NPCI reveals the reason behind the ‘longest’ UPI outage: “The issue was caused by …”

India's Unified Payments Interface (UPI) experienced its longest downtime in over three years on April 12, lasting approximately five hours due to banks flooding the system with excessive transaction status check requests.
According to the National Payments Corporation of India's (NPCI) root cause analysis, the outage stemmed from a critical technical oversight - the absence of a transaction status check limiter in the system's architecture.
"The issue was identified to be caused by the flooding of 'Check transaction' API. Further, it was observed that a few PSP Banks were also sending requests for 'Check transactions' even for older transactions multiple times," stated the NPCI report.

The NPCI's operating guidelines explicitly limit banks to checking a transaction's status only three times, with each request requiring a 90-second interval. However, this restriction was meant to be implemented by the banks themselves rather than through NPCI's infrastructure.
A source familiar with the matter told MoneyControl that banks continued making non-stop transaction success checks that overwhelmed the system beyond its capacity.
"When a transaction is initiated, banks need to verify its completion status, but there needs to be reasonable limits to how frequently these checks occur," explained a senior banking official who requested anonymity. "What we witnessed was essentially a self-inflicted denial-of-service situation."
The UPI platform has reportedly faced four separate outages in just the past three weeks, causing substantial disruption to merchants and consumers alike. The NPCI has now advised financial institutions and their partners to strictly adhere to the specified frequency of transaction checks instead of continuously querying the system.
Industry experts suggest this incident highlights the need for more robust failsafe mechanisms within the UPI architecture itself. "Relying solely on partner banks to self-regulate their API calls creates a single point of failure," noted a fintech consultant. "The NPCI needs to implement system-level throttling to prevent similar incidents."