(Updates: added clarifications from PhonePe co-founder Sameer Nigam, and Citrus Pay co-founder Jitendra Gupta)

Paytm CEO Vijay Shekhar Sharma (VSS) made some fairly strong accusations yesterday in an interview with CNBC-TV18. Moving beyond the “Facebook is the most evil company in the world” rhetoric, there are substantial policy issues raised here, especially about governance at NPCI, which is a bank-owned non-profit company, which owns and operates critical payments infrastructure like UPI and IMPS, and also owns and operates the BHIM application, in competition with other UPI apps.

VSS says that “Whatsapp is killing India’s “beautiful, open UPI system”, and that it has gotten preferential access to UPI. He says that “it does not allow transactions to non-Whatsapp UPI handles, UPI handles created via other apps, does not include passwords and logins, and QR code scanning. Everyone else has 3 factors of authentication: login, password and then UPI pin. Whatsapp doesn’t have login and password.”

“The rulebook which is written out there gets interpreted and modified for other players in a different way than us. I’ll give you an example: Yesterday I had a conversation with a gentleman at NPCI, and I asked how they could let the login and password go away. He said that there was a circular about it, and the circular says that if banks can undertake (underwrite) the liability, you can take away the 2-factor authentication, before the third-factor authentication”…”NPCI issued the circular, which is on the website.”

“We were launching UPI before Diwali. We were asked to delay the launch of UPI because Google could launch. NPCI asked Paytm to [delay] launch so that Google can launch. Post-Diwali traffic and compliance requirements made Paytm delay the launch by 3 months.”

“Tell me another UPI app which has no login and password. Closed door negotiations and agreements [with NPCI] are allowed here.”

Also read: UPI is a toll road

MediaNama’s take

1. Poor governance at NPCI

1.1 UPI was never open platform. In an open platform, which is fair and transparent, all players get access to all features at the same time. Let’s take three instances of this allegedly not happening: firstly, wallets were (and still are) kept out of the UPI ecosystem, in order to give banks a head start. AP Hota, the former CEO of NPCI, had told MediaNama in an interview in May 2016 that

“Bank applications do not have such a great user experience. So the banks asked give us time to catch up and leave the wallets out of it [UPI]. It is just a competitive position.”

The NPCI is wilfully preventing other RBI authorised (non-banking) payment instruments from connecting with UPI: users of 44 authorised PrePaid Payment Instruments (PPIs), including mobile wallets, prepaid cards, etc., 8 authorised Payments Banks, 8 Cross-Border Money Transfer operators, and 8 White-label ATM Operators, cannot connect to NPCI run infrastructure.

Secondly, when Google Tez launched, it had access to multiple banks for payments processing. Sure, there was a circular issued to this effect just before the launch of Tez, but it’s pretty clear that such integration takes time, and unlikely that Tez didn’t have head-start here, by choice. In addition to this, VSS’s allegation that Paytm’s UPI launch was delayed by the NPCI because they wanted Google Tez to launch first, is fairly damning.

In the same vein, there was something amiss about how PhonePe allegedly was able to launch as the first UPI payments app, ahead of Citrus Pay. From The Ken:

Meanwhile, PhonePe, a startup that had launched just a few months ago, was already doing deep work on building a UPI product in partnership with Yes Bank.

Gupta* could only watch in silence as Flipkart, India’s largest e-commerce company, acquired PhonePe on 1st April for its UPI app. An app that hadn’t even launched yet. Just a few days later, on 11 April, NPCI announced a “soft launch” of UPI.

But Citrus Pay hadn’t progressed much beyond its initial conversations.

On 25 August, UPI went live. On 29 August, PhonePe went live, becoming the first UPI payments app in the country.

*

Update 1

Both PhonePe and Citrus Pay have contested this. In a message to MediaNama, Sameer Nigam, co-founder of PhonePe says that “We started studying UPI guidelines in Feb 2016 when the NPCI hackathon happened in Bangalore. We partnered with Yes Bank and started developing in parallel when the UPI sandboxes were opened up in May-June timeframe. We launched post proper app certification, SDK testing and YES Banks settlement approvals. There is no question of having started before anyone else, nor about any favoritism.”

Jitendra Gupta, co-founder of Citrus Pay, says that “we were delayed in the UPI launch because of Yes Bank. They were not quite responsive during our testing phase. That delayed our launch. We never spoke anything against NPCI. Rather I praised NPCI initiative.”

VSS’s contention that Indian companies are being mistreated isn’t correct or true, given NPCI’s history here, and while this may appear to be a recent occurrence, the broader trend is that there appears to be a lack of open-ness at NPCI, and ad-hoc’ism, where the platform is geared up towards favouring new launches or some companies, for reasons only the NPCI knows.

We wonder who the rules will be changed for next.

