A plain-English summary of the rules behind AutoPay on UPI and cards, for brands that sell subscriptions. We checked it against RBI's published directions on 15 October 2026. It isn't legal advice: your payment gateway and its bank apply these rules, and can tell you how they affect your account.
What an E-Mandate Is
An e-mandate is a standing instruction from the customer to their bank, card issuer or UPI app. It lets one merchant collect recurring payments without asking for a PIN or OTP each time. Shoppers know it as AutoPay.
Under RBI's 2026 Framework, every e-mandate:
- is registered once, after an additional factor of authentication (AFA);
- states a validity period, which the customer can change;
- is for a fixed amount, or a variable amount up to a maximum the customer sets;
- can be changed or withdrawn by the customer at any time, again with authentication.
The Framework covers recurring payments on cards, UPI and prepaid payment instruments such as wallets. It's addressed to banks, card networks, UPI apps and gateways, and acquirers must make sure the merchants they onboard comply. So the rules reach your store through your gateway. Our guide to the best payment gateways for Shopify in India shows which ones run AutoPay.
A card saved at checkout isn't an e-mandate. That's one reason a subscription can't simply charge an Indian customer's saved card. Our guide to Shopify subscriptions in India covers the rest.
The Rules at a Glance
| Rule | What RBI's 2026 Framework says | What it means for your subscriptions |
|---|---|---|
| Registration | Once, after extra authentication (UPI PIN, card OTP or another factor) | The customer approves once, at the first purchase |
| First payment | Authenticated; can be combined with registration | Pay for delivery 1 and set up AutoPay in one step |
| Limit without OTP or PIN | ₹15,000 a payment; ₹1,00,000 only for insurance premiums, mutual funds and credit card bills | Keep AutoPay payments under ₹15,000; sell bigger boxes prepaid |
| Notice before each debit | From the customer's issuer, at least 24 hours ahead | Customers see your merchant name before every charge |
| Opt-out | From the notice: skip one debit or end the mandate | Make skipping easier in your portal than in their bank app |
| Changes and cancelling | Anytime, with authentication | Expect some cancellations from the UPI app |
| Fees | Customers can't be charged for using e-mandates | Never add an AutoPay fee |
| Alert after each debit | From the issuer, with how to raise a complaint | Match it with your own order confirmation |
Approving a Mandate: UPI PIN or Card
On UPI. The customer picks their UPI app: Google Pay, PhonePe, Paytm, BHIM or their bank's app. They see the merchant, amount and frequency, and approve with their UPI PIN. Some UPI apps only accept mandates up to ₹15,000, according to Razorpay's UPI AutoPay documentation.
On cards. The customer uses a credit or debit card that supports e-mandates, and authenticates with their card issuer. That's usually an OTP. Since 1 April 2026, RBI's authentication directions also let issuers use other factors, such as biometrics or a software token. Not every card supports e-mandates yet, so offer UPI alongside.
In one step. The first payment needs authentication anyway, and RBI lets it be combined with registration. On StackBack's subscription checkout, the customer pays for the first delivery and sets up AutoPay in the same step.
The ₹15,000 Limit, Explained
- It's per payment, not per month. Each AutoPay payment up to ₹15,000 goes through without an OTP or PIN.
- Above ₹15,000, the customer authenticates every payment. That works, but it brings back the friction AutoPay is meant to remove.
- ₹1,00,000 is only for three categories: insurance premiums, mutual fund subscriptions and credit card bills. It doesn't apply to D2C products.
- It's been ₹15,000 since June 2022, when RBI raised it from ₹5,000. The 2026 Framework kept it.
What to do about it:
- Keep each AutoPay payment under ₹15,000. Most consumable subscriptions sit well below it.
- Sell boxes above ₹15,000 a delivery as prepaid.
- Leave headroom in the mandate. If it only covers today's price, an added product or a bigger box can fail. On StackBack, the AutoPay limit is set at up to ₹15,000, or 3–4× the plan price. So an added product is covered without a new approval.
Pre-Debit Notices: RBI's 24 Hours, and Yours
RBI requires the customer's issuer to send a notice at least 24 hours before every debit. It must show:
- the merchant's name;
- the amount;
- the date and time of the debit;
- the e-mandate reference number;
- the reason for the debit: the customer's registered e-mandate.
