Cross-Border UPI - “Legal, Compliance, And Settlement Framework For International Expansion”
Author: LawSphereX
Category: General Law
Published:
Updated:
CROSS-BORDER UPI: “LEGAL, COMPLIANCE, AND
SETTLEMENT FRAMEWORK FOR INTERNATIONAL EXPANSION”
Anbumukil. S1, Elavarasan. P2 & Ellakiya. S3
ABSTRACT
The globalisation of India’s Unified Payments Interface (UPI) represents a pioneering attempt to extend an instant, low-cost, account-to-account retail payment infrastructure across jurisdictions with varied regulatory, technological, and monetary frameworks. This paper critically examines the legal, compliance, and settlement architecture required for the international deployment of cross-border UPI corridors. It begins by evaluating the divergent regulatory regimes applicable to UPI operations abroad, analysing how RBI and NPCI/NIPL guidelines interface with licensing, supervision, and risk-management expectations of foreign central banks and payment regulators. A core focus is the integration of robust AML/CFT, KYC, and sanctions-compliance mechanisms that align with FATF recommendations while preserving the speed, finality, and frictionless user experience characteristic of UPI.
The paper then explores the complex terrain of data governance in cross-border transactions, particularly the interaction between India’s data protection regime and international frameworks such as GDPR, with emphasis on localization norms, consent requirements, and cybersecurity liability. Settlement design including clearing models, FX conversion processes, liquidity management, and legal recognition of settlement finality is analysed to assess how UPI could support scalable, resilient, and interoperable cross-border payment flows. Technical-legal standards such as ISO 20022, open APIs, and alias-based identifiers are examined for their role in ensuring interoperability, dispute management, and system integrity across heterogeneous payment ecosystems.
The paper further investigates taxation, exchange-control compliance, consumer protection risks, liability allocation, and governance structures underpinning multi-jurisdictional partnerships. Finally, it situates UPI’s global expansion within the broader G20/BIS agenda on faster, cheaper, and more transparent
1 Author is a Student of 5th year BA.LLB, Government Law Collage, Coimbatore, Tamil Nadu, India
2 Author is a Student of 5th year BA.LLB, Government Law Collage, Villupuram, Tamil Nadu, India
3 Author is a student of 5th year BA.LLB ,Government Law College, Coimbatore, Tamil Nadu, India
cross-border payments, highlighting implications for remittances, financial inclusion, regional integration, and India’s fintech diplomacy. Collectively, the study offers a comprehensive framework for a legally sound and internationally scalable cross-border UPI ecosystem. Keywords: Unified Payments Interface (UPI); FATF recommendations; cross-border transactions; Settlement design; interoperability; fintech diplomacy.
1 INTRODUCTION
The global financial architecture is undergoing a profound metamorphosis, transitioning from the legacy framework of correspondent banking—characterized by opacity, latency, and prohibitive costs—to an ecosystem premised on digital public infrastructure and real-time interoperability. India has positioned itself at the vanguard of this transformation through the Unified Payments Interface (UPI), a protocol that has fundamentally recalibrated the nation's domestic commerce landscape and now serves as a compelling archetype for international financial integration.
The central thesis of this article posits that while technological innovation furnishes the propulsive mechanism for expedited and inclusive payment systems, the long-term viability and sustainability of cross-border UPI deployment hinges upon the meticulous reconciliation of domestic statutory imperatives—particularly concerning data sovereignty, settlement finality, and consumer protection—with the evolving corpus of international standards governing anti-money laundering (AML), combating the financing of terrorism (CFT), and transnational data protection regimes.
The legal landscape governing this expansion is notably complex, comprising a multi-layered regulatory matrix that includes the Payment and Settlement Systems (PSS) Act, 2007, the Digital Personal Data Protection (DPDP) Act, 2023, the Foreign Exchange Management Act (FEMA), 1999, and the Prevention of Money Laundering Act (PMLA), 2002, all of which must be harmonized with the Financial Action Task Force's (FATF) revised Recommendation 16 on cross-border wire transfers.
