UPI Architecture and Transaction Flow Explained for CAIIB 2026

Every CAIIB elective candidate meets the Unified Payments Interface twice — as a daily user and as an examinee — and the two experiences are nothing alike. Understanding the UPI architecture and transaction flow means knowing which entity holds the account, which switch routes the message, and where money finally settles. This guide covers the layered design, the two payment legs, authentication, product variants and the dispute framework.

🏗️ The Building Blocks of UPI Architecture

UPI was launched by the National Payments Corporation of India (NPCI) in 2016 and rides on the Immediate Payment Service rails, which is why it inherits 24x7x365 availability and near-instant credit. Architecturally it is a four-party model: the payer, the payer's Payment Service Provider (PSP), the payee's PSP, and NPCI operating the central UPI switch. Behind the PSPs sit the remitter bank and the beneficiary bank, the entities that actually debit and credit accounts.

The layer that separates UPI from earlier retail rails is the Virtual Payment Address (VPA), a handle such as name@bankhandle that points to an underlying account. The customer never shares an account number or IFSC. NPCI maintains the mapper that resolves a VPA — or a mobile number — to the correct account, and that indirection delivers both privacy and interoperability.

Only banks can be PSPs. A fintech participates as a Third-Party Application Provider (TPAP) sponsored by a PSP bank, so regulatory accountability for a TPAP's conduct sits with its sponsor bank. If switches, routing and message hops are still hazy, revise Networking Systems first.

UPI is best read as the account-based sibling of the card and wallet worlds. Compare it with the token-based designs in distributed ledger technology in banking and the exposure model in API banking and open banking, and the trade-offs become clear.

🔁 The Debit Leg and Credit Leg, Step by Step

A live payment is a sequence of API calls between the two PSPs and the NPCI switch, and examiners love testing the order. It begins when the payer selects a payee by VPA, QR code or mobile number.

• Initiation: the payer's PSP builds a pay request and sends it to the NPCI UPI switch.
• Address resolution: NPCI resolves the payee VPA through the mapper to identify the beneficiary PSP and account.
• Authentication: the payer enters the UPI PIN, captured and encrypted inside the NPCI Common Library, never by the application.
• Debit: NPCI forwards the encrypted PIN block and debit instruction to the remitter bank, which validates it in its hardware security module and debits the account.
• Credit: on a successful debit response, NPCI sends the credit request to the beneficiary bank, which credits the payee.
• Confirmation: NPCI returns the final status to both PSPs within seconds.

Crucially, the customer-facing credit is immediate while inter-bank money movement is not. NPCI computes multilateral net obligations in defined settlement cycles and settles them through the banks' settlement accounts with the Reserve Bank. That separation of clearing from settlement is the core principle in Electronic Clearing and Settlement Systems.

💡 Exam Tip: If asked who "credits the beneficiary", the answer is the beneficiary bank — not NPCI, not the payee's app. NPCI only switches messages and computes net settlement obligations.

🔐 Two-Factor Authentication and the Common Library

UPI satisfies the Reserve Bank's additional factor of authentication requirement with two distinct factors. The first is device binding: an outbound encrypted SMS from the registered mobile number ties the SIM, the handset and the customer profile together — the "something you have" factor. The second is the UPI PIN, the "something you know" factor, set using debit card credentials.

The PIN is never visible to the PSP application. It is entered on a secure screen rendered by the NPCI Common Library embedded in the app, encrypted immediately, and passed on as an opaque block that only the issuing bank can decrypt and verify. This is why a compromised app cannot by itself drain an account — a favourite discussion point in Computer Security.

The residual risk is therefore social rather than cryptographic. Fraudsters exploit the collect request — a pull transaction where the payee requests money — dressed up as a refund or a prize. Because approving it needs the payer's UPI PIN, the victim authorises their own debit. NPCI has progressively restricted person-to-person collect requests, but customer education remains the primary control.

⚠️ Common Mistake: A UPI PIN is never required to receive money. Any screen asking for a PIN to "confirm a credit" is authorising a debit — the single most examined UPI fraud pattern.

🧩 UPI Variants, Limits and Where Each One Fits

The syllabus expects familiarity with the whole product family, not just the standard app payment. UPI Lite creates a small-value on-device balance so low-ticket payments settle without a PIN and without touching the core banking system, cutting switch load sharply. UPI 123Pay extends the rail to feature phones through IVR, missed calls, sound-based proximity payments and an on-device app.

UPI AutoPay handles recurring e-mandates such as subscriptions, SIPs and insurance premiums: authentication happens once at registration, and later debits within the notified ceiling proceed without a fresh factor. Credit Line on UPI lets a customer spend from a pre-sanctioned bank credit line instead of a deposit account, turning UPI into a credit distribution channel.

Limits are revised often by NPCI and the Reserve Bank, so verify the current position on the NPCI UPI product page rather than trusting a coaching handout, and track changes alongside the current RBI rates.

⚖️ Failed Transactions, TAT Rules and Redressal

Because UPI is a two-leg transaction, the classic failure is a successful debit with a failed credit. The Reserve Bank's harmonised turn-around-time framework requires the debit to be auto-reversed by T+1 day; beyond that the bank must pay compensation of ₹100 per day of delay, suo motu, without the customer asking. The circular sits in the notifications archive on the Reserve Bank of India website.

Redressal follows a defined ladder. The customer first complains in the PSP application, which routes it through UPI Help and NPCI's online dispute resolution. If unresolved within the prescribed period, it escalates to the bank's nodal officer and then to the RBI Ombudsman under the integrated ombudsman scheme.

A rail running 24x7 cannot be reconciled on a working-day rhythm. Banks automate reconciliation between switch logs, core banking postings and the NPCI raw files, and every break is investigated the same day rather than at month end. Deferred settlement also creates an intraday liquidity obligation that treasury must fund. Read this alongside business continuity planning in banks and the control expectations in Information System Audit.

One economic point also matters: UPI carries zero merchant discount rate on account-to-account merchant payments, while an interchange applies to prepaid instrument transactions above a threshold. Who funds a free rail mirrors the risk-transfer logic behind securitisation of assets on the ABFM side.

🧠 Practice MCQs: UPI Architecture and Transaction Flow

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

Revise This Topic the Smart Way

Master the four-party model, the six-step sequence and the TAT compensation rule, and most UPI questions become straightforward. Work through the Information Technology and Digital Banking article series, reinforce it with BANKING SOFTWARE, then take a timed mock on the CAIIB course page.