The Draft Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Amendment Directions, 2026 proposes a standalone and more comprehensive framework governing recovery of loan dues and engagement of recovery agencies by NBFCs. The amendment directions is stated to have been issued in exercise of the RBI’s powers under Sections 45JA, 45L and 45M of the Reserve Bank of India Act, 1934.
The central effect of the draft amendment is that recovery conduct is no longer treated merely as a third-party agent issue, but as an NBFC governance, outsourcing, customer protection, disclosure, monitoring and grievance redressal issue. The proposed framework places primary responsibility on the NBFC to design policy architecture, control outsourced conduct, regulate customer contact practices, preserve evidence of recovery interactions, structure lawful possession processes, and prevent abusive or coercive recovery behaviour, while also introducing a narrowly tailored but highly regulated regime for device-disablement tools in financed-device loans.
As a structural matter, the amendment inserts the definitions of “Recovery agency” and “Recovery agent” into paragraph 6 of the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025. “Recovery agency” is defined broadly to mean any entity or individual, other than the NBFC’s own employees, engaged by an NBFC under an outsourcing arrangement to assist in recovery of loan dues from a borrower in default, including taking possession of security. Further, “Recovery agent” is defined as a representative of a recovery agency involved in recovery-related activities at the point of customer interface. The explanation makes clear that where an individual is directly engaged by an NBFC under an outsourcing arrangement for recovery or possession-related activities, the instructions applicable to both recovery agencies and recovery agents will apply to that individual.
In place of the earlier framework on “Responsibilities of Recovery Agents of the NBFC”, the amendment inserts a new Section J titled “Conduct of NBFCs in Recovery of Loan Dues and Engagement of Recovery Agencies”, and shifted the regulatory focus from only recovery agents to the broader conduct obligations of NBFCs themselves, their employees, and outsourced recovery agencies.
Under paragraph 100A, the new Section J applies to recovery of loan dues by an NBFC from borrowers in default, including taking possession of security. The proviso clarifies that wherever expressly specified, the provisions will also apply mutatis mutandis to collection of dues in the normal course from borrowers who are not in default. Paragraph 100B further states that these provisions operate without prejudice to any statutory rights available to an NBFC, and without prejudice to obligations relating to enforcement of security under any statute, as well as other Directions dealing with specific recovery actions such as one-time settlement. Paragraph 100C clarifies that for purposes of this section, “NBFC employees” includes employees deployed for recovery of loan dues, including taking possession of security.
The Directions require every NBFC to put in place a policy on collection and recovery of loan dues, including taking possession of security, whether carried out by its own employees or recovery agents. Under paragraph 100D, the policy is expected to cover trigger points for initiation of recovery, graded recovery actions through an escalation matrix, code of conduct for employees and recovery agents, and recovery of dues in cases involving death of a borrower. In relation to engagement of recovery agencies, the policy must also address eligibility and due diligence criteria, performance evaluation standards, inspection or audit mechanisms, controls for compliance with statutory and regulatory requirements, and procedures or penal actions in case of non-compliant agencies or agents. The policy must also incorporate provisions relating to compensation payable to borrowers or guarantors for loss arising from recovery-related actions of the NBFC or recovery agencies that are not consistent with the Directions.
In relation to outsourcing and onboarding of recovery agencies, paragraph 100E requires the NBFC’s due diligence process to conform to the RBI’s Reserve Bank of India (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025, as amended from time to time. The NBFC must also ensure that engaged recovery agencies verify the antecedents of their recovery agents at the pre-engagement stage and thereafter on an ongoing basis at a pre-defined periodicity specified in the NBFC’s policy. Paragraph 100F adds a mandatory training requirement by requiring NBFCs to ensure that only those recovery agents are engaged who have obtained certification from the Indian Institute of Banking and Finance after completing the prescribed training programme for Debt Recovery Agents, or from another institute having a tie-up arrangement with IIBF. Recovery agents already engaged but lacking such certificate must obtain it within one year from the issuance of the Directions.
