In October, when the Reserve Bank of India (RBI) announced that cheques would be cleared within a few hours instead of days, the technology in question—the Cheque Truncation System—came, yet again, from the stables of the National Payments Corporation of India (NPCI). Other products from the NPCI include the Unified Payments Interface (UPI), RuPay cards, Bharat Bill Pay Payment Service (BPPS), FASTag, Immediate Payment Service (IMPS), Aadhaar Enabled Payment Services (AePS), RuPay credit card, National Automated Clearing House, and the BHIM-UPI mobile application. Among these products, UPI, which is the NPCI’s crown jewel, logged 20.47 billion monthly transactions amounting to Rs. 26.32 lakh crore in November alone.
Long story short, the NPCI today controls the digital backbone of the Indian financial system. Any serious data security breaches or outages at the NPCI can have dire consequences for the Indian financial system, compromising the privacy of citizens and throwing transport services across the country out of gear.
While there is no doubt that the NCPI has contributed significantly to the ease of digital payments in India, it has also made significant errors. Poor design choices by it have enabled significant fraud, especially with the AePS system and the “pull function” of UPI, leading to questions being raised in Parliament and hearings by committees about action being taken by the NPCI to curb fraudulent transactions. Parliament has also been raising questions about the dominance of foreign payments applications such as GPay and PhonePe on the UPI ecosystem.
The crucial question to ask at this point is: to whom exactly is the NPCI accountable within the government? Given the use of “National” in its name, most people assume that the NPCI is a government company operated by the government. However, for its part, the NPCI has argued for some time now that it is not a public authority under the Right to Information (RTI) Act, 2005.
It has even argued before the Madras High Court, as well as the Central Information Commission (CIC), that it is not “state” for the purposes of Article 12 of the Constitution of India. The implication of not being a “state” under Article 12 is that the NPCI is not required to submit to the writ jurisdiction of high courts or recognise the fundamental rights of citizens. Thus, the NPCI, for all legal purposes, has declared that it is not under the control of the union government. Its stand should be a cause of worry for anybody using products and services developed by it.
The crucial question to ask at this point is: to whom exactly is the NPCI accountable within the government?
To be fair to the NPCI, there is a decision from the Central Information Commission in 2019 in Neeraj Sharma v. NPCI that the NPCI is not a “public authority” as defined under the RTI Act. This was a poorly reasoned judgment. In this piece, we will demonstrate beyond doubt that the NPCI is a “public authority” under the RTI Act and that the Central Information Commission’s order in the Neeraj Sharma case did not engage with crucial issues of the law.
NPCI’s Legal Architecture
A good starting point is to understand the legal architecture that gives the NPCI its vast clout over the Indian financial system. On its website, the NPCI describes itself as follows:
“an umbrella organisation for operating retail payments and settlement systems in India, is an initiative of Reserve Bank of India (RBI) and Indian Banks’ Association (IBA) under the provisions of the Payment and Settlement Systems Act, 2007, for creating a robust Payment & Settlement Infrastructure in India.”
Towards, this end it was incorporated as a non-profit company under Section 25 of the Companies Act, 1956 by five public sector banks, two domestic private banks (HDFC and ICICI) and two international banks (Citibank and HSBC). Each of the 10 banks invested $14 million each for a 10% stake in the shareholding of the NPCI.
Once incorporated as a company, the NPCI was authorised by the Reserve Bank of India (RBI) under The Payments and Settlements Systems Act, 2007 (PSSA) to operate different “payment systems”. The first of these was the National Financial Switch (NFS), which is the backbone for the country’s ATM network. It was actually developed and operated by the Institute for Development and Research in Banking, a wholly public funded venture, before it was transferred to the NPCI. A working paper highlights that the public funded National Financial Switch provided the NPCI with a “revenue stream from day one”, ensuring economic sustainability.
Since its incorporation, the shareholding of the NPCI has diversified to include 65 banks and fin-tech companies but the majority shareholding of the company has always been held by public sector banks owned by the Indian state.
Who is in “Control”?
