RBI Guidelines on Recovery Agents
The lender hires the agent, and the lender answers for the agent. Here is what RBI requires of it.
When a bank or NBFC hands an overdue loan to a recovery agency, RBI holds the lender responsible for everything the agency does. The rules below are the lender's side of that deal: who it may hire, what it must tell the borrower, and how it must watch its agents.
These rules are why the DRA certificate exists. They are also the backbone of Module C in the exam, so it pays to know which duty sits with the lender and which with the agent.
You save ₹200
- Full 100-question mocks
- Recovery law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
Where the Rules Come From
The same ideas have been carried forward for nearly two decades. What changes is the document they sit in.
May 2003
Instrument
Fair Practices Code for Lenders
What it did
Banned undue harassment in recovery, such as calls at odd hours and use of muscle power.
April 2008
Instrument
RBI guidelines on recovery agents engaged by banks
What it did
Set the first full framework: due diligence, ID and authorisation letter, call recording, no harsh targets, IIBF training.
August 2022
Instrument
RBI circular on recovery agents (all lenders)
What it did
Banned intimidation, public humiliation, anonymous calls and calls before 8 a.m. or after 7 p.m.
November 2025
Instrument
RBