While I didn't work on indian regulations, I've worked directly on 2FA/OTP with recurring charges. For this regulation, the recurring charge must be initiated with an OTP code, but subsequent charges may happen automatically. There should also be an exception process to allow preexisting standing instructions to continue.
This article has details of the actual regulation: https://indianexpress.com/article/explained/explained-why-au...