by design,” he said.

That complicates conventional fraud monitoring. Banks often look for transactions that differ from a customer’s normal behavior or suggest compromised credentials. An agent may transact at unusual hours or act immediately when a price changes because that is exactly what it was asked to do.

A dispute could therefore depend on more than whether the payment was authenticated. A bank or payment company may need to know what the user asked for, what authority the agent had at the time, and how its decision led to the transaction.

Mukesh Pandey, founder and managing director of lending platform Rupyaapaisa.com, said agent transactions should retain “a transparent audit trail covering consent, permissions, instruction and execution.”

Setu, a Pine Labs subsidiary, launched an agentic bill-payment service in December 2025 for use through ChatGPT and Claude. The service uses customer-defined rules and pre-blocked funds, fetches bills, compares amounts with previous patterns, and flags unusual charges. Setu says payments remain within limits and approvals set by the user.

Pine Labs separately launched P3P in June as an agentic payment protocol built on UPI. The company says it allows an AI agent to complete a UPI payment without requiring the user to enter an MPIN for every transaction.

Those are company claims about their own products. They do not amount to regulatory approval for UAP or for autonomous payments across UPI.

No Rule Yet Divides the Loss 

RBI has been clearer about institutional responsibility than about how to divide losses from agentic payments.

Speaking at GFF on September 11, Deputy Governor Shirish Chandra Murmu said regulated institutions remain accountable for financial decisions made or materially influenced by algorithms.

“When an algorithm makes or materially influences a financial decision, who is accountable? The answer cannot be the algorithm,” Murmu said.

He said boards and senior management need to understand the models their institutions use, their limits and the consequences of deploying them. As financial services become more automated, he said, human accountability should become stronger.

Murmu also raised the agentic AI problem directly, asking who is responsible when an agent acts incorrectly and how an institution can ensure that it serves the customer’s interests.

“These are not arguments against agentic AI. They are arguments for responsible agentic AI,” he said.

RBI has not, however, set out how to divide losses in every case involving an agentic payment.

Anand argues that “liability should follow control.” If an agent moves outside its mandate, he said, responsibility should fall on the participant whose system failed to enforce the boundary rather than automatically on the customer. 

Reuters reported that rules are still needed to deal with wrong or unauthorized agent payments. Business Standard said possible liabilities are among the issues holding up UAP.

The difficult cases will be those in which the agent stays within its mandate but misreads the customer’s instruction. Existing payment records may show that the transaction was valid without explaining why the agent chose it.

Singapore has begun putting some of those ideas into a formal framework. Safeguards for Agentic Finance at Runtime, or SAFR, covers agent identity, mandates, pre-execution checks, and audit records. The Monetary Authority of Singapore developed it under its BuildFin.ai initiative.

SAFR is voluntary and does not constitute regulatory guidance or supervisory expectations.

India has a broader framework for AI in finance. RBI’s FREE-AI committee report, chaired by IIT Bombay professor Pushpak Bhattacharyya and published in August 2025, set out principles for responsible AI use in the financial sector.

The report predates the current UAP debate and does not settle the specific questions raised when an AI agent has authority to spend.