Fintech Brief — November 6, 2026

Today’s Top Stories

NPCI tells the Supreme Court: UPI’s MDR hits only 4% of payments — and merchants can’t pass it on

In a 100-page affidavit filed November 5, NPCI defended the 0.4% MDR on UPI person-to-merchant payments above ₹2,000 before the Supreme Court, responding to a PIL by advocate Anjan Datta that challenges the amendment to Section 10A of the Payment and Settlement Systems Act, the Finance Ministry’s September 14 notification, and NPCI’s September 15 MDR circular. NPCI argued the fee lands on only about 4% of P2M transactions — roughly 96% stay free — that merchants are strictly prohibited from passing the charge to customers, and that UPI apps cannot levy platform fees on users. Small merchants receiving up to ₹1 lakh a month via UPI QR remain at zero MDR, and 5% of every entity’s MDR share is earmarked for a fund to drive adoption among small merchants with turnover up to ₹20 lakh. “The 0.4% ceiling for MDR is far lower than the charges imposed by other system providers for credit cards and debit cards,” NPCI submitted, represented by Additional Solicitor General N. Venkataraman. The Court refused a stay on September 28; the rollout remains deferred to a post-Diwali date yet to be notified. LiveLaw · The Hindu · Moneycontrol · ETBFSI

Consumer takeaway: once the fee goes live, a merchant is supposed to absorb the MDR on your ₹2,000+ UPI payment — watch for quiet “extra charges for UPI” or card-only nudges at the counter and push back. Nothing changes for payments under ₹2,000, person-to-person transfers, or small QR merchants, whatever the affidavit’s fate in court.

I4C and CERT-In warn: AI agents are attacking payment APIs at machine speed

An advisory issued November 3 by I4C’s National Cybercrime Threat Analysis Unit together with CERT-In — publicised November 5 — warns banks, NBFCs and fintech firms of financially motivated attacks in which intruders drain automated fund-disbursement systems and payment APIs. “Use of Agentic AI Framework makes the attack possible at machine speed,” the advisory states: stolen funds are pushed through mule accounts via IMPS and NEFT, and attackers delete records to stall investigations, with individual cases running to multiple crores. Institutions have been directed to implement two “Critical” CERT-In advisories — CIAD-2026-0046 on exploitation of payment and disbursement APIs (October 9) and CIAD-2026-0049 on AI agents as attack vectors (October 15) — maintain a complete inventory of payment APIs and decommission old, unused or test interfaces, coordinate CISO, transaction-monitoring and IT teams, and honour the six-hour cyber-incident reporting window. CERT-In also trained 300 officials from over 55 financial institutions this week. The Federal · Free Press Journal · Daily Pioneer

Consumer takeaway: when fraud runs at machine speed, the window to claw money back is minutes, not days. If a transfer you didn’t authorise hits your account, call your bank’s fraud line and the national cybercrime helpline 1930 immediately, and report at cybercrime.gov.in — the advisory itself says speed is what separates recovery from loss.

SEBI lets NRIs and OCIs complete KYC entirely from abroad

A SEBI circular dated November 4 (effective December 3, 2026) removes the requirement that overseas clients be physically present in India for digital KYC. NRIs, OCIs and foreign nationals living in FATF-compliant countries can submit documents digitally and complete video in-person verification from abroad — with the official on camera, IP address in India or a FATF-compliant country, and no VPN. Verified details go to the KYC Registration Agency within three working days, get tagged “validated,” and become portable across brokers, depositories and mutual funds; re-KYC from abroad is covered too. Clients in FATF-non-compliant countries stay on the old process. Moneycontrol · Economic Times · Zerodha Z-Connect

Consumer takeaway: for the diaspora, opening or updating a demat, broker or mutual-fund account no longer needs an India trip or couriered attestation — just a passport, PAN and a working camera. From December 3, reject any intermediary that still insists on physical presence.

Razorpay clears its IPO hurdle at $5 billion; OneStack raises for co-operative bank UPI

Razorpay has secured SEBI approval for its IPO — a raise of ₹5,000–6,000 crore (~$500–600 million) at a ~$5 billion valuation, about a third below the $7.5 billion it commanded in 2021 — with listing targeted for January–March 2027 after its June confidential pre-filing. FY25 consolidated revenue rose 65% to ₹3,783 crore with a net loss of ₹1,209 crore driven by one-time ESOP and reverse-flip costs; Axis Capital, Kotak, JP Morgan and Citi are the bankers. Business Standard · CNBC-TV18 · Moneycontrol. In smaller-round news, fintech infrastructure startup OneStack raised ₹12.5 crore led by new investor Shepherd’s Hill with existing backers Pentathlon Ventures and AVNM Ventures, as its co-operative bank clients go live directly on NPCI’s UPI network as issuers and acquirers under their own bank handles — an addressable base, per NABARD, of 34 state and 351 district co-operative banks running nearly 15,900 branches. Economic Times · YourStory

Consumer takeaway: Razorpay’s mark-to-market haircut (7.5 → 5) is the private market finally repricing payments, and its public listing will force disclosure of economics that MDR, not charity, has been quietly funding. And if your local co-operative bank starts offering a UPI handle of its own, the money still moves on NPCI’s rails — the bank just keeps a bigger slice and your transaction data in-house.

Quick hits

  • UPI lands at Dubai Duty Free: NIPL announced November 5 a 10% discount (up to AED 100) for UPI payments at Dubai International and Al Maktoum airports, with Network International as acquiring partner — activate UPI International in your payment app before flying. CNBC-TV18 · Times of India
  • SEBI eased its accredited-investor framework on November 5, letting AIF managers certify investors directly instead of routing through stock exchanges. ETBFSI
  • RBI ran a one-day ₹75,000 crore VRRR auction on November 5 to absorb festive-season liquidity, reversing today. TradersUnion
  • October funding stayed cold: Indian startups raised $678 million, down 47.5% month-on-month and ~61% year-on-year, with no $100M+ round — per Entrackr, 2026 is pacing toward the weakest year in seven. Deccan Chronicle