e-Mandate and NACH in Digital Banking: Rules and Flow (IIBF 2026)

DIGIBANK By Ashish Jain · IIBF STORE Editorial · 28 July 2026 · Updated 11 Sep 2026 · 8 min read · 68 views
e-Mandate and NACH in Digital Banking: Rules and Flow (IIBF 2026)

Every JAIIB and CAIIB Digital Banking paper carries at least one question on recurring debit authorisation, and e-mandate and NACH in digital banking is the topic examiners keep returning to. Banks now process SIPs, insurance premiums, OTT subscriptions and loan EMIs through electronic mandates rather than paper ECS forms, and the exam expects you to know the registration channels, the Additional Factor of Authentication (AFA) rules, and where a mandate can legally fail. This article walks through the e-NACH flow end to end, the RBI framework that governs it, and the checkpoints bank staff must verify before a recurring debit goes live.

🏦 What Is NACH and How e-Mandates Fit In

NACH (National Automated Clearing House) is the bulk electronic clearing system operated by NPCI since 2016, built to replace the older ECS platform. It moves large batches of debit and credit instructions between a sponsor bank and destination banks on a single settlement cycle, and it is the backbone for salary credits, dividend payouts, and — most relevant here — recurring debits for EMIs, SIPs, and insurance premiums.

An e-mandate is the paperless authorisation a customer gives to let a biller or lender pull money from their account on a fixed schedule under NACH. Instead of signing a physical mandate form and submitting it to the branch, the customer authenticates digitally, and NPCI issues a UMRN (Unique Mandate Reference Number) that uniquely identifies that standing instruction for its entire life cycle — right up to modification or cancellation. Candidates preparing from Overview of Digital Banking will recognise NACH as one of the core payment rails alongside UPI and card networks.

NACH clearing flow between sponsor bank, NPCI and destination bank
NACH clearing flow between sponsor bank, NPCI and destination bank

🔐 AFA Rules for Recurring Payments

The RBI's framework for processing e-mandates on cards, UPI, and NACH requires an Additional Factor of Authentication at the time of mandate registration, modification, and each first debit in a new cycle. This closed the gap left by earlier standing-instruction systems where a one-time authentication covered years of subsequent debits with no further customer check.

Recognising that OTP-style AFA on every small recurring debit is friction customers don't want, RBI carved out a limit below which AFA is not mandatory for each transaction — this exemption threshold moved from ₹2,000 to ₹5,000 over time, and was extended further to ₹15,000 for specified recurring categories such as mutual fund SIPs, insurance premiums and subscriptions. Above the applicable threshold, the bank must re-authenticate the customer for that specific debit.

💡 Exam Tip: Remember the AFA exemption exists at the transaction level, not the mandate level — a mandate can run for years without a fresh AFA as long as each individual debit stays under the exempt limit.

Even AFA-exempt debits are not silent: the bank or biller must send a pre-debit notification at least 24 hours before the debit date, giving the customer the chance to arrange funds or cancel the mandate. This single rule is tested repeatedly because it applies regardless of transaction value.

AFA exemption threshold and pre-debit notification timeline for e-mandates
AFA exemption threshold and pre-debit notification timeline for e-mandates

🔄 The e-Mandate Registration Flow, Step by Step

An e-NACH registration typically runs through five steps. First, the customer initiates a recurring payment at a merchant, lender, or biller website or app and chooses to pay via e-mandate rather than a one-time transfer. Second, the customer is redirected to the NPCI e-mandate page or their bank's authentication gateway. Third, the customer authenticates using one of the approved channels — net banking credentials, debit card details with OTP, Aadhaar-based e-sign, or a UPI PIN if registering through UPI AutoPay. Fourth, on successful authentication, NPCI generates the UMRN and the mandate is registered with the destination bank. Fifth, recurring debits execute automatically on the due dates under that UMRN, each preceded by the required notification.

Bank officers working the retail desk should be comfortable walking a customer through cancellation or modification too — both require the same authentication strength as the original registration, so a customer cannot cancel a mandate over a phone call alone. The relevant registration and settlement mechanics are covered in Retail Banking - Digital Banking Class 12 and Mobile Banking, both worth revising alongside this topic.

Registration ChannelAuthentication ModeAFA on Every Cycle?Typical Use
Net Banking e-NACHLogin credentials + OTP❌ Below exempt limitLoan EMIs, insurance premiums
Debit Card e-mandateCard details + OTP❌ Below exempt limitOTT and utility subscriptions
Aadhaar e-sign NACHAadhaar OTP❌ Below exempt limitMutual fund SIPs
UPI AutoPayUPI PIN✅ Above ₹15,000 slabSmall recurring bill payments
Comparison of e-mandate registration channels for NACH and UPI AutoPay
Comparison of e-mandate registration channels for NACH and UPI AutoPay

⚠️ Common Failures and Compliance Checkpoints

Most e-mandate disputes at the branch trace back to one of three causes: a missed or delayed pre-debit notification, insufficient balance on the debit date leading to a bounced NACH transaction and applicable charges, or a customer disputing a debit above the AFA-exempt slab where the bank cannot show evidence of fresh authentication. Staff handling grievances should always pull the UMRN first — it is the single reference that ties the disputed debit back to the original registration, the authentication log, and the notification trail.

⚠️ Common Mistake: Assuming an e-mandate registered once never needs re-verification. Any change in the debit amount, frequency, or destination account requires the customer to re-authenticate with the same rigour as the original mandate.

