What this edition covers

This month, we unpack the regulatory developments shaping India’s fintech and payments ecosystem:

Main Course 1 | Gold on UMI: Could gold be tokenized on the RBI’s Unified Markets Interface, and who could issue it? The RBI is exploring the idea but has not identified eligible issuers. We examine what a gold token would require, how the UAE and Singapore have approached similar products, and what this could mean for existing digital gold platforms.

Main Course 2 | Regulating AI in finance: What rules govern the use of AI in Indian financial services today? For now, the existing ones. Rules on lending, outsourcing and customer conduct apply to AI just as they apply to other technologies. We trace the path from the RBI’s FREE-AI Report to its draft Model Risk Management guidance and consider how the framework may evolve.

Dessert | UPI MDR takes shape: What will UPI MDR cost and who will receive it? Following the UPI and Services Steering Committee’s meeting on 15 September, NPCI issued a circular and FAQs setting MDR at 0.4% for UPI transactions above Rs. 2,000. We explain the nuances and what remains unsettled.

Behind the stories: A snapshot of our recent work on the issues covered in this edition.

Mints | Quick bites: A round-up of other key fintech developments.

Hello Reader,

Four days at Global Fintech Fest (GFF) can feel like a crash course in the future of finance, delivered through crowded panels, hurried coffees and conversations in moving queues. The Ikigai Law team joined the bustle this year too. Our Partner and fintech practice head, Aparajita Srivastava, also moderated a panel on payments and loyalty programs.

The conversations unfolded against a distinctly futuristic backdrop. Agentic AI, tokenization and quantum computing dominated GFF 2026. Yet, amid all the talk of what technology could do, one of the sharpest observations concerned something much older: trust. As RBI Deputy Governor Shirish Chandra Murmu said, ‘Potential without trust produces experimentation. Potential with trust produces impact.’ The theme of potential to impact runs through this edition of FinTales. Consider this our post-GFF debrief, without the queues.

Let’s dive in.

Main Course 1 🥘

Gold Standard: RBI’s Next Test for UMI

What gold tokenisation on UMI could look like, how other markets are approaching it, and where it could leave India’s existing gold investment products.

At GFF 2026, RBI Executive Director P. Vasudevan indicated that the RBI is exploring gold tokenization on its Unified Markets Interface (UMI). The proposal is part of a wider plan to extend UMI across asset classes and build the ecosystem around it.

We previously unpacked how UMI works in FinTales Edition 42. UMI is the RBI’s platform for tokenizing real-world assets. It gives each asset a standard digital identity so that it can be recorded and traded on a shared blockchain ledger. This ledger acts as a common record of ownership and transactions.

Payment for a tokenized asset can be settled using the wholesale Central Bank Digital Currency (wCBDC). This allows atomic settlement, where the asset and the money move at the same time. The trade proceeds only if the buyer has the funds and the seller has the token. This reduces the risk of one side completing while the other fails.

Since UMI was launched in October 2025, it has been used to tokenize financial assets such as Certificates of Deposit (CDs). A CD is a debt instrument that a bank issues to raise funds. It has a fixed value and maturity date and gives the investor a claim against the issuing bank.

Gold would require a different model. A gold token would represent a specified quantity of physical gold supplied and held by a bullion provider. Its value would move with the market price of gold. UMI would therefore need to maintain a clear link between the token and the underlying bullion.

Where would tokenized gold fit among India’s existing gold products?

India already offers several ways to invest in gold. However, each product gives investors different rights.

Gold exchange-traded funds (ETFs) are mutual funds that invest in physical gold. Investors hold units in the fund, rather than the gold itself. Electronic Gold Receipts (EGRs), by contrast, represent a specified quantity of physical gold held in an approved vault. Investors can redeem them for the underlying gold. Both ETFs and EGRs are regulated by SEBI and traded on recognized stock exchanges.

Sovereign Gold Bonds (SGBs) are issued by the RBI. They are government securities linked to the price of gold and do not give investors a claim to physical gold.

Digital gold does give customers a claim to the underlying gold. A platform and its partners source and hold a specified quantity for each customer. Customers can sell it back for cash or redeem it for physical gold, but cannot trade it. Digital gold currently falls outside the purview of any financial-sector regulator. Yet it remains popular because users can start saving with as little as Rs.10.

A UMI gold token would therefore be closest to EGRs and digital gold in terms of ownership. However, its regulatory and trading model would be different.

Table 1: Comparing India’s Gold Investment Options

Which model should the RBI choose for gold tokenisation?

