you’ve paid for anything with UPI in the last few weeks, you’ve probably seen a headline about “UPI charges” and felt a small jolt of panic. Six years of a completely free payment system does that to you.

Here’s the good news: for almost everyone reading this on their phone, nothing changes. But NPCI (the National Payments Corporation of India, which runs UPI) has rolled out a genuinely big set of updates in 2026 — and if you run a shop, freelance, or just like knowing how your money moves, this is worth five minutes of your time.

Let’s break it down properly, one change at a time.

1. The Big One: 0.4% MDR on Merchant Payments (From October 15, 2026)

This is the update everyone’s talking about, so let’s start here.

From October 15, 2026, NPCI is introducing a Merchant Discount Rate (MDR) of 0.4% on select Person-to-Merchant (P2M) UPI transactions above ₹2,000. This is the first time since the government made UPI free in 2020 that a fee has been attached to it in any form.

Who actually pays it? The merchant — not you. If you’re a customer paying for groceries, ordering food, or shopping online, you keep paying exactly what’s on the price tag. NPCI has explicitly barred UPI apps and merchants from passing this charge on to customers.

How it works, with numbers:

Who’s exempt:

• All person-to-person (P2P) transfers — sending money to friends, family, or splitting a bill — stay completely free, forever, no threshold.
• P2M payments up to ₹2,000 stay free — and this covers roughly 95–96% of all merchant UPI transactions in India, according to NPCI’s own data.
• Small merchants receiving under ₹1 lakh a month via UPI QR codes are fully exempt, so your neighborhood kirana store or the tea stall near your office isn’t affected.

Why now? NPCI has said the annual cost of running UPI’s infrastructure — servers, fraud prevention, cybersecurity, 24/7 uptime for billions of transactions — runs into roughly ₹20,000 crore a year. The government incentive that kept UPI free was designed as a launch-phase subsidy, not a permanent arrangement, and NPCI says this MDR keeps the system financially sustainable without touching the everyday user experience.

Bottom line: if you’re a consumer, this changes nothing about how you use UPI. If you’re a mid-to-large merchant — a restaurant, a clothing store, an e-commerce seller — expect this to show up as a small deduction in your UPI settlements from mid-October onward.

2. Biometric Payment Limit Doubled: ₹5,000 → ₹10,000

Since August 7, 2026, NPCI has raised the cap on transactions authorised through on-device fingerprint or facial recognition from ₹5,000 to ₹10,000 per transaction.

A few things this does not mean:

• It does not raise your overall daily UPI limit (still ₹1 lakh for regular P2P transfers).
• It does not make biometric authentication compulsory.
• It does not remove or replace the UPI PIN — PIN-based payments work exactly as before.

It simply means that if your phone and bank support biometric UPI payments, you can now authenticate a larger chunk of your daily spending with just your face or fingerprint, instead of typing a PIN each time.

3. Two-Factor Authentication Becomes Mandatory (From April 1, 2026)

Under the RBI’s Authentication Mechanisms for Digital Payment Transactions Directions, 2025, every domestic digital payment — UPI included — now needs two authentication factors from different categories, with at least one being a “dynamic” factor (something that changes each time, like an OTP or biometric scan, rather than a static, reusable one).

In practice: an SMS OTP alone is no longer sufficient on its own for many transaction types. This is aimed squarely at fraud built around stolen static credentials — leaked PINs, intercepted OTPs, and similar tricks. Expect your bank and UPI app to lean more on biometrics, device-binding, and dynamic checks going forward.

4. Recurring Payments (AutoPay) Get More Flexible

Two changes worth knowing if you have subscriptions, SIPs, or insurance premiums running on autopay:

• No fresh authentication needed for recurring payments up to ₹15,000 per transaction (once the mandate is properly registered).
• For insurance premiums, mutual fund SIPs, and credit card bill payments, that no-re-authentication ceiling jumps to ₹1 lakh per transaction.
• Since October 2025, NPCI’s AutoPay framework also lets you view all your active UPI AutoPay mandates in a single app of your choice, and even port a mandate from one UPI app to another — so switching from, say, Google Pay to PhonePe no longer means resetting every subscription by hand.

5. System Stability Caps: Fewer Failed Transactions

To handle the sheer scale UPI now operates at — NPCI reported over 2,365 crore transactions worth nearly ₹30 lakh crore in a single month in 2026 — new operational caps have been introduced:

• Balance inquiries are capped at roughly 50 per day per app.
• Account listing / status checks are similarly capped.
• These caps exist purely to reduce server strain during peak hours (think salary day or festival sales), and NPCI says backend improvements now let most transactions complete in near real-time, often within 15 seconds.