RBI E-mandate Framework 2026: UPI AutoPay and Recurring Payment Rules for Merchants
On 21 April 2026, RBI replaced eight separate circulars on recurring payments with a single document: the Digital Payments E-mandate Framework, 2026. It took effect immediately. For subscription businesses, insurers, lenders, mutual fund platforms and anyone running autopay, it is now the one reference for how recurring debits on cards, UPI and prepaid payment instruments must work.
Most of the rules are not new. The AFA-free limits and the 24-hour pre-debit notice are unchanged. But the consolidation adds two provisions, states plainly that acquirers must make their merchants comply, and is a good moment to check your consent, notification and cancellation flows against the text. This guide covers what the framework says, how UPI AutoPay works in practice and what merchants should check.
Quick answer: RBI’s Digital Payments E-mandate Framework, 2026, issued on 21 April 2026 and effective immediately, consolidates eight earlier circulars into one set of directions for recurring payments on cards, UPI and PPIs, domestic or cross-border. Registration and the first debit need an additional factor of authentication (AFA). Later debits up to Rs 15,000 run without AFA, or up to Rs 1 lakh for insurance premiums, mutual fund subscriptions and credit card bills. Customers get a notice at least 24 hours before each debit, can opt out or cancel with AFA, and cannot be charged for using e-mandates.
What is the RBI E-mandate Framework, 2026?
The framework is a set of directions issued under Section 10(2) read with Section 18 of the Payment and Settlement Systems Act, 2007 (reference RBI/DPSS/2026-27/396). It applies to all payment system providers and participants for recurring transactions, domestic or cross-border, made using cards, PPIs or UPI.
RBI’s press release says the directions consolidate existing instructions with “a few minor changes” based on stakeholder feedback. Key terms such as authentication, issuer and merchant take their meaning from the 2025 authentication directions and the 2025 payment aggregator directions, so the three documents should be read together. Our explainer on theRBI authentication directionscovers why recurring payments are an exemption from per-transaction two-factor rules.
The directions do not mention NACH or e-NACH. Mandates set up through netbanking or debit card authentication on NACH run under NPCI’s NACH rules, not this framework.
Which circulars does it replace?
Paragraph 11 repeals eight instruments. If your terms, internal policies or gateway contracts cite any of them, update the reference.
| Date | Circular | What it covered |
|---|---|---|
| 21 August 2019 | Processing of e-mandate on cards for recurring transactions | Original card framework, with an AFA-free limit of Rs 2,000 |
| 10 January 2020 | Processing of e-mandate in UPI for recurring transactions | Extended the framework to UPI |
| 4 December 2020 | Processing of e-mandates for recurring transactions | Raised the AFA-free limit to Rs 5,000 |
| 31 March 2021 | Framework for processing of e-mandates for recurring online transactions | Extended the compliance deadline for banks and merchants |
| 8 October 2021 | Clarification issued to the Indian Banks’ Association | Clarifications on the framework |
| 16 June 2022 | Processing of e-mandates for recurring transactions | Raised the AFA-free limit to Rs 15,000 |
| 12 December 2023 | Processing of e-mandates for recurring transactions | Rs 1 lakh limit for insurance, mutual funds and credit card bills |
| 22 August 2024 | Processing of e-mandates for recurring transactions | Auto-replenishment of FASTag and NCMC balances |
What are the limits and core rules?
The table below summarises the main rules with their paragraph numbers, so you can check them against the RBI text.
| Rule | Requirement | Para |
|---|---|---|
| Registration | One-time registration, valid only after successful AFA | 4(a) |
| Validity period | Every e-mandate must state one; customer can change it or withdraw at any time | 4(b) |
| Amount type | Fixed amount, or variable amount within RBI’s overall cap; customer can set a maximum per debit | 4(c) |
| Notification channel | Customer chooses or changes the mode, such as SMS or email | 4(d) |
| Changes and withdrawal | Need AFA validation by the issuer | 4(e) |
| First debit | Needs AFA; can be combined with registration | 5(a) |
| Later debits, general | No AFA up to Rs 15,000 per transaction | 8(a) |
| Later debits, specified categories | No AFA up to Rs 1 lakh for insurance premiums, mutual fund subscriptions and credit card bills | 8(b) |
| Pre-debit notice | At least 24 hours before the debit | 6(a) |
| Opt-out | Customer can opt out of one debit or the whole mandate, with AFA | 6(c) |
| Post-debit notice | Sent after each debit, with grievance redressal details | 7 |
| Customer charges | None for using the e-mandate facility | 10(a) |
The pre-debit notice must include, at minimum, the merchant’s name, the amount, the date and time of debit, the e-mandate reference number and the reason for the debit. It is not required for mandates that auto-replenish FASTag or National Common Mobility Card balances.
