Fintech Deep Dive — Sunday | November 08, 2026
Weekly review | Developments reported November 1–8, 2026
The week Indian fintech’s free lunch got its invoice. UPI closed October with its biggest month ever — the first ₹1 lakh crore average day, the first month past ₹30 lakh crore — in the same seven days its operator filed a hundred-page Supreme Court affidavit defending the return of merchant fees. The Enforcement Directorate kicked in the doors of the stablecoin shadow corridor while regulators kept widening the sanctioned ones. Razorpay cleared its IPO hurdle at a valuation a third below its 2021 peak. And nearly thirty investors discovered that the American stocks they thought they owned could be sold without them. Here are the five stories that will shape December.
1. UPI sets the record, then defends the bill
October was UPI’s biggest month ever: 25.47 billion transactions worth ₹31.53 lakh crore — up 23% in volume and 16% in value year-on-year — the first month above ₹30 lakh crore, with average daily value crossing ₹1 lakh crore for the first time on roughly 821 million transactions a day (Moneycontrol; Economic Times). The milestone landed against a quality warning worth reading twice: NPCI’s September data shows technical decline rates among the twenty largest remitter banks rising to 0.24% from 0.18%, with ICICI at 0.73%, SBI at 0.38% and Kotak at 0.36% — all more than doubled month-on-month (Medianama). At 25 billion transactions a month, even that failure rate means tens of millions of stuck payments.
Into the record month walked NPCI’s counter-affidavit in Anjan Datta v. Union of India, the PIL challenging the UPI merchant discount rate framework — filed November 3, reported through November 5–6 (LiveLaw; MediaNama). The arithmetic finally has official numbers behind it: the charge — up to 0.4%, capped at ₹300 — attaches only to person-to-merchant payments above ₹2,000, roughly 4% of P2M volume; person-to-person transfers stay free; small merchants receiving up to ₹1 lakh a month via QR keep zero MDR; and 5% of every participant’s MDR share funds small-merchant adoption for businesses with turnover up to ₹20 lakh. The sharpest arguments were defensive: the pass-through ban on merchants is a “mandatory and binding direction” enforced through NPCI’s contracts, with violations up to termination of UPI membership; UPI apps cannot levy platform fees; and NPCI is not “State” under Article 12, which would sink the petition’s maintainability under Article 32 (Business Standard; The Tribune). NPCI also put the subsidy’s failure on the record, citing the Parliamentary Standing Committee’s finding that the government’s ₹2,000-crore zero-MDR offset covered just 11% of the industry’s actual costs and 14% of potential MDR collections (LiveLaw).
The consumer test remains implementation, not litigation: whether a ₹2,050 purchase quietly becomes ₹2,058, or the ban holds where every merchant already has a “card charges extra” board. The go-live itself is still unnotified — “immediately after Diwali” was NPCI’s October position, Diwali fell today, and Financial Express sources now point to January 1, 2027 (Financial Express). The quiet structural story inside the week: NPCI also stood up NPCI Tech Solutions Limited, its fourth subsidiary, to chase AI and blockchain work beyond the non-profit payments core, with CTO Vishal Kanvaty as MD & CEO (Reuters via Yahoo Finance). The operator of the national rail is becoming a vendor in the market its rail enables — its revenue lines and governance disclosures deserve the same scrutiny as its fee circulars.
2. AI agents became the threat model and the checkout feature in the same week
The week’s most ironic pairing: on November 3, I4C’s National Cybercrime Threat Analysis Unit and CERT-In warned banks, NBFCs and fintechs that “use of Agentic AI Framework makes the attack possible at machine speed” — intruders draining automated disbursement systems and payment APIs, pushing stolen funds through mule accounts on IMPS and NEFT, and deleting records to stall investigations, with individual cases running to multiple crores (The Federal; Free Press Journal). The advisory builds on CERT-In’s October advisories CIAD-2026-0046 (payment-API exploitation) and CIAD-2026-0049 (AI agents as attack vectors).
