Recurring Payments Compliance

The Reserve Bank of India introduced its e-mandate framework for recurring card payments in 2019 and tightened it in 2021, and it changed the Indian subscription market completely. Under the framework, a customer must register an e-mandate for a recurring payment, and the mandate must specify the maximum amount, the frequency, and the validity period. Before the first debit, the customer must complete an additional factor of authentication, such as a one-time password. For amounts up to 15,000 rupees, later debits do not need a fresh authentication, but the customer must receive a pre-debit notification at least 24 hours before each charge. For amounts above 15,000 rupees, the customer must authenticate every debit. The pre-debit notification is the most important customer protection in the RBI framework, and it is a requirement that business analysts must design carefully. At least 24 hours before each recurring debit, the merchant or the bank must send the customer a message with the merchant name, the amount, the date of the debit, and the reference number of the mandate. The message must also tell the customer how to modify or cancel the mandate. The customer can then choose to allow the debit, change the amount, or cancel the mandate before the money leaves the account. Merchants that failed to build this notification saw their recurring payments stop overnight when the rules came into force, which shows how important it is to track regulatory change. In Europe, recurring payments are governed by the Payment Services Directive 2, known as PSD2, and its strong customer authentication rules. The good news for merchants is that PSD2 contains a specific exemption for recurring payments. The first payment in a series must be authenticated with strong customer authentication, but later payments of the same amount to the same merchant are exempt, provided the mandate was set up correctly. If the amount changes, the merchant must authenticate the new amount once, and then the new amount becomes the basis for future exemptions. This makes European subscription payments smoother than Indian ones, but the merchant must still keep careful records of the mandate. The difference between the Indian and European approaches tells a business analyst a lot about how regulation shapes product design. In India, the regulator chose to give the customer a notification and a chance to stop every single debit, which protects the customer but creates friction and failed payments when notifications are missed. In Europe, the regulator chose to trust the original mandate and exempt later payments, which is smoother for the merchant but relies on the customer remembering to cancel a subscription they no longer want. A BA working for a global merchant must design a system that applies the stricter rule in each market, which usually means building the Indian pre-debit notification for India and the PSD2 exemption logic for Europe. Compliance for recurring payments also includes the basics that apply in every market. The merchant must allow the customer to cancel the mandate easily, through the same channel where it was created, and the cancellation must take effect before the next billing date. The merchant must keep an audit trail of the mandate, including when consent was given, what the terms were, and every charge made under it. The merchant must also handle data protection rules, since stored card details are sensitive personal data. A BA should keep a compliance checklist for every market the merchant operates in, and should review it whenever a regulator publishes new guidance, because recurring payment rules change more often than most people expect.