Executive Summary

On 6 August 2026, RBI issued nine parallel circulars amending the Responsible Business Conduct Directions applicable to Commercial Banks, Small Finance Banks, Local Area Banks, Regional Rural Banks, Urban Co-operative Banks, Rural Co-operative Banks, All India Financial Institutions, NBFCs and Housing Finance Companies. Together they replace scattered recovery-conduct instructions with a single, detailed code governing recovery agents, technology-based device restrictions, and borrower compensation. The Directions take effect from 1 January 2027.

Correction to earlier draft: the IIBF-certification requirement, the device-locking restrictions and the ?250-per-hour compensation figure are genuine provisions confirmed directly from RBI's own circular text — they should not have been removed as "unsupported." The effective date is 1 January 2027, not immediate.

Background

Complaints about aggressive recovery practices — abusive calls, workplace visits, contact with relatives, and remote device locking by digital lenders — have persisted for years. RBI has now consolidated instructions into a single Section on "Conduct of Banks in Recovery of Loan Dues and Engagement of Recovery Agencies" across all nine circulars, issued under Sections 21/35A of the Banking Regulation Act, 1949 (Section 30A of the National Housing Bank Act, 1987 for HFCs).

What Has Changed?

The definition of "recovery agency" is widened to cover any outsourced entity engaged for recovery regardless of contractual label, expressly including Business Correspondents performing recovery functions.

Key Provisions

• Calling/visit window: contact permitted only between 08:00 and 19:00, unless the borrower has expressly authorised otherwise.
• Prior notice: the recovery agency's details must be given to the borrower at least one day before the first in-person visit.
• Website disclosure: lenders must publish an up-to-date list of empanelled recovery agencies, updated within 7 calendar days of any change.
• Deemed harsh practices (prohibited): abusive language; posting a borrower's details/recordings on social media; excessive or anonymous calls; contacting relatives, employers or co-workers to pressure repayment; threats of violence; misrepresenting the debt or consequences of non-payment.
• Call recording: mandatory, preserved for six months.
• Agent certification: recovery agents must hold IIBF Debt Recovery Agent certification (or an IIBF-affiliated equivalent).
• Device locking: technology-based restriction of a borrower's device as a recovery tool is prohibited by default. The sole exception is where the device itself was financed by the loan, subject to an express contractual clause, gradual restriction, no restriction of incoming calls/SMS/emergency SOS, no outgoing-call restriction before 60 days past due, and OEM/platform certification of the mechanism.
• Compensation: restrictions must be reversed within one hour of dues being cleared; wrongful restriction or delayed reversal attracts compensation of ?250 per hour, capped at the disbursed loan amount.
• Data use: lenders/agencies must not access a borrower's personal device data (contacts, SMS, call logs, location, photos) for recovery, under any circumstances.

Who Are Affected

Commercial Banks, SFBs, LABs, RRBs, UCBs, RCBs, AIFIs, NBFCs (including HFCs) — in practice, essentially every regulated Indian lender and its outsourced recovery agencies.

Practical Implication

Digital lenders using device-locking SDKs must rebuild their collection technology against the narrow exception conditions. All regulated entities must rewrite agency contracts, build agent-certification tracking, and implement call recording and website-disclosure processes — all before 1 January 2027.

What Businesses Should Do

1. Adopt a board-approved recovery policy covering escalation, distress handling and compensation.
2. Rebuild or discontinue device-locking mechanisms outside the narrow financed-device exception.
3. Build an IIBF-certification tracker for all recovery personnel.
4. Route all recovery calls through recorded, retained telephony systems (6-month retention).
5. Publish and maintain the empanelled-agency list on the website (7-day update cycle).
6. Review recovery-linked incentive structures to ensure they do not induce harsh practices.

KGS Perspective

This converts previously informal fair-practice expectations into a citable, enforceable code with a quantified compensation mechanism. Internal and statutory auditors should treat outsourced recovery as core operational risk — reviewing agency contracts, call records, device-locking logic (if any) and compensation accruals as part of the audit rather than as an ancillary outsourcing matter.

Conclusion

RBI has consolidated recovery-conduct rules into one enforceable standard applying uniformly across banks, NBFCs and HFCs, with a five-month-plus runway to 1 January 2027. Entities should treat this as a compliance project, not a policy update, given the scale of contract, technology and process change required.

Source / Regulatory Reference

• RBI Notification (RRB circular, RBI/2026-2027/226): https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=13668&Mode=0
   
• RBI Notification Index (all nine circulars, dated 6 August 2026): https://www.rbi.org.in/Scripts/BS_CircularIndexDisplay.aspx