The Reserve Bank issued the Digital Payments – E-mandate Framework, 2026 on 21 April 2026, effective immediately, consolidating eight separate circulars issued between 2019 and 2024 into a single document. For anyone running a subscription business in India, this is now the reference. The substantive changes are modest — grievance redressal detail and card re-issuance mapping, plus adjustments from stakeholder feedback — but having one document instead of eight is itself worth the re-read.
The framework covers all payment system providers and participants processing recurring transactions, domestic or cross-border, using cards, prepaid instruments or UPI. FASTag and National Common Mobility Card auto-replenishment sit inside the framework with specific exemptions from the pre-transaction notification requirement, which is the sensible accommodation for a top-up that needs to happen at a toll plaza rather than a day later.
Authentication is structured around a one-time registration validated with an additional factor of authentication, after which recurring debits proceed without it up to a threshold. The first recurring transaction requires AFA, though it may be combined with the registration itself. The general threshold is fifteen thousand rupees per transaction. Insurance premiums, mutual fund subscriptions and credit card bill payments carry a higher threshold of one lakh. Above the applicable limit, each debit needs AFA — which in practice means the customer must be present and available, and any product design assuming silent renewal above the threshold will fail.
The pre-debit notification is the requirement most likely to affect your product surface. Issuers must notify the customer at least twenty-four hours before the charge, including the merchant name, the amount, the date and time of the debit, the mandate reference number and the reason. Customers can opt out through an AFA-validated request. The commercial consequence is that every renewal is announced a day in advance, which changes churn behaviour and makes the clarity of your merchant name and billing descriptor a retention issue rather than a cosmetic one.
Mandate lifecycle operations are prescribed too. Customers must be able to modify the validity period or withdraw a mandate at any time, and modifications and withdrawals require AFA validation. Building this properly means treating the mandate as a first-class object in your data model with its own status history, not as a flag on a subscription record — because you will be asked to prove what the customer authorised and when.
For engineering, the practical checklist is short. Confirm which threshold applies to each of your plans, and what happens in the flow when a price rise crosses one. Make the mandate reference visible to support staff, because it is what a customer's bank will ask for. Handle the case where a card is re-issued and mandates need mapping across. And treat a failed debit due to missing AFA as a distinct outcome from a declined payment, because the recovery path for the two is completely different.
