Govt stalls Alipay+ tie-up over data security concerns

The Indian government's decision to stall Alipay+'s proposal for integration with India's payment ecosystem marks a significant moment in India's evolving approach to digital sovereignty and national security in the financial technology sector. Alipay+, operated by Ant Group — an affiliate of Chinese e-commerce giant Alibaba — sought to enable cross-border payments for Chinese tourists and businesses in India by linking with the Unified Payments Interface (UPI) and other domestic payment rails. However, the Ministry of Finance, in coordination with the Ministry of Home Affairs and the Reserve Bank of India (RBI), rejected the proposal citing national security risks and concerns over the storage and processing of Indian citizens' financial data on servers potentially accessible to the Chinese state under China's National Intelligence Law (2017) and Cybersecurity Law (2017). This development must be understood in the broader context of India-China relations since the Galwan Valley clashes in June 2020, which resulted in the deaths of 20 Indian soldiers and an undisclosed number of Chinese personnel. In response, India launched a multi-pronged strategy to reduce strategic dependence on Chinese technology and capital. The most direct policy instrument was Press Note 3 (2020), issued by the Department for Promotion of Industry and Internal Trade (DPIIT), which mandated prior government approval for foreign direct investment (FDI) from countries sharing a land border with India — effectively targeting China. This move was grounded in the government's sovereign authority under Article 246 read with Entry 33 of the Union List (trade and commerce with foreign countries) and Entry 41 (incorporation, regulation, and winding up of trading corporations), as well as the Foreign Exchange Management Act (FEMA), 1999, and the RBI's master directions on payment systems. The stakes are high: India's digital payment infrastructure, led by UPI — developed by the National Payments Corporation of India (NPCI) — processed over 131 billion transactions worth ₹200 lakh crore in FY 2023-24, making it the world's largest real-time payment system by volume. Allowing a China-linked entity access to this ecosystem could expose metadata, transaction patterns, and user behavior to foreign surveillance, posing risks under Article 21 (Right to Privacy, as affirmed in Justice K.S. Puttaswamy v. Union of India, 2017) and the Digital Personal Data Protection Act (DPDP Act), 2023, which mandates data localization and restricts cross-border data transfers to notified jurisdictions. Key stakeholders include the RBI (regulator of payment systems under the Payment and Settlement Systems Act, 2007), NPCI (operator of UPI), the Ministry of Electronics and Information Technology (MeitY) — which oversees cybersecurity and data governance — and the National Security Council Secretariat (NSCS), which coordinates strategic risk assessments. The decision also reflects coordination with the Ministry of External Affairs, given the diplomatic sensitivity ahead of President Xi Jinping's anticipated visit, possibly for the SCO Summit or a bilateral engagement, aimed at stabilizing ties after four years of frozen high-level contact. Economically, the move signals India's commitment to "trusted technology partners" — a principle echoed in the Quad's Critical and Emerging Technology Working Group and the India-US Initiative on Critical and Emerging Technology (iCET). It reinforces the "Atmanirbhar Bharat" vision in fintech, encouraging domestic innovation (e.g., RuPay, BHIM, UPI Lite) and partnerships with like-minded democracies (e.g., Singapore's PayNow linkage, UAE's AANI). Politically, it demonstrates strategic consistency: despite diplomatic thaw — including the 21st round of Corps Commander-level talks (2024) and disengagement at Patrolling Points 15 and 17A — India refuses to compartmentalize security from economic engagement. This aligns with the "security first, engagement later" doctrine articulated by External Affairs Minister S. Jaishankar. Future implications include continued scrutiny of Chinese fintech apps (e.g., WeChat Pay, other Ant Group services), potential expansion of the "trusted source" list for telecom and digital infrastructure under the National Security Directive on Telecommunication Sector (2021), and deeper integration of India's digital public infrastructure (DPI) stack — UPI, DigiLocker, Aadhaar, ONDC — with Global South partners. For aspirants, this case exemplifies the intersection of technology, sovereignty, and geopolitics — a defining theme of 21st-century governance.