RBI E-Mandate Rules (2026) for Foreign Subscription Businesses

RBI e-mandate rules usually reach a foreign subscription business in practice, even with no Indian entity. They bind the Indian bank or app that issued your customer's card or UPI handle, while the acquirer that processes your charges must make sure the merchants it signs up follow them.

The current rulebook is the Digital Payments E-mandate Framework, 2026, which the Reserve Bank of India (RBI) issued on 21 Apr 2026. It took effect immediately, pulled eight older circulars into one set of directions and repealed them, so material that still cites the 2021 rules points to repealed circulars.

What decides whether your Indian renewals go through is a short list of mechanics: how the customer registers, who warns them before each charge, which amounts need fresh approval, and how they can pause or cancel. Each one changes how you price and schedule a subscription in India.

Usually, in practice, though the RBI e-mandate framework never names foreign merchants. Clause 2 applies it to payment system providers and participants processing recurring transactions, "domestic or cross-border", on cards, prepaid instruments (PPIs) and UPI. If your foreign subscription business bills an Indian card or UPI handle, the issuer will generally apply these rules to your recurring payments in India.

The framework reaches you through two parties rather than directly:

• The issuer - the Indian bank or UPI app registers the mandate, checks the customer, sends the pre-debit notice and approves or declines each renewal you submit.
• The acquirer - clause 10(c) says an acquirer "shall ensure compliance with these directions by merchants on-boarded by them", so in practice the duties reach you through your processor's contract.

What the text leaves open matters too. It does not define "cross-border", does not say whether a subscription merchant outside India is covered directly, and does not address cards issued outside India. Ask your compliance counsel to confirm your position before you design billing around any of those points.

Recurring billing in the other direction, from India to overseas clients, follows different rules, covered in international recurring payments.

Most of the work under the framework falls on the issuer, while your duties come through your acquirer's contract.

The Digital Payments E-mandate Framework 2026 is the RBI e-mandate rules update that replaced everything before it. Its reference is RBI/DPSS/2026-27/396, and it consolidates the e-mandate circulars issued since 2019 into one document with 11 clauses. For an overseas merchant, the practical change is that one text now governs cards, PPIs and UPI together.

• One document instead of eight - clause 11 repeals the earlier circulars, including the 31 Mar 2021 framework, the 8 Oct 2021 clarification and the updates of 12 Dec 2023 and 22 Aug 2024.
• Grievance details in the post-debit message - the issuer's message after each charge must now carry grievance redressal details, a point RBI added after feedback.
• Mandates can follow reissued cards - clause 10(b) lets existing card e-mandates be mapped to a reissued card, so a replaced card need not end the subscription.

If your billing logic, help pages or vendor notes still cite the 2021 framework, update them to the 2026 text, which is now the only set of e-mandate RBI guidelines in force. How a recurring payment works covers the basics these rules build on.

An e-mandate is the customer's standing instruction to pay you on a schedule, and it starts with a one-time registration with the customer's issuer. Under clause 4(a), the mandate is registered only after the issuer validates AFA. The framework does not name the factor, though issuers mostly use an SMS one-time password, with 3D Secure on cards and the UPI PIN on UPI.

Registration sets the terms you bill against:

1. Validity period - every mandate states how long it lasts, and the customer can change that period or withdraw at any time.
2. Fixed or variable amount - a mandate covers a set amount or a variable one, and for variable mandates the customer can set the maximum value of any single charge.
3. First charge - the first transaction also needs AFA, but it can be combined with registration when both happen together at checkout.
4. Later changes - the customer can modify or withdraw the mandate later, and an opt-out is validated with AFA.

Plan around the variable-amount option. If you bill by usage or seats, register a variable mandate and ask customers to set a ceiling with headroom, because a charge above their maximum will not go through. Test the flow with real Indian cards before launch.

The issuer sends it, at least 24 hours before each charge. Clause 6(a) says: "An issuer shall send a pre-transaction notification to the customer, at least 24 hours prior to the actual charge / debit." It does not come from the merchant. You trigger the charge, and the customer's bank or app sends the notice.

The notice must show your merchant name, the amount, the date and time of the debit, the mandate reference and the reason for the charge. The customer can opt out of that single charge.

Timing is what catches overseas billing systems. A renewal submitted the moment it falls due leaves the issuer no time for its notice. Submit each renewal at least a day ahead, with a buffer for delays in delivering the notice. If the issuer cannot deliver the notice to the customer, the renewal can decline.

The customer controls the mandate from their issuer's side, and none of it costs them anything. Clause 10(a) bars any charge to the customer for using e-mandates.

• Skip one charge - the customer can opt out of a single upcoming debit, usually from the pre-debit notice, and the mandate stays live.
• Change or withdraw - they can change the validity period or end the mandate at any time.

You typically learn of a cancellation only when your next charge declines with a cancelled-mandate error. Treat it as a hard decline in your dunning flow: stop retries on that error and invite the customer to register again, instead of retrying a mandate that no longer exists.

When Indian renewals fail, the cause is usually one of four things:

• No registered mandate - the charge was submitted without a live e-mandate on the card or UPI handle.
• Notice not delivered - the charge went in too late for the issuer to send its notice at least 24 hours ahead.
• AFA missed - the charge was above Rs 15,000 and the customer did not complete the approval prompt.
• Mandate cancelled - the customer withdrew the mandate, so every retry will keep declining.

