NPCI’s AI-Powered MyUPI and AtOM Push Indian Payments Toward Agentic Commerce

The news

Mumbai. The Indian Express reported on 21 September that the payments industry is moving from conventional artificial intelligence toward ‘agentic AI’, and that the Global Fintech Fest (GFF), held in Mumbai from 8 to 11 September, saw leading payments companies showcase such products. The National Payments Corporation of India (NPCI) unveiled MyUPI, an AI-powered revamp able to delegate pre-authorised payments and to file payment disputes automatically. It also launched a back-end tool called Agentic Orchestration and Messaging (AtOM), described as a “connective tissue” for AI interaction across the financial ecosystem. The report explains the terms. Conventional AI has long been used in payments to reduce friction and to screen customers from fraudulent transactions. Agentic AI is a model that executes tasks for users without constant prompts, but within set limits. Agentic commerce is a digital trade model in which AI agents discover, negotiate and execute purchases on a customer’s behalf; it does not bypass authorisation but cuts the number of steps, for instance by picking the best card or payment mode and reducing multiple OTPs to a one-time authentication, while the consumer keeps oversight and can change any component. The report cites Amazon Pay’s Smart Wallet, demonstrated at GFF, which uses smart recommendations, biometric authentication and tap-and-pay, and can auto-execute small-ticket regular purchases within a limit: a customer with a monthly limit of ₹10,000 ordering groceries would not need to authenticate each time until that month’s spending crossed the threshold. “With agentic AI, I think that assistance for humans to get their job done in a very informed, intelligent manner, with a lot of control and trust, is kind of a large opportunity we see,” said Girish Krishnan, Director of payments, rewards and merchant services at Amazon Pay India. The paper notes that MyUPI has a similar feature, and that wallets from Samsung Pay, Google Pay and PhonePe offer PIN-less small-ticket purchases, though not all of this is AI. It adds that adoption is at a nascent stage, that agentic commerce is currently the biggest use-case, and that agentic AI could eventually streamline the whole ‘procurement to payment’ process for businesses.

Static syllabus linkage

1. NPCI is a not-for-profit owned by banks, regulated by the RBI. The National Payments Corporation of India was set up in 2008 as an umbrella organisation for retail payments, promoted by the Reserve Bank of India and the Indian Banks’ Association, and is registered as a not-for-profit company under Section 8 of the Companies Act, 2013. It operates UPI, launched in 2016, along with RuPay, IMPS, the National Automated Clearing House and FASTag infrastructure. It operates under authorisation from the RBI.
2. The Payment and Settlement Systems Act, 2007 is the legal base. This Act makes the RBI the authority to regulate and supervise payment systems in India, and no payment system can operate without RBI authorisation. The RBI acts through its Board for Regulation and Supervision of Payment and Settlement Systems. Rules on authentication, mandates for recurring payments and customer liability for unauthorised transactions all flow from this regulatory power.
3. Authentication is the RBI’s central safeguard, and agents test it. The RBI requires an additional factor of authentication, such as an OTP or PIN, for most digital payments, and allows recurring e-mandates with only the first transaction authenticated, within limits it sets. UPI Lite permits small-value payments without a PIN from an on-device wallet. Agentic commerce works inside these rules by stretching the pre-authorised mandate, which is why the precise limits and the customer’s ability to revoke them matter.
4. Data protection now travels with the payment. The Digital Personal Data Protection Act, 2023 requires that personal data be processed only for a lawful purpose with consent, and gives individuals rights to information, correction and erasure. An AI agent that reads shopping history to recommend purchases and then pays for them is processing personal data at every step, so consent, purpose limitation and accountability of the ‘data fiduciary’ are directly engaged.

Why UPSC loves this

1. Digital public infrastructure is a favourite GS3 topic. Questions on UPI, digital payments and financial inclusion appear under ‘inclusive growth’ and ‘awareness in IT’. Agentic payments are the next stage of that story, and the examiner tends to reward candidates who can pair a technological advance with its risks.
2. AI governance is emerging in both GS3 and the Essay paper. UPSC has begun asking about the social and ethical effects of artificial intelligence. Payments are a practical domain in which issues of consent, accountability and liability for automated decisions are concrete rather than abstract.
3. Prelims asks about the institutions. Who owns NPCI, under which Act the RBI regulates payment systems, and what UPI Lite or e-mandates are, are all standard Prelims material. Today’s news adds MyUPI and AtOM as names to recognise.

Analysis

1. The real change is who initiates a payment. Every earlier convenience in digital payments still left the customer to press ‘pay’. Agentic commerce moves the initiating act to software acting under a standing mandate. That is a shift in legal and practical responsibility, not merely a smoother interface. The existing framework was built around a human authorising each transaction, and it will need clear answers to who is liable when the agent buys the wrong thing or the right thing at the wrong price.
2. Limits are the safeguard, so they must be easy to see and revoke. The ₹10,000 monthly grocery limit in the Smart Wallet example shows the design principle: autonomy inside a cap. That works only if the customer knows the cap exists, can see what has been spent against it, and can cancel it instantly. For less digitally literate users, who are the fastest-growing UPI population, a standing mandate they have forgotten is a vulnerability. Regulation should therefore focus on visible limits and simple revocation rather than on banning agents.
3. Automated dispute filing may be the most valuable feature. Disputes are where ordinary customers lose the most, because the process is slow and tiring. If MyUPI can file disputes automatically, it shifts effort from the weak party to the system. That is a genuine consumer-protection gain, and it deserves more attention than the shopping features. The risk is a flood of automated claims, which the dispute machinery must be ready to handle.
4. Recommendation and payment in one agent creates a conflict of interest. An agent that both suggests what to buy and chooses how to pay may favour the platform’s own products, partner merchants or the card that earns the platform the most. The report’s example of an agent picking the ‘ideal card’ begs the question: ideal for whom? Disclosure of how recommendations are made, and a duty to act in the customer’s interest, are the obvious safeguards, and competition regulators will have a stake as well as the RBI.
5. The counter-view: this is incremental, not revolutionary. The article itself notes that PIN-less small-ticket payments already exist in many wallets and are not AI. Much of what is called agentic today is automation with a new label. That is a fair corrective. The regulatory response should be proportionate — built on existing mandate and authentication rules — and should tighten only where real autonomy, such as negotiation and purchase selection, is introduced.

Administrator's brainstorm