UPI is the poster child of India’s tech innovation and a benchmark for things to come. Its simple design and the sheer capability to scale it to a billion users make it a masterpiece—one that the world has been trying to replicate in vain.
Behind UPI’s seamless simplicity lies a story of hard-won technological independence, system-level thinking, and relentless problem-solving. At the centre of this story is Vishal Anand Kanvaty, CTO at NPCI, and one of the key architects of UPI.
Kanvaty opened up with AIM about the evolution of NPCI’s technology journey and the foundational decisions behind UPI’s architecture. “We had three phases at NPCI,” Kanvaty said, reflecting on the organisation’s tech evolution.
In the first phase, everything from product design to operations was vendor-managed. They used to run the product and the platform, and NPCI used to just manage the vendors.
The second phase brought marginal control, with NPCI buying products from vendors like Oracle and Euronet but still depending on them for enhancements. This model created bottlenecks. “NPCI at that time was relatively small, and Indian customers were not a priority. But we were running at our own pace.”
That’s when the realisation hit: To innovate and scale, NPCI had to take full ownership of its stack. “We cannot be dependent on anyone, and whether we succeed or fail has to be our ability and choice,” Kanvaty said.
This decision marked the beginning of a new phase—one where NPCI would build and control its own technology, with no licensed platforms or external dependencies. This is the same idea Kanvaty holds for building foundational AI models in India too.
The Tech Behind the Billion-People Impact
Around the time UPI was being conceptualised, NPCI had already internalised these lessons. “We were confident about it. I would not say that we were aware, or knew that it would reach half a billion someday… But we knew that it was going to be a successful product,” he said.
Cost was always a concern, but never the sole driver. “That’s the motto of NPCI. We have to give back to the ecosystem. We’re not for profit, so we have to keep the cost very reasonable.”
Open source was an obvious choice, and UPI’s stack reflected that. Built on Java, the system included in-memory processing with Kafka and Redis. One of the most defining design principles was no dependency on traditional databases.
“For us, latency was extremely critical,” Kanvaty explained. “We are just a switching engine… we don’t need to have too much state… So the database hits will definitely have a problem in terms of scalability and latency.”
Though they initially used Postgres for specific bindings like mobile numbers and device IDs, most checks now happen in Redis. This decision has enabled UPI to handle billions of transactions daily with sub-second response times.
If Kanvaty were to build UPI in 2025 with infinite compute and budget, he said he would still use the same architecture. However, there’s one shift he would consider: replacing Java with Rust.
UPI’s democratic design is one of its most underrated achievements. “One of the fundamental things that we have done in UPI is democratise the whole payment service providers (PSP) concept,” Kanvaty said. “The friction there is minimal. I can use my PIN, I can use my same account number, same debit card. So there is nothing that I need to do physically.”
Looking ahead, Kanvaty sees AI playing a defining role in UPI 2.0. “I think we will have a lot more agentic AIs coming in where a lot of assistance and experience could be given to users,” he said.
One clear use case is personalised troubleshooting. “Today, if my transaction failed… we give a very generic error saying that the bank is down. But now I think I can go and say maybe the problem is with your risk bank, why don’t you try and use the other bank that you have?”
AI could also optimise offers and cards based on context. “Let’s say I’m booking a ticket, it can give me a lot more benefit saying that you have this card, why don’t you use it to get a better offer?”
Voice, Vernacular, and Vision
Voice, especially in regional languages, is another big piece of the future.
“People are used to a sort of Alexa model where they want to make payments without even touching the phone,” Kanvaty said. “We have already started working on that; we have launched voice assistants in at least two languages and we want to scale it up.”
On the rising concerns about UPI outages, like on May 12 when the server was down, Kanvaty said, “It’s a scary situation, so I don’t want to give any suggestions to anyone. I think people should continue to depend on it, but yes, it’s a learning experience for us.”
What keeps Kanvaty up at night? “One is resiliency,” he said. “What happened on the 12th, we don’t want to be in that situation again. Uptime is critical. We understand the impact UPI has on the country. The other is fraud. These are the two big challenges we have to stay on top of and keep improving constantly.”
Meanwhile, NPCI is internally exploring AI tools like Cursor and others in a controlled environment. “We have created an AI platform for developers to start experimenting. Still in the early days, so it may be a little more time before we can say that we are a good adopter.”
Kanvaty is candid about the challenges of scaling UPI beyond smartphones and into rural areas. “We tried various options,” he said. “We tried working with feature phones and voice. While voice-based solutions are an alternative we’re exploring, they still don’t offer the kind of experience that smartphones provide.”
The problem isn’t just technological, it’s about building trust and ease of use.
“More help with onboarding is important,” Kanvaty noted. “We need to work on different models that can give rural users the same confidence and comfort in making digital payments. But it’s going to be a long and tough journey. There are no easy answers.”
When asked about a hypothetical future where UPI could be embedded into wearable devices—say, a pendant with tap-to-pay functionality—Kanvaty doesn’t dismiss the idea.
In fact, NPCI is already testing adjacent technologies.
“We’re exploring palm-based payments, and also ‘tap and pay’ using NFC-enabled devices. We even experimented with embedding NFC tags into QR codes, so users can just tap instead of scanning. The early results are promising, with a better user experience. But again, the real challenge is scaling it across the country.”
But What About Fraud?
Amid all the innovation, a persistent issue looms. The nature of UPI fraud has shifted dramatically in recent years. “Earlier, fraudsters cloned cards and replicated chips—it took effort. Now, it’s all social engineering,” Kanvaty said.
“People are tricked into scanning malicious QR codes or entering their PINs. It’s no longer about a fraudster initiating the transaction—it’s the customer doing it, willingly, on their own device,” he said.
To address this, NPCI has taken a two-pronged approach—awareness and technology. “We’ve invested a lot in awareness campaigns,” Kanvaty said, referring to the public service announcements featuring actor Pankaj Tripathi. “We tried to make the message catchy, subtle, but effective.”
On the technical side, NPCI has deployed AI models that analyse behavioural patterns over a 90-day period. NPCI assesses the type of transactions a user has made, and who they are interacting with, and based on that, the team can decline potentially fraudulent payments.
“We do about 60 crore transactions daily, and out of these, nearly 15 lakh are blocked due to suspected fraud,” he said, adding that it’s a cat-and-mouse game as fraudsters eventually adapt.