UPI outages in early 2025 indicate need for tighter controls and monitoring

Written by Kapronasia || May 07 2025

During the months of March and April 2025, India's Unified Payments Interface (UPI) experienced several outages, with the most notable disruption occurring on April 12, when the system was affected for nearly five hours. This marks the longest downtime in recent years. According to the NPCI (National Payments Corporation of India), the developer and operator of UPI, the system previously experienced partial and intermittent outages in March 2025 for 95 minutes and in January 2022 for 187 minutes. A few weeks after the incident, NPCI released a Root Cause Analysis (RCA) report which explained that the April 12 outage was caused by payment service provider (PSP) banks sending an excessive number of ‘Check Transaction Status’ API calls which overwhelmed the system’s capacity and led to instability. The situation worsened when a few PSP banks began sending multiple ‘Check Transaction’ API calls for even older transactions.

Banks sending a transaction would typically initiate a ‘Check Transaction’ request if they do not receive a confirmation response from the beneficiary bank after a transaction attempt. However, on April 12, banks overwhelmed the system with excessive ‘Check Transaction’ calls without waiting for responses, congesting NPCI’s servers. While NPCI was able to take quick mitigation steps to stabilize the system, the outage had already impacted millions of users across India.

This incident indicates the urgent need for tighter controls and monitoring of NPCI’s API usage to ensure the stability of UPI. NPCI subsequently outlined a set of measures aimed at preventing further large-scale interruptions to its system. For one, ‘Check Transaction Status’ requests must be sent only after 90 seconds have passed since the authentication of the transaction. NPCI plans to further shorten this window to between 45 and 60 seconds once PSP banks have aligned their systems with the new mechanism. Banks will also be limited to a maximum of three ‘Check Transaction’ calls within a two-hour period from the original transaction. After which, banks must refer to the settlement files or the Unified Dispute and Issue Resolution (UDIR) system rather than continuing to send queries to NPCI.

NPCI is also considering the possibility of introducing rate limiters on certain APIs which would restrict how many times a particular call can be made within a specific time frame. From the compliance perspective, PSP banks will be required to undergo annual audits to assess their API usage and systems configuration. NPCI also reiterated that APIs should not be used for purposes other than those originally intended, unless otherwise approved.

Despite the outages, UPI remains one of the most reliable digital payment systems globally but there is clearly a need for better coordination between the parties involved and stricter adherence to operational protocols, for instance those relating to API calls. On a national level, UPI’s adoption and trust among Indian consumers continues to grow with the platform handling a record of 20 billion transactions worth Rs 25 trillion (US$300 billion) in March 2025 alone. However, if UPI seeks to become a payment system with greater regional and international influence, it needs to make serious attempts to reduce the frequency and severity of future outages.