UPI May Soon Let AI Agents Pay. NPCI's Chairman Drew a Line Small Firms Should Copy

⏱ 7 min read|Published 13 October 2026|By Dibyendu Choudhury

At the Global Fintech Fest in Mumbai on 10 September 2026, Ajay Kumar Choudhary, the non-executive chairman of NPCI, said a sentence that deserves to be pinned above the desk of every accounts manager in India. Medianama's report of the session put it this way: "Decision making and execution must remain separate." He added that AI may recommend actions, but that authentication and final settlement must follow deterministic, auditable rules, and he described the goal as "autonomy that is bounded and accountable."

He was talking about the national payments network, which processed 24.51 billion UPI transactions worth Rs 29.82 lakh crore in August 2026, according to the same report. But the principle is not limited to NPCI. It is the best operating rule I have seen for any small business that wants to let software spend its money.

What was said in Mumbai, and what has not been published

The background, as reported: on 1 September, Inc42 carried a Reuters report that NPCI would present a Unified Agent Protocol at the Fest, allowing AI agents to carry out UPI payments within a limit the user sets in advance, building on existing features called UPI Circle and Reserve Pay. The first use cases would be low-value, high-frequency payments such as grocery orders. Inc42 noted that NPCI declined to comment. A later Reuters-sourced report, carried by TNGlobal on 12 September, said NPCI plans a registry, a record of approved software identities and the operators behind them, with possible extension to cards and bill payments later.

Be clear about the status. As of Medianama's 10 September report, NPCI had not released protocol specifications, transaction limits, a liability framework or per-transaction thresholds for agent-initiated payments. What exists is a direction and a principle. On 9 September NPCI did launch two platforms at the Fest, AiNxt for building AI applications and AtOM for streamlining operations among banks and payment providers, but those are tools for the ecosystem, not a finished rulebook for agents spending your money.

Three layers, and why the AI is let into only one

Medianama summarised Choudhary's structure as three layers. The first is intent, where AI can operate: understanding that rent is due, that a supplier invoice has arrived, that stock is running low. The second is authorisation, where a human verifies identity and grants a mandate. The third is settlement, which must be deterministic and auditable, with no room for a model's judgement or mood.

I like this because it is not anti-technology. It lets the machine do what machines do well, which is reading, matching and proposing, and it keeps the irreversible act behind a boundary that a person defined. Most failures of automation that I have seen in small firms were not failures of intelligence. They were failures of boundary: nobody had decided what the system was allowed to do without asking.

In a ten-person workshop the same idea looks very ordinary. The person who notices that a bill is due is not the person who signs the cheque, and the person who signs is not the person who reconciles the bank statement. That separation of duties is old accounting wisdom, and it exists because any single hand, human or otherwise, can make a mistake or be fooled. An AI agent is one more hand, and it should be placed in the same system of checks as the rest.

The same week, assistants for merchants appeared

The Fest was not only about rules. Medianama's roundup of products launched at the event, covering 8 to 11 September, describes BharatPe's agentic AI assistant for merchants, built on Google Cloud's Gemini Enterprise Agent Platform, which reads a merchant's business and transaction history across more than 60 internal systems and speaks in the merchant's preferred language. The same roundup describes Pine Labs working with L&T Finance on an agentic commerce feature whose first capability is an AI agent booking flights within spending limits the user defines.

Notice the shape of both. One reads and advises, the other acts, but only inside a limit set in advance. I cannot tell you from these reports how well either works in daily use, and I will not pretend to. What I can say is that the industry's own first products already follow the discipline the NPCI chairman described.

Your own agent will need a mandate

You may never touch the UPI protocol, yet you will almost certainly meet an AI tool that offers to handle payables, reminders or reorders. Take the supplier side. The Micro, Small and Medium Enterprises Development Act expects payments to micro and small suppliers within a period that cannot exceed 45 days. An agent that schedules those payments on time could save a firm real money and relationships. An agent that pays the wrong account, or pays an invoice twice, or pays a fraudulent invoice that looks perfect, can do damage faster than any clerk.

The sensible position sits between those two. Let the agent read invoices, match them to purchase orders, flag the due dates and prepare the batch. Do not let it release money without a human approval above a threshold you have chosen. That is the NPCI structure translated into a workshop: intent for the machine, authorisation for the owner, settlement through your bank's normal, logged channel.

When the payer is software

The other side of the coin matters to sellers. If agents begin to pay, some of your customers will not be people tapping a phone. They will be software acting under a delegated mandate. The registry NPCI is reportedly planning exists precisely so that a payment can be traced to an approved software identity and its operator.

Two practical consequences follow. First, keep your invoicing clean: a clear invoice number, a clear payee name and a reference that a machine can match is worth more than ever. Second, remember that liability is unsettled. Medianama's 10 September report says no liability framework has been published for agent-initiated payments. Earlier, on 10 July, its founder Nikhil Pahwa proposed that a consumer agent could start with a default limit of Rs 100 per transaction and Rs 500 a month. That was one commentator's suggestion, not NPCI policy, but it shows how small and cautious the first mandates may be.

One caution applies to both sides. Payment fraud rarely announces itself. It tends to arrive as a polished invoice with a changed bank account number, or a message that seems to come from a regular supplier. An agent that reads documents will read a forged one just as readily as a genuine one, and it will do so at speed. The defence is old and cheap: any change of payee details is verified by a call to a number you already hold, never to the number printed on the new document.

A one-page mandate for any AI that touches money

Whatever tool you choose, write its mandate before you switch it on. I suggest seven lines.

1. Cap: the largest single payment it may prepare, and the largest it may release without a person, which should be zero at the start.
2. Payees: a named list. A new payee always needs a human to verify the account by phone.
3. Expiry: the mandate lapses after ninety days unless the owner renews it.
4. Record: every action is logged with the invoice it relied on, and the log goes to someone other than the person who set the mandate.
5. Kill switch: two named people who can revoke it instantly, including at night.
6. Trial: run it on small, low-risk payments for a month and review every one.
7. Review: a monthly look at what it did, what it flagged and what it got wrong.

What I will be watching

Three things will tell me whether this becomes useful infrastructure or another announcement. The first is whether NPCI publishes the protocol and its limits in a form that small fintech firms can build against. The second is whether the liability framework names who bears the loss when an agent errs, the user, the operator or the bank. The third is whether the registry covers the small agents that will serve small businesses, or only the large platforms.

Until those answers arrive, my advice is the one Mr Choudhary's sentence already gives. Let the machine decide what to propose and let a person decide what to release. This week, write the seven-line mandate for the one task you would most like to hand over, and keep it beside the first invoice that the tool reads.

Published 13 October 2026 · dibyenduchoudhury.com