Whalesbook
The Regulatory Spotlight on Recurring Payments
The Reserve Bank of India (RBI) has initiated a review into a notable increase in user complaints regarding Unified Payments Interface (UPI) Autopay functionalities. The directive, aimed at the National Payments Corporation of India (NPCI), focuses on issues such as erroneous recurring debits and the reported difficulties users face in canceling these automated mandates. This escalation in grievances, some of which have been flagged with cybercrime authorities, suggests a growing friction point within India's otherwise highly successful digital payments infrastructure. NPCI, the architect of UPI and UPI Autopay (launched in 2020), convened stakeholder discussions in December 2025 to pinpoint whether systemic gaps in mandate processing or user interface design are contributing factors.
UPI Autopay's Rapid Ascent and Emerging Pains
UPI Autopay has witnessed an exponential surge in adoption, fundamentally reshaping the recurring payments segment. By January 2025, it accounted for over 53% of recurring transactions, a significant leap from 33% a year prior, processing 175 million transactions that month alone, a threefold increase [4, 5]. This growth underscores a seismic shift from traditional card-based recurring payments [4]. NPCI data shows transaction volumes doubling year-on-year, with hundreds of millions of recurring payments processed monthly by the top ten banks by November 2025 [8, 27]. However, this rapid scaling has coincided with a rise in user complaints, highlighting issues beyond simple user error. Reported problems include unexpected charges, money debited even after app deletion, and insufficient alerts before transactions [27]. While insufficient funds, technical glitches, and expired mandates remain common reasons for payment failures, concerns are mounting that design ambiguities and unclear consent mechanisms may be exploited [12, 13, 21, 33].
Navigating the Complex Fintech Regulatory Maze
India's digital payments ecosystem operates under a multifaceted regulatory framework spearheaded by the RBI and managed by NPCI, which oversees critical retail payment systems [7, 19, 20]. The fintech sector, while rapidly innovating, grapples with constantly evolving regulations, multiple oversight bodies, and significant cybersecurity threats [2, 3, 6, 32, 38]. Recent regulatory actions, such as new UPI rules implemented in October 2025, introduced measures like deactivating inactive UPI IDs and tightening auto-pay norms to combat fraud [34]. NPCI itself has been examining changes to UPI Collect and Autopay features, not solely due to fraud but also because of design gaps leading to unintended payments and complaints, pushing for clearer disclosures on mandate frequency, duration, and total exposure [33, 35]. The RBI's current focus on UPI Autopay issues reflects a broader trend of regulators balancing the imperative to foster innovation with the critical need to ensure consumer protection and maintain trust in the digital financial infrastructure [10, 38].
The Bear Case: Trust, Friction, and Competitive Nuances
The recurring complaints, even if representing a small fraction of the immense transaction volume, pose a tangible risk to user confidence in UPI Autopay and, by extension, the broader digital payments ecosystem. While the NPCI and various payment providers have introduced fixes, such as mandate management portals and improved alerts [8, 27], the core issue may lie in the inherent complexity of managing consent in high-volume, low-friction systems [33, 35]. The investigation could lead to more stringent compliance requirements for fintechs and payment aggregators, potentially introducing operational friction. Furthermore, the issues may offer a subtle advantage to more traditional, albeit slower, payment methods like net banking or even card-based recurring payments, which some businesses are reportedly reverting to for greater reliability [4, 12]. The challenge for regulators and NPCI is to refine the system without stifling the convenience and rapid adoption that have made UPI a global success, ensuring that the pursuit of scale does not outpace the robustness of user protection.
Future Outlook
This probe into UPI Autopay issues signals an intensified focus on operational integrity within India's digital payment rails. Future developments are likely to involve clearer mandate disclosures, stronger authentication protocols for certain transaction types, and potentially enhanced dispute resolution mechanisms. The RBI's intervention underscores the critical need for continuous adaptation of security controls to match the evolving sophistication of digital payment platforms and emerging fraud tactics. The success of these adjustments will be key to preserving the exceptional trust India's digital payment system currently enjoys.