Faster Than the Rules: Can India's UPI Carry the Travel Rule Abroad?

India's Unified Payments Interface (UPI) settles a payment in ten to fifteen seconds. The standard now shaping its journey abroad assumes the opposite: verified, structured data preserved at every step. When the Reserve Bank of India (RBI) published its Payments Vision 2028 on 27 March 2026, naming the efficiency of cross-border payment frameworks as a central pillar, it committed one of the world's largest retail payment systems to an ambition that runs straight into a rule rewritten in 2025 to slow such systems down. The question is no longer whether UPI can scale. It is whether speed and traceability can share a single payment instruction.

Domestic triumph does not cross borders

UPI's domestic record is not in doubt. Launched in 2016, it carries the bulk of person-to-person and merchant digital payments in India, settling in roughly ten to fifteen seconds according to analysis by Facctum. That speed is the product of a system built around a single regulator, a single currency and a single supervisory perimeter. None of those conditions survives a border.

Most of UPI's international presence today is the simplest kind. The dominant model is QR-based merchant acceptance, where an Indian traveller scans a code abroad and pays a foreign merchant from an Indian bank account. The payments facilitator Worldline describes how each corridor runs through interoperability agreements, routing a transaction through both networks, converting currency and settling in near real time. Cross-border volumes nearly doubled to 1.48 million in the 2025-26 financial year as of December 2025, up from 0.75 million the year before, according to Business Standard, crossing one million for the first time. Striking as a growth curve; trivial as a share of UPI's domestic scale. That gap is the point, not a footnote to it. The corridors that exist today are the easy ones, built with willing partners and modest volumes. The hard part of internationalisation, true bidirectional account-to-account transfer, has barely begun, and the rules governing it are the part that has changed most.

FATF has rewritten the rules

The rules changed in June 2025. The Financial Action Task Force (FATF) agreed the most significant revision to Recommendation 16 (R16) in more than a decade, with an Annex IV to the assessment methodology following the October 2025 Plenary, according to the FATF. R16, known in the virtual asset context as the travel rule, requires that cross-border transfers carry complete originator and beneficiary information end to end, so receiving institutions can screen and act on high-risk transactions.

The revision did not restate the principle. It hardened it. For cross-border payments above a de minimis threshold of around USD or EUR 1,000, the standard now demands accurate, structured originator and beneficiary data, preserved across every intermediary in the chain. The iPiD analysis of the June 2025 update notes new fields including originator address, date of birth and the Legal Entity Identifier (LEI), aligned to the richer capacity of the International Organization for Standardization messaging standard ISO 20022. Ordering institutions must verify originator data; beneficiary institutions must confirm recipient identity above the threshold. The governing logic, in the FATF's words, is "same activity, same risk, same rules." The phrase is short. Its consequences for a real-time retail system are not.

The collision is not yet fully joined, and that is the crucial point. So long as UPI's overseas activity is mostly travellers paying merchants, with settlement handled inside India, the heaviest travel-rule obligations on genuine cross-border transfers do not bite as hard as headlines suggest. But the stated ambition is precisely to move beyond that. The Finance Ministry has described plans to link UPI with fast payment systems in partner countries to enable cross-border person-to-person remittances, alongside travel-based merchant corridors. The day those remittance corridors carry real value at volume is the day R16 applies in full. The FATF expects global compliance by the end of 2030, supported by a Payment Advisory Group and a guidance paper expected late in 2026, according to FinancialCrime.lu.

India is lobbying, not just complying

India has read the same standard and reached a different conclusion. Rather than accept the framework as fixed, it has tried to reshape it. During the consultation that closed in April 2025, RBI Governor Sanjay Malhotra reportedly told FATF attendees, without naming UPI, that it would be desirable to make the travel rule "technology-neutral," according to Outlook Business. The same reporting records India's contention that compliance falls hardest on smaller players, while established networks such as the Society for Worldwide Interbank Financial Telecommunication (SWIFT), Visa and Mastercard sit comfortably within rules shaped around their architecture.

