Zero-MDR UPI Payment Gateways in India: The 2026 Merchant Guide

UPI is the default way many Indian customers pay, but the phrase “zero-MDR gateway” is often used imprecisely. A merchant can pay no Merchant Discount Rate and still pay for checkout software, payment verification, reconciliation, support, or another payment method. The useful question is not “Is it free?” It is:

What does the provider charge, what work does that charge cover, where does the customer’s money settle, and how does my application learn that an order is genuinely paid?

This guide separates the regulated payment rail from the software around it, gives you a reproducible cost calculation, and outlines a production-safe UPI checkout.

What zero MDR actually means

Merchant Discount Rate (MDR) is the charge traditionally deducted for processing a merchant payment. A Government of India explanation of the UPI incentive framework states that MDR on prescribed person-to-merchant UPI transactions was removed from January 2020. It also clarifies an important tax point: GST is levied on a payment-related charge such as MDR, not on the customer’s transferred UPI amount itself.

That does not make every service surrounding UPI costless. A provider can supply:

• checkout and order APIs;
• dynamic QR and UPI intent generation;
• merchant-account connectivity;
• periodic transaction-status checks;
• signed webhooks;
• dashboards and reconciliation exports;
• support, observability, and uptime engineering.

A flat SaaS subscription for those software capabilities is different from a percentage MDR deducted from every order. Always read the invoice and contract language rather than relying on a “0%” headline.

Bank-account UPI is not the same as every UPI-branded instrument

UPI can also carry transactions funded by eligible credit products or prepaid instruments. Commercial treatment can differ from a normal bank-account-funded UPI payment. Ask the provider for a method-level rate card covering:

1. bank-account UPI;
2. RuPay credit card on UPI;
3. credit line on UPI;
4. wallets or prepaid instruments;
5. domestic cards, international cards, EMI, and net banking.

If your checkout mixes these methods, calculate the weighted cost from your real transaction mix.

Comparing UPI cost models

As checked on 28 July 2026, Razorpay’s public ecommerce pricing describes a 2% platform fee for domestic transactions with 18% GST on that fee. That makes the illustrative all-in deduction:

effective rate = 2.00% + (18% × 2.00%)
               = 2.36%

For ₹5,00,000 of monthly processed value:

monthly platform fee = ₹5,00,000 × 2%      = ₹10,000
GST on platform fee  = ₹10,000 × 18%       = ₹1,800
illustrative total   = ₹11,800 per month
illustrative annual  = ₹1,41,600

A ₹300-per-month software plan costs ₹3,600 per year before any separately contracted services. Under the same simplified assumptions:

monthly break-even value = ₹300 ÷ 0.0236
                         ≈ ₹12,711.86

Use this only as a comparison model. Negotiated rates, refunds, international methods, instant-settlement fees, taxes, and provider-specific conditions can change the result.

Do not assign the same rate to every competitor

Paytm’s public pricing page says it does not charge for ordinary UPI transactions and that charges vary by payment source. It would therefore be misleading to describe Paytm UPI itself as “2% + GST.” Compare Paytm’s relevant method-level quote and required features with the same discipline.

Other published examples also differ:

Provider	Publicly stated baseline checked 28 Jul 2026	Important qualification
Razorpay	2% platform fee on domestic transactions; GST on the fee	Some instruments are priced higher; custom terms may apply
Paytm PG	UPI advertised at zero transaction charge	Other sources have method-specific charges
Cashfree	1.95% standard domestic platform fee, with time-bound offers	Offer eligibility, UPI mix, volume caps, and GST conditions apply
Instamojo	2% + ₹3 per transaction excluding GST for normal payments	Digital goods and special card categories are priced differently
Easebuzz	Average pricing around 1.5%	Exact pricing is merchant- and method-specific
VyaparGateway	₹300 per month flat software plan; 0% transaction fee	Confirm provider connection, feature scope, and current plan terms

Sources: Razorpay pricing, Paytm pricing, Cashfree pricing, Instamojo fee documentation, and Easebuzz pricing.

