How Is NPCI’s Monster Baby UPI One Of The Reasons For The Bank’s Shattered Infrastructure, Which Resulted In Colossal Outages In The Last Handful Of Years?

UPI transactions crossed the 100-billion mark in 2023, the news dated January 2024 announced by displaying a UPI celebration in the new year. India’s Unified Payment Interface (UPI) has completely transformed the country’s development environment, functioning as a breakthrough technology that overcomes traditional financial barriers and promotes socioeconomic progress.

However, every success comes at a price! UPI has grown exponentially since its launch in 2016 — from a modest 2.65 million initially to a whopping 100 billion transactions in FY23. However, as mentioned earlier, heatwaves are felt at NPCI’s curtainwalls. Why NPCI, the National Payments Corporation of India, comes into the picture because UPI is nothing but NPCI’s monster child, which works actively on screen; however, at the back, it comes with ‘handle with care’ instructions. 

How is UPI, NPCI’s monster child, messing with core banking systems? This has led to a halt in boarding new customers at HDFC Bank and now Kotak Mahindra Bank.

The bank’s core banking system (CBS) and its online and digital banking channels have experienced frequent and substantial outages over the last handful of years due to a lack of a strong IT infrastructure and risk-management framework. These sanctions are necessary due to major concerns raised by the Reserve Bank’s IT assessment of the bank in 2022 and 2023, as well as the bank’s continuous inability to resolve these problems comprehensively and swiftly. The RBI’s decision sent a message to other banks that they should enhance IT systems to keep up with rising transaction volume and potential cyber hazards.

So what are the problems encountered or originated due to UPI introduction?

Because UPI transactions originate directly from a bank account, they are routed through a bank’s core banking solution (CBS) software, which is not built to handle such a large volume of transactions. Some of these CBS platforms are built on technology and software established in the 1990s, and they are not intended to manage such a load. This led to substantial transaction failures in 2020 and 2021 and again afterwards, prompting the NPCI and RBI to require banks to invest in servers and CBS to handle the increased volumes. 

What is CBS- The Brain of the Bank.

CBS functions as the bank’s brain. It stores information about customers, accounts, and bank balances. All financial transactions are documented here. All other functions in a bank operate on separate modules that connect to the CBS. For example, a loan module has its own logic for determining the amount of credit to be issued, the interest rate, and so on, but it still links to the CBS to obtain data from the customer’s bank accounts. 

Problem 1: The reduction in number of branch visits.

Traditionally, CBS served as a technological backbone that linked all branch networks. When a consumer visited a branch or an ATM, CBS logged the debit or credit transaction. However, customers are increasingly not visiting banks or ATMs to withdraw money since they can simply transfer or receive money using UPI instead.

Previously, customers would go to ATMs and withdraw a lump sum of money, such as INR 10,000 to 20,000, and then pay for all minor purchases in cash. UPI has made these payments digitally over the previous few years. Think about it! In the past, you would withdraw money, say INR1,000, at the beginning of the week and pay the office chaiwala, vegetable vendor, and daily vehicle trip in cash. So, your CBS account received one update that week. You no longer withdraw money; instead, you pay with UPI, necessitating several updates to your CBS data. Scale this to all the bank’s customers, and you’ll see the problem.

At first, it may sound good, which is true. There is no doubt that UPI exaggerated the action of cashless payment. However, the theory of transaction at the back screen remains the same. As written in bold earlier CBS logged the debit and credit transactions, so is the case with ongoing UPI transactions and incoming UPI transactions.

Every transaction is recorded twice in UPI design, first by remitting banks and again by receiving banks. This resulted in a slew of credit reversal failures, owing to the fact that no one could have predicted how quickly UPI volumes increased. This high incidence of transaction failures and build-ups in credit reversal dues is prompting worry, with industry officials pointing out that banks—with redundant digital infrastructure—are unable to cope with the unexpected spike in payment volumes.

There is no way to forecast how this UPI transaction will change during the day. It may rise because an e-commerce company has unexpectedly launched a quintillion-day deal. It may just be an Akshay Tritiya day! This might potentially be the root source of the problem. The best CBS can handle a continuous load, but they are overloaded when they encounter rapid increases in transactions/traffic, as is typical of the Internet.

“Banks are in the business of banking—primarily deposits and lending—rather than enabling payments. The core banking solution (CBS) architecture was not designed for micropayments. This is why the RBI, in addition to payments banks, established multiple prepaid and wallet instruments to address digital payments,” says a managing partner at a fintech investment business. “Theoretically, one may keep adding servers to process billions of transactions, but this does nothing to modify the CBS architecture, which was not meant for such high numbers.” While mobile wallets such as Amazon Pay have been successful, users appear to prefer having their money sent directly to their bank accounts rather than through an intermediary such as a wallet.

Around CBS, banks have created peripheral systems to meet the increasing demands of business and increased transaction volume. The majority of peripheral systems are built using cutting-edge technology, using a microservice design, and are hosted in the cloud. However, CBS is a legacy system.

