EXCLUSIVE: A Mobile Payments Monopoly With a Beep?

A public procurement exercise initiated in September 2017 by the National Payments Corporation of India (NPCI) asked bidders to present ‘proximity payment solutions’ for the United Payments Interface (UPI), an inter-bank mobile payments platform it set up a year earlier. Sixteen months have passed since then. Yet the name of the bidder chosen remains either undecided or has been decided but not yet been disclosed. What has consequently surfaced are several questions relating to the terms and conditions of the bidding process and several unusual developments surrounding it.

The NCPI was promoted as a not-for-profit corporate entity in December 2008 by the country’s central bank and apex monetary authority, the Reserve Bank of India, with ten “core” public and private promoter banks. This quasi-governmental body was set up under the Payment and Settlement Systems Act and commenced business in August 2009.

The request for proposal (RFP) released by NPCI on September 22, 2017 asked interested firms to submit proximity-based payment solutions that met a set of technical criteria. Among the conditions stipulated in the RFP—leaving several potential bidders perplexed—was that the technology would have to be ‘patented’ and supplied to NPCI on a ‘free usage basis.’

Instead of usage charges being paid by NPCI, the bidders were encouraged to negotiate commercial agreements with banks and mobile wallets which would then be forced to adopt the patented technology selected by NPCI to ply on its UPI platform. While P2P (peer-to-peer) transactions could not be monetised, prospective bidders were free to generate revenue from P2M (peer-to-merchant) transactions.

In effect, the RFP sought to impose a private party de facto as well as de jure monopoly over a public technical standard under the NPCI’s benevolent gaze. Was the ‘not-for-profit’ NPCI abetting the accrual of disproportionate benefits to a clutch of private interests?

In April 2018, it was reported that among the bidders shortlisted for pilot testing was a company called ToneTag. The Bangalore-based tech start-up had offered NPCI a sound-based proximity payment technology that would allow users to send or receive money through the United Payments Interface or UPI using an encrypted beep.

While ToneTag was only four years old at the time, its parent company Naffa Innovations Private Limited was already being backed by some of the biggest names in information technology in the country: NASSCOM Foundation trustee Arun Seth is listed among its directors while former Infosys finance chief T V Mohandas Pai, Facebook executive Anand Chandrasekaran, Gencoval Strategic Services chairperson Deepak Ghaisas and former Wipro vice-chairperson T K Kurien had invested in the company in 2016.

The first major cash influx announced by Naffa Innovations had been from Reliance Venture Asset Management Private Limited (Reliance VAMPL), the corporate venture capital arm of Reliance Capital Limited in the Reliance Anil Dhirubhai Ambani Group which had put in $ 1 million (or ₹6.4 crore) in the mobile payments technology in August 2015.

A month after ToneTag reportedly entered into talks with NPCI, its market worth shot up by between $ 8 and 10 million (or between ₹51 crore and ₹64 crore) after a new round of funding took place by international bigwigs led by Amazon, Mastercard and Tropical Star Limited. By then, the company had also entered into private alliances with several leading banks and mobile wallets including HDFC Bank Limited, ICICI Bank Limited, FreeCharge and Airtel Payments Bank to share its technology.

The three big questions are:

• Would the terms of the RFP issued by NPCI create a virtual condition for a monopoly, and then hand it over to ToneTag?

• Did this step happen because somebody in NPCI was aware of the ToneTag patent portfolio and sought to leverage it on ToneTag’s behalf?

• Were they privileging the interests of the tech company’s investors and partners over the public good and possibly also contravening the laws of the land?

Rules of the game

To answer these questions, it is useful to outline what a proximity-based payment solution is meant to do. As per the NPCI’s RFP, a typical scenario for its application would involve a payer and payee selecting the proximity payment option on their respective UPI apps (such as NPCI’s own Bharat Interface for Money, or BHIM) and the payee entering the amount to be transferred. When the payer’s device would be brought close to or in contact with the payee’s, the amount and the payee’s virtual payment address (VPA) would be transferred to the payer—hence the term ‘proximity payment.’ The transaction would be authorised once the payer keyed in her UPI passcode.

