RBI New Loan Recovery Rules 2027: Recovery Agent Guidelines, Calling Hours & Borrower Rights

The Reserve Bank of India has introduced new rules governing loan recovery by Non-Banking Financial Companies (NBFCs), recovery agencies and recovery agents. The Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026, dated August 6, 2026, set out detailed requirements covering recovery agent conduct, borrower communication, field visits, customer data, call recording, technology-based recovery, device restrictions and grievance redressal.

The new RBI loan recovery rules come into effect from January 1, 2027.

For borrowers, the most important changes include restrictions on harsh recovery practices, defined recovery-contact hours, advance information before recovery-agent visits, mandatory identification of recovery agents, stronger controls over borrower data, and specific safeguards around technology used to restrict financed mobile devices.

This guide explains the new RBI recovery agent guidelines in plain language and answers the questions borrowers actually ask. If an agent is already crossing the line, run the messages through our harassment rule analyzer — it maps what happened to the exact rule broken.

RBI Loan Recovery Rules 2027: Key Highlights

New rule	What borrowers should know
Effective date	January 1, 2027
Recovery contact hours	Generally 8:00 AM – 7:00 PM
Recovery-agent visit	Agency details must be provided at least 1 day before the first visit
Recovery agency disclosure	NBFCs must publish updated agency lists on their websites
Agent identification	Agents must carry identity card, authorisation letter and notice copy
Harassment	Threats, abuse, intimidation and public humiliation are prohibited
Social media	Personal details, videos or audio cannot be used for harsh recovery
Call records	Recovery calls must be documented and recorded as prescribed
Phone/device restriction	Permitted only in the specific device-financing circumstances covered by RBI
Personal phone data	Contacts, SMS, call logs, photos and location history cannot be used for recovery under the device-locking provisions
Device unlocking	Restrictions must generally be reversed within 1 hour after dues are realised
Wrongful restriction	Compensation of ₹250 per hour, subject to the prescribed cap

What has RBI changed with the new loan recovery rules?

The RBI has moved from relatively broad recovery-agent conduct requirements toward a much more comprehensive framework covering the entire recovery lifecycle.

The new framework places responsibility not only on recovery agents but also on the NBFC that appoints them — policy creation, due diligence, training, codes of conduct, agency monitoring, borrower information safeguards, recovery-call records, technology controls and grievance redressal.

Why are these RBI recovery rules important for borrowers?

Loan recovery is a legitimate part of lending. When a borrower fails to repay according to the agreed terms, the lender has contractual and statutory rights to recover its dues.

The process becomes problematic when borrowers face repeated calls, abusive language, threatening messages, contact with relatives or colleagues, public humiliation, unauthorised disclosure of personal information, anonymous calls or inappropriate visits.

The new framework specifically identifies several of these practices as harsh recovery methods. Default does not eliminate a borrower's basic right to dignity, privacy and fair treatment — a point we cover in detail in our recovery agent rights guide.

What is a recovery agency under the new RBI rules?

A recovery agency means an entity or individual, other than the NBFC's own employees, engaged by an NBFC under an outsourcing arrangement to assist in recovering loan dues from a borrower in default, including taking possession of security.

A recovery agent is a representative of a recovery agency involved in recovery activities on behalf of an NBFC at the point of customer interface.

The framework also addresses individuals directly engaged by an NBFC under an outsourcing arrangement for recovery or possession-related activities.

NBFCs must have a formal loan recovery policy

NBFCs must put in place a policy on collection and recovery of loan dues, including taking possession of security. The policy must cover triggers for recovery, graded escalation, codes of conduct, recovery in cases involving death of a borrower, and structured handling of financial distress.

It must also cover eligibility and due diligence for recovery agencies, performance evaluation, inspection and audit controls, procedures for non-compliant agencies, and compensation for borrowers or guarantors for losses arising from recovery actions inconsistent with the directions.

Recovery agencies must undergo due diligence

NBFCs engaging recovery agencies must establish due-diligence processes. The antecedents of recovery agents must be verified before engagement and subsequently on an ongoing basis, at a periodicity specified in the NBFC's policy.

Recovery agents must be trained and certified

NBFCs must ensure that recovery agencies engage agents who have obtained the prescribed certificate from the Indian Institute of Banking and Finance (IIBF) after completing the Debt Recovery Agents training programme offered by IIBF, or an institute with an appropriate tie-up arrangement with IIBF.

Existing agents without the certificate must obtain it within one year from the effective date of the directions.

NBFCs must maintain a code of conduct

NBFCs must establish a code of conduct for recovery agents and for their own employees involved in recovery. Where a recovery agency is engaged, the NBFC must obtain an undertaking that its agents will follow that code.

Recovery targets must not encourage harassment

NBFCs must ensure that recovery targets or incentive structures do not induce harsh recovery practices. The design of collection incentives is now an explicit part of responsible lending governance.

