RBI Tightens Loan Recovery Rules: No Calls After 7 PM, Stricter Oversight From 2027

The Reserve Bank of India (RBI) has issued a new framework for loan recovery that draws a clearer line between legitimate recovery and borrower harassment. The rules, effective from January 1, 2027, will apply to all banks and regulated lenders, including those using technology-enabled recovery methods such as remote locking of financed devices.

Under the new guidelines, recovery agents can contact borrowers only between 8 am and 7 pm. Calls or visits outside this window are allowed only if the borrower has explicitly requested or authorised them. Agents have also been instructed to avoid contacting borrowers during sensitive situations such as bereavement, medical emergencies, or marriage functions.

The RBI has explicitly barred threatening, abusive, or intimidating language. Recovery agents cannot make anonymous calls, repeatedly contact borrowers, publicly humiliate them, or threaten their family, assets, or reputation. The rules also prohibit posting personal information, photographs, videos, or audio recordings on social media to shame borrowers.

For in-person visits, the framework introduces a layer of transparency. Before the first visit by a recovery agency, the borrower must be informed at least one day in advance, and the bank must provide details of the agency assigned to the case. Recovery agents are expected to contact borrowers at a place of their choice. If no preference is given, or if the borrower repeatedly fails to appear at the chosen location, the agent may visit the home or workplace.

Recovery agents must carry an identity card, an authorisation letter, and the relevant notice. The authorisation letter must include contact details for the agency and the bank's grievance officer. This ensures that borrowers can verify the legitimacy of any recovery agent.

The new framework also holds lenders accountable for monitoring recovery agencies. Banks will have to record recovery conversations and maintain details such as the time and number of calls. These records must generally be preserved for at least six months. Even when recovery is outsourced, the lender remains responsible for the agency's compliance. Recovery agents must be properly trained, and incentive structures should not encourage aggressive recovery tactics.

Privacy is another key area. Recovery agents should receive only the information necessary to recover dues. Banks must implement safeguards to prevent misuse of borrowers' personal information.

On technology-led recovery, the RBI has laid down specific conditions for remotely restricting financed smartphones, tablets, or laptops. The loan must have been specifically taken to finance the device. A lender cannot remotely disable a device for a default on an unrelated loan. Additionally, borrowers will have a waiting period before any remote action is taken, ensuring that the measure is a last resort rather than an immediate response to a missed EMI.

The RBI's move comes amid growing concerns over aggressive recovery practices that have led to mental distress and, in some cases, tragic incidents. By setting clear rules, the central bank aims to balance the rights of lenders to recover dues with the dignity and privacy of borrowers. The framework represents a significant step towards more humane and accountable debt recovery in India.