Imagine telling an AI assistant to buy my groceries every week, but keep each order below INR2,000. You don’t open a payment app, scan a QR code or approve every transaction. The AI agent makes the decision within the limits you gave it.
That is the promise of agentic payments, and India’s Unified Payments Interface (UPI) is moving toward that possibility.
UPI already made digital payments almost frictionless for people. The next challenge is deciding how much of that friction can safely be removed when the payer is no longer a person making the final click.
The National Payments Corporation of India (NPCI) is developing a registry to identify, verify and monitor AI agents that make payments on behalf of users as part of its proposed Unified Agentic Protocol (UAP), according to Reuters reporting. NPCI chairman Ajay Kumar Choudhary has also said the organization is examining protocols to identify and authorize digital AI agents within the UPI ecosystem. The proposed system is expected to begin with routine, low-value transactions before potentially expanding to more complex use cases.
The stakes are unusually high because UPI is already operating at enormous scale. NPCI recorded 24.51 billion UPI transactions worth INR29.82 lakh crore in August 2026. Adding autonomous software to that infrastructure would change not only how payments are made, but also who is effectively making the decision.
From approving payments to delegating authority
The technology itself is not starting from zero. NPCI has already introduced delegated-payment capabilities through UPI Circle, allowing users to authorize another party to make payments within defined limits. Its 2025 operating rules were also extended to certain IoT devices and software profiles, including AI profiles in limited closed-user settings.
Agentic UPI would take that idea further by allowing software to operate within a user-defined mandate rather than requiring a person to approve every payment.
That creates a fundamental security shift, said David Williams, SVP Marketing and Market Strategy at Quali.
“When an agent recommends, a person is still accountable for the decision. When it executes, the agent’s authority becomes the control,” Williams said. He claims that autonomous systems need restrictions built into the infrastructure itself, including separate identities, least-privilege access, transaction and velocity limits, restricted payees and immediate revocation mechanisms.
His main thesis is that detecting a bad transaction after it happens isn’t enough. Controls have to prevent unauthorized actions before they reach the payment rails.
Authentication doesn’t equal authorization
That distinction becomes even more important when an AI agent has access to financial credentials.
Yael Fainaro, Chief Strategy Officer at Akeyless, says traditional authentication only establishes who or what is making a request. For autonomous systems, financial platforms also need to determine whether the specific action is within the authority delegated by the user.
“The biggest mistake is assuming that because an agent has legitimate access, every action it takes with that access is legitimate,” Fainaro said.
She stated that AI agents should have their own identities while retaining verifiable context about the customer they represent. Payment access should be narrow, temporary and enforced at runtime rather than relying on a credential as the only security boundary.
An AI agent can be manipulated without being technically “hacked.” A legitimate agent with excessive permissions could still make a harmful decision.
For financial institutions, the security question is no longer simply whether an agent is authentic. It is whether the action itself is authorized, appropriate, and within scope.
Who is liable when the machine makes the mistake?
This may prove harder than the technology.
Existing RBI rules address customer liability for unauthorized electronic banking transactions, but agentic payments introduce a more complicated scenario: a transaction could be technically authenticated and still fall outside what the customer intended. RBI’s existing framework was not written specifically for autonomous AI agents.
Gaurav Makhijani, Managing Partner at Makhijani Gera & Associates LLP, said that an AI agent should operate under an explicit and revocable mandate with clearly defined limits.
He says authorization should establish the user’s objective, pre-transaction, and approved merchants or categories. Transactions outside those parameters should trigger additional verification.
A registry alone would not solve the problem, Makhijani said. Regulators would also need transaction-level safeguards, anomaly detection, proof-of-intent checks and audit mechanisms that can establish which agent acted, on whose authority and under which rules.
Nitin Bhuwania, Legal & Compliance | Fintech, Payments & Financial Services, sees another legal distinction becoming critical: the difference between an unauthorized payment and an authorized but unintended transaction.
An AI agent could receive legitimate authority from a customer but subsequently interpret an instruction incorrectly, choose an unsuitable transaction or act outside the mandate, he noted.
That raises a question traditional digital payments largely avoid: when a user delegates authority to software, where exactly does authorization end and unauthorized action begin?
Bhuwania discusses that an AI agent should not be treated as an independent legal person simply because it can execute a payment. Instead, it should be treated as a technological instrument operating within a defined and revocable customer mandate.
The practical implication is significant. A payment record may eventually need to show not only the customer and merchant, but also the AI agent, mandate, permissions, model or agent version, applicable limits and intervention history.
India has a head start—but the rules have to catch up
India’s scale gives it a natural testing ground for agentic commerce, but that same scale raises the cost of getting the framework wrong.
NPCI is reportedly developing an AI-agent registry to help verify and monitor agents before they are allowed to transact. Yet the proposed Unified Agentic Protocol is not a fully deployed payment standard today. Business Standard reported on September 12 that its rollout had been temporarily put on hold pending regulatory clearance and further work on user protection, liability and governance.
That pause may ultimately be as important as the technology itself.
For agentic payments to move beyond experimentation, India will need rules that define delegation, identity, spending limits, auditability, revocation and liability before autonomous transactions become routine.
As Williams puts it, governance has to move closer to the infrastructure. Fainaro says for runtime controls rather than trust based solely on credentials. Makhijani calls for enforceable authorization and proof of intent. Bhuwania mentioned that greater automation must not create an accountability gap.
Their views converge on one principle: An AI agent may be given financial authority, but that authority cannot be unlimited or invisible.
UPI already made digital payments almost frictionless for people. The next challenge is deciding how much of that friction can safely be removed when the payer is no longer a person making the final click.
The future of agentic UPI may not depend on whether AI can make a payment. It may depend on whether India can make the payment accountable when AI does.
