RBI’s New Loan Recovery Rules From January 1, 2027: What the August 6, 2026 Directions Mean for Every Borrower

Quick Summary: What RBI Changed on August 6, 2026

• What happened: On 6 August 2026 the Reserve Bank of India issued nine circulars simultaneously, replacing the scattered instructions on loan recovery and recovery agents with a single comprehensive framework applying across every category of regulated lender.
• Who is covered: Commercial Banks, Small Finance Banks, Local Area Banks, Regional Rural Banks, Urban Co-operative Banks, Rural Co-operative Banks, All India Financial Institutions, Non-Banking Financial Companies and Housing Finance Companies. In practice, essentially every formal lender a business or individual borrows from.
• When it starts: 1 January 2027. These are not immediately operative, which gives lenders roughly five months to rewrite policies and contracts.
• The headline borrower protections: recovery contact only between 08:00 and 19:00; at least one day’s prior intimation before a recovery agent’s first visit; mandatory call recording preserved for six months; a published, current list of empanelled recovery agencies on the lender’s website; and a lender policy that must provide compensation to borrowers and guarantors for losses caused by non-compliant recovery.
• The genuinely new bit: a detailed code governing technology-based device locking, including compensation of Rs 250 per hour where a lender wrongly restricts a borrower’s mobile device or delays unlocking it after dues are paid.

What Exactly Did RBI Issue on August 6, 2026?

This was not one circular. It was nine, issued the same day, each amending the Responsible Business Conduct framework for a different class of regulated entity so that the same recovery rules land everywhere at once.

The commercial bank circular is issued under Sections 21 and 35A of the Banking Regulation Act, 1949; the housing finance circular under Section 30A of the National Housing Bank Act, 1987. All nine come into effect from 1 January 2027.

Structurally, RBI has deleted paragraphs 408 to 416 and 442 to 454 of the Responsible Lending Conduct chapter of the 2025 Directions and inserted a new Section L, “Conduct of Banks in Recovery of Loan Dues and Engagement of Recovery Agencies”, running from paragraph 454A to 454AB. The HFC circular takes a shortcut worth noting: it deletes the old recovery-agent sub-section in the Fair Practices Code and simply requires HFCs to comply with the corresponding paragraphs of the NBFC Directions. NBFCs and HFCs are now held to the same recovery standard as banks. That convergence is the real story.

Who Counts as a “Recovery Agency” Now? The Definition Got Wider

RBI has inserted a deliberately broad definition, and it closes the most-used loophole in this area.

A recovery agency is “an entity or individual (other than bank’s own employees) who has been engaged by a bank, irrespective of the contractual designation / nomenclature used for such engagement, under an outsourcing arrangement to assist in recovery of loan dues from a borrower in default, including taking possession of a security.” RBI then adds an explicit illustration: a Business Correspondent involved in recovery activities is a recovery agency for these purposes.

A recovery agent is the representative of that agency at the point of customer interface. Where an individual is engaged directly by the lender for recovery or possession work, both the agency-level and agent-level obligations apply to that person.

The phrase “irrespective of the contractual designation” is doing heavy lifting. Calling someone a collections consultant, a field verification partner or a business correspondent no longer takes them outside the framework. If the function is recovery, the rules apply.

The Borrower Protections, Paragraph by Paragraph

Before anyone shows up: disclosure and notice

• The lender must publish an up-to-date list of empanelled recovery agencies on its website, with name, type, correspondence address, period of engagement and purpose. The list must be updated within seven calendar days of any change, and promptly on termination of an agency.
• Before a recovery agency makes an in-person visit, the lender must intimate that agency’s details to the borrower or guarantor at least one day prior to the first visit.
• If the agency changes mid-process, the borrower must be notified immediately. If an agency’s engagement is terminated, borrowers assigned to it must be told immediately so they stop dealing with it.

Contact conduct: the hours rule and what counts as harsh

Recovery contact and visits are permitted only between 08:00 hours and 19:00 hours. Outside those hours, contact is allowed only where the borrower or guarantor has expressly requested or authorised it. A borrower’s request to avoid contact at a particular time must be honoured in normal circumstances.

