UPI Agentic Payments vs Card Agent Protocols: Can an AI Really Spend Your Money in 2026?

Short answer: an AI agent cannot freely spend from your bank account today, and India has not launched autonomous UPI payments nationwide. What is true is narrower and more interesting. NPCI is building a protocol that would let a registered AI agent make small UPI payments inside limits you set once, without asking you to tap approve on every transaction. One private implementation of that idea is already live in production. The national version is still unannounced in any public NPCI circular as of 10 September 2026.

The confusion comes from the fact that at least four different things are currently being called "agentic payments," and they give the agent very different levels of power. Before deciding whether this is exciting or alarming, it helps to separate them.

This piece compares the models rather than the brands: bank-rail delegation (what India is building), card-rail agent tokens (what Visa and Mastercard built), protocol-layer mandates (what Google's AP2 built), and assisted checkout (what most people have actually used). Sources are linked at each claim, and everything unconfirmed is labelled as reported.

Four models that all get called "agentic payments"

The distinction that matters for the scare headline is the second column. In assisted checkout, the agent gets you to the payment screen and you finish it. In the other three, you approve a rule once and the agent transacts against that rule afterwards.

What is actually live in India right now

Assisted checkout has been available for almost a year. Razorpay has offered agentic UPI payments since October 2025, first with NPCI and OpenAI inside ChatGPT and later with Anthropic, and in those flows the payment still needs the user's final consent before it completes, as Medianama reported in June 2026. So "ChatGPT can pay with UPI" was already partly true. It just kept a human in the loop at the last step.

The genuinely new thing is Pine Labs. On 11 June 2026 the company announced the Pine Labs Payment Protocol, P3P, describing it as the first setup in India where an AI agent completes a UPI payment with no human authentication at the moment of payment. It is a vendor announcement, so treat the "first in India" claim as the company's own. The mechanism is checkable, though. P3P sits on UPI's existing mandate rails, One Time Mandate and Single Block Multiple Debits, which Pine Labs brands as Reserve Pay. The user approves a mandate once, funds are blocked or pre-authorised, and later debits happen against that reserved amount. Pine Labs' own documentation lists UPI ReservePay and cards as the live rails, with net banking, wallets and EMI on the roadmap.

Two deployments are named publicly. Gullak, a digital gold savings app, is live: a user sets a rule such as buying a fixed rupee amount of gold when the price drops below a threshold, approves the mandate once, and the agent executes afterwards. Vijay Sales is running a proof of concept for price-triggered purchases. That is the honest current scale of autonomous UPI payments in India. Two named merchants, one payment company, one rail.

What NPCI is reportedly building

Reuters reported in early September 2026, citing three people familiar with the plans, that NPCI has built a framework to let AI agents execute UPI payments without per-transaction approval, with groceries and other low-value routine orders as the first use cases. A follow-up Reuters report on 10 September adds a second piece: an AI agent registry that would vet and monitor the agents making those payments, starting with UPI and potentially extending later to cards and bill payments.

Note the naming, because it is inconsistent across coverage. Some reports call it the Unified Agent Protocol. Others, including the registry report, call it the Unified Agentic Protocol. Both refer to the same NPCI framework. The Economic Times carried the earlier detailed version of the story, and Business Standard reported in July 2026 that the protocol was already in consultation with the payments industry. This has been in progress for months rather than being invented for one week of headlines.

Two things are worth flagging clearly. NPCI declined to comment on the reports. And as of 10 September 2026, no protocol specification for this appears on NPCI's public UPI circular list. Everything above rests on named-outlet reporting from unnamed sources, plus one vendor's advertised launch.

The plumbing already exists, and it has limits

The reason this can move quickly is that NPCI is not inventing delegated payments from scratch. Two primitives are already in the rulebook.

UPI Circle lets a primary account holder delegate payment authority to a secondary user. In October 2025 NPCI extended it to IoT devices and software profiles, including AI profiles, for a limited set of users. That earlier implementation still required explicit user action at payment time, so it is a stepping stone rather than the same product.

