A recovery agent repeatedly calling through the day, threatening a borrower, contacting relatives or colleagues about unpaid dues, or even turning up during a wedding or a medical emergency --- such practices have long made loan recovery particularly distressing for borrowers in default.From January 1, 2027, lenders and their recovery agents will face a much more detailed rulebook on what they can and cannot do. The Reserve Bank of India (RBI) this month has finalised sweeping new directions governing loan recovery, explicitly barring practices ranging from abusive or threatening calls and public humiliation to misuse of borrowers’ personal information.The framework extends across RBI-regulated lenders, including commercial and small finance banks, regional rural and co-operative banks, non-banking financial companies (NBFCs) and housing finance companies. Recovery agents generally come into the picture after a borrower defaults and the lender escalates the account for recovery.Besides setting rules for how and when borrowers can be contacted, the new RBI rules make lenders accountable for the conduct of recovery agents and introduce safeguards covering recorded calls, grievance redressal and even remote restrictions on financed mobile devices.Here is what borrowers need to know.Respecting your privacyUnder the new RBI mandate, collection agents cannot disrupt your life at arbitrary hours.In-person visits and recovery calls are strictly restricted to a daytime window between 08:00 hours and 19:00 hours, unless you have explicitly authorised contact outside these limits.To protect your dignity, recovery agents must maintain civil decorum at all times. They are strictly barred from discussing your outstanding dues with third parties, such as family, friends or colleagues, and cannot contact you during sensitive personal events like weddings, bereavements, or medical emergencies.When visiting your premises, recovery agents must display their identity card and carry an authorisation letter and a copy of the notice issued by the lender.Furthermore, banks must document every single call made to you, notify you that the conversation is being recorded, and archive all recovery call recordings for at least six months.All forms of “harsh methods”, such as using abusive language, making anonymous or threatening calls, and posting your personal information on social media, are strictly prohibited.Smart protectionsFor borrowers financing smart devices like mobile phones, tablets or laptops, the RBI has introduced cutting-edge protections against aggressive remote lockdowns.Lenders are now subject to strict, graded timelines. No restrictions can be placed on a financed device until the loan is at least 30 days past due. A full set of restrictions, including restricting outgoing calls, can only be initiated after 60 days past due.Importantly, your digital lifeline cannot be completely cut off. Lenders are legally barred from disabling essential functionalities, meaning you will always retain access to incoming calls, SMS and emergency SOS features.Furthermore, restrictions cannot deny you access to applications or services required for your active work or employment. Lenders and third-party software providers are also strictly prohibited from accessing your personal data, such as photos, contacts, location history, or call logs, under any circumstances.If you default and subsequently clear your dues, the lender must unlock your device within one hour of payment realisation. If they wrongfully lock your device or delay its reactivation, the lender must compensate you at a rate of ₹250 per hour for the duration of the lock. This compensation, designed to protect consumers from bureaucratic delays, is capped only by the total amount of the loan disbursed to you.Your right to redressTo guarantee professional conduct on the ground, the RBI has mandated that lenders only employ recovery agencies whose agents hold a professional certification from the Indian Institute of Banking and Finance (IIBF).For agents currently operating without this credential, the central bank provides a strict one-year transition period ending on January 1, 2028, to obtain the certification for most regulated entities.If you encounter non-compliant behaviour, you have clear avenues for redressal. Lenders must establish a dedicated grievance redressal mechanism, and the name, email, phone number and physical address of their Grievance Redressal Officer must be featured on all recovery communications and clearly written within your original loan agreement. Lenders can no longer deflect blame onto third-party agencies; they are held directly liable for their agents’ actions.Every lender must also have a board-approved policy incorporating provisions for compensating borrowers or guarantors for losses arising from recovery actions that violate these directions. This makes lenders accountable for misconduct even when recovery has been outsourced to a third-party agency.Published on August 15, 2026