One of the key tests under the RTI Act to establish whether a body is a “public authority” is to determine if it is under the “control” of the government, except this law does not lay down the definition of “control”.
The Central Information Commission in the Neeraj Sharma case concluded that the NPCI is not a public authority on the grounds that the union government does not have “pervasive control” over it. It came to this conclusion on the basis that the Government of India does not own any equity in the NPCI or appoint any of the directors to its board or control the day-to-day working of the company. That public sector banks hold a majority of the stake in the NPCI was deemed irrelevant by the Central Information Commission on the grounds that these public sector banks are separate entities from the government.
There are several problems with the Central Information Commission’s conclusions. To begin with, the NPCI is by definition a “government company” under the Companies Act, 2013 because more than 51% of its shareholding is held by public sector banks. If not for this shareholding pattern, the NPCI could not have been recognised by the RBI under Section 4(2) of the PSSA, 2007 as a “payments service provider” providing “common retail clearing house” services.
This issue of “clearing house” services being controlled by the public sector came up during a discussion on the PSSA Bill, 2006. The then finance minister P. Chidambaram made it crystal clear that the NPCI would be a public sector corporation. His statement from that discussion almost two decades ago is reproduced here.
The question is: who will own this NPCI? Obviously, the banks which are owning the clearing houses have to own the new NPCI. I have said that nobody will be allowed to own more than 10% of the NPCI. The State Bank will own 10%, the big public sector banks will own 10% each, but the private sector banks are also doing clearing. They must also have a share of this. Therefore, this is implicit, but since the hon. Members demanded that it should be made explicit, I have readily said that we will make it explicit and that is why the new amendment has been introduced. We have made it explicit that the NPCI will be a public sector corporation owned by the public sector banks”(emphasis added).
The NPCI does not contest that it is a government company since the Comptroller and Auditor General (CAG) has been appointing the auditor for the company as mandated by the Companies Act, 2013 for government companies. If it is a government company, it follows that it is under the control of the government and hence a “public authority” under the RTI Act.
Further, there are several public statements made by the Ministry of Finance in Parliament and on social media, demonstrating that the government controls the functioning of the NPCI. For example, the Ministry of Finance has made several statements in the recent past confirming no transaction charges will be imposed on merchants using UPI.
This is a statement by the Minister of Finance on user charges for UPI: “We see digital payments as a public good. People should be able to access these facilities freely, so that the digitisation of the Indian economy becomes attractive to them. We intend to achieve a higher level of transparency through digitisation. Therefore, we do think it’s not yet time for charging for services.”
That the Ministry of Finance wields such control over the NPCI is not surprising because the public sector banks that have a majority stake in the NPCI are all under the control of the Ministry of Finance. None of these issues were perused seriously by the Central Information Commission in the Neeraj Sharma case when it concluded that the Government of India did not exercise “pervasive control” of the NPCI.
Government Funding
An alternative test to determine whether a body is a “public authority” under the RTI Act is to assess whether it receives “substantial funding” directly or indirectly from the government. As with the issue of “control”, the issue of public funding received by the NPCI was also poorly analysed by the Central Information Commission in the Neeraj Sharma decision.
There is enough evidence to suggest that the NPCI has been sustained by public funds since its inception. More than 51% of its founding equity came from investments by public sector banks, as required by the PSSA 2007. Since then, the NPCI has received substantial public funding to subsidise its products such as RuPay, which competes with Visa and Mastercard, and the BHIM-UPI application, which competes with private sector players like GPay and PhonePe.
According to a reply by the Department of Financial Services (DFS) to a parliamentary question, a total of Rs. 8,730 crore, of public money, has been allocated between 2021 and 2025 from the government “to support payment system participants to mitigate adverse impact of zero MDR [merchant discount rate] and to promote digital payment” through “RuPay Debit Cards and low-value BHIM-UPI transactions (person-to-merchant [P2M])”.
There is enough evidence to suggest that the NPCI has been sustained by public funds since its inception.
