Mifos Pay: UPI Integration Use Case

1. Overview of UPI Infrastructure

Architecture & Participants: UPI is a real-time payments system operated by NPCI (under RBI), connecting Payment Service Providers (PSPs, i.e. banks or prepaid payment issuers) with end-user/payment apps. NPCI provides the secure UPI “switch” for routing transactions . PSP banks connect their servers and mobile apps to this switch to on-board customers and process payments. Third-Party App Providers (TPAPs) – non-bank fintech/apps (e.g. Google Pay, PhonePe) – participate through sponsor PSP banks . In this model, NPCI authorizes participants and provides transaction routing; banks authenticate users (via UPI IDs linked to bank accounts), while TPAPs offer user-facing apps under NPCI/RBI rules .

Regulatory Requirements: UPI operates under India’s Payment and Settlement Systems Act (2007) and RBI’s oversight. NPCI issues detailed operating circulars and guidelines for all participants . Key requirements include strict data security (encrypted channels for all data, two-factor authentication via UPI PIN/OTP, device-binding of mobile number) and annual security audits of apps/systems . Banks and TPAPs must store all transaction data in India and allow inspections by RBI/NPCI audit teams . Entities must comply with NPCI’s Procedural Guidelines and RBI’s master directions on payment security and data privacy. For TPAPs specifically, NPCI mandates compliance with all relevant laws and circulars, PCIDSS audits, and setting up customer grievance redressal (e.g. toll-free helpline).

UPI Integration Models:

There are two principal integration options:

- (a) Intent/Deep-Link Flow: The merchant (Mifos Pay) app invokes an installed UPI app via a platform-specific intent/URL. The user completes payment in the UPI app and returns to the merchant. This requires no NPCI license or new payments infrastructure.

- (b) TPAP License (Full API) Integration: The merchant/app itself becomes a UPI app under NPCI licensing (TPAP). It integrates directly with NPCI and banks via APIs, handling entire UPI flows in-app. This requires obtaining a TPAP license from NPCI (through sponsor bank) and full compliance with RBI/NPCI norms.

Each model has trade-offs (see below).

2. Path 1: UPI Intent Flow Integration

How Intent Works:

In the intent model, when a user chooses “Pay by UPI” in Mifos Pay, the app launches an OS intent (Android) or URL scheme (iOS) with a UPI URI. Android INTENT.ACTION_VIEW or an HTML link like

is used . The URI includes parameters like payee VPA ( PA ), payee name ( PN ), amount ( AM ), currency ( CU=INR ), etc.

Example:

This triggers a chooser of all installed UPI apps. The user selects one (e.g. PhonePe, GooglePay, BHIM, or a bank app), which opens with the payment details . The user enters their UPI PIN to authorize the debit from their bank account. The transaction is routed via NPCI’s UPI switch to debit the payer’s bank and credit the merchant’s PSP bank. NPCI then returns a success/failure result back to the UPI app, which in turn returns control to the Mifos Pay app (typically via a deep-link callback) .

Android Integration:

The merchant app constructs a UPI URI and starts an intent.

For Example:

The UPI URI looks like:

and the intent :

The chosen UPI app handles the payment. Back in onActivityResult() , check resultCode : RESULT_OK typically means payment success or failure returned in the intent data, while RESULT_CANCELED indicates user aborted . The app should parse the returned payment confirmation (e.g. via intent extras or checking server status) to finalize the transaction.

iOS Integration:

On iOS, the app must declare UPI URL schemes (e.g. in Info.plist add custom URL Types for UPI apps) and then use

with a UPI URI. To let the user choose their UPI app, Mifos Pay might list supported schemes (e.g. tez://upi/pay?... for GooglePay, phonepe://pay?... for PhonePe) and open accordingly . iOS will switch to the UPI app, user authorizes the payment, and then the UPI app will launch back to Mifos Pay via the registered callback URL with the result.

Technical Prerequisites:

The device must have at least one UPI-capable app installed (Android 6.0+/iOS 11.0+ typically). The merchant app needs no special banking license or API access. For Android, declare the intent filters or simply use ACTION_VIEW . For iOS, register and handle URL schemes/ callbacks. (Note: some UPI apps on iOS only respond to their own custom scheme, not a generic upi:// ; in practice the app may call a specific scheme of a user-chosen app .) No server-side NPCI integration is needed – however, the backend should still verify transaction status via bank/ NPCI APIs if available, or rely on the client-provided result.

