Introduction
The Reserve Bank of India has issued a sweeping set of directions governing how commercial banks and their recovery agents may pursue overdue loans. Notified on August 6, 2026 as the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Fourth Amendment Directions, 2026, this regulatory intervention rewrites the rules on recovery agent conduct, restricts the use of device-locking technology in loan recovery, and creates a compensation mechanism for borrowers subjected to wrongful recovery action. The directions take effect from January 1, 2027, giving banks a compliance window of roughly five months to overhaul recovery policies, contracts, and technology systems.
Background: Why RBI Tightened Loan Recovery Rules
Complaints about aggressive and often unlawful recovery practices by banks and their outsourced recovery agents have persisted for close to two decades. Borrowers have long reported abusive calls, workplace visits intended to cause public embarrassment, contact with relatives and employers to pressure repayment, and, more recently, the misuse of app-based lending platforms to remotely lock or disable financed mobile devices. The Reserve Bank had previously addressed some of these concerns through the Fair Practices Code and through the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Directions, 2025, but enforcement gaps remained, particularly around technology-enabled recovery and the accountability of third-party recovery agencies operating under different contractual labels.
The Fourth Amendment Directions, 2026 respond to these gaps by consolidating recovery-related obligations into a single, detailed framework applicable specifically to commercial banks other than Small Finance Banks, Payments Banks, Regional Rural Banks, and Local Area Banks, each of which is governed by parallel directions issued the same day for non-banking financial companies and housing finance companies.
The Statutory Basis: Banking Regulation Act, 1949
The Reserve Bank has issued these directions in exercise of powers conferred by Sections 21 and 35A of the Banking Regulation Act, 1949. Section 21 empowers the Reserve Bank to control advances made by banking companies, including the power to determine the policy in relation to advances that banks must follow. Section 35A confers a broader power on the Reserve Bank to issue directions to banking companies in the public interest, in the interest of banking policy, or to prevent the affairs of a bank from being conducted in a manner detrimental to depositor interests. Directions issued under Section 35A are binding, and non-compliance can attract penal consequences under the Act, including monetary penalties on the regulated entity.
This statutory foundation matters for borrowers and their advisers because it establishes that the recovery conduct rules are not merely advisory guidance. They carry the force of binding regulatory direction, and a bank’s failure to comply exposes it to regulatory action independent of any private law remedy the borrower may pursue.
Recovery Agency Engagement and Due Diligence
Banks that outsource recovery functions must now conduct due diligence on recovery agencies in line with the Reserve Bank of India (Commercial Banks – Managing Risks in Outsourcing) Directions, 2025. This includes verifying the agency’s financial soundness, conducting background checks on personnel deployed for recovery work, and ensuring agents undergo relevant training before engagement.
A significant addition is the mandatory requirement that individual recovery agents hold certification from the Indian Institute of Banking and Finance. This professionalises what has historically been a loosely regulated segment of the recovery chain and gives borrowers a concrete, verifiable standard against which to judge whether an agent visiting them is properly authorised.
Banks must also adopt board-approved collection and recovery policies covering the escalation matrix for overdue accounts, the conduct expected of employees and agents, procedures for handling cases involving the borrower’s demise or genuine financial distress, criteria for recovery agency empanelment, periodic performance evaluation of engaged agencies, and the governance around any technology deployed for recovery purposes.
Disclosure and Documentation Requirements
Transparency obligations form a core part of the new framework. Banks must maintain an updated list of engaged recovery agencies on their websites, including relevant details that allow a borrower to verify whether a person contacting them is genuinely authorised. Before a recovery agent’s first visit, the borrower must receive notice at least one day in advance, and any change in the agency assigned to a case, or its termination, must be communicated promptly.
Recovery-related calls and visits must be recorded and the recordings preserved for six months, or until the conclusion of any related litigation, whichever is later. This creates an evidentiary record that borrowers can invoke when raising grievances, and one that regulators and courts can rely on when adjudicating disputes over recovery conduct.
Restricted Hours for Recovery Contact
The directions cap permissible recovery contact, whether by call, message, or visit, to the hours of 08:00 to 19:00, unless the borrower has expressly authorised contact outside this window. This hour restriction addresses one of the most frequently reported forms of harassment: late-night or early-morning calls intended to intimidate rather than genuinely communicate about repayment.
Technology-Based Device Restrictions: Scope and Limits
The directions specifically address the practice of remotely restricting or disabling mobile devices financed under a loan when the borrower falls into default. This mechanism is permitted only where the loan itself financed the device in question, and only where the loan agreement contains an express contractual clause authorising such restriction.
