On 6 August 2026 the RBI issued Amendment Directions rewriting how banks and NBFCs may recover loan dues and engage recovery agencies. They take effect on 1 January 2027 and cover contact hours, agent certification, published agency lists, prohibited practices and technology-based recovery.
This is not a redraft of the old recovery-agent paragraphs. It is a new chapter that deletes them and replaces them with a framework covering the whole recovery process, from the trigger that starts it to the compensation owed when a lender gets it wrong.
The old rules governed who the agent was. The new rules govern what happens, when it happens and whether you can prove it.
What exactly has the RBI issued?
The Reserve Bank issued a set of parallel Amendment Directions on 6 August 2026, all effective 1 January 2027, so that one conduct standard applies across regulated entities:
- Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, RBI/2026-27/230, DOR.MCS.REC.No.199/01-01-039/2026-27
- Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Fourth Amendment Directions, 2026
- Matching Fourth Amendment Directions for Small Finance Banks, Local Area Banks, Regional Rural Banks, Urban Co-operative Banks and Rural Co-operative Banks
- Third Amendment Directions for All India Financial Institutions
- Reserve Bank of India (Housing Finance Companies) Third Amendment Directions, 2026, RBI/2026-2027/231, which routes HFCs to the same NBFC conduct paragraphs
The NBFC Directions exclude a short list of entity types, including mortgage guarantee companies, core investment companies, NBFC-Account Aggregators, standalone primary dealers, non-operating financial holding companies and NBFCs with no customer interface. If a lender has a customer interface, it is in scope.
A revised draft had been put out for comment on 20 May 2026. This is the final text.
The nine things that change
| Requirement from 1 January 2027 | What it means for a collections floor |
|---|---|
| Board-approved recovery policy | Must specify recovery triggers, a graded escalation matrix, a code of conduct, treatment on borrower death and a framework for borrowers in financial distress |
| Contact window of 8:00 a.m. to 7:00 p.m. | Calls and visits outside it only where the borrower has expressly asked for or authorised them; stated do-not-call times must ordinarily be respected |
| IIBF certification for agents | Recovery agencies may engage only IIBF-certified agents; existing uncertified agents have one year from the effective date to obtain it |
| Published agency list | Name, address, type, engagement period and purpose on the lender’s website, updated within seven calendar days, and promptly on termination |
| One day’s notice before a visit | The borrower or guarantor must be told the agency’s details at least a day before the first in-person visit |
| Identification at the door | Identity card, authorisation letter and the relevant notice, carrying the agency’s contact details and the grievance redressal officer’s details |
| Prohibited practices, named | Abusive or threatening language, anonymous calls, excessive calls or messages, inappropriate social media contact, public humiliation, harassment of relatives, friends or co-workers, violence or its threat, and false statements about the amount owed |
| Call records kept for six months | Time and number of recovery calls, plus recordings or records of their contents, held for six months or until proceedings conclude; borrowers must be told the call is recorded |
| Occasion sensitivity | No recovery contact during bereavements, medical emergencies or marriage functions |
Due diligence on recovery agencies must follow the RBI’s outsourcing directions, with agent antecedents verified at onboarding and periodically after. The policy must also set performance evaluation, inspection and audit, penal action against non-compliant agencies, and compensation to borrowers or guarantors for losses from recovery actions inconsistent with the Directions.
Device locking now has hard thresholds
The most specific part of the Directions deals with technology-based recovery: restricting or disabling a borrower’s phone, tablet or laptop.
Ordinarily it is not allowed. It is permitted only where the lender financed that device, the loan agreement expressly and unambiguously authorises the mechanism, and the borrower has received notice setting out the repayment requirement and the proposed restriction. Even then:
- No restriction before the loan is 30 days past due, and only after notices have gone unanswered.
- Restrictions are graded, and the full contractual set can apply only at 60 days past due.
- Outgoing calls cannot be restricted before the 60-day point.
- Incoming calls, SMS and emergency SOS must keep working, and restrictions must not block work or employment activity.
- The borrower must be able to see what restrictions are applied.
- Lenders and their technology providers may not access device data (contacts, messages, call logs, photographs, location history) for recovery or any other purpose.
- On payment, restrictions reverse within one hour. Wrongful restriction or delay attributable to the lender attracts compensation of ₹250 per hour, capped at the loan amount disbursed.
A lender running device locking through a third-party SDK has 57 days to confirm that the SDK can enforce a 30-day floor, a 60-day gate, a one-hour release and a data-access prohibition it probably was not built for.
What this breaks in a typical collections setup
Most Indian collections floors will fail at least three of these on 1 January, and the failures are systems failures, not policy failures:
- The dialler does not know the clock. Auto-dial campaigns that run to a daily quota will place calls at 7:40 p.m. because nobody told the system that 7:00 p.m. is now a rule, not a courtesy.
- Agent certification is not in the workflow. If the allocation engine does not know which agents hold the IIBF certificate, an uncertified agent will be assigned a case.
- The website list is a PDF someone updates quarterly. Seven calendar days is a system obligation, not an admin task.
- Visit notice is manual. A one-day advance intimation before the first visit has to fire off the allocation event automatically or it will not happen.
- Call records are in the telephony vendor’s retention policy. Six months, retrievable per account, with the borrower informed of recording, is a specific requirement.
