Recurring Payments in India

UPDATE 12/12/2022
The RBI has further delayed enforcement of the Card Tokenization regulation from December 31, 2021 to June 30, 2022.

Overview

The Reserve Bank of India (RBI) has issued a directive of processing e-mandates for future recurring payment requests with the scope originally covering cards and wallets but most recently Unified Payments Interface (UPI) transactions as well.

The details of the new requirements mean that an Additional Factor of Authentication (AFA) on the registration and first transaction (up to ₹15,000 before the next challenge), as well as a pre-debit notification 24+ hours prior to taking payment against the account. Within that notification, the user should see the amount they will be charged, the frequency of the recurring charge, and have the ability to opt out of that charge or subscription. 

Effective Date: September 30, 2021

In addition, India has been pushing more aggressive data localization requirements in regards to 'Payments Data' since 2018 and the RBI continues to modify these requirements. 

Effective Date: December 31, 2021

Impact of non-compliance

Companies operating in INR may see higher failure rates if they do not meet the RBI's guidelines for new recurring payments come September 30, 2021.

What to do

We encourage all customers to speak to their gateway representatives first and foremost for guidance. The gateways will be able to help you understand your risks and the potential impacts to your business, as well as provide guidance on how to implement the necessary measures to mitigate any issues with your recurring payments.

In addition, we also recommend that potentially impacted customers:

• [Recurring Mandate] Ensure that users registering a new card and/or making a first payment on a subscription are able to be challenged with a form of AFA like 3DS.
• [Recurring Mandate] Configure notifications to your consumers 24+ hours prior to their next payment that provide them information about the upcoming charge including an easily accessed option to opt out of that charge.
• [Data Storage] If applicable with the gateway's feedback, migrate any new and existing Indian card payment methods to a tokenized form. If your gateway does not support tokenization, you may want to consider one that does. There is no form of grandfathering for existing cards on file for this directive so all existing payment methods must be tokenized with the gateway if they do not provide an alternative. 

Who are we supporting in India?