Understanding The Recent UPI Outages: What Went Wrong And How NPCI Responded?

In the past few weeks, India's Unified Payments Interface (UPI) has faced significant outages, disrupting financial transactions across the country. The most notable disruption occurred on April 12, marking the longest downtime in the past three years, as the system remained affected for nearly five hours.

This raises an important question - Why is UPI, the backbone of India's digital financial ecosystem, experiencing frequent downtime? Let's explore the reasons behind these disruptions, with insights from a report by The Hindu.

How Does UPI Work?

Developed by the National Payments Corporation of India (NPCI), UPI facilitates peer-to-peer and inter-bank transfers through a simple two-step authentication process. It operates using systems like Immediate Payment Service (IMPS) and Aadhaar Enabled Payment System (AEPS) to ensure fast and secure transactions.

At its core, UPI uses a basic "push" (sending money) and "pull" (requesting money) mechanism. For this system to function, banks must be integrated with the UPI platform and must allow customers to link their bank accounts with a registered mobile number via a Payment Service Provider (PSP) app - such as PhonePe, Google Pay, or Paytm.

Every UPI transaction is routed through NPCI, which plays a critical role in encrypting sensitive banking information, such as PINs, and securely forwarding payment details to the payer's bank for execution. Therefore, if there is any disruption at NPCI's end, banks do not receive the encrypted information needed to process transactions, leading to failures.

What Caused The April 12 UPI Outage?

In its Root Cause Analysis (RCA) report, NPCI explained that the April 12 outage was caused by an overwhelming flood of 'Check Transaction' API requests. The situation worsened when a few PSP banks began sending multiple 'Check Transaction' requests for even older transactions - far more frequently than allowed.

Typically, banks initiate a 'Check Transaction' request if they do not receive a confirmation response from the beneficiary's bank after a transaction attempt. This usually happens when the beneficiary bank's server is down or unresponsive.

To resolve the uncertainty, the PSP bank, which is the UPI app's banking partner connecting it to the NPCI system, repeatedly checks if the transaction was successful before moving on to process more payments. However, according to NPCI guidelines, banks are supposed to initiate a 'Check Transaction' request only once every 90 seconds.

On April 12, PSP banks flooded the system with excessive 'Check Transaction' calls without waiting for responses, leading to congestion in the NPCI's servers. This repeated and unnecessary load overwhelmed the platform, resulting in prolonged downtime.

Recognizing the issue, NPCI advised the concerned PSP bank to immediately halt the 'Check Transaction' feature at around 4 PM. By 4:15 PM, a temporary solution was deployed to mitigate cross-site flooding and manage the excessive processing requests. These quick mitigation steps helped stabilize the UPI platform, although the downtime had already impacted millions of users nationwide.

While UPI remains one of the most robust digital payment systems globally, the recent outages highlight the need for stricter adherence to operational protocols by PSP banks. Ensuring better coordination and real-time monitoring between banks, PSP apps, and the NPCI will be critical to maintaining UPI's reliability.