RBI Issues Amendment Directions on Recovery of Loan Dues and Engagement of Recovery Agents, 2026

Background: Why RBI Rewrote the Recovery Rulebook

Recovery-agent conduct has been a recurring flashpoint in Indian lending — from aggressive field visits to, more recently, digital lending apps remotely locking borrowers' phones to force repayment. Until now, RBI's guidance on this sat scattered across each regulated entity's own Responsible Business Conduct (RBC) or Fair Practices Directions, with no common definition of who counts as a "recovery agent," no uniform rulebook for call recording, and no explicit framework for the increasingly common practice of restricting a financed mobile device as a recovery tool.

RBI first floated a fix through the revised draft Amendment Directions released on May 20, 2026, inviting stakeholder feedback — a proposal we broke down in detail, including the original device-lock trigger points, in our earlier coverage of the draft guidelines. After examining industry feedback, the Reserve Bank has now finalised nine parallel Amendment Directions — near-identical in substance — that insert a common recovery framework into the RBC Directions (or Fair Practices Code, for HFCs) governing every class of regulated lender.

The result is a single, largely harmonised compliance standard: whether you are a scheduled commercial bank, an NBFC, a co-operative bank or a housing finance company, the recovery-agent rules you must follow from January 1, 2027 are, with a few structural exceptions, the same.

Applicability: Which Direction Applies to Whom

Each entity type received its own Amendment Direction, numbered and dated identically (August 6, 2026), inserting a substantively similar recovery framework at a different point in that entity's existing Directions.

All nine Directions come into effect on January 1, 2027. NBFCs excludes Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators, Standalone Primary Dealers, Non-Operating Financial Holding Companies, and NBFCs with no customer interface.

New Definitions: "Recovery Agency" and "Recovery Agent"

These definitions are inserted verbatim (with only the entity name changing) across all nine frameworks, and the existing recovery-related provisions in each entity's Directions are deleted and replaced wholesale with a new, self-contained Section.

1. The Recovery Policy Mandate

Every regulated entity must now put in place a board-approved policy on collection and recovery of loan dues — covering its own staff as well as outsourced recovery agents. At minimum, the policy must address:

• Triggers for initiating recovery, and a graded escalation matrix
• A code of conduct for both employees and recovery agents
• Recovery procedure where the borrower has passed away
• A structured, documented framework for borrowers in financial distress, including pre-escalation engagement and available resolution options
• Compensation payable to borrowers/guarantors for losses caused by non-compliant recovery action
• Where a technology-based device-lock mechanism is used — the graduated restrictions, notice timelines, and the role of any third-party service provider

On the recovery-agency-engagement side specifically, the policy must separately cover eligibility and due-diligence criteria for engaging recovery agencies, performance evaluation standards, inspection/audit and control mechanisms, and the procedures and penal actions to be applied against non-compliant agencies or their agents.

2. Engaging Recovery Agencies: Due Diligence, Training, Code of Conduct

REs must run antecedent verification on recovery agents both before engagement and periodically thereafter, aligned with the applicable outsourcing-risk-management Directions for that entity class. Every recovery agent must hold a certificate from the Indian Institute of Banking and Finance (IIBF), earned through its Debt Recovery Agent training programme or a tied-up institute's equivalent. REs must also frame a code of conduct binding both employees and agents, and obtain a written undertaking from each recovery agency that its agents will comply.

Separately, REs must put in place a management structure to monitor and control the activities of their recovery agencies — with agreements drafted to give the RE the contractual footing to do so — and must carry out a periodic review of the recovery mechanism to learn from experience and improve it. This oversight obligation sits alongside, but is distinct from, the initial due-diligence and training requirements above.

3. Disclosure, Notice and Fair Treatment

• Public agency list: an up-to-date list of empanelled recovery agencies — name, type, address, engagement period and purpose — must sit on the RE's website, updated within seven calendar days of any change, and promptly on termination.
• Prior intimation: before any in-person recovery visit, the borrower/guarantor must be told which agency has been assigned, at least one day in advance.
• Change/termination notice: borrowers must be immediately informed if the assigned agency changes, or if its engagement is terminated — so they don't keep dealing with an agent who no longer represents the lender.
• Information limits: borrower data shared with staff/agencies is capped at what recovery duties actually require, backed by penal provisions against misuse.
• Call recording: the time and number of recovery calls must be logged, and their content recorded — both the RE's outbound calls and the borrower's inbound calls to the number given to them — retained for six months (or until disposal, if sub judice), with the borrower told the call is being recorded.
• Incentive design: recovery targets and incentive structures — for staff or in agency contracts — must not push recovery agents toward harsh tactics.