The regulatory response moved unusually fast, in two layers. RBI’s confidential November 3 advisory to banks processing API-based transfers requires a full inventory of API clients, a CERT-In security audit before onboarding any new NBFC client (existing ones by February 3, 2027), risk assessment of business correspondents, payment aggregators, PSPs and fintech clients within three months, immediate per-transaction and daily cumulative limits, intra-day velocity limits within a month, beneficiary whitelisting where additions happen only through a separate MFA-protected channel, and maker-checker or out-of-band confirmation on API debits — at least one safeguard live for all existing integrations by December 3, 2026 (MediaNama). Days later, RBI consolidated three years of instructions into a single cyber-resilience Master Direction for non-bank payment operators — payment aggregators, PPI issuers, card networks, white-label ATM operators — with a six-hour breach-reporting clock, device binding, blocking of remote-access apps during live payments, a minimum 12-hour cooling period before online transactions work after a registered mobile or email change, quarterly board-level technology-risk committees, and disaster recovery in a different seismic zone. Large and medium operators comply immediately; small ones by April 1, 2028 (NDTV Profit).
Meanwhile the same capability shipped as a product. Cashfree Payments launched “Checkout for Agents” on November 6 — a WebMCP layer letting AI shopping agents read a checkout’s order amount, items and payment methods directly instead of scraping pixels, cutting token consumption over 40%, with final payment approval kept on the customer’s device (Business Standard). Agentic commerce is now simultaneously a sales channel and the week’s named attack vector — which is exactly why the approval screen is the only checkpoint that is genuinely yours. For consumers the practical translation: expect payout friction when fintech apps add new beneficiaries (that is the whitelisting working), and if an unauthorised transfer hits your account, call your bank and the 1930 helpline within minutes. Note the disclosure gap that survived the week: the six-hour clock runs to the regulator, not to affected users.
3. The stablecoin shadow corridor got bricked — while the sanctioned doors widened
The enforcement half: ED’s Bengaluru zonal office searched premises linked to RPFAS Technologies (which runs Mudrex and Saber.money) and Instadapp Labs on October 27 under FEMA, alleging over ₹4,600 crore of unauthorised cross-border transfers plus roughly $40 million at the Instadapp-linked entities — north of ₹5,000 crore moved by converting user rupees into stablecoins and paying out through OTC deals on Binance and Bybit via shell entities in tax havens (Indian Express; crypto.news). It was the second such action this year, after June’s ₹2,500-crore probe across Transak and four others. The consumer-facing half arrived November 2: RBI and FIU-IND are scrutinising prepaid crypto cards — RedotPay the named example — that let Indians spend offshore stablecoin wallets at domestic merchants on cards that look like ordinary Visa/Mastercard debit cards; several providers’ sites and cards have been blocked since around October 29, with the probe triggered partly by Digital South Trust, a Bengaluru research outfit that bought a card and documented the flows (Economic Times; Crypto Times). The global backdrop: Visa’s CEO said its network now carries 225+ stablecoin-linked card programmes, up over 70% year-on-year.
The construction half ran in parallel. Razorpay received its final IFSCA PSP licence on November 2, completing the dual stack — RBI’s PA-CB authorisation for the domestic leg, GIFT City licensing for the international leg — days after Skydo picked up the identical licence (Economic Times). SEBI created a depository-receipts framework for REITs and InvITs on GIFT City’s international exchanges. And RBI’s FEMA Second Amendment Regulations quietly deleted the Export Declaration Form requirement for resident individuals exporting services — freelancers and consultants billing foreign clients no longer file a separate form at all (News On Air; TaxGuru). One policy, two halves: make the legal route cheaper, make the bypass expensive and traceable. For anyone still holding a blocked crypto card, the lesson is custody: a balance with no Indian regulatory custody has no ombudsman, no chargeback and no FEMA recourse when access dies overnight.
4. Razorpay cleared the IPO gate — at a $2.5 billion haircut
Razorpay’s SEBI approval, reported November 3–4, clears a ₹5,000–6,000 crore IPO at a valuation around $5 billion (₹49,000–50,000 crore) — about a third below the $7.5 billion its last private round commanded in 2021 — with listing targeted for January–March 2027 after a June confidential pre-filing and the May 2025 reverse flip (Economic Times; Moneycontrol; CNBC-TV18). FY25 consolidated revenue rose 65% to ₹3,783 crore with a net loss of ₹1,209 crore driven by one-time ESOP and flip costs; Axis Capital, Kotak, JP Morgan and Citi are the bankers. The haircut is the private market’s repricing of payments finally becoming public record — and the prospectus will force disclosure of exactly the economics that returned MDR revenue now underwrites, which is why this story and story one are the same story at different altitudes.