Debits above the AFA-free limit are still allowed under a mandate, but each one needs the customer to complete AFA. In practice that means the debit cannot run silently: the customer must approve it.
What is new in the 2026 framework?
RBI footnotes two provisions as added after feedback:
- Grievance details in post-debit notices. The issuer’s notice after each debit must now tell the customer how to raise a grievance, alongside the merchant name, amount, timing, transaction and mandate references and reason.
- Mapping to reissued cards. Existing card e-mandates can be mapped to a reissued card, so a customer whose card is replaced does not automatically lose their subscriptions.
Three other points are worth noting because they are now stated plainly in one place:
- Acquirers are responsible. Paragraph 10(c) says an acquirer shall ensure compliance by the merchants it onboards. Expect your gateway to review your mandate flows more closely.
- Cross-border is in scope. The directions cover recurring transactions that are domestic or cross-border.
- Customer controls do not block mandates. Under paragraph 5(b), payments under e-mandates are not subject to other limits or controls set by the customer. The opt-out, modification and withdrawal rights are the controls that apply.
Who is responsible for what?
Most obligations in the framework fall on the issuer, meaning the customer’s bank or card issuer, or the PPI issuer. Merchants still carry practical responsibility, because their gateway must answer for them.
| Party | Main duties under the framework |
|---|---|
| Issuer | Registers mandates after AFA, sends pre-debit and post-debit notices, provides opt-out, modification and withdrawal, runs dispute redressal |
| Acquirer or payment aggregator | Ensures onboarded merchants comply (paragraph 10(c)), passes mandate and notification requests to the issuer or UPI network |
| Merchant | Designs the consent flow, schedules debits so the 24-hour notice is met, honours cancellations, keeps records |
Nothing in the directions requires mandates registered under the earlier circulars to be registered again. The framework consolidates existing instructions, so a mandate set up correctly under the old rules should already meet the core requirements. The gaps are more likely to be in newer details, such as grievance information in post-debit notices, which your gateway and the issuer handle.
How does UPI AutoPay work under the framework?
UPI AutoPay is NPCI’s implementation of e-mandates on UPI. The RBI rules above apply, and NPCI adds operational rules for banks, apps and payment service providers.
Creation. The customer approves a mandate in any UPI app, reached through a collect request, a QR code or an intent flow. Entering the UPI PIN is the AFA. NPCI lists frequencies from one-time and daily through weekly, monthly, quarterly and yearly, and gateways also offer an “as presented” option for irregular charges. The customer sees the merchant, amount or maximum amount, frequency and validity before approving.
Execution. Before each debit, the merchant’s payment provider sends a pre-debit notification through UPI so the customer is told at least 24 hours ahead. Under NPCI guidelines that took effect on 1 August 2025, AutoPay debits run only outside peak hours: before 10 am, between 1 pm and 5 pm, and after 9:30 pm. Each scheduled debit is allowed one attempt and up to three retries.
Customer controls. From the mandate section of their UPI app, customers can view, modify, pause and revoke mandates. Merchants cannot override these controls. Since mid-2026 NPCI has also been rolling out the ability to view mandates across UPI apps and move them between apps without registering again.
For a worked example of how a gateway exposes these steps, seeRazorpay’s UPI AutoPay documentation, which describes registration, the customer-set maximum amount and the pre-debit notification requirement.
How do card and UPI mandates differ for merchants?