As India pursues an ambitious objective to establish UPI linkages with over twenty jurisdictions by 2029, the interplay between executive discretion in managing cross-border data flows and the technical-legal requirements imposed by multilateral settlement gateways such as Project Nexus will fundamentally determine whether India's digital finance revolution can be successfully globalized without compromising either security or sovereignty.
2 BACKGROUND
AND
LEGAL FRAMEWORK
2.1 The Statutory Architecture
PSS Act and Settlement Finality It is pertinent to observe that the foundational statutory instrument undergirding India's payment ecosystem is the Payment and Settlement Systems Act, 2007, which vests the Reserve Bank of India (RBI) with plenary authority to authorize, regulate, and supervise all payment systems operating within the country. 4 This legislative framework was conceived to provide legal certainty regarding two cardinal principles: "netting" and "settlement finality. " Section 23 of the PSS Act explicitly provides that settlement through a designated payment system shall be final and irrevocable, thereby insulating transactions from subsequent challenge under insolvency or other proceedings.
5 This clarity is indispensable for international expansion, as it establishes a template for bilateral negotiations with foreign regulators to ensure reciprocal recognition of settlement finality across disparate legal systems. The importance of settlement finality cannot be overstated in the context of real-time payment systems. Unlike traditional Real-Time Gross Settlement (RTGS) systems where each transaction settles individually and immediately on a gross basis, retail instant payment systems typically operate on a net settlement basis, where obligations are calculated and discharged periodically.
The legal irrevocability enshrined in the PSS Act ensures that once settlement occurs, participants cannot invoke bankruptcy or fraud claims to unwind completed transactions, thereby maintaining systemic stability and predictability—qualities essential for fostering international trust and participation.
2.2 Cross-Border Financial Flows
FEMA and the Liberalised Remittance Scheme Operating in tandem with the PSS Act, the Foreign Exchange Management Act, 1999, governs the transnational movement of capital and establishes the regulatory perimeter within which cross-border UPI transactions must function.6 Under the Liberalised Remittance Scheme (LRS), resident individuals are permitted to remit up to USD 250,000 per financial year for specified current account transactions, including education, travel, medical treatment, and 4 Payment and Settlement Systems Act, 2007, sec 4 (granting RBI authority to determine payment systems policy).
5 Sec 23 (providing for finality and irrevocability of settlement).
6 Foreign Exchange Management Act, 1999, sec 3, 5 (regulating current and capital account transactions). maintenance of close relatives abroad.7 This fiscal ceiling defines the operational boundary for retail international UPI transfers and necessitates robust reporting mechanisms to ensure compliance with capital account restrictions. Notably, the RBI has introduced the Payment Aggregator - Cross Border (PA-CB) license framework, which permits non-bank entities to facilitate export and import payments on behalf of merchants, thereby democratizing access to cross-border payment infrastructure for small and medium enterprises (SMEs).8 This regulatory innovation reflects a broader policy orientation toward fostering competition and reducing the oligopolistic control traditionally exercised by correspondent banks in the remittance corridor.
2.3 Data Protection and Localization
The DPDP Act, 2023 The Digital Personal Data Protection Act, 2023, represents a paradigm shift from the erstwhile patchwork of sectoral regulations and common law principles toward a comprehensive, unified data governance framework. 9 Unlike its European counterpart, the General Data Protection Regulation (GDPR), which adopts an "adequacy" model requiring affirmative determinations before cross-border transfers, the DPDP Act operates on a "negative list" mechanism: crossborder transfers of personal data are permitted by default unless the Central Government notifies specific jurisdictions as restricted territories due to concerns regarding data protection standards or national security considerations. 10 This architecture ostensibly provides greater flexibility for international payment flows.
However, a significant tension persists between the DPDP Act's permissive stance and the RBI's payment data localization circulars, which mandate that all end-to-end transaction data for payments initiated within India must be stored exclusively on domestic servers, with limited exceptions for international data sharing necessitated by fraud prevention or regulatory compliance. 11 This "dual-compliance" burden creates considerable operational complexity for Indian financial institutions and payment system operators seeking to participate in multilateral platforms that inherently require cross-border data exchanges for transaction routing, fraud 7 Reserve Bank of India, Liberalised Remittance Scheme for Resident Individuals (updated guidelines, 2025). 8 Reserve Bank of India, Master Direction on Payment Aggregator – Cross Border (PA-CB), RBI/2023-24/93 (Oct. 2023).
