Digital public infrastructure

Also called: DPI, India Stack · Topic: Payment Systems and Digital Finance · NCERT: Beyond NCERT

Meaning

Digital public infrastructure (DPI) means shared digital systems for identity, payments and data sharing. They are built once as public goods (systems made by the state or a non-profit body that anyone can use). They are open and interoperable, so different apps and institutions can work with each other. Private firms then build competing products on top of them.

DPI matters because one public "rail" lowers the cost of entry for every firm. It stops any single company from owning the customer, and it speeds up financial inclusion. In India this set of layers is called India Stack.

Explanation

How it works: public road, private vehicles

• The basic model: a public "road" (the rail) and many private "vehicles" (the apps).
• The government or a public body builds the common rail.
• Private companies build competing apps on top of it.

• Competition keeps costs low, and no single firm owns the customer.

• Interoperable means different systems talk to each other. For example, a PhonePe user can pay a Paytm user, because both apps run on UPI.

• Open APIs make this possible. An API (Application Programming Interface) is a standard digital "plug" that lets two computer systems talk to each other.

The layers of India Stack

Layer	Components	What it does
Identity	Aadhaar, e-KYC, eSign	Proves who you are online. e-KYC (electronic "Know Your Customer") checks identity digitally, not on paper. eSign lets you sign documents online.
Payments	UPI, AePS	UPI gives instant bank-to-bank transfers through apps. AePS (Aadhaar-enabled Payment System) lets you withdraw cash or pay using Aadhaar and a fingerprint, often through a banking correspondent.
Data	DigiLocker, Account Aggregator, DEPA	DigiLocker stores official documents. Account Aggregator moves financial data with your consent. DEPA (Data Empowerment and Protection Architecture) is the consent-based design behind the data layer.
Extensions	ONDC (2022), OCEN, ULI (2024)	ONDC is an open network for e-commerce. OCEN is a common "language" for lenders and loan apps. ULI is RBI's lending platform.

The data layer: consent is the core idea

• Account Aggregator (AA): an RBI-regulated, consent-based go-between. It carries your financial data from one institution to another.
• FIP (Financial Information Provider) = the one that holds your data, such as a bank.
• FIU (Financial Information User) = the one that wants your data, such as a lender.

• Data-blind: the AA passes on encrypted data (data locked in a code). It cannot read or store it.

• Worked example: a loan through an AA

• A small shop owner applies to an NBFC (the FIU) for a loan.
• The NBFC asks for 12 months of bank statements through an AA.
• The shop owner approves consent on their phone. The consent names the purpose (loan check) and the time limit (for example, one-time access).

• The bank (the FIP) sends the encrypted statement through the AA. The NBFC decrypts it and judges the loan.

• Why it matters: cash-flow-based lending

• Old method: no credit score and no collateral (property pledged as security for a loan) → no loan.
• New method: the lender reads real cash flows (sales, GST data, bank inflows) → it can judge the ability to repay → it can lend without collateral.
• This helps thin-file borrowers, meaning people or MSMEs (micro, small and medium enterprises) with little credit history.

What makes DPI different from other models

Model	Example	Who owns the rails?
Public rails + competing private apps	India (UPI)	A public or non-profit body; many private apps compete
Central-bank-run fast payment	Brazil's Pix (2020), Singapore's PayNow	The central bank or a public system
Card-network-led	USA	Private card networks
Big-tech-wallet-led	China's Alipay, WeChat Pay	Private tech giants (closed systems)

• In the US and China, private firms own the rails. They can charge fees and keep customer data inside their own walls.
• India's model keeps the rail neutral.

In India

• Payments rail: UPI (2016) is the flagship of India Stack's payments layer.
• Account Aggregator:
• Its legal form is NBFC-AA, regulated by RBI under the Master Direction of 2016 [1].
• The network went live on 2 September 2021 [1].
• At the four-year mark (September 2025), 2.2 billion financial accounts could share data through AAs, and 112.34 million (≈11.2 crore) users had linked accounts [1].

• AAs are licensed by RBI, but FIPs can be regulated by RBI, SEBI, IRDAI or PFRDA. So bank, securities, insurance and pension data flow on one network.

