Failure To Deactivate Expired Mandates In Automated Systems

This is a specific type of Deficiency in Service and Systemic Negligence. It occurs when a NACH / ECS / e-Mandate / ACH / Standing Instruction remains active in the core banking / payment gateway system after its Validity Period, Cancellation, or Revocation, and the system continues to present debit requests.

Under RBI and NPCI rules: If the mandate is not found or has expired, the transaction must be Returned with the appropriate reason code. Continuing to debit is illegal.

1. What The Law Requires

A. RBI Digital Payments - E-Mandate Framework, 2026 (Consolidated Directions dated 21 April 2026)

This is now the master framework. It consolidates 8 circulars from 2019-2024.

Key mandates:

1. 24-hour Pre-Debit Notification Mandatory: An issuer shall send a pre-transaction notification to the customer, at least 24 hours prior to the actual charge / debit.
2. Right to Withdraw: The issuer shall provide the customer with a facility to modify the validity period or withdraw the e-mandate at any point of time.
3. No Charges for Mandate: No charges shall be levied on customers for availing of the e-mandate facility.
4. Auto-Mapping on Card Re-issue: Previously auto-debits stopped when card expired. Now issuer can map existing e-mandates to newly issued card, but ONLY with same mandate validity. You cannot auto-extend expired mandate to new card.

B. NPCI NACH Rules

After cancellation, the bank stops accepting new debit requests under that mandate. No further automatic deductions should take place once the cancellation is completed.

If mandate expired/not found - bank MUST return.

C. Old ECS Rule Still Valid

ECS (Debit Clearing) - Revocation of mandate by customers - it is obligatory on the part of the user institution not to include the transaction in the ECS input file provided withdrawal instruction is received 15 days prior to the date of submission of ECS file.

If you informed 15 days before, any debit after that is fault of User Institution (merchant/lender).

2. Liability - Who Is Liable?

Failure to deactivate is treated as Systemic Failure and bank cannot shift blame to technology.

Case Law 1: Amritsar District Consumer Commission - PMJJBY Auto-Debit Case (2023)

The Commission observed that once a bank undertakes to operate an auto-debit facility, it cannot absolve itself merely by pointing to the failure of a computer-generated system.

Bank failed to inform customer that auto-debit failed due to insufficient balance, leading to lapse of insurance. Held deficiency in service. Awarded Rs. 1.5 Lakh compensation.

Principle Applied to Expired Mandates: If you cannot absolve for system failure for failure to debit, you also cannot absolve for system failure for debiting after expiry. Both are systemic failures.

Case Law 2: Payu Payments Pvt. Ltd vs N. Nirmal Chander (NCDRC, 4 May 2023)

If an account is maintained by the Bank, the Bank itself is responsible for its safety and security. Any systemic failure, due to any virus or hacking in its computerized system, is its responsibility, and not of the consumer.

Extended to mandates: If your automated system fails to purge expired mandate table, it is bank's responsibility.

Case Law 3: Kerala High Court - Unauthorized Withdrawals

Banks cannot be absolved of liability for unauthorised withdrawals from their customers' accounts... if a customer suffers loss in connection with transactions made by fraudsters, it has to be presumed that it is due to the bank's failure to put in place a system which prevents such withdrawals.

Debit after mandate expiry = unauthorized withdrawal. Bank must have system to prevent.

Case Law 4: US - NACHA Rules & FTC Enforcement

In US, ACH mandate must have clear expiry. In FTC v. Wyndham and CFPB actions against auto-debit lenders, continuing to debit after revocation is treated as Unfair or Deceptive Acts or Practices (UDAP). CFPB fined multiple loan servicers $1M+ for failure to deactivate expired ACH.

Case Law 5: Cheque Bounce Parallel

Under Section 25 of the Payment and Settlement Systems Act, 2007, the dishonour of a NACH or ECS mandate set up to repay a legally enforceable debt, when it fails for insufficient funds, is a criminal offence that mirrors cheque bounce under Section 138 NI Act.

By corollary, if lender continues to present expired mandate and it bounces, lender itself is causing offence and liable for harassment under RBI Fair Practices Code.

3. Legal Consequences for Company / Bank

If your automated system debits after expiry:

1. Consumer Protection Act, 2019: Deficiency in service - compensation, refund with 12% interest, punitive damages.
2. RBI Ombudsman: Violation of E-Mandate Framework -> Ombudsman can award compensation upto Rs. 20 lakhs.
3. Data Privacy: Under DPDP Act 2023, continuing to use payment instrument data after purpose (mandate) expired is violation of purpose limitation.
4. Section 43A IT Act + Section 72A: Failure to maintain reasonable security practices for financial data.

4. Technical Standard of Care Required

Court expects:

• Cron job to deactivate mandates on valid_to < TODAY
• NPCI ACKNOWLEDGMENT file parsing - if NPCI returns "Mandate Expired", system must auto-block
• Audit trail of deactivation
• After three times of a failed mandate, bank will proceed to cancel the mandate - NPCI guideline. Your system must not retry infinitely.

5. What to Do If You Are Victim?

1. Send written revocation email + keep 15-day proof
2. Raise dispute within 24h of pre-debit notification (new right under 2026 framework)
3. File complaint with Bank Ombudsman under "unauthorized electronic transaction"
4. If insurance/SIP lapsed due to bank's failure to debit valid mandate, or loss due to debiting expired mandate - file consumer complaint.