UPI for cross-border e-commerce: how foreign online stores get paid from India

A foreign online store that adds India to its shipping list and keeps its usual card form is asking most shoppers to pay in a way they rarely do. In India, the phone is the payment method. A shopper picks UPI, their app opens, they approve with a PIN, and the money moves between bank accounts in real time.

This article explains how UPI works at checkout, what changed with collect requests, what the Reserve Bank of India (RBI) requires of the cross-border aggregators that carry these payments, and what to ask a provider. Card tokenisation and e-mandates appear only as market context. For why local rails matter in general, see account-to-account and instant payments; for QR design, see QR payments for e-commerce.

Why does UPI matter for a foreign online store?

Because it is the default way to pay. The RBI’s Annual Report for 2025-26 says UPI contributed nearly 86% of total retail payment transactions in the year. Volumes are still rising: NPCI data reported by StartupTalky show 24.07 billion UPI transactions worth INR 29.37 lakh crore in September 2026, about 802 million a day. One lakh crore is one trillion rupees.

UPI is a real-time system built by the National Payments Corporation of India (NPCI). Stripe’s documentation describes it as moving funds instantly between two bank accounts, with customers using their preferred banking or wallet app to authenticate and approve. For a merchant, that means no card number at checkout and a customer who confirms the payment on their own phone. Our India guide covers the rest of the market.

How does a UPI payment work at checkout?

The flow depends on the device, and two patterns now cover nearly every case.

Flow	Where it fits	What the shopper does	Status
Intent	Mobile web and apps	The UPI app opens with the payment details filled in; the shopper approves	The main mobile flow
QR code	Desktop	The shopper scans a code with their UPI app and approves	The main desktop flow
Collect	Historically any device	The shopper types a UPI ID or mobile number, then approves a request in the app	Deprecated from 28 February 2026, with exemptions

Stripe’s documentation sets out the same split: on desktop, customers scan a QR code with their UPI app, and on mobile, they are redirected to it. Razorpay’s documentation describes intent as opening the UPI app automatically with details prefilled, so customers do not enter a UPI ID or phone number. It lists intent as supported on mobile web, Android and iOS.

Two design rules follow. Detect the device and show one clear path: a button on mobile and a code on desktop. And never treat the return to your page as a completed payment. The shopper may approve late, or not at all, so keep the order pending until the final status arrives. Our article on webhooks and idempotency explains why.

What happened to UPI collect?

Collect was the old pattern: the shopper typed a UPI ID, then approved a request that appeared in their app. Razorpay and PayU both say that, under NPCI guidelines, the flow is deprecated from 28 February 2026, so customers can no longer pay or register mandates by manually entering a UPI ID or mobile number.

The detail matters, because the change is not absolute. Both providers list exemptions:

• Merchant category codes 6012 and 6211, for IPO and secondary market payments
• iOS apps and mobile web
• UPI mandate execution, modification and revocation, but not new registration
• Businesses on cross-border aggregator licences, shown as PACB in both documents

So a foreign merchant on a cross-border route may technically still have access to collect. Do not build around it. Razorpay tells new users to integrate intent, and PayU tells new merchants to integrate both intent and QR. Exemptions can narrow, and a checkout built on intent and QR works whichever way they move.

If a provider’s demo still opens with a UPI ID field, ask why, and ask whether that flow is covered by an exemption for your account.

What do RBI rules require of cross-border payment aggregators?

The rulebook is the RBI’s Master Direction on the Regulation of Payment Aggregators, issued on 15 September 2025. It replaced the earlier circulars, including the October 2023 circular that first brought cross-border aggregators under direct RBI regulation. Authorisations and actions under the old circulars remain valid.

The direction calls these firms PA-Cross Border. It splits their work into inward transactions, which bring foreign exchange into India, and outward transactions, which send it out. A foreign store selling to Indian shoppers is on the outward side. The points that matter to a merchant are these:

• Who needs authorisation. Banks do not need it for this business. Non-bank firms do, and must be companies incorporated in India, with net worth of at least INR 15 crore at application, rising to INR 25 crore by the end of the third financial year after authorisation. The direction keeps a transition for firms that applied by 30 April 2024 and are still waiting for a decision.
• Which instruments. Outward transactions can use any payment instrument from authorised payment systems in India, except small prepaid instruments.
• How much. The maximum value is INR 25 lakh per transaction, inward or outward. That is 2.5 million rupees. The earlier circular set the cap per unit of goods or services, so check any older contract language.
• Who can be onboarded. An aggregator may onboard merchants located abroad directly, or contract with overseas marketplaces and payment aggregators. It must carry out due diligence on merchants and allot merchant category codes and IDs, including for merchants who come through an overseas partner.
• When due diligence applies. Merchants onboarded from 1 January 2026 must meet the requirements from the start. Those onboarded by 31 December 2025 had one year from the date of the direction, a window that closed in September 2026.

