RBI's New Auto-Debit Rule: Your Netflix and SIP Can Now Be Charged Rs 15,000 Without an OTP

RBI issued its Digital Payments E-Mandate Framework, 2026 around April 21-22, 2026, consolidating eight earlier circulars on recurring digital payments into one rulebook. It’s worth reading a full explainer like Upstox’s breakdown of the new e-mandate rules if you want the complete regulatory text rather than just what changes for your monthly bills, which is what this post focuses on.

The headline number: the amount your bank can auto-debit without an OTP for recurring payments has moved up to Rs 15,000. If you have ever wondered why your Netflix, Spotify, or gym app renewal never asks for a one-time password, this is the rule that governs it, and the ceiling under which it operates just got much higher.

What actually changed

Three things matter for your wallet, in order of how much money they touch.

1. The no-OTP ceiling for everyday recurring payments is now Rs 15,000. Any subscription, utility bill, or SIP that debits Rs 15,000 or less per transaction can now go through without you entering an OTP or approving a push notification at the moment of charge. Above that, the bank still needs additional factor authentication (AFA), typically an OTP or an app-based approval.

2. A separate Rs 1 lakh no-AFA threshold exists, but only for three categories: insurance premiums, mutual fund SIP contributions, and credit card bill payments. This isn’t a general limit, and your OTT platform can’t use this window. Larger insurance premiums and SIP instalments frequently exceeded the older cap and had to fall back on manual authentication each cycle, which is a plausible reason RBI carved out a higher, category-specific ceiling instead of raising the general limit all the way to Rs 1 lakh. We haven’t seen an RBI statement spelling out this rationale explicitly, so treat that as a read on why the carve-out exists rather than a quoted regulatory justification.

3. Banks must send a pre-debit alert at least 24 hours before every auto-debit, showing the exact amount, plus a post-debit confirmation after the charge goes through, both with a working way to cancel or opt out. Advance notice existed under older rules too. What the 2026 framework tightens is the specificity: the 24-hour window and the exact-amount disclosure are now explicit requirements, alongside a functioning cancel option rather than a dead link or a “contact customer care” instruction.

It covers UPI AutoPay, NACH-based standing instructions, and recurring mandates set up on debit and credit cards.

The tradeoff: fewer failed payments, more silent charges

The upside is fewer failed payments. A SIP debit or a slightly-late utility bill that used to bounce because it crossed the old, lower cap now has more headroom before you need to step in and manually approve it.

The flip side is that same headroom working against you. A no-OTP debit is one you never actively confirm. More categories of unconfirmed charges now fit under the higher ceiling: annual OTT bundles, premium gym or wellness app plans, co-branded card add-on fees, and SIP top-ups you set up once and forgot about.

The 24-hour pre-debit alert exists to offset this risk, and most people ignore it anyway because it arrives as an SMS or app notification indistinguishable from every other bank alert. That window existed under the old rules too. The change is that RBI has now made the exact-amount disclosure and a working cancel link mandatory parts of it, rather than leaving “advance notice” defined loosely.

Your 24-hour alert checklist

Use this every time a pre-debit alert lands, not just when you’re auditing subscriptions once a quarter.

1. Open the alert immediately. The 24-hour window starts from when the bank sends it. A notification you open on day two of a two-day window has already closed on you.
2. Check the amount against what you expect. A Rs 199 Spotify renewal that suddenly shows as Rs 249, or a gym app that jumped its “annual” tier without telling you, will show up here before it hits your account. This is the cheapest fraud and price-hike check you have.
3. Ask if you still use the service. An alert for a subscription you haven’t opened in three months is your cancel signal today, because next month brings another alert you’ll scroll past the same way.
4. Use the cancel/opt-out link in the alert itself, not a support ticket. The framework requires banks to provide a working cancel option directly in the notification. A missing or broken link is a compliance gap worth flagging to your bank’s grievance channel.
5. If you let it renew, note the date of the next debit. Set a phone reminder for 25 hours before the next expected cycle so you’re not relying on catching the SMS in real time again.

How to check and revoke standing e-mandates right now

Don’t wait for the next alert to audit what you’ve already authorised. Two places to check:

• Your bank’s mobile app or net banking portal. Most major banks now have a dedicated “Manage Mandates” or “AutoPay” section under UPI or card settings, listing every active standing instruction, the merchant, the amount ceiling, and the next debit date. Go through every line, not just the ones you recognise by name.
• NPCI’s UPI AutoPay mandate list inside whichever UPI app you use (Google Pay, PhonePe, Paytm, or your bank’s own app usually has a “Mandates” or “Autopay” tab). This shows UPI-based recurring mandates specifically and lets you pause or revoke them without going through the merchant.

Revoking a mandate you no longer need takes under two minutes and stops the debit at the source, instead of relying on remembering to cancel through the merchant’s own app, which is often a deliberately buried setting.

Once you’ve gone through your mandate list and kept only what you actually use, add those survivors to the SubsCut subscription calculator to see what they actually cost you monthly and annually. It’s a five-minute check that turns “a bunch of small no-OTP debits” into one real number.

If you want a fuller pass at everything currently pulling money from your account on autopilot, our guide on auditing every UPI AutoPay mandate walks through finding and killing the ones you’ve forgotten about, and pairs well with checking your bank’s mandate list right after reading a pre-debit alert.

FAQ

Does the higher Rs 15,000 limit mean my Netflix or gym app can charge me anything up to that amount without warning? No. Even below Rs 15,000, your bank has to send a pre-debit alert at least 24 hours before the charge, with the exact amount and a cancel option. The no-OTP part only removes the OTP popup at the moment of debit. It doesn’t remove your advance notice.

What is the Rs 1 lakh limit and does it apply to my Netflix subscription? No. The Rs 1 lakh no-additional-factor-authentication threshold is specific to insurance premiums, mutual fund SIP investments, and credit card bill payments. Everyday recurring payments like OTT, gym apps, and utility bills stay under the Rs 15,000 ceiling.