Even where these conditions are met, the restriction must follow a graduated approach rather than an outright shutdown. Under the directions, initial restriction may begin once the account is 30 days past due, with fuller restriction permissible only after 60 days of continued default. Throughout any restriction period, essential functionalities, including the ability to receive incoming calls, receive SMS, and access emergency services, must remain available to the borrower.
Where a bank wrongfully restricts a device, or delays restoring functionality after the borrower has cleared the overdue amount, the directions prescribe compensation of ₹250 per hour of wrongful restriction, subject to a cap equal to the loan amount. This is a rare instance of an RBI direction quantifying a specific per-hour compensation figure, and it gives borrowers a clear, calculable basis for a compensation claim rather than having to establish loss through open-ended negotiation.
The directions also impose an absolute prohibition on lenders accessing personal data stored on the device, including contacts, messages, photographs, or location information, regardless of the circumstances. This restriction operates alongside the broader data protection obligations that apply to any entity processing personal data under the Digital Personal Data Protection Act, 2023, which governs how data fiduciaries, including lenders and their technology partners, may collect, use, and retain an individual’s personal data. A recovery agency or lending app that accesses device data beyond what the loan agreement authorises risks liability under both frameworks simultaneously.
Practices Deemed Harsh and Expressly Prohibited
The directions enumerate specific conduct that is deemed a harsh recovery practice and is therefore prohibited outright. This includes the use of abusive or threatening language, contacting the borrower’s relatives, friends, or co-workers to exert pressure or cause embarrassment, disclosing the borrower’s debt status on social media or to third parties, making threats of violence or criminal action that the recovery agent has no authority to initiate, and misrepresenting the extent of the debt or the consequences of non-payment.
These prohibitions give statutory colour to conduct that borrowers have long characterised as harassment but often struggled to frame as a specific regulatory violation. A borrower can now point to a defined paragraph of a binding RBI direction rather than relying solely on generalised allegations of unfair treatment.
Grievance Redressal and the RBI Ombudsman
Banks must establish a dedicated grievance redressal mechanism for recovery-related complaints, with the contact details of the responsible officer disclosed in the loan agreement itself and repeated in recovery communications. Where a borrower is dissatisfied with the bank’s response, or receives no response within a reasonable period, recourse lies to the Reserve Bank – Integrated Ombudsman Scheme, 2021, which consolidates the erstwhile separate ombudsman schemes into a single window for resolving complaints against regulated entities, including complaints relating to recovery agent conduct.
Criminal Law Remedies Available to Borrowers
Beyond the regulatory framework, a borrower subjected to threats, intimidation, or unauthorised entry by a recovery agent retains recourse under general criminal law. The Bharatiya Nyaya Sanhita, 2023, which has replaced the Indian Penal Code, criminalises such conduct independently of the RBI’s regulatory directions. Criminal intimidation, involving a threat of injury to a person, their reputation, or their property made with intent to cause alarm, is punishable under Section 351 of the Bharatiya Nyaya Sanhita, with enhanced punishment where the threat involves death or grievous hurt. Unauthorised entry into a borrower’s residence or workplace by a recovery agent may attract liability for criminal trespass under Section 329 of the same code. These criminal remedies operate in parallel with, and independently of, the compensation and grievance mechanisms created by the RBI directions, and a borrower facing genuinely threatening conduct is not required to exhaust the bank’s internal grievance process before approaching the police.
Compliance Roadmap for Banks Before January 1, 2027
Banks have a limited window to bring recovery operations into alignment with the new directions. Priority areas include redrafting loan agreements to incorporate the mandatory disclosures around device restriction and recovery agent authority, building the website disclosure infrastructure for empanelled recovery agencies, implementing call and visit recording systems with the required six-month retention, verifying that all deployed recovery agents hold current Indian Institute of Banking and Finance certification, and revising recovery policies to build in the graduated approach required for any technology-based restriction. Given that the directions apply concurrently with parallel instructions issued to NBFCs and housing finance companies, banks that route recovery through group NBFC entities or shared recovery agencies will need to ensure consistent compliance across the group rather than treating each regulated entity’s obligations in isolation.
Conclusion
The Fourth Amendment Directions, 2026 mark a meaningful shift from principle-based guidance to a detailed, enforceable code governing recovery conduct, backed by the binding force of Sections 21 and 35A of the Banking Regulation Act, 1949. For borrowers, the directions convert previously informal expectations of fair treatment into specific, citable obligations, supported by a quantified compensation mechanism for device-related violations and reinforced by existing criminal law remedies. For banks, the compliance burden is substantial but time-bound, with the January 1, 2027 effective date leaving little room for delay in redesigning recovery policies, contracts, and agent oversight systems.
The RBI’s evolving regulatory framework also extends to RBI – Credit Derivatives Directions, 2026: Legal Analysis, which complements the focus on responsible lending and recovery practices.