How does money get from an Indian shopper to a foreign merchant?

Through a ring-fenced account. Under the direction, outward funds reach an Outward Collection Account, either directly or through the aggregator’s escrow account, and payments to foreign merchants may be made only by debit from that account. Inward and outward funds must stay separate, with no netting. Foreign currency may be bought only through an authorised dealer, and payments must be identified as cross-border. Settlement timelines are set by the agreement between aggregator and merchant, which must state them clearly.

Two consequences follow. Your provider’s settlement speed depends on a chain you do not see, so ask for the timing of each step. And your payments must be for goods or services not prohibited under India’s foreign exchange law, FEMA, so expect questions about what you sell.

What limits, refunds and disputes apply?

Provider terms vary, so treat Stripe’s documentation as one example.

At Stripe	UPI
Customer location	India
Currency	INR
Amount	1 INR to 100,000 INR
Recurring limit	15,000 INR
Refund window	60 days
Refund timing	Up to 7 business days
Disputes	Yes; the merchant cannot contest an accepted request

Disputes deserve attention, because many instant methods have none. Stripe says the risk of fraud is low since the customer authenticates with their bank, but that customers can still dispute a UPI payment, for example after being debited for a failed transaction or not receiving goods. The RBI’s direction also says customers’ chargeback rights are unaffected, and that refunds run back through the escrow account unless the merchant manages the refund directly and the payer has been told.

Where do card tokenisation and e-mandates fit?

As context, not as part of a UPI build. Three RBI rules shape how Indian shoppers experience online payments, and a foreign store will hear about them.

Card storage. The RBI’s circular of 7 September 2021 limits storage of actual card data to card issuers and networks. Other parties may keep only the last four digits and the issuer’s name. Tokens require explicit customer consent and an additional authentication factor. The circular does not mention cross-border payments, and Federal Bank’s FAQ says tokenisation applies only to domestic transactions. Ask your provider how saved cards behave on your route.

Authentication. The RBI’s Authentication Mechanisms Directions, announced on 25 September 2025, apply from 1 April 2026. Card issuers must validate an additional factor on non-recurring cross-border card-not-present payments when the overseas merchant or acquirer asks for it. That gives a foreign store a way to ask for stronger authentication on Indian cards, such as 3-D Secure.

E-mandates. The RBI’s Digital Payments E-mandate Framework of 21 April 2026 replaced its earlier circulars and covers domestic and cross-border recurring payments on cards, prepaid instruments and UPI. Payments up to INR 15,000 can run without an additional factor, with INR 1 lakh for insurance premiums, mutual funds and credit card bills. Registration and the first payment need one, and the issuer must notify the customer at least 24 hours before each debit. Stripe’s UPI limit of 15,000 INR for recurring payments matches the general ceiling.

What should you ask a provider?

Use this list when you compare providers for India:

1. Who is the regulated entity? Name the bank or aggregator on the Indian leg, and whether it is authorised or waiting for a decision.
2. Can you onboard my entity? Ask for the document list, and whether you are onboarded directly or through an overseas partner.
3. Which flows are live? Ask for intent on Android and iOS, and QR on desktop, in production today.
4. What are the limits? Ask for the per-transaction limit for your category, and any daily caps.
5. How long does the shopper have? Ask for the payment timeout, and how late approvals are handled.
6. How do funds reach me? Ask for the settlement currency, the FX rate source, the spread and the days at each step.
7. How do refunds and disputes work? Ask for the refund window, the timing, and how disputes reach you.
8. What do you report? Ask for a bank reference on each payment, so finance can reconcile it.
9. What are the prohibited categories? Check your products against them before you sign.

If you sell into several markets, our guide on how many PSPs you need per market helps you decide whether India justifies its own route.

How does Omno support UPI for cross-border merchants?

Omno puts the providers you choose behind one integration, and each provider onboards you separately. Where a connected provider offers UPI, your team can show it in the no-code checkout builder for Indian shoppers in INR, set minimum and maximum amounts to match the provider’s limits, and write routing rules by country, currency or amount. If a provider is unavailable or rejects the request, the payment moves to the next provider in the rule until one accepts. The hosted checkout page shows how it works.