Banks are also expected to give customers a functioning self-service option to view, pause, or cancel active mandates rather than routing every request through the branch — a point regulators have pushed since recurring-payment complaints started rising alongside UPI AutoPay adoption. For the underlying merchant-acquiring context around recurring collections, see Payment Aggregators and Gateways: RBI Rules Explained, and for how banks route these transactions internally across core systems, refer to Enterprise Service Bus in Banking: CAIIB ITDB Guide.

📌 Remember: Pre-debit notification is mandatory even for AFA-exempt debits — it is a separate obligation, not a substitute for authentication.

For the full regulatory text on recurring transaction processing, refer to the RBI's official notifications at rbi.org.in. Candidates should also connect this topic to feature-phone recurring collections covered in UPI 123Pay Explained: Feature-Phone Payments and to bill-payment settlement covered in Bharat Bill Payment System BBPS: Architecture, Roles and Charges, since all three rely on the same underlying NACH and UPI rails.

🧠 Practice MCQs: e-Mandate and NACH in Digital Banking

Q1. What does UMRN stand for in the context of e-mandates? (a) Universal Merchant Registration Number (b) Unique Mandate Reference Number (c) User Mandate Recurring Number (d) Unified Merchant Routing Number

Answer: (b) — UMRN is the Unique Mandate Reference Number generated by NPCI that identifies an e-mandate for its full life cycle.

Q2. NACH, the platform used to process e-mandate debits, is operated by which entity? (a) RBI (b) NPCI (c) IBA (d) CCIL

Answer: (b) — NACH is operated by the National Payments Corporation of India, having replaced the earlier ECS system.

Q3. Under the RBI e-mandate framework, what must a bank send before debiting an AFA-exempt recurring mandate? (a) A pre-debit notification at least 24 hours in advance (b) A fresh OTP for every debit (c) A physical letter (d) Nothing is required below the exempt limit

Answer: (a) — A pre-debit notification at least 24 hours before the debit date is mandatory regardless of whether the transaction is AFA-exempt.

Q4. Which authentication mode is used to register an e-mandate through UPI AutoPay? (a) Net banking password (b) UPI PIN (c) Aadhaar biometric only (d) Debit card CVV alone

Answer: (b) — UPI AutoPay mandates are authenticated using the customer's UPI PIN at registration and above the AFA-exempt slab.

Q5. If a customer wants to increase the debit amount on an existing e-mandate, what is required? (a) Nothing, the change applies automatically (b) A phone call to customer care is sufficient (c) Re-authentication with the same rigour as original registration (d) The mandate must remain unchanged for its full tenure

Answer: (c) — Any modification to amount, frequency, or destination account requires fresh authentication equivalent to the original mandate registration.

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

What is the difference between NACH and e-mandate?

NACH is the underlying bulk clearing platform operated by NPCI that settles recurring debits and credits in batches. An e-mandate is the digital authorisation process a customer completes to set up a recurring debit on that platform, ending in a UMRN.

Is OTP required for every e-mandate debit?

No. Fresh authentication (AFA) is required at registration, modification, and for debits above the applicable exempt slab. Debits below that slab proceed with only a pre-debit notification, not a fresh OTP each time.

What happens if a pre-debit notification is not sent?

Skipping the mandatory 24-hour pre-debit notification is a compliance lapse under the RBI e-mandate framework and can form valid grounds for a customer dispute on that specific debit, independent of whether the debit itself succeeded.

Can a customer cancel an e-mandate without visiting the branch?

Yes. Banks are expected to provide a digital self-service option to view, pause, or cancel active mandates, and cancellation requires the same authentication strength used at registration.

📚 Take This Further

e-Mandate and NACH in digital banking sits at the intersection of payments, compliance, and customer service — exactly the mix JAIIB and CAIIB examiners favour. Revisit the registration channels table above, work through the five MCQs, and browse more topics under the Digital Banking tag hub before your next mock. Ready to test yourself under exam conditions? Start a JAIIB mock test →

Quick quiz

Quick quiz on this topic

5 exam-style questions from our free test bank — check yourself before you move on.

Digital Banking · 5 questions · instant result
Q1. Consider the following statements about the merchant on-boarding pre-requisites for POS: 1. A POS terminal may be installed before the Merchant Establishment (ME) Agreement is executed, provided KYC is complete. 2. KYC compliance and acceptance of the bank's MSF/MDR scales are pre-requisites for on-boarding. Which is/are correct?
Q2. Consider the following statements about PSTN and GPRS POS terminals: 1. A PSTN POS terminal needs telephone lines to interact with the Data Centre. 2. A GPRS POS terminal uses a SIM card and can be moved anywhere as it has a built-in battery. Which of the statements is/are correct?
Q3. Assertion (A): A merchant must verify the cardholder's signature against the one on the card for all signature-based cards. Reason (R): Signature verification is also mandatory for chip-and-PIN cards before completing the transaction.
Q4. An m-POS solution is being marketed to small retailers. Which statement MOST accurately captures its defining advantage over a traditional merchant POS terminal as described in the chapter?
Q5. A small merchant with a turnover of Rs 15 lakh in the previous financial year processes a Rs 50,000 debit-card sale on a physical POS. Under the RBI MDR mandate effective 01.01.2018, what is the applicable MDR ceiling?
Next step

Practice this topic

Ready to put this into practice?

Take a free mock test, download chapter PDFs, or watch a video class — all included on iibf.store.

Keep reading