NPCI and Quantum Risk: Why the Operator of UPI Hasn't Published Anything Yet
NPCI runs the payment rails behind UPI, RuPay, and IMPS, arguably the most consequential quantum-risk surface in Indian finance, but has published no independent PQC or CBOM guidance of its own. Here's what that absence means, and doesn't mean.
This tracker's standard is to report a checked absence explicitly rather than leave a regulator out of the page entirely, because an unlisted regulator is indistinguishable from one nobody bothered to check. NPCI, the National Payments Corporation of India, is exactly that case: a real check, against an entity whose infrastructure arguably matters more to India's quantum-risk exposure than any of the regulators that have actually published something.
Why NPCI's silence is worth an article, not just a line item
NPCI operates UPI, RuPay, and IMPS, the payment rails carrying the overwhelming majority of India's day-to-day retail financial transactions. If "harvest now, decrypt later" is a real threat model anywhere in Indian finance, encrypted payment traffic recorded today and decrypted once a capable quantum computer exists is as good a candidate as any. That makes NPCI's lack of an independent quantum-risk publication a genuinely notable gap, not a trivial one.
What NPCI's only connection to this topic actually is
As of this research, NPCI's sole documented connection to post-quantum cryptography is board-level: its MD & CEO, Dilip Asbe, sits on the Reserve Bank of India's Q-SAFE committee, convened in May 2026 to evaluate the financial sector's cryptographic inventory. That's real and worth noting, but it's participation in someone else's committee, not an independent NPCI document, standard, or public statement about quantum risk to its own infrastructure.
Separately, NPCI signed a memorandum of understanding with IDRBT (the RBI-owned research institute) in June 2025 for cybersecurity training, certification, and threat-intelligence sharing via IDRBT's "Sachet" platform. This is general cyber-resilience cooperation; quantum computing and post-quantum cryptography aren't mentioned in the reporting on that MoU.
The adjacent work that IS happening, just not at NPCI
IDRBT itself runs a dedicated Quantum-Safe Cryptography Lab, building implementations of NIST-standardized post-quantum algorithms and a "Q-Safe" encrypted cloud storage prototype aimed at banking use cases. This is real, primary-source-confirmed research activity, directly relevant to the infrastructure NPCI operates, but it's IDRBT's work, not NPCI's, and a research lab prototype is a different thing from an operational migration plan for live payment rails processing billions of transactions.
What would change this
If NPCI publishes its own cryptographic inventory approach, a migration timeline for its payment switch infrastructure, or a technical standard for how member banks should handle post-quantum key exchange in UPI/RuPay transactions, this page will be updated and a scored entry would likely follow. Until then, the honest record is: checked, and the only entity actually building quantum-safe capability for Indian payment infrastructure today is IDRBT's research lab, not NPCI's own operational security program.
How this fits with India's other regulators
See the India country page for the full picture: CERT-In's Technical Guidelines, SEBI's already-binding CSCRF clause, and RBI's pending Q-SAFE roadmap, the entity whose eventual recommendations NPCI will likely be asked to implement.
Sources: NPCI/IDRBT MoU coverage; IDRBT Quantum Safe Cryptography Lab.