Pros and Cons:

• Pros: Rapid deployment (no license or approvals), minimal development overhead, and broad coverage since any UPI app works . It requires no changes to bank integrations or compliance beyond standard app development. Users do not need to enter bank details or switch apps manually.

• Cons: Limited control and features. The merchant app cannot initiate payments without user action or show dynamic payment limits beyond what UPI apps allow. Reliance on user’s UPI app means inconsistent UI and possible compatibility quirks (e.g. Google Pay’s scheme vs generic). On iOS there is no automatic app chooser for upi:// , so the app may need to handle one scheme at a time . The merchant never holds the payment flow fully; there is no direct settlement API – funds go into the PSP bank and must be pulled or reconciled. Also, no ability to automate recurring payments or manage refunds via UPI; all handling is manual. Compliance burden is low (no TPAP license), but conversely scalability and branding are limited.

3. Path 2: TPAP License–Based Integration

Eligibility & Application:

To become a licensed Third-Party Application Provider, Mifos (or its parent entity) must be an Indian-registered company (bank/NBFC/authorized fintech) and partner with at least one NPCI-certified sponsor PSP bank . The sponsor bank conducts due diligence (tech, security, governance) before agreeing. The applicant gathers documents (certificate of incorporation, MOA/AOA, audited financials, KYC for promoters, business plan, security policies, etc.) . The sponsor bank submits the TPAP application to NPCI on the company’s behalf. NPCI reviews eligibility, financials and compliance readiness . If satisfactory, NPCI issues the TPAP license, typically taking several months (4–8 months is common for large candidates).

NPCI/RBI Regulations:

TPAPs operate under NPCI’s Procedural Guidelines and RBI’s Payment Systems regulations. Key rules include: data localization (all UPI transaction data must be stored in India) ; strong security (PCI-DSS, encryption, secure coding); periodic audits by Qualified Security Assessors (QSAs) ; adherence to customer limits and KYC/AML per RBI directions; and NPCI-enforced volume caps (no TPAP may exceed 30% of total UPI volume ). The sponsor bank must sign agreements covering liability and compliance (IT Act, Privacy Act, UPI guidelines) and provide grievance redressal (e.g. 24×7 support) . RBI master directions on digital payments and data security (2020) also apply, requiring, for example, transaction encryption and device-binding technology.

Technical & Compliance Requirements:

Mifos Pay must develop or adopt a UPI stack: user registration, intent/collect APIs, QR scanning, etc., integrating with the sponsor bank’s UPI server. Apps (Android/iOS) must be PCI-DSS audited by a certified QSA , and the server components must undergo annual security audits (SOC2 or equivalent) . All integrations (e.g. SMS for device-binding) must be over encrypted channels. The TPAP’s app must fully implement NPCI’s UPI 2.0 specifications (Mandate transactions, QR payments, etc.), and pass NPCI’s certification tests. Ongoing compliance demands include regular reporting to NPCI/RBI, on-site audits, and updates for any new UPI features or regulatory changes.

Step-by-Step Integration Path:

1. Bank Partnership: Finalize MoU with a sponsor PSP bank and obtain NPCI approval to engage.

2. Infrastructure Setup: Provision secure servers (with redundancy), deploy UPI application software, and establish network links to NPCI’s staging environment.

3. Development & Testing: Implement UPI API calls (pull/push), collect/intent flows, and UPI Lite/offline if needed. Perform unit/integration tests with the bank and NPCI’s sandbox.

4. Certification: Apply for NPCI’s certification. NPCI and the sponsor bank schedule a certification test; TPAP must demonstrate end-to-end UPI transactions (registration, pay, collect, refunds, dispute handling) in their UAT environment.

5. Go-Live & Audits: After passing certification, deploy to production. Undergo PCI DSS audit and SOC2 (if overseas data). Set up compliance processes (audits, reporting, support) before launch.

Required Documents:

As per NPCI and RBI, prepare:

• Corporate documents (Certificate of Incorporation, MOA/AOA, board resolutions)

• KYC/KYB of promoters, directors, major shareholders

• Audited financial statements (last 2–3 years)

• Business plan and financial projections

• IT/security policies (PCI-DSS evidence, ISO 27001 certificate, etc.)

• Technology architecture and disaster recovery plan

• Grievance redressal and customer support plan

Timeline:

The end-to-end process (from decision to acceptance as TPAP) typically spans 4–8 months. Bank onboarding and NPCI review can take 2–3 months if documentation is complete. Development and testing may take 3–4 months (depending on resources). NPCI certification slots are scheduled monthly, with formal sign-off usually within a few weeks after testing. Delays often occur in compliance (e.g. PCI audit gaps) or in satisfying NPCI’s checklist. Thus, realistic planning assumes 6–8 months.

