What is changing
NPCI has mandated the following changes for UPI P2M transactions:- UPI Collect flow phase-out: UPI Collect for P2M transactions must be discontinued.
- Migration to secure flows: Merchants must prioritise UPI Intent (mobile) and UPI QR (desktop) as primary payment methods.
- Device-specific enforcement: Different rules apply based on customer device type.
UPI Collect was previously sunset for P2P transactions. These changes now extend to merchant payments to address rising fraud instances.
Understanding UPI payment flows
Cashfree supports the following UPI payment flows:UPI Collect flow
UPI Collect flow
- Customer enters their UPI ID (VPA).
- Collect request is sent to the customer’s UPI app.
- Customer authorises the payment using their UPI PIN.
UPI Intent and QR flow
UPI Intent and QR flow
- On mobile, the customer is redirected to their preferred UPI app by clicking the app icon on checkout.
- On desktop, the customer scans a dynamically generated QR code using their UPI app.
- Payment is completed securely within the UPI app without manually entering a VPA.
UPI Intent and QR flows are now the dominant payment methods in the ecosystem due to enhanced security and user experience.
Device-specific UPI rules
The following table shows NPCI’s recommended UPI flows by device type:| Device or platform | Allowed UPI flows | UPI Collect status |
|---|---|---|
| Android mobile | UPI Intent | To be phased out |
| Desktop (Web) | UPI QR | To be phased out |
| iOS mobile | UPI Intent + UPI Collect | Temporarily allowed |
iOS is currently exempted by NPCI and will continue to support UPI Collect until further notice.
Required actions by integration type
Non-seamless merchants (Cashfree Hosted Checkout)
Non-seamless merchants (Cashfree Hosted Checkout)
Applies to: Mobile web and native SDK integrations using standard Cashfree Hosted CheckoutAction required: No action neededImpact: Cashfree will automatically handle the phase-out. Alternate flows (Intent and QR) are already supported, so customers won’t experience disruptions. The Collect option will be removed from checkout once sunset is enforced.
Non-seamless merchants using WebView
Non-seamless merchants using WebView
Applies to: Android or iOS mobile WebView integrations using Cashfree CheckoutAction required: The following scenarios determine your required actions:
- Scenario A (Not using standard Checkout): No action required.
- Scenario B (Using standard Checkout in WebView): Implement specific code changes to ensure UPI Intent displays correctly. Refer to the Android Custom Checkout documentation for WebView integration details.
Seamless merchants (Custom checkout or API-based integration)
Seamless merchants (Custom checkout or API-based integration)
Applies to: Direct API integrations using custom checkout or Order Pay API
Header values:
Migrate from Collect to Intent or QR
Update your checkout logic to prioritise the following flows:- Mobile: Enable UPI Intent.
- Desktop: Use UPI QR.
- Deprecate: Remove UPI Collect as a payment option according to device rules above.
Pass client environment details
Cashfree requires visibility into the customer’s device to enforce NPCI rules. You must pass the following headers in your Order Pay API request:| Header | Example Value | Requirement |
|---|---|---|
x-client-device | mobile | Required |
x-client-os | ios | Required |
x-client-rendering-type | mweb | Required (when device=mobile) |
x-client-browser | safari | Required |
| Header | Accepted values | Description |
|---|---|---|
x-client-device | mobile, desktop, tablet | Type of device used by customer |
x-client-os | android, ios, windows, macos, linux, others | Operating system of customer’s device |
x-client-rendering-type | mweb, webview, native | How the checkout is being rendered |
x-client-browser | safari, chrome, firefox, edge, others | Browser used by customer |
Rendering type details:• mweb – Payment rendered in a mobile browser (browser on a mobile device)
• webview – Payment rendered inside an in-app browser (WebView within a merchant app)
• native – Payment rendered natively within the merchant’s mobile app using SDKs
• webview – Payment rendered inside an in-app browser (WebView within a merchant app)
• native – Payment rendered natively within the merchant’s mobile app using SDKs
If headers aren’t passed, Cashfree will assume full migration to Intent or QR flows. UPI Collect will only be allowed in permitted environments once NPCI confirms final sunset timelines.
Timeline and compliance
| Item | Details |
|---|---|
| Recommended timeline | Complete all changes by December 31, 2025 |
| Current status | Tentative (subject to NPCI confirmation) |
| iOS support | Continues until further notice |
Cashfree won’t immediately block UPI Collect on December 31, 2025. Cashfree will phase this out gradually. However, implement the recommended changes now to ensure a smooth transition.
Product-level exemptions
The following transaction categories are exempted from UPI Collect sunset:| Category | Details |
|---|---|
| IPO | IPO creation and execution flows |
| Capital or Commodity markets | Transactions related to capital markets and commodity platforms |
| OTM (Non-IPO) | Mandate execution-only flows |
| UPI Autopay | Mandate execution-only flows |
| PACB | PACB-related transaction flows |
Implementation checklist
Use this checklist to track your compliance progress:Have you identified your integration type (Non-seamless or Seamless)?
Your integration type (Non-seamless or Seamless) determines the actions you must take for UPI Collect deprecation compliance.
Review the Required actions by integration type section above to determine which category your implementation falls under.
Have you ensured that UPI Intent and QR flows are enabled and functional?
UPI Intent and QR flows are now the dominant and secure payment methods. Ensure both are fully enabled and tested before deprecating UPI Collect.
Refer to the Understanding UPI payment flows section for flow descriptions, or contact your Account manager for assistance in enabling these flows.
Have you deprecated UPI Collect in non-exempt environments (Android or Desktop)?
NPCI requires UPI Collect to be phased out on Android and Desktop devices. Ensure your checkout removes this option for non-exempt transaction types.
Review the Device-specific UPI rules table and Product-level exemptions section to confirm which flows to deprecate for your use case.
Have you updated the Order Pay API with client environment headers (seamless merchants only)?
Seamless merchants must pass client environment headers to allow Cashfree to enforce NPCI device-specific rules correctly.
Review the API documentation section above to see required and optional headers, or consult the Order Pay API documentation for implementation details.
Are you monitoring Cashfree updates for final NPCI enforcement dates?
NPCI enforcement timelines are subject to change. Stay updated to ensure your implementation remains compliant with the latest regulatory requirements.
Review the Timeline and compliance section above, or contact your Account manager for the latest enforcement date information.
Support
For questions or technical clarifications, contact Cashfree through the following channels:- Support: Cashfree support form.
- Account manager: Reach out to your designated Account manager.