A proximity payment solution is therefore an addition to the existing methods for initiating transactions using the UPI: by typing in the payee’s VPA or scanning her unique QR (quick response) code. While the solution provider will not be privy to the transaction’s authentication process (which is limited to the respective banks of the payer and payee), it appears that transactions details would be accessible to the proximity payment solution provider. As per the RFP, the solution sought would generate usage statistics and ‘capture relevant data’ in its database.

As it is clear from the description above, such a method would add a greater measure of ease to transferring money online. This includes transactions made using cell phones as well as between cell phones and point of sale (PoS) devices such as readers of credit cards or debit cards.

NPCI indicated that the proximity-based solution could employ a tone, a sound, a near field communication (NFC), a radio-frequency identification device (RFID) or deploy ultra-high frequency (UHF) technology or a combination of these. Separate bids would be entertained for each of these categories.

A new clause that was added to the RFP by NPCI on October 17, 2017 following a round of consultation with prospective applicants, stipulated that the solution provided by the bidder ought to have been patented.

This clause raises questions about whether NPCI’s RFP violates the Patents Act, 1970. Section 3(k) of the Act, as amended in 2002, lists ‘a mathematical or business method or a computer programme per se or algorithms’ under ‘inventions not patentable.’

The reason for inserting this provision, is that most people believe that software is not patentable as it is not an invention but either a mathematical method or an algorithm, both of which are not patentable. The major advocate of software patents were larger foreign players who hold a stockpile of patents abroad and were seeking their control of the Indian software market using these patents. Interestingly, software patents are increasingly being discarded or highly restricted in other jurisdictions including the EU and the US.

Given that any proximity payment solution would rely only on algorithmic encryption to transfer payment details between devices—in ToneTag’s instance, on an algorithm to encode beeps of certain frequencies—patenting it would appear to go against existing Indian patent legislation on not accepting software patents.

The RFP also states that the payment solution offered ought to be developed on ‘open source’ platforms using ‘non-proprietary’ protocols. Open source software allows everyone to read, copy, modify and distribute the programme’s source code (that is, the machine-readable script which runs it), giving users a degree of transparency and control over how their data is used and encouraging a community-based approach to customising or modifying the programme.

This is in line with a directive of the Union Ministry of Electronics and Information Technology (MeitY) to public institutions under the Government of India, issued in March 2015, restricting the use of ‘closed source’ software to those circumstances where it was unavoidable—for ‘urgent (or) strategic reasons’ and ‘with sufficient justification.’

Therefore NPCI’s RFP, in asking for a patented solution, violates the clause regarding adoption of open source standards as well as the directive of MeiTY.

In response to queries raised by prospective bidders, NPCI clarified: ‘For a P2P (peer-to- peer) scenario the successful bidder would not charge the NPCI. The bidder's revenue model would be through (that is, based on) the rate negotiated by the successful bidder with the member banks on the merchant transactions.’ However, the definition of open source software under the MeitY framework includes the key phrase that its ‘source code shall be free from any royalty.’

Paradoxically, NPCI’s RFP seeks open source standards-compliant payment solutions while encouraging bidders to enter into commercial agreements with interested banks and mobile wallets on the UPI platform, if chosen. This is against the government’s own policy on open source standards as it amounts to allowing the chosen bidder to levy a royalty – or a tax of sorts – on the use of its software. The commercial burden of this arrangement is set to be passed on to the end-user, the citizen, through her or his banking institution—in effect meaning that a private firm is being granted the power of taxation by virtue of its monopolistic power.

To put it very differently, this would be akin to a national public institution, first, promoting a bottling factory, then, asking all cola makers to shift to its facility and, finally, declaring that they would now also be free to pay royalty to an entity which already owns the patent for the design of the straws that can fit its bottles. In this absurd analogy, the cold drink is citizen’s digital payment information, the bottle is the UPI platform and the bottler is the NPCI.