The customer chooses whether it arrives by SMS or email, and can change that later. From the notice, they can opt out of that one debit or the whole mandate. After the debit, the issuer sends a second alert with the details and how to raise a complaint.
That notice comes from the bank, not from you. Two things follow:
- Your name must be recognisable. The notice shows the merchant name on your gateway account. If that's your company's legal name rather than your brand, say so in your own messages.
- Send your own notice first. A customer who hears only from the bank can only skip or cancel. One who hears from you first can swap, reschedule or add a product. StackBack emails your notice 48–72 hours before each charge, and passes the charge to the WhatsApp tool you already use, with a link to manage the subscription.
Your Notice Goes Out Before the Bank's
StackBack emails your customers 48–72 hours before each payment and passes the charge to your own WhatsApp tool, so they hear from you before the bank. Our team takes you live in 2 days.
Pausing and Cancelling Outside Your Portal
RBI's Framework lets customers change or withdraw a mandate at any time. In practice, customers can pause or cancel a UPI AutoPay mandate from their UPI app, without contacting you (Razorpay's UPI AutoPay FAQs).
NPCI, which runs UPI, has added more:
- Pause support. Merchants that accept UPI AutoPay must support a mandate being paused from the customer's UPI app, and mustn't delete it on their side when it's paused. NPCI set this in December 2023 and restated it in its September 2026 consolidated circular.
- One view of every mandate. By 31 December 2025, UPI apps had to show users all their active AutoPay mandates, including ones set up in other apps. Customers can also move a mandate to another app, up to three times in 90 days.
- Moving mandates between UPI apps. Customers can move a mandate when they switch UPI apps. Razorpay began rolling this out in July 2026, under NPCI's interoperability circular OC-163, according to its documentation.
What it means for you:
- Expect some cancellations outside your portal. The customer's UPI app is one tap away.
- Make your portal the easier option. A skip, pause or swap in your portal keeps the subscription. Cancelling the mandate stops the payments.
- Treat a cancelled mandate as a payment problem. It isn't always a lost customer. A payment link before the next delivery gives them a way to stay.
Card AutoPay: Tokens and Mandates
- No stored card numbers. Only card issuers and card networks may store card numbers. Everyone else had to purge them after 30 September 2022 (RBI notification, 24 June 2022).
- Tokens instead. Card-on-file tokenisation replaces the card number with a token. A token is created only with the customer's consent and extra authentication (RBI circular, 7 September 2021). Card AutoPay runs on that token.
- Reissued cards. When a bank reissues a card, the 2026 Framework lets existing e-mandates be mapped to the new card.
- Expired or blocked cards still cause failed payments. Plan for retries, and offer UPI AutoPay as the way back.
When UPI AutoPay Payments Run, and How Often They're Retried
NPCI's UPI API rules moved AutoPay debits out of peak hours, with banks and apps to comply by 31 July 2025. Peak hours are 10 am to 1 pm and 5 pm to 9:30 pm. Each scheduled debit gets one attempt and up to three retries.
So a debit may land early in the morning or late at night. And a failed payment can't be retried forever. Build your process around a fixed number of retries, then a fallback.
On StackBack, a failed AutoPay payment is retried. After 3 failed retries, the subscription pauses or moves to pay as you go, whichever you choose. On pay as you go, the customer gets a payment link. Nothing ships unpaid.
What Changed in 2025 and 2026
- 31 July 2025: deadline for NPCI's UPI API rules. AutoPay debits run outside peak hours, with one attempt and up to three retries.
- 25 September 2025: RBI issues the Authentication Mechanisms for Digital Payment Transactions Directions, 2025, with compliance due by 1 April 2026. Issuers can use authentication factors beyond SMS OTP.
- 31 December 2025: deadline for UPI apps to show every active AutoPay mandate in one place, and let customers move one to another app.
- 21 April 2026: RBI's Digital Payments – E-mandate Framework, 2026 takes effect immediately. It replaces eight circulars issued between 2019 and 2024. The ₹15,000 limit, the ₹1,00,000 exceptions and the 24-hour notice stay the same. It spells out what the notice must contain, the single-debit opt-out and the validity period.
- 18 September 2026: NPCI issues its UPI Consolidated Circular, Version 1.0. It gathers UPI circulars issued up to 31 July 2026, AutoPay included, into one document. It changes no AutoPay rule, except that a customer can now move a mandate between apps three times in 90 days instead of once.