9 Digital Personal Data Protection Act, 2023, Statement of Objects and Reasons.
10 Id. sec 16 (cross-border transfer of personal data).
11 Reserve Bank of India, Storage of Payment System Data Circular, RBI/2017-18/153 (Apr. 2018); updated directives (2025). detection, and settlement reconciliation.
3. CASE LAW AND JUDICIAL REASONING
3.1 Proportionality and Regulatory Restraint
The Crypto Precedent The judicial scrutiny of digital finance in India has been characterized by an evolving doctrinal framework that seeks to balance innovation incentives with systemic risk mitigation. The watershed moment in this jurisprudential evolution was Internet and Mobile Association of India v. Reserve Bank of India (2020), wherein the Supreme Court of India struck down the RBI's circular that prohibited regulated entities from providing banking services to persons or entities dealing in virtual currencies. 12 The Court's reasoning was anchored in the constitutional "doctrine of proportionality," concluding that the RBI had failed to demonstrate either the existence of an imminent threat to the regulated payment system or the absence of less restrictive regulatory alternatives.
Justice Nariman, writing for the majority, observed that regulatory prohibition, as the most draconian form of intervention, must be justified by compelling evidence of necessity and must constitute the least restrictive means of achieving the stated regulatory objective. This precedent carries significant implications for the internationalization of UPI, as it establishes that future regulatory restrictions on cross-border digital payment flows—whether predicated on AML concerns, data sovereignty imperatives, or systemic risk considerations—must satisfy a rigorous evidentiary burden and demonstrate proportionality in their application.
3.2 Functional Classification and Entity Neutrality
Conversely, judicial discourse at the High Court level has begun to address the classification of payment intermediaries under the Prevention of Money Laundering Act (PMLA). In proceedings before the Delhi High Court, the judiciary has observed that online payment gateways may constitute "payment system operators" under the PMLA, thereby subjecting them to identical reporting and Know Your Customer (KYC) obligations as traditional banking institutions. 13 This reasoning comports with the principle of "entity neutrality" or "same 12 Internet and Mobile Association of India v. Reserve Bank of India, Writ Petition (Civil) No. 528 of 2018 (Supreme Court of India, Mar. 4, 2020). 13 Pending jurisprudence before Delhi High Court regarding classification of payment gateways under PMLA (2024–2025 proceedings).
business, same risks, same rules" advocated by the FATF, which posits that regulatory obligations should attach to the function performed rather than the institutional form of the service provider. Therefore, it may be inferred that Indian jurisprudence is gravitating toward a functional rather than institutional taxonomy of financial services—a development that is salutary for establishing a technologically agnostic regulatory environment capable of adapting to innovations such as digital wallets, cryptocurrency exchanges, and decentralized finance protocols. This functional approach is particularly germane to cross-border UPI expansion, as it ensures that non-bank payment facilitators operating in international corridors are subject to commensurate regulatory oversight.
4 ANALYSIS
THE TRILEMMA OF SPEED, SECURITY, AND SOVEREIGNTY
4.1 The FATF Travel Rule and Real-Time Compliance Friction
The principal challenge confronting the internationalization of UPI lies in reconciling the protocol's defining characteristic—near-instantaneous settlement—with the compliance obligations imposed by the FATF's revised Recommendation 16. The 2025 amendments to Recommendation 16 mandate that comprehensive originator and beneficiary information, including full legal names, account identifiers, dates of birth, and national identification numbers, must accompany every cross-border wire transfer exceeding USD/EUR 1,000. 14 For a payment system architected to achieve settlement in under sixty seconds, this requirement introduces substantial technical and operational friction.