The significant differences are that few other equivalents of the bottling facility are available in the digital payments sector, its potential for growth far surpasses that of cola, has more complex ramifications over other sectors and seems unlikely to be burped away anytime soon.

The RFP issued by NPCI also contained other irregularities. For instance, clause 5.26 (‘Bid Evaluation Process’) declared that ‘NPCI will continue with the processes for bid evaluation and selection of successful bidder even if only one bid is received or only one bid qualifies after technical evaluation.’

It is noteworthy that NPCI considered it fit to adopt a public technological standard with potentially significant commercial and technical ramifications even in the absence of competitive bids. In effect, it had favoured a ‘single bid’ procurement process instead of opting to revise the terms of the RFP under such circumstances.

Another provision under Clause 4.2 (‘Eligibility Criteria’) mandated having a ‘full-fledged office (or) branch’ in Mumbai as a pre-condition for submitting bids. While the RFP may have included a condition regarding bidders opening branches in the city where the NPCI is headquartered for smoother operations, making it an a priori condition to even enter the tender process was indeed unusual for a national institution, if not the first such instance ever.

It may also be argued that a single technological standard should not have been promoted by an organization backed by the RBI and several major public banks in the first place as this could stifle innovation in India’s mobile payments sector. Even if one were to ignore this criticism on ideological grounds, the NPCI had also overlooked other commercial alternatives available within the procurement process it went with.

As a quasi-governmental body, it could have carried out the research and development of such a standard at its own behest and released it in interest of the common good. This would be in line with the principles of ‘free software’ championed by advocates of technological sovereignty. Alternatively, it could have procured a proximity payment solution from the private sector and released it under a free software license.

Instead, allowing private negotiations between merchants using the UPI (such as banks and mobile wallets) and the chosen bidder, implies that the commercial viability of NPCI’s RFP would also be affected by its existing private agreements. Certain banks and mobile wallets already in alliance with the prospective proximity payment solution provider would be positioned to derive a competitive advantage over those which are not.

In order to remain viable—especially after recent developments such as the central bank giving the go-ahead to interoperability between mobile wallets and banks through UPI and with major card networks (including NPCI’s own RuPay) in October 2017—a rush to broker private deals with the bidder chosen is likely, once the results of the procurement process are known and its proximity payment solution has been standardised.

For the bidder chosen, this would amount to, what economists describe as, a ‘natural’ monopoly. Only in this case, it would have been manufactured by NPCI, a public entity. Is ToneTag, one of the private firms shortlisted by NPCI, set to inherit such a monopoly? Circumstances indicate that its backers may have had this very end in mind.

Hitting the right notes

Three particular amendments to the original RFP, issued via NPCI’s August 2017 corrigendum, stand out. While ToneTag was possibly not the only prospective bidder to have benefitted from these amendments, they do seem to have improved its chances.

The amended RFP did away with a clause requiring the company to have a minimum annual turnover of ₹50 million during each of the three preceding financial years (that is, 2014-17). As per documents filed with the Registrar of Companies, ToneTag’s parent company Naffa Innovation would have been ineligible to apply without this amendment given that its reported net turnover was lower than the amount stipulated in two financial years. Its reported net turnover was ₹7,29,512 (0.73 million) in 2014-15 and ₹3,98,70,535 (39.87 million) in 2015-16 though it rose to ₹7,18,98,452 (71.9 million) in 2016-17.

Another clause done away with entailed that the entity in question be a profit-making body after taxes in at least one of the preceding three years. While we could not verify whether Naffa Innovations made a profit or loss in financial year 2016-17, it reported losses of ₹25,95,445 in 2014-15 and ₹2,21,27,605 in 2015-16.

As mentioned previously, the clause in NPCI’s RFP mandating that the submitted payment solution be patented was also added at this time, thereby disqualifying bids involving solutions whose patent requests were under consideration. As per its website, ToneTag has filed seven global patents at present.

