How to Take Recurring Payments in India — UPI AutoPay, Card Mandates and e-NACH

If you are building a subscription product for Indian customers, the first thing to unlearn is the model most billing tutorials assume: save the card, charge it on the first of the month, retry if it fails. That does not work here, and has not for years.

In India, every recurring debit runs through a mandate the customer has registered and authenticated. Their bank tells them at least 24 hours before each charge, and lets them cancel that one charge or the whole mandate from the notification. Above ₹15,000 per transaction, most charges need the customer to authenticate again. Your billing system has to be designed around those three facts. If it is not, involuntary churn shows up in your dashboard as "payment failed" and nobody can work out why.

This post covers what the rules currently say, which payment rail fits which kind of business, and what changes in the code.

What are the current rules for recurring payments?

On 21 April 2026 the Reserve Bank of India issued the Digital Payments – E-mandate Framework, 2026. It replaces eight separate circulars issued between 2019 and 2024 with one document, and it took effect on the day it was issued. Mostly it consolidates rules that were already in force rather than introducing new ones, which is useful: there is now one primary source to read instead of a trail of amendments.

It applies to recurring transactions made with cards, prepaid payment instruments (wallets) and UPI, domestic or cross-border. The parts that matter to anyone building a product:

Rule	What the framework says
Registration	One-time, and only after the customer completes an additional factor of authentication (AFA) — OTP, UPI PIN, or similar
First charge	Needs AFA, but can be combined with registration
Limit without AFA	₹15,000 per transaction; above that, each charge needs AFA
Higher limit	₹1,00,000 without AFA, but only for insurance premiums, mutual fund subscriptions and credit card bill payments
Pre-debit notice	Issuer notifies the customer at least 24 hours before the debit, with merchant, amount, date, mandate reference and reason
Opting out	Customer can opt out of a single upcoming charge or the whole mandate, at any time
Post-debit notice	Issuer notifies after every debit, including grievance details
Amount	Fixed, or variable up to a maximum the customer sets
Fees	The customer cannot be charged for using the e-mandate facility
Reissued cards	Existing mandates can be mapped to a reissued card

Two lines in that table do most of the damage to naive billing designs: the ₹15,000 ceiling and the per-transaction opt-out. We will come back to both.

One detail on scope. The framework names cards, wallets and UPI. NACH, the bank-account debit system run by NPCI, sits outside it and runs under NPCI's own rules. That turns out to matter for high-value billing.

Which rail should you actually use?

You have three practical options. Most products should offer the first two and add the third only if their ticket sizes need it.

	UPI AutoPay	Card e-mandate	e-NACH
Customer authorises with	UPI PIN in their UPI app	Card OTP or issuer authentication	Net banking, debit card or Aadhaar, depending on the bank
Governed by	RBI e-mandate framework	RBI e-mandate framework	NPCI NACH rules
Where the customer cancels	Their UPI app	Their card issuer	Their bank
₹15,000 AFA ceiling applies	Yes	Yes	No — outside the framework
Best for	Consumer subscriptions, low and mid ticket	Customers who prefer to pay by card	EMIs, B2B retainers, high-value fixed debits

UPI AutoPay is where most Indian consumer subscriptions should start. Setup happens inside an app the customer already uses every day, and there is no card to expire. NPCI's own AutoPay brand guidelines require the customer to be told they can pause or revoke the mandate at any time. That is good for trust and bad for any business model that relies on people forgetting they subscribed.

Card e-mandates are worth having because some customers simply prefer cards. Cards also bring a dependency that UPI does not: under RBI's card-on-file rules, since 1 October 2022 nobody in the payment chain except the card issuer and the card network may store the actual card number. Your gateway holds a token, not the card. If you are migrating a billing system from outside India, any plan that involves your own vault of card numbers is dead on arrival.

e-NACH debits a bank account directly. Because it falls outside the framework, the ₹15,000 re-authentication ceiling does not apply to it, which is why lenders and insurers have used NACH for years. If you bill a business ₹40,000 a month, UPI AutoPay or a card mandate means asking the customer to approve every single charge. NACH does not. The trade-off is a heavier registration flow and less of the instant feel of UPI. How far each bank supports online NACH registration varies by authentication method, and NPCI publishes a live bank status list you should check against your customers' banks before relying on it.

What does the ₹15,000 ceiling mean in practice?

It means a subscription priced above ₹15,000 per charge is not really automatic on UPI or cards. Every renewal needs the customer to act.

The most common way this bites is annual billing. A ₹1,499 monthly plan renews silently. Offer the same thing as a ₹16,000 annual plan with a discount, and every renewal now depends on the customer opening a notification and approving it. Many will not, not because they want to leave but because they missed it. The discount meant to cut churn creates a different kind.

The options, roughly in order of preference:

• Keep each charge under ₹15,000. Offer quarterly rather than annual billing if the annual figure crosses the line.
• Move high-value customers to e-NACH, where the ceiling does not apply.
• Treat the renewal as a sales touchpoint. For B2B, an invoice with a payment link and a human follow-up often works better than an approval prompt nobody is expecting.