While the FATF has expressly clarified through footnote annotations that it does not prescribe real-time sanctions screening as a mandatory compliance mechanism—leaving the specific modality to national regulators—the obligation to freeze and report assets "without delay" upon detection of a sanctions match remains absolute. In practical terms, this necessitates the deployment of sophisticated technological solutions, including "pre-validation" or "confirmation of payee" (CoP) application programming interfaces (APIs), which enable ordering institutions to verify beneficiary details before irrevocably committing funds to settlement, thereby reducing the incidence of "false positive" sanctions hits that plague 14 Financial Action Task Force, Revised Recommendation 16: Wire Transfers, Explanatory Note ¶¶ 3–5 (June 2025). traditional correspondent banking channels.
4.2 Data Sovereignty Versus Interoperability
A Structural Tension A distinct regulatory friction emerges from the apparent conflict between India's data localization mandates and the architectural requirements of global payment interoperability. Notwithstanding the DPDP Act's relatively permissive "blacklist" model for cross-border data transfers, the RBI's sectoral regulations continue to mandate comprehensive localization of payment transaction data. 15 This creates a "dual-compliance" predicament for Indian payment system operators seeking to integrate with multilateral platforms such as Project Nexus. Project Nexus, an initiative spearheaded by the Bank for International Settlements (BIS) Innovation Hub, provides a blueprint for a multilateral gateway that standardizes messaging protocols and operational procedures across heterogeneous domestic instant payment systems (IPS).
16 By establishing a single connection to the Nexus platform, a participating IPS can theoretically transact with all other connected jurisdictions without necessitating bespoke bilateral integration efforts. However, the successful incorporation of UPI into this network requires harmonization of the Nexus Scheme Rulebook's technical-legal protocols with the RBI's 2025 Directions on Digital Payment Authentication, which mandate dynamic, multifactor authentication including biometric verification for all card-not-present (CNP) and digital wallet transactions. 17 The tension between localization and interoperability manifests most acutely in the context of fraud monitoring and dispute resolution. Effective real-time fraud detection increasingly relies on machine learning algorithms that analyze transaction patterns across multiple jurisdictions to identify anomalies.
However, if transaction data must remain siloed within domestic servers with only limited, compliance-driven exceptions for cross-border sharing, the efficacy of such fraud prevention systems is substantially diminished, potentially increasing the vulnerability of international payment corridors to financial crime.
15 Reserve Bank of India, Payment Data Localization Circulars (2018, updated 2025).
16 Bank for International Settlements, Project Nexus
Connecting Instant Payment Systems Across Borders (2024). 17 Reserve Bank of India, Directions on Digital Payment Authentication for Card-Not-Present Transactions (2025).
4.3 Settlement Architecture and Foreign Exchange Provision
An additional layer of complexity derives from the necessity of coordinating real-time payment settlement with foreign exchange (FX) conversion. Traditional correspondent banking models accommodate FX conversion through pre-funded nostro accounts and deferred settlement, allowing time for price discovery and liquidity management. By contrast, instant payment systems predicated on T+0 settlement require either pre-arranged FX rates or access to realtime FX liquidity providers. 18 Project Nexus addresses this challenge by incorporating FX provision directly into its gateway architecture, enabling participants to specify acceptable exchange rate parameters and automatically matching counterparties within milliseconds. Nevertheless, this innovation introduces novel legal questions regarding liability allocation in the event of FX rate disputes, settlement failures, or liquidity shortfalls.
The Nexus Scheme Rulebook must therefore establish clear hierarchy of obligations among ordering institutions, beneficiary institutions, and the central gateway operator—a task that requires alignment with the insolvency and payment finality laws of all participating jurisdictions.
5. COUNTER-PERSPECTIVES AND LIMITATIONS
5.1 Infrastructure Readiness and the G20 Timeline Skepticism
Despite the considerable momentum generated by the G20 Roadmap for Enhancing Cross- Border Payments, empirical assessments by the Financial Stability Board (FSB) suggest that the ambitious cost and speed targets established for 2027 are unlikely to be achieved on schedule. 19 This skepticism is grounded in the protracted lead times required for legacy infrastructure modernization, the persistence of structural frictions such as capital controls and fragmented data standards, and the limited digital financial literacy in many emerging market corridors. For instance, in sub-Saharan Africa, pervasive reliance on cash transactions and inadequate last-mile digital connectivity continue to impede the adoption of instant payment systems, thereby limiting the practical utility of cross-border linkages even where technical interoperability exists.
