UPI merchant KYC is the due diligence an acquiring bank, payment aggregator, or merchant app performs before issuing a QR code or soundbox. Under RBI’s 2025 PA Directions, small merchants with turnover up to Rs 40 lakh can be onboarded on simplified checks; larger merchants need full business verification and ongoing transaction monitoring.
A printed QR code on a counter has become the cheapest acceptance point in Indian payments. That is exactly why it attracts fraud: a static QR can be issued in minutes, and a soundbox confirms every payment aloud without the merchant opening an app.
UPI merchant KYC now carries more weight. RBI’s PA Directions put merchant due diligence on the PA, and NPCI’s MDR framework from 15 October 2026 draws a commercial line between small and larger merchants. This guide covers who onboards, what the rules require, the fraud patterns, and a tiered checklist.
Who Onboards UPI Merchants
Three types of entities issue UPI merchant QR codes, often working together:
- Acquiring banks, which hold the merchant relationship and remain accountable to NPCI.
- Payment aggregators, which onboard merchants, pool collections in escrow, and settle to them under the PA Directions.
- Merchant apps and third-party app providers, which distribute QR codes and soundboxes, usually under a sponsor PSP bank.
Responsibility is diffused: an agent captures documents, an app builds the flow, and a bank or PA owns the risk. UPI merchant KYC must be designed for the weakest link.
The Regulatory Baseline for UPI Merchant KYC
RBI Payment Aggregator Directions, 15 September 2025
RBI’s consolidated Payment Aggregator Directions, dated 15 September 2025, set the core requirements for PA merchant onboarding:
- Merchant KYC must use the Central KYC Records Registry (CKYCR) at onboarding.
- Small merchants with turnover up to Rs 40 lakh (or export turnover up to Rs 5 lakh) may be onboarded through a simplified mechanism. As summarised by AZB & Partners, this can include verifying PAN or Form 60, obtaining one Officially Valid Document, and physical verification of the business premises (contact point verification).
- PAs may use agents for assisted digital KYC and video-based customer identification, but remain responsible for merchant due diligence.
- PAs have a positive obligation to monitor merchant transactions on an ongoing basis against the merchant’s business profile.
Bank acquirers apply the applicable RBI KYC Directions, 2025, which replaced the 2016 Master Direction from 28 November 2025. Map policy to specific paragraphs with legal counsel.
Small vs Large Merchants: P2PM, P2M and the New MDR Line
The P2PM category
NPCI uses a person-to-person-merchant (P2PM) category for small and unorganised merchants who receive UPI payments directly into their own account. Under limits NPCI required acquirers and PSPs to implement before 30 April 2024, a P2PM merchant VPA can receive up to Rs 10,000 per transaction, Rs 25,000 per day and Rs 1 lakh per month.
These caps are a risk control in themselves, which is why lighter UPI merchant KYC for P2PM merchants is defensible.
The MDR framework from 15 October 2026
NPCI’s FAQ dated 15 September 2026 introduces an MDR of 0.4%, capped at Rs 300, on specified person-to-merchant UPI transactions above Rs 2,000, effective 15 October 2026. Certain sectors carry different rates. Transactions up to Rs 2,000 stay free, and small merchants under the P2PM framework receiving up to Rs 1 lakh a month through UPI QR keep zero MDR, without needing GST registration.
The UPI merchant KYC consequence is subtle. Merchants now have a commercial reason to appear small. Expect some businesses to split collections across multiple VPAs or family accounts to stay under the Rs 1 lakh line.
| Merchant segment | Typical profile | Indicative KYC depth | UPI pricing position from 15 Oct 2026 |
|---|---|---|---|
| P2PM small merchant | Street vendor, kirana, home business | PAN or Form 60, OVD, CPV, bank account check | Zero MDR up to Rs 1 lakh per month via QR |
| Small P2M merchant | Shop with turnover up to Rs 40 lakh | Simplified due diligence plus business proof where available | MDR on specified transactions above Rs 2,000 |
| Mid and large P2M merchant | Registered business, often GST and MCA | Full KYB: entity, beneficial owners, GST, MCA, Udyam | MDR on specified transactions above Rs 2,000 |
Fraud Patterns in QR and Soundbox Merchant Onboarding
QR swap and overlay
Fraudsters paste their own QR over a genuine merchant’s code at fuel stations, parking lots, or donation boxes. The overlay QR maps to a separately onboarded merchant or personal VPA, which weak onboarding made possible.
Mule merchants
Mule merchant accounts are onboarded using rented identities or shell proprietorships to collect proceeds of cyber fraud. Signals include brand-new accounts with instant high inflows, many unique payers, and immediate outward transfers.
Transaction laundering
A merchant onboarded as a grocery shop processes payments for something else entirely, such as illegal betting or prohibited online money gaming. The declared category, ticket size, and payer geography stop matching.
Soundbox scams
Soundbox fraud takes several forms: fake devices that play a fixed “payment received” audio, devices taken back by agents after onboarding and used elsewhere, and field agents creating dummy merchants to meet device targets. Each one starts with an onboarding record that nobody verified on the ground.
Agent-driven fake onboarding
Paying agents per activated merchant creates pressure to manufacture merchants. Duplicate shopfront photos, shared mobile numbers, and clustered geotags are common tells.