Estimated Costs:

Costs can be significant and ongoing. Major heads include:

• Application/License Fees: NPCI’s TPAP onboarding fee and any bank/PSP processing fee. (NPCI often bundles this into overall onboarding costs.)

• Development & Integration: Engineering effort to build the UPI client, connect to bank/NPCI APIs, and mobile app updates. Depending on team size, this could range from a few lakhs to crores of INR. - Security Certification: PCI-DSS audit (performed by a QSA firm) and SOC2 audits can cost ₹3–10 lakhs per year (depending on scope). Initial certifications and remediation add cost.

• NPCI Recurring Charges: Annual maintenance/renewal fees to NPCI or the sponsor bank (often modest but must be budgeted).

• Maintenance & Ops: Ongoing server hosting, bandwidth, cybersecurity (firewalls, monitoring), and a 24×7 support team. Additional compliance overhead (internal audits, reporting) also contributes to costs .

4. Intent vs. TPAP Integration: Comparison

5. Integration Readiness Checklist

• Organizational Setup: Registered entity (PLC/LLP). If TPAP, tie-up MoU with a UPI PSP bank and obtain board approvals

• Technical Infrastructure: Secure servers (in India), SSL/TLS encryption, high availability (99.9% uptime), load balancing, backup/DR plan.

• Application Prep: Updated Mifos Pay code to support Intent URLs (Android Intents / iOS URL callbacks) for Path 1. For TPAP path, full UPI API client library integrated.

• Device/OS Requirements: Android 6.0+ and/or iOS 11+; ensure handling of runtime permissions (Android) and URL schemes (iOS).

• Security Certification: Engage a PCI SSC-approved QSA to certify the app and server. Prepare for SOC2 or ISO27001 audits if needed.

• Data & Compliance: Build KYC/AML processes (for payments above NPCI thresholds), privacy policy compliant with RBI’s data localization (all UPI data in India).

• NPCI Documentation: Compile all required documents (KYC, policies, financials, system architecture) and submit via sponsor bank as per NPCI’s checklist .

• Audit & Logging: Plan for transaction logging, audit trails, and quarterly reconciliation reports as per NPCI rules. Ensure capability to produce logs for NPCI/RBI audits .

• Grievance Redressal: Establish 24×7 customer support (toll-free number, email, IVR) for UPI complaints .

• Security Controls: Implement device binding, app integrity checks, anti-tampering, and real-time monitoring for suspicious activity.

• NPCI Engagement: Register on NPCI’s developer portal (if any) and book slots for certification testing as soon as readiness is achieved

• Partner and Compliance Audit: For TPAP, ensure the sponsor bank performs due diligence audit of Mifos Pay’s systems (as required by NPCI) .

6. Official Guidelines & Resources

• NPCI UPI Portal: The central source for rules is NPCI’s website. See the UPI Product Overview and Roles & Responsibilities pages . NPCI maintains a Circulars section listing all UPI operating circulars (e.g. OC-32/2017 on TPAP rules, OC-73/2019 on Intent payments) .

• NPCI Procedural Guidelines (2019): Covers technical and KYC/AML procedures for UPI; available under NPCI’s UPI documentation. (E.g., device-binding, UPI 2.0 mandates.)

• BHIM UPI Branding Guidelines: NPCI specifies UPI logo usage and co-branding rules, important for any TPAP app. (See NPCI’s BHIM UPI Brand Guidelines page.)

• RBI Directions: RBI’s Master Directions on Payment and Settlement Systems (Retail Payments) and Digital Payment Security Controls outline data localization, authentication and cybersecurity norms. (Refer to RBI publications.)

• PCI DSS QSAs: For security certification, consult the PCI Security Standards Council’s list of Qualified Security Assessor (QSA) companies . These auditors perform the required PCI-DSS assessment of the app.

• NPCI/SPDSPs: NPCI-approved Third-Party App Providers list (to see examples). Live UPI members and apps are listed on NPCI’s website.

• NPCI Support: NPCI helpdesk and forum for queries on certification and compliance.

• Compliance Auditors: Engage auditors approved by RBI/NPCI (for example, PCI DSS QSAs, ISO 27001 certifiers, SOC auditors) as needed for UPI certification.