Revised draft enables device locking facility and removes the restriction taking legal action as first  resort

Tejasvi Thakkar, Simrat Singh and Jeel Ranavat | finserv@vinodkothari.com

Introduction

Pursuant to the RBI’s stated intent in theStatement on Developmental and Regulatory Policies to harmonise the conduct of Regulated Entities in relation to loan recovery, comprehensive draft instructions were initially proposed on May 20, 2026 consolidating and rationalising the existing scattered provisions. The draft has been revised and RBI has proposed Draft – Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Amendment Directions, 2026 which introduces several changes to the proposed recovery and conduct framework for NBFCs.

[Changes proposed under the revised draft have been highlighted in red for the ease of reference]

The key changes proposed are introduction of the device locking facility with restrictions, widening of the scope of harsh practices, removing the earlier restriction against initiating legal action as a first resort etc.

The instructions are applicable to all NBFCs, excluding Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators, Standalone Primary Dealers, Non-Operating Financial Housing Companies, and NBFCs not having any customer interface. The key requirements of the proposed framework are summarised below:

Key highlights

Policy Requirement

REs shall formulate a separate policy on recovery of loan dues, engagement of recovery agents and taking possession of security, by its own employee or recovery agent. The policy shall, inter-alia, cover:

• Eligibility and due diligence criteria for engagement of recovery agents.
• Specified recovery activities permitted to be carried out.
• Code of Conduct requirements.
• Performance evaluation standards, inspection and control mechanism.
• Procedures and penal actions in case of non-compliance by recovery agents.
• Recovery procedures in case of demise of borrower.
• Mechanism to identify borrowers facing repayment difficulties and provide guidance on recourse options
• Incentive structures not inducing harsh recovery practices.
• Enforcement and possession framework including legal action not to be adopted as the first resort.
• Triggers for initiation of recovery process.
• Graded actions as per an escalation matrix for loan recovery.
• Provision for compensation to the borrowers / guarantors for loss arising on account of recovery related actions of the NBFC or the recovery agencies.

Issue: Whether this can be combined with the policy on Code of Conduct for DSAs/DMAs?

Our view: Since the present requirement specifically deals with recovery conduct, possession and enforcement of security interest, and engagement of recovery agents, the same should ideally be maintained as a separate policy. The DSA/DMA CoC policy deals largely with sourcing-stage conduct such as mis-selling and consequent compensation-related aspects. However, where there are overlapping requirements, NBFCs may structure the same within a broader conduct framework, divided into separate sections. However, it should remain distinct from the outsourcing policy.

Due diligence (DD) requirements

1. Frame and implement a due diligence framework in line with the RBI Outsourcing Directions, 2025.
   1. RE to ensure that recovery agencies shall undertake due diligence and verification of their employees/representatives at the time of engagement and on a periodic basis. Policy to specify such periodicity and scope of verification.

Training Requirements

1. Recovery agents shall mandatorily possess certification from the Indian Institute of Banking and Finance (IIBF) for debt recovery agents. (Aligned with the HFC Master Directions)
   1. Existing agents without certification shall obtain the same within one year from issuance of directions

Code of Conduct for recovery Agents

1. REs shall put in place a CoC for recovery agents and employees engaged in recovery and obtain undertakings for adherence.
   1. The CoC shall include, inter alia:
      1. Fair and respectful treatment of borrowers.
      2. Sharing only limited borrower information necessary for recovery and preventing misuse.
      3. Mandatory documents to be carried (ID card, copy of recovery letter etc)
      4. Permissible hours of contact
      5. Place of contact rules
      6. Restriction on contacting third parties
      7. Detailed prohibition of harsh practices
      8. Borrower information confidentiality
      9. No recovery action where grievance is pending
      • Recording of recovery calls with due borrower intimation.

Though the earlier draft proposed that recovery action cannot be taken if the grievance is found to be frivolous, however, the revised draft specifies that recovery cases cannot be referred to recovery employees or agencies while a borrower grievance relating to loan dues or recovery remains pending with the NBFC.

While the intent of the proposal is to strengthen borrower protection, it may make recoveries more difficult for lenders, as any borrower grievance can pause recovery action regardless of whether the complaint has merit. In our view, this could be misused by borrowers with malicious intent, by raising complaints primarily to delay or stall recovery proceedings.

