UPI is the default way India pays, which means users judge your product by how well your UPI flow works. Failed collects, stuck "pending" statuses, and slow refunds show up in reviews within days. This checklist is for product, engineering, and compliance leads at fintech apps, lenders, and merchants preparing to add UPI payments, AutoPay mandates, or become a third-party application provider (TPAP).
Rules change often, so treat every regulatory line here as "confirm against the current NPCI circular" before sign-off.
1. Choose your integration model
- [ ] Decide your role: merchant accepting UPI via a payment aggregator, TPAP offering a consumer UPI app, or lender using UPI AutoPay for repayments
- [ ] If a TPAP: shortlist sponsor PSP banks, and confirm their onboarding timeline, commercials, and technical stack
- [ ] If a merchant: compare payment aggregators on UPI success rates, settlement timelines, and dispute tooling (ask for data, not averages)
- [ ] Confirm any RBI authorisation you need (for example, as a payment aggregator) and who holds it
- [ ] Assign an internal owner for NPCI and PSP bank communication
2. Flows to support
- [ ] Intent flow (UPI app switch) and QR for mobile and web
- [ ] Collect requests, if still permitted for your use case and category
- [ ] UPI AutoPay mandates: create, modify, pause, revoke, and pre-debit notification
- [ ] Refunds, full and partial, with clear customer messaging
- [ ] Transaction limits by category, including any higher P2M limits that apply to your merchant category
3. NPCI API usage and performance rules
NPCI's API usage guidelines, enforced from 1 August 2025, changed how apps can call core APIs. Build to them from day one:
- [ ] Balance enquiry capped per user per app per day (50 at the time of writing)
- [ ] List-account calls capped per user per app per day (25 at the time of writing)
- [ ] Transaction status checks rate-limited and spaced out; no aggressive polling loops
- [ ] AutoPay mandate executions scheduled outside peak hours, with limited retries
- [ ] Core API responses handled within NPCI's tightened timeout windows
- [ ] Backoff and circuit-breaker logic for PSP or NPCI downtime
4. Security and data handling
- [ ] UPI and payment data stored in India only, as NPCI and RBI data localisation rules require
- [ ] Device binding and SIM verification for TPAP registration
- [ ] No UPI PIN or sensitive credentials ever touch your servers or logs
- [ ] Secrets in a vault, with keys rotated on a schedule
- [ ] App hardening: root/jailbreak detection, certificate pinning, tamper checks
- [ ] Consent and notice for personal data under India's DPDP Act
- [ ] Fraud rules for new-device, high-velocity, and mule-account patterns
5. Status handling and reconciliation
| Status | What the user sees | What your system does |
|---|---|---|
| Success | Confirmation and receipt | Mark paid, trigger fulfilment |
| Failure | Clear reason and retry option | Release reserved stock or order |
| Pending / deemed | "Being confirmed" with expected time | Scheduled status checks within limits, then auto-resolve |
| Reversed | Refund message | Update ledger and notify |
- [ ] Daily automated reconciliation of your ledger against PSP/aggregator settlement files
- [ ] Unmatched transactions routed to an operations queue with ageing
- [ ] Webhook signature verification and idempotency keys on every callback
6. Disputes and grievance redressal
- [ ] In-app complaint raising linked to the transaction reference
- [ ] Integration with the PSP's dispute system, with turnaround times tracked
- [ ] Published grievance officer details and escalation path
- [ ] Refund turnaround timelines monitored against RBI's harmonised TAT framework
7. Pre-launch testing
- [ ] Certification or UAT with your PSP bank or aggregator completed
- [ ] Test matrix covering the top UPI apps, Android and iOS, and low-bandwidth networks
- [ ] Load test at 5x expected peak (festive sales, salary days, EMI dates)
- [ ] Chaos test: PSP timeout, duplicate callback, callback never arrives
- [ ] Monitoring dashboards for success rate by bank, app, and hour
Red flags
- Status checks implemented as tight polling loops
- Reconciliation done manually in spreadsheets
- No plan for "pending" transactions beyond telling users to wait
- Payment logs that contain full account or device identifiers
How to use this checklist
Split it by owner: product owns sections 1–2, engineering 3, 5 and 7, security and compliance 4 and 6. Review weekly until launch, and re-check section 3 whenever NPCI issues a new circular.
How Syslabs helps
Syslabs supports fintech teams with API development for payment flows, reconciliation engines, and monitoring, plus a compliance review of data handling before launch. If you are also exposing account data to partners, our open banking API security checklist is a useful companion to this one.