20 18 Financial Stability Board, Enhancing Cross-Border Payments: Stage 3 Roadmap, at 18–22 (Oct. 2023). 19 Financial Stability Board, G20 Roadmap for Enhancing Cross-Border Payments: Progress Report (2025). 20 International Monetary Fund & World Bank, Payment System Frictions in Sub-Saharan Africa: Diagnostic and Policy Recommendations (2025).
5.2 Algorithmic Opacity and the Explainability Challenge
The increasing deployment of artificial intelligence and machine learning models for transaction monitoring and fraud detection presents a distinct category of regulatory and ethical challenges. While these technologies demonstrably enhance the capacity to process voluminous datasets and identify subtle patterns indicative of illicit activity, their "black box" nature renders interpretability problematic. 21 Regulated entities may find it difficult to justify risk-based decisions to supervisory authorities when the underlying algorithmic reasoning cannot be articulated in comprehensible terms. Moreover, there exists a legitimate concern regarding "algorithmic bias," whereby certain demographic cohorts may be disproportionately flagged as high-risk due to correlations embedded in historical training data.
Such outcomes could exacerbate financial exclusion and contravene principles of equitable access that ostensibly animate the digital finance revolution. The FATF's guidance on leveraging new technologies for AML/CFT purposes acknowledges these challenges but stops short of prescribing specific safeguards, leaving jurisdictions to navigate the tension between innovation and accountability independently.
5.3 Liability Allocation in Instantaneous Settlement
As payment systems transition to T+0 settlement, the temporal window for detecting and interdicting fraudulent transactions contracts to near-zero, fundamentally altering traditional liability frameworks.22 In correspondent banking, the multi-day settlement cycle affords opportunities for post-transaction review and, where warranted, reversal of suspicious transfers. By contrast, instant settlement systems achieve finality within seconds, effectively precluding retroactive remediation. This reality necessitates a prospective shift in liability allocation, potentially imposing greater due diligence obligations on ordering institutions and elevating the importance of pre-transaction verification mechanisms.
6 PRACTICAL IMPLICATIONS
THE SHIFT TO OPEN BANKING AND THE "FINTERNET"
6.1 Remittances and Diaspora Financial Inclusion
21 Financial Action Task Force, Opportunities and Challenges of New Technologies for AML/CFT, at 31–34 (June 2021).
22 Quant LegalTech, T+0 Settlement
Regulatory Realignment and Liability Frameworks (2025).
The globalization of UPI carries profound practical ramifications for the Indian diaspora, international travelers, and enterprises engaged in cross-border commerce. For the millions of non-resident Indians (NRIs) dispersed across the globe, the integration of UPI with systems such as Singapore's PayNow or Bahrain's BENEFIT enables near-instantaneous, low-cost remittances, effectively bypassing the 5–7% transaction fees typically levied by traditional money transfer operators. 23 This cost reduction translates directly into enhanced financial inclusion, as remittance recipients—often economically vulnerable households—retain a greater proportion of transferred funds for consumption or investment.
For SMEs, the PA-CB licensing regime furnishes non-bank payment aggregators with the regulatory authorization to facilitate import and export settlements, thereby democratizing access to cross-border payment infrastructure and reducing dependence on incumbent banks. 24 This regulatory innovation is particularly significant in sectors characterized by high transaction volumes but low per-transaction values, such as e-commerce and digital services, where traditional banking channels impose cost structures that are economically prohibitive.
6.2 Authentication and Security Evolution
From a security perspective, the transition toward "device-bound credentials" and "passkeys" under the RBI's 2025 authentication mandate aims to supplant legacy one-time password (OTP) mechanisms transmitted via SMS, which are notoriously susceptible to interception and failure on international roaming networks. 25 The adoption of biometric authentication and cryptographic key pairs stored in secure enclaves within mobile devices enhances security while improving user experience by eliminating reliance on telecommunications infrastructure that may be unavailable or unreliable in cross-border contexts.
