Fintech Deep Dive — Friday | November 06, 2026
Policy & Regulation | Developments: October 30 – November 6, 2026
This was the week Indian fintech’s rulebook stopped being drafted and started being defended. NPCI went to the Supreme Court to argue that the return of UPI merchant fees is a survival measure, not a tax grab. RBI consolidated three years of payment-security instructions into a single Master Direction and handed it to every non-bank payment operator. SEBI rewrote the KYC process for the diaspora, Razorpay walked through SEBI’s IPO gate at a valuation a third below its 2021 peak, and NBFCs discovered that RBI’s August proposal on revolving credit is not going away. Read together, the five stories describe a regulator that has finished building the policy superstructure and is now stress-testing it — in courtrooms, in consolidated rulebooks, and in the fine print of what NBFCs are allowed to sell.
1. NPCI tells the Supreme Court why UPI can’t stay free
The centrepiece of the week is NPCI’s counter-affidavit in Anjan Datta v. Union of India, the petition challenging the return of merchant discount rate (MDR) on UPI payments above ₹2,000. Reported on November 5, the affidavit defends the September framework — 0.4% MDR on person-to-merchant transactions above ₹2,000, capped at ₹300 — with a set of numbers that finally put official arithmetic behind the policy (LiveLaw; The Hindu).
The headline claim: about 96% of person-to-merchant transactions would remain free, because the charge attaches only to the roughly 4% of P2M payments above ₹2,000, and person-to-person transfers — nearly 70% of UPI’s volume — stay untouched. Small merchants, defined as those receiving up to ₹1 lakh in monthly UPI inward credits, are fully exempt. NPCI also committed to routing 5% of every participant’s MDR share into a dedicated fund subsidising digital adoption for merchants with turnover up to ₹20 lakh (LiveLaw; The Tribune).
The sharper argument is about who pays for the free lunch. NPCI cited the Parliamentary Standing Committee’s Thirty-Second Report, which found the government’s ₹2,000-crore budgetary allocation to offset zero-MDR costs covered only 11% of the industry’s actual operating expenses and 14% of potential MDR collections. Zero-MDR, the affidavit argues, made the ecosystem an ouroboros — a system whose growth consumes its own capacity, with “the magnitude of growth placing correspondingly greater demands on the security, resilience, and infrastructural capacity of the system” (The Hindu).
Two defensive positions matter for consumers. First, NPCI asserted that merchants cannot pass the MDR on to customers — not as a policy assurance but as an enforceable direction backed by contractual mechanisms, with violations exposing banks, PSPs and TPAPs to compliance action including termination of UPI membership (The Tribune; News18). Second, it argued it is not “State” under Article 12, insulating its circulars from constitutional challenge — a jurisdictional shield that will likely decide the case’s fate more than the economics (LiveLaw). The Court, which declined an interim stay in September, now has the full defence on record. For consumers, the practical test arrives with implementation: whether a ₹2,050 ChaiLocha purchase quietly becomes ₹2,058, or whether the pass-through ban holds in a market where every merchant has a “card charges extra” board. Zero-MDR was a subsidy; this affidavit is the state’s first honest accounting of what the subsidy never covered.
2. RBI hands non-bank payment operators one cyber rulebook
On November 5, RBI issued the consolidated (Cyber Resilience and Digital Payment Security Controls for non-bank PSOs) Master Directions, 2026 — circular RBI/DPSS/2026-27/475 — merging the July 2024 Master Directions with the 2019 cyber-security controls for third-party ATM switch application service providers and the January 2020 system-audit scope instructions into a single reference document (TaxGuru). It is effective immediately for large and medium non-bank payment system operators — the PPI issuers, card networks, TReDS platforms and cross-border operators outside the banking system — while small PSOs get runway until April 1, 2028 (TaxGuru).
The consolidation is housekeeping; the interesting clause is scope. Paragraph 5 obliges PSOs to ensure that unregulated entities in their ecosystem — payment gateways, vendors, third-party service providers, ATM switch ASPs — also adhere to these Directions, “subject to mutual agreement,” backed by a board-approved organisational policy (TaxGuru). That is the regulator acknowledging where payment breaches actually happen: not inside the licensed operator, but in the contractor handling its settlement files or hosting its switch. “Subject to mutual agreement” is the soft spot — a PSO whose vendors decline the terms complies with the letter of the rule by documenting the refusal — but requiring a board-level policy at least forces the decision into the open, on the record.
The governance load is real: a board sub-committee meeting at least quarterly with information-security expertise among its members, a designated CISO, a comprehensive cyber crisis management plan, key risk indicators, security operations centres, and system audits with the audit report due within two months of financial-year close and corrective action ordinarily within three (TaxGuru). The context explains the urgency: the RBI’s own Trend and Progress report put bank frauds at ₹34,771 crore for 2024-25 — nearly triple the previous year — with card and internet frauds making up 66.8% of cases, and CERT-In logged 5.7 lakh cyber incidents in the banking sector in 2025 (The Tribune). For consumers, consolidated rules translate into one auditable standard across the wallets, gateways and card rails that sit between your phone and the merchant — the value shows up only when an incident tests it.
3. SEBI lets the diaspora onboard from abroad
On November 4, SEBI issued its circular overhauling KYC for individual Persons Resident Outside India — NRIs, OCIs and foreign nationals — effective December 3, 2026. The substantive change: clients residing in FATF-compliant countries can complete the entire onboarding digitally, from anywhere, ending the requirement that they be physically present in India during digital KYC (Moneylife; Business Standard).