Tokenizing gold would raise questions that UMI did not face with CDs. CDs can be issued only by certain RBI-regulated entities, including scheduled commercial banks. They also have no underlying physical asset that must be stored or verified. The RBI therefore began with a defined group of issuers and did not need separate rules for physical custody.

Gold tokens will have no similar group of existing regulated issuers. The RBI would first need to decide who may issue a gold token. It would then need to prescribe standards for the quality and quantity of the underlying gold. The framework would also need to identify who will hold and verify the gold, supervise the tokenization chain and protect token holders.

Other markets point to two possible models. One allows specialized providers to participate under an accreditation framework. The other keeps the full chain within an already regulated bank.

The UAE has taken the first approach. In October 2025, Dubai’s Virtual Assets Regulatory Authority (VARA) and the Dubai Multi Commodities Centre (DMCC) partnered on commodity tokenisation infrastructure. The first asset was a tokenised 1,971-kilogram silver bar. Tokinvest, a VARA-regulated platform, issues the tokens. DMCC separately verifies and registers the silver through its Tradeflow platform.

This model divides responsibility between two bodies. The commodity body verifies the underlying asset, while the financial regulator supervises the token issuer.

Singapore has followed the second model. Banks manage the entire chain. In June 2026, DBS Bank announced that it would offer retail customers gold tokens backed one-to-one by bullion held in its own vaults. The bank will manage tokenization, issuance, distribution and custody. The Monetary Authority of Singapore (MAS) has also set up a working group on gold trading. However, the model remains centered on banks. There is no separate accreditation framework for independent gold token providers.

What would this mean for existing gold investment products?

The model chosen by the RBI will determine which businesses can participate in UMI. It will also shape the competition faced by businesses that remain outside it.

An open accreditation model could allow bullion providers, vaulting agencies and digital gold platforms to participate. These businesses would need to meet the RBI’s standards for issuing tokens and holding the underlying gold. In return, they could gain access to regulated tokenization and settlement infrastructure.

A model limited to RBI-regulated entities would have a different effect. It would keep unregulated digital gold platforms and other fintechs outside UMI. These businesses would then compete with a tokenized gold product backed by RBI-regulated infrastructure.

That competition could push digital gold platforms to reconsider their structures. Some may partner with a regulated entity. Others may restructure their products or seek regulated-entity status. Businesses that continue to operate outside the regulatory perimeter may risk losing customers who prefer a regulated product.

The impact would ultimately depend on whether the UMI product offers a better investment experience. If it provides stronger liquidity, more transparent pricing or easier redemption, the pressure on existing platforms would be greater. If it does not, regulatory backing alone may not be enough to shift the market.

What will decide whether gold tokenization succeeds?

Gold will test how far UMI can move beyond financial assets. Tokenization may make ownership and settlement more efficient. However, efficiency alone will not create demand for another gold product.

Investors already have several ways to gain exposure to gold. Each serves a different need. EGRs show why regulatory backing may not be enough. SEBI created an accredited and exchange-traded framework for gold-backed receipts carrying a claim to physical gold. Adoption has still remained weak, and the framework is now under review.

The RBI must therefore solve a problem that existing products do not. Wholesale participants may value atomic settlement because it could reduce settlement and counterparty risk. Retail users will need another reason to switch, such as better access, liquidity, pricing or redemption.

Gold is therefore an important next product for UMI. The technology and settlement infrastructure are taking shape. The harder task will be to build a product that investors want and a framework in which existing gold businesses can participate.

Main Course 2 🍲

How RBI May Regulate AI Use in Financial Services

How existing RBI regulations govern AI, and how they may evolve.

RBI Deputy Governor Rohit Jain summed up the RBI’s approach to AI regulation at GFF 2026: ‘An institution may outsource the computation, but it cannot outsource the consequence’. He emphasized that a financial institution may use an external AI model or cloud service, but it remains responsible for the outcome.

This warning comes as financial institutions are deploying AI for various purposes such as credit assessment, customer service and fraud detection. A bank may use a third-party model for credit scoring. An NBFC may use generative AI to handle borrower queries. A payments company may use AI to identify fraudulent transactions. However, if these systems make a wrong decision, the regulated entity remains responsible.

Mr. Jain also highlighted three risks that could grow as AI adoption increases. The first is speed since AI systems can make decisions faster than humans can review them. The second is concentration, as many institutions rely on the same cloud, model and technology providers. The third is opacity, as some AI reasoning can be difficult to reconstruct. These risks can create direct customer harm.