Among ToneTag’s investors is Arvind Gupta. Besides being the current CEO of the MyGovIndia public portal, under the Government of India’s MeitY, Gupta headed the BJP’s information technology cell in the run-up to the 2014 general election which brought the party to power at the centre. BJP’s online advertising campaign had been in the news for combining the deployment of innovative digital marketing techniques with ‘fake news’, that is, news articles with incendiary headlines which willingly disseminate misinformation or hate speech. Gupta also claims to have worked with several leading information technology companies in Silicon Valley before joining the government.

While Gupta’s financial stakes in Naffa Innovations are not known, his proximity to several nodes of power in the emerging digital economic landscape in India will certainly be of significant interest to ToneTag. Whether Gupta, a senior government official and a member of the ruling party, having invested in a favourite for NPCI’s RFP raises red flags over potential conflicts-of-interest that may arise remains to be seen.

While ToneTag was reportedly Reliance VAMPL’s first portfolio addition in four years, it had previously also invested in other finance technology firms such as Gradatim IT Ventures Private Limited, a digital solutions company for banking and insurance, and Suvidha Infoserve Private Limited, a consumer services firm.

After the split in the Ambani dynasty in 2006, younger brother Anil had inherited the newer financial services and telecommunications divisions while elder brother Mukesh was fenced out of these sectors by a non-compete clause. Mukesh Ambani entered telecommunications as late as 2010 with what would go on to become Reliance Jio Infocomm Limited (hereafter, Reliance Jio).

At the time, it was assumed that the heirs to Dhirubhai Ambani’s empire would remain fierce business rivals but an announcement in April 2013 to share ₹1,200 crore worth of fibre optic infrastructure with Reliance Jio came as a thaw in the relationship between the siblings.

After his elder brother’s horse entered the race and with his telecommunication venture’s fortunes dwindling, Anil Ambani bowed out of the sector in September 2018—calling Reliance Jio’s entry an act of ‘creative destruction’ that, he believed, could create a monopoly.

Earlier that year, in August, Reliance Industries Limited had announced its foray into the banking sector, in a 70:30 partnership with the largest public sector bank in the country, the State Bank of India (SBI). Interestingly, its then-chairperson Arundhati Bhattacharya joined the board of the Mukesh Ambani-headed conglomerate not very long after her retirement from SBI.

In what would later be launched as Jio Payments Bank, the richest man in India and Asia, the older of the Ambani siblings was also placing his bets on the mobile payments sector—calling data, ‘the new oil,’ and seeking to impose restrictions to foreign investment in the sector. As an aside, his group owns the world’s largest petroleum refinery.

The connection between Naffa Innovations and Reliance VAMPL is not the only one that might raise eyebrows. On 22 September 2017—the day NPCI’s RFP on proximity payment solutions was released—ToneTag announced its new partnership with EdgeVerve Systems Limited, a wholly-owned subsidiary of the country’s biggest information technology services provider Infosys Limited.

The software giant runs the Finacle platform for mobile payments. The partnership between ToneTag and Finacle will integrate the two entities in offering mobile payment solutions to a reported 800 million users across 94 countries.

Infosys Limited co-founder Nandan Nilekani is listed as advisor for innovations and public policy to the NPCI. Besides being among the key persons who conceptualised the UPI and a vocal proponent for its adoption, Nilekani was also appointed to head the RBI’s Committee on Deepening of Digital Payments on 8 January 2019. The committee is set to present its recommendations by April.

In a potentially significant conflict-of-interest situation, the high-level committee’s mandate includes identifying best practices ‘to accelerate digitisation of the economy and financial inclusion through greater use of digital payments.’

While Nilekani may no longer be involved with the day-to-day running of Infosys Limited as its non-executive chairperson, the recommendations of the committee he is heading will likely affect his commercial interests as a shareholder in the company, owning stake worth over ₹5,500 crore along with his wife Rohini.