NBFCs must publish their recovery agencies on their website

NBFCs must make available an up-to-date list of recovery agencies empanelled with or engaged by them, including agency name, type, correspondence address, period of engagement and purpose of engagement.

The list must be updated within seven calendar days of a modification, and terminations must be reflected promptly. This gives borrowers a way to check whether the caller is actually authorised — useful alongside our guide on loan apps that are not RBI registered.

Borrowers must be told about an upcoming recovery agent visit

When a case is forwarded to a recovery agency for an in-person visit, the NBFC must intimate the borrower or guarantor about the recovery agency's details at least one day before the first visit.

If the recovery agency changes during an ongoing recovery process, the borrower or guarantor must be immediately notified. If the agency's agreement is terminated, affected borrowers or guarantors must also be immediately informed.

Your personal information cannot be freely shared with recovery agents

Information disclosed to employees or recovery agencies must be limited to what is necessary for recovery duties, and NBFCs must put safeguards in place to prevent misuse of customer information. This sits alongside your statutory data rights under the DPDP Act, 2023.

Recovery calls must be documented and recorded

NBFCs must document the time and number of recovery calls and ensure the content of calls is recorded. Calls made by the borrower or guarantor to the number conveyed by the NBFC must also be recorded.

Records must generally be preserved for six months from the date of the call — or, in sub judice cases, until disposal. Reasonable precautions, such as informing the borrower that the conversation is being recorded, are also required.

New rules on taking possession of security

Where an NBFC relies on a possession clause in the loan agreement, that clause must be legally valid and clearly brought to the borrower's notice at execution.

The agreement must address notice periods, circumstances for waiver, the possession procedure, a final repayment opportunity before sale or auction, return of possession, and sale or auction procedures.

Can loan apps lock your phone if you don't pay?

The framework does not generally permit an NBFC to use technology to restrict or disable a borrower's mobile phone, tablet or laptop as a recovery tool. An exception applies only where the concerned device itself was financed by the NBFC and the detailed conditions in the directions are satisfied.

Even then:

• the loan agreement must expressly permit the mechanism;
• due notice must be issued;
• restrictions cannot begin until the associated loan is 30 days past due and required notices have been served;
• full restrictions can become effective only after 60 days past due;
• outgoing calls cannot be restricted before 60 days past due.

Essential mobile functions cannot be disabled

Where permitted, device restrictions must be gradual. Incoming calls, SMS and emergency SOS features must remain available, and restrictions must not prevent work or employment activities. Borrowers must have visibility into the restriction status.

Lenders must unlock restrictions quickly after payment

Restrictions must be reversed expeditiously and no later than one hour after realisation of dues. Where wrongful restrictions or delays are attributable to the NBFC, compensation is prescribed at ₹250 per hour, subject to the overall cap specified in the directions.

Recovery technology cannot access your personal data

Under the device-locking provisions, an NBFC and its third-party service provider cannot access or use personal data such as contacts, SMS, call logs, photos or location history for loan recovery or for other purposes.

Borrowers have the right to prepay

The directions state that borrowers should have the right to prepay the loan, either partly or fully, at any stage.

What time can a recovery agent call you?

An NBFC employee or recovery agent should contact or visit the borrower or guarantor between 8:00 AM and 7:00 PM. Outside this window, contact should occur only when expressly requested or authorised by the borrower or guarantor.

A borrower's request to avoid calls or visits at a particular time should ordinarily be honoured. See also: recovery calls before 8 AM.

Borrowers can choose where recovery agents contact them

A recovery agent should ordinarily contact the borrower or guarantor at the place chosen by them. If no specific choice exists, or the borrower fails to appear at the chosen place on two or more successive occasions, contact may be made at the residence, place of business or occupation.

Recovery agents must identify themselves

During a recovery visit, an NBFC employee or recovery agent must identify themselves by displaying the relevant identity card. The agent must also carry an authorisation letter and a copy of the required notice.

The authorisation letter and notice must include relevant contact information, including the recovery agency's telephone number and grievance redressal officer details.

What recovery agents are not allowed to do

The RBI identifies the following as harsh recovery methods:

• abusive or threatening language;
• using social media to post borrower videos, audio or personal details;
• inappropriate messages;
• excessive calls or messages;
• threatening or anonymous calls;
• intimidation or harassment of relatives, friends, referees or co-workers;
• violence or threats of violence;
• false or misleading representations about the debt or the consequences of non-payment.

What if you are unable to pay your loan?

The new framework does not eliminate legitimate contractual dues. Borrowers facing financial difficulty should communicate through official channels, explain the difficulty, ask about available resolution options, and keep written records of all communications and payments. If restructuring or settlement is on the table, compare the options first: settlement vs restructure vs moratorium.

