The Reserve Bank of India (RBI) has pushed back the implementation of its revised framework governing loan recovery and engagement of recovery agents to January 1, 2027, from the earlier deadline of October 1, 2026. The extension, announced on August 6, 2026, came after banks and other regulated entities flagged that they needed more time to overhaul their systems, train recovery staff, and align workflows with the new directions. The revised framework consolidates multiple scattered instructions into a single set of conduct norms, making banks directly accountable for the behaviour of recovery agencies they outsource.
Why the RBI Extended the Timeline
The original deadline of October 1, 2026 was set after the RBI published its final amendment directions on August 6, 2026, following two rounds of public consultation. The first set of draft guidelines was released on February 12, 2026, and a revised draft was issued on May 20, 2026 for further stakeholder feedback. Banks, non-banking financial companies (NBFCs), and housing finance companies (HFCs) told the RBI that the technical and operational changes required to comply with the new directions were substantial. They pointed to the need for system overhauls, internal policy restructuring, and large-scale training of recovery agents as reasons for seeking more time.
The RBI accepted this feedback and extended the deadline by three months. It clarified that the extension was meant to facilitate smooth implementation rather than dilute the substance of the directions. Notably, the RBI did not relax certification requirements for newly engaged recovery agents. It rejected suggestions that agents should be allowed to interact with borrowers before obtaining certification, stating that doing so could expose borrowers to conduct risks from inadequately trained personnel.
What the Revised Framework Covers
The revised directions modify the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Directions, 2025, issued in November 2025. They replace the earlier fragmented provisions on loan recovery scattered across multiple circulars with a unified framework. Separate but parallel circulars were also issued for NBFCs (RBI/2026-2027/230) and HFCs (RBI/2026-2027/231), ensuring a common recovery standard across all regulated entities, including commercial banks, small finance banks, regional rural banks, payments banks, urban co-operative banks, rural co-operative banks, and all-India financial institutions.
Board-Approved Recovery Policy
Every regulated entity must now put in place a board-approved policy on collection and recovery of loan dues. This policy must clearly define the triggers for initiating recovery, an escalation matrix for graded actions, a code of conduct for employees and recovery agents, and procedures for handling cases where a borrower or guarantor has died. It must also set out a structured framework for borrowers facing financial distress, including documented pre-escalation engagement and guidance on available resolution options. Crucially, the policy must specify how the lender will compensate borrowers or guarantors for losses caused by recovery actions that violate the directions.
Recovery Agent Certification and Due Diligence
Banks must conduct due diligence before engaging any recovery agency, in line with the RBI’s outsourcing risk management directions. They must verify the antecedents of recovery agents both at onboarding and periodically thereafter. Under the revised rules, antecedent verification may now be carried out either by the regulated entity itself or by the recovery agency. Recovery agencies can deploy only those agents who have obtained certification after completing the Debt Recovery Agent (DRA) training programme offered by the Indian Institute of Banking and Finance (IIBF) or an institute affiliated with IIBF.
For existing recovery agents who were not previously covered by certification requirements, the RBI has granted a one-year transition window to obtain the necessary certification. This applies to agents engaged by entities that were not earlier subject to such mandates. However, newly engaged agents must be certified before they begin interacting with borrowers.
Key Changes from the Draft Guidelines
The final directions incorporated several modifications based on public feedback, while retaining the core intent of the framework.
Prohibited Recovery Practices
The RBI has drawn a clear line between recovery and harassment. Recovery agents are now expressly barred from using abusive or threatening language, making excessive or anonymous calls, publicly humiliating or shaming borrowers, contacting relatives, friends, or colleagues to pressure the borrower, posting personal information or recordings on social media, and making misleading representations about the debt or the consequences of non-payment. Recovery agents must also avoid contacting borrowers during bereavements, medical emergencies, or other inappropriate occasions.
Borrower Disclosure and Communication
Banks must publish an updated list of empanelled recovery agencies on their websites, including agency names, types, correspondence addresses, periods, and purposes of engagement. The list must be updated within seven calendar days of any modification. Borrowers must be informed about the recovery agency and the authorised agent before recovery proceedings begin, and promptly notified of any subsequent changes.
All telephonic conversations between recovery agents and borrowers must be recorded and preserved for at least six months. Recovery agents must carry valid identity cards and authorisation letters, identify themselves and the bank they represent at the start of every interaction, and contact borrowers only between 8:00 a.m. and 7:00 p.m., unless the borrower has expressly agreed to a different time.
