RBI mandates additional factor authentication for e-mandates

This comes under the Reserve Bank of India’s (RBI) Digital Payments – E-mandate Framework, 2026, issued on April 21, 2026, and effective immediately. The directions consolidate all previous RBI circulars on recurring online payments made through cards, prepaid payment instruments (PPIs), and UPI, including for domestic and cross-border transactions.

An e-mandate is a standing instruction that lets merchants automatically charge customers for recurring payments. Additional factor authentication (AFA) is an extra layer of verification, such as an OTP, used to authenticate digital payment transactions.

Registration and revocation of e-mandates

• Customers must complete a one-time registration process.
• Issuers must validate registration using AFA, in addition to normal checks.
• Every e-mandate must specify a validity period.
• Customers must be able to modify the validity or withdraw the e-mandate at any time.
• Issuers must clearly communicate this facility at registration.
• E-mandates can be for a fixed amount or a variable amount.
• For variable mandates, customers must be able to set a maximum transaction value.
• Customers must be able to choose or change how they receive pre-transaction alerts (SMS, email, etc.).
• Any modification or withdrawal of an e-mandate requires AFA.

First and subsequent recurring transactions

• The first transaction under an e-mandate requires AFA.
• If processed during registration, AFA for both may be combined.
• Payments under e-mandates will not be subject to any other customer-set limits or controls.

Pre-transaction notifications must be sent at least 24 hours before debit. It must include the merchant’s name, amount, date or time of debit, mandate reference number, and reason for debit. Customers must be able to opt out of a specific transaction or the mandate using AFA. This requirement does not apply to auto-replenishment of FASTag and National Common Mobility Card (NCMC) balances.

Post-transaction notifications: Issuers must send a post-transaction alert after debit. It must include the merchant’s name, amount, date and time of debit, transaction and mandate reference numbers, reason for debit, and grievance redressal details.

Transaction limits and velocity checks: Issuers can process recurring transactions of up to Rs 15,000 per transaction without AFA. Transactions above this require AFA. However, insurance premiums, mutual fund subscriptions, and credit card bill payments can be processed without AFA up to Rs 1 lakh per transaction.

Dispute resolution and other provisions: Issuers must set up a grievance redressal system for customer complaints. RBI’s rules on limiting customer liability for unauthorised transactions also apply to recurring payments. They cannot charge customers for using the e-mandate facility. They can map existing card-based e-mandates to reissued cards, and acquirers must ensure that merchants comply with these…