Banks often have 80-90 systems that cover various features such as credit scoring, online KYC, OTP messaging, and so on. To be sure, CBS is separate from them; nonetheless, when a financial record or account-related change is necessary, these systems communicate with the CBS. According to experts, what distinguishes UPI is its increased volume, very variable load, and the necessity to communicate constantly with the CBS.

The UPI switch is one of the peripheral systems, but every payment you make is logged on the CBS, whether it is for INR10,000 or INR10. It seems like CBS is a legacy architect that is burdened by UPI transactions. If the UPI transaction gets blocked, it will impose an unnecessary strain on CBS. If this occurs, other peripheral systems may suffer as well. There is a rippling effect.

Hence, the need to upgrade the CBS to handle such a large volume of transactions comes into the picture.

Problem 2: The removal of MDR, giving no gain to banks and hence contributing almost nill to the economy. 

According to an IIT Bombay research, while retail firms have gone digital, a major portion of the wholesale ecosystem still operates in cash. Small retailers, traders, and even major merchants have begun to choose UPI due to “balance or change” concerns following demonetisation. The removal of the Merchant Discount Rate, or MDR (the commission merchants pay to banks and payment service providers to facilitate payments) on UPI, has increased merchant adoption.

The development of QR codes simplified it because you don’t have to give your VPA (Virtual Payment Address) or phone number to receive or send money, providing a layer of secrecy. Then came the pandemic, and the hands-free feature of UPI payments via QR codes made them the most popular choice for customers and retailers.

Again, at first, it sounds good as this penetration of UPI architecture by the small segments of merchandise and retailers has pulled them into the formal economy by registering them as bank accounts. However, the removal of MDR that helped the small merchants to get board on UPI have costed the bank.

How zero MDR is one of the Real Losers? The globe is rapidly replacing cash with non-monetary payments. In the 38 OECD nations, this is accomplished through the usage of credit cards, which are increasingly being used online. Mobile payments utilising QR codes and credit cards are common in China and other East Asian nations.

UPI is India’s innovative payment system. It is the simplest, least risky, and most convenient. The G20 and the Global South may not adopt UPI, as India has attempted, but its expansion in India is irreversible. Payments, however, do not contribute to GDP growth since their contribution is restricted to the charges/value collected by service providers. Fintechs and banks are not permitted to charge for the UPI service; thus, it has no influence on growth.

So, is there any free lunch?

The NPCI might be paying the price for the government’s steadfast determination to promote digital payments. When Finance Minister Nirmala Sitharaman announced the elimination of MDR in her first Budget in 2019, she sent a clear message. But the big stunner came at the end of the year when she declared that no MDR charges will apply to RuPay and UPI transactions beginning January 1, 2020. 

While FM Sitharaman claimed that the change will “increase payments using the home-grown real-time payments system,” she may have damaged how the NPCI operates its business. MDR is a cost that the merchant pays for each digital transaction. It is the sole incentive the payments ecosystem receives for supporting digital transactions.

The zero-MDR policy has the potential to negate UPI and RuPay’s massive advantage over Visa, Mastercard, and wallet companies. However, in 2022, the industry expected a loss of ₹5,500 crore from UPI, while RuPay MDR remains zero. It stated a significant gap needs to be filled before everyone in the payment value chain receives credit.

With 0% MDR, the government has denied these Payment Service Providers (PSPs) the ability to invest in and maintain the financial infrastructure they have constructed. With MDR gone from UPI and RuPay transactions, there is no treasure to share. “Why would someone invest in UPI?

In August 2022, the RBI issued a discussion paper suggesting a tiered structure levy on UPI payments based on various value categories. The paper solicited suggestions on whether MDR should be based on transaction value or as a constant charge regardless of transaction value. It also asked for feedback on whether the RBI should decide on charges or if the market should decide whether or not to impose them. Following the RBI discussion paper, the finance ministry stated that there was no plan to collect fees on UPI transfers. Since then, the initiative has been on the back burner.

According to industry experts, the difficulty of applying an MDR to UPI transactions is primarily one of ‘intent’. “The price model is straightforward. They already have a system in place for debit and credit cards. With UPI, the price model should be equivalent to or somewhat lower than the MDR on card-based transactions, taking into account transaction volumes.

Bringing in MDR on UPI transactions will encourage banks to spend more on payment infrastructure. The fact is that foreign players with large sums of money are presently driving UPI expansion. Players here wouldn’t want to waste that type of money, especially when there is no clear business plan, a fintech sector executive explained.

Now, one always knows ‘that there is no free lunch’. Someone at the end needs to bear the cost. By making UPI free to end users, the whole burden was shifted to banks (and NOT the government, despite the popular perception). To understand who is actually bearing the cost, one needs to know the thin line of demarcation between fact and fiction.

The fact is that UPI is pushing the economy and fulfilling the dreams of digital India, and all of the credit goes to the gigantic efforts of the central government of India. However, the fiction of the story is that the government has a stake in and direct control over the National Payments Corporation of India (NPCI), which operates UPI. And all government acts are meant to help the NPCI.