How direct-to-bank UPI works

A direct-to-bank workflow separates money movement from merchant orchestration:

Customer
   │ scans QR / opens UPI intent
   ▼
Customer's UPI app ───────────────► UPI / banking rails
                                           │
                                           ▼
                                  Merchant-linked account

Merchant website ─► Order API ─► payment reference
       ▲                              │
       └──── verified webhook/status ◄┘

The software does not need to hold the merchant’s sale proceeds to provide a good checkout experience. It can create an order reference, encode a dynamic QR, monitor the connected merchant provider, and deliver a signed event when the matching credit is observed.

Why the reference matters

An amount alone is a poor reconciliation key. Two customers can pay ₹499 within the same minute. Every checkout should have a unique server-generated order ID and, where supported by the connected provider, a transaction reference.

The NPCI UPI linking specification defines a URI shape such as:

upi://pay?pa=merchant%40bank&pn=Example%20Store&tr=ORD_20260728_001&tn=Order%20ORD_20260728_001&am=499.00&cu=INR

Key fields include:

• pa: payee address or VPA;
• pn: payee name;
• tr: merchant transaction reference;
• tn: transaction note;
• am: amount with a dot decimal;
• cu: currency, normally INR.

URL-encode every value. Never concatenate raw customer input into a payment URI.

Merchant evaluation checklist

Commercial questions

• Is the quoted rate MDR, a platform fee, or both?
• Is GST included or added to the provider’s fee?
• Which payment instruments are covered?
• Are refunds, instant settlement, payment links, or support extra?
• Is a promotional rate time-bound or volume-limited?
• Can the provider change pricing after onboarding?

Money-flow questions

• Does the payment settle directly to the merchant-linked account?
• Is settlement instant, same-day, T+1, or another cycle?
• Who is the regulated acquiring or payment-aggregation entity?
• What happens during provider downtime?
• How are reversals, refunds, and disputes handled?

Engineering and security questions

• Are order creation and secret-bearing calls server-side?
• Are webhooks signed with HMAC or an equivalent mechanism?
• Can events be retried, and are event IDs stable?
• Can your handler process duplicate and out-of-order events safely?
• Is there an authenticated status endpoint for reconciliation?
• Are test and live credentials isolated?
• Do logs redact API keys, signatures, VPAs where appropriate, and personal data?

Claims you should distrust

Be cautious when a provider promises guaranteed payment success, “instant KYC for everyone,” or universal zero charges without identifying the payment instrument and conditions. UPI apps, issuing banks, acquiring partners, risk systems, and network availability all participate in the outcome.

Implementation blueprint

The browser should never decide that an order is paid. A safe flow looks like this:

1. Browser asks your server to create order ORD_123.
2. Server stores amount, currency, customer/cart context, and status=PENDING.
3. Server calls the payment API with an idempotency key.
4. Browser receives a public payment URL or QR payload.
5. Customer authorises payment inside a UPI app.
6. Provider sends a signed event to your server.
7. Server verifies the raw-body signature before parsing or mutating state.
8. Server matches merchant, order, amount, and expected status transition.
9. One database transaction marks ORD_123 PAID and records the event ID.
10. Fulfilment runs once; duplicate events return HTTP 200 without repeating work.

Example verification pseudocode:

import { createHmac, timingSafeEqual } from "node:crypto";

function verifyWebhook(rawBody: Buffer, receivedHex: string, secret: string) {
  const expected = createHmac("sha256", secret).update(rawBody).digest();
  const received = Buffer.from(receivedHex, "hex");

  return (
    received.length === expected.length &&
    timingSafeEqual(received, expected)
  );
}

Keep the exact raw request bytes. Re-serialising parsed JSON can change whitespace or key order and break signature verification.

Reconciliation is still required

Webhooks are a delivery mechanism, not a ledger. Run a scheduled reconciliation job that finds old PENDING orders, queries the authenticated status endpoint, and resolves discrepancies. Alert on:

• paid events with an amount mismatch;
• unknown order references;
• repeated signature failures;
• payment success without fulfilment;
• unusually old pending orders;
• duplicate credits against the same order.

Bottom line

Zero MDR is a property of the relevant UPI payment rail, while gateway software is an operational product. The strongest merchant setup combines transparent flat pricing, direct-to-bank settlement, unique order references, signed webhooks, idempotent fulfilment, and routine reconciliation.

Before choosing a provider, calculate the effective annual cost from your real payment mix and obtain the current commercial terms in writing. Then evaluate the failure paths—not just the happy-path checkout demo.