What to Show Customers
Before they subscribe:
- the amount of each payment, and how often it's taken;
- how many deliveries, or "until you cancel";
- that AutoPay collects each payment automatically, after a notice;
- the maximum amount AutoPay can collect, and why it's above the plan price;
- how to skip, pause or cancel: from your portal or their UPI app.
After they subscribe:
- a confirmation with the plan, the amount and the next payment date;
- your own notice before every charge, with a link to manage the subscription;
- an order confirmation after each payment;
- a named contact for problems.
Never:
- pre-select the subscription, or add it to the cart for them;
- reveal the full price late;
- hide cancelling, or make it harder than subscribing.
India's Guidelines for Prevention and Regulation of Dark Patterns, 2023 (CCPA, 30 November 2023) name these "basket sneaking", "drip pricing" and "subscription trap".
How StackBack Handles This
AutoPay on UPI and cards is bought on StackBack's subscription checkout, through your own Razorpay, Cashfree, PayU or PhonePe account. The customer pays for the first delivery and sets up the mandate in one step. Payments up to ₹15,000 then go through without an OTP, and the limit is set at up to ₹15,000 or 3–4× the plan price.
Customers get a notice 48–72 hours before every charge, by email and on WhatsApp through your own WhatsApp tool, with a link to manage the subscription. They can pause or cancel from your portal or their UPI app. A failed payment is retried, and after 3 failed retries the subscription pauses or moves to pay as you go, as you choose. Every payment settles in your own gateway account.
For boxes above ₹15,000, prepaid plans sit alongside AutoPay on the same product page. More on AutoPay on UPI and cards, Razorpay subscriptions on Shopify and subscriptions on StackBack.
Frequently Asked Questions
What is the UPI AutoPay limit?
₹15,000 per payment without extra authentication, under RBI's E-mandate Framework, 2026. Above that, the customer approves each payment with their UPI PIN. Insurance premiums, mutual funds and credit card bills have a ₹1,00,000 limit.
Do customers enter an OTP or UPI PIN for every AutoPay payment?
No. They authenticate once, when they set up the mandate and make the first payment. After that, payments up to ₹15,000 go through without an OTP or PIN.
Who sends the pre-debit notification?
The customer's bank, card issuer or UPI app, at least 24 hours before each debit. Brands can send their own notice earlier. With StackBack, yours goes out by email 48–72 hours before every charge, and on WhatsApp through your own WhatsApp tool.
Can customers cancel UPI AutoPay from their UPI app?
Yes. Customers can pause or cancel a UPI AutoPay mandate from their UPI app at any time, without contacting the brand. They can also manage the subscription from your customer portal.
What is an e-mandate?
A standing instruction that lets a merchant collect recurring payments from a customer's card, UPI account or wallet. The customer registers it once, with extra authentication, and can change or cancel it anytime.
Can I charge customers a fee for using AutoPay?
No. RBI's Framework says customers can't be charged for using the e-mandate facility for recurring payments.
Do the same rules apply to card AutoPay?
Yes. The same Framework covers cards, UPI and wallets: one registration, the ₹15,000 limit and the 24-hour notice. Card AutoPay also runs on a token, because merchants can't store card numbers.
RBI's Rules, Handled for You
AutoPay on UPI and cards through your own gateway, with a notice before every charge. Our team takes you live in 2 days.
Sources: RBI, Digital Payments – E-mandate Framework, 2026, 21 April 2026 · RBI, Authentication Mechanisms for Digital Payment Transactions, 25 September 2025 · RBI, Restriction on Storage of Actual Card Data, 24 June 2022 · RBI, Card-on-File Tokenisation, 7 September 2021 · NPCI UPI circulars OC-182 (7 Dec 2023), OC-151A (14 Dec 2023), OC-215A (21 May 2025), OC-223 (7 Oct 2025) and the UPI Consolidated Circular v1.0 (18 Sep 2026), links in the next line · Razorpay Docs, UPI AutoPay FAQs and AutoPay interoperability, checked 15 October 2026 · CCPA, Dark Patterns Guidelines, 2023, 30 November 2023
NPCI sources (opened 17 Oct 2026): OC-182: User Experience Enhancements for UPI AutoPay · OC-151A: Enhancement of Limits for UPI AutoPay · OC-215A: Guidelines on usage of UPI APIs · OC-223: Enhancement of UPI Autopay · UPI Consolidated Circular v1.0
