RBI e-Mandate Rules 2026: No OTP for Auto-Debit up to ₹15,000

Is ₹15,000 enough to cover your monthly auto-debits? That single number decides whether your next OTC, electricity bill or OTT subscription will ask you for an OTP or simply go through. The Reserve Bank of India (RBI) has reset these limits under one rulebook, and the change touches almost every standing instruction on your card, wallet or UPI app.

An e-mandate is your standing permission for a merchant to pull a recurring payment from your card, Prepaid Payment Instrument (PPI) or UPI on a fixed schedule. You authorise it once. After that, each cycle's debit happens automatically, within the limit and rules you agreed to, without you logging in every time.

The Additional Factor of Authentication (AFA) is the one-time password or PIN that confirms it is really you. RBI's Digital Payments E-mandate Framework, 2026, dated 21 April 2026, consolidated the bank's earlier e-mandate circulars into a single framework and reset the no-OTP execution limits.

The table below shows where a recurring debit runs without an OTP, and where an OTP is still mandatory.

Note: the framework applies across cards, PPIs (wallets) and UPI. RBI also bars banks and merchants from levying any charge on customers for the e-mandate facility.

The exact screens differ by bank and app, but the flow is the same everywhere.

1. Set up. On the merchant's payment page, choose the auto-pay or standing-instruction option. Pick your card, wallet or UPI account. Set the maximum amount and frequency. Approve the registration with the one-time OTP or UPI PIN your bank sends.
2. Modify. Open the auto-pay or mandates section in your bank app or UPI app. Select the mandate, change the amount cap or frequency, and confirm with an OTP. A change always re-triggers AFA.
3. Cancel or withdraw. In the same mandates section, select the standing instruction and choose cancel or pause. Confirm with an OTP. Once cancelled, no further debit can be pulled on that mandate.

If your bank app does not show a mandate you know exists, ask the bank's PIO-equivalent grievance desk in writing - and read how to escape a subscription auto-debit trap before the next billing date.

The framework keeps the protection that made e-mandates safe in the first place. Before every debit, the issuer (your bank or card network) must send you a pre-debit notification at least 24 hours in advance. That notice must give you an option to opt out of that specific debit. After the money moves, you also get a post-debit notification.

This is your early-warning system. If a pre-debit alert shows an amount or merchant you do not recognise, act on the opt-out before the 24 hours run out - do not wait for the debit.

1. Use the pre-debit opt-out. The fastest stop. Decline the specific debit from the notification when the 24-hour window is open.
2. Cancel the mandate. In your bank or UPI app, cancel the standing instruction so no future cycle can run.
3. Tell your bank in writing. If the app fails, instruct your bank in writing to stop the mandate and to reverse a wrong debit. Keep the acknowledgement.

If money was pulled fraudulently or without a valid mandate, see how UPI auto-pay mandate fraud works and how to fight it and the steps to recover money lost in a UPI fraud.

If your bank does not resolve a wrong or unauthorised auto-debit, escalate. First, file a written complaint with the bank and wait for its reply or 30 days, whichever is earlier. If you are not satisfied, take it to the RBI Ombudsman under the Reserve Bank - Integrated Ombudsman Scheme, 2021 (RB-IOS 2021), the RBI's free dispute-redress route for banking and payment grievances. For a full walkthrough, read the banking ombudsman complaint guide.

For the bigger picture on filing complaints and using your information rights against any public authority, keep The RTI Playbook handy.

No - not for the recurring debit itself, as long as each instalment is within the no-OTP limit. For SIPs, insurance premiums and credit card bills that limit is ₹1,00,000 per transaction. You only enter an OTP when you first register the mandate or later modify or cancel it.

₹15,000 per transaction for general recurring debits such as OTT subscriptions, utility bills and EMIs. Below that, each cycle's debit runs without an OTP. A single debit above ₹15,000 still needs an OTP for that transaction, unless it falls in the ₹1,00,000 category for SIPs, insurance or credit card bills.

No. You get a pre-debit notification at least 24 hours before every debit, with an option to opt out of that debit. You can also modify or cancel the mandate at any time, and that change requires a one-time OTP. The OTP-free part covers only the routine execution within the limit.

No. Under RBI's Digital Payments E-mandate Framework, 2026, banks and merchants cannot charge customers for the e-mandate facility. If you see a charge labelled for setting up or maintaining a standing instruction, raise it with your bank and, if unresolved, with the RBI Ombudsman under RB-IOS 2021.

Yes. The framework covers cards, Prepaid Payment Instruments (wallets) and UPI. So a UPI AutoPay mandate, a wallet standing instruction and a card-based recurring payment all follow the same AFA limits and the same 24-hour pre-debit notice rule.