The ₹1,00,000 tier sounds like a way out, but it is limited to insurance premiums, mutual fund subscriptions and credit card bill payments. A SaaS product does not qualify.

What changes in your billing code?

This is where most of the engineering effort goes, and where most of the bugs we see come from. Almost none of it is about calling the gateway's API, which is the easy part.

Model the mandate as its own object with its own states. A subscription and the mandate that pays for it are different things with different lifecycles. The mandate can be pending, active, paused, revoked by the customer, or expired. The subscription can be active while its mandate is revoked. If your database has one status column for both, you will eventually charge someone who has left, or cut off someone who is still paying.

Schedule debits with the 24-hour notice built in. The issuer has to notify the customer at least 24 hours before the debit, so you cannot present a charge for a renewal due today. Your gateway handles the actual notification, but your scheduler needs to request the debit early enough. In practice that means one job that requests the upcoming charge and a separate state for "notified, awaiting debit".

Treat a per-transaction opt-out as a decision, not a failure. When a customer declines one upcoming charge from their pre-debit notice, that is not a bank error to retry. It is closer to a cancellation, or at least a pause. Retrying it aggressively annoys the customer and helps nobody. Handle the gateway's event for it separately from insufficient funds or a technical decline.

Set the variable maximum carefully. For usage-based billing, the customer sets a maximum for any single charge. If your pricing changes or a heavy month pushes the bill past that maximum, the debit fails. You need a flow that asks the customer to raise the cap or register a new mandate before the bill arrives, not after.

Plan for price changes. A fixed-amount mandate is for a fixed amount. A price rise means a new mandate, with the customer authenticating again. Budget for losing some customers at that step, and do not raise prices by surprise.

Lean on webhooks, not polling. Mandate registrations, debit results, revocations and pauses all arrive asynchronously. Your system should be driven by the gateway's events, check their signatures, and handle duplicates safely. In our experience, most "the customer was charged twice" incidents come from a non-idempotent webhook handler, not from the gateway.

Most of the gateways serving India offer a subscriptions product that handles the mandate itself. Unless your billing is genuinely unusual, use it and build only the state machine and business rules on top. Writing your own recurring-billing engine on top of raw mandate APIs is rarely worth it below serious scale.

What does it cost?

Less than you would expect from the gateway, more than you would expect in engineering time.

On fees, published pricing is patchy. Razorpay's pricing page lists its Subscriptions product at 0.9% plus platform fees for card mandates. UPI, NACH and e-mandate pricing for Subscriptions is "on request", which in practice means negotiated. The same page lists standard domestic card payments at 2%, with 18% GST on the gateway's fee rather than on the transaction. Cashfree's charges page prices mandates as flat per-registration and per-debit fees rather than a percentage. For high-value charges, a flat fee can come out far cheaper than a percentage, so if your average charge is large, compare the two models on your own numbers rather than on headline rates.

Fees change, so get the "on request" numbers in writing when you decide.

On engineering, the subscription flow is rarely the expensive part of a build on its own. The cost is in the edge cases above: mandate states, opt-outs, cap changes, price changes, and reconciliation between what you think you billed and what actually settled. If you are scoping a product with recurring billing, treat those as their own line items. Our web development ranges assume ordinary checkout; a subscription product with usage-based billing sits higher.

When should you not build automatic recurring billing?

Fairly often.

If most of your charges are above ₹15,000 and your customers are businesses. You are building an elaborate system that ends in an approval prompt every month. Invoices with payment links, a clear due date and a reminder sequence may get you the same collection rate for a fraction of the effort. A CRM or operations system that tracks who has paid is often what the business actually needed.

If your customers already pay you reliably by hand. A tuition centre whose parents pay by UPI on the first of every month without being chased does not have a collections problem. Adding mandates adds friction at signup to solve a problem that does not exist.

If your pricing is still moving. Every price change on a fixed mandate means asking every customer to authenticate again. Settle your plans first.

If the plan depends on customers forgetting. Indian rules are built so that customers see every debit coming and can stop it in one tap. A model that only works if people do not notice will not work here, and should not.

What we could not confirm

NPCI changed the operational rules for UPI AutoPay in 2025 — when mandate debits can be presented during the day, and how many times a failed debit can be retried. Payments press reported specific hours and retry counts, but we could not read the NPCI circular itself, so we have left the numbers out. If your retry logic depends on them, ask your gateway for the current figures in writing. They will have implemented them already.

The ceilings above also come with a caveat: RBI has revised them before, and the 2026 framework is only the latest version. Re-read it before you price a new plan.

Getting it right the first time

Recurring payments in India reward the businesses that design for the customer seeing and approving every charge, and punish the ones that try to work around it. Wiring up the gateway is the small part. The state machine, the opt-out handling and the pricing decisions around the ₹15,000 line are what make it work.

If you are building a subscription product, or moving an existing one onto proper mandates, tell us what you charge and how often. We will tell you which rail fits — including when the honest answer is an invoice and a reminder, not a mandate. For the build itself, see our web application development and e-commerce development work.