Over the years, India’s Unified Payments Interface has moved a largely cash economy onto digital rails at a fast pace. In May this year alone, it processed 23.2 billion transactions worth close to Rs 30 lakh crore. But digital public infrastructure of this size also brings responsibility. There is a well-established idea in financial regulation that fits this situation, and we have applied it everywhere except here. It is called concentration risk.
Concentration risk arises when too much depends on too few. It is not a claim that the few are badly run. It is a statement about what happens when one of them stops.
In India’s payments system, this kind of risk sits in three layers, one on top of the other.
First, more than eight out of every ten digital retail payments in this country now move on a single rail, the Unified Payments Interface (UPI). Second, that rail is designed, run and governed by a single organisation, the National Payments Corporation of India (NPCI). Third, on that rail, two applications, PhonePe and Google Pay, carry close to four-fifths of all traffic. In May 2026, their combined share was 79 per cent, the first time it had slipped below 80 per cent.
On 5 November 2020, NPCI issued a circular capping any single third-party app at 30 per cent of monthly UPI volume, stating that it was acting “to address the risks and protect the UPI ecosystem”. Established players exceeding the threshold were given until December 2022 to comply. That deadline has been deferred twice and now stands postponed to 31 December 2026. What has never been adequately explained is why.
Also Read: Taxing India’s gaming industry into oblivion won’t cure gaming-related social ills
The unintended consequences
Consider what happens when UPI stops working. It suffered repeated outages through 2025, of which NPCI properly explained the cause of only one, on 12 April. For a salaried person, four hours without UPI is an irritation. For a pushcart vendor or an auto driver, it can mean a day’s earnings, because they have no card machine, no second app and no fall-back.
Then there is fraud, where our record is worse than we admit, and where concentration can heighten systemic vulnerabilities. The government’s own answers in Parliament record 10.64 lakh UPI fraud incidents costing Rs 805 crore till November 2025, and nearly 5.86 lakh digital payment fraud cases worth Rs 3,590 crore over five years.
Is there evidence that concentration itself makes this worse for consumers, rather than being merely untidy? There is, and it comes from a country that has travelled further down this road than India. In a 2024 study, ‘FinTech Monopoly and Systemic Risk’, researchers in China argued that regulators should curb fintech dominance and encourage fair competition. Pointing to the fact that two mobile applications account for 94 per cent of China’s digital payments market, they warn of “severe risk contagion”, where trouble at one platform spreads through the wider financial system.
What global research tells us
Two papers published in July offer useful pointers for India — a Bank for International Settlements (BIS) bulletin paper on ‘Competition in retail digital payments’ and an IMF technical note on ‘BigTech in financial services’.
The BIS paper points to UPI as an example of a system that is open and interoperable, but where two providers still account for about 80 per cent of the user-facing market. The IMF looks at a related concern: how large technology companies can leverage network effects to expand into other financial services, including lending.
Together, they yield the following lessons for India:
- Interoperability alone does not guarantee competition
UPI was designed to be interoperable from the beginning. Users can send money to someone using another app, and merchants can accept payments from different apps. But that has not stopped the market from becoming concentrated. Why?
Because payment apps benefit from network effects. Consumers want to use the app that is accepted everywhere. Merchants want to accept the app that consumers already use. Once an app gets ahead, it becomes easier for it to get even bigger. Interoperability is necessary for competition, but it may not be enough to create competition once a market has already tipped towards a few large players.
- Payments can become a gateway to other financial services
The IMF cautions that BigTech dominance in payments can have implications beyond payments themselves. Large payment platforms can use their scale, data and existing user base to expand into other financial services, creating dependencies that are difficult to unwind. It also flags the risk of “loss-leader” strategies, where services are offered cheaply to build scale but may eventually stifle competition and reduce consumer choice.
The concern is not just who dominates payments today, but what that dominance enables tomorrow.
- Concentration raises questions about strategic dependence
The two largest applications, PhonePe and Google Pay, are controlled by companies headquartered outside India: one by a US-based retailer and the other by a US technology group.
That does not, by itself, make their participation in UPI a problem. But UPI is no longer just another payment product. It is a national digital infrastructure, processing more than 23 billion transactions a month. When so much of that infrastructure depends on a small number of applications, questions around data governance, resilience and continuity deserve attention. India built UPI in part to reduce its dependence on foreign card networks. Yet it has allowed a comparable dependence to form for payment apps.
- An operational risk.
Concentration is not just about competition. If an application handling nearly half of all UPI transactions suffers a prolonged outage, cyberattack or regulatory disruption, where does that volume go? In theory, users can simply move to another app. In practice, millions of users cannot be expected to download, onboard and set up another UPI app in the middle of a crisis. A more diverse ecosystem is therefore not just better for competition. It is also a form of resilience.
The competitor that never arrived
It is worth remembering that the Reserve Bank once tried to fix the middle layer of this problem. In 2019, it proposed New Umbrella Entities: retail payment networks that would operate alongside NPCI so that the country would not depend on a single operator. Applications were invited in 2020. The process was quietly shelved the following year.
This is not a new concern in Parliament either. The Parliamentary Standing Committee on Communications and Information Technology flagged in 2023 that indigenously developed BHIM UPI accounted for just 0.22 per cent of UPI transactions by volume, compared with 36.39 per cent for Google Pay and 46.91 per cent for PhonePe — both owned by or substantially held by foreign entities (Google and Walmart).
The committee also observed that regulators find it harder to hold apps to account when they are owned abroad and operate across multiple jurisdictions. It recommended a greater focus on promoting local Indian players in the fintech universe.
More than two years on, almost nothing has changed.
Also Read: Tamil Nadu sand mining scandal spans decades and governments. It’s time to put a stop to it
What December should mean
The cap was framed in 2020 because NPCI itself identified concentration as a risk to the ecosystem it administers. Yet with every postponement, there has been little explanation of what has changed. Does the concentration risk no longer exist? Or has it been addressed in some other way?
If the 30 per cent cap is the wrong instrument, NPCI should say so plainly, retire it and open a transparent consultation with Parliament, the regulator and the industry. If it is the right instrument, it should take effect. Ten years into UPI, the Ministry of Finance should also examine whether concentration has simply shifted to the application layer, and what this means for competition, data governance, resilience and continuity.
Karti P Chidambaram is a Member of Parliament for Sivaganga, and a Member of the All India Congress Committee. His X handle is @KartiPC. Views are personal.
(Edited by Asavari Singh)