UPI AutoPay Limit Explained: Rs 15,000, Rs 1 Lakh and Mandates

The UPI AutoPay limit is Rs 15,000 per debit for most payments: up to that amount, a recurring payment runs on its own after you approve the mandate once. Above it, you approve each debit with your UPI PIN. This guide explains that rule as the payer sees it, then the mandate ceilings a business has to design around. The rules come from RBI’s e-mandate framework, checked on 14 November 2026, plus what we measured on Voroa’s own live billing.

What does “amount up to Rs 15,000 will be auto paid” mean?

It means each debit of Rs 15,000 or less will go through automatically, without asking for your UPI PIN again. It does not mean Rs 15,000 will be taken. The merchant debits only the amount due, and RBI requires them to tell you at least 24 hours before each debit. A debit above Rs 15,000 waits for your approval.

The same answer covers “setting an AutoPay of Rs 15,000 means”. You are setting a maximum, not a charge. A Rs 499 monthly plan on a Rs 15,000 mandate still costs Rs 499 a month.

Google Pay’s help page says the same thing from the app’s side: if the mandate amount is less than Rs 15,000, you enter your UPI PIN only for the first payment; if it is more, you enter your PIN each time a payment is due.

What is the UPI AutoPay limit in 2026?

RBI’s Digital Payments - E-mandate Framework, 2026, issued on 21 April 2026, sets two numbers:

The framework says “All recurring transactions may be authorised without AFA up to ₹15,000/- per transaction”. AFA means an additional factor of authentication, which on UPI is your PIN. The first debit under a new mandate always needs your approval, whatever the amount.

The history explains why so many pages show different numbers. RBI raised the figure from Rs 5,000 to Rs 15,000 in June 2022, added the Rs 1,00,000 categories in December 2023, and folded both into the 2026 framework.

How many AutoPays can you set, and how many run in a day?

We could not find a fixed number in RBI’s 2026 framework or in any NPCI page we could read. The framework’s section on transaction limits gives the Rs 15,000 and Rs 1,00,000 amounts, but no count of mandates per person and no count of AutoPay debits per day. So you can have several AutoPays at once, one per merchant or service.

What does limit a day’s debits:

• Your bank’s daily UPI limits. Each bank sets how much, and how many UPI payments, an account can make in a day. Check your bank’s app for your own numbers.
• Each mandate’s own maximum. A debit above the amount you approved is refused.
• Retry rules. Under NPCI rules reported from August 2025, a failed debit gets at most one original attempt plus three retries, run outside peak hours.

If an app or website quotes a fixed daily count of AutoPays, ask which rule it comes from. We did not find one in the official texts.

Why a business sees more than one “UPI AutoPay limit”

If you sell a subscription in India, the payment rail decides a large part of how much you can charge a customer every month. Each recurring method carries a ceiling on the mandate amount, the ceilings are far apart, and you cannot negotiate any of them.

Short answer: for a business, “the UPI AutoPay limit” is three different numbers. Rs 15,000 is the RBI threshold above which the customer must approve each debit. The mandate ceiling is higher: our gateway accepted UPI mandates up to Rs 1,00,000 for our merchant category. UPI Reserve Pay, a different product, has a far lower cap.

Most guides quote one of these numbers and call it “the limit”. We did too, in the first version of this post, and we were wrong. Here is what each number actually means.

What a mandate actually is

A recurring charge in India is two separate things. The mandate is the customer’s standing permission, registered once, that names a maximum amount. The debit is each individual charge against it. A debit is allowed only if it fits within the mandate’s maximum.

That word maximum trips people up. You are not registering “Rs 1,999 a month”. You are registering a ceiling that every future debit must fit under. Get the ceiling wrong at registration and the failure does not appear until month four, when the customer adds a service and the debit finally exceeds what they once authorised.

Mandates come in two shapes. A fixed mandate debits the same amount every cycle, which suits a flat subscription. A variable mandate lets each debit change, up to the maximum, which is what usage-based or multi-service billing needs. Either way, the maximum is the number that matters.

The three numbers people call “the UPI AutoPay limit”

Rs 15,000: the authentication threshold, not the mandate ceiling

RBI’s e-mandate framework lets a registered mandate run recurring debits without fresh customer authentication only up to a threshold. RBI raised it from Rs 5,000 to Rs 15,000 in June 2022. In December 2023 it raised the figure to Rs 1,00,000 for three categories only: mutual fund subscriptions, insurance premiums and credit card bill payments. The April 2026 framework keeps both numbers. A SaaS subscription is not one of those categories.

