RBI asks NPCI to review UPI Autopay amid concerns over unexplained debits

Users of the Unified Payments Interface—a real-time instant payment system developed by the NPCI—began reporting involuntary autopay mandates and an inability to cancel such recurring payments towards the end of 2025.

The surge in such complaints to the cybercrime department prompted the umbrella body—which launched UPI Autopay in 2020 to enable recurring payments for subscriptions, utility bills, insurance premiums, and EMIs—to convene a meeting in December with UPI ecosystem players to assess whether existing auto-pay flows and interface designs were to blame, the people cited above said on the condition of anonymity.

Mint could not independently verify these complaints.

The meeting was part of a series of conversations the NPCI had been holding with third-party application providers (TPAPs), payment gateways, and select merchants to reiterate existing norms and ensure all TPAP operators comply with the framework, one of the persons added.

The NPCI and the Reserve Bank of India (RBI) did not respond to Mint’s emailed queries.

Consumer concerns

Autopay remains one of the fastest-growing use cases on UPI. The rise of digital subscriptions across consumer AI, edtech, fintech, wellness, content, and other sectors has been closely tied to the development of recurring payments infrastructure.

Recurring UPI payments have doubled over the past year, according to NPIC data. The top 10 banks alone processed about 926 million autopay transactions in November 2025, up from 530.5 million a year ago.

Even as adoption has accelerated, some users have raised concerns about how mandates are created, communicated, and cancelled, with complaints focusing on unclear onboarding, limited visibility into active mandates, and difficulty cancelling subscriptions.

“Autopay now processes close to 1 billion recurring transactions monthly and accounts for roughly 5% of all UPI transactions by volume, reflecting rapid uptake of recurring mandates within the UPI ecosystem,” said Ranadurjay Talukdar, partner and payments sector leader, EY India.

Autopay-related issues typically involve mandate cancellation, unexplained debits and interface issues in recurring payment flows. These concerns are broadly similar to those previously observed for mandates set up on cards, which subsequently led to regulatory refinements by the RBI, Talukdar said, citing RBI Ombudsman data.

Consumers complained they were unaware that agreeing to a UPI Autopay mandate authorized automatic recurring debits from their bank accounts, while others reported that a routine one-time payment sometimes triggered a recurring mandate without clear disclosure or an option to decline the facility, according to the second of the three persons.

“Some also assumed that deleting an app would stop deductions, not realizing that mandates operate at the bank level through TPAPs,” the person added. “There have also been instances where users claimed they did not receive clear pre-debit or post-debit notifications from apps, relying instead on bank SMS alerts, which may be overlooked.”

NPCI response

Even before the RBI nudge, the NPCI had begun tightening the Autopay framework as recurring payments grew in size and volume.

In 2023, the NPCI raised the limit for recurring payments to ₹1 lakh per transaction without requiring additional authentication for pre-approved mandates.

In a circular dated 7 October 2025, it directed banks and UPI apps to enable interoperability of UPI Autopay mandates by 31 December 2025. Under the new rules, users must be able to view all their active mandates on any UPI app of their choice, even if those mandates were created on another app. Users will also be able to “port” or shift mandates from one app to another.

TPAPs, or UPI applications, have been asked to provide a dedicated UPI Autopay or “manage accounts” section where users can view, modify, and port mandates.

Porting must be user-driven from the “view mandate” page. The NPCI has barred apps from using cashbacks, pop-ups, or other nudges to push users to migrate mandates, and has prohibited the use of mandate data for purposes unrelated to mandate servicing.

Separately, performance guidelines effective 1 August 2025 changed how Autopay debits are processed. Recurring debits are now to be executed only during non-peak hours, defined as 10am to 1pm and 5pm to 9.30pm, with the remaining hours considered peak. More importantly, each mandate gets one primary attempt and up to three retries per cycle, the NPCI communicated through a compliance notice dated 21 May 2025.

The cap on retries has also led to some disruptions at the merchant end, given that most such mandates go through successfully between the fifth and ninth retrials. Most of these issues are due to server failures, bank-level problems, and challenges with customer balances, and warrant multiple retries, said the third person.

The NPCI has also directed banks to display available account balances in every successful UPI transaction message, and has introduced a chatbot-based UPI Help portal that allows users to track and cancel mandates. The centralized portal for e-mandate management is aimed at ensuring clear consent and notification frameworks, providing online grievance channels and allowing users to access all mandates in one place.

However, the first official quoted above said such tools are useful only if users are aware that an active mandate exists in the first place.