RBI tightens loan recovery rules: What banks can and cannot do now

You miss an EMI by a few days. Within hours, an unknown number starts calling you, then your family members, then your office colleague. Someone shows up at your house, refuses to show identification, and threatens to tell your neighbours you are a defaulter.For years, this has been the lived experience of loan recovery for far too many Indian borrowers.In one of the most comprehensive overhauls of loan recovery practices in recent years, the RBI has issued fresh directions governing the conduct of banks and recovery agents, laying down detailed rules on everything from when borrowers can be contacted to what recovery agents can say, how banks must monitor them, and what compensation borrowers may receive if the rules are violated.The new directions will come into effect from January 1, 2027. The central bank said it had examined stakeholder feedback received on the draft directions released in May this year before issuing the final amendment directions. The objective is to establish a uniform framework for "conduct of banks in recovery of loan dues and engagement of recovery agencies" across commercial banks and several other regulated entities.For borrowers, however, the biggest takeaway is simple: the RBI has made it clear that recovering loans cannot come at the cost of dignity, privacy or fairness.WHY RBI HAS STEPPED IN Recovery agents have long been the subject of complaints from borrowers over aggressive recovery tactics. These range from repeated phone calls and intimidating visits to contacting relatives and colleagues or publicly humiliating borrowers on social media.The RBI's new framework directly addresses many of these concerns.It requires every bank to put in place a comprehensive, board-approved policy governing the collection and recovery of loan dues, whether the recovery is undertaken by its own employees or outsourced recovery agencies. The policy must specify when recovery action can begin, the escalation process, the code of conduct to be followed by recovery agents, procedures for handling financially distressed borrowers, recovery in case of the borrower's death, and the resolution options available before recovery escalates.The central bank has also directed banks to frame detailed policies governing the appointment, monitoring and auditing of recovery agencies, along with the action to be taken against agencies that fail to comply with regulatory requirements.In another significant move, the RBI has asked banks to incorporate provisions relating to compensation for borrowers or guarantors who suffer losses because recovery actions are not consistent with the new directions.RBI DEFINES WHAT RECOVERY AGENTS CANNOT DOPerhaps the strongest part of the new framework is the RBI's detailed list of recovery practices that it considers unacceptable.The regulator has said recovery agents and bank employees "shall not engage in any harsh methods" while collecting or recovering loan dues. It has gone a step further by clearly defining what amounts to "harsh" recovery.According to the RBI, recovery agents cannot:Use threatening, intimidating or abusive language.Post videos, audio recordings or personal details of borrowers on social media.Send inappropriate messages through mobile phones or social media.Repeatedly call or message borrowers or contact them outside the prescribed hours.Make anonymous or threatening phone calls.Harass or intimidate borrowers, their family members, relatives, referees, friends or colleagues.Publicly humiliate borrowers or intrude upon their privacy.Threaten violence or damage to a borrower's family, assets or reputation.Make false or misleading claims about the borrower's debt or the consequences of not repaying it.These provisions effectively codify several practices that borrowers have complained about over the years and make it easier for banks to identify misconduct by recovery agents.RECOVERY AGENTS CAN CONTACT YOU ONLY DURING FIXED HOURSThe RBI has also imposed strict timelines on when recovery agents and bank employees can approach borrowers.Under the new rules, they can contact or visit borrowers only between 8:00 am and 7:00 pm.Calls or visits outside these hours can take place only if the borrower has expressly requested or authorised them. Likewise, if a borrower asks the recovery agent not to call or visit at a particular time, that request must ordinarily be respected.The regulator has also recognised that recovery visits should not take place during sensitive personal situations.Recovery agents have been directed to avoid contacting borrowers during bereavement in the family, medical emergencies, marriage functions or other similar calamitous occasions.BORROWERS CAN CHOOSE WHERE THEY WANT TO MEETAnother borrower-friendly provision relates to where recovery discussions can take place.The RBI has said recovery agents should ordinarily contact borrowers at a place chosen by the borrower. Only if no such preference has been communicated—or if the borrower repeatedly fails to appear at the chosen location on two or more occasions—may the recovery agent visit the borrower's residence or workplace.For microfinance loans, the RBI has retained the principle that recoveries should normally happen at a mutually agreed designated location rather than at the borrower's home, except where the borrower repeatedly fails to appear.BANKS MUST TELL YOU WHO IS COMINGTo improve transparency, banks will no longer be allowed to send recovery agents to borrowers without prior intimation.The RBI has directed banks to inform borrowers at least one day before a recovery agency makes its first in-person visit. The intimation must include details of the recovery agency assigned to the case.If the bank changes the recovery agency during the recovery process, borrowers must be informed immediately. Likewise, if the agreement with a recovery agency is terminated, banks must notify affected borrowers so they do not continue dealing with unauthorised agents.Banks have also been directed to publish and regularly update the list of all empanelled recovery agencies on their websites, including their names, addresses, purpose of engagement