This evolution aligns with the broader architectural vision articulated by the BIS as the "Finternet"—a conceptual framework wherein robust economic architecture and interoperable technologies enable individuals to transfer any asset, in any denomination, at any time, to any recipient globally. 26 Realization of this vision necessitates convergence on standardized messaging formats such as ISO 20022, which accommodate "rich data" fields in payment instructions, thereby facilitating automated compliance checks, enhanced reconciliation, and 23 Worldline India, UPI Global Expansion: Low-Cost Remittance Benefits for the Indian Diaspora (2025).
24 Reserve Bank of India, PA-CB Guidelines, supra note 5.
25 Reserve Bank of India, Authentication Mandate for Card-Not-Present Transactions, supra note 15.
26 Bank for International Settlements, The Finternet
A Financial System for the Future (2024). superior user experience through inclusion of remittance information.27
6.3 Emerging Paradigms
Agentic Payments and Conversational Commerce Looking forward, the confluence of artificial intelligence and payment infrastructure is giving rise to "agentic payments," wherein AI-driven shopping assistants and conversational checkouts—currently being piloted by the National Payments Corporation of India (NPCI) in collaboration with generative AI platforms—automate transaction initiation based on natural language instructions. 28 This paradigm shift introduces novel legal questions regarding agency, authorization, and liability: if an AI agent initiates a payment on a user's behalf based on inferred intent, what standard of proof is required to establish valid authorization? How should liability be allocated in cases of algorithmic misinterpretation or unauthorized transactions?
These questions demand proactive legislative and regulatory responses to ensure that the legal framework evolves in tandem with technological capabilities.
7 CONCLUSION
AND FORWARD-LOOKING INSIGHTS In synthesis, the international expansion of India's Unified Payments Interface constitutes a multifaceted strategic endeavor situated at the nexus of financial technology innovation, diplomatic negotiation, and regulatory harmonization. The legal architecture governing this expansion must exhibit a degree of sophistication and adaptability commensurate with the technological infrastructure it seeks to regulate; a failure to reconcile the DPDP Act's data flow provisions with the FATF's Travel Rule standards, or to harmonize the PSS Act's settlement finality guarantees with the operational requirements of multilateral gateways, could result in a fragmented and suboptimal ecosystem characterized by elevated costs, security vulnerabilities, and limited interoperability.
Moving forward, it is imperative that Indian regulators transition beyond the current phase of bilateral pilot programs toward the realization of truly multilateral settlement architectures exemplified by Project Nexus. Such platforms offer the promise of scalable, equitable global payment infrastructure that transcends the inefficiencies and exclusions inherent in correspondent banking models. However, achieving this vision requires not only technological
27 Financial Stability Board, ISO 20022 Harmonisation for Cross-Border Payments (2025).
28 Razorpay & National Payments Corporation of India, Agentic Payment Pilots with ChatGPT Integration (2025). interoperability but also deep legal harmonization across diverse jurisdictional frameworks— a task that demands sustained diplomatic engagement and a willingness to reconcile domestic policy priorities with international best practices. The next quinquennium will likely witness the emergence of increasingly sophisticated payment paradigms, including agentic transactions, programmable money, and tokenized asset settlements. In this evolving landscape, the legal burden will shift toward ensuring "privacy by design," maintaining meaningful "human-in-the-loop" oversight to mitigate risks of automated decision-making, and establishing clear accountability mechanisms for algorithmic errors or biases.
Ultimately, the success of India's digital finance revolution will be measured not merely by transactional volumes or technological prowess, but by its capacity to export a legally sound, transparent, and inclusive framework that empowers users across borders while safeguarding systemic integrity and individual rights. The jurisprudential and regulatory convergence required to achieve this vision represents one of the most significant challenges—and opportunities—in contemporary international financial law. As India continues to assert leadership in digital public infrastructure, the coherence and sophistication of its legal framework will determine whether this model can serve as a genuine global standard or remain confined to bilateral arrangements of limited scalability.