Clause 8(a) lets recurring charges go through without AFA up to Rs 15,000 per transaction, and anything above needs AFA each time. Clause 8(b) raises it to Rs 1,00,000 only for insurance premiums, mutual fund subscriptions and credit card bill payments. SaaS, AI, edtech and streaming are not on that list, so you sit on the Rs 15,000 tier.

The limits are set in rupees, and the framework does not say how a USD, GBP or EUR charge is measured against them. Treat the INR equivalent as the working rule and confirm it with your acquirer. These examples are illustrative and priced in INR to keep the arithmetic clean.

Example of a Rs 999 monthly plan renewing under the limit

In this example, a streaming or SaaS plan costs Rs 999 a month, well inside the no-AFA tier.

1. Sign-up - the customer registers the mandate with AFA and pays the first Rs 999 in the same step, which clause 5(a) allows.
2. Monthly renewals - every later charge is under Rs 15,000, so it goes through without AFA as long as the mandate is live.
3. Before each charge - the issuer still sends its pre-debit notification at least 24 hours ahead, and the customer can skip any single month from it.

Example of a Rs 18,000 annual plan needing AFA yearly

In this example, an edtech course or AI tool is billed at Rs 18,000 a year, which sits above the no-AFA tier.

1. Sign-up - registration and the first payment need AFA, exactly as on a monthly plan.
2. Each annual renewal - Rs 18,000 is above Rs 15,000, so the customer must authenticate again every year, not just once at sign-up.
3. Where it fails - if the customer misses the prompt, the renewal declines, so send your own reminder before the date or offer Rs 1,500 a month instead.

Example of a Rs 16,500 upgrade on a monthly plan

In this example, a customer on the Rs 999 monthly plan moves up to a larger plan partway through the term.

1. The upgrade charge - you bill Rs 16,500 as a one-off amount for the change, which is above Rs 15,000.
2. What the issuer asks - that single charge needs AFA, even though the regular Rs 999 renewals do not.
3. How to collect it - ask for the upgrade payment while the customer is still in your app, where they can approve it at once.

The framework covers cards, PPIs and UPI. That decides which payment methods fall under the Rs 15,000 tier and the 24-hour notice, and which sit outside them.

UPI AutoPay suits low-price plans, since many Indian customers pay through UPI apps and renewals under the limit need no fresh approval. For annual plans above Rs 15,000, check whether your acquirer accepts recurring UPI charges at that size; on cards, those renewals go through with AFA each time.

e-NACH, the NPCI e-mandate on a bank account, sits outside this framework, so check its own terms with your provider. If you want to accept UPI AutoPay from overseas, your acquirer must support UPI for merchants outside India.

A second set of cross-border card rules affects Indian cards used to pay an international merchant. The Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (RBI/2025-26/79, dated 25 Sep 2025) apply mainly to domestic payments and sit among the new RBI rules for online transactions that came into force in 2026. Paragraph 10, though, covers card not present (CNP) payments online, where an Indian card pays a merchant served by an overseas acquirer.

By 1 Oct 2026, card issuers were required to have a way to validate non-recurring cross-border CNP transactions when an overseas merchant or acquirer asks for authentication. They also had to put a risk-based check in place for all cross-border CNP transactions, and to register their card number ranges (BINs) with the card networks.

For a foreign subscription business, the duty sits with Indian issuers, not with you, and the validation step applies to non-recurring payments only. Annexure-1 of the same directions lists recurring charges after the first one under the 2026 framework as exempt from two-factor checks. RBI has not said how the risk-based check treats your renewals, so watch your decline codes closely.

Card storage sits under separate RBI recurring payment rules: since 30 Sep 2022, only card issuers and card networks may keep card-on-file data. In practice that means card-on-file tokenisation, so ask your acquirer how it applies to Indian cards saved on your account.

If you want to sell subscriptions to India without setting up a local company, you need an acquirer or PA-CB that holds the Indian side of these rules for you.

A PA-CB is an RBI-authorised company that handles payments between India and other countries. RBI's 2025 rules for payment aggregators allow a PA-CB to sign up merchants located abroad directly for outward payments, with a limit of Rs 25 lakh per transaction.

We built Xflow for this. We hold final PA-CB authorisation from RBI, the fully approved stage past in-principle, as of Feb 2026.

With Xflow, your Indian customers pay with the methods they already use, and you are paid abroad in your own currency:

• Payment methods - Visa, Mastercard and RuPay cards, UPI, UPI AutoPay, card mandates, e-NACH and netbanking, so you can offer UPI AutoPay on small monthly plans and card mandates on annual ones.
• Settlement - funds settle to your overseas account in USD, GBP, EUR, CAD, AUD and more, with T+2 (2 business days) as our standard settlement time.
• No Indian entity - Xflow handles the Indian regulatory steps with its banking partners, while the customer's issuer still sends the pre-debit notice under clause 6(a).

To see how it works for your plans, read about how to accept international payments from India with us, or get in touch with our team.

RBI e-mandate rules usually reach a foreign subscription business through the Indian issuer and your acquirer, even with no Indian entity. Under the 2026 framework, every Indian card or UPI mandate needs one-time registration with AFA, a notice from the issuer at least 24 hours before each charge, and fresh AFA on any charge above Rs 15,000.

Price plans with that limit in mind, submit renewals early enough for the notice, and stop retrying cancelled mandates. Confirm the open points, such as foreign-issued cards and non-INR charges, with your acquirer and compliance counsel.