Introduction
The debate around the reintroduction of Merchant Discount Rate (“MDR”) on certain Unified Payments Interface (“UPI”) transactions has largely focused on whether UPI should remain free. The more precise legal question is different: What is the source of the power to determine the rate, threshold and caps that will govern merchant-side UPI charges? The distinction matters because the statutory amendment and the subsequent MDR framework came from two different sources.
Parliament amended Section 10A of the Payment and Settlement Systems Act, 2007 (“PSS Act”) in August 2026. The Central Government subsequently notified the electronic modes that would continue to enjoy statutory protection from charges. The detailed MDR framework was then issued by the National Payments Corporation of India (“NPCI”), following deliberations of the UPI and Services Steering Committee. The resulting framework may ultimately prove legally sustainable. But the precise boundary between the Central Government’s statutory power and NPCI’s authority as the operator of an authorised payment system deserves closer examination.
What Section 10A Now Provides
The original Section 10A, introduced in 2019, prohibited banks and system providers from imposing charges on payments made through electronic modes prescribed under Section 269SU of the Income-tax Act, 1961. UPI, BHIM-UPI and UPI QR were prescribed modes from January 01, 2020, resulting in the zero-charge regime for those payment modes. The Taxation and Other Laws (Amendment) Act, 2026 has changed that architecture. It substitutes the earlier reference to Section 269SU with a provision under which the Central Government may, by notification, specify one or more electronic modes of payment to which the statutory no-charge protection applies. The amendment received Presidential assent on August 17, 2026. The change is important, but it should not be overstated. Parliament did not itself prescribe an MDR, nor did it impose a charge on UPI transactions. It created a notification-based framework under which the Central Government would determine the electronic modes that remained protected.
The Central Government exercised that power on September 14, 2026 through Gazette Notification S.O. 5067(E). The notification protects RuPay powered debit cards and UPI transactions up to INR 2,000 (Indian Rupees Two Thousand Rupees only) from direct or indirect charges by banks or system providers. The notification therefore establishes the boundary of the statutory no-charge protection. It does not itself prescribe an MDR of 0.4% (zero point four per cent), an INR 300 (Indian Rupees Three Hundred only) cap or the sector-specific rates subsequently announced. That distinction is central to the legal analysis.
Where Did The MDR Come From?
On September 15, 2026, NPCI issued Circular No. NPCI/UPI/OC-No.237/2026-27. The framework is scheduled to take effect from October 15, 2026 and introduces an MDR of 0.4% (zero point four per cent) on specified person-to-merchant (“P2M”) UPI transactions above INR 2,000 (Indian Rupees Two Thousand Rupees only), subject to a cap of INR 300 (Indian Rupees Three Hundred only) for transactions of INR 75,000 (Indian Rupees Seventy-Five Thousand only) and above. Certain sectors receive concessional treatment, including a flat INR 5 (Indian Rupees Five only) MDR for specified essential and thin-margin sectors and a 0.02% (zero point zero two per cent) rate, capped at INR 300 (Indian Rupees Three Hundred only), for specified capital-market transactions. However, person-to-person transactions remain free. Small merchants falling within the P2M framework also continue to receive zero-MDR treatment, subject to the applicable conditions. The Government states that approximately 96% (ninety-six per cent) of P2M transactions will remain unaffected.
The Ministry of Finance had itself indicated in August, before the final framework was announced, that the UPI and Services Steering Committee headed by NPCI would determine whether MDR would be introduced and, if so, its scope and structure. The September framework is therefore not simply a case of a rate appearing without any governmental indication of who would determine it. The Government had publicly contemplated that role for the UPI Steering Committee. The harder question is whether the statutory framework supports that allocation of responsibility.