Above the threshold, the mandate still works, but each debit needs the customer to approve it. For a subscription business, that means a renewal above Rs 15,000 is no longer truly automatic.

Rs 1,00,000: the mandate ceiling we measured

The mandate ceiling is a separate number: the maximum the customer authorises when they set up the mandate, which every later debit must fit under. Voroa sizes that maximum to your bill, not to the rail’s limit. In September 2026 we registered UPI AutoPay mandates against our live account: Rs 1,00,000 was accepted, and Rs 2,00,000 was refused with an error saying the amount “cannot be greater than Rs. 100000.00 for this merchant category code”.

Note the last four words. The ceiling depends on your merchant category code (MCC), so a business in another category can see a different number. Treat ours as one measurement, not a universal rule. RBI’s 2026 framework does not print a single mandate maximum either; it refers to “the overall cap fixed by the RBI” for variable mandates without stating it on that page.

UPI Reserve Pay: the trap we fell into

UPI Reserve Pay (NPCI calls it Single Block Multiple Debit, or SBMD) looks similar but behaves differently. Instead of permission to debit later, it blocks money in the payer’s account up front, and its cap is far lower than the AutoPay ceiling.

Our first integration requested Reserve Pay by accident: one token-type field in the order told the gateway to create an SBMD mandate instead of an AutoPay one. The gateway reported a Rs 15,000 SBMD maximum, the payer’s app showed “UPI Reserve Pay” on the approval screen, and setup failed. We read that error as “UPI AutoPay is capped at Rs 15,000” and published it here. The fix was to stop sending that field.

If your gateway quotes a UPI ceiling in error text, check which product the order actually requested before you design around the number.

Other e-mandate rules that affect renewals

The amount limits are not the only RBI rules that shape a recurring charge. Four more decide whether a renewal goes through on time:

• Registration needs authentication. The customer approves the mandate once, with their UPI PIN or a card OTP. Changing or cancelling it needs authentication too.
• The first debit needs authentication. RBI’s 2026 framework says the first transaction under an e-mandate requires it, even below Rs 15,000. It can be combined with registration when both happen together.
• Every debit needs a pre-debit notification. The customer must be told about each debit at least 24 hours before it runs, so your billing schedule has to send the notice a day ahead.
• The customer can cancel at any time. They can withdraw the mandate, or opt out of a single debit, from their UPI app or card issuer, so a registered mandate never guarantees payment.

UPI, card and eNACH ceilings Voroa measured

The Rs 15,000 authentication threshold applies on top of the card and UPI ceilings. A card mandate can be registered for Rs 2,00,000, yet a Rs 20,000 debit against it still needs the customer to approve it. We have not yet run a debit above Rs 15,000 ourselves, so we describe that rule from RBI’s text, not from our own measurement.

The regulator and the networks revise these numbers, and your category can change which one applies. Confirm the current figure with your own gateway before you build around it.

Example: a Voroa bill that outgrows its mandate

The ceiling applies to the consolidated debit, not to one line item. If a customer runs four services and you bill them on one mandate, what matters is the total, with tax.

Work an example. A plan at Rs 1,999 plus 18 percent GST is Rs 2,359 a month: inside every ceiling and below the authentication threshold, so it renews silently. A plan at Rs 29,999 plus GST is Rs 35,399. It fits a UPI mandate on our category, but it is above Rs 15,000, so every renewal waits for the customer to approve it. A bill of Rs 1,50,000 a month cannot go on a UPI mandate at all on our category, however the customer feels about it.

So the method is not a preference you collect at signup and forget. It is a function of what the customer will eventually owe. Two design consequences follow:

1. Check the cap against the projected debit, not the first one. The first order is almost always the smallest. If you validate only at registration, you have validated the easiest case and shipped a bug that fires months later.
2. Re-check on every change that moves the bill. Adding a service, changing a plan or a tax change can push a consolidated debit past a ceiling, or past the authentication threshold, that was fine when the mandate was registered.

How to avoid failed UPI AutoPay renewals

The worst version of this bug is the quiet one: the mandate registers, months pass, the debit is attempted, the rail refuses it, and the first person to find out is a customer whose service was suspended for a payment they never had a chance to make.

