Below is the executive summary reproduced from the report.
Digital public infrastructure (DPI) is scaling faster than the means to correct it when it fails. The Universal DPI Safeguards Framework calls for effective remedy and redress but does not define “effective” or say how to get there. No one can currently say how many DPIs offer meaningful recourse.
The stakes are rising. More than 39 countries have signed up to launch at least one DPI component by 2028. Fraud and scams create new harms, and grievances cross institutional lines: a stolen identity credential surfaces as a failed payment, and outdated registry data results in a denied benefit. Redress across DPI systems – when weak or absent – erodes the trust on which adoption depends.
What we found. We studied one payment, one digital identity and one data-exchange or other DPI-like system each in Brazil, India, Benin, Ethiopia and South Africa: 15 systems, using document review, mystery shopping and operator interviews between May and July 2026. Grievance redressal mechanisms (GRMs) were complex, opaque and fragmented. In many systems, users usually deal with participating banks or providers, not the scheme operator, and because of this, in some of them, operators can lose sight of how first-tier providers perform. Only two of the 15 systems regularly publish some form of GRM volumes. Those two, Pix and UPI, count different things, so their numbers cannot be compared.
Two ways to measure. Liveness is a minimum test built on public information and mystery shopping. Four of the 15 GRMs were fully live, eight were underway and three were not live. It proved feasible across all five countries. Wellness is a scorecard of how well a GRM performs. It needs operator data, so it depends on cooperation or a mandate. Researchers judged it could be completed in about 20 working days where data exist. It was not scored across the sample and needs piloting.
From measurement to interoperability. Existing international standards on grievances and disputes agree on principles but not on data. Countries need not adopt one institutional model. A common grievance taxonomy and data object would let cases be counted consistently and passed between providers, schemes and DPIs without the complainant starting over.
Because such an object makes the complainant traceable as well as the case, limits on what is collected, who is authenticated and how long data are kept, must be built in from the start.
What should happen next
- International stakeholders, such as those behind the DPI Safeguards Framework and the DPI Map, test and agree on a minimum liveness benchmark. Operators launch every new DPI with a live GRM.
- Willing operators, with funders and overseers, pilot wellness and calibrate it for system size and maturity.
- Oversight agencies, operators, open-source communities and vendors start a technical workstream on grievance semantics.
This work is exploratory: five countries, 15 systems, and measures that need further testing. However, the direction is clear. Infrastructure that cannot correct its own failures or that does not design for GRM from the start, will not build the public’s trust.