Beyond the hours, RBI lists eight practices that are deemed harsh and prohibited outright:

1. Use of minatory or abusive language.
2. Use of social media to post video or audio recordings, or the personal details, of the borrower or guarantor.
3. Sending inappropriate messages by mobile or social media.
4. Excessive calling or messaging, or contact outside the prescribed hours.
5. Threatening or anonymous calls.
6. Intimidating or harassing the borrower or guarantor, or their relatives, referees, friends or co-workers, verbally, physically or otherwise, including acts intended to humiliate them publicly or intrude on their privacy.
7. Use or threat of violence to harm the borrower or their family, assets or reputation.
8. False or misleading representations about the extent of the debt or the consequences of non-repayment.

Item 6 is the one that will change field behaviour most. Contacting a defaulter’s employer, colleagues or extended family as leverage has been a standard collections tactic. It is now expressly a harsh practice.

Recording, data and incentives

• The lender must document the time and number of calls made to the borrower or guarantor, and must record the content of those calls, including calls the borrower makes back to the number the lender provided.
• Records must be preserved for six months from the date of the call, or until disposal in matters that are sub judice.
• The borrower must be told the conversation is being recorded.
• Borrower information disclosed to employees and agencies must be limited to what is needed for the recovery task, with penal provisions against misuse.
• Recovery targets and incentive structures must not induce harsh practices. This puts the lender’s own compensation design inside the regulatory perimeter, which is a meaningful shift.

Identification at the door

An employee or recovery agent visiting a borrower must display an identity card. The agent must additionally carry an authorisation letter and a copy of the prior-intimation notice. Those documents must carry the recovery agency’s telephone number and the contact details of the lender’s grievance redressal officer.

Practically: a borrower is entitled to ask for the ID, the authorisation letter and the notice, and to decline to engage if they are not produced.

Device Locking: The New Rules Nobody Should Miss

This is the most novel section, and it matters well beyond consumer lending.

The baseline is a prohibition. A lender shall not deploy any technology-based mechanism that restricts or disables functionality of a borrower’s mobile phone, tablet or laptop as a recovery tool, whether directly or through a third party. There is exactly one exception: where the device itself was financed by that loan. Even then, four conditions apply cumulatively:

1. The device acquisition was financed by the lender through the loan.
2. The loan agreement expressly and unambiguously permits the action and sets out the procedure.
3. Due notice is given per the agreed timeline, including details of the gradual restrictions. The full set of restrictions may take effect only after the loan is 60 days past due, and outgoing calls may not be restricted before the loan is 60 days past due.
4. The mechanism is certified by the device OEM or operating system platform, where such certification is provided.

Where locking is permitted, RBI then constrains how:

• A gradual approach, not disabling the device from the outset.
• Essential functionality must never be restricted: incoming calls, SMS and emergency SOS features.
• Restrictions must not deny the borrower access to activities related to their work or employment.
• The borrower must have visibility into the restriction status at any time.
• Restrictions must be reversed within one hour of dues being realised.
• For wrongful restriction, or delay in reversal attributable to the lender, the lender must compensate the borrower at Rs 250 per hour until remedied, capped at the loan amount disbursed.
• The borrower retains the right to prepay, partly or fully, at any stage.
• A grievance mechanism specifically for unlocking delays is mandatory.

Separately and absolutely: the lender and its service provider shall not access or use personal data on the borrower’s device, including contacts, SMS, call logs, photos and location history, for loan recovery or any other purpose under any circumstances. There is no exception drafted into that sentence.

Compensation: The Provision With Real Teeth

Two distinct compensation obligations now exist, and they are the practical enforcement lever.

1. General. The lender’s recovery policy must incorporate provisions for compensating borrowers and guarantors for loss arising from recovery actions, by the lender or its agencies, that are inconsistent with these Directions. This is a mandated policy element, not a discretionary goodwill gesture.
2. Specific. Rs 250 per hour for wrongful device restriction or delayed unlocking, capped at the disbursed loan amount.