Each of these schemes has been announced by the Minister of Finance in budget speeches and the money for these schemes has been appropriated from the Consolidated Fund of India. For instance, following the launch of BHIM UPI, the Government introduced “incentive schemes”, providing cash back and referral bonus to individuals and merchants for registering on the BHIM app. The outlay for the scheme was Rs. 495 crore, completely funded by the Government. Significantly, this scheme was not extended to others providing payment providers on UPI.
That these payouts are subsidies is clear from statements made by public functionaries. Take, for example, this recent statement by RBI Governor Sanjay Malhotra while speaking about UPI. “Right now, it is government which is defraying those costs. Going forward, how those costs are handled is very important … Government has taken a view that it should be available free and government is subsidising it. And I would say that it has borne good fruits.”
If the NPCI’s products such as RuPay and BHIM, as well as low-value UPI transactions, cannot function without subsidies from the public exchequer, it is reasonable to conclude that the NPCI is being substantially financed by public money, either directly or indirectly, through public sector banks. This line of argument is supported by precedents such as the judgement of the Delhi High Court in Mother Dairy v. Hatim Ali where the court determined that a body receiving funds “of material or considerable value” from the union government, “directly or indirectly”, is a public authority under the RTI Act.
Why This Matters
The issue of whether the NPCI is a public authority has wider ramifications for India’s approach to its digital public infrastructure (DPI) projects. These include Digi Yatra, which is a facial recognition project for passengers accessing airports, and the Open Network for Digital Commerce (ONDC), which has been set up as an online network of sellers.
The Digi Yatra Foundation, which owns Digi Yatra, is a non-profit company set up by the government-owned Airport Authority of India (AAI) along with other airport operators (Bengaluru International Airport Limited, Cochin International Airport Limited, and so on), which are public-private partnerships (PPPs) between the public and private sector. Its ability to deploy the Digi Yatra software as an alternative to physical verification of identity by the Central Industrial Security Force (CISF) required the Ministry of Home Affairs to waive a mandatory security requirement. As with the NPCI, the Digi Yatra Foundation has claimed that it is not a public authority under the RTI Act.
Those in charge of these digital public infrastructure projects claim that their entities are a “public good” when they seek to influence government policy, use public funds, or encourage … public adoption of their products.
The ONDC, incorporated in 2021 by the Quality Council of India and Protean eGov Technologies (formerly NSDL E-Governance Infrastructure Ltd.) as its founding members, is a non-profit company. Its members also include many of India’s nationalised banks, private banks, stock exchanges, and institutional depositories. The ONDC does not have any RTI tab on its website like other public authorities and presumably does not consider itself to be covered by the RTI Act despite receiving public funding to subsidise its activities. For example, earlier this year, the government disclosed that it had allocated Rs. 277 crore to encourage the onboarding of the medium and small enterprises on the ONDC.
Those in charge of these digital public infrastructure projects claim that their entities are a “public good” when they seek to influence government policy, use public funds, or encourage (and sometimes coerce) public adoption of their products. However, the moment questions of public accountability arise, these same organisations conveniently change tack. They then argue that they are not public bodies and are therefore not accountable to citizens, to Parliament, or even to the writ jurisdiction of high courts under Article 226 of the Constitution, which can be invoked when the state or its instrumentalities act arbitrarily or violate fundamental rights.
What makes this arrangement especially problematic is that these organisations have used their influence in government to entrench themselves as monopolies, with the NPCI being the prime example.
There is room for other payment systems to enter the market and compete with UPI, but the RBI has made no such move. This reluctance on the part of the government to encourage competition within digital public infrastructure will stifle innovation, as argued by some scholars, giving rise to a different kind of monopoly.
Given the initial promise of digital public infrastructure as an alternative to big tech, such an outcome—marked by cronyism and monopolistic behaviour by government-backed entities—would be a tragedy. In a sense, Indians will suffer the worst of both worlds: an unaccountable private sector alongside public sector sloth.
Prashant Reddy T. is the co-author of Create, Copy, Disrupt: India’s Intellectual Property Dilemmas (2017, Oxford University Press); Yogesh Byadwal is a student at the National Law School of India University, Bangalore.
