Response to Nandan Nilekani’s speech at UPI v2 launch.

Response to Nandan’s speech during the launch of UPI v 2.0 in August 2018. Although this response is few months late, it might be useful in analyzing conflicts of interests. It is also important to note in January 2019, RBI had appointed Nandan Nilekani as chairperson to head a committee on deepening digital payments.

In Oct 2016, shortly after Unified Payments Interface was launched, Nandan Nilekani in an interview mentioned how a new generation of digital public goods are being built as highways. I responded with how UPI is a club good and is tolled road. Over the last 20 months, gigabytes of data has flown from millions of users to NPCI, trading privacy for convenience without even knowing it by merely using UPI, the instant payments platform run by a private non-profit (that just means, it doesn’t pay its investors dividends and not to be confused with non-commercial) company. On Aug 16, 2018, UPI 2.0 was unveiled and Nandan Nilekani spoke again on some strategic decisions behind UPI and directions on future of payments in India. You can watch the whole speech at or read through transcripts. (semi-edited, closed captions)

Let us examine these pitches, dissect them separating the marketing exaggerations with facts from the ground and examine some of the key governance issues in UPI / NPCI. Some of these issues are also present across variety of institutions in various sectors undergoing digital transformation (partly owing to his role in TAGUP report guiding these digital infrastructure, not limited to Aadhaar / UPI) and what these mean to state, market, and public in general.

1. Structure of NPCI.

India has a company like NPCI is also very very critical we without NPCI we could not have done all these things and the fact is that NPCI is a non-profit company section 25 a section 8 company owned by the banks collectively and therefore having that company which enables these payment rails to be built in a cooperative, collaborative fashion

Contrary to popular opinion, there is very little “National” and “India” in NPCI, except that it operates in India. The name, much like BCCI — Board of Control for Cricket in India representing cricket clubs, NPCI represents a closed club of banks. It is important to note that this club will serve the interests of its members, not end consumers and maintaining a shared settlement infrastructure provides low cost solutions to banks to reduce their operating expenses which banks may / may not pass on to consumers.

The current structure of NPCI has its own downsides and much more needs to be done to improve the governance fault lines. Following is an incomplete laundry list of fault lines.

1. NPCI is a friend of state entity, with government holding a minority stake, through its investment in various PSU banks, which themselves are held again jointly through direct and indirect investments. It has been reported that the selection of CEO of the entity had direct interference from PMO and RBI.
2. NPCI also performs a public function of delivering direct benefits through its infrastructure and by virtue of it and operating financial inclusion payment platform (AePS), it is a non government entity that has 2nd largest entries of UID linked to bank accounts. It is to be noted that while Airtel Payments bank faced fines from RBI over the subsidy rerouting scam, the role of NPCI was never closely examined in enabling the same and no regulatory penalties were posed on NPCI, even though NPCI changed the process to seed account number in its mapper indicating its faulty nature.
3. NPCI has argued and made itself outside the ambit of RTI. It is important to know that NPCI was previously under RTI and in a 2015 ruling by the CIC, it argued that since it is a Section 8 company, it is not liable to be under RTI. The judgement itself notes it as an argument, but NPCI removed all traces of it under RTI as the judgement does not differentiate operative part and argument part. It is important to note that CIC order recently declared even a private organisation Indian Bankers Association — IBA as a public authority and falls under RTI since it performs significant public function. There is a case being heard by Chief Information Commission on why NPCI need not be under RTI and NPCI is conspicuously absent to the hearing, further delaying the case.

From the above, one can see how NPCI is a quasi government agency when it comes to wielding power of state, and a private body without proportional accountability and transparency requirements as per its convenience.

2. Open Rail and Monopoly.

… open rail which can be used by everybody is very very important in most countries when you migrate from physical cash to digital cash you don’t get the migration right because physical cash has always been a sovereign function right you have central bank’s your means your people who print cash you know it’s all run by the sovereign sovereign but digital cash inevitably leads to a privatization of money and then if that architecture of that privatization happens does happen properly you end up creating new monopolies …

NPCI is also a monopoly settlement agency for retail payments in the country that is owned by banks, hence non-banks have no option to be a part of interoperable payment network and are automatically disadvantaged of reaping network effects. It is to be noted RBI needs to license these operators of settlement networks and there are no guidelines for getting the license. It is to be noted that wallets were kept out of UPI to give banks an edge and subsequently, Aadhaar lobby through its power in RBI essentially killed wallets with KYC requirements through PPI guidelines. The availability of settlement infrastructure is not an open rail and fintech’s are mandated to partner banks and this Bank Led Model was propagated into payments through NPCI. The downsides of having a settlement infrastructure monopoly has also been studied in detail by CUTS and has provided set of recommendations on fixing NPCI structurally in its research report studying competition assessment of payment infrastructure in India.

3. Big Data — Profits, Surveillance, Empowerment.

… historically when we think of big data we think of big data as useful to companies to make money or governments to do surveillance or whatever but India has an operation where data can be used by users to get get better services so users can use their own data using the infrastructure we have of authentication online identity verification and so on users can use their own data whether it’s to get better healthcare better education and in your case to get a loan and I think the big big thing.

It is amusing to see how big data leads to profits and surveillance elsewhere in world and only empowerment in India. The three are not mutually exclusive and if anything presence of big data in private entities with lower accountability levels but empowered with quasi state capacity. These entities are not for profit / profit minimizing core, enabling profit maximisation at the shell. Citizens are often compelled to part data with these institutions using the mask of regulations, state laws often enabled by institution captures. Amassment of data, directly / indirectly, without consensus is not just violation of privacy, but daylight robbery. Forced empowerment is enslavement.