- Nobody can produce the audit. The Directions assume you can show, per account, who contacted whom, when, under what authority, and what was said.
If your answer to “who called this borrower at 7:40 p.m. and what did they say” is a spreadsheet and a phone call to the agency, you are not compliant on 1 January.
A 57-day sequence
- Weeks 1–2. Draft the board-approved recovery policy and get it on a board agenda. It is the document every other requirement hangs off, and board calendars are the long pole.
- Weeks 1–2. Audit your recovery agencies: certification status of every agent, contract terms, and whether the outsourcing due diligence on file meets the standard.
- Weeks 3–4. Put the contact window into the dialler and the field app as an enforced constraint, not a guideline. Same for DND and do-not-contact preferences.
- Weeks 3–5. Automate the published agency list and the pre-visit intimation.
- Weeks 4–6. Fix retention: call recordings, call counts and timestamps, six months, retrievable per loan account.
- Weeks 5–7. If you use device locking, re-paper the loan agreements and rebuild the thresholds, or switch it off until you can.
- Week 8. Dry-run the audit. Pick ten accounts and reconstruct every contact.
How Trustt’s collections stack maps to this
Trustt’s collections module enforces calling windows, DND and retry caps before a call is dialled, rather than reporting on breaches afterwards. Strategy runs by bucket: early bucket, pre-due to 30 DPD, on automated reminders; mid bucket on promise-to-pay negotiation inside approved bands; late bucket on scripted communication only, where the model does not generate the language. Promise-to-pay is written back and validated against what was actually said. Because collections sits on the same data layer as the lending platform, a bounced mandate updates the loan, the bucket and the strategy together.
Trustt’s AI Banking Agents work in 11 Indian languages plus Hinglish at 1,000+ concurrent calls, with high-risk lines running on locked, legally reviewed scripts and warm handoff to a human with full context. On client floors Trustt has measured 2.1× more promises-to-pay kept and 63% lower cost per resolved account. Every agent action is logged and replayable for seven years, which is the part that matters when a supervisor asks what was said on a call in March.
The Directions do not ban automated contact. They require that it be inside the window, identified, civil, recorded and provable. That is a systems property. For the wider picture of what a collections platform should do, see our guide to debt collection management software.
If your dialler cannot enforce a contact window today, book a demo and see what enforcement before dial looks like.
Frequently asked questions
What are the new RBI recovery agent rules?
On 6 August 2026 the RBI issued Amendment Directions to its Responsible Business Conduct framework for NBFCs, commercial banks, small finance banks, RRBs, co-operative banks, AIFIs and HFCs. Effective 1 January 2027, they govern recovery policy, agent certification, contact hours, prohibited practices and technology-based recovery.
What are the permitted calling hours for loan recovery in India?
From 1 January 2027, recovery agents and lender employees may contact borrowers between 8:00 a.m. and 7:00 p.m. Contact outside those hours is permitted only where the borrower or guarantor has expressly requested or authorised it, and stated preferences to avoid particular times must ordinarily be respected.
Do recovery agents need a certificate in India?
Yes. From the effective date, recovery agencies may engage only agents certified by the Indian Institute of Banking and Finance after completing the Debt Recovery Agents training programme, or through an institute tied up with IIBF. Agents already engaged without the certificate have one year to obtain it.
Can a lender lock a borrower’s phone for non-payment?
Only in narrow circumstances: the lender financed that device, the loan agreement expressly authorises it, and notice has been given. No restriction before 30 days past due, full restrictions only at 60 days past due, outgoing calls not restricted before 60 days, and incoming calls, SMS and emergency SOS must keep working.
What happens if a lender wrongly restricts a device?
Restrictions must be reversed within one hour of dues being realised. Where a wrongful restriction or a delay is attributable to the lender, compensation of ₹250 per hour is payable to the borrower, capped at the loan amount disbursed. Lenders must also run a grievance mechanism for device-unlocking complaints.
Which recovery practices are prohibited under the 2026 Directions?
Abusive or threatening language, anonymous calls, excessive calls or messages, inappropriate social media communication, public humiliation, harassment of relatives, friends or co-workers, use or threat of violence, and false or misleading statements about the amount owed or the consequences of non-payment.
How long must recovery call records be kept?
Lenders must record the time and number of recovery calls and preserve recordings or records of their contents for six months, or until the conclusion of proceedings where the matter is sub judice. Borrowers must be informed that conversations are being recorded.
Do these rules apply to banks as well as NBFCs?
Yes. The RBI issued parallel Amendment Directions on the same date for commercial banks, small finance banks, local area banks, regional rural banks, urban and rural co-operative banks and All India Financial Institutions, and routed housing finance companies to the same NBFC conduct paragraphs.
Technology you can bank on!
Researched and drafted with AI assistance under editorial review by Gautam Bandyopadhyay.
Sources
- RBI Issues Amendment Directions on ‘Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents’, RBI press release, 6 August 2026
- Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, RBI/2026-27/230, DOR.MCS.REC.No.199/01-01-039/2026-27, RBI, 6 August 2026
- Reserve Bank of India (Housing Finance Companies) Third Amendment Directions, 2026, RBI/2026-2027/231, RBI, 6 August 2026
