India’s digital payment landscape has rapidly evolved, from cards and wallets to UPI-led innovations that made transactions instant and accessible.
With this growth, sectors like OTT, insurance, and SaaS have widely adopted recurring and subscription payments to enhance customer convenience.
To ensure these automated transactions remain secure and transparent, the Reserve Bank of India (RBI) introduced the e-mandate framework.
These RBI recurring payment rules empower users with greater control while helping businesses automate payments safely and compliantly under the RBI e-mandate system. Let’s learn more about the RBI e-mandate framework in detail.
What is the RBI e-Mandate Framework?
The RBI e-mandate framework is a regulatory system introduced by the Reserve Bank of India to make recurring payments in India safer, more transparent, and fully consent-based.
In simple terms, an e-mandate is a digital authorisation that allows a customer to permit a business or service provider to automatically debit recurring payments, such as subscription fees, EMIs, or insurance premiums, from their account.
Under the RBI e-mandate regulations, every automated transaction must be backed by explicit customer consent and authentication, ensuring complete user control.
The framework also mandates pre-debit notifications, limits on automatic debits, and robust fraud prevention measures.
By setting clear e-mandate compliance guidelines, the RBI aims to strike a balance between convenience and security, enabling businesses to automate payments responsibly while protecting consumers from unauthorized charges.
Key Provisions Under RBI e-Mandate Regulations
On September 25, 2025, the Reserve Bank of India (RBI) announced a significant update to the authentication process for digital payments in India.
These new guidelines, called the Authentication Mechanisms for Digital Payment Transactions Directions, 2025, aim to make online payments safer and more fraud-resistant.
They will come into effect from April 1, 2026.
The RBI e-mandate regulations outline strict steps to ensure recurring payments remain secure, transparent, and fully consent-driven.
Here’s a simplified breakdown of what’s changing and how it impacts users and businesses.
1. Authentication Process: Mandatory 2-Factor Authentication
As per RBI Guidelines, customers must complete an initial registration and Additional Factor Authentication (AFA), verifying their consent before enabling automated debits.
RBI defines these factors as:
- Something you know: your password, PIN, or passcode
- Something you have: your phone, hardware token, or device
- Something you are: biometrics like your fingerprint or face
This layered approach helps ensure that even if one factor is compromised, the payment remains protected.
2. Dynamic Authentication Factor for Online Transactions
For card-not-present or remote digital transactions such as online purchases, RBI now requires that at least one authentication factor be dynamic in nature. This factor must be:
- Unique to the specific transaction
- Dynamically generated in real time
- Non-reusable and valid only once
This directive effectively moves the ecosystem away from static credentials, such as fixed passwords or PINs, which are more susceptible to compromise.
Instead, the focus shifts toward advanced authentication methods, including device-based approvals, in-app confirmations, and cryptographically generated tokens.
3. Transitioning Beyond OTPs—Without Eliminating Them
While SMS-based One-Time Passwords (OTPs) have long been a mainstay of digital authentication in India, the RBI is encouraging the adoption of more robust and secure alternatives.
This shift is driven by the growing vulnerabilities associated with SMS OTPs, including phishing attacks, SIM-swapping, message forwarding exploits, and network latency issues.
To strengthen digital transaction security, RBI recommends the use of modern authentication mechanisms such as:
- In-app authentication prompts
- Biometric verification
- Hardware-backed security tokens
- Device binding and cryptographic validation
Notably, SMS OTPs will continue to remain in use, but they will no longer be treated as the primary or sole authentication method.
4. Pre-Debit Notification:
Merchants or banks must send a notification at least 24 hours before every recurring charge, giving users the option to cancel or modify the payment.
5. Transaction Limits and Payment Modes: The RBI recurring payments rules
set specific transaction limits for cards, UPI, and wallets, ensuring safety across all payment channels.
6. Merchant and Bank Responsibilities: Both are responsible for maintaining clear consent records, providing easy cancellation options, and adhering to e-mandate compliance norms.
| Category | Rule / Requirement | Limit / Details |
|---|---|---|
| AFA Requirement for Card/UPI/Wallet Transactions | Mandatory for most online/e-commerce transactions | AFA is required for all domestic transactions except permitted exemptions |
| Card-on-File Tokenization | The merchant cannot store card numbers; tokenization is enabled | Token creation requires AFA |
| AFA for Auto-Debits (Standing Instructions) | Required only once at the time of SI registration | Applicable for: Cards, UPI AutoPay, wallets, bank accounts |
| Pre-debit Notification (Mandatory) | Issued before every recurring payment | Must be sent 24 hours before debit |
| SI Limit Without Additional Authentication | Transactions up to ₹5,000 can be auto-debited without extra AFA | Applies to recurring payments only |
| AFA for Transactions Above Limit | If the auto-debit amount >₹5,000, AFA is required for every such debit | User must authenticate manually |
| Manage/Modify/Cancel SI | The user should have the facility to pause/modify/cancel | Must be available via app/portal |
| Transaction Failure Handling | If payment fails due to no AFA (above limit) | Merchant must retry after AFA |
| Pre-transaction Information | Must include merchant name, amount, date/time, reference number, and cancellation option | Sent via SMS, email, or app notification |
| Post-debit Notification | Compulsory after every recurring debit | Sent immediately after debit |
| De-registration of SI | A simple and instant opt-out option is required | The user should not be charged any penalty |
Together, these provisions strengthen user trust and promote a secure digital payments ecosystem in India’s recurring payments landscape.
