How should our subscription billing engine validate category-wise UPI limits for insurance premiums after the September 15, 2025 change?

Canonical merchant metadata

• Maintain a merchant_profile that includes: MCC / NPCI category, verified flag (yes/no), sponsor bank/PSP IDs, and the official daily & per-txn caps for that category.
• Keep this data synced daily from your PSP or acquirer (don’t hardcode assumptions).

Keep real-time daily usage counters

• Track upi_volume_today per merchant (and optionally per merchant+PSP handle) in a fast store (Redis). Increment only after final success confirmation (webhook or settlement ack).
• Persist an authoritative copy in your DB for audits.

Pre-debit validation flow (run BEFORE initiating UPI collect) When a subscription payment is due:

• Lookup merchant category & cap: cap_txn, cap_day = (verified ? high_cap : normal_cap).
• Read used_today = upi_volume_today and remaining = cap_day - used_today.
• If amount <= min(cap_txn, remaining) → proceed with UPI collect.
• If amount > min(cap_txn, remaining) → do not fire the UPI collect. Instead route to fallback (card, netbanking) or auto-split logic (if supported).

Support for splits / deferred attempts

• If you allow auto-split: compute compliant legs (each ≤ per-txn cap and within remaining daily allowance), create a payment_plan record with leg IDs, and execute legs sequentially (prefer sequential to avoid race conditions).
• If you allow scheduling: queue remaining amount for next valid window and notify customer (don’t auto-debit without consent if policy requires).

Real-time sync with PSPs & webhooks

• Rely on PSP webhooks for PAYMENT_SUCCESS, PAYMENT_FAILED, REFUND, REVERSAL. Only increment the upi_volume_today on a confirmed success webhook (or settlement confirmation).
• If webhooks are lost, reconcile via periodic pull or settlement file to avoid drifting counters.

Race conditions & concurrency protection

• Use optimistic locking or atomic Redis ops (INCRBY with check) when reserving remaining capacity just before initiating collect: reserve → call PSP → on success commit, on failure release.
• Idempotency keys per subscription+attempt so retries won’t double-count.

Fallback UX & orchestration

• If pre-check fails, surface a clear, friendly message: UPI limit reached for today — choose card, netbanking, or schedule. Offer one-tap fallback with invoice/policy prefilled.
• For partial-success (split legs), show progressive updates: ₹X of ₹Y paid via UPI; remaining ₹Z — pay now with card or we’ll retry tomorrow.

Mandate / autopay rules

• For UPI AutoPay mandates, verify that mandate is valid and that the bank supports multi-leg/large value AutoPay (some banks differ). If a mandate would breach daily cap, don’t attempt — schedule or prompt for alternate method.

Reconciliation & accounting hooks

• Persist PSP txn refs and map every successful leg to the subscription invoice. Reconcile by UPI ref/UTR.
• Distinguish Received (Pending settlement) GL vs Settled GL; only finalize revenue when settlement/confirmation arrives (or per your revenue rules).

Notifications & audit trail

• Send pre-debit notification where required. Log pre-check result, decision, API payloads, PSP response codes, and who/what fallback was chosen. Keep this for compliance and dispute resolution.

Monitoring & alerts

• Alert when failed due to limit events spike. Add dashboards: daily cap usage per merchant, split success rate, number of fallbacks, and reconciliation mismatches.

Edge cases & tests

• Test concurrent debits that together exceed remaining allowance.
• Test midnight boundary (cap reset) and cross-day splits.
• Simulate webhook loss and settlement lag to ensure counters reconcile.
• Test refunds: refunded amount should decrement upi_volume_today if PSP semantics require (verify with PSP whether refunds free up cap).

Policy & UX decisions to finalize

• Decide if you will auto-split or force fallback when over cap. (Auto-split is smoother but more complex.)
• Decide whether to block subscription processing or schedule retries when cap is hit.