Issue: Whether the CoC prescribed earlier under HFC Directions stands subsumed?

Our view: Yes. The earlier HFC provisions largely stand harmonised and subsumed within the present draft framework, except for certain differences which have been captured in the Annexure below.

Recovery agents shall be required to carry recovery notice, identity card and authorisation letter which shall include the telephone number of the / recovery agency and the grievance redressal officer appointed by the NBFC, and shall adhere to the following conduct requirements:

• Interact only with the borrower / guarantor and not approach relatives or other contacts; maintain civil behavior;
• Contact / visit borrowers only between 08:00 hours and 19:00 hours;
• Honour borrower’s request to avoid calls / visits at particular times in normal circumstances;
• Contact borrowers ordinarily at the place of their choice, failing which at residence, and thereafter at place of business / occupation. In the absence of any specific choice or if the borrower / guarantor fails to appear at the chosen place on two or more successive occasions, the employee / recovery agent may contact the borrower / guarantor at the place of his / her residence / occupation.
• Avoid calls / visits during inappropriate occasions such as bereavement, calamities, marriage functions, festivals, etc.
• In case of microfinance loans, undertake recovery at a mutually decided designated place, with field visits permitted only upon repeated non-appearance.
• Ensure only duly authorised representatives visit borrower’s premises for recovery activities.
• Ensure any written communication to borrowers has RE’s approval.
• Promptly issue proper acknowledgement / receipt for collections made.
• Refrain from harsh practices, including use of abusive/minatory  language,
• use of social media for posting video / audio recordings or personal details of the borrower / guarantor;
• sending inappropriate messages either on mobile or through social media;
• excessive or anonymous calls, intimidation or harassment, threats of violence, misleading representations, or intrusion into borrower’s privacy,
• making false or misleading representations to the borrower / guarantor, especially about the extent of the debt or the consequences of nonrepayment
  
  The revisions to the draft has widened the scope of “harsh practices” to explicitly include misuse of social media for recovery purposes, including disclosure of borrower information and sending abusive, threatening, or inappropriate communications through mobile or digital platforms.

Grievance redressal mechanism

• Establish a dedicated recovery-related grievance redressal mechanism.
• Provide complete details of the Grievance Redressal Officer and the mechanism in all recovery communications and loan agreements.
• Define criteria for identification and closure of frivolous complaints with appropriate internal oversight.
• REs should address issues including for issues relating to delays or difficulties in unlocking mobile device functionalities.

Responsibilities of REs

REs shall:

• Prominently display an up-to-date list of empanelled recovery agents on all customer interface channels. Details to be provided
  • names of agents,
  • details of individuals engaged
  • period of engagement.
  • Type of recovery agent (corporate / individual),
  • Correspondence address,
  • Purpose of engagement (recovery / possession of security),
  • Assigned geographical areas,
• The revised draft has introduced a timeline for REs to update the list within seven calendar days of any modification to the list.
• In case of termination of agreement with the recovery agency,  REs are required to  inform the borrowers immediately.
• Maintain records of recovery calls, including timing, frequency, and call recordings, for at least 6 months or until disposal of sub judice matters.
• Inform the borrowers/guarantors that calls are being recorded.
• At the time of forwarding cases for recovery,
  • In case a registered mobile number or email is available, inform borrowers atleast one day before the first recovery visit about the details of the recovery agent through SMS/Email.
  • In case digital details of the borrower  are  unavailable, inform borrowers atleast 3 days prior through physical notice.

Possession of mortgaged / hypothecated assets

Loan agreements shall contain a legally enforceable possession clause, clearly disclosed at the time of execution. The agreement shall, inter alia, specify:

• Notice period and circumstances for waiver;
• Procedure for taking possession of security;
• Final opportunity to the borrower for repayment prior to sale/auction;
• Procedure for restoration of possession;
• Transparent process for sale or auction of the secured asset.

Periodic review, monitoring and control

REs shall put in place a management structure to monitor and control the activities of recovery agents and ensure that such agents refrain from actions that could harm the RE’s integrity and reputation. Accordingly, the RE should ensure:

• Appropriate monitoring and conduct provisions shall be incorporated in agreements with recovery agents.
• Remain fully responsible for the actions of recovery agents.
• Undertake periodic review of recovery mechanisms to learn from experience and effect improvements.

