RBI Regulations

RBI's New Recovery Agent Rules for NBFCs: What Changes from 1 January 2027

Loan recovery is where the relationship between a lender and a borrower is tested hardest. It is also where most borrower complaints begin.

On 6 August 2026, the Reserve Bank of India issued the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026. These directions replace RBI’s earlier, scattered instructions on recovery agents with one set of rules. The rules cover the full recovery process: the recovery policy, the phone call, the field visit, and the repossession of security.

For NBFC leadership, compliance, collections, and risk teams, this is an operational change as much as a policy change. It affects vendor contracts, agent training, call handling, borrower notices, technology systems, and grievance handling.

This article explains what RBI has notified, what it means in practice and what to review before the rules apply. Where we give our own view rather than RBI’s text, we say so.

Key Facts at a Glance

Item	Detail
Title	RBI (NBFC – Responsible Business Conduct) Third Amendment Directions, 2026
Reference	RBI/2026-27/230, DOR.MCS.REC.No.199/01-01-039/2026-27
Date of issue	6 August 2026
Effective date	1 January 2027
Legal basis	Sections 45JA, 45L and 45M of the RBI Act, 1934
Amends	RBI (NBFC – Responsible Business Conduct) Directions, 2025
Where the new rules sit	A new section in Chapter III (Responsible Lending Conduct), paragraphs 100A to 100AB

RBI first published these rules in draft form in May 2026. The final version was issued alongside matching amendments for other regulated lenders, including housing finance companies. This means recovery conduct is now held to a broadly common standard across banks and non-banks.

Which NBFCs Are Covered?

The directions apply to all NBFCs except the following:

• Mortgage Guarantee Companies
• Core Investment Companies
• NBFC-Account Aggregators
• Standalone Primary Dealers
• Non-Operating Financial Holding Companies
• NBFCs with no customer interface

The rules cover recovery of dues from borrowers in default, including taking possession of security. Where RBI says so explicitly, they also apply, with necessary changes, to routine collection from borrowers who are not in default.

The new section does not affect an NBFC’s statutory rights to enforce security. It also does not override recovery-related provisions in other directions, such as those on one-time settlements.

Two New Definitions

Recovery agency: Any entity or individual, other than the NBFC’s own employees, engaged under an outsourcing arrangement to help recover dues from a borrower in default. This includes taking possession of security. The contract’s label does not matter.

Recovery agent: A representative of a recovery agency who deals with the borrower on the NBFC’s behalf.

If an NBFC engages an individual directly under an outsourcing arrangement for recovery or possession work, the rules for both agencies and agents apply to that person.

What the New Rules Require

1. A board-approved recovery policy

Every covered NBFC needs a policy on collection and recovery, including possession of security. It must cover:

• triggers for starting recovery, and a graded escalation matrix
• a code of conduct for employees and agents
• how recovery is handled when a borrower dies
• a structured approach for borrowers in financial distress, including documented engagement before escalation and guidance on resolution options
• compensation for borrowers or guarantors who suffer loss from recovery action that breaches the directions

If the NBFC uses recovery agencies, the policy must also set out eligibility and due-diligence criteria, performance standards, audit and inspection arrangements, and penalties for agencies or agents that break the rules.

The distress requirement is easy to overlook. It asks lenders to show that they spoke to a struggling borrower about options before escalating recovery.

2. Due diligence, training and certification

• Agencies must be engaged through a due-diligence process consistent with the RBI (NBFC – Managing Risks in Outsourcing) Directions, 2025.
• Recovery agents must be background-verified before engagement and then at regular intervals set in the NBFC’s policy.
• Agents must hold the IIBF certificate for Debt Recovery Agents, or an equivalent from an institute tied up with IIBF.
• Agents already working who do not have the certificate must obtain it within one year of the effective date. By our calculation, that means by 1 January 2028. Confirm this date for your compliance calendar.
• The NBFC must obtain a written undertaking that agents will follow its code of conduct.

3. Disclosures to borrowers

• Website list: Publish an up-to-date list of empanelled recovery agencies, showing name, type, address, and period and purpose of engagement. Update it within seven calendar days of any change, and promptly when an agency is terminated.
• Before the first visit: Tell the borrower or guarantor the agency’s details at least one day before the first in-person visit.
• Change or termination: Tell the borrower immediately if the assigned agency changes or is terminated.

4. Fair treatment and call records

• Share only the borrower information needed for recovery, with safeguards, including penalties, against misuse.
• Record the time and number of calls.
• Record the content of calls, including calls the borrower makes to the number the NBFC has given, and tell the borrower the call is being recorded.
• Keep recordings for at least six months from the date of the call, or until the matter is disposed of if it is sub judice.
• Recovery targets and incentives must not push staff or agents towards harsh practices.

5. How employees and agents must behave

• Show an identity card. Agents must also carry an authorisation letter and a copy of the notice sent to the borrower.
• Deal only with the borrower or guarantor, not with neighbours or relatives.
• Contact borrowers only between 8:00 a.m. and 7:00 p.m., unless the borrower has asked otherwise. Respect any request to avoid a particular time.
• Meet at the borrower’s chosen place. Visit the home or workplace only if the borrower gives no choice or fails to appear on two or more successive occasions.
• Avoid inappropriate occasions such as bereavement, medical emergencies, calamities and marriage functions.
• For microfinance loans, recover at a mutually agreed place. Field visits to the home or workplace are allowed only after two successive missed appointments.
• Give a receipt for every payment collected.

