UPI, Wallets & Real-Time Payments · Compliance
NPCI UPI MASF: what it requires of your app's mobile security.
NPCI circular NPCI/2025-26/IS/003, dated 19 May 2025, mandates mobile application security controls and enhanced RASP (runtime application self-protection) for every UPI app. It lists 31 controls, 19 marked Mandatory and 12 Recommended. Compliance is certified by a CERT-In empanelled auditor once every financial year, alongside the UPI Information Security Compliance Framework submission due on or before 31 December.
Every PSP, ASP and TPAP on UPI.
The circular is addressed to all Payment Service Providers, Application Service Providers and Third-Party Application Providers on the Unified Payments Interface, and says the listed controls are mandated for all UPI applications. It builds on NPCI's earlier RASP circular (NPCI/2020-21/PSO/001, 28 April 2020) and on Section 17 of the UPI Information Security Compliance Framework-2025 (NPCI/2024-25/IS/006, 29 April 2024).
RASP is mandated for UPI apps.
NPCI has made runtime application self-protection (RASP) and related mobile application security controls mandatory for UPI applications. Each control in the circular is marked Mandatory or Recommended. Talk to us about NPCI RASP compliance.
Source: NPCI circular NPCI/2025-26/IS/003 dated 19 May 2025. Not legal advice; confirm requirements with your compliance counsel and the original circular.
Issued Once. Certified Every Year.
Date of circular NPCI/2025-26/IS/003, "Comprehensive Mobile Application Security Framework for UPI-2025". The circular text does not set a separate compliance date; confirm any implementation timeline with NPCI.
Compliance against the circular is submitted once per financial year, certified by a CERT-In empanelled auditor, with the UPI Information Security Compliance Framework-2025 submission on or before 31 December.
Set It Against What UPI Fraud Costs.
reported UPI fraud loss in FY24, across 13.42 lakh cases
reported in FY25, across 12.64 lakh cases
reported in FY26 up to November, across 10.64 lakh cases
Source: Ministry of Finance reply in the Lok Sabha, December 2025, as reported by the press. Reported cases and losses, not NonaShield measurements.
Root Detection Alone Isn't Compliance.
What teams treat as "done"
- A basic root-check library that a hooking framework can defeat.
- Checking device health at login, then never again in the session.
- No signed record of what the check actually found.
What the circular is actually asking for
- Root-cloaking detection, not just root-flag checks: the circular names hooks in the runtime environment as an indicator.
- Continuous memory-integrity and runtime verification, not a one-time gate at login.
- A tamper-response plan: customisable actions on detection, and real-time alerts to your monitoring systems.
- An auditor-ready record of what each check found, because certification is annual.
Screen-sharing and remote-access scams pass every check that only looks at the device, because the real customer is using their real phone — the compromise is in who's driving the session, not the hardware. The circular's device checks and NonaShield's behavioural layer answer two different questions; both are part of the same requirement. See the behavioural detection case study.
One Platform, Twelve Controls, Every Sector.
NPCI's UPI mobile app security circular is one of seven compliance instruments NonaShield maps to on day one — alongside the RBI Digital Payment Security Controls, RBI Authentication Directions, RBI Digital Lending Directions, PCI DSS v4.0.1, CERT-In's retention rules and DPDP Rule 6. See the full compliance mapping →
NPCI UPI App Security Circular, Answered.
Is RASP mandatory for UPI apps?
Yes. NPCI circular NPCI/2025-26/IS/003 (19 May 2025) issues mobile application security controls and enhancements to RASP mechanisms, and states that its controls are mandated for all UPI applications. It follows NPCI's earlier RASP circular, NPCI/2020-21/PSO/001 of 28 April 2020. Each control is labelled Mandatory or Recommended.
What does NPCI's UPI mobile app security circular require?
It lists 31 controls across Identify, Protect, Detect and Respond, 19 Mandatory and 12 Recommended. Mandatory items include root and root-cloaking detection, runtime code and data integrity, debugging prevention, proxy detection, SSL pinning, screen-mirroring prevention, tamper response and real-time alerting.
Who does the circular apply to?
It is addressed to all Payment Service Providers (PSPs), Application Service Providers (ASPs) and Third-Party Application Providers (TPAPs) on the Unified Payments Interface, and covers all UPI applications.
Is compliance a one-time requirement?
No. Compliance against the circular is submitted once every financial year from a CERT-In empanelled auditor, along with the UPI Information Security Compliance Framework-2025 submission on or before 31 December.
Is root detection enough to comply?
No. The circular also requires root-cloaking detection, runtime memory-integrity checks, debugging prevention, proxy detection, tamper response and real-time alerting, among other mandatory controls.
Talk to Us About NPCI RASP Compliance.
The control-by-control mapping to NPCI/2025-26/IS/003, for your app.