Why the RBI Is Tightening the Screws
For years, borrowers have lodged complaints about the strong-arm tactics used by some loan recovery agents. These have ranged from incessant, late-night phone calls to threats, public shaming, and harassment of family and friends. To curb these unethical
practices and protect consumers, the RBI has consolidated and strengthened its guidelines. The new framework, announced on August 6, 2026, holds lending institutions—like banks and NBFCs—directly accountable for the conduct of the agents they hire. The goal is to ensure the recovery process, while necessary for lenders, is conducted fairly and with respect for the borrower's dignity.
What Changes for In-Person Visits?
The new rules bring significant clarity to in-person interactions. Recovery agents must now follow a strict code of conduct. They are required to carry a valid identity card and an official authorisation letter from the bank. Before an agent makes a first visit, the bank must inform the borrower about the assigned agency. Agents can only visit between 8 a.m. and 7 p.m., unless the borrower has specifically agreed to a different time. They are explicitly forbidden from using intimidating or abusive language, making threats, or publicly humiliating the borrower by creating a scene in front of neighbours or colleagues. Furthermore, agents cannot contact you during sensitive times like a medical emergency or bereavement.
Your Rights as a Borrower
These regulations empower you with clear rights. You have the right to be treated with respect. If an agent visits you, you can ask to see their ID and authorisation letter to verify their identity. All telephonic conversations between you and the recovery agent must now be recorded by the bank and preserved for at least six months. You also have the right to privacy; agents are not allowed to discuss your debt with your family members, friends, or colleagues to pressure you. If you experience any form of harassment, you can file a complaint through a dedicated grievance redressal mechanism that every bank is now required to establish for recovery-related issues.
New Rules for Digital and Data Privacy
The RBI's new framework also extends to the digital realm. In a significant move, the rules prohibit lenders from accessing personal information stored on your phone, such as contacts, photos, or call logs, for recovery purposes. They are also barred from remotely locking a borrower's mobile phone or other personal devices to force repayment of an unrelated loan. An exception exists if the loan was specifically taken to finance that device. Even then, lenders must follow a gradual process, provide ample notice, and cannot disable essential functions like incoming calls or emergency SOS features.
Impact on Lenders and Recovery Agents
The onus is now squarely on the banks and NBFCs. They must create a board-approved policy covering the entire recovery process, from when to action to how financially distressed borrowers should be handled. Lenders are also responsible for conducting due diligence on the recovery agencies they hire and ensuring all agents are properly trained and certified by the Indian Institute of Banking and Finance (IIBF). Incentive structures for agents cannot encourage coercive practices. These requirements mean lenders must invest more in compliance, training, and monitoring to avoid penalties for violations committed by their agents.
