Can AI Agents Pay Over UPI? NPCI's Unified Agent Protocol, Explained for Indian SMBs

Short answer: Not yet, but India is building the rails. The National Payments Corporation of India (NPCI) is developing a Unified Agent Protocol, a standard and registry to register, verify, and authorise AI agents that make payments over UPI, starting with small, frequent purchases such as groceries. NPCI has not published the detailed framework or a launch date. For a small business the practical takeaway is not about payments at all: when customers start sending AI agents to buy for them, those agents will buy from businesses they can read and order from cleanly.

What is NPCI’s Unified Agent Protocol?

It is a planned framework that lets AI agents make UPI payments on a person’s behalf, under rules. Reports in September 2026 describe a registry that would identify, screen, and verify which agents may transact at all, record which software identity belongs to which operator, and begin with small, frequent transactions before expanding to more complex ones (TechNode Global). It was expected to be unveiled around the Global Fintech Fest in Mumbai in September (Startup Fortune).

How would an AI agent actually pay?

Through delegated, capped authority that already exists in UPI today. The protocol is reported to build on UPI Circle, which lets a primary user delegate spending to someone else within a monthly cap, and on UPI Reserve Pay, which lets a user block an amount for future debits to a chosen merchant (Startup Fortune). The person stays the account holder; the agent gets a limited, revocable permission, with spending limits and an audit trail.

Has anything like this already been tried in India?

Yes, in a pilot. In October 2025 NPCI, OpenAI, and Razorpay announced a pilot that let people shop and pay inside ChatGPT using UPI Reserve Pay and UPI Circle, with BigBasket among the first merchants, and with users pre-authorising payments so the AI company never saw payment data (TechCrunch). The new protocol is the attempt to turn one-off pilots like that into a common, registered standard.

How is this different from taking payment through a chatbot today?

Today the customer still approves every payment; under an agent protocol, their agent could pay within limits they set in advance. A WhatsApp bot or website chatbot can already send a UPI payment link or QR code, but the customer opens their UPI app and approves each one. What NPCI is designing is the next step, where the customer’s own AI assistant holds a capped, revocable permission and completes routine purchases without a tap each time. That shifts who your business is really selling to in those moments: not the person, but the agent acting for them.

It also changes what can go wrong. A payment link that a person approves has a human check built in. A delegated payment relies on the limits, the registry, and the agent behaving correctly, which is exactly why NPCI is building identity and audit controls before anything goes live.

When will this be available to my business?

Nobody outside NPCI can say, and you should be sceptical of anyone who gives you a date. NPCI has not published the detailed framework, and important questions, including who is liable when an agent makes a wrong payment, are still open (Startup Fortune). Treat it as a direction of travel for the next year or two, not a feature to integrate this quarter.

Does a small business need to do anything about it now?

Not on the payment side. Accepting UPI works the same way it always has, and an agent paying on a customer’s behalf would still pay you through UPI. The preparation that matters is upstream: an agent shopping for a customer has to find you, understand what you sell and at what price, and place an order without a human clicking through your website. Businesses whose catalogue, prices, stock, and ordering live in structured systems will be easy for agents to buy from; businesses whose stock list lives in one person’s head will not.

• Keep products, prices, and availability in one system of record, not in chat history.
• Make sure your website states what you sell and what it costs in plain, server-rendered text.
• Have an ordering path that does not depend on a human reading a message first.

Is it safe to let AI agents handle payments?

Safer than letting them handle passwords or card numbers, which is the point of the design. Capped, revocable delegation with an audit trail limits the damage a manipulated or buggy agent can do, and a registry means agents have an identity that can be checked and blocked. The risks that remain are the ones every AI agent carries, especially being tricked by content it reads, which we cover in prompt injection, explained for SMBs. For your own agents, the same principle applies today: least privilege, hard limits, and a human approval step for anything that moves money.

What is the real opportunity for SMBs here?

Being the business an agent can transact with when this arrives. That is mostly the same work as being visible to AI assistants today, which we cover in how Indian SMBs get found by AI assistants, plus clean integrations between your catalogue, your order system, and your payment confirmation. None of it is wasted if the protocol slips, because the same work speeds up your own team and your own automations now.

If you want to know how agent-ready your ordering flow is, book a free 15-minute call and we will tell you what an agent would get stuck on. We build that plumbing under custom integrations.