1. Executive Summary
On August 6, 2026, the Reserve Bank of India (RBI) issued finalized Amendment Directions aimed at standardizing and strengthening the regulatory framework for loan recovery processes and the engagement of recovery agents. Following a draft release on May 20, 2026, these amendments emphasize responsible business conduct, protecting borrowers from coercive tactics, and regulating technology-based recovery mechanisms. These comprehensive directions represent a significant shift towards more ethical and transparent debt collection practices across the Indian financial sector.
2. Applicable Entities
The RBI has ensured a level playing field by applying these directions broadly across the financial ecosystem. The amendments specifically target the following Regulated Entities (REs):
- ✅ Commercial Banks (including standard, large-scale commercial operations)
- ✅ Small Finance Banks (SFBs)
- ✅ Local Area Banks
- ✅ Regional Rural Banks (RRBs)
- ✅ Urban Co-operative Banks (UCBs)
- ✅ Rural Co-operative Banks
- ✅ All India Financial Institutions
- ✅ Non-Banking Financial Companies (NBFCs)
- ✅ Housing Finance Companies (HFCs)
3. Specific Changes Required
The Amendment Directions introduce stringent requirements for REs regarding their conduct and the oversight of their outsourced recovery mechanisms.
A. Fair Treatment & Anti-Harassment Measures
- Restricted Calling Hours: Lenders and agents can ordinarily only contact borrowers between 8:00 AM and 7:00 PM unless explicitly requested otherwise by the borrower.
- Prohibited Conduct: Agents are strictly forbidden from using abusive, threatening, or misleading language.
- Privacy Protection: Publicly disclosing or circulating information about the borrower’s debt, or contacting family members, friends, or colleagues to discuss the debt is prohibited.
B. Due Diligence and Agent Certification
- Mandatory Certification: Recovery agents engaged by banks must be certified by the Indian Institute of Banking & Finance (IIBF).
- Rigorous Onboarding: REs must conduct thorough background checks and due diligence before engaging any recovery agency or individual agent.
- Documentation & Identification: Recovery personnel must always identify themselves clearly, carry proper authorization, and adhere to approved procedures during interactions. All communications must be documented and traceable.
- Data Privacy: REs must ensure that disclosure of borrower or guarantor information to recovery agencies is strictly limited to what is absolutely necessary for the recovery process.
C. Regulation of Technology-Based Recovery Mechanisms
- Mobile Device Restrictions: The RBI has specifically barred banks from completely disabling financed mobile devices belonging to defaulting borrowers.
- Essential Functions Protection: Even if a technology-based mechanism is used to prompt repayment, banks cannot restrict or disable functionalities deemed essential, specifically including emergency SOS features, incoming calls, and incoming SMS.
4. Management Action Plan
To ensure compliance by the January 1, 2027 deadline, RE management must undertake the following steps:
-
Policy & Process Overhaul (By Q3 2026):
- Revise the internal Fair Practices Code (FPC) and loan recovery policies to explicitly include the new anti-harassment rules, specific contact hours (8 AM – 7 PM), and privacy mandates.
- Update data sharing agreements with all third-party recovery agencies to strictly limit the transfer of borrower data.
-
Vendor Management & Certification Drive (Immediate Action):
- Audit all current recovery agencies and individual agents.
- Mandate that all agents obtain IIBF certification before the January 2027 deadline. Implement a tracking mechanism to monitor certification status.
- Terminate contracts with agencies that fail to meet due diligence or certification standards.
-
Technology & Systems Update (By Q4 2026):
- Review any “kill-switch” or device-locking technologies used for financed mobile devices.
- Reconfigure software to ensure that even in default, devices retain the ability to receive incoming calls and SMS, and make emergency SOS calls. Complete disabling must be stopped immediately.
- Implement a centralized system to log and trace all communications (calls, SMS, emails, visits) made by both internal staff and external agents to borrowers.
-
Training and Sensitization (Ongoing through 2026):
- Conduct mandatory training programs for internal recovery staff and external agents focusing on ethical practices, legal boundaries, and the new RBI code of conduct.
-
Audit & Compliance Monitoring (Effective Jan 1, 2027):
- Establish periodic internal audits specifically focused on the performance of recovery agents, reviewing communication logs, and checking adherence to the FPC.
5. Real-World Examples & Implications
Example 1: The Financed Smartphone
Scenario: A customer finances a smartphone through an NBFC but misses two EMIs. Under old practices, the NBFC might use pre-installed software to “brick” or completely lock the phone until payment is made.
Under New RBI Rules: The NBFC can no longer completely disable the device. If they use software to restrict usage, they must ensure the user can still receive incoming phone calls and text messages, and use the emergency SOS dialer. This prevents a financial dispute from becoming a safety hazard for the borrower.
Example 2: The Overzealous Recovery Agent
Scenario: A third-party agent hired by a commercial bank calls a defaulting borrower at 10:30 PM, uses threatening language, and then calls the borrower’s employer the next day to complain about the unpaid debt.
Under New RBI Rules: This conduct violates multiple new directives. The bank would be held directly responsible. The calls outside 8 AM – 7 PM, the threatening language, and the privacy breach (contacting the employer) are all prohibited. The bank’s management action plan must include auditing this agency, potentially terminating the contract, and ensuring all agents have IIBF certification and FPC training.