4. Taking Possession of Security

Where a loan contract carries a possession clause, it must be legally valid and clearly disclosed to the borrower at the time of signing. The contract itself must spell out: the notice period before possession, when that notice can be waived, the possession procedure, a final repayment opportunity before sale/auction, how possession is handed back if resolved, and the sale/auction procedure.

5. Mobile-Device Locking as a Recovery Tool

This is the most closely watched piece of the new framework — RBI's first explicit rulebook for restricting or disabling a financed mobile phone, tablet, or laptop to force repayment. As we noted when the draft device-lock guidelines were first proposed, the final text retains the two-stage timeline while tightening compensation and disclosure obligations.

Conditions that must all be met before locking:

• The device's purchase was financed by the RE's own loan
• The loan agreement expressly permits device restriction, and spells out the procedure
• Due notice of the impending restriction is issued to the borrower
• The RE and/or its tech vendor holds OEM/OS-platform certification for the locking mechanism

Ongoing obligations once a device is locked:

• A gradual approach only — never an immediate full lock
• Essential functions (incoming calls, SMS, emergency SOS) can never be restricted
• Restrictions cannot cut off the borrower's ability to work or earn a living
• The borrower must always be able to see the current restriction status

Data-privacy backstop: Neither the RE nor its third-party service provider may access or use personal data on the device — contacts, SMS, call logs, photos, location history — for recovery or any other purpose, under any circumstances.

6. Field Conduct — Permitted Hours, Places and Prohibited "Harsh" Practices

7. Grievance Redressal and Other Compliance

Every RE needs a dedicated mechanism for recovery-related grievances, with the redressal officer's name, email, phone and address disclosed in the loan agreement and on every recovery communication. REs must also continue complying with the applicable outsourcing directions and with TRAI's Telecom Commercial Communications Customer Preference Regulations (TCCCPR), 2018, as amended.

Entity-Specific Nuances

NBFCs — the framework excludes Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators, Standalone Primary Dealers, Non-Operating Financial Holding Companies, and NBFCs with no customer interface at all.

Housing Finance Companies — rather than reproducing the full framework, RBI simply deleted the HFC's own Chapter-X clause (sub-section A.15, paragraph 170) and replaced it with a one-line cross-reference: HFCs must now comply with paragraphs 100A–100AB of the NBFC RBC Directions, 2025, directly.

All India Financial Institutions — only paragraph 32 was deleted (a narrower excision than the other categories), with the new Section E inserted immediately after it.

Local Area Banks — the original provisions were framed specifically around microfinance-loan recovery; the new Section H carries that context forward alongside the general framework.

Old vs New: What Materially Changes

Compliance Checklist

CorpLawUpdates Analysis

The headline change here isn't the policy paperwork — it's RBI finally putting hard rules around mobile-device locking, a recovery tactic that digital lenders have used for years without a dedicated regulatory framework. By fixing the 30-day and 60-day thresholds, mandating OEM certification, and attaching a real financial penalty (₹250/hour, uncapped except by loan value) for wrongful delay in unlocking, RBI has converted what was previously a grey-zone practice into a tightly bounded, auditable process. Expect this to become a standard compliance-audit checkpoint at every digital-lending NBFC.

The operational lift is the real challenge. Entities now have under five months from issuance to build call-recording infrastructure, publish and maintain a live recovery-agency list, retrofit loan documentation, and get every recovery agent IIBF-certified — across potentially large, geographically dispersed agent networks. For NBFCs and banks that lean heavily on Business Correspondents for rural recovery, the BC-as-recovery-agency reclassification alone could require renegotiating hundreds of outsourcing contracts.

Practitioners should watch two things closely. First, the NBFC exclusion list is narrow and specific — entities assuming they're outside scope because they're "not a typical lender" (Account Aggregators, Standalone Primary Dealers) should double-check against the actual carve-outs rather than assume. Second, the HFC approach — deleting a standalone clause in favour of a bare cross-reference to the NBFC Directions — signals RBI's broader appetite for consolidating overlapping conduct rules into a single source of truth, a pattern worth watching for future harmonisation across other RBC frameworks.

Looking ahead, we'd expect RBI to issue clarificatory FAQs before the January 2027 deadline, given the technical complexity of the device-lock certification requirement and the ambiguity around exactly how the one-year IIBF transition window interacts with each entity's differently-worded training clause. Entities that begin agent certification and system changes now, rather than waiting for the deadline, will be better placed.