For a borrower, the sequence to remember is: the conduct rule is in the Directions, the compensation obligation is in the lender’s own policy, and the grievance officer’s details must appear on every recovery communication. That is a complete complaint pathway.

What the Lender’s Policy Must Now Contain

Every covered lender must put in place a board-level policy on collection and recovery covering, among other things: triggers for initiating recovery; graded actions under an escalation matrix; a code of conduct for employees and agents; recovery where the borrower has died; and a structured framework for cases involving financial distress, including documented pre-escalation engagement and guidance on available resolution options.

That last item deserves attention from anyone advising a stressed business. RBI is requiring lenders to document an engagement step before escalation and to point the borrower at resolution options. A borrower in genuine distress will, from January 2027, have a regulatory basis to ask what pre-escalation engagement was undertaken.

On the agency side, the policy must cover eligibility and due diligence, performance standards, inspection and audit, and penal action against non-compliant agencies. Agents must hold certification from the Indian Institute of Banking and Finance (IIBF), or an institute with an IIBF tie-up, after completing the Debt Recovery Agents training programme.

Possession of Security: What Must Be in the Loan Agreement

Where a lender relies on a possession clause, it must ensure the clause is legally valid and was clearly brought to the borrower’s notice at the time of execution. The agreement must set out: the notice period before taking possession; circumstances in which notice can be waived; the procedure for taking possession; a final chance to repay before sale or auction; the procedure for returning possession; and the procedure for sale or auction.

These rights are without prejudice to a lender’s statutory enforcement rights under other laws, so this does not displace SARFAESI or similar machinery. It governs conduct, not entitlement.

Who Is Affected, and What to Do Before January 1, 2027

For MSMEs and founders with borrowings

Nothing to file, but three things to know. Recovery contact outside 8 am to 7 pm is not permitted from January 2027. Contacting your staff, suppliers or family as leverage is a deemed harsh practice. And if your business is heading into stress, the lender will be obliged to run a documented pre-escalation engagement rather than jumping straight to agents. Pull your loan agreements now and check what they say about possession and, for any device or equipment finance, about technology-based restrictions.

For CAs and advisers

When a client reports aggressive recovery, the practical checklist from January 2027 is: was the agency on the lender’s published website list; was one day’s prior intimation given before the first visit; did the agent produce ID, authorisation letter and notice; were calls within 8 am to 7 pm; and are call recordings available, given the lender must preserve them for six months. A complaint that cites specific paragraph obligations is materially stronger than one alleging harassment generally.

For NBFCs, HFCs and lending fintechs

This is a five-month implementation project, not a memo. Board-approved policy including the compensation clause; agency contracts rewritten to carry the code of conduct undertaking; the website disclosure list built and maintained on a seven-day cycle; call recording and six-month retention; IIBF certification verified across the agent base; incentive structures reviewed so they do not induce harsh practices; and, for anyone running device-locking technology, a full rebuild against the exception conditions including OEM certification and the one-hour reversal requirement. Digital lenders relying on device locking outside device finance need to stop, because the baseline is prohibition.

Frequently Asked Questions

When do these RBI recovery rules take effect?

1 January 2027. All nine circulars carry the same commencement date. The existing instructions continue to apply until then.

Do the new rules apply to NBFCs and housing finance companies, or only banks?

All of them. RBI issued parallel circulars for NBFCs (RBI/2026-2027/230) and HFCs (RBI/2026-2027/231). The HFC circular requires compliance with the corresponding paragraphs of the NBFC Directions, so the recovery standard is common across banks, NBFCs and HFCs.

What time can a recovery agent call or visit?

Only between 08:00 and 19:00. Outside those hours only where the borrower or guarantor has expressly requested or authorised it. A request to avoid a particular time must be honoured in normal circumstances.

Can a lender lock my phone if I default?

Generally no. The baseline is a prohibition on using device restriction as a recovery tool. The single exception is where that device was financed by that loan, and even then only with an express contractual clause, due notice, gradual restriction, no restriction of incoming calls, SMS or emergency SOS, no restriction of outgoing calls before the loan is 60 days past due, and OEM certification where available.