RBI e-Mandate Checklist for Merchants
For fintechs and merchants, adhering to RBI e-mandate compliance is essential to build trust and avoid regulatory risks.
Here’s a simple RBI e-mandate checklist for merchants to ensure smooth implementation:
- Register and Verify the Mandate: Initiate the e-mandate
setup through approved banks or payment gateways and verify it using Additional Factor Authentication (AFA). - Obtain Explicit Customer Consent:
Ensure every recurring payment is backed by clear digital consent from the user before activation. - Send Pre-Debit Notifications:
Notify customers at least 24 hours before each transaction to allow review or cancellation. - Enable Easy Cancellation and Modification:
Provide users with a simple way to pause, modify, or cancel their mandates anytime. - Maintain Audit Trails for RBI Compliance: Keep detailed logs of transactions, notifications, and user consents to demonstrate full compliance with RBI e-mandate regulations.
Technical Implementation: e-Mandate API Integration Explained
Smooth and secure e-mandate API integration is the backbone of automated recurring payments.
Most integrations are done through banks or payment gateways that offer standardized APIs aligned with RBI e-mandate guidelines.
Key API Endpoints in the Integration Flow:
- Registration API – captures customer details and initiates the e-mandate setup.
- Verification API – confirms consent using Additional Factor Authentication (AFA).
- Execution API – processes recurring payments as per the approved schedule.
- Cancellation or Modification API – allows users to revoke or change their mandates anytime.
As per RBI, to ensure compliance, fintechs must implement tokenization and encrypted data handling, preventing exposure of sensitive card or account information.
Using RBI-compliant APIs not only strengthens data security but also enhances scalability, reliability, and customer trust, key drivers for sustainable growth in e-mandate India.
Impact of e-Mandate on Subscription Revenue
The introduction of the RBI e-mandate has significantly transformed how businesses manage recurring payments in India, especially in subscription-driven sectors like OTT, SaaS, and insurance.
By automating billing with e-mandates, companies are experiencing smoother payment cycles, higher customer retention, and improved cash flow predictability.
With reduced payment friction and instant renewals, users stay subscribed longer, directly increasing subscription revenue and lowering churn rates.
However, challenges such as re-authentication requirements, regulatory transaction limits, and mandatory notifications can impact user experience if not managed well.
Businesses that streamline these processes through compliant and user-friendly systems gain a clear competitive edge.
Overall, the impact of e-mandate on subscription revenue has been positive, enabling fintechs and merchants to scale recurring models confidently while maintaining compliance and customer trust.
What It Means for India’s Fintech Future
The RBI e-mandate framework represents more than just a compliance requirement; it’s a foundation for India’s next wave of fintech innovation.
- By enforcing secure, consent-based recurring payments, the RBI has strengthened user trust and opened the door for scalable digital finance solutions.
- As e-mandate adoption grows, fintechs are integrating it with emerging technologies like UPI Autopay, tokenization, and real-time APIs to deliver seamless payment experiences.
- This shift not only enhances operational efficiency but also promotes a culture of responsible automation in e-mandate India.
- In the long run, these regulations will help shape a more transparent, resilient, and user-centric payments ecosystem, where compliance and innovation go hand in hand to drive sustainable fintech growth.
The RBI e-mandate has transformed recurring payments in India by combining security, transparency, and user control. For fintechs, it’s not just a regulation, it’s an opportunity to build trust and scale automation responsibly.
Vegaah simplifies this journey with RBI-compliant e-mandate solutions, offering easy API integration, real-time consent tracking, and secure recurring payment automation.
Partner with Vegaah to make your recurring payments smarter, safer, and fully compliant.
What is RBI’s e-mandate?
The RBI e-mandate is a digital authorization framework that allows customers to enable automated recurring payments with their consent. It ensures every transaction is secure, transparent, and user-controlled under RBI regulations.
How does RBI’s e-mandate work for recurring payments?
Once a customer registers an e-mandate with authentication, recurring payments are automatically processed on schedule. Users receive a pre-debit notification 24 hours before each charge, maintaining full control over cancellations or modifications.
What are the RBI recurring payment rules for merchants?
Merchants must obtain explicit customer consent, send advance notifications, allow easy cancellations, and maintain detailed audit trails. These RBI recurring payments rules ensure security and compliance across all payment channels.
How can fintechs integrate e-mandate APIs? Fintechs can integrate
e-mandate
APIs through banks or payment gateways, covering endpoints for registration, verification, and cancellation. Secure tokenization and encrypted data handling are crucial for ensuring compliance and maintaining user trust.
What is the impact of e-mandate on customer retention and subscription growth?
The e-mandate framework reduces payment friction, enhances renewal rates, and fosters stronger customer loyalty. Automating billing securely drives higher subscription revenue and lower churn for fintechs and businesses.