What should you do if a recovery agent harasses you?

Document everything: call logs, SMS, WhatsApp messages, emails, screenshots, payment receipts, notices, agent names and agency details, dates and times of visits, and complaints made to the lender.

The RBI requires NBFCs to have a dedicated mechanism for recovery-related grievances. Recovery communications must contain the relevant grievance redressal officer's name, email address, telephone number and address. If the lender does not act, escalate through the RBI Sachet complaint process or the RBI Ombudsman.

Do not confuse recovery with harassment

A lender has the right to seek repayment of legitimate dues and may take legally permitted recovery action. Recovery rights do not authorise threats, abuse, public shaming, misuse of private information, anonymous threats, violence, excessive contact or misleading statements.

What does the new RBI circular mean for digital lending apps?

The framework is particularly relevant to digital lending, where recovery can involve NBFCs, lending service providers, technology platforms, collection agencies and other outsourced providers.

The directions reinforce NBFC responsibility for due diligence, training, codes of conduct, agency monitoring, customer-information safeguards, grievance mechanisms and technology controls — building on the RBI Digital Lending Guidelines.

A new era of more accountable loan recovery?

The directions treat recovery as an area requiring governance, compliance, consumer protection, data protection and operational controls. Recovery-agency oversight is now an important part of responsible lending.

10 things every borrower should know about the new RBI recovery rules

1. Recovery agents must operate within a defined framework.
2. Recovery agencies must undergo due diligence.
3. Recovery agents need prescribed training and certification.
4. Recovery agencies must be disclosed.
5. Field visits require prior information.
6. Recovery calls must be documented.
7. Calls generally have defined hours of 8 AM to 7 PM.
8. Harassment is prohibited.
9. Phone-locking technology has strict limits.
10. Personal phone data cannot be used for recovery under the device-locking provisions.

What should NBFCs do before January 1, 2027?

NBFCs should review recovery policies, agency onboarding and due diligence, training and certification, recovery-agency contracts, incentive structures, technology mechanisms, data-sharing practices, monitoring, customer communication and grievance processes before the effective date.

Final takeaway for borrowers

If you have an outstanding loan with an NBFC or digital lender: understand the loan, communicate through official channels, maintain records, and ask about resolution options if you are facing genuine financial distress.

The RBI's new directions provide a clearer framework around recovery conduct, agency accountability, borrower communication, technology-based recovery and grievance redressal.

The broader message is simple: responsible lending does not end when a borrower misses a payment. Responsible recovery is also part of responsible lending.

Frequently asked questions

Is there a new RBI rule for loan recovery in 2027?

Yes. The Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026 introduce comprehensive rules for loan recovery and recovery agencies and come into effect on January 1, 2027.

What are the RBI rules for recovery agents?

They cover identification, training and certification, conduct, calling hours, field visits, customer-data protection, call recording, grievance redressal and prohibited recovery practices.

Can a recovery agent call after 7 PM?

Generally no. Recovery agents should contact borrowers between 8:00 AM and 7:00 PM. Contact outside this window requires the borrower's express request or authorisation.

Can recovery agents threaten borrowers?

No. Threatening, abusive, intimidating or violent behaviour is identified as a harsh recovery practice under the directions.

Can a recovery agent contact my family?

Recovery agents are required to deal with the borrower or guarantor regarding loan dues. The RBI specifically prohibits intimidation or harassment of relatives, friends, referees or co-workers.

Can a loan app access my contacts for recovery?

Under the device-locking provisions, the NBFC and its third-party provider cannot access or use contacts, SMS, call logs, photos, location history and similar personal data for recovery.

Can a loan app lock my phone?

Only in the specific device-financing context — where the device itself was financed by the NBFC — and subject to the detailed safeguards in the directions.

How long before a financed phone can be restricted?

Restrictions cannot begin until the associated loan is at least 30 days past due and required notices have been served. Full restrictions can become effective only after 60 days past due.

How quickly should a device restriction be removed after payment?

No later than one hour after realisation of dues, subject to the conditions in the directions.

Is there compensation if my device is wrongly restricted?

Where wrongful restriction or delay is attributable to the NBFC, compensation is prescribed at ₹250 per hour, subject to the applicable cap.

Official RBI circular

Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026.

• RBI reference: RBI/2026-27/230
• Circular: DOR.MCS.REC.No.199/01-01-039/2026-27
• Date: August 6, 2026
• Effective from: January 1, 2027

Source: Reserve Bank of India.

Disclaimer

This article is intended for general financial awareness and educational purposes only. It is based primarily on the Reserve Bank of India's Non-Banking Financial Companies – Responsible Business Conduct Third Amendment Directions, 2026. It should not be considered legal, financial or regulatory advice. Readers should refer to the applicable RBI directions, their loan agreement and the lender's official grievance mechanism for their specific circumstances.