Around it, consolidation and credit kept moving. CCI cleared Kotak’s ₹281.7-crore slump purchase of Deutsche Bank’s India retail and wealth business — ₹29,000 crore of loans, ₹16,000 crore of deposits, roughly 1.5 lakh customers, 1,000 employees, completion expected by September 2027 (Business Standard). MobiKwik’s subsidiary got its RBI NBFC licence, targeting ₹5,000 crore of co-lending disbursements over three to four years off a 196-million-user base whose Q2 disbursements grew 34% (Economic Times). Venture stayed frozen — October’s $678 million was down 47.5% month-on-month and about 61% year-on-year with no $100M+ round (Deccan Chronicle); the November 2–6 week managed $255 million across 20 deals, with GIVA ($103M) and EloElo ($80M) making up nearly three-quarters of it. The funded money rotated to collateral: TPG’s Rise Funds committing up to ₹800 crore to Kirloskar’s Arka Fincap, Muthoot Microfin raising $40 million from responsAbility and BlueOrchard (Economic Times).
5. Stockal and the custody chain nobody reads
The consumer-rights story of the week: Moneycontrol reported November 3 that nearly 30 investors claim over ₹100 crore in losses after their US-stock holdings — Apple, Nvidia, Amazon, Tesla, Alphabet — were liquidated without authorisation on October 15 through Stockal Securities, a Bengaluru-based, SEBI-registered platform for US investing, with proceeds allegedly moved into a little-known Chinese digital-insurance stock that then crashed (Moneycontrol). India Today documented one investor’s ₹3.19 crore wipeout (India Today). Stockal’s parent Borderless Investing denied any platform breach on November 4, pointing to possible credential theft via social engineering; investors have complained to SEBI, FINRA and the SEC and filed police complaints. The structural fact underneath: India-facing apps like Stockal sit on top of US clearing brokers — DriveWealth in this chain — which actually hold the shares, a custody layer most users never see and app-level SEBI registration does not govern.
The counterpoint landed in the same week: SEBI’s November 4 circular, effective December 3, lets NRIs and OCIs in FATF-compliant countries complete investment KYC entirely from abroad — digital documents plus video verification, portable across brokers, depositories and mutual funds (Moneycontrol). The compliant cross-border path is getting easier at precisely the moment its least-regulated corners showed their fragility. For anyone investing abroad: find out which clearing broker actually holds your shares, turn on 2FA, and treat portfolio alerts as something you read, not archive.
The rest of the week, briefly
NSE rewrote closing-price discovery and F&O expiry-day settlement from December 7 — a shorter ten-minute closing auction and a differently computed settlement price narrow the last-hour games options buyers have long complained about (Economic Times). UPI’s foreign acceptance went digital — Burj Khalifa and Resorts World Sentosa bookable online, Dubai Duty Free offering 10% off for UPI payments (Moneycontrol). Equitas SFB named an interim CEO after founder P N Vasudevan’s exit; SGB 2021-22 Series VII holders exited at ₹14,167 against a ₹4,715 issue price; IDBI staff struck against the ₹52,878-crore Fairfax sale; and Muthoot Finance’s Stage 3 gold-loan NPAs more than doubled to ₹7,267 crore under RBI’s April EMI-based framework (Financial Express).
The week’s through-line: every subsidy and shortcut of fintech’s growth era got repriced at once — free UPI in an affidavit, private valuations in a prospectus, the stablecoin bypass in an ED search, custody trust in a ₹100-crore complaint. The watch list for the fortnight ahead: the MDR go-live notification (January 1, 2027 is the reported candidate), NPCI’s 30% market-share cap taking effect in December, SEBI’s response on Stockal, and whatever Razorpay’s prospectus says about what merchant fees actually fund.
Sources: all figures linked inline to primary reporting from November 1–8, 2026.