Your recurring UPI or card autopay mandate runs without a one-time password only up to ₹15,000 a transaction. Above that, you have to approve it. RBI says it plainly in its Digital Payments – E-mandate Framework, 2026 (RBI/DPSS/2026-27/396, 21 April 2026). “All recurring transactions may be authorised without AFA up to ₹15,000/- per transaction.” And: “Transactions above this amount shall be subject to AFA.”
Three categories get a much higher ceiling. Insurance premiums, mutual fund subscriptions and credit card bill payments “may be made without AFA up to ₹1,00,000/- per transaction”. That is why your SIP debits silently and your gym membership does not.
What are the rules that actually govern your autopay mandates?
Most people meet the e-mandate rules only when a payment fails. Learn them before that happens. They give you rights the app does not advertise.
| Rule | What it says | Applies to |
|---|---|---|
| Setting up a mandate | Requires additional factor of authentication, on top of the issuer’s normal process | Every e-mandate |
| Standard AFA-free ceiling | Up to ₹15,000 per transaction | All recurring transactions |
| Higher AFA-free ceiling | Up to ₹1,00,000 per transaction | Insurance premiums, mutual fund subscriptions, credit card bill payments |
| Pre-debit notification | At least 24 hours before the charge, naming the merchant, amount, date, reference and reason | Every e-mandate debit |
| Cancelling or changing a mandate | The issuer must let you modify the validity period or withdraw it “at any point of time” | Every e-mandate |
The 24-hour notice is the rule worth remembering. It exists so no subscription can debit you by surprise. If a merchant is charging you without that notice arriving, your bank is in breach, not just the merchant.
How do you stop a subscription that will not let you cancel?
Go to your bank or card issuer, not the merchant. The framework requires the issuer to give you a facility to withdraw the mandate at any time. That right sits with the issuer. It cannot be handed back to the company charging you.
This matters because the standard runaround is circular. The app says contact support. Support does not reply. Meanwhile the debit repeats. Cancelling at the mandate level ends the debit, whatever the merchant does. You may still owe the merchant money contractually. That is a separate argument, and a much better one to be having.
Modifying a mandate needs authentication again, so keep your registered phone reachable. And read the pre-debit notification when it arrives. It is the only place the amount is shown before it leaves your account.
What happens when a UPI payment fails and the money is debited?
It comes back automatically, and if it is late the bank owes you money. RBI’s turnaround-time circular (RBI/2019-20/67, DPSS.CO.PD No.629/02.01.014/2019-20, 20 September 2019) sets the deadlines and the penalty.
| Failure | Reversal deadline | Compensation if missed |
|---|---|---|
| UPI fund transfer: account debited, beneficiary not credited | T + 1 day | ₹100 per day of delay |
| UPI merchant payment: account debited, merchant not confirmed | T + 5 days | ₹100 per day of delay |
| Card payment at a shop: account debited, no confirmation | T + 5 days | ₹100 per day of delay |
| Online card payment: account debited, no confirmation | T + 5 days | ₹100 per day of delay |
The circular is explicit about who has to act. Where compensation is due, “the same shall be effected to the customer’s account suo moto, without waiting for a complaint”. You do not have to ask. In practice you often do have to ask, and the circular reference is what makes the asking work.
Notice the asymmetry in that table. A person-to-person UPI transfer must reverse in one day. A merchant payment gets five. So a payment stuck at a shop is not a bank error until day six.
Are wallet balances protected the way bank money is?
On fraud, yes. RBI’s customer protection circular of 6 July 2017 (RBI/2017-18/15) covers prepaid payment instruments alongside bank accounts. Report an unauthorised transaction within three working days of the bank’s alert and your liability is nil. Report on day four to day seven and it is capped at ₹10,000 for a prepaid instrument or gift card.
On everything else, no. A wallet balance is not a deposit. It earns you nothing. It is not covered by deposit insurance the way a bank balance is. Money sitting in it is money you have lent to a company for free. Keep the balance small. The convenience is real. The float is a gift you are making.
Full liability rules, including the ten-working-day refund deadline, are on our page about credit card fraud and chargebacks. The same circular governs both.