A Tiered UPI Merchant Onboarding Checklist
These tiers are a framework to adapt, not prescribed by RBI or NPCI.
| Check | Tier 1: P2PM small merchant | Tier 2: small P2M (up to Rs 40 lakh) | Tier 3: mid and large P2M |
|---|---|---|---|
| Identity | PAN or Form 60; one OVD | PAN or Form 60; one OVD | PAN of entity and authorised signatory |
| CKYCR search and upload | Yes | Yes | Yes, for individuals linked to the entity |
| Bank account | Penny drop and name match | Penny drop and name match | Penny drop, name match to entity |
| VPA | Verify VPA holder name | Verify VPA holder name | Verify settlement VPA |
| Premises | CPV with geotagged photo | CPV with geotagged photo | CPV or registered office verification |
| Business registration | Not required | GST, Udyam or shop licence if available | GST, MCA or LLP, Udyam; status checks |
| Beneficial ownership | Not applicable | Proprietor or partners | UBO identification |
| Category declaration | MCC from CPV | MCC validated against registrations | MCC validated against GST and website |
| Approval | Automated rules | Automated with exceptions | Risk review for high-risk categories |
Monitoring After the QR Goes Live
Onboarding sets a baseline; monitoring tests it. Practical controls include:
- Velocity rules on new merchants in the first 30 to 90 days.
- Ticket size against declared category (a tea stall receiving Rs 45,000 payments needs a look).
- Payer diversity and geography against merchant location.
- Inflow-to-outflow speed into the settlement account.
- Monthly volume near the P2PM Rs 1 lakh cap, and multiple VPAs linked to the same PAN, mobile, or address.
- Periodic re-verification of GST and MCA status for registered merchants.
Illustrative scenario
A PA onboards 400 “kirana” merchants in one district through one agent in three weeks. Thirty share four mobile numbers, and 22 shopfront photos show the same two buildings. Within a month, 18 receive payments from distant states and settle out the same day. Each passed simplified UPI merchant KYC on paper; only the portfolio view exposes the pattern.
Bringing Business Verification Into UPI Merchant Onboarding
Much of the fraud risk in UPI merchant acquiring comes from merchants who are not what they claim to be. For Tier 2 and Tier 3 merchants, registry data is the quickest test: is the GSTIN active, does the legal name match the bank account, is the company struck off, is the Udyam category consistent with the volumes being requested?
Where BeFiSc fits: BizCheck generates a business risk report in about 60 seconds from GST, MCA, Udyam, and digital footprint data, giving onboarding teams registration status, age, and name consistency for registered merchants. It does not perform CPV, CKYCR uploads, or transaction monitoring, and it adds little for unregistered P2PM merchants with no business records. Try a free BizCheck report on a merchant in your onboarding queue.
Key Takeaways
- UPI merchant KYC is owned by acquiring banks and PAs even when merchant apps and agents run the flow.
- RBI’s PA Directions of 15 September 2025 allow simplified due diligence for merchants with turnover up to Rs 40 lakh, with mandatory CKYCR use.
- NPCI’s P2PM limits (Rs 10,000 per transaction, Rs 25,000 per day, Rs 1 lakh per month) cap small-merchant risk.
- The MDR framework from 15 October 2026 gives merchants an incentive to stay under the zero-MDR line; watch for split VPAs.
- QR swaps, mule merchants, transaction laundering, and soundbox fraud all start with weak onboarding.
- Use tiered KYC at entry and portfolio-level monitoring after activation.
Frequently Asked Questions
How do PAs detect mule merchants?
By combining onboarding checks (shared identifiers, unverified premises, fresh registrations) with early-life monitoring of inflow velocity, payer diversity, and same-day outward transfers.
Will UPI merchant payments attract MDR from 15 October 2026?
Specified person-to-merchant transactions above Rs 2,000 attract MDR of 0.4%, capped at Rs 300, with different rates for some sectors. Transactions up to Rs 2,000 remain free, and consumers pay nothing.
What is a P2PM merchant in UPI?
A P2PM (person-to-person-merchant) is a small merchant receiving UPI payments into their own account, with NPCI limits of Rs 10,000 per transaction, Rs 25,000 per day, and Rs 1 lakh per month.
Do small merchants need GST registration to get a UPI QR code?
No. Small merchants can receive a UPI QR without GST registration, and NPCI’s FAQ states GST is not needed for the zero-MDR benefit for P2PM merchants receiving up to Rs 1 lakh a month.
What documents are needed for UPI merchant KYC?
For small merchants, typically PAN or Form 60, one Officially Valid Document, bank account details, and a premises verification. Larger merchants add business registrations such as GST, MCA, or Udyam records, and beneficial ownership details.
Conclusion
UPI merchant KYC has always balanced inclusion against fraud. The 2025 PA Directions and the 2026 MDR framework sharpen both sides: simplified onboarding for the smallest merchants, and stronger incentives to misclassify for everyone else.
The answer is not heavier KYC for everyone. It is tiered checks matched to merchant size, registry-backed verification for anyone claiming to be a registered business, and monitoring that looks at the portfolio, not just the individual QR.