NPCI is Not Merely A Private Body Outside The Statutory Framework
This is where the analysis becomes less straightforward than a conventional delegated-legislation challenge might suggest. NPCI operates UPI as an RBI-authorised payment system operator. The PSS Act expressly regulates the conduct of a “system provider”. Section 20 requires a system provider to operate its payment system in accordance with the Act, the contracts governing relationships among system participants, the rules and regulations governing the payment system, the conditions of its authorisation and RBI directions. Section 21, in turn, expressly requires a system provider to disclose the terms and conditions of the payment system, including charges, to existing and potential system participants. That statutory architecture matters. It would therefore be difficult to contend, without further analysis of NPCI’s authorisation and the applicable UPI rules and agreements, that NPCI has no legal capacity whatsoever to prescribe commercial terms within the UPI payment system. The PSS Act plainly contemplates a system provider operating under rules and contracts and having charges associated with its payment system. The real issue is narrower.
Does the PSS Act permit NPCI to determine the substantive MDR applicable to merchants as part of its system rules, or does fixing a mandatory nationwide rate amount to the exercise of a public regulatory power that must be traceable to an express statutory delegation?
The answer may depend, among other things, on the legal relationship between NPCI, participating banks, payment service providers and merchants; the terms of NPCI’s authorisation; the applicable UPI operating rules; and the contractual mechanism through which the MDR is ultimately recovered from merchants. That analysis is currently missing from much of the public discussion.
Delegated Legislation or Payment-System Governance?
The distinction is important because the absence of a Gazette notification is not, by itself, sufficient to establish invalidity. The September 14 instrument issued by the Central Government is a Gazette notification under Section 10A. The subsequent NPCI framework is a different instrument issued by the system provider. If the NPCI framework operates as a set of rules governing participating institutions and the contractual relationships through which merchant acquiring is undertaken, it may not need to take the form of subordinate legislation published in the Gazette.
On the other hand, if the MDR framework is said to derive its legal force directly from Section 10A, there is an obvious question: where in Section 10A is NPCI authorised to determine the rate, the monetary threshold, the cap or the sectoral classification?
Section 10A gives the Central Government the power to specify the electronic modes that receive the statutory protection. It does not expressly confer a rate-setting power on NPCI. That does not necessarily make the NPCI framework ultra vires. It means that the source of NPCI’s authority has to be found elsewhere, most plausibly in the statutory framework applicable to system providers, NPCI’s authorisation and the contractual and operational rules governing UPI.
The Supreme Court’s jurisprudence on delegated legislation reinforces the importance of this distinction. A subordinate authority cannot travel beyond the source of power conferred by the parent statute. At the same time, legislation may validly leave ancillary matters and implementation details to subordinate or specialist bodies where the statutory framework supplies the necessary policy and standards. The question, therefore, is not simply whether Parliament itself wrote the MDR into the statute. It did not. The question is whether the particular rate-setting function exercised by NPCI falls within the authority already available to it as an authorised system provider. That is a materially narrower, and more difficult, question.
The Consultation Question
The absence of a public consultation process is another issue that requires careful treatment. The MDR framework was finalised within days of the Central Government’s Section 10A notification. There was no publicly announced consultation exercise comparable to the process ordinarily associated with formal rule-making. That may be relevant to a challenge based on procedural fairness, particularly if the framework is characterised as an exercise of public regulatory power. But consultation is not an automatic legal prerequisite to every decision affecting a regulated market. Whether it was required would depend on the source of the power, the applicable regulations, NPCI’s authorisation and the governing contractual and regulatory framework.
Accordingly, the stronger criticism is not that the absence of consultation necessarily invalidates the MDR, but that greater transparency around the statutory and regulatory basis for the rate-setting exercise would make the framework easier to defend and easier for affected participants to understand. That distinction is likely to matter if the issue reaches judicial review.
Legitimate Expectation: Relevant, But Not Determinative
A separate issue arises from the Government’s earlier public statements. In June 2025, the Ministry of Finance described reports that MDR would be imposed on UPI transactions as “completely false, baseless, and misleading”. That statement is relevant to the question of legitimate expectation, particularly because UPI participants and businesses may have made commercial decisions during a period in which the zero-MDR framework was presented as continuing. But legitimate expectation should not be overstated. The Supreme Court has consistently recognised that the doctrine does not create an immutable substantive right to continuation of a policy. A legitimate expectation may require fairness in the manner in which a public authority departs from a representation or established practice, but it can yield to a change in policy or overriding public interest.