and the duration of their appointment.BANKS CAN NO LONGER PASS THE BLAMEOne of the biggest messages in the RBI's new framework is that banks remain responsible for the conduct of recovery agents, even when the recovery process is outsourced.The central bank has directed banks to carry out proper due diligence before engaging recovery agencies. This includes verifying the antecedents of recovery agents before they are appointed and carrying out periodic checks thereafter. Banks have also been asked to establish clear performance standards, audit mechanisms and internal controls to ensure recovery agencies comply with regulatory requirements.To professionalise the sector, the RBI has further directed that recovery agencies should deploy only those recovery agents who have completed the Debt Recovery Agent training programme conducted by the Indian Institute of Banking and Finance (IIBF), or an equivalent programme offered by an institute having a tie-up with IIBF.The regulator has also asked banks to frame a code of conduct for both their own employees and outsourced recovery agents, and ensure recovery agencies formally undertake to follow it.EVERY RECOVERY CALL MUST NOW BE RECORDEDThe RBI has introduced another important safeguard aimed at improving accountability.Banks will now be required to maintain records of the time and number of recovery calls made to borrowers or guarantors. More importantly, they must also record the contents of these conversations, including calls made by borrowers to the contact numbers provided by the bank.The regulator has directed banks to preserve these recordings for at least six months from the date of the call. In cases where the matter is pending before a court, the records must be retained until the legal proceedings conclude. Borrowers must also be informed that the conversation is being recorded.The RBI believes this will improve transparency while also helping resolve disputes over the conduct of recovery agents.RECOVERY TARGETS CANNOT ENCOURAGE AGGRESSIVE PRACTICESThe RBI has also taken aim at the incentive structures often used by banks and recovery agencies.It has directed banks to ensure that recovery targets or incentive structures for employees and recovery agencies do not encourage harsh recovery practices.This means banks will have to review not only how recovery agents behave, but also how they are rewarded, ensuring that incentives do not push agents towards intimidation or harassment in order to recover dues quickly.RECOVERY AGENTS MUST IDENTIFY THEMSELVESBorrowers will also have greater clarity about who is visiting them.Under the new rules, recovery agents must display their identity cards while visiting borrowers. They must also carry an authorisation letter issued by the bank or the recovery agency, along with a copy of the notice issued by the bank informing the borrower that the recovery agency has been assigned the case.The authorisation letter must also mention the contact details of the recovery agency as well as the bank's grievance redressal officer, allowing borrowers to verify the identity of the person visiting them and report any misconduct.CUSTOMER DATA CANNOT BE MISUSEDRecognising growing concerns around privacy, the RBI has reminded banks that customer information shared with recovery agents must be limited strictly to what is necessary for carrying out recovery-related duties.Banks have been directed to put in place safeguards, including penal provisions, to prevent employees or recovery agencies from misusing borrowers' personal information in any manner.BORROWERS CAN SEEK COMPENSATIONPerhaps one of the most significant changes is the RBI's decision to make banks financially accountable when recovery actions violate the rules.The regulator has directed banks to incorporate provisions in their recovery policies for compensating borrowers or guarantors who suffer losses because recovery actions were "not consistent with these Directions."While the RBI has not prescribed a fixed compensation amount for recovery-related misconduct, it has made it clear that banks must have a policy to compensate affected borrowers.This marks a shift in responsibility, placing the onus squarely on banks to ensure their employees and outsourced recovery agencies comply with the regulatory framework.DEDICATED GRIEVANCE REDRESSAL MECHANISMThe RBI has also strengthened the complaint redressal process.Every bank will now be required to establish a dedicated mechanism for handling complaints relating to recovery practices.The details of this mechanism—including the name, email address, telephone number and office address of the grievance redressal officer—must be shared with borrowers in the loan agreement itself. The same information must also appear in all communications relating to recovery.This is expected to make it easier for borrowers to report misconduct without having to navigate multiple customer service channels.TECHNOLOGY-BASED RECOVERY GETS ITS OWN RULEBOOKApart from regulating recovery agents, the RBI has also introduced an entirely new framework governing the use of technology-based recovery tools, such as remotely restricting or disabling financed mobile devices.The central bank has laid down detailed conditions under which such technology can be used, including timelines, borrower safeguards, mandatory notices and compensation for wrongful device restrictions.Given the significance of these provisions, they merit a separate discussion and represent another major consumer-focused change introduced by the RBI.The revised directions will come into force from January 1, 2027, giving banks a few months to overhaul their recovery policies, train recovery agents, strengthen internal monitoring systems and establish grievance redressal mechanisms.For borrowers, however, the changes send a clear message.The RBI has recognised that while banks have every right to recover their dues, loan recovery cannot come at the cost of dignity, privacy or fairness. By defining what recovery agents can and cannot do—and making banks accountable for violations—the regulator has attempted to draw a clearer line between legitimate recovery and harassment.- EndsPublished On: Aug 7, 2026 08:56 IST