The fix is unglamorous. Compute the projected consolidated debit before registering a mandate, compare it to that method’s ceiling, and if it does not fit, say so at the point of choice, while the customer is still on the page. “This plan needs a card or bank mandate” is a fine sentence to show someone. A suspended service four months later is not.

For debits above the authentication threshold, plan for the approval step: send the pre-debit notice early, and give the customer a payment link as a fallback if they miss the approval.

What happens when a UPI AutoPay debit fails

A debit can still fail inside every limit: low balance, a revoked mandate, or a bank decline. Under NPCI rules in force since August 2025, as reported by banks and legal publishers:

• Four attempts at most. One original debit plus three retries; after that, the debit is dropped.
• Off-peak windows only. Recurring debits may run before 10:00 AM, between 1:00 PM and 5:00 PM, or after 9:30 PM, not in the busy hours between.

So retries are a scarce resource, not a loop you can run until the money arrives. Schedule them in allowed windows, spread them over days rather than minutes, and switch the customer to a payment link before the last attempt is spent.

How Voroa enforces mandate limits in code

Every mandate rule lives in one module, and every caller reads its ceiling from there. That sounds like ordinary hygiene, and it is, but it exists because of a specific failure: the cap was once written in three places, one was edited, and the other two kept the old value. The rule that replaced it is simple: one home for the number, and nobody gets a local copy.

The ceilings themselves are a constraint, not configuration. Each one sits in code next to the probe that established it, and none is editable from an admin panel, because raising one in our own code would not raise it at the network. It would only move the failure from our validation to the rail, where it costs a customer instead of a build. What we can set is a lower limit of our own, and whether a method is offered at all.

The lesson from getting Rs 15,000 wrong is the one we now apply to every payment limit: a ceiling is a measurement, not something you read in a document.

Frequently asked questions

What is the UPI AutoPay limit in India?

Rs 15,000 per debit for most recurring payments: up to that amount, debits run without your UPI PIN after the first one. Insurance premiums, mutual fund subscriptions and credit card bills go up to Rs 1,00,000. Above the limit, AutoPay still works, but you approve each debit. The mandate itself can be set higher; our gateway accepted Rs 1,00,000 for our merchant category.

Can UPI AutoPay charge more than Rs 15,000?

Yes, if the mandate allows it. RBI’s Rs 15,000 figure is not a ban on larger debits. It is the point above which you must authenticate each debit, for example with your UPI PIN. The payment goes through once you approve it, but it is no longer fully automatic.

Will the full mandate amount be debited every month?

No. The mandate amount is a maximum. The merchant debits only what you owe for that cycle, and must notify you at least 24 hours before each debit, so you can check the amount or opt out.

What is the difference between UPI AutoPay and UPI Reserve Pay?

UPI AutoPay registers permission to debit later, up to a maximum, and money stays in the customer’s account until each debit. UPI Reserve Pay, also called Single Block Multiple Debit, blocks the amount in the customer’s account up front and lets the merchant debit against that block. Its cap is far lower than AutoPay’s.

Which recurring payment method should an Indian SaaS business use?

Lead with UPI AutoPay for bills that stay under Rs 15,000 a cycle, since customers already use it and renewals stay automatic. Offer a card mandate for larger bills or customers who prefer cards, and eNACH for enterprise or annual contracts where the amount exceeds what UPI and cards allow.

What happens if a UPI AutoPay payment fails?

The merchant can retry, but NPCI rules since August 2025 allow at most four attempts per debit: the original plus three retries, run only in off-peak windows. After that, the debit is dropped. A well-run billing system tells the customer early and offers a one-off payment link before the retries run out.

Further reading

• RBI, Digital Payments - E-mandate Framework, 2026 (21 April 2026), which sets the Rs 15,000 and Rs 1,00,000 thresholds, first-debit authentication and the 24-hour notice
• RBI circular of December 12, 2023 on processing e-mandates for recurring transactions, which added the Rs 1,00,000 categories
• UPI AutoPay for cloud hosting: mandates, limits and what breaks, how Voroa sizes a mandate
• Summary of UPI changes from August 1, 2025, including AutoPay retries and time windows
• Paying a renewal by payment link when an auto-debit does not go through
• Add a payment method on Voroa