The RBI rules are the same, but the mechanics differ.
| Area | Card e-mandates | UPI AutoPay |
|---|---|---|
| AFA at registration | Issuer authentication, usually 3D Secure | UPI PIN |
| Stored credential | Card-on-file token, never the card number | Mandate reference linked to the UPI ID and bank account |
| Retries | Set by card network rules and your gateway | One attempt plus up to three retries per debit |
| Debit timing | No NPCI time windows | Non-peak windows only |
| Customer cancellation | Through the issuer’s channels or the merchant | In the UPI app at any time |
| Card reissue | Mandate can be mapped to the new card | Not applicable |
| Disputes | Card network chargeback process | Complaint through the UPI app and bank |
On cards, a mandate is tied to a token. Our guides tosaved-card tokenisation in Indiaand theCIT and MIT stored credential frameworkexplain how the first customer-initiated payment and later merchant-initiated debits should be flagged.
What should merchants check for compliance?
The framework is addressed to payment system providers, but your gateway answers to RBI for your flows. Work through these points.
Consent and registration:
- Show the merchant name, plan, amount (or maximum amount for variable plans), frequency, start date, validity period and first charge before the customer authenticates.
- State at registration that the customer can change the validity period or cancel at any time.
- Set a sensible maximum for variable mandates. A cap far above the plan price invites disputes.
- Do not add a fee for setting up or using autopay.
Notifications:
- Confirm your gateway sends pre-debit notifications at least 24 hours ahead with all required fields. Schedule debits so the notice window is always met.
- Send your own reminder for annual or high-value renewals. It reduces “I did not recognise this charge” disputes.
Failed debits and retries:
- For UPI, schedule retries inside non-peak windows and within the one-attempt-plus-three-retries limit.
- Stop retrying once the customer has opted out of a debit or revoked the mandate.
- For debits above Rs 15,000 (or Rs 1 lakh in the specified categories), build a flow that asks the customer to authenticate instead of retrying silently.
Cancellation and refunds:
- Offer cancellation in your own app or account page and cancel the mandate through your gateway’s API, so the customer does not have to visit their bank.
- Listen for mandate revoked, paused and cancelled webhooks, and stop service and billing accordingly.
- Refund to the original payment method unless the customer asks otherwise, as the payment aggregator directions require. OurRBI payment aggregator guidelines checklistcovers that rule.
Records and disputes:
- Keep the mandate ID, consent screen version, registration timestamp, notification references and debit history for each customer. The framework sets no retention period, so follow your tax, contractual and dispute timelines.
- Remember that RBI’s customer liability rules for unauthorised transactions apply to e-mandate debits. A customer who says they never agreed to a mandate has a strong position unless you can show consent. Our guide tochargeback and friendly fraudcovers evidence handling.
For the security side of subscription billing, such as protecting stored credentials and reducing involuntary churn, seesecuring recurring billing and subscriptions.
Frequently asked questions
1. When did the RBI E-mandate Framework, 2026 come into force?
It was issued on 21 April 2026 and took effect immediately. It replaced eight circulars issued between August 2019 and August 2024.
2. What is the AFA-free limit for e-mandates in 2026?
Rs 15,000 per transaction for most recurring payments. Insurance premiums, mutual fund subscriptions and credit card bill payments can go up to Rs 1 lakh per transaction without AFA.
3. Does the first payment under an e-mandate need AFA?
Yes. Registration and the first debit both need AFA. If the first debit is processed during registration, a single AFA can cover both.
4. How early must the pre-debit notification be sent?
At least 24 hours before the debit. It must state the merchant’s name, amount, date and time, mandate reference and reason. FASTag and NCMC auto-replenishment mandates are exempt.
5. Can a customer cancel a UPI AutoPay mandate at any time?
Yes. Customers can pause, modify or revoke mandates from their UPI app, and RBI requires issuers to let customers opt out of a single debit or the whole mandate, validated with AFA.
6. Can merchants charge a fee for autopay?
No. Paragraph 10(a) says no charges shall be levied on the customer for using the e-mandate facility.
7. Does the framework cover e-NACH?
No. It covers cards, UPI and PPIs. NACH mandates follow NPCI’s NACH rules.
8. Does the framework apply to cross-border subscriptions?
Yes. It covers recurring transactions that are domestic or cross-border, using cards, PPIs or UPI.