In October 2026, India's Unified Payments Interface (UPI) processed 25.47 billion transactions worth ₹31.53 lakh crore, according to National Payments Corporation of India (NPCI) data reported by Inc42. It was the first month above 25 billion. UPI launched in 2016.
UPI is one layer of what is informally called the India Stack: a national digital identity, a payments network, a consent-based data-sharing framework, and an open commerce protocol. Each is a public rail. Private companies build products on top.
This article is for a team building or scaling a product in India, or in a market that is copying India's approach. It covers what each layer does, what it costs to use, what rules sit around it, and which parts transfer to other countries.
The design choice that matters most
Each layer does one narrow job and exposes it through published interfaces. The state, or a body it sets up, runs the rail. Banks, payment apps, lenders, and retailers compete on the products built on it.
For a builder, that means three things. You do not build identity checks, bank transfers, or data pipes from scratch. You do depend on rules you do not control. And your competitors have the same rails, so any advantage has to come from what you build on them.
Aadhaar: identity
Aadhaar is a 12-digit identity number linked to biometric data. The UIDAI enrollment dashboard showed 144.66 crore (about 1.45 billion) Aadhaar numbers generated, in figures published in May 2026.
The rule to know is the Supreme Court's September 2018 judgment in Justice K.S. Puttaswamy v. Union of India. The court upheld Aadhaar but struck down the part of Section 57 of the Aadhaar Act that let private companies require Aadhaar authentication. Parliament's 2019 amendments then allowed voluntary Aadhaar authentication by banks and licensed telecom operators, with the holder's informed consent, and by some other entities subject to central government approval.
What to do: if your onboarding uses Aadhaar-based eKYC, ask counsel which authentication modes your entity type may use, and whether you need an offline or alternative route for customers who decline. Do not copy a competitor's flow and assume it applies to you.
UPI: payments
UPI, run by NPCI, moves money between bank accounts in real time using a phone number, a virtual payment address, or a QR code. Any licensed app can connect, which is why several large consumer apps compete on the same network.
Merchant pricing is the part to watch. The government waived the merchant discount rate on UPI in 2020, so most merchants paid nothing to accept it. In 2026 that started to change: news reports in September and October described an NPCI framework to charge a fee on larger merchant payments, with small merchants and small-value payments exempt, and reports differed on the start date.
What to do: before you model payment costs for an Indian product, read the current NPCI circular, not a summary. Build your pricing so a small per-transaction fee on larger payments does not break it.
Account Aggregator: consent-based data sharing
The Account Aggregator (AA) framework, regulated by the Reserve Bank of India, lets a person share financial data, such as bank statements, with a lender or other regulated user. The person approves each request. The aggregator passes the data along encrypted. Sahamati describes aggregators as data-blind: they cannot view the data in transit and may not store or sell it.
The framework went live in September 2021. In September 2026, Sahamati, the industry body for the AA ecosystem, reported more than 500 million fulfilled consents. It also reported that AA-enabled lending reached ₹3.82 lakh crore across 3.68 crore loans in FY26, or 8.4 percent of retail and MSME lending by value. These are the industry body's own figures.
The practical change is for underwriting. A lender can request a borrower's transaction history with consent and read it by machine, rather than collecting PDF statements. The model that reads it is still the lender's responsibility, and so is explaining a decline.
What to do: if you lend, insure, or advise on money in India, design your intake around AA consent from the start. Ask for the narrowest data and the shortest duration your decision needs; the consent screen shows the customer what you asked for.
ONDC: commerce
The Open Network for Digital Commerce (ONDC) is a not-for-profit company incorporated in December 2021. Its pilot began on 29 April 2022 in five cities: New Delhi, Bengaluru, Bhopal, Shillong, and Coimbatore. The idea is a shared protocol, so that a buyer app and a seller app from different companies can complete one order.
ONDC is younger than the other layers and its long-term place next to the large marketplaces is not settled. For a seller or logistics company, it is one more channel to test, with its own fees and service-level terms to read.
The data law around all of it
India's earlier Personal Data Protection Bill, 2019, was withdrawn in August 2022. The Digital Personal Data Protection Act, 2023 received presidential assent on 11 August 2023. The government notified the DPDP Rules in November 2025 and set a phased rollout; law firm AZB & Partners described the phases as running for 18 months, to May 2027.
Consent sits at the center of that law, as it does in the AA design. A product built around granular, logged consent will need fewer changes than one that collects broadly and asks later.
What to do: map which personal data you collect, why, and for how long. Ask counsel which obligations apply to you in which phase, and put the dates in your product roadmap.
What transfers to other markets
Other countries are adopting parts of this approach. The G20 New Delhi Leaders' Declaration in September 2023 welcomed a G20 framework for digital public infrastructure and India's plan for a global repository of DPI. MOSIP, an open-source identity platform developed at IIIT Bangalore, lists Ethiopia (where the national ID is branded Fayda), Morocco, and the Philippines among the countries using it. UPI payments are now accepted in several other countries, among them Singapore, the UAE, France, and Nepal, according to Indian government figures reported in 2026.
Three cautions apply before you plan a product elsewhere around India's model.
- A shared design is not a shared rail. A country that adopts an open-source identity platform still runs its own registry, rules, and access terms. Your integration work is per country.
- Scale took years. UPI launched in 2016 and passed 25 billion monthly transactions a decade later. A country starting now will not have that volume when you launch.
- The surrounding law decides what you can build. The Aadhaar judgment and the DPDP Act shaped Indian products as much as the technology did. Each new market will have its own equivalents.
A checklist for builders
- List every place your product verifies identity, moves money, or reads financial data. For each, name the public rail you could use instead of building.
- For each rail, get the current terms from the operator: fees, uptime commitments, onboarding requirements, and who may connect.
- Get a written view from counsel on Aadhaar authentication for your entity type and on your DPDP obligations by phase.
- For each new country, check whether the rail exists there, who runs it, and whether you may connect directly or only through a bank.
- Price on the assumption that zero-fee rails may introduce fees.
Start with the first item. Most teams find at least one piece of infrastructure they are building or paying for that a public rail already provides.
GradeCircle builds and runs six products of its own: AfroSynergy, CallerBridge, HealthSquire, Heyzl, Lexfora, and LukeAPI, two of them in beta. The assumptions in our models come from operating those systems, not from a framework. See what we run.
If you are building or scaling in these markets, see how GradeCircle approaches AI implementation.
