UPI Mandate Revokes Spike 16% at Second Auto-Debit

UPI AutoPay mandate revocations in India's online gaming sector rose 16% at the second debit attempt in the quarter ending March 2025, according to merchant-side data compiled across a sample of 41 operators processing through four payment aggregators. The figure — up from 11.2% in the preceding quarter — describes the share of recurring mandates that failed specifically on the second collection, after a first debit had already cleared. The pattern matters because it inverts the usual assumption that mandate attrition concentrates at setup.

The underlying mechanics are worth stating plainly. A UPI AutoPay mandate is authorised once by the user, capped at a registered maximum amount, and then debited on a schedule the merchant controls. NPCI rules, revised through 2024, require pre-debit notification to the payer at least 24 hours before each collection. For gaming operators, whose collections are often weekly or monthly and tied to a deposit cadence rather than a fixed subscription, that notification window creates a recurring decision point rather than a single consent event. The second debit is where the payer first sees a repeat charge against a mandate they authorised weeks earlier, often after a session in which they did not win.

What the revocation data actually shows

The 16% figure aggregates failures coded as payer-initiated revocations, not insufficient funds. That distinction is load-bearing. Insufficient-funds failures across the same sample sat at 8.7% and moved less than a point quarter-on-quarter. Revocations, by contrast, climbed from 11.2% to 16% — a 42.9% relative increase in one quarter.

Disaggregating by vertical sharpens the picture. Sportsbook mandates, which cluster around tournament calendars, revoked at 19.4% on second debit during the IPL-adjacent window in March; poker and rummy mandates, typically smaller and more frequent, revoked at 12.1%. Casino and slot operators fell between at 15.8%. The sportsbook concentration suggests schedule visibility matters: when a payer can connect a debit to a specific event they have since lost interest in, the revocation is easier to rationalise.

Vertical	Q4 FY24 second-debit revocation	Q4 FY25 second-debit revocation
Sportsbook	13.6%	19.4%
Casino/slots	11.9%	15.8%
Poker/rummy	9.8%	12.1%
Blended	11.2%	16.0%

The sample is not exhaustive — 41 operators is a fraction of the licensed and offshore-facing market — and merchant-side coding of revocation reasons is inconsistent. Some aggregators log a pre-debit-notification-triggered cancellation as a revocation; others log it as a user-initiated mandate amendment. The 16% should be read as directionally reliable rather than precise.

The 24-hour notification effect

Operators who ran controlled tests on notification timing report the sharpest variance. One large sportsbook, speaking on condition of anonymity because the data is commercially sensitive, found that mandates notified at 26–30 hours before debit revoked at 14.2%, while those notified at 24–25 hours revoked at 18.9%. The mechanism is not obvious: a longer lead time should give the payer more opportunity to cancel. The operator's working hypothesis is that earlier notifications arrive during a different part of the day, before the payer has opened the app and re-engaged with the product, and are therefore less likely to prompt a reactive cancellation.

This is speculative and the sample is one operator. But it points at something structural: revocation is not a stable user preference so much as a response to a prompt, and the design of the prompt moves the number.

Why the second debit, and not the first

First-debit failures in the sample sat at 6.4%, largely technical — mandate not yet active, bank-side processing lag, account mapping errors. The first debit is also the one the payer most recently authorised, so the consent is fresh. By the second debit, three things have changed: the payer has experienced at least one full deposit-and-play cycle, the mandate has aged past the point where authorisation feels like an active choice, and the pre-debit notification now arrives against a background of prior transactions rather than as a novel event.

There is a compliance dimension. Under the IT Rules amendments notified in 2023 and the MeitY advisories that followed, real-money gaming operators face obligations around user consent and grievance redressal that intersect awkwardly with recurring payment design. A mandate that is easy to authorise and hard to revoke invites regulatory scrutiny; the 16% figure could be read either as evidence that revocation works (payers can exit) or as evidence that authorisation was too frictionless relative to the commitment it represents. Operators have an interest in the first reading.

The ₹15,000 threshold

NPCI's mandate framework allows AutoPay without additional factor authentication up to ₹15,000 per debit for certain categories, with higher values requiring AFA. Gaming operators cluster mandate caps just under this threshold — ₹14,999 is a common registered maximum — which means the second debit frequently lands at or near the cap for high-value players. Revocation rates in the sample were 4.1 points higher for mandates registered above ₹10,000 than below it. The relationship between transaction size and cancellation is well documented in subscription research generally; gaming is not exempt.

What operators are doing about it, and whether it should worry anyone

The commercial response has been predictable. Several operators have moved to shorter mandate cycles — weekly rather than monthly — on the theory that more frequent, smaller debits normalise the charge and reduce the salience of any single revocation. Others have experimented with notification copy, though NPCI template rules constrain how much can be varied. A third group has shifted collection timing to avoid the days immediately following major sporting events, when post-loss revocation appears elevated.

Each of these is a legitimate retention tactic and each also raises a question the sector has not answered well. If revocation at the second debit is a meaningful exit signal — a payer deciding, with one full cycle of information, that the recurring commitment is not for them — then engineering the notification or the cadence to suppress that signal is not neutral. It sits close to the line the responsible-gambling framework draws around friction: the principle that exit should be at least as easy as entry.

The counter-argument is that many second-debit revocations are not considered exits at all but housekeeping — a payer clearing mandates they no longer recognise, or reacting to a bank app prompt without context. On that reading, better notification design reduces accidental churn and harms no one. The data cannot currently distinguish the two populations, because no aggregator in the sample codes revocation intent.

That gap is the open question. A 16% second-debit revocation rate is either a healthy sign that Indian payers exercise control over recurring gaming charges, or a warning that the mandate layer is doing retention work it was not designed for. The number alone will not settle it. What would settle it — intent coding at the aggregator level, or a regulator-mandated disclosure of revocation reasons — does not yet exist, and the operators best positioned to build it have little commercial reason to. Until then, the 16% will be cited by both sides of the argument, and the second debit will remain the least understood point of exit in the Indian gaming payment stack.