RBI treats the following as harsh practices, and all of them are prohibited:

• abusive or threatening language
• posting borrower details or recordings on social media
• inappropriate messages
• excessive calls or messages, or contact outside permitted hours
• threatening or anonymous calls
• intimidating or harassing the borrower, their relatives, referees, friends or colleagues
• using or threatening violence
• false or misleading statements about the debt or the consequences of non-payment

6. Taking possession of security

If an NBFC relies on a possession clause, the clause must be legally valid and explained to the borrower when the loan is signed. The loan terms must set out:

• the notice period before possession
• when that notice can be waived
• the procedure for taking possession
• a final chance for the borrower to repay before sale or auction
• the procedure for returning possession
• the procedure for sale or auction

7. Device locking: allowed only in narrow cases

An NBFC cannot restrict or disable a borrower’s phone, tablet or laptop as a recovery tool. The only exception is recovering dues on a loan that financed that same device, and only if all of these conditions are met:

• The loan agreement clearly permits it and describes the procedure.
• No restriction starts until the loan is 30 days past due and the borrower has not paid despite notices.
• Full restrictions apply only after 60 days past due. Outgoing calls cannot be blocked before then.
• The mechanism is certified by the device manufacturer or operating-system platform, where such certification is available.

Further safeguards apply:

• Restrictions must be applied gradually.
• Incoming calls, SMS and emergency SOS must always work.
• The borrower must still be able to do their work.
• The borrower must be able to see the restriction status.
• Restrictions must be lifted within one hour of the dues being received.
• The NBFC must pay ₹250 per hour for wrongful or delayed unlocking caused by the NBFC, capped at the loan amount disbursed.
• After full repayment, the NBFC must remove the locking mechanism and guide the borrower to uninstall it.
• The borrower can prepay, in part or in full, at any time.
• There must be a grievance channel specifically for unlocking problems.

8. Monitoring and grievances

NBFCs must:

• set up a management structure to monitor recovery agencies
• review the recovery mechanism periodically
• provide a dedicated channel for recovery-related complaints
• include the grievance redressal officer’s name and contact details in every recovery communication

They must also keep complying with RBI’s outsourcing rules and with TRAI’s Telecom Commercial Communications Customer Preference Regulations, 2018.

What This Means for Your Loan Management and Collection Systems

This section is our analysis, not RBI’s text.

Most of these rules cannot be met with a policy document alone. They need system support. Here is how each requirement translates into what your technology must do:

Requirement	What your systems need to support
Agency list on website, updated within 7 days	A single agency master that feeds the website list
Notice one day before the first visit	Automatic borrower alerts triggered by visit scheduling
Contact only between 8 a.m. and 7 p.m.	Time-window blocks in the dialler and field app
Call recording and retention	Recording linked to each loan account, with retention rules
IIBF certification	Agent-wise certification tracking with expiry alerts
Grievance officer details in all communications	Notice templates that insert these details automatically
Device-locking conditions	A DPD-based workflow with an audit trail and a one-hour unlock record
Monitoring and MIS	Reports on agency conduct, complaints and escalations

Some of this groundwork is already available in lending software built for NBFCs. Vexil’s IFS NBFC software includes collection and recovery management, audit trails, MIS dashboards for tracking collections, and a legal and documentation module. Its mobile app supports collection management with geo-tagging and data masking. For microfinance lenders, where the rules on meeting places and field visits are stricter, the same questions apply to group and centre-based collection workflows.

Why This Amendment Matters

This section is our analysis, not RBI’s text.

• Vendor risk is now conduct risk. With formal definitions, certification and audit expectations, managing recovery agencies needs more oversight than a standard service contract.
• Operations must change. Call recording, retention, borrower notices and website updates need working processes and systems.
• Incentives are in scope. How you pay collectors is now a compliance question.
• Device-based recovery needs review. Any locking tool must be checked against the conditions above.
• Time is short. 1 January 2027 leaves little room for NBFCs with large agent networks.

Checklist: What to Review Before 1 January 2027

This is a practical starting point based on the notification. It is not an official RBI checklist.

1. Applicability: Confirm whether your entity is covered or excluded.
2. Policy: Update the board-approved recovery policy for the elements in paragraphs 100D to 100F.
3. Vendor mapping: List every third party involved in recovery and check it against the new definitions.
4. Contracts: Align due diligence, verification cycles, audit rights, penalty clauses, and code-of-conduct undertakings.
5. Certification: Track IIBF status for every agent across all agencies.
6. Borrower notices: Revise pre-visit notices, agency-change notices and grievance officer details.
7. Calls: Check recording, the borrower recording notice, and retention.
8. Incentives: Review targets and commissions for pressure towards harsh practices.
9. Loan agreements: Check possession clauses against paragraph 100R.
10. Device tools: Assess any locking mechanism against paragraphs 100S to 100U.
11. Monitoring: Set up review routines and management reports on agency conduct and complaints.

Conclusion

The Third Amendment Directions bring RBI’s recovery rules for NBFCs into one place and make them easier to audit. Before 1 January 2027, NBFCs need to update their recovery policy, tighten control over recovery agencies, fix their call and disclosure processes, and review any technology used in recovery.

At Vexil Infotech, we have built lending software for NBFCs since 2007, and we have seen how quickly a regulatory change becomes a system change. If you want to check how your current collection process measures up against the new rules, talk to our team.

Related update: RBI’s new large exposure limits for IDF-NBFCs

This article is for general information and is not legal advice. Check the full text of the directions and take professional advice for your specific situation.

Sources

• Reserve Bank of India, RBI (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, RBI/2026-27/230, 6 August 2026.
• Reserve Bank of India, RBI (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025.
• Reserve Bank of India, RBI (Non-Banking Financial Companies – Managing Risks in Outsourcing) Directions, 2025.