Technology-Based Device Locking
The revised directions introduce strict safeguards for technology-based recovery tools, particularly the practice of locking financed mobile devices. Banks may disable specific functions of a financed phone, tablet, or laptop only if the device itself was financed by the bank and the loan agreement expressly permits such action. Restrictions can begin only after the account becomes 30 days past due following due notice, and complete restrictions may be imposed only after 60 days past due.
Essential features, including incoming calls, SMS, and emergency SOS services, cannot be disabled under any circumstances. The bank must also ensure that restrictions do not prevent borrowers from carrying out work-related activities on the device. Once the borrower clears the dues, the bank must reverse all restrictions within one hour. If the bank fails to restore the device within this window for reasons attributable to it, the borrower is entitled to compensation of ₹250 per hour, subject to a cap equal to the loan amount disbursed.
Changes Accepted and Rejected
The RBI accepted several suggestions from stakeholders. Antecedent verification of recovery agents may now be carried out by either the regulated entity or the recovery agency, a flexibility not present in the original draft. However, the RBI withdrew the proposal requiring lenders to publish details of individual recovery agents, citing operational concerns arising from high turnover in the category. Lenders will continue to publish details of empanelled recovery agencies.
The RBI also did not accept suggestions to exclude contractual possession clauses from loans enforced under the Securitisation and Reconstruction of Financial Assets and Enforcement of Security Interest (SARFAESI) Act, 2002. It stated that these provisions were intended to complement the existing legal framework by ensuring key aspects relating to possession of security were clearly incorporated in loan agreements and brought to the borrower’s notice.
The Role of IIBF Certification
The Indian Institute of Banking and Finance (IIBF), established in 1928 and headquartered in Mumbai, is a premier professional body offering banking and finance certifications. It is the sole certifying body for Debt Recovery Agents (DRAs) in India. The DRA certification programme was developed by the Indian Banks’ Association (IBA) in consultation with IIBF.
The training covers banking products, policies, procedures, and processes, along with the legal framework governing debt collection. It also focuses on soft skills development and inter-personal behavioural areas, equipping agents to interact with borrowers in a professional and respectful manner. The training duration is either 50 hours or 100 hours, depending on the agent’s background, followed by a certification examination conducted by IIBF.
Banks and NBFCs are required to ensure that all their recovery agents obtain DRA certification within a specified period. Service providers engaged by lenders for recovery functions must also employ only certified personnel. The certification is not just a formality. It ensures that agents understand borrower rights, the consequences of violating conduct norms, and the legal framework governing recovery.
The Way Forward
The revised framework signals a significant shift in how loan recovery is regulated in India. For years, complaints about aggressive and humiliating recovery tactics by agents of banks and NBFCs have been a persistent concern. The RBI’s decision to consolidate all existing instructions into one unified code, while placing direct accountability on banks for the conduct of outsourced agencies, marks a structural reset in the regulatory approach.
The three-month extension gives regulated entities a narrow window to overhaul internal systems, retrain recovery staff, and establish the dedicated grievance redressal mechanisms now mandated. Banks must also update their loan agreements to reflect the new provisions on contractual possession clauses, device locking, and borrower disclosures. For recovery agencies, the one-year transition window for existing uncertified agents is a practical concession, but it comes with a hard deadline.
The framework also reflects the growing importance of technology in the recovery process. As more banks and NBFCs adopt device-locking and app-based restrictions as recovery tools, the RBI has moved to prevent these from becoming instruments of borrower harassment. The compensation mechanism for wrongful device restrictions is a particularly strong signal that the regulator intends these norms to have teeth.
Borrowers, for their part, now have clearer protections and formal channels for redressal. The requirement for banks to publish recovery agency details, record all recovery calls, and establish dedicated grievance officers gives borrowers tangible tools to hold lenders accountable.
Key Takeaways
- The RBI extended the implementation of its revised loan recovery and recovery agent engagement framework from October 1, 2026 to January 1, 2027, citing the need for banks to make technical and operational changes.
- The revised directions modify the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Directions, 2025, consolidating multiple scattered instructions into a single unified framework.
- Existing recovery agents not previously covered by certification requirements are granted a one-year transition window to obtain Debt Recovery Agent (DRA) certification from the Indian Institute of Banking and Finance (IIBF).
- Recovery agents may contact borrowers only between 8:00 a.m. and 7:00 p.m., must record all calls, and preserve recordings for at least six months.
- For technology-based device locking, restrictions may begin only after 30 days past due, complete restrictions after 60 days past due, and devices must be restored within one hour of dues being cleared, with compensation of ₹250 per hour for delays.
- The IIBF, established in 1928 and headquartered in Mumbai, is the sole certifying body for DRAs, with training developed in consultation with the Indian Banks’ Association (IBA).
