Question: My mutual fund SIP auto-debit through UPI for an amount higher than what I remember as the old additional-factor-authentication threshold went through without me having to approve it separately on my banking app. Could this be a security lapse I should report?
Answer: Not a lapse — it's the new rule. RBI's e-mandate framework (effective April 2026) raised the AFA-free (no separate approval) limit for SIP debits specifically to ₹1,00,000, up from the earlier ~₹15,000 threshold. So a SIP debit above your old remembered limit but under ₹1 lakh going through automatically is expected, not a security issue.

Supporting evidence:
title: rbi.org.in/BS_ViewMasDirections.aspx
quote: Payment of insurance premiums, subscription to mutual funds, and credit card bill payments may be made without AFA up to ₹1,00,000/- per transaction All recurring transactions may be authorised without AFA up to ₹15,000/- per transaction
context: action notification An issuer shall send a post-transaction notification to the customer. This notification shall, at the minimum, inform the customer about the merchant’s name, transaction amount, date and time of debit, reference number of transaction and e-mandate, reason for debit, i.e., e-mandate registered by the customer, and details on grievance redressal 1 .
8. Transaction limits and velocity check (a) All recurring transactions may be authorised without AFA up to ₹15,000/- per transaction. Transactions above this amount shall be subject to AFA. (b) Payment of insurance premiums, subscription to mutual funds, and credit card bill payments may be made without AFA up to ₹1,00,000/- per transaction.

9. Dispute resolution and grievance redressal (a) An appropriate dispute redressal system shall be put in place by the issuer to facilitate the customer to lodge grievance/s. (b) RBI instructions on limiting liability of customers for unauthorised transactions shall be applicable to recurring transactions under e-mandates as well.
10. Other provisions (a) No charges shall be levied to the customer for availing the e-mandate facility for recurring transactions. (b) In case of cards, existing e-mandate(s) can be mapped to reissued cards 2 . (c) An acquirer shall ensure compliance with these directions by merchants on-boarded by them.
11. Repeal With the issue of these directions, the instructions/guidelines contained in the following circulars, issued by the Reserve Bank stand repealed. No Circular No. Date Subject

DPSS.CO.PD.No.447/02.14.003/2019-20
August 21, 2019
Processing of e-mandate on cards for recurring transactions
2.
DPSS.CO.PD No.1324/02.23.001/2019-20
January 10, 2020
Processing of e-mandate in Unified Payments Interface (UPI) for recurring transactions
3.
DPSS.CO.PD No.754/02.14.003/2020-21
December 04, 2020
Processing of e-mandates for recurring transactions
4.
CO.DPSS.POLC.No.S34/02-14-003/2020
March 31, 2021
Framework for processing of e-mandates for recurring online transactions
5.
Clarification issued to IBA on e-mandate based recurring transactions
October 08, 2021
RBI's framework for e-mandate based recurring transactions
6.
CO.DPSS.POLC.No.S-518/02.14.003/2022-23
June 16, 2022
Processing of e-mandates for recurring transactions
7.
CO.DPSS.POLC.No.S-882/02.14.003/2023-24
December 12, 2023
Processing of e-mandates for recurring transactions