4. Leeching open source in UPI, building proprietary stack.

NPCI is built completely of an open source stack and I think it’s one of the most advanced open source stacks so it does not it uses off the shelf open source like Linux, Postgres and so on so the cost of building this technology of course they may not like me telling this to you guys because you’ll say well lower the prices even further but the cost of building this technology is probably a tenth of what it would have cost us using commercial products and that is and the architecture of it is designed for scale so the combination of open-source scalable architecture means that the UPI infrastructure is capable of going to billions of transactions at a very low cost.

While it might be fancy to claim building cheapest solution using open source stack at scale, it must be noted that the products and solutions themselves are built in a closed manner. Following a closed development of the “public good” infrastructure not only prevents participation, collaboration, scrutiny by professionals, but also avoids any accountability on those who built them. The specifications of UPI v2, was not made available publicly for comments despite the fact it being claimed public good, run by a quasi state entity and having been a beneficiary in government funded promotion schemes which drove transactions on the platform.These governance infrastructures are not only built before any democratic discussions, laws are made, altered to suit the needs of technology and its bugs and inefficiencies. If these are indeed public good, the technology must be free and open.

There has been no significant contribution in giving back to these open source software too. Even the acknowledgement of using OSS professionally seem to lack as the BHIM doesn’t even embed credits and licenses of OSS used in the app, a normal practice in industry to do so.

5. Selling IndiaStack and ownership.

I can say we have at least 20 countries which have visited India to see what we are doing and seeing how they can replicate this in that country so clearly what we have is a global phenomenon which which has been done thanks to all the people in this room and it is being seen as something that India is done and Morocco is implementing it and Philippines so on. every day there is a new country coming who wants to do something about it so I think we really created something exceptional in this country

I will leave it upto you to verify these claims, if it’s (even if its) Morocco and Philippines or 20 countries or everyday a country expressing interest. Surely, all 3 can’t be true at the same time. While the pitch might be exaggerated, it is indeed true that IndiaStack is being talked as an asset to be used in diplomatic discussions using it as soft power. iSpirt calls it Innovation diplomacy and Prime Minister cited it in talks with Singapore. What is unclear is, who owns the IP of IndiaStack (Given India’s stand on no to software patents), who gets to sell / license IndiaStack (if at all anyone buys them) and who will bear liabilities should disasters strike and buyers claim damages. More than these, it is India’s reputation at stake and selling around the globe without fixing pressing issues and responding maturely to criticisms is in poor light.

6. UPI and Demonetisation

so for example before demonetization UPI was available only on smartphones not on feature phones but after after in that time of those 60 days the complete feature phone and ussd app was built for feature phones so that now people who have smartphones can use UPI on their app whether it’s you know or or any other app and people have feature phones can use the USSD so 600 million people with phones today whether there are smartphones or feature phones can now use UPI and this was a direct result of the Demonetization sort of window of policy opportunity similarly the Aadhaar pay which allows people who don’t have phones to use Aadhaar for drawing money or making a merchant payment also happen at that time so essentially what happened was a lot of the policy and regulatory bottlenecks to digital got swept away in those 60 days.

The above says the extent to which policy and regulatory bottlenecks were removed due to the crisis mode created by the demonetisation and how it was leveraged to further UPI and Aadhaar Pay. It must be noted that iSpirt that had built UPI, had lobbied for demonetisation as early as June 2015 draft which was presented to top policy officials of the government and had made fatal policy prescriptions in its conclusion “It is possible for us to dematerialize cash”. In this context, it can be seen how lobbying by Nandan and iSpirt can alter cirumstances that changes policy, regulatory landscape completely to their favour.

7. Data middlemen.

The account aggregator standards we will create an in structure it’s very important because if you are really going to get a billion people to use the data you need some intermediaries who will act on your behalf manage the data connections for you and make sure that your data is used properly and the account aggregator standard with the RBI actually allows that will happen

This seems to be a new shift in acknowledging the need for intermediaries and middlemen. Through the years, Nandan has been saying cutting of the middleman (synonymous with corruption) and delivering efficiency through technology. Suddenly now though digital intermediaries are necessary and these entities will manage individuals data is used properly without being corrupt by running unaccountable code that is neither open nor audited.

8. Lobbying for eMandates — Problems in it.

since I have the stage I’ll request the Central Reserve Bank to think about it we still have to look at recurring mandates so I think it’s not yet there but I’m sure it will happen one of these days I’m I’m lobbying for you guys and of course the EMI and all that so I think couple of things missus the way is nodding her head so clearly she has heard me so I think but I think what we have today is very significant I think the three or four things being launched today are very significant

The above statement tells the extent to which bank lobbies have fought hard to stop having e-Mandates being implemented in UPI and how much Nandan cares 3–4 “other things”. On one hand, it can be termed as anti-competitive move as banks have something to lose on their core business to fin-tech digital lenders if e-Mandates are enabled as the latter might then slowly push to make additional changes to use it for digital lending. But there are genuine concerns of liability sharing between banks and PSPs, risks in allowing digitally signed mandate from non-bank application given that use of Aadhaar is highly being restricted and Supreme Court judgement is awaited and cost of the support infrastructure needed in tackling identity/signature repudiation claims, frauds. Lobbying and pushing technology without consideration of any impact on people has been the norm for IndiaStack, but this time the impact on business cannot be simply brushed aside.