Merchant Underwriting must become a continuous risk function in India’s real-time payments economy

By Deepak Chand Thakur, CEO and Co-Founder and NPST

India’s digital payments ecosystem has entered a phase where scale and speed are now the defining operating realities. In FY 2025-26, UPI processed more than 24,000 crore transactions, with total value crossing ₹314 lakh crore, and continued to expand at a strong year-on-year pace. UPI also now accounts for the large majority of retail digital payment volume. At this level of throughput, merchant risk cannot be managed through onboarding-era assumptions.

Merchant acceptance has also broadened sharply across neighbourhood retail, platform sellers, digital-first service providers, and small businesses that now transact nationally from day one. Instant activation has become a market expectation. That is a welcome shift for inclusion and commerce, but it has also exposed a structural gap. Merchant acquisition is now real time, while underwriting in many institutions is still periodic. This mismatch is becoming a material business risk.

Why traditional models are under strain
Legacy underwriting frameworks were designed for a slower environment. Merchant categories were more stable, behavioural shifts were gradual, and periodic review cycles could reasonably keep pace. Document verification and manual checks were suitable controls for that context.

Today, those controls remain necessary but are no longer sufficient by themselves. A merchant’s declared profile may remain unchanged while transaction behaviour changes significantly within weeks. Category boundaries are less rigid in digital commerce, and platform-led distribution can amplify volumes faster than conventional risk cycles can absorb. Risk now moves through patterns, not just paperwork.

This is why static approaches are losing effectiveness. One-time KYC and KYB establish legal identity, but they do not measure behavioural drift post onboarding. Manual review brings judgement, but review capacity does not scale linearly with transaction complexity. Periodic assessments can identify known concerns, but often after exposure has already accumulated.

From verification to continuous assessment
Underwriting is evolving from a point-in-time control to a lifecycle discipline. The first layer remains robust entry screening: identity validation, de-duplication, adverse history checks, and category sanity checks. The second layer is ongoing behavioural assessment: monitoring velocity shifts, payer concentration, dispute signals, refund patterns, and profile inconsistencies. The third layer is trigger-led intervention: calibrated action when risk indicators cross material thresholds.

The strategic objective is not to reject more merchants. It is to differentiate better between healthy scale-up and emerging risk. That distinction matters commercially. Broad friction hurts legitimate merchants and weakens conversion. Delayed intervention increases fraud losses, dispute costs, and control overhead. Continuous underwriting supports precision, and precision is now central to sustainable acquiring performance.

Industry experience increasingly shows that risk does not always arrive as a single extreme event. It often appears first as small but persistent deviations: unusual value clustering, category-behaviour mismatch, linked-entity exposure, or rising operational disputes. Institutions that can detect these weak signals early gain optionality. They can intervene proportionately before losses harden into portfolio stress.

AI is an enabler, not a substitute for judgement
AI has a clear role in this transition because merchant risk is multi-dimensional and fast changing. It helps detect non-obvious patterns, identify anomalies against dynamic baselines, and prioritise high-value alerts for human teams. It can improve speed and consistency in environments where static rule updates lag evolving threat behaviour.

But AI should be positioned as decision support within governed frameworks, not as autonomous risk authority. In regulated financial institutions, accountability remains human. Decisions must be explainable, reviewable, and auditable. The quality of outcomes depends on operating design: model governance, escalation protocols, human-in-the-loop controls, and a defensible record of why decisions were made.

This governance layer is now as important as detection capability itself. Supervisory scrutiny is moving toward continuous control readiness. Institutions will increasingly be judged not only on whether they flagged risk, but on whether they can evidence consistent decision logic and timely action across the merchant lifecycle.

What this means for banks and acquirers
For acquiring businesses, underwriting maturity now directly shapes economics. It influences portfolio quality, loss containment, operating efficiency, merchant experience, and compliance resilience. Where margins are tight, even modest increases in fraud leakage or dispute-handling burden can materially affect business outcomes.

Competitive positioning is also changing. Onboarding speed remains important, but speed without continuous risk intelligence is not a durable advantage. The stronger institutions will be those that combine fast market access with disciplined, adaptive underwriting that stays aligned to merchant behaviour in motion.

India has already demonstrated that digital payments can scale with depth and inclusivity. The next phase will be defined by risk architecture. Underwriting is moving from a front-end checkpoint to a continuous intelligence function embedded across the full merchant lifecycle. Institutions that align technology, governance, and behavioural insight will be best placed to deliver high-quality growth in the real-time payments economy.