A practical reading of the RBI (Non-Banking Financial Companies — Responsible Business Conduct) Third Amendment Directions, 2026

Notification No. DOR.MCS.REC.No.199/01-01-039/2026-27 (RBI/2026-27/230), dated 6 August 2026  •  Effective 1 January 2027

This note reframes our earlier analysis of the draft guidelines on recovery of loans against the final text what the rules now say, what changed on the way from draft to final, and what compliance teams will have to build before the new year.

Effective from 1 January 2027, the Final Guidelines amend the RBI (Non-Banking Financial Companies — Responsible Business Conduct) Directions, 2025. These final guidelines lay out a framework for how a debt is collected from a borrower. For NBFCs, recovery process is no longer a back-office function to be outsourced and forgotten. It is now a governed, documented, audited, and accountable activity.

Applicability

The Directions apply across the NBFC universe with a few deliberate exceptions like Mortgage Guarantee Companies, Core Investment Companies, NBFC-Account Aggregators, Standalone Primary Dealers, Non-Operating Financial Holding Companies, or to NBFCs that have no customer interface at all. 

The commencement date deserves a highlighter. 1 January 2027 is not far away for the scale of change involved — new Board-approved policies, re-papered loan agreements, vendor re-onboarding, agent certification, call-recording systems, and grievance channels all have to be in place. NBFCs that treat this as a January problem will find December uncomfortable.

Calling it something else won’t help: who counts as a “recovery agent”

The Directions insert two new definitions (paragraphs 6(11A) and 6(11B)). A “recovery agency” is any entity or individual — other than the NBFC’s own employees — engaged under an outsourcing arrangement to help recover dues from a defaulting borrower, including taking possession of security. A “recovery agent” is the human face of that agency: the person who actually deals with the customer.

The Guidelines clarify that it does not matter whether the contract calls someone a “tele-caller”, a “field executive”, a “collection partner” or a “business associate”. If the work is recovery, the rules apply. 

A Recovery Policy

Every covered NBFC must put in place a Board-approved policy on collection and recovery — including possession of security — whether the work is done by its own staff or by an agent (paragraph 100D). What is striking is what the policy is now required to contemplate: the triggers for starting recovery, a graded escalation matrix, a code of conduct, what happens on the demise of a borrower, and a structured framework for handling financial distress, complete with documented pre-escalation engagement and guidance on the resolution options available to a struggling borrower.

That last requirement is easy to skim past but hard to overstate. The RBI is asking lenders to build, into policy, a pause before the pressure — a documented conversation with a borrower in genuine difficulty before the machinery of recovery grinds into gear. For a sector often criticised for treating distress as delinquency, this is a meaningful reorientation.

Where recovery agencies are engaged, the policy must also address eligibility and due-diligence criteria, performance evaluation, inspection and audit mechanisms, and the penal actions to be taken against agencies or agents who misbehave (paragraph 100E). And crucially, the policy must set out how the NBFC will compensate borrowers or guarantors for losses caused by recovery actions that breach these Directions (paragraph 100F). 

Vetting and training the people who knock on doors

Before engaging any recovery agency, an NBFC must run a due-diligence process aligned with the RBI (NBFC — Managing Risks in Outsourcing) Directions, 2025, and must verify the antecedents of recovery agents both at onboarding and, thereafter, at a defined periodicity (paragraph 100H). 

Recovery agents must hold a certificate from the Indian Institute of Banking and Finance (IIBF) — or an institute tied up with the IIBF — earned by completing the Debt Recovery Agents programme (paragraph 100I). Agents already in the field who lack the certificate get a one-year runway from the effective date to obtain it. The NBFC must also frame a code of conduct for agents and its own employees, and where an agency is used, obtain a written undertaking that its agents will abide by that code (paragraph 100J).

Borrowers deserve to know who is coming

An NBFC must keep an up-to-date list of the recovery agencies it has empanelled on its website, showing each agency’s name, type (corporate or individual), correspondence address, and the period and purpose of engagement (paragraph 100K). Any change to the list must be reflected within seven calendar days; a termination must be updated promptly.

Before an in-person visit, the borrower or guarantor must be told the recovery agency’s details at least one day in advance (paragraph 100L). If the agency changes mid-way through a recovery, the borrower must be told immediately (paragraph 100M); and if the NBFC terminates an agency altogether, borrowers who were dealing with it must be told at once, so they know to stop engaging with that agency or its agents (paragraph 100N). 

Fair treatment while the debt is being pursued

A borrower’s information may be shared with employees or agencies only to the extent needed to do the recovery job, and the NBFC must put mitigants — including penal provisions — in place against misuse (paragraph 100O). Recovery conversations must be documented: the time and number of calls recorded, the content of calls preserved for at least six months (or until disposal, in matters that are sub judice), and the borrower told that the call is being recorded (paragraph 100P). And incentive structures — whether for staff or built into an agency contract — must not be designed in a way that pushes people towards harsh recovery (paragraph 100Q).

Taking possession of security: no surprises in the fine print

Where an NBFC relies on a possession clause to enforce its rights, that clause must be legally valid and must have been clearly brought to the borrower’s notice when the loan was signed (paragraph 100R). The loan terms must then spell out six things:

• the notice period before possession is taken;
• the circumstances in which that notice may be waived;
• the procedure for taking possession of the security;
• a final chance for the borrower to repay before any sale or auction;
• the procedure for returning possession to the borrower; and
• the procedure for the sale or auction of the security.