What rules already apply to AI in financial services?

Even though India does not have one binding central law or specific RBI regulations governing AI deployment, the existing regulations do address some of the risks highlighted by RBI governor.

Most financial rules are technology-neutral. They regulate the activity, its risk and the entity responsible. Lending rules still apply when AI assesses a borrower. Payment rules apply when an AI agent initiates a transaction. Requirements on customer conduct, disclosures, grievance redress, data protection, cybersecurity and resilience also continue to apply.

The same principle applies when an institution uses an outside vendor. RBI outsourcing rules require due diligence, clear contracts, monitoring and audit access. The regulated entity remains accountable for the regulated activity and the customer outcome.

What could future AI regulation look like?

The RBI has taken two steps that indicate what future AI rules may look like. Neither creates a final, binding rulebook. However, both point to safeguards that the RBI may introduce.

The RBI’s FREE-AI Report, released in 2025, sets out a non-binding roadmap for responsible AI adoption. Its 2026 Draft Guidance on Model Risk Management proposes more concrete controls.

Together, they suggest that the RBI may build on existing financial rules and add safeguards where AI creates new risks. These safeguards are likely to vary by use case. A system that prepares internal management reports from existing data would not face the same regulatory burden as one that approves credit disbursal or moves money.

Future rules may require regulated entities to maintain a board-approved model-risk framework, and an inventory and risk classification of AI models. Higher-risk systems may need independent validation and closer monitoring. Regulated entities using customer-facing AI models may need to make clear disclosure of AI use, provide access to human assistance and a way to challenge AI-driven decisions.

Oversight of technology providers servicing regulated entities may become stricter as well. The RBI may make it mandatory for REs to obtain information about training data, testing, model changes and incidents from AI vendors. Contracts between regulated entity and AI models may require stronger audit rights and controls over customer data.

Could India regulate AI through design?

India’s approach may extend beyond rules imposed on institutions. It may also place safeguards within the digital infrastructure through which AI operates. NPCI’s reported proposal for a Unified Agentic Protocol offers an early example.

The proposal includes a central registry for AI agents transacting on UPI. It could identify each agent, verify who authorized it and record the limits of that authority. This would make agents visible and traceable before they initiate payments. Payment firms could then reject unknown or unauthorized agents.

The registry would not answer every legal question. Rules would still need to clarify liability when an agent makes a mistake or exceeds its instructions. Yet it shows how regulation by design could work. Basic safeguards could sit within the payment rail and manage risk before a transaction goes wrong.

What should regulated entities do now?

AI rules are likely to become more detailed as systems gain autonomy and perform critical tasks. Regulated entities should therefore define what each AI system may access, recommend, decide and do. They should test these limits, monitor outcomes and retain a path for human intervention.

Technology providers will need to reflect these duties in their system design and guardrails. Accountability, however, will remain with the regulated entity. This makes early governance especially important where existing rules were not written with AI in mind.

Dessert 🍨

UPI MDR Takes Shape

NPCI has released the UPI MDR framework, effective 15 October 2026.

In our last edition, we covered the amendment to Section 10A of the Payment and Settlement Systems Act. It allowed the Government to decide which payment modes must remain free.

The Government has now notified that RuPay debit-card payments and UPI transactions up to Rs. 2,000 will remain free. NPCI has followed with a circular and FAQs setting out the MDR framework.

P2M transactions above Rs. 2,000 will attract MDR of 0.4%, capped at Rs. 300. Capital-market payments will attract 0.02%, also capped at Rs. 300. Small merchants receiving up to Rs. 1 lakh a month under the P2PM framework will continue to pay zero MDR.

Several participants support a UPI payment. The issuing bank holds the customer’s account. The UPI app provides the customer-facing interface, while its partner payment service provider (PSP) bank connects it to the UPI network. On the other side, an acquiring bank, often working with a payment aggregator, onboards and services the merchant. NPCI operates the underlying payment rail.

The framework divides the standard 0.4% MDR among these participants. The issuing bank retains 0.16%, the acquiring side 0.12%, the UPI app 0.08% and the payer PSP bank 0.04%. Where a payment aggregator is involved, it must negotiate its share of the acquiring bank’s 0.12%.

A dedicated fund will also support small-merchant onboarding, particularly in rural areas and Tier 3 to Tier 6 centres. Each participant will contribute 5% of its MDR share. The fund’s structure will be finalised with the RBI within three months.

Consumers will continue to use UPI for free.