What happens if the lender does not unlock the device after I pay?

Restrictions must be reversed within one hour of realisation of dues. Where reversal is wrongly applied or delayed for reasons attributable to the lender, compensation is payable at Rs 250 per hour until remedied, capped at the loan amount disbursed.

Can recovery agents contact my relatives or employer?

No. Intimidating or harassing the borrower’s or guarantor’s relatives, referees, friends or co-workers, including acts intended to humiliate them publicly or intrude on their privacy, is expressly a deemed harsh practice. Recovery matters are to be discussed only with the borrower or guarantor.

The Bottom Line

RBI has taken instructions that were scattered across entity-specific rulebooks and consolidated them into one recovery-conduct standard that applies to banks, NBFCs and housing finance companies alike. The substance is not entirely new, but three things are: the definition of recovery agency now ignores contractual labels, compensation to borrowers is a mandatory policy element rather than a courtesy, and device locking is prohibited by default with a narrow, heavily conditioned exception. Lenders have until 1 January 2027, which is less runway than it sounds for anyone who has to renegotiate agency contracts and rebuild a collections technology stack. Borrowers should read the harsh-practices list once and keep it.

Source and Verification Note

Primary-source pinned. All nine circular numbers, reference numbers, exact titles, the issuing date of 6 August 2026, the commencement date of 1 January 2027, and every operative paragraph quoted or summarised above (paragraphs 454A to 454AB, and the definitions at 4(24A) and 4(24B)) were retrieved directly from the Reserve Bank of India’s own circular index at rbi.org.in on 7 August 2026. The enabling powers are stated in the circulars themselves as Sections 21 and 35A of the Banking Regulation Act, 1949 for banks, and Section 30A of the National Housing Bank Act, 1987 for housing finance companies.

Note on scope: the paragraph numbering cited is that of the Commercial Banks circular (RBI/2026-2027/223). The equivalent paragraphs in the SFB, RRB, UCB, RCB, AIFI, NBFC and HFC circulars follow the same substance within each entity’s own Directions, but the paragraph numbers differ. Readers should cite the paragraph numbering of the circular applicable to their own entity category.

Related Reading on TaxUpdate.in

• RBI TReDS Directions 2026: Trade Receivables Discounting for MSME Working Capital
• RBI’s New ECB Rules 2026: How Much Foreign Debt Your Company Can Raise
• RBI A.P. (DIR Series) Circular 19 of 2026: Special Rupee Vostro Accounts
• Section 43B(h) and MSME Payment Timelines

Dealing With Lender Pressure or Reviewing Your Facility Documents?

If your business is carrying stressed borrowings, or you want your loan agreements reviewed against what the new recovery framework will require from January 2027, the terms you agreed to matter more than the conversation you are having with the collections team. Talk to an expert and we will go through your facility documents and options with you.

Disclaimer: This article is published by Tax Update India for general information and professional awareness. It is not legal, financial or investment advice and does not create an adviser-client relationship. It is based on the nine Reserve Bank of India circulars dated 6 August 2026 amending the Responsible Business Conduct Directions, retrieved from rbi.org.in on 7 August 2026. Those Directions come into effect on 1 January 2027 and the position until then is governed by the existing instructions. Readers should read the circular applicable to their own entity category in full and obtain advice on their own facts before acting.

• Author
• Recent Posts

CA Adityavikram Banka

Founder & Director at A S Banka Advisors Private Limited

The author is a Practicing CA, Founder of A. S. Banka Advisors Private Limited & Partner of Dhiraj & Dheeraj.

You can reach out to the author on : info@asbanka.com

www.asbanka.com

Latest posts by CA Adityavikram Banka (see all)

• RBI’s New Loan Recovery Rules From January 1, 2027: What the August 6, 2026 Directions Mean for Every Borrower - August 7, 2026
• Form ITR-BN Explained: CBDT Notification 97/2026 and the New Block Assessment Return for Search Cases - August 7, 2026
• SEBI GARUDA Circular of July 30, 2026: How AIF Schemes Now Launch in 10 Working Days - August 4, 2026