The argument is serious, not special pleading. A standard written with correspondent banking in mind encodes assumptions that disadvantage account-to-account instant systems. Yet a decision on India's request depends on consensus among FATF members, and consensus is slow. The risk is plain. If India builds remittance corridors at the pace Payments Vision 2028 implies while the rules it dislikes remain in force, it operates an expanding international system against a standard it has not yet persuaded the world to amend. Lobbying is not a compliance strategy. It is a bet on timing.

Europe is where deferral ends

The merchant-acceptance model has carried UPI into Europe, with France among the markets reached through a local partner, and the corridor list lengthening. That model keeps the hardest compliance questions at bay for now, because the transaction looks closer to card acquiring than to a regulated cross-border transfer between institutions. The deferral is temporary, not permanent.

The European Union is where the deferral ends. The recast Transfer of Funds Regulation, Regulation (EU) 2023/1113, has applied since 30 December 2024 with no transitional grace period, implementing the travel rule for transfers handled by payment service providers established in the Union, with operational detail set out in the European Banking Authority's Travel Rule Guidelines of 4 July 2024. The moment UPI moves from letting Indian tourists pay European merchants to carrying genuine cross-border transfers into or out of the bloc, it enters a regime that already demands the structured, verified data the FATF made global in 2025. A system permitted to run lightly in one jurisdiction does not become compliant by crossing into another; it inherits the stricter obligation. The European corridors are small in volume and large in signal: they mark where the abstract clash between speed and traceability will first become a concrete supervisory expectation.

Localisation and the travel rule collide

The travel rule is not the hardest constraint. India mandates domestic storage of payment data and requires that foreign-held copies be deleted within twenty-four hours of retrieval where business-as-usual access is not established, according to analysis by Cyril Amarchand Mangaldas. R16 requires that data travel with the payment and remain available to authorities along the chain. Localisation requires that the same data stay home. One rule says move it; the other says keep it. Both apply at once.

The conflict sharpens with each new corridor. Every counterpart jurisdiction brings its own localisation rules, its own supervisory expectations and its own claim over a transaction that touches two regulators at once. The Cyril Amarchand Mangaldas analysis warns that what should be cooperation risks becoming competition, with each central bank seeking oversight over transactions linked to its economy, and with UPI's expansion potentially diluting the RBI's own supervisory control. A compliance question becomes a question of sovereignty. The data fields are the easy part. Deciding whose law governs them is not.

The exposure extends beyond India

For payment service providers, fintechs and banks operating any corridor that touches UPI, the consequences are immediate. As bidirectional corridors develop, firms cannot assume a counterpart on a fast retail rail is transmitting the structured, verified data the revised R16 now expects above the threshold. Screening and monitoring workflows built for slower correspondent flows must be re-examined against systems that settle before a human analyst could act. The FinancialCrime.lu guidance is clear that compliance now demands technical, process and legal measures together: ISO 20022 messaging, workflows that flag payments lacking required data, and legal powers to compel production of payment information.

The deeper challenge is that R16 is enforced through mutual evaluation, not declaration. An assessment does not ask whether a firm has a travel rule policy. It asks whether the data arrives, whether it is accurate, and whether a payment missing required information is caught and acted upon. For a corridor settling in seconds, the control must operate without a human in the loop, because there is no interval in which one could intervene. A real-time payment system can be made compliant, but compliance cannot be retrofitted at the speed of settlement. It has to be built into the corridor before the corridor opens. The 2030 deadline is not distant. It is the point by which architecture, not aspiration, will be tested. Control effectiveness, not control existence.

Conclusion: speed meets the slowest consensus

The contest looks like a technology problem. It is a governance problem wearing a technology costume. India has built a payment system of remarkable reach and speed, and it has every reason to want that system to travel. The revised R16 prizes traceability over velocity, and it will be enforced by evaluation, not exhortation. Between the two sits a question India has not answered: whether a system built to remove friction can absorb the friction transparency demands without ceasing to be what made it work. One of the world's largest real-time payment systems is approaching the slowest-moving consensus in financial regulation. One of them will bend.

Is your firm confident that every cross-border corridor it touches can carry verified, structured payment data at the speed those rails now settle?

At OpusDatum, we help payment firms, banks and fintechs translate the revised Recommendation 16 from a 2030 abstraction into corridor-level controls that survive a mutual evaluation. We work on the architecture before the corridor opens, not after a finding lands. To find out how we can help you, contact us now.