RBI's New Recovery Rules: 7 Things Agents Can't Do Anymore

Missed an EMI? The loan recovery agent who calls you next cannot do half the things agents used to get away with. In the last week of September 2026, the Reserve Bank of India issued final, binding directions on how lenders and their recovery agents must behave — and they take effect on **January 1, 2027**. These are not suggestions or draft proposals. After stakeholder feedback on earlier drafts, the RBI has now locked in a formal framework that applies across banks, co-operative banks and NBFCs. Here is every borrower right that changes, in plain language.

## What Exactly Did the RBI Announce? The central bank released its final directions on the conduct of loan recovery in late September 2026, following years of complaints about harassment by recovery agents. Reporting by ETV Bharat (September 24, 2026) and Business Standard confirms the rules are now final and binding, and will be in force from January 1, 2027. The headline shift: recovery is being brought under one disciplined regime. Lenders must adopt a single, board-approved recovery policy covering nine types of regulated entities — commercial banks, co-operative banks, NBFCs and others — closing the loopholes that let some lenders play by looser rules than others. Business correspondents are brought under the framework too. Note the timing carefully: the rules were announced in September 2026 but take effect on January 1, 2027. Until then, the existing guidelines apply — but knowing what is coming lets you hold lenders to the standard they are about to be bound by.

## 1. No Calls or Visits Before 8 AM or After 7 PM Recovery agents can contact you only between **8:00 AM and 7:00 PM**. Late-night calls, dawn visits, and the dreaded 10 PM "reminder" are explicitly out of bounds. This applies to both phone calls and physical visits. Separately, an agent must give you **at least one day's notice before the first physical visit** — no surprise doorstep confrontations to begin the process.

## 2. Agents Must Prove Who They Are Under the new framework, recovery agents must show identification, including certification from the Indian Institute of Banking & Finance (IIBF), when they engage with you. Lenders must publish the names of their empanelled recovery agencies, and borrowers must be informed if the recovery agency handling their account changes. Practical takeaway: if someone shows up claiming to be a recovery agent, you are entitled to see their ID and IIBF certification before engaging. If they cannot produce it, end the conversation and report it to the lender.

## 3. Harassment Is Banned — Explicitly The directions prohibit recovery agents from using abusive language, personal attacks, threats, or publicly shaming borrowers. They cannot contact your relatives, friends or colleagues to intimidate you into paying. Publicly humiliating a customer, making threatening or anonymous calls, sending inappropriate messages, and persistent calling are all outside an agent's authority — and, as a Lucknow police official noted in the ETV Bharat report, conduct like threats, assault or forcibly taking someone can attract criminal liability, not just regulatory action. The RBI's position is unambiguous: owing money is not a crime, and collection methods must stay within the legal framework.

## 4. Your Phone Cannot Be Held Hostage for an Unrelated Loan One of the most borrower-friendly provisions concerns device locking — a practice where lenders remotely restrict a borrower's smartphone, tablet or laptop to force repayment. The new rules draw a hard line: - A lender can apply software restrictions to a device **only if the loan was specifically taken to finance that exact device** (for example, a phone bought on EMI from the manufacturer). - Devices **cannot** be locked to recover unrelated dues — not for a personal loan, home loan, car loan or credit card bill. - Where locking is permitted, it follows a graded process: **no restrictions before a payment is 30 days overdue**, and full restrictions only after **60 days past due**, with due notice given. - Even under full restriction, **essential functions must stay available**: incoming calls, SMS and emergency SOS cannot be disabled. - Once you pay the pending dues, the lender must **restore all features within one hour**.

## 5. Your Personal Data Is Off-Limits Banks, their technology providers and recovery agents are strictly prohibited from accessing personal information stored on your device for recovery purposes — that means your contacts, photos, text messages, call records and location history. Any attempt to harvest this data for collection is against the rules and can invite remedial action. This matters because some lending and recovery apps have historically sought sweeping device permissions. Under the new framework, "collect only what is necessary, use it only for the stated purpose, with clear consent" is the governing principle.

## 6. Rs 250 Per Hour for Violations The rules introduce a concrete remedy where previously there was only process: if a lender wrongfully restricts your device or delays restoring it, it must compensate you at **Rs 250 per hour**, capped at the total loan amount. Recovery calls must be preserved for six months, creating an evidence trail, and violations of the recovery framework carry mandatory compensation. This is the provision that gives the rules teeth. A wrongful phone lock is no longer just a complaint — it is a meter running at Rs 250 an hour.

## 7. One Policy for Every Lender Regulatory arbitrage ends. The framework requires a single, board-approved recovery policy across nine categories of lender entities, so a borrower with an NBFC loan gets the same protections as one with a public-sector bank loan. Recovery agents empanelled by any regulated lender operate under the same conduct code.

## What About Loans Sanctioned Before January 2027? A question readers will rightly ask: the RBI's separate (Pre-payment Charges on Loans) Directions, 2025 — which bar prepayment penalties on floating-rate loans for individuals and MSEs — apply to loans sanctioned or renewed on or after January 1, 2026. The recovery conduct directions announced in September 2026 take effect January 1, 2027 and govern recovery *behaviour*, not loan contracts — so the conduct standards apply to recovery actions from that date regardless of when your loan was taken. If you are being harassed today, do not wait for January: the existing RBI guidelines already prohibit intimidation, and criminal law already covers threats and assault.

## What to Do If an Agent Crosses the Line Keep this checklist saved — it works under the current rules and becomes stronger from January 2027: - **Stay calm and document everything.** Note the agent's name, agency, time of contact, and what was said. Save call recordings, messages and screenshots. - **Demand identification.** Ask for the agent's ID and IIBF certification, and the name of the agency empanelled by your lender. Refuse to engage with anyone who cannot identify themselves. - **State the rule.** If contacted outside 8 AM–7 PM, or threatened, or shamed in front of others, say clearly that you know the RBI's conduct rules prohibit it. Agents counting on your ignorance retreat when the ignorance ends. - **Complain to the lender's nodal or grievance officer.** Every regulated lender must have one. Put the complaint in writing (email counts) and keep the reference number. - **Escalate after 30 days.** If the lender does not resolve your complaint within 30 days, raise it on the RBI's Complaint Management System (CMS) — the central bank's own grievance portal. - **For threats or physical intimidation, go to the police.** Harassment that crosses into threats, assault or wrongful restraint is a criminal matter. File an FIR; do not let anyone tell you it is "just a loan recovery dispute." - **Never hand over your phone or its passwords** to a recovery agent, and never grant device permissions to a recovery app beyond what is strictly necessary. *This article is for educational purposes only and is not financial advice. Please consult a SEBI-registered investment adviser for personalized guidance. Investments are subject to market risk.*