There are two ways to build a state in the twenty-first century. You can write the rules and hope the plumbing follows, which is the European instinct and the older habit of civilised republics. Or you can ship the plumbing and let the rules chase, which is the Indian instinct, learned late and in a hurry, under the weight of a subcontinent that would not wait. In 2026 the difference has stopped being a matter of taste. It has become measurable in numbers so large that they read, at first, like typos.
The volumes that reorder the argument
UPI processed 23.66 billion transactions in July, up 22% year on year, at an average of 763 million a day and a daily notional value of about ₹96,383 crore. That is not a payments system in any recognisable European sense. Visa clears roughly 750 million transactions a day worldwide. UPI now handles that alone, on Indian rails, for a subcontinent, and its marginal cost to the user is zero. The system was built as a public utility on top of banks, not by a bank; it is operated by the National Payments Corporation of India, which is a not-for-profit; and the merchant fee for a person-to-merchant transfer under ₹2,000 is nil by law.
Aadhaar, the identity layer beneath it, has enrolled 1.4 billion people and now performs roughly 2.5 billion authentication calls a month, about 80 million a day. The number matters less than the fact that any Indian citizen can prove who they are to any relying party in the country in under two seconds, biometrically or by one-time password, for effectively no cost. This is what makes UPI possible: a payment protocol is only useful when both sides can be identified, and identification is only cheap when the state runs it.
ONDC, a protocol layer above payment for open commerce, crossed 500 million cumulative orders in July, having recorded almost none only three years ago. Its monthly run rate is now around 10 million transactions, distributed across roughly 200,000 merchants, more than one million drivers, and by June this year, 370,000 public transport trips per day across nine metros and four bus operators. It is small compared with UPI. It is also the first serious attempt anywhere to make commerce itself a network, rather than a walled garden operated by two American platforms.
And UPI now runs abroad. It is live in Singapore, the United Arab Emirates, Bhutan, Nepal, Sri Lanka, France, Mauritius, Qatar, and Cambodia. In August the Maldives joined, on a Favara-UPI corridor that will move remittances instantly between two countries whose bilateral banking relationship, until this year, was measured in weeks. Cross-border UPI use rose more than twenty-fold in a single fiscal year, from about 37,000 transactions to over 755,000. A payments rail designed for a poor country has quietly become an export product.
The state as protocol
The word to hold onto is protocol. What India has built is not an app, nor a website, nor a suite of services owned by a ministry. It is a stack of open specifications — identity, payment, consented data sharing, document exchange, commerce — each with a governance authority, an API, a certification regime, and a mandate that private actors may build on top of it without permission. This is the reason a taxi driver in Coimbatore, a mango exporter in Ratnagiri, and a state-run hospital in Bhubaneswar can all use the same rails without knowing they exist.
The layers are boringly named and civilisationally consequential. Aadhaar is identity. UPI is payment. The Account Aggregator framework is consented financial data sharing. DigiLocker is document exchange. ONDC is commerce. CoWIN was pandemic scheduling and became a template for scheduled public services. Bhashini is language. Beckn, the underlying grammar behind ONDC, is now being extended to mobility, energy, and skilling. Each one exists because a preceding one made it cheap. Identity made payments possible. Payments made commerce possible. Commerce is now making logistics and public transport programmable. This is how infrastructure compounds when you actually lay it.
What is unfamiliar to European readers is that most of this was built by small teams of engineers seconded from private firms into a public foundation, advised by a group of people around Nandan Nilekani who were unusually good at shipping. It was not built by a ministry. It was not procured through a five-year enterprise contract with an American consultancy. It was written, deployed, revised, and scaled while critics wrote papers about whether it should exist. The critics were often right about the risks. They were also always three years behind the traffic.
Europe drafts what India has shipped
The European Digital Identity Wallet, mandated by Regulation 2024/1183, was supposed to be available to every European citizen by the end of 2026. As of the middle of the year, the implementing acts are not fully issued, the technical standards are still evolving, the certification framework is unfinished, and several member states have not begun serious national work because they lack the enabling legislation. Analysts polled this summer said the deadline will slip in most of Europe, and even the states that meet it will do so with partial functionality, small pilot populations, and no useful set of relying parties. Brussels calls this a “cold start”. In infrastructure terms, it is the polite word for “there is nothing yet”.
PSD3 and the SEPA Instant regulation will improve retail payments at the margin, but Europe still runs its rails through a bank cartel that has spent a decade preferring stablecoin panic over building a public alternative. The Digital Euro remains a working paper. There is no European equivalent of UPI in production. There is no European equivalent of Aadhaar in production. There is no European equivalent of ONDC even on the drawing board. What there is, in abundance, is regulation of the American and Chinese layers that have quietly taken the space Europe did not build.
This is not a story about incompetent bureaucrats. Europe’s civil services contain some of the most careful minds in the world. It is a story about a civilisational habit: the belief that if a rulebook is elegant enough, the plumbing will build itself. It does not. Rails require welders. Protocols require ship-dates. GDPR is a beautiful piece of legislation atop an infrastructure Europe does not own. The EUDI Wallet threatens to be its second act.
Twenty-four countries
The tell, for anyone who wants to understand where the industrial polity of the small state is headed, is the export list. India has now signed formal cooperation agreements with 24 countries to adopt parts of the India Stack — UPI, DigiLocker, Aadhaar-style identity, ONDC-compatible commerce. Bhutan and Nepal took UPI first, out of proximity and pragmatism. Sri Lanka and Mauritius joined for tourism receipts. France signed for a diaspora and a diplomatic gesture that turned into a use case. The more consequential signatures are in the Global South: the Philippines, Namibia, Zambia, Peru, Trinidad and Tobago, Papua New Guinea, and a lengthening list in Africa and Latin America whose governments have looked at their options and concluded that a public protocol from Bengaluru is cheaper, less coercive, and better documented than a proprietary offer from San Francisco or a Chinese state-integrated alternative.