Which rail should you use for which payment?
Speed is no longer the deciding factor. All the main rails are fast. It is about what happens when something goes wrong, and about the ceiling.
UPI suits everyday payments and transfers between people. It has the tightest reversal deadline of any rail. For large one-off transfers, the older bank rails are still the right tool. A property advance, say, or a tax payment. The ceilings are higher and the paper trail is cleaner. Our page on NEFT, RTGS, IMPS and UPI compares them properly.
Cards are better for anything you might need to dispute with a merchant. The chargeback machinery exists there. It does not exist on UPI in the same form. A UPI payment to a fraudster is very hard to claw back. A card payment to the same fraudster is not easy, but it is possible.
What are the current UPI transaction limits?
We are not printing them, and the reason is specific. Per-transaction and per-day UPI limits are set by NPCI, and they vary by bank, by app and by payment category. NPCI’s own site returned an access error on 7 September 2026. We could not read the current figures at source.
Every number you will find elsewhere is copied from a copy. Check the limit inside your own UPI app, under the account or payment settings, or ask your bank. Your bank’s limit is the one that will actually stop your payment, and it is frequently lower than the network maximum.
Frequently asked questions
Can my bank charge me for UPI payments?
Person-to-person and person-to-merchant UPI payments have been free to the payer. What is not free is what sits behind some UPI flows. A credit line, say, or a card linked to the handle. Read the notification before confirming a large payment. Does a charge appear that you did not agree to? That is a grievance for your bank, and it must respond within 30 days.
Why did my SIP debit go through without an OTP but my ₹20,000 rent autopay did not?
Because of the category rule. Mutual fund subscriptions sit in the ₹1,00,000 AFA-free bracket under the 2026 e-mandate framework. Rent does not, so anything above ₹15,000 needs authentication each time. It is not your bank being inconsistent. It is the framework working as written.
Money left my account but the merchant says it was not received. What do I do?
Wait out the deadline first. For a merchant payment the reversal window is five days, and most reverse automatically. Raise a complaint with your bank on day six, quote RBI/2019-20/67, and ask for the ₹100 per day compensation. Keep the UPI reference number. It is the only identifier both banks can trace.
Is a UPI payment made by mistake to the wrong person recoverable?
Only with the recipient’s cooperation, and that is the honest answer. A successful transfer to a valid account is not a failed transaction, so the auto-reversal rules do not apply. Raise it with your bank immediately. File on the National Cyber Crime Reporting Portal if you were deceived into paying. Our page on UPI fraud covers the reporting route in detail.
Should I keep autopay on for my credit card bill?
Yes, if you set it to the full statement amount rather than the minimum due. Autopay on the minimum due is the most expensive default in Indian consumer finance. It protects your credit record. Meanwhile the rest of the balance revolves at credit card interest. Autopay in full removes the late fee risk entirely, and the ₹1,00,000 AFA-free ceiling means it rarely needs your intervention.
Sources
- Reserve Bank of India, Digital Payments – E-mandate Framework, 2026, RBI/DPSS/2026-27/396, 21 April 2026. Primary. Read 7 September 2026.
- Reserve Bank of India, Harmonisation of Turn Around Time and customer compensation for failed transactions, RBI/2019-20/67, DPSS.CO.PD No.629/02.01.014/2019-20, 20 September 2019. Primary. Read 6 September 2026.
- Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, 6 July 2017. Primary. Read 6 September 2026.
- NPCI UPI limits: not cited. npci.org.in returned HTTP 403 to us on 7 September 2026, so no NPCI figure appears on this page.
Related reading
Best Budgeting Apps in India
The one rule that separates a safe budgeting app from a dangerous one: how it reads your bank data.
6 Sep 2026 · 4 min
Building an Emergency Fund
How many months of expenses to hold, where to park the money, and why the ₹5 lakh deposit insurance limit shapes the plan.
7 Sep 2026 · 5 min
Claiming a Deceased Relative’s Assets
The document trail for banks, demat accounts and insurers, and why a nominee is not an heir.
7 Sep 2026 · 5 min