• Unified Lending Interface (ULI):

• An RBI platform to make loans "frictionless" (quick, with little paperwork). Lenders join in a "plug and play" way through open APIs [4][5].
• It pulls Aadhaar e-KYC, state land records, PAN validation and Account Aggregator data into one place [4][5].
• It was piloted in August 2023 as the Public Tech Platform for Frictionless Credit (PTPFC), built by the Reserve Bank Innovation Hub. It was renamed ULI, and national roll-out was announced in August 2024 [6].

• As of 12 December 2025, 64 lenders (41 banks + 23 NBFCs) had joined [4][5]. It is being extended to RRBs and DCCBs to reach rural borrowers [4].

• Privacy law: the DPDP Act 2023 requires consent, purpose limitation (data is used only for the stated purpose) and duties for Data Fiduciaries. Consent Managers must register with the Data Protection Board [7][8]. The DPDP Rules were notified on 13 November 2025 [7].

• DPI diplomacy (G20 New Delhi, 2023):
• The Leaders' Declaration (9–10 September 2023) adopted a framework for systems of DPI [3].
• Three deliverables were endorsed unanimously at the Digital Economy Ministers' Meeting: a framework for building DPI, mobilising finance for DPI in Low- and Middle-Income Countries, and a Global DPI Repository [2].
• The Global DPI Repository, built by MeitY, holds 50+ DPIs from 16 countries (2023) [2].
• The Social Impact Fund: India pledged an initial USD 25 million (2023) to help Global South countries in the early stages of building DPI [2].

Don't confuse with

• Open banking (EU's PSD2, UK rules): banks share data directly with each third-party provider. In India's DPI variant, a separate regulated consent manager (the AA) sits in between, and the customer controls consent from one place.
• Big-tech wallets (Alipay, WeChat Pay): these are private, closed systems. DPI is a public, open rail where many apps compete.
• Central-bank-run systems (Brazil's Pix): here the central bank runs the system itself. In India's UPI model, the rail is public, but many private apps compete to serve customers.
• ONDC / OCEN vs payment systems: ONDC (2022) is for e-commerce and OCEN is for credit. Neither is a payment system.

Prelims Hooks

• DPI has three core layers: identity, payments and data sharing. AePS belongs to the payments layer, and eSign to the identity layer. "Match the layer" questions are a common trap.
• Account Aggregator = NBFC-AA regulated by RBI (Master Direction, 2016). It went live on 2 September 2021 [1]. Trap: the AA is data-blind, so it does not store or read data.
• ULI was developed by the Reserve Bank Innovation Hub. It was piloted in 2023 as PTPFC and renamed ULI in August 2024 [6]. It had 64 lenders by December 2025 [4][5].
• G20 New Delhi (2023): framework for DPI [3]; Global DPI Repository by MeitY (50+ DPIs, 16 countries) and Social Impact Fund (India's pledge: USD 25 million) [2].
• PSD2 is the EU's open-banking law, not India's. Brazil's Pix (2020) is run by its central bank.
• DPDP Rules were notified on 13 November 2025 [7]. Consent Managers register with the Data Protection Board [7][8].

Mains Points

• Public rails vs private rails (GS-III: inclusive growth, competition):
• India's model (public rail + competing apps) lowers entry barriers and stops platform monopolies.
• Compare it with the fee-heavy card model in the US and the walled gardens of China's big-tech wallets.

• Data as collateral: AA, GST data and ULI allow cash-flow-based lending to thin-file MSMEs and farmers. This can narrow the MSME credit gap. The risks are over-lending by digital lenders and algorithmic bias in credit scoring.

• Consent vs convenience (GS-II: rights and governance):

• The AA's data-blind design and the DPDP Act's Consent Managers put users in control of their data.
• Link this to the right to privacy, recognised as a fundamental right in Puttaswamy (2017).

• Real consent needs digital literacy, notices in local languages, and a Data Protection Board that can act firmly.

• DPI as soft power (GS-II/III: international relations):

• The G20 framework, the Global DPI Repository and the USD 25 million Social Impact Fund make India a DPI provider for the Global South [2].
• The challenges are fitting DPI to other countries' laws, and questions of data sovereignty.

Related concepts

• Account Aggregator
• Open banking

Read more

• Digital public infrastructure and the data layer