A UPI payment completes in two to three seconds, but the visible moments — scan, name check, PIN entry, green tick, receiver buzz — mask a chain of five distinct organisations. The app (PhonePe, Google Pay, Paytm) acts only as a Third-Party Application Provider: it gathers intent, displays the verified payee name, and captures the PIN inside a certified secure element it cannot read. It holds no licence and touches no money. Instead, each app routes through a sponsor bank (PSP) that issues the @handle — @ybl for Yes Bank, @okaxis for Axis — and connects to the central switch run by NPCI. In June 2026 that switch processed 2,272 crore transactions, more than any real-time system globally.

Every payment converges on NPCI's single switch. It resolves the payee's handle at their sponsor bank, then debits the payer's bank first. Only the payer's bank can decrypt the PIN, verify balance, and confirm the debit. Once confirmed, the switch credits the payee's bank. Results return via both sponsor banks to their respective apps. PhonePe and Google Pay together carry roughly four-fifths of volume, a duopoly stable for years, while the sponsor-bank layer shifts: most large apps now spread across multiple PSPs for resilience and to capture same-sponsor resolution savings of about one paisa per transaction.

The paying-side bank rankings mirror consumer scale — State Bank of India leads by a wide margin — but the receiving-side order diverges sharply, revealing different merchant-acquisition strengths. This asymmetry means the busiest debit banks are not the busiest credit banks, a structural detail that shapes liquidity planning and settlement risk across the network.