NPCI UAP: UPI Circle Is Already the Agent Rail

Reuters reported on 1 September that NPCI is preparing a "Unified Agent Protocol" to let AI agents transact on UPI, probably unveiled at Global Fintech Fest in Mumbai next week. NPCI declined to comment. Here is what the coverage missed: the delegation rail an agent would run on has been in circular form since 8 October 2025, and it already names AI as a supported profile type.

The circular is NPCI/UPI/OC-201B/2025-26. It extends UPI Circle full delegation to IoT devices and software profiles — smart glasses, watches, TVs, and, in its own words, "AI Profiles (initially for limited users in CUG)". A closed user group pilot for delegating payment authority to software, published eleven months before the protocol it supposedly needs.

What Is NPCI's Unified Agent Protocol?

Treat the reporting carefully. I went looking for a primary source and there isn't one: no NPCI circular, no RBI notification, no press release mentions UAP. The one AI-related circular, OC-227 of October 2025, introduces UPI HELP — a support assistant that explicitly cannot transact: "all the decision making shall be done either by the customer and/or the Issuer bank."

So UAP is a wire story on unnamed sources plus a conference slot. What is reported is that it composes two existing primitives rather than defining new rails: UPI Circle for delegation, Reserve Pay for fund blocking. That matches the documented evidence, which is why it is probably right.

What Circular OC-201B Actually Permits

UPI Circle, launched at the same festival in August 2024, has two modes: full delegation ("Spend With Limits") lets a secondary user transact independently inside a cap, while partial delegation ("Approve Every Payment") routes each request back to the primary, who completes it with their UPI PIN.

The mechanics matter for anyone modelling an agent as the secondary party. That secondary user never holds a UPI PIN — they authenticate with an app passcode or biometrics and need no bank-linked UPI ID. The primary enters their PIN once, at setup. OC-201B carries the construct to software profiles with these constraints:

Two clauses constrain the design more than the numbers do. Devices must be in close physical proximity at linking, which maps awkwardly onto a cloud-hosted agent. And this: "Debit transactions using IoT shall be only initiated by explicit user action."

That sentence is the whole story. Under OC-201B as written, the software profile is a payment instrument, not a payment decider. A watch that pays when you tap it qualifies. An agent that spots a price drop at 3am and buys does not.

My read: UAP's substantive work is relaxing that clause, not building a protocol. The registry and the branding package a smaller, more contentious change: moving from explicit user action per debit to a standing mandate a machine can draw against. NPCI's chief executive, Dilip Asbe, spent the spring publicly asking for a regulatory framework covering agentic AI and traceable agent consent — not the posture of an organisation sitting on a finished protocol.

How Much Can an AI Agent Spend on UPI?

₹15,000 a month is roughly £130; ₹5,000 is about £45. Adequate for groceries and routine repeat purchases, inadequate for anything else, and deliberate rather than an oversight.

Reserve Pay is not a separate product. OC-228 of October 2025 states that Single Block and Multiple Debits is "henceforth to be referred as UPI Reserve Pay". It blocks funds for later debits, capped at ₹10,000 for up to 90 days, one active block per mobile number per merchant. That ceiling attaches to purpose code 77; the securities-broker code 76 runs to ₹5 lakh, so it is a policy setting rather than a platform limit.

Reserve Pay is also what actually shipped. In February 2026 Razorpay and NPCI put agentic UPI payments into a closed user group pilot with Zomato, Swiggy and Zepto, built on Reserve Pay rather than UPI Circle. Six months on, no wider rollout — a better signal of pace than a conference agenda.

Stack both and an agent's headroom is still four figures in rupees, while UPI Autopay already clears recurring debits without additional factor authentication up to ₹15,000. India runs automated debits happily. It just does not yet let software choose them.

One RBI document addresses software moving customer money: the FREE-AI committee report of 13 August 2025 puts "payment execution" by autonomous systems in its high-risk tier, and says regulated entities "must remain liable for the actions and outcomes of the autonomous AI systems they deploy". A recommendation, not a circular — but it tells you where liability will land.

UAP vs x402 vs AP2: Where Agent Authority Lives

The divergence that matters is not the amounts. It is which party holds and enforces the mandate.

x402 puts the brake in the agent's own wallet — the SDKs shipped a default $1 client cap in August 2026. Fast, permissionless, globally reachable, and the entity enforcing the limit is the entity you are trying to constrain. Compromise the agent's runtime and the cap goes with it. UPI Circle inverts that: the cap sits at the issuer, is enforced before the debit clears, and the agent cannot raise it. You lose reach; you gain an enforcement point the agent cannot touch. For consumer payments at ₹5,000 a shot, that trade is obviously correct.

Why UPI Circle Resembles UK Commercial VRP More Than x402

Anyone who has built against commercial VRP, live in the UK since 2 June 2026 under UK Payments Initiative Limited, will find the shape familiar. The Open Banking Read/Write API v4.0 domestic-vrp-consents endpoint carries ControlParameters with MaximumIndividualAmount, an array of PeriodicLimits each holding a PeriodType (Day through Year) and a PeriodAlignment of Consent or Calendar, plus validity dates.

That is UPI Circle's ₹5,000-per-transaction and ₹15,000-per-month, expressed as a schema instead of a circular clause. Both put a parameterised standing consent at the payer's bank, replacing a merchant-held credential with limits the payer's institution enforces.

Both share an unsolved problem. cVRP has no equivalent of the Direct Debit Guarantee — no post-hoc unconditional refund right — which is why Wave 1 was scoped to utilities, regulated financial services, e-money, government and charities rather than general retail. Agentic payments inherit that gap and widen it. When an agent misreads an instruction and buys the wrong thing inside its limit, that payment was authorised, instant and irrevocable. Neither rail has a chargeback.

What This Means for Payment Developers

1. Model the agent as a delegated secondary user, not an account holder. The primitive that exists in both India and the UK is a capped standing consent enforced at the payer's institution. Design permissions around ceilings your own code cannot raise. 2. Handle the explicit-action constraint now. Until a circular says otherwise, OC-201B requires user-initiated debits. Build that confirmation step properly rather than as temporary scaffolding, and do not hardcode an approval window — NPCI publishes none. 3. Instrument for the missing refund path. With no chargeback, your reconciliation is a user's only recourse. Log the mandate parameters in force at authorisation time, not just the transaction.

Key Takeaways for Payment Developers

• UAP is unannounced and unevidenced in any NPCI or RBI document. Wait for the circular before committing roadmap to it.
• The substrate is real and dated: OC-201B, 8 October 2025, extends UPI Circle full delegation to AI profiles in a closed user group, capped at ₹15,000 monthly and ₹5,000 per transaction.
• The binding constraint is the explicit-user-action clause, not the amounts.
• Issuer-side enforcement is the structural difference from x402, and why this model suits consumer payments better than client-side caps.

I write about payment infrastructure at Tom Wang. If UAP lands at Global Fintech Fest between 8 and 11 September, the clause to read first is the one about who initiates the debit.