Behind the stories 🍃

The themes we explore in FinTales often reflect the regulatory questions we encounter in our work with fintechs, investors, and policymakers. Here is a taste of  what’s keeping us busy:

Tokenized assets: We advise several businesses on the laws that apply to digital assets. Our clients include stablecoin-based cross-border payment providers and tokenized securities platforms.

AI in finance: We have advised investment platforms developing AI-powered securities research tools. Our work covered their regulatory classification, oversight, disclosures, and responsibility for AI-generated outputs.

UPI monetization: We have advised leading fintech companies, investors and industry associations on the policy case for UPI MDR. Our work included engagement with the RBI, NPCI, and the Ministry of Finance. Several of our recommendations on rates, revenue sharing, merchant protection, and the long-term sustainability of the ecosystem are now reflected in the revised framework.

Find more of our recent work here.

Mints 🍃

🪙 RBI and SEBI introduce Demat 2.0 for tokenized securities

RBI and SEBI have jointly introduced Demat 2.0, which connects SEBI’s securities infrastructure with RBI’s UMI. The framework is being used to tokenize corporate bonds.

🧊 RBI proposes temporary holds on suspected mule accounts

The RBI has proposed a new SOP for banks to place temporary debit holds on transactions of Rs. 1,000 or more that are flagged for suspected money-mule activity. The draft sets timelines for notifying customers, reviewing their response and either releasing the hold or referring the matter to the police. Deadline to submit comments on the SOP is 2 October 2026.

🏠 Maharashtra plans framework for land tokenisation

Maharashtra plans to introduce the DELTA Act to create a legal framework for blockchain-based tokenisation of land and other immovable assets. The proposed framework aims to unlock liquidity while addressing legal certainty and consumer protection.

🤝 United Fintech Forum recognized as fintech sector’s second SRO

RBI has recognized the United Fintech Forum as the fintech sector’s second self-regulatory organisation (SRO). The move is aimed at strengthening governance, trust and responsible growth as the sector expands.

🌍 India proposes forum to help fintechs navigate foreign regulation

Finance Minister Nirmala Sitharaman has proposed a dedicated forum to help Indian technology companies engage with overseas regulators and Governments. The forum could support licensing, market entry, interoperability and cooperation on data and cybersecurity.

💳 NPCI Bharat BillPay proposes infrastructure for MSME collections and credit

NPCI Bharat BillPay is working on a centralized infrastructure connecting invoices, payments, reconciliation and financing. The proposal aims to help MSMEs convert receivables into cash and transaction flows into credit opportunities.

🏢 NPCI gets in-principle approval for GIFT City office

IFSCA has given NPCI in-principle approval to establish an office in GIFT City. The move could support NPCI’s international payments ambitions as GIFT IFSC develops as a hub for cross-border financial services.

🇺🇿 UPI expands to Uzbekistan

NPCI International has partnered with Uzbekistan’s National Interbank Processing Centre to enable Indian travelers to make UPI payments at merchants accepting UZQR. Users can pay directly from their Indian bank accounts through existing UPI apps.

🔄 UPI AutoPay set for interoperability

NPCI is working to make UPI AutoPay mandates portable across apps, allowing users to view eligible mandates and switch providers without recreating them. Merchants will also be able to move mandates when changing payment gateways or acquiring banks.

🏦 IRDAI proposes common digital insurance registry

IRDAI has proposed a Public Insurance Registry to enable consent-based sharing of policy, claims and customer data across insurers and stakeholders. The registry could support consolidated policy views, product comparison, underwriting and claims processing.

📊 SEBI introduces IT Resilience Index for market infrastructure

SEBI has introduced an Information Technology Resilience Index for stock exchanges, depositories and other market infrastructure institutions. The index will assess areas such as security, availability, governance and business continuity, with half-yearly reporting and corrective actions.

About FinTales

FinTales is Ikigai Law’s monthly fintech and digital economy newsletter. It tracks the regulatory shifts shaping India’s fintech ecosystem, from payments, digital lending, KYC, wealth-tech, insur-tech, AI in finance and data governance to product strategy, financial innovation and policy reform. FinTales is curated by Ikigai Law’s fintech team, which advises fintech businesses, banks, NBFCs, payment companies and policy stakeholders on regulatory, transactional and strategic questions across the financial technology ecosystem.

Author credits: Aparajita Srivastava, Astha Srivastava, Sidharth Chamarty and Samyukta Iyer.

Image credits: AI-generated

For any queries, reach out to us at contact@ikigailaw.com.