RBI sets new loan recovery rules: What changes for borrowers in 2027

RBI's binding rules on recovery will restrict contact hours and recovery-agent conduct, while safeguarding against wrongful device locking, but third-party agents could pose challenges.

The Reserve Bank of India has now issued final, binding directions on loan recoveries, and how recovery agents for lenders need to interact and engage with the borrowers. The new rules, which kick in January 1, 2027, are no longer mere proposals but imply a final framework, after stakeholders’ feedback on the earlier drafts.

New rights to borrowers

The directions strengthen the borrower’s safeguards through clearcut rules for the interactions between the recovery agents and borrowers. These include: contact hours, visit notices, identification of the agents, and the latter’s conduct.

 

According to Jyoti Prakash Gadia, managing director, Resurgent India, borrowers can be contacted only between 8 a.m. and 7 p.m., with at least one day’s notice before a first physical visit. Borrowers must be informed of any changes in recovery agencies. Lenders must publish the names of empanelled agencies, while agents must show their IDs, and the certification issued by the Indian Institute of Banking & Finance (IIBF).

Do these norms improve earlier rules?

The new norms require a single, board-approved recovery policy across nine types of lender entities such as banks, cooperative banks, and non-banking financial companies (NBFCs) to reduce regulatory arbitrage. “The rules introduce graded device-locking safeguards: no locking before 30 days overdue, and full locking after 60 days,” says Gadia. He adds that the other measures include six-month preservation of recovery calls, bringing business correspondents under the rules, and mandatory compensation for recovery violations.

 

“The ₹250-per-hour compensation for wrongful restrictions or delayed restoration gives borrowers a clear remedy, and makes recovery more transparent and structured,” says Adhil Shetty, chief executive officer of BankBazaar.

What are the key positives?

There is greater clarity on the recovery process for both the borrowers and lenders. “The directions clarify recovery-agent oversight, technology-based recovery, and device restrictions, bringing greater consistency to the recovery process,” says Shetty.

 

Mandatory documentation of recovery contacts creates an objective record, reduces disputes, and helps curb inappropriate collector behaviour. “Limiting coercive incentives will push lenders to reward agents for compliance, and not just recoveries,” says Gadia.

Gaps or shortcomings

The effectiveness of the new norms will depend on how they are implemented. Lenders have until January 1, 2027, to align policies, systems, and recovery processes with the new rules. However, experts contend that compliance costs may rise due to the requirements such as call-record storage, agent verification, and automated unlocking.

 

“Loopholes may emerge as lenders may use unregulated digital channels, automated bots or informal skip-tracing to bypass the contact-hour restrictions,” says Gadia. He adds that third-party subcontracting networks may make real-time monitoring difficult. The success of new system will depend on whether borrowers, and how many, report harassment in the future.

Prohibitions for recovery agents

The RBI has spelt out eight harsh recovery practices that are now banned. According to Sameer Mathur, managing director and founder of Roinet Solution, they include abusive or threatening language; posting borrowers’ videos, audio, or personal details online; inappropriate messages; excessive calls or messages; threatening or anonymous calls; harassing or publicly humiliating relatives, friends, or colleagues; violence or threats of violence; and false claims about the debt or consequences of non-payment.

Rules that apply to calls and visits

Sarika Grover, co-founder of LoansJagat, points out that borrower consent is required for contact outside the mandated hours, and requests to avoid specific time slots need to be honoured by the recovery agents. Repeated same-day contacts after a borrower has responded are prohibited. Agents must remain respectful, avoid sensitive occasions, and share loan details only with the borrower or guarantor.

Identification norms for recovery agents

Recovery agents, who make physical visits must carry IDs, written authorisations, and copies of the advance notices, along with the agencies and lenders’ grievance officers’ contact details. “Apart from one-day notice before a visit, borrowers must be informed immediately if the recovery agency changes,” says Mathur. According to Grover, without the above-mentioned documents, the borrower can refuse the entry of the agent, or talk to her.

Can borrowers choose how and where to interact?

Borrowers’ preferred contact time or mode should be respected. Unannounced visits are prohibited. Mathur points out that lenders generally cannot lock devices, except when the device is financed. Even then, calls, SMS, and SOS must remain active, with outgoing calls restricted only after 60 days overdue.

Is the lender liable for agents’ misconduct?

The RBI rules hold lenders responsible for the conduct of recovery agencies and agents. “Lenders must conduct due diligence, periodically verify agents, and publish updated lists of impanelled agencies. Their recovery policies must provide for compensation for non-compliant recovery or agent misconduct, with complaints handled by the lender’s grievance officer,” says Grover.

When can lenders lock a financed device after default?

Remote-locking software installed on financed devices lets lenders restrict or disable them remotely. “As per new rules, even if locking is allowed, four conditions must be met: the device is loan-financed, agreement permits locking, due notice is given, and mechanism is manufacturer/OS certified, where available,” says Anshuman Panwar, co-founder, Creditas Solutions.

 

“The RBI rules require notice before device restrictions. After 60 days overdue, borrowers get 21 days to pay, followed by a second notice with seven more days. Restrictions can apply only after 90 days if dues remain unpaid,” says Ashraye Lalani, director, MegaCorp.

 

According to Panwar, restrictions must follow the exact days-past-due timeline. They cannot be imposed after just a single EMI default; the financed device, disclosure, notice, and required process must all be in place.

Safeguards to protect borrowers’ data and device access

A device is a lifeline, not leverage. “Lenders and their technology partners cannot access contacts, messages, call logs, photos, or location history — not to recover payments or for any other purpose. Even safety and connectivity features on the phone are protected,” says Panwar.

Remedies for wrongful locking

RBI has introduced clear accountability measures. “Apart from compensation, once the borrower regularises the account, the lender must restore functionality within one hour,” says Lalani. On full repayment, the lender must give up control of the mechanism and, where the borrower has to uninstall it, explain how.

 

The one-hour reversal is a key clause. “It forces payment to trigger real-time unlocking across the lender, its agents and the device. The Rs 250-per-hour compensation effectively shifts the cost of delayed unlocking from the borrower to lender,” says Panwar.

How should borrowers protect themselves?

According to Alay Razvi, managing partner, Accord Juris, a borrower should preserve evidence, and prepare a dated incident log. "S/he needs to keep records of calls, messages, visits, and threats, along with screenshots, recordings, and witness details. Preserve the original evidence and keep backups. Keep loan documents, repayment records, and lender notices. Preserve proof of any harm and ask the lender in writing to retain relevant call and visit records,” says Razvi.  (The writer is a Mumbai-based independent journalist)

 

What recovery agents cannot do

• Abuse, threaten or intimidate borrowers
• Share borrowers’ videos, audio or personal details online
• Send inappropriate messages or make excessive calls
• Make threatening or anonymous calls
• Harass or publicly shame family, friends or colleagues
• Use or threaten violence
• Make false claims about the debt or consequences of non-payment