RBI Expands UPI AutoPay Tokenisation: PAs Can No Longer Store Credentials, Merchants Face Ban for Non-Compliance
RBI has mandated dynamic tokens for every UPI AutoPay debit, requiring payment aggregators to store only token references — not card or UPI credentials — and barring non-compliant merchants from using UPI AutoPay entirely. Builders running subscription or recurring-payment flows must audit their PA integrations immediately, as merchant-side storage violations now carry a direct product kill-switch.
Source: Kunvarji Wealth ↗