Reserve Pay, formally Single Block Multiple Debits, lets a user block an amount that can then be debited across multiple later transactions until it is used up, revoked, or expires. NPCI's circular on the Reserve Pay enhancement is public.

Reported caps, and these are set by banks rather than fixed forever: UPI Circle full delegation is commonly capped around ₹15,000 a month with about ₹5,000 per transaction, and Reserve Pay blocks are commonly capped around ₹10,000 for up to 90 days. Reuters' sources indicated those caps could be revisited specifically for agentic use. Treat the numbers as the current operating envelope rather than a published agentic limit, because no agentic limit has been published.

How India's approach differs from the card networks

The card networks got to agentic commerce first, and they solved a different problem. Mastercard announced Agent Pay on 29 April 2025, which issues an Agentic Token scoped to a specific agent, merchant and consent policy, so a model can complete a checkout without touching the raw card number. Mastercard's own description requires trusted agents to be registered and verified first, which is worth noting before anyone calls a national agent registry a uniquely Indian idea. Visa unveiled the Trusted Agent Protocol on 14 October 2025, built with Cloudflare, which gives each agent a cryptographic signature checked against a Visa-operated directory so the merchant can tell a legitimate agent from a bot. Google's Agent Payments Protocol, AP2, announced in September 2025 with more than 60 partners, is a layer above both: signed Intent, Cart and Payment mandates carried as verifiable credentials, giving the merchant cryptographic proof of what the user actually authorised.

The structural difference is who sets the rules. Card-rail agent commerce is designed by competing commercial networks and adopted merchant by merchant. India's version would be defined by one national utility that every bank and payment app already connects to. That makes coordination easier and it makes distribution enormous on day one.

It also concentrates risk. If a national registry decides which agents are allowed to pay, that registry becomes a single point of both control and failure. Reuters noted that the registry work comes against a backdrop of increased attention on unpredictable agent behaviour at large AI firms.

Where the card networks are ahead

The card model has one clear advantage right now: liability is a solved question on card rails. Chargebacks, dispute rights and issuer responsibility already exist, and an agent-scoped token inherits them. Coverage of both P3P and the NPCI proposal keeps landing on the same gap. Liability allocation when an agent buys the wrong thing, or is manipulated into buying it, has not been publicly settled for UPI agentic payments. Medianama raised it in June. Reuters raised it in September. Neither has an answer yet.

AP2 is ahead on a second thing: auditability as a design principle. A signed mandate is evidence of what the user agreed to. A blocked Reserve Pay amount proves only that money was set aside.

Why the scale makes this a global story

UPI processed 24.51 billion transactions worth ₹29.82 lakh crore in August 2026, its highest ever monthly volume, averaging roughly 791 million transactions a day, per NPCI data reported on 1 September. Volume grew 22% year on year while value grew 20%, which means average ticket size is falling.

Work out that average and it explains the design choice. ₹29.82 lakh crore across 24.51 billion transactions is about ₹1,217 per transaction. UPI's centre of gravity is small, frequent, everyday payments. That is exactly the segment the reported agentic rollout targets first, which makes groceries and subscription renewals a natural starting point rather than a cautious one.

What would tell you this is real

Four checkable signals, in order of weight:

1. A protocol specification or operating circular for UAP on NPCI's public circular list. Nothing there yet.

2. A published liability framework covering agent-initiated debits.

3. RBI guidance on whether existing authentication rules apply to mandate-backed agent payments.

4. Named banks and payment apps confirming live support, with revised caps stated.

Until at least the first two land, the accurate sentence is the boring one: India is building a system where an authorised AI agent could make UPI payments on your behalf within limits you set, without approving every individual transaction. A private version of that already works on a small scale. The national version is reported, unconfirmed by NPCI, and unpublished.

If you want to test the shape of it today, set up a UPI mandate on any subscription you already pay for and watch how the block-and-debit flow behaves. That is the same primitive the agentic version would sit on.