E-mandate Rules 2026: How to Cancel a Recurring Payment, the ₹15,000 OTP Limit and 24-Hour Notice
Meera, a teacher in Nagpur, found three subscriptions charged to her debit card on the same morning. She had forgotten about two of them. All three were mandates she had registered once and debited every month after that. RBI’s Digital Payments – E-mandate Framework, 2026, issued on 21 April 2026, collects every earlier rule on these recurring debits into one document. It also gives you the right to stop any mandate, at any time, without paying a charge.
What an e-mandate is under RBI rules
It is a standing instruction you give through a card, a prepaid wallet (PPI) or UPI, so that a merchant can charge you on a schedule. UPI AutoPay is one form of it. The framework applies “in respect of processing of recurring transactions, domestic or cross-border, using cards / PPI / UPI” (para 2) (RBI framework text).
| Stage | The rule | Para |
|---|---|---|
| Registration | A one-time step, validated with an additional factor of authentication (AFA), such as an OTP or PIN | 4(a) |
| Validity | Every mandate must state its validity period; you can change it or withdraw the mandate “at any point of time” | 4(b) |
| Variable amounts | You can set the maximum value of any single debit | 4(c) |
| First debit | Needs AFA (it can be combined with registration) | 5(a) |
| Before each debit | A notice at least 24 hours in advance | 6(a) |
| After each debit | A notice with transaction details and where to complain | 7 |
| Charges | “No charges shall be levied to the customer for availing the e-mandate facility” | 10(a) |
What the 2026 framework does not cover
Para 2 limits the framework to recurring payments “using cards / PPI / UPI”. A mandate set up on your bank account through net banking or a signed form for a loan EMI or SIP (NACH, for example) runs on a different system; in our reading, it falls outside this document. To stop one of those, go to your bank and the company you pay. The 24-hour notice and ₹15,000 rule described here may not apply to it.
A ten-minute mandate audit
Meera’s three debits were ₹199, ₹649 and ₹1,499 a month: ₹2,347 a month, or ₹28,164 a year. Two of them were for services she no longer used. A short audit catches this:
| Where to look | What you’ll find | Action |
|---|---|---|
| Credit card app or net banking | Card mandates (OTT, cloud storage, app subscriptions) | Withdraw unused ones (AFA needed) |
| Each UPI app you use | UPI AutoPay mandates | Pause or revoke |
| Prepaid wallets | PPI mandates | Withdraw from the wallet app |
| Last three bank or card statements | Repeating debits you don’t recognise | Match each to a mandate; report any you didn’t register |
For a variable-amount mandate, use para 4(c) to set a maximum per debit just above the usual bill. If the merchant raises its price, the debit fails and you get to decide, rather than finding out from your statement.
The ₹15,000 and ₹1 lakh limits
Para 8 sets when your bank must ask for an OTP or PIN on each debit:
- Recurring debits up to ₹15,000 each can go through without AFA. Anything above that needs AFA every time.
- For “insurance premiums, subscription to mutual funds, and credit card bill payments”, the no-AFA limit is ₹1,00,000 per debit.
So a ₹14,999 OTT bundle renews on its own, while a ₹15,001 renewal waits for your OTP. A ₹25,000 monthly SIP falls within the ₹1 lakh mutual-fund limit and goes through without an OTP.
The 24-hour pre-debit notice: your chance to stop a charge
Para 6(b) says the notice must show the merchant’s name, the amount, the date and time of the debit, the mandate reference number and the reason. Para 6(c) lets you opt out of “any particular transaction or the e-mandate”; the opt-out is confirmed with AFA, and the bank must send you a confirmation. You can also choose how the notice reaches you, for example SMS or email (para 4(d)).
There is no pre-debit notice for FASTag and NCMC auto top-ups (para 6(d)). Those debits arrive without warning.
How to cancel a recurring payment: three routes
- From the pre-debit notice. Use the opt-out link or option in the notice for that one debit or the whole mandate (para 6(c)).
- From your bank or card app. Look for “standing instructions” or “manage mandates” and withdraw the one you don’t want. Withdrawal needs AFA (para 4(e)).
- For UPI AutoPay. Open the UPI app where you set it up, find the mandate under AutoPay, and pause or revoke it.
Cancelling the mandate doesn’t cancel your contract with the merchant. Close the subscription on the merchant’s side too, or it may try to collect another way.
When a debit goes wrong
Para 9(b) says RBI’s rules on limiting customer liability for unauthorised transactions “shall be applicable to recurring transactions under e-mandates as well”. If a mandate you never registered debits your account, report it to your bank at once. For a payment that went to the wrong place, see wrong account transfer recovery. For an unexplained block on your funds, see debit holds on bank accounts.
Two more practical points. If your card is reissued, the bank can map existing mandates to the new card (para 10(b)), so a replacement card does not stop them. And payments under a mandate “shall not be subject to any other limits / controls set by the customer” (para 5(b)): a low daily limit you set on your card won’t block a mandate debit. UPI’s own limits are explained in UPI Lite vs UPI limits. If credit-card mandates are part of your billing, see our credit card billing cycle guide.
Questions readers send us on recurring debits:
FAQ
Can a bank charge me for cancelling a mandate?
No. Para 10(a) bars any charge for the facility.
Why didn’t I get an OTP for my ₹40,000 insurance premium?
Insurance premiums up to ₹1,00,000 per debit can go through without AFA under para 8(b).
How early must the bank warn me?
At least 24 hours before the debit (para 6(a)).
Is my loan EMI covered by these rules?
Only if it is paid through a card, wallet or UPI mandate. EMIs debited from a bank account through NACH run on a different system.
Does a new card stop old mandates?
Not necessarily. The bank may move them to the reissued card (para 10(b)).
Takeaway: open your bank app’s mandate list today and withdraw every mandate you no longer use. It is free, and each one takes a single OTP.
Rule text
- RBI, Digital Payments – E-mandate Framework, 2026, RBI/DPSS/2026-27/396, 21 Apr 2026: paras 2, 4(a)–(e), 5, 6, 7, 8, 9(b), 10, 11
- RBI (Authentication mechanisms for digital payment transactions) Directions, 2025, Annexure-1 (recurring-debit exemption)
Last verified: 10 Oct 2026, 8:00 AM IST. Checked: Digital Payments – E-mandate Framework, 2026 (full text) and the Authentication Directions, 2025 on rbi.org.in. App menu names vary by bank and are given only as examples.