Nilekani has been associated with several contentious public policy recommendations on citizens’ data sovereignty in the past. He conceived of the data collection and security framework for Aadhaar as the then-chairperson of the Unique Identification Authority of India (UIDAI) and recommended the creation of national information utilities (NIUs) as chairperson of the Technology Advisory Group on Unique Projects (TAGUP) since June 2010.

NIUs recommended by this advisory panel—modelled on the NPCI—such as the Goods and Service Tax Network have been riled with reports of conflicts-of-interest, arguably arising out of the way in which they are structured.

What has drawn lesser attention has been Nilekani’s association with the Indian Software Products Industry Round Table (iSPIRT), a think tank associated with Aadhaar whose members have gone on to head several for-profit ventures using public data collected by the UIDAI.

Nilekani’s iSPIRT colleague Sanjay Jain is also on RBI’s committee for digital payments. After stepping down as UIDAI’s chief product manager in 2012, Jain has gone on to found Khosla Labs, a technology ‘incubator’ registered in Mauritius which invests in several start-ups providing Aadhaar-based authentication services.

After the resignation of the previous RBI governor Urjit Patel in December 2018, it had been speculated that among the reasons behind Patel’s decision to turn in his papers was the Union government’s push for an autonomous Payments Regulatory Board for digital transactions, thereby weakening the powers of the central bank. The new committee set up this January comes less than a month after Patel’s successor Shaktikanta Das took over.

Moreover, the appointment of Dilip Asbe as the CEO of NPCI a year earlier, in January 2018 had also been seen by many as a ‘political’ choice pushed by the RBI. A report by The Wire has claimed that Asbe’s appointment had been confirmed after overruling the choice of the NPCI’s board. Among the theories being whispered at the time was that it had been Nilekani who had pushed for Asbe. A source said to be aware of the proceedings had claimed to Caravan that it is Nilekani who ‘shadow-runs’ the NPCI.

ToneTag’s links with Reliance VAMPL, EdgeVerve Systems Limited and a senior member of the BJP have left several questions unanswered about the potentially disproportionate benefits NPCI may endow upon these entities if its proximity payment standard is selected.

This is by no means an exhaustive list of potential gainers. The net worth of Naffa Innovations, ToneTag’s parent company, had gone up by ₹2,79,76,330 between financial years 2015-16 and 2016-17 with the addition of twelve private investors in the year, as per filings with the Registrar of Companies.

Though it remains to be seen what the NPCI’s extended bidding process yields, what seems likely is that the precedent this would set for public procurement in the digital age may prove dangerous, regardless of the proximity payment solution chosen. Writing about the changes taking place in the sector at breakneck speed, one can only wonder: have we arrived at a new frontier of India’s gilded age of crony capitalism?

* * *

ToneTag declined to comment on the status of its bid submitted to NPCI, the nature of its partnerships with banks and mobile wallets and the digital monopoly it may soon gain, or to share details of Naffa Innovation’s shareholding structure, stating that our questions were ‘business number specific’ and that ToneTag would not be able to ‘disclose the numbers or comment about (its) partnership status with NPCI.’

On January 25, detailed questionnaires on the terms of the NPCI’s RFP seeking proximity payment solutions were sent to Shaktikanta Das, Governor of the RBI, Sudarshan Sen, RBI’s director nominated to NPCI, Dilip Asbe, CEO of NPCI and Biswamohan Mahapatra, NPCI’s non-executive chairperson. Another set of questions was sent to Nandan Nilekani, non-executive director of Infosys Limited, the same day regarding the comments made by several sources quoted in this report. The questionnaires were also sent by India Post. At the time of publication, other than a response from a representative of ToneTag, none of the others had responded.

On Sunday, February 10, one of the writers received a phone call from a person representing a public relations firm who said he was calling on behalf of the NPCI management led by Asbe. He requested that time be granted till 3.00 pm on Monday February 11, for the NPCI and Asbe to send in a response. This article will be updated should a response come in.

The authors are independent journalists.