Paragraph 100G obliges the NBFC to frame a code of conduct for both recovery agents and its own employees based on the instructions contained in the Directions. Where a recovery agency is engaged, the NBFC must obtain an undertaking from that agency confirming that its recovery agents agree to comply with the code of conduct. This makes the NBFC directly responsible not only for prescribing behavioural standards but also for obtaining contractual confirmation of compliance from outsourced agencies.
The disclosure obligations imposed on NBFCs are extensive. Under paragraph 100H, the NBFC must make available an up-to-date list of recovery agencies empanelled with or engaged by it across all prominent customer-facing channels, including branches, offices, websites and mobile applications, as applicable. The list must include key particulars such as the name of the agency, whether it is corporate or individual, correspondence address, period of engagement, purpose of engagement, and assigned geographical areas. The list must be updated within seven calendar days of any modification, but where the agency’s engagement is terminated, the update must be immediate. Paragraph 100I further requires that before a case is forwarded to a recovery agency for recovery through an in-person visit, the borrower or guarantor must be notified of the agency’s details at least one day before the first visit through message or email on the registered contact details, or, where such contact details are unavailable, by letter to the current address at least three days before the visit. Paragraphs 100J and 100K require immediate notification to the borrower or guarantor if the recovery agency is changed during an ongoing process or if the agreement with the agency is terminated.
The Directions also impose customer protection measures during the recovery process. Paragraph 100L requires the NBFC to ensure that disclosure of borrower or guarantor information to employees or recovery agencies is limited strictly to what is necessary for recovery duties, and to put in place safeguards, including penal provisions, to prevent misuse of customer information. Paragraph 100M states that if a grievance relating to loan dues or recovery has been lodged by a borrower, the NBFC must not forward the concerned recovery case to an employee or recovery agency until the grievance is finally disposed of. Paragraph 100N requires the NBFC to document the time and number of calls made by its employees or recovery agents to the borrower or guarantor and to maintain recordings of the content or text of such calls, as well as calls made by the borrower or guarantor to the number conveyed by the NBFC. These records must be preserved for six months from the date of the call, or until disposal where matters are sub judice. The NBFC must also take reasonable precautions, including informing the borrower or guarantor that the conversation is being recorded. Paragraph 100O further prohibits recovery targets or incentive structures in the recovery agency contract that may induce harsh recovery practices described in paragraph 100X.
For cases involving possession of security, paragraph 100P provides that where an NBFC incorporates a possession clause in the loan contract or agreement and relies on that clause to enforce its rights, it must ensure both that the clause is legally valid and that it is clearly brought to the borrower’s notice at the time of execution. The loan contract or agreement must accordingly include provisions on notice period before taking possession, circumstances in which the notice period can be waived, procedure for taking possession, final opportunity for repayment before sale or auction of the security, procedure for returning possession to the borrower, and procedure for sale or auction of the security. This effectively requires ex ante contractual clarity on the entire possession and enforcement process.
The Directions introduce a specific regime for technology-based recovery tools affecting financed mobile devices. Paragraph 100Q prohibits an NBFC from using any technology-based mechanism that restricts or disables the functions of a borrower’s mobile phone, tablet or similar device as a recovery tool, except where the loan financed acquisition of that device. Even in such cases, this mechanism may be used only if the loan contract expressly and unambiguously allows it and sets out the triggering events, notice process, graduated restriction approach, cure period and grievance redressal mechanism. In addition, a first notice can only be issued after the loan becomes 60 days past due, giving the borrower at least 21 days to cure the default, followed by a second notice after expiry of the first notice period giving at least another 7 days. The explanation makes clear that restriction or disablement cannot be deployed until the loan has become 90 days past due and the borrower has failed to cure the default despite both notices.
Paragraph 100R sets out detailed safeguards for any such device-restriction mechanism. The NBFC must adopt a graduated approach rather than disabling the device ab initio, and cannot disable essential functions such as internet access, incoming calls, emergency SOS features, or receipt of emergency government or public-safety notifications. Restrictions must be reversed expeditiously and in any case within one hour of cure of default. If there is wrongful restriction or delay in reversal after cure, the lender must compensate the borrower at the rate of ₹250 per hour until the wrongful action is remedied. The mechanism must be uninstalled soon after the loan is fully repaid, the borrower must retain the right to prepay the loan at any stage, and the NBFC must maintain a robust grievance redressal mechanism for issues relating to unlocking. Paragraph 100S separately imposes an absolute prohibition on the NBFC accessing, using, obtaining or retaining any data stored in the borrower’s mobile device for loan recovery or any other purpose.
