Cybernerds, a CERT-In Empanelled Information Security Auditor, conducts independent security audits for entities participating in the UPI ecosystem , aligned with NPCI's UPI Information Security Compliance Framework 2025 and associated circulars.

Preparing for your UPI audit? Start here.

Why This Audit Exists

NPCI has issued the UPI Information Security Compliance Framework 2025 to strengthen the security and resilience of the UPI ecosystem, focusing on confidentiality, integrity, and availability.

With UPI processing over 15 billion transactions monthly, the security of every participant such as banks, PSPs, and TPAPs is a systemic requirement. NPCI mandates audits to ensure all entities meet consistent and verifiable security standards.

Key regulatory drivers:

  • UPI Information Security Compliance Framework 2025: Security baseline for all UPI participants
  • NPCI Circular OC-215/2025-26: UPI API security guidelines with implementation deadline July 31, 2025
  • NPCI Circular NPCI2025-26IS003: Mobile Application Security Framework for UPI
  • RBI Digital Payments Security Controls Directions: Applicable to all payment system participants
  • CERT-In Directions dated April 28, 2022: Incident reporting and log management requirements

Non-compliance may result in penalties, transaction restrictions, or suspension from the UPI network.

Who This Applies To

The framework applies to issuing and acquiring banks, PSPs, third-party application providers (TPAPs), technology service providers, and IVR platforms.

In practical terms:

  • PSP Banks - banks providing UPI payment services through their own or third-party applications
  • TPAPs - third-party UPI app providers operating through a PSP bank
  • Acquiring Banks - banks on the merchant/payee side of UPI transactions
  • Technology Service Providers - entities providing backend technology infrastructure to UPI participants
  • IVR Platforms - voice-based UPI service providers

Important: PSP is responsible to ensure that UPI compliant application and systems of TPAP are audited to safeguard security and integrity of the data and information of the User including UPI Transaction Data as well as UPI app security. If you are a TPAP, your PSP bank carries audit accountability for your systems and your cooperation is a contractual obligation.

What the Audit Covers

Controls span data security, identity access management (IAM), network security, application lifecycle security, incident response, and fraud risk mitigation. Infrastructure security, logging, monitoring, and architecture reviews form pillars. The framework adopts Zero Trust Architecture, aligning with NIST CSF, RBI guidelines, and DPDP Act.

Specific assessment areas:

  • Application and Mobile Security
  • API Security
  • Data Security and Localisation
  • Identity, Access, and Authentication
  • Fraud Monitoring and Incident Response
  • Infrastructure and Network Security
  • Business Continuity and Resilience

Our Audit Methodology

A structured, evidence-based approach aligned with NPCI framework and CERT-In guidelines:

  • Scope and Applicability Review: Identify entity type, map applicable NPCI circulars, and define systems and APIs in scope
  • Document and Gap Review: Assess policies, API inventory, SDLC records, incident logs, and prior audit evidence
  • Technical Assessment: Evaluate application security, API controls, infrastructure configuration, and VAPT reports
  • Control Validation: Verify controls against evidence and document gaps with reference to NPCI requirements
  • Remediation Verification: Validate closure of identified findings before certification
  • Reporting and Submission: Prepare audit report in NPCI format for submission

Common Gaps We Observe

Recurring observations from UPI audit engagements:

  • Incomplete API inventory with undocumented or deprecated endpoints still active
  • System-initiated API calls not rate-limited or queued
  • Mobile apps missing RASP controls for runtime and proxy misuse
  • VAPT excludes mobile application scope
  • Data localisation not verified for UPI transaction data
  • User consent not obtained for UPI ID seeding or porting
  • Incident response plans not aligned with NPCI and CERT-In timelines

What You Receive

  • UPI Security Audit Report - control-level findings across all NPCI framework domains, with observations, evidence references, and risk classification
  • Compliance Certificate - issued by Cybernerds as a CERT-In Empanelled Information Security Auditor, confirming audit completion and finding closure status for NPCI submission
  • Quarterly Self-Attestation Support - guidance on structuring the quarterly self-attestation process for ongoing compliance

The compliance certificate is issued solely on the basis of audit findings and verified remediation closure. It is not a predetermined outcome of the engagement.

Our Perspective

We approach the NPCI UPI audit as an assessment of whether your organisation's participation in India's payment infrastructure is backed by controls that genuinely protect transaction integrity and user data , not just a compliance submission.

As a CERT-In Empanelled Information Security Auditor, Cybernerds brings:

  • Independence from your technology vendors and platform providers
  • Payment ecosystem familiarity - UPI, IMPS, RuPay, and associated NPCI frameworks
  • Evidence-backed assessment of live system controls across mobile, web, API, and infrastructure layers
  • Regulatory interpretation aligned with NPCI, RBI, and CERT-In requirements

Review a Sample Audit Output

See how UPI audit findings, API security observations, and control evaluations are structured for NPCI submission.

Speak With Our Experts

If your organisation participates in the UPI ecosystem and is preparing for its annual security audit, connect with our team.