India launched the Global DPI Repository and “India Stack Global” during its G20 presidency and made this its most serious diplomatic export since non-alignment. It is beginning to work. The countries adopting the stack are not doing so out of admiration for the Modi government, whose politics they mostly find alien. They are doing so because ordinary state functions — paying a pension, issuing a driving licence, verifying a small merchant — can now be done at cost using code someone else has written, tested, and battle-hardened at a billion-user scale. This is what soft power looks like when it is denominated in engineering.
The politics inside the plumbing
None of the above is a fairy tale. Aadhaar has been used to deny food rations to poor households when the biometric fails, and the failures have killed people. UPI, precisely because it is universal and traceable, has been used to freeze the accounts of dissidents and to squeeze small merchants during moments of political friction. The Indian state has demonstrated a willingness to switch off Kashmir’s internet, and any protocol operated at 763 million transactions a day is a lever any government would eventually reach for. The architecture in principle allows plural governance. The politics of who runs it is a different question, and in India that question has already been answered in the more centralising direction.
This should be said clearly, because a serious argument about Digital Public Infrastructure has to hold two things together. The plumbing is a real achievement. The politics is a real risk. Both facts are load-bearing. A European conversation that only records the risk, and refuses to acknowledge the plumbing, is not a critique; it is an alibi. The honest critique of Aadhaar is a critique of a working system. Europe’s critique of its own DPI is, in 2026, still mostly a critique of a document.
There is also a mirror to be looked into. European identity systems are not politically clean either; they simply externalise their coercion into commercial platforms — Google, Apple, and a handful of banks — that quietly decide who exists online and who does not. The European citizen is already surveilled and de-platformable. The difference is that this power sits with American firms bound by no European vote, rather than with an Indian ministry bound by an Indian election. Neither settlement is comfortable. Only one is honest about what it is.
What Europe would need to admit
A serious response would begin with three admissions. First, that the regulatory instinct is not itself the problem; it is the refusal to build under the regulation. Second, that the state that ships beats the state that drafts, and that shipping requires engineers on the public payroll with the authority to make decisions and the mandate to accept small failures on the way to working systems. Third, that Europe has more to learn from Bengaluru, Tallinn, and Singapore than from any American consultancy currently invoicing it for “digital transformation strategy”.
None of that is politically easy. Building infrastructure that will outlast an electoral cycle is exactly the thing democratic finance ministries hate. Accepting foreign engineering pedigree at civilisational scale offends the European self-image, which likes to imagine itself as the teacher of others. Admitting that the two most interesting state-capacity experiments in the century so far are Indian and Estonian, and that neither borrowed much from Brussels, requires a modesty the union has not shown for a generation.
But the alternative is what is already happening. When a European citizen sends money instantly abroad on a network they do not own, when a European small business is discovered and rated by algorithms whose training data belongs to a foreign platform, when a European government proves the identity of its citizens by asking Apple whether the phone in their pocket is really theirs, the sovereignty that Europe likes to protect at the border has already been given away at the socket. The border matters less every year. The socket matters more.
Steel and code
Two Tuesdays ago the argument on this page was about the sea, and about what happens to a maritime order when one country builds nearly all the hulls. Today’s argument is a version of the same argument, one layer up. A hull is an unglamorous unit of power on the water. A protocol is an unglamorous unit of power on the wire. Whoever ships them at scale sets the terms of the medium. In both cases Europe finds itself, at the middle of the decade, in the position it has been trained since 1945 to imagine only Africa or Latin America could occupy: buying finished goods from other people’s workshops because it has forgotten how to run its own.
A state that cannot ship an identity to its own citizens has already delegated the future of its administration. The interesting question is only which foreign protocol it will end up running. India, for reasons of poverty, urgency, and a stubborn generation of engineers, has decided not to be that state. Europe, so far, has decided nothing at all — and pretending, with excellent grammar, that this is the same as choosing wisdom.
Sources
Business Standard, UPI clocks record monthly volume as July transactions rise 4.1% to 23.66 bn, August 2026.
business-standard.com / UPI July 2026
StartupTalky, UPI Hits Highest-Ever Monthly Volume: 23.66 Billion Transactions in July 2026.
startuptalky.com / UPI July 2026
Press Information Bureau, Government of India, UPI completes 10 glorious years, Emerges as World’s Largest Real-Time Payments Platform, 2026.
pib.gov.in / ten years of UPI
Center for Strategic and International Studies, Ten Years of UPI: Implications of India’s Digital Public Infrastructure for Data Protection.
csis.org / ten years of UPI
Observer Research Foundation, India’s DPI 2.0: From UPI to Universal Data Empowerment.
orfonline.org / DPI 2.0
WORLDEF, ONDC Crosses 500 Million Transactions as India Expands Open Digital Commerce Network, August 2026.
worldef.com / ONDC 500 million
Adda247 Current Affairs, India’s Digital Public Infrastructure Goes Global: 24 Countries Adopt India Stack, UPI and DigiLocker, 2026.
adda247.com / 24 countries
Organiser (India), UPI Goes Global: India, Maldives launch Favara-UPI payment corridor, August 2026.
organiser.org / Favara-UPI corridor
Biometric Update, Will the EUDI Wallet be ready in 2026? Experts say probably not.
biometricupdate.com / EUDI Wallet 2026
eID Easy, EU Digital Identity Wallet Rollout Status by Member State, July 2026.
eideasy.com / EUDI status July 2026
TechCrunch, India makes Aadhaar more ubiquitous, but critics say security and privacy concerns remain, February 2026.
techcrunch.com / Aadhaar 2026