The headline act: what an NBFC can — and cannot — do to a financed phone

The most consequential part of these Directions deals with technology-based recovery: the practice of remotely restricting or “bricking” a smartphone, tablet or laptop that was itself bought on loan. 

An NBFC may deploy such a mechanism only to recover dues on a loan that financed the very device being restricted, and only if a set of conditions is met (paragraph 100S):

• the device must actually have been financed by the NBFC through a loan;
• the loan agreement must expressly and unambiguously permit the action and describe the procedure;
• no restriction may even begin until the loan is 30 days past due and the borrower has failed to pay despite notices; gradual restrictions may follow, but the full set of restrictions can take effect only after 60 days past due — and outgoing calls cannot be restricted before the 60-day mark; and
• the mechanism must be certified by the device’s Original Equipment Manufacturer (OEM) and/or the operating-system platform, where such certification is available.

Guardrails the borrower can rely on

Paragraph 100T lays down the protections that must accompany any such mechanism:

• restrictions must be applied gradually which means lenders shall not resort to disabling the device outright from the start;
• essential functions must always work — incoming calls, SMS, and emergency SOS features cannot be cut off;
• the restrictions must not stop the borrower from doing their work or earning a living for example if he is a driver registered on some platform or delivery partner on food aggregator platform, etc.;
• once dues are paid, restrictions must be lifted expeditiously and within one hour of realisation;
• if a restriction is wrongful, or if unlocking is delayed for reasons attributable to the NBFC, the lender must pay the borrower ₹250 per hour until it is put right subject to total compensation is capped at the amount of the loan disbursed;
• after full repayment, the NBFC must promptly relinquish the locking mechanism and guide the borrower to uninstall the system from his/ her devise;
• the borrower has the right to prepay the loan — partly or fully — at any stage; and
• a robust grievance mechanism must exist specifically for delays and problems in unlocking the device.

It is pertinent to note that neither the NBFC nor its technology partner may access or use the personal data on the borrower’s device such as contacts, SMS, call logs, photos, location history and the like for loan recovery or, indeed, for any purpose whatsoever.

How agents must behave: the human conduct code

When an employee or agent visits, they must identify themselves with an identity card, and the agent must additionally carry an authorisation letter and a copy of the notice sent to the borrower including the agency’s telephone number and the grievance officer’s details (paragraph 100X). Beyond identity, paragraph 100Y sets out how recovery must actually feel to the person on the other side:

• dealings only with the borrower or guarantor — not their neighbours or relatives;
• a civil manner, with decency and decorum maintained during any visit;
• contact only between 8:00 a.m. and 7:00 p.m., unless the borrower has asked otherwise, and any request to avoid a particular time honoured;
• visits at the borrower’s chosen place; only where there is no choice, or the borrower fails to appear on two or more successive occasions, may the agent go to their home or workplace;
• no calls or visits during bereavement, medical emergencies, other calamities, or marriage functions;
• for microfinance loans, recovery at a mutually designated place — field visits to home or work only after two successive no-shows;
• prompt receipts and acknowledgements for every payment collected.

A dedicated door for complaints — and alignment with the wider rulebook

Every covered NBFC must run a dedicated mechanism for recovery-related grievances, with its details written into the loan agreement, shared when the recovery agency is disclosed, and repeated in every recovery communication — carrying the name, email, telephone number and address of the grievance redressal officer (paragraph 100AA). 

NBFCs must continue to comply with the RBI’s norms on outsourcing of financial and IT services, and with the TRAI Telecom Commercial Communications Customer Preference Regulations (TCCCPR), 2018, when it comes to commercial communications (paragraph 100AB). Recovery calling, in other words, must also respect the telecom rulebook.

Precautions and additional guardrails to put in place before the Directions take effect

With effect from 1 January 2027 approaching, NBFCs especially device-financing and small-ticket digital lenders should begin putting the following safeguards in place well ahead of time.

Any locking mechanism must be made graduated, OEM/OS-certified, reversible within an hour, blind to the borrower’s device data, and respectful of essential functions and livelihood. Build and test the unlocking workflow early, since the ₹250-per-hour clock leaves no room for delay.

Tighten vendor and agent governance with re-run due diligence on every recovery agency against the Outsourcing Directions, ensure every agent is IIBF-certified (using the one-year window for existing agents), fit each contract with a code-of-conduct undertaking and non-aggressive incentive terms, and publish and maintain the empanelment list on the website.

Build a complete evidence trail. Put systems in place to record and preserve recovery calls for six months, issue prior-visit intimations, equip agents with authorisation letters and notices, give borrowers a live view of device restrictions, and name a grievance officer in every recovery communication so the NBFC can always demonstrate it acted correctly.

Update the Board-approved recovery policy, redraft loan agreements to carry the new possession, device-locking and grievance clauses, and set up the dedicated recovery-grievance channel.

Disclaimer: This write-up is prepared for general information and awareness of the RBI (NBFC — Responsible Business Conduct) Third Amendment Directions, 2026, and does not constitute legal advice. Specific situations should be assessed against the full text of the Directions and professional advice sought as required.