Do you still enter an OTP for your SIP or insurance auto-pay? For the recurring debit itself, no - if each instalment is within the limit. Under RBI's Digital Payments E-mandate Framework, 2026, recurring transactions up to ₹15,000 each can be debited without an OTP. The limit is ₹1,00,000 for SIPs, insurance premiums and credit card bills. But you still enter a one-time OTP when you first register, modify or cancel the mandate.
Is ₹15,000 enough to cover your monthly auto-debits? That single number decides whether your next OTC, electricity bill or OTT subscription will ask you for an OTP or simply go through. The Reserve Bank of India (RBI) has reset these limits under one rulebook, and the change touches almost every standing instruction on your card, wallet or UPI app.
An e-mandate is your standing permission for a merchant to pull a recurring payment from your card, Prepaid Payment Instrument (PPI) or UPI on a fixed schedule. You authorise it once. After that, each cycle's debit happens automatically, within the limit and rules you agreed to, without you logging in every time.
The Additional Factor of Authentication (AFA) is the one-time password or PIN that confirms it is really you. RBI's Digital Payments E-mandate Framework, 2026, dated 21 April 2026, consolidated the bank's earlier e-mandate circulars into a single framework and reset the no-OTP execution limits.
The table below shows where a recurring debit runs without an OTP, and where an OTP is still mandatory.
| Action / payment type | Per-transaction limit for no-OTP execution | OTP still needed? |
|---|---|---|
| General recurring debits (subscriptions, bills, EMIs) | Up to ₹15,000 | No OTP for each debit within limit |
| Insurance premiums | Up to ₹1,00,000 | No OTP for each debit within limit |
| Mutual fund subscriptions (SIPs) | Up to ₹1,00,000 | No OTP for each debit within limit |
| Credit card bill payments | Up to ₹1,00,000 | No OTP for each debit within limit |
| Any single debit above the applicable limit | Not covered | Yes - OTP required for that debit |
| Registering a new e-mandate | n/a | Yes - one-time OTP at setup |
| Modifying an existing e-mandate | n/a | Yes - one-time OTP |
| Cancelling or withdrawing a mandate | n/a | Yes - one-time OTP |
Note: the framework applies across cards, PPIs (wallets) and UPI. RBI also bars banks and merchants from levying any charge on customers for the e-mandate facility.
The exact screens differ by bank and app, but the flow is the same everywhere.
If your bank app does not show a mandate you know exists, ask the bank's PIO-equivalent grievance desk in writing - and read how to escape a subscription auto-debit trap before the next billing date.
The framework keeps the protection that made e-mandates safe in the first place. Before every debit, the issuer (your bank or card network) must send you a pre-debit notification at least 24 hours in advance. That notice must give you an option to opt out of that specific debit. After the money moves, you also get a post-debit notification.
This is your early-warning system. If a pre-debit alert shows an amount or merchant you do not recognise, act on the opt-out before the 24 hours run out - do not wait for the debit.
If money was pulled fraudulently or without a valid mandate, see how UPI auto-pay mandate fraud works and how to fight it and the steps to recover money lost in a UPI fraud.
If your bank does not resolve a wrong or unauthorised auto-debit, escalate. First, file a written complaint with the bank and wait for its reply or 30 days, whichever is earlier. If you are not satisfied, take it to the RBI Ombudsman under the Reserve Bank - Integrated Ombudsman Scheme, 2021 (RB-IOS 2021), the RBI's free dispute-redress route for banking and payment grievances. For a full walkthrough, read the banking ombudsman complaint guide.
For the bigger picture on filing complaints and using your information rights against any public authority, keep The RTI Playbook handy.
No - not for the recurring debit itself, as long as each instalment is within the no-OTP limit. For SIPs, insurance premiums and credit card bills that limit is ₹1,00,000 per transaction. You only enter an OTP when you first register the mandate or later modify or cancel it.
₹15,000 per transaction for general recurring debits such as OTT subscriptions, utility bills and EMIs. Below that, each cycle's debit runs without an OTP. A single debit above ₹15,000 still needs an OTP for that transaction, unless it falls in the ₹1,00,000 category for SIPs, insurance or credit card bills.
No. You get a pre-debit notification at least 24 hours before every debit, with an option to opt out of that debit. You can also modify or cancel the mandate at any time, and that change requires a one-time OTP. The OTP-free part covers only the routine execution within the limit.
No. Under RBI's Digital Payments E-mandate Framework, 2026, banks and merchants cannot charge customers for the e-mandate facility. If you see a charge labelled for setting up or maintaining a standing instruction, raise it with your bank and, if unresolved, with the RBI Ombudsman under RB-IOS 2021.
Yes. The framework covers cards, Prepaid Payment Instruments (wallets) and UPI. So a UPI AutoPay mandate, a wallet standing instruction and a card-based recurring payment all follow the same AFA limits and the same 24-hour pre-debit notice rule.