The NPCI might be paying the price for the government’s steadfast determination to promote digital payments. NPCI, a not-for-profit corporation formed under Section 8 of the Companies Act of 2013, which frequently draws harsh criticism for receiving preferential treatment from the government, may be paying the price for being the government’s “favourite.” Previously, the NPCI wrote to the government, requesting that it establish a mechanism to reimburse banks for revenue losses on UPI transactions under the zero-MDR policy. 

What do banks need to do?

Banks are conscious of the need to update and improve CBS. However, it is a long and time-consuming procedure. According to banking and IT insiders, moving to the new CBS will take at least two years. To handle all of these updates, banks must purchase more processing power, databases, and servers to ensure that the system does not slow down or crash. This is a capital expense. Banks have been sluggish in creating them, especially because they make no money from UPI transactions. 

Now there’s a question: are banks spending enough?

In a speech in December 2023, RBI deputy governor Swaminathan J stated that many banks had not spent the amount allocated for the acquisition of IT systems and IT security systems. Upgrades to CBS are time-consuming by design. If the CBS is the brain, then all alterations to it are considered neurosurgery.

“Just because UPI is placing a strain on the system, it is not possible to update merely that component of the CBS. It is impossible to attribute a precise capability to a specific sector of the transaction,” said a bank official who worked on CBS implementation at two institutions.

Let’s take a few examples to justify our opinion that banks aren’t spending enough.

In 2020, as some of India’s largest banks, which includes HDFC Bank and SBI, faced operational problems due to unexpected technology outages, and now the same occurred with Kotak Mahindra Bank. Industry experts suggested that their technology spending, which used to hover in the range of 2-5% of the banking sector’s gross revenue, be increased to 8-10% to handle the current rate of digital transactions smoothly and without technical glitches.

Mahesh Hariharan, director and sales leader for financial services at Blue Prism (2021), an intelligent automation software company, told Market Intelligence that banks don’t have to totally replace their legacy systems when updating infrastructure. Banks’ major IT strategy should be on achieving a “digital singularity” in which all technological infrastructure, including legacy systems, can be merged to function together and be interoperable. 

An inadequately tested upgrade to the CBS can be devastating. In 2018, UK firm TSB turned over its CBS as part of the transition process following its sale to Spanish lender Sabadell. The entire system has failed. Customers were locked out of their accounts for several weeks and granted access to other people’s accounts. They were unable to earn income or pay their bills. The incident cost TSB more than GBP400 million, and difficulties persisted months later.

Because of the way banks are regulated, it is more expensive for them to adopt Cloud technology to manage larger loads. For example, when a store conducts a sale, it simply purchases additional capacity from its Cloud provider to handle the extra traffic during that period.

However, banks, even though most are hybrid — with their own servers and Cloud centres — must adhere to high data-security standards and audits, making scaling up on the fly challenging. To prevent downtime and outages, banks must strengthen the resilience of their IT systems by testing them on a regular basis and investing in key infrastructure.

Banks are focused more on customer acquisition; however, things need to be done at the back end as well.

According to Asim Parashar, partner – financial services, PwC India, banks have invested the majority of their technology on customer acquisition and servicing platforms such as mobile banking, internet banking, and super apps, as well as interfaces with partner ecosystems and data and analytics platforms. There is also a need to invest in middle-office and transaction systems, such as CBS.

They should concentrate on the next-generation design, which is cloud-native and microservices-based for CBS with API integration and can handle both horizontal and vertical scalability and resilience. This will assist in dealing with the increased volume of transactions as well as any unexpected increases. This would need a rethinking of IT strategy and IT spending over the next three years for institutions that are preparing for expansion.

Selecting competent IT personnel is also essential.

At the same time, the business side should interact with IT before implementing new projects. Frequently, this is lacking in banks. While banks have employed technologists, they have little grasp of banking, which is a highly regulated industry, according to experts. During its periodic assessments, the RBI puts bank balance sheets through stress tests.

Perhaps the time has come to do the same with the bank’s IT systems. Similarly, key banking software vendors such as TCS, Infosys, Oracle, and Temenos may consider re-architecting their software, which serves as the bank’s brain.

The bottom line.

Jaya Vaidhyanathan, CEO of BCT Digital, says that all banks have made significant investments in omnichannel and user experience when it comes to digital banking. However, they have not invested enough in the mid and back office, which might be their downfall. Now that digital is becoming a crucial channel, long-term investments in mid- and back-office transformation are critical. 

That’s prominently one of the big reasons why RBI have one thing in common in giving punishments, i.e. halt onboarding of new customers. Hitting Where It Hurts is the most justified punitive action against those who do not follow the compliances.

Given the substantial risks, the RBI made the right choice to enforce compliance by hitting where it hurts, in addition to applying monetary penalties. Banks and financial institutions are barred from onboarding new customers until their systems have been fixed, which has a negative impact on both reputation and financial performance.

It has a direct influence on senior management’s performance appraisal and the value of their stock options, emphasising the need to maintain compliance, investing in relevant technology and talent, and closing loopholes.

Former RBI deputy governor R Gandhi states, “When fines did not pinch monetarily, and routine measures had little impact on reputation, the RBI had to think differently to make its actions effective. Parallelly, banks become totally digital, and any rectification of regulatory infractions required system-wide effect.” This is clearly effective, and all other regulators should adopt it.