UPI AutoPay — meaning and mechanics
How a UPI AutoPay mandate is created
- The merchant initiates a mandate creation request specifying amount, frequency (one-time, daily, weekly, monthly, etc.) and validity window.
- The user receives the mandate request inside their UPI app (Google Pay, PhonePe, Paytm, BHIM, bank UPI app).
- The user authorises the mandate using their UPI PIN — this is the single PIN-entry moment.
- The bank stores the mandate in NPCI's mandate registry against the user's account.
- On each subsequent debit date, the merchant fires the request; the bank executes the debit automatically; the user is notified.
Per-debit limits
NPCI runs a two-tier ceiling on UPI AutoPay. The standard limit is ₹15,000 per debit without additional 2-factor authentication. NPCI has progressively enhanced this to ₹1,00,000 per debit for specific Merchant Category Codes (MCCs) where larger recurring debits are routine — including credit card bill payments (MCC 5413), insurance premiums, mutual fund SIPs, and certain education and healthcare categories. Transactions above the applicable ceiling require the user to enter their UPI PIN at execution time.
NPCI keeps expanding both the cap and the eligible MCC list — verify the current limit, eligible categories, and any execution-time windows (mandates are processed in non-peak hours per current NPCI guidelines) at npci.org.in/product/autopay before relying on it for product design.
Where AutoPay is used today
- OTT subscriptions (Netflix, Hotstar, Amazon Prime renewals)
- Mutual fund SIPs and insurance premiums
- Loan EMIs (consumer durable EMIs, BNPL, personal loans)
- Utility bills (electricity, gas, mobile postpaid)
- Co-working / co-living rent
- Pre-checkout intent products (commitment-mandate categories like Zlash Drop)
User controls
Every active mandate is visible inside the UPI app under "Manage Mandates" or "AutoPay". Users can pause, modify the cap, or revoke mandates at any time. The revocation propagates to NPCI's registry instantly, so the merchant's next debit will fail if the user has revoked. This is the key difference from a one-time UPI payment: the standing authorisation persists, but the user remains in control.