I think most data selling happens via branch employees / telecom operators instead of "at the top"

Banks / UPI vendors have to comply with very strict data regulations and the confirmation of a "data leak" is enough to attract heavy penalties from the NPCI and RBI. Most banks and UPI service providers will never risk it, specially post the DEPA guidelines which have recently been adopted.