The June 2025 statement was also made in response to speculation about a possible policy at that time. It was not, on its face, a statutory assurance that MDR could never subsequently be introduced. The more credible legal argument is therefore one of procedural fairness and reliance, rather than an assertion that the 2025 statement permanently constrained the Government’s ability to change policy. A court considering such a challenge would likely have to examine the nature of the representation, the extent of any demonstrable reliance, the subsequent legislative change and the public-interest rationale advanced for the new framework.
The INR 300 Cap And The Declining Effective Rate
The economic structure of the MDR framework raises a separate policy question. For a qualifying transaction of INR 75,000 (Indian Rupees Seventy-Five Thousand only), a 0.4% (zero point four per cent) MDR produces a charge of INR 300 (Indian Rupees Three Hundred only). Once the cap applies, however, the absolute MDR remains INR 300 (Indian Rupees Three Hundred only) irrespective of the transaction value. An INR 5,00,000 (Indian Rupees Five Lakhs only) transaction would therefore carry an effective MDR of 0.06% (zero point zero six per cent), substantially below the headline rate of 0.4% (zero point four per cent).
The structure consequently produces a declining effective rate for higher-value transactions once the cap is reached. Whether that is appropriate is ultimately a question of policy and rate design. But it is relevant to the stated objective of creating a sustainable revenue model for the UPI ecosystem. The Government and NPCI have justified the framework by reference to the cost of maintaining infrastructure, cybersecurity, fraud prevention and technical support, with industry estimates placing annual operating costs at approximately INR 20,000 crores. UPI processed approximately 2,451 crore transactions worth INR 29.9 lakh crore in August 2026 alone.
If the objective is to create a broad-based mechanism for funding the payment infrastructure, the declining effective rate produced by the cap is a feature that warrants explanation. Conversely, if the cap is intended to prevent the MDR from becoming disproportionately burdensome on high-value transactions, that policy rationale is also capable of supporting the structure. The legal significance lies less in deciding which economic approach is preferable and more in asking whether the rate-setting body considered relevant factors and acted within the scope of the authority available to it.
WHAT WILL MATTER IF THE FRAMEWORK IS CHALLENGED?
A challenge to the new MDR framework would likely require a court to separate three questions:
- First, what exactly did Parliament authorise?
The 2026 amendment gives the Central Government a notification-based power to determine which electronic payment modes receive Section 10A’s statutory protection. It does not itself prescribe an MDR. - Second, what authority does NPCI have as an authorised system provider?
Sections 20 and 21 of the PSS Act recognise rules, contracts and charges within a payment system. The scope of that authority, and the terms of NPCI’s authorisation and UPI operating framework, therefore become central to the analysis. - Third, was the power exercised fairly and rationally?
Even where an authority possesses the relevant power, the exercise of that power may remain subject to ordinary public-law constraints, including non-arbitrariness, consideration of relevant factors and procedural fairness where applicable.
These questions are no longer entirely theoretical. A public interest petition has been filed before the Supreme Court challenging the September framework and the underlying statutory architecture. The reported challenge questions, among other matters, the source of authority for the rate-setting mechanism and the absence of a more transparent process. As of September 23, 2026, the Supreme Court had not yet adjudicated those issues.
The October 15 commencement date will therefore be an important point in the development of the legal position. But the more enduring issue is not whether UPI has ceased to be free in the abstract. It is how far a statutory payment-system framework can permit a specialist system operator to determine the commercial price of access to that system, and where the line lies between operational governance and the exercise of delegated public power. That question extends beyond UPI. It goes to the broader architecture of India’s increasingly regulated digital payment infrastructure, where statutory regulators, specialised system operators and private contractual arrangements operate within the same framework.
