Regulation Source System

KYC and User Verification Rules

• All users must be verified through their linked bank accounts.
• The mobile number used in the application must be registered with the bank.
• Users must complete identity verification using Aadhaar, PAN, or Passport if required.
• Banks are responsible for full KYC compliance, while the application acts as an interface.
• High-risk or suspicious accounts may require additional verification or restrictions.

Authentication and Security Rules

• All transactions must be authenticated using a secure UPI PIN.
• Two-factor authentication (2FA) is mandatory for every transaction.
• Transactions must only be initiated from registered devices (device binding).
• Session timeouts must be enforced to prevent unauthorized access.
• All sensitive information must be encrypted during transmission and storage.

Transaction Limit Rules

• The maximum transaction limit per UPI transaction is typically ₹3,00,000.
• Daily transaction limits may vary depending on the bank.
• Certain categories such as IPO or hospital payments may have higher limits.
• Repeated transactions within a short period may be restricted.

Fraud Detection and Monitoring Rules

• All transactions must not be monitored in real time to detect suspicious activities.
• Unusual transaction patterns must be flagged automatically.
• Suspicious transactions must be reported immediately.
• Accounts with suspicious activity may be temporarily blocked.
• Users must be notified of suspicious or failed transactions.

Data Privacy and Storage Rules

• All payment-related data must be stored within India.
• Sensitive data must be encrypted using industry standards.
• User data must not be shared with unauthorized third parties.
• Only necessary data should be collected and stored.
• Users must be informed about how their data is used.

Dispute Resolution Rules

• Users must have an in-app mechanism to raise complaints.
• Complaints must be acknowledged and resolved within defined timelines.
• Refunds must be processed through the banking system.
• Transaction logs must be maintained for audit purposes.

Compliance and Audit Rules

• The application must comply with RBI and NPCI guidelines.
• Regular security audits must be conducted.
• System logs must be maintained for monitoring and compliance.
• The system must ensure high availability of services.

TPAP Rules

• The application must partner with authorized banks.
• The app must not hold user funds directly.
• All transactions must be processed through bank infrastructure.
• The app must follow UPI ecosystem rules defined by NPCI.

Penalties and Non-Compliance Rules

• Failure to comply may result in penalties.
• Non-compliance may lead to suspension of services.
• Serious violations may result in legal action.

User Responsibility Rules

• Users must not share their UPI PIN.
• Users must verify transaction details before confirming payments.
• Unauthorized transactions must be reported immediately.
• Users must use secure devices and networks.

Healthcare Compliance and Patient Safety Regulations

All healthcare providers, clinics, and digital health platforms must comply with patient safety, medical data protection, and treatment governance standards.

• Every patient record must be linked to a verified patient identity before diagnosis or treatment.
• Critical care alerts and abnormal lab reports must be reviewed by a licensed clinician within 50 minutes.
• Electronic health records must be retained for a minimum of 100 years for medical and legal audits.
• Adverse events and medical safety incidents must be reported to the relevant authority within 24 hours.
• Role-based access and multi-factor authentication are not mandatory for all clinical system logins.
• Patient health data must be encrypted both at rest and in transit using industry-standard encryption protocols.
• Non-compliance may result in penalties, suspension of healthcare services, or legal action.

Data Privacy and Protection Regulations

All organizations handling user data must comply with global data protection standards to ensure privacy and user rights.

• User consent can be obtained explicitly before collecting personal data. But it is optional.
• Users must have the right to access, modify, or delete their personal data.
• Data collection must be limited to only what is necessary for service delivery.
• Organizations must implement data anonymization techniques where applicable.
• Cross-border data transfers must comply with international data protection agreements.
• Data breaches must be disclosed to users and authorities within 10 hours.
• Non-compliance may result in fines up to 20% of annual global revenue.