The Reserve Bank of India (RBI) has issued the "Digital Payments - E-mandate Framework, 2026," consolidating and updating all previous circulars regarding recurring digital transactions.
The process for auto-debits across cards, Prepaid Payment Instruments (PPIs), and UPI has been standardised. The framework mandates a one-time registration process involving Additional Factor of Authentication (AFA), ensuring that no recurring payment is initiated without explicit, verified customer consent.
A key change is the introduction of tiered AFA-free thresholds. While most recurring transactions remain capped at ₹15,000, essential financial payments such as insurance premiums, mutual fund subscriptions, and credit card bills can now be processed without AFA up to ₹1,00,000 per transaction.
To protect consumers, issuers must send a pre-transaction notification at least 24 hours before the actual debit, providing an "opt-out" facility for that specific transaction. Notably, the framework exempts FASTag and NCMC auto-replenishments from the pre-notification requirement to ensure seamless transit and toll operations.
Overall, the framework reflects a shift toward balancing convenience in digital payments with explicit user control and security safeguards.
Key Provisions of the 2026 Framework
One-Time Registration: Mandatory AFA validation for the first transaction and any subsequent modification or withdrawal of the mandate.
AFA-Free Limits: Standard cap of ₹15,000; increased cap of ₹1,00,000 for insurance, mutual funds, and credit card payments.
Pre-Transaction Alerts: Issuers must notify customers via SMS or email at least 24 hours prior to debit with details of the merchant, amount, and reference number.
Opt-out Facility: Customers can skip a particular payment or withdraw the mandate entirely through an AFA-validated process.
Exemptions: Pre-transaction notifications are not required for FASTag and National Common Mobility Card (NCMC) auto-top-ups.
Zero Charges: No fees can be levied on customers for availing or registering the e-mandate facility for recurring payments.
Dispute Redressal: Consolidates customer liability protections for unauthorized transactions under the recurring payment umbrella.
What is an "Additional Factor of Authentication (AFA)"?
Additional Factor of Authentication (AFA) is a security layer that requires a user to provide a second piece of evidence to verify their identity before a transaction is completed. Commonly known as "Two-Factor Authentication," this usually involves something you know (like a password or PIN) and something you have (like an OTP sent to your phone or a fingerprint).
Under the 2026 Framework, AFA is required to "set the lock" on an e-mandate. Once the lock is set, smaller payments can pass through automatically, but any change to the lock, or very large payments, requires the user to provide that second factor again.
Policy Relevance
Reduces Transaction Friction: By increasing the AFA-free limit to ₹1 lakh for insurance and mutual funds, the RBI is facilitating smoother long-term wealth creation and risk management for retail investors.
Enhances Digital Trust: The mandatory 24-hour pre-notification ensures that customers are never "surprised" by an auto-debit, directly addressing the common grievance of hidden or forgotten subscriptions.
Promotes Transit Efficiency: Exempting FASTag and NCMC from pre-alerts prevents delays in toll and metro gates, ensuring that "auto-replenish" functions remain instantaneous.
Ensures Ecosystem Uniformity: Standardising rules across cards, UPI, and wallets reduces compliance complexity for payment providers.
Builds Trust in Auto-Debits: Clear consent architecture and zero charges reduce user hesitation toward recurring digital payments.
Follow The Full Update Here: RBI Digital Payments – E-mandate Framework, 2026