Note that NPCI is not subject to Right to Information requests. When we contacted Dilip Asbe, CEO at NPCI, for comments, he declined to comment on the record, and we couldn’t find the circular in question (about doing away with usernames and passwords). And we have written to NPCI for a statement, though.

1.2. Lest it be forgotten, the Watal Committee has highlighted issues of “ownership neutrality” at the NPCI, recommending the expansion of the NPCI’s board, saying “Ensure that the board of the NPCI should have majority ‘public interest directors’ – independent directors, representing the interests of consumers in payments markets and who do not have any association, directly or indirectly, which in the opinion of the regulator, is in conflict with their role.” This is because the NPCI is bank owned and bank run:

VSS says in the interview that “We’ve gone to NPCI and asked for our potential shareholding. We’re a bank, so potential contribution, part of those committees: nothing. We may be the largest UPI Bank in the country, but we don’t have a say in it.” The response: “Not yet.”

2. Whatsapp fails when it comes to interoperability:

A few things that Whatsapp is not doing right:

2.1: Sending to non-Whatsapp UPI IDs: Apart from not having a username and password for usage, Whatsapp, by design, makes it difficult to send money to a non-Whatsapp UPI ID, and much easier to send money to another Whatsapp user. If a particular mobile number is on UPI, instead of facilitating discovery of their UPI ID and being able to send money to them, Whatsapp demands that those users necessarily be on Whatsapp for you to be able to send money to them. For example, Siladitya is on UPI, but not on Whatsapp UPI, and the prompt I got said that he needs to be on Whatsapp payments to be able to receive money. This shouldn’t be the case because the way UPI is supposed to work, is that any UPI ID can send money to any other UPI ID without restriction.

2.2: Disclosure of UPI ID: Whatsapp does not openly disclose UPI IDs to users. For example, your Whatsapp UPI ID could be [mobile number].wa.dta@icici, but it will only be visible in the SMS notifications the recipient gets from the bank, and not from within the Whatsapp app.

Updates: I stand corrected. A user has to go their payments tab on the Whatsapp page for their ID. However, the fact that the user cant pick their own UPI ID, or that it’s not even easy to guess (the format above) is problematic.

Secondly, Whatsapp has enabled the option for sending to other UPI IDs, instead of a whatsapp name. However, to be able to do that, you have to go to Settings –> Payments –> Tap on your own account –> tap on the three dots on the top right –> click on pay using UPI ID and then manually enter the third party UPI ID. Most UPI Apps allow you to add users on other apps/UPI IDs into your payment list, and make it much much easier to do this. This is obfuscation by design from Whatsapp, and does not follow the spirit of openness.

We tried something else. Based on a trial payment I got from Aroon Deep via Whatsapp, I sent money to his Whatsapp ID using another UPI app, which allows me to do this. Aroon got the money, but it came from “unknown” on Whatsapp, but didn’t even get an SMS. There’s something seriously wrong here with how Whatsapp has implemented UPI.

Clearly, Whatsapp here is negatively impacting the openness of the UPI ecosystem, and its interoperability, and this needs to be fixed. Whatsapp payments should be shut down until it conforms to norms that are applicable to all, and in the interest of transparency, there should be a public and open consultation process here. Interoperability needs to be mandated, like interconnection agreements in telecom, and it needs to be equally easy for people to send money to all UPI IDs, not just app specific UPI IDs. It’s not that this can’t be done. it’s just that Whatsapp isn’t doing it.

2.3 Login and password: Most UPI apps use the mobile number as a login, and Google TEZ and PhonePe both have additional passwords for logging in, over and above the UPI pin required for payments. Friction is a necessary inconvenience for security in payments, and you can’t do away with it, especially in a country where mobile phones get changed and stolen easily, numbers get changed. Whatsapp might want to make payments easier, but this can’t come at the cost of compromising users.

3. The reaction: Paytm didn’t speak up when Wallets weren’t allowed on UPI, but that was probably because it was on its way to becoming a Payments Bank; UPI then gave it a competitive advantage over other apps. When Google Tez launched with multiple banks, it was an upstart, and even though Paytm was allegedly forced to delay its UPI launch, VSS didn’t speak up then. So why now? Whatsapp has the single largest userbase of any app in India in terms of monthly active users. Whatsapp also brings to the table, a higher daily active user base, in all probability, than any other app. This is the biggest competition that Paytm has faced so far in the payments space.

While it is right for VSS to speak up about the governance issues and the lack of process and interoperability, it would have perhaps seemed a lot less self-serving if he had spoken up for interoperability earlier as well.

4. Facebook’s decision to sign up for UPI: Given the vagaries of how NPCI appears to operate, and the fact that it lacks the transparency and accountability to be seen as a credible regulator of an important payments infrastructure, Facebook’s decision to launch UPI is risky because it creates a dependency for Whatsapp.

Note: We’ve reached out to NPCI for a comment and will update when they respond.

*Refers to Jitendra Gupta the founder of Citrus Pay