On governance and oversight, paragraph 100T requires an NBFC to establish a management structure to monitor and control the activities of recovery agencies and to ensure that they do not engage in conduct that could damage the NBFC’s integrity and reputation. The NBFC must ensure that its agreement with each recovery agency contains necessary provisions to support this control framework. Paragraph 100U further requires a periodic review of the recovery mechanism so that lessons from experience are incorporated and improvements are made over time.
The operational conduct requirements applicable to NBFC employees and recovery agents are also set out in detail. Under paragraph 100V, during any visit for collection, recovery or taking possession of security, the employee or recovery agent must identify themselves through identity cards issued by the NBFC and the recovery agency respectively. The recovery agent must also carry an authorisation letter issued by the NBFC or recovery agency and a copy of the notice issued under paragraph 100I. The authorisation letter and notice must include, among other things, the telephone number of the recovery agency and the grievance redressal officer appointed by the NBFC under paragraph 100Y.
Paragraph 100W prescribes standards of conduct during borrower interaction. Recovery-related discussions may be held only with the borrower or guarantor, as applicable. The employee or recovery agent must behave in a civil manner and maintain decency and decorum during visits. Only authorised representatives may visit borrower or guarantor premises. Contact or visits may ordinarily take place only between 08:00 hours and 19:00 hours, unless the borrower or guarantor expressly requests or authorises otherwise, and requests to avoid contact at a particular time should ordinarily be respected. Contact should generally occur at the place chosen by the borrower or guarantor; only if no specific choice is made, or if the borrower or guarantor fails to appear at the chosen place on two or more successive occasions, may contact be made at residence or place of business or occupation. The Directions also require agents to avoid calls or visits on inappropriate occasions such as bereavement, calamitous events or marriage functions. For microfinance loans, collection or recovery must generally take place at a mutually decided designated or central designated place, though field staff may collect at residence or workplace if the borrower fails to appear at the designated place on two or more successive occasions. Any written communication must have prior approval of the NBFC and include the sender’s name and contact details, and proper acknowledgement or receipt must be promptly given for dues collected or recovered.
Paragraph 100X prohibits harsh recovery methods and gives an illustrative list of practices deemed harsh. These include use of minatory or abusive language; posting video, audio or personal details of the borrower or guarantor on social media; sending inappropriate mobile or social media messages; excessive calling or messaging, including outside prescribed hours; threatening or anonymous calls; intimidation or harassment of the borrower, guarantor, or their relatives, referees, friends or co-workers; use or threat of violence or other means to harm family, assets or reputation; and making false or misleading representations, particularly regarding the extent of debt or the consequences of non-payment. The provision is framed broadly so that the listed practices are deemed harsh without limiting the wider prohibition on harsh recovery methods generally.
For grievance handling, paragraph 100Y requires every NBFC to maintain a dedicated mechanism for redressal of recovery-related grievances. The details of this mechanism must be provided to the borrower both in the loan agreement and when the NBFC communicates the details of the recovery agency under paragraph 100I. In addition, all recovery-related communications issued by the NBFC must include the name, email address, telephone number and address of the relevant grievance redressal officer whom the borrower or guarantor may contact.
Finally, paragraph 100Z clarifies that compliance with this new recovery framework is in addition to compliance with other applicable RBI guidelines and guidelines issued by other authorities from time to time. The Directions specifically refer to the Telecom Regulatory Authority of India’s Telecom Commercial Communications Customer Preference Regulations, 2018, as amended, in relation to commercial communications aspects. This indicates that NBFCs must treat the new framework as supplemental and not exhaustive of all legal and regulatory obligations relevant to recovery conduct.
Reserve Bank of India (Non-Banking Financial Companies Click here