The mechanics are worth noting because they set the template for what “digital identity verification” now means in Indian regulation. Where in-person verification is infeasible, video IPV is allowed with layered safeguards: live GPS coordinates, date-and-time stamps, face-liveness checks, randomised actions to defeat pre-recorded video, protection against spoofed IP addresses, VPNs and proxies, uninterrupted recording, end-to-end encryption, and an authorised official of the intermediary present through the call (Moneylife; Mint). Overseas addresses are accepted as proof of address, specimen signatures can be electronic, completed KYC records must reach KRAs within three working days, and the framework extends to periodic re-KYC from FATF-compliant countries (Business Standard; Moneycontrol).
Two consumer notes. The exclusion cuts along FATF lines: clients in non-compliant countries stay on the older, harder process, meaning an OCI holder’s compliance now depends on their country of residence’s blacklist status — reasonable policy, but worth knowing before choosing where to re-KYC from (Economic Times BFSI). And the safeguard stack — GPS, liveness, anti-VPN — is the same architecture being normalized for resident verification everywhere in Indian fintech. SEBI is not just easing diaspora onboarding; it is codifying what friction-free-but-verified identity looks like, and that template will migrate to banking and lending KYC. For a diaspora that remits over $100 billion a year and has historically needed couriered documents and India trips to open a demat account, this is the most quietly consequential inclusion measure of the week.
4. Razorpay clears SEBI: the IPO gate opens, at a discount
Razorpay received SEBI’s approval for its IPO, sources confirmed on November 3–4, targeting a raise of ₹5,000–6,500 crore (estimates vary by report) at a valuation around $5 billion — roughly ₹49,000–50,000 crore — with listing targeted for the first quarter of calendar 2027 (Business Standard; Entrackr; Elets BFSI). The company had confidentially filed its draft red herring prospectus in June 2026; final papers are expected before March 2027, with Axis Capital, Kotak Mahindra Capital, JP Morgan and Citi on the ticket (Entrackr).
The number that tells the story is the valuation. Razorpay’s last private round priced it at $7.5 billion in 2021, during the funding-cycle peak; the IPO pricing accepts roughly a one-third haircut to meet public-market reality (Entrackr; Beats in Brief). Forbes India frames the listing as the test case for the cohort behind it — Fibe, Cult.fit, Acko, Navi and PayU are all queued — in a market where investor sentiment toward startup paper has turned cautious (Forbes India).
The regulatory read: SEBI’s confidential pre-filing route, which lets issuers test appetite without telegraphing numbers, has now processed India’s most closely watched payments IPO. For consumers the listing matters less for the price than for what disclosure compels — Razorpay’s settlement timelines, chargeback handling, merchant-fee structures and lending book will be in a public prospectus for the first time, converting marketing claims into audited fact. When the DRHP goes public, the merchant-fee and settlement pages are worth reading before the growth story.
5. The revolving-credit question RBI won’t drop
RBI’s August 6 proposal to restrict NBFC lending to term loans — effectively barring revolving credit facilities such as flexi-loans, overdraft-style products and salary-advance structures — is still reshaping product design, Mint reported on November 4. NBFCs are back at the drawing board, redrawing flexible-credit products around the proposed framework, and several expect the final norms to soften on aspects like the cooling period between restructuring and loan terms, while conceding the core restriction will hold (Mint).
Governor Sanjay Malhotra’s October 7 position explains why the industry is planning around the restriction rather than against it: the central bank received substantial feedback, but the proposal “was not a new restriction” — NBFCs were never permitted to offer such loans in the first place; the framework merely restates the boundary (Mint). That framing matters for consumers holding flexi-loan products marketed as revolving credit from NBFC platforms: the products’ legality was always thinner than their app screenshots suggested, and the final directions will decide whether the convenience survives inside term-loan wrapping — with the interest-only-minimum-payment mechanics that made flexi-loans deceptively cheap likely to disappear.
On the radar
DPDP consent managers go live November 13. The consent-manager provisions of the DPDP Rules, 2025 take effect next week, with the core notice, security and breach obligations following by May 2027; vendors are already selling compliance stacks to banks and NBFCs against penalties that can reach ₹250 crore (The Tribune). Whether consent managers actually materialise as functioning intermediaries — or as another checkbox — is the story to watch.
Crypto-card deactivations continue. RBI and FIU-IND’s scrutiny of offshore stablecoin cards (RedotPay et al.) continued through the week, with users reporting sudden deactivations as authorities examine FEMA and payment-regulation violations (CCN). The enforcement backdrop was covered in yesterday’s cross-border deep dive; the consumer lesson bears repeating — an offshore wallet behind a Visa-branded card has no Indian ombudsman when the card dies mid-checkout.
UPI acceptance infrastructure keeps growing. RBI data shows UPI QR codes rose nearly 9% in September 2026, the acceptance base expanding ahead of the MDR regime’s activation (MediaNama).
The takeaway
The common thread this week is justification. NPCI’s affidavit is the first official document that prices what zero-MDR actually cost; RBI’s consolidated Master Direction converts scattered security instructions into a single standard a consumer can hold operators to; SEBI’s KYC circular specifies, clause by clause, what verified-but-remote identity means. Regulation is shifting from rule-making to rule-defending, and for consumers that shift cuts both ways: the protections are getting explicit and enforceable, but so are the charges. The next test is delivery — whether the MDR pass-through ban holds at the merchant counter, whether “subject to mutual agreement” vendor clauses survive a real breach, and whether a $5 billion payments IPO discloses the fee structures this column has spent years reconstructing by hand.