Technology-Based Recovery Restrictions

The revised draft also proposes that the REs are restricted from using technology-based mechanisms (Remote Device Locking) to remotely restrict or disable functionalities of a borrower’s mobile device as a recovery tool, except in cases where the loan itself was granted for financing that specific device.

This can be done subject to certain conditions:

1.  Loan agreement must expressly authorise such restrictions in clear and unambiguous terms.
2. Trigger events for recovery actions must be specifically defined and disclosed upfront.
3. A structured notice mechanism must be provided before any restriction is imposed.
   1. Notice of  atleast 21 days to be issued to borrower after the loan becomes 60 DPD
   1. After expiry of 21 days notice atleast another 7 days of time to the borrower to cure the default.

The default is 90DPD and the borrower has not curated the default irrespective of the notices Restrictions should follow a graduated, step-by-step escalation process.

• REs  shall not restrict or disable essential device functionalities including internet access, incoming calls, emergency SOS, or emergency government/public safety notifications.
• NBFC must reverse any restriction within 1 hour of default being cured.
• NBFC must pay ₹250 per hour compensation for wrongful restriction or delayed reversal.
• Device restriction mechanism must be uninstalled after full loan repayment.
• Borrower retains the right to prepay the loan anytime (partial or full).
• NBFC must maintain a strong grievance redressal system for unlocking-related issues.
• NBFC is strictly prohibited from accessing, using, or retaining borrower device data for        recovery or any purpose.
• NBFC is not allowed to access, use or obtain or retain the data in the phone for recovery in any circumstances

This means the lender cannot view personal files, contacts, messages, photos, location data, or any other information stored on the device while enforcing recovery measures.

Please refer to our detailed write -up on this–Remote Device Locking: RBI proposes highly guarded path

For Housing Finance Companies:

Most of the proposed requirements are not entirely new in substance for HFCs, as they were already reflected in the Guidelines for Engaging Recovery Agents under paragraph 170 of the RBI HFC Directions, 2025. The proposal now is to delete those HFC-specific guidelines and require HFCs to comply with the proposed Directions.

However, while the underlying principles remain largely consistent, the proposed Directions significantly strengthen and formalise the recovery framework. The approach shifts from principle-based guidance to a more structured, prescriptive, and compliance-oriented regime. The key changes are as follows:

1. Mandatory written recovery policy:Under the HFC Directions, compliance was required with paragraph 170, but there was no express requirement to frame a consolidated written policy governing recovery of loans, engagement of recovery agents, and repossession of security. The proposed Directions now mandate a formal, documented recovery policy. Such policy must specifically cover eligibility criteria for engagement of agents, due diligence standards, performance evaluation parameters, inspection and audit mechanisms, and penal actions for non-adherence. This marks a shift from guideline-based adherence to a structured governance framework.
2. Borrower distress identification mechanism: The HFC Directions required utilisation of credit counsellors in cases where a borrower was considered to “deserve sympathetic consideration,” which was discretionary and reactive in nature. The requirement of early stage borrower distress identification has been removed from the revised draft which indicates a shift from a proactive, structured borrower support system to a more reactive, institution-led approach based on observed default or non-payment events.
3. Explicit data governance controls:While the HFC Directions required training of recovery agents on respecting customer privacy, the proposed draft goes further by mandating that only limited borrower information be shared with recovery agents and that adequate safeguards be put in place to prevent misuse or unauthorised transfer of customer data. This introduces clearer data governance and accountability obligations.
4. Restriction on initiating legal action as first resort: The HFC Directions did not prescribe any sequencing rule regarding enforcement remedies. The earlier draft proposed that legal action for recovery or enforcement of security shall not be initiated as a first resort, thereby imposing a structured progression in recovery measures.

However, the revised draft provides for removal of this provision and suggests a relaxation of the earlier restriction against initiating legal action as a first resort for recovery.

This may provide lenders greater flexibility in choosing recovery measures and pursuing legal remedies at an appropriate stage.

Conclusion

Recovery is as vital to lending as disbursement, if not more. Credit often begins with a courteous engagement by the lender, but too often, the standards of professionalism seen at the time of sanction weaken at the stage of enforcement. The right to recover is unquestionable; harassment is not. The proposed Directions seek to correct this imbalance by requiring lenders to uphold the same standards of fairness, transparency and discipline during recovery as at the time of origination.