RBI Master Directions on E-Mandate: New Rules for UPI AutoPay Recurring Subscriptions

Operating a recurring SaaS, newsletter, gym, or subscription business in India has become heavily regulated under the Reserve Bank of India’s (RBI) Master Directions on Framework for Processing of e-Mandates for Recurring Transactions.

Following the overhaul of recurring card payments, UPI AutoPay emerged as India’s most dependable recurring billing rail. Here is the technical and regulatory blueprint every founder and engineering lead must know.

---

RBI E-Mandate Framework: An Overview

Direct Answer: The RBI E-Mandate framework requires all automated recurring digital debits to have explicit customer authentication at creation, mandatory pre-debit notifications, and an accessible consumer revocation dashboard. Under this framework, UPI AutoPay allows businesses to collect recurring payments seamlessly up to ₹15,000 per cycle without requiring a second-factor OTP from the subscriber.

Before 2021, merchants could store card numbers and execute background debits. The RBI’s directive fundamentally shifted control to consumers, preventing zombie subscriptions and unauthorized charges.

---

The ₹15,000 AFA Limit for UPI AutoPay

Under the latest RBI circular updates:

Category	Maximum Recurring Debit Without OTP (AFA)	Debits Requiring OTP Per Cycle
SaaS, Media & Retail Subscriptions	₹15,000 per cycle	Amounts exceeding ₹15,000
Mutual Funds & SIP Investments	₹1,00,000 per cycle	Amounts exceeding ₹1,00,000
Insurance Premium Payments	₹1,00,000 per cycle	Amounts exceeding ₹1,00,000
Educational Fee Mandates	₹1,00,000 per cycle	Amounts exceeding ₹1,00,000

What Happens When an Invoice Exceeds ₹15,000?

If your monthly B2B enterprise tier charges ₹25,000/month:

1. The mandate setup is registered for a maximum limit of ₹25,000.
2. For each billing cycle, the system initiates an out-of-band Additional Factor of Authentication (AFA) prompt.
3. The customer receives an alert in their UPI app (PhonePe, Google Pay, BHIM) and enters their 4-digit or 6-digit UPI PIN to clear the debit.

---

The Mandatory 24-Hour Pre-Debit Notification

A critical compliance mandate that causes many developer systems to fail regulatory audits is the Pre-Debit Notification (P-DN):

• Timing: Must be dispatched at least 24 hours prior to the actual bank debit execution.
• Channels: Direct SMS or registered email to the subscriber.
• Mandatory Payload Details:
  1. Business / Payee Name.
  2. Exact amount to be debited.
  3. Scheduled debit date and time.
  4. Unique Mandate Reference Number (UMRN).
  5. Reason / invoice line item.
  6. A direct link enabling the customer to view, pause, or revoke the mandate.

Failure by your payment processor to deliver this pre-notification triggers an immediate decline code (RB01 - Pre-Debit Notification Missing) from the issuing bank.

---

SaaS Subscription Compliance Checklist

To ensure your billing system remains 100% compliant with RBI directions:

[1. Mandate Creation] ➔ Collect initial 1-time UPI PIN authorization from user
[2. Store UMRN]      ➔ Record NPCI Unique Mandate Reference Number securely
[3. Pre-Debit Trigger]➔ Fire pre-notification webhook 24 hours before billing
[4. Execution]       ➔ Send auto-debit request to NPCI settlement network
[5. Webhook Reconcile]➔ Validate HMAC-SHA256 signature on payment.success event

• Clear option on your customer settings page to Cancel Subscription / Pause Mandate.
• Clear disclosure of billing frequency (weekly, monthly, quarterly, annual).
• Automatic retry backoff policy (maximum 3 retries within 7 days) if an auto-debit fails due to insufficient balance.

---

How to Architect Recurring Billing in India

Many SaaS startups get trapped in costly aggregator billing engines that charge 2% to 3% plus GST on every recurring invoice.

For annual or predictable subscription workflows:

• Use one-click UPI dynamic payment links generated via the VyaparGateway API.
• Automated renewal reminders sent via WhatsApp or Email with pre-filled dynamic QR codes achieve up to 89% renewal completion without mandate setup friction.
• You maintain full direct-to-bank settlement with 0% platform transaction fees.

Read our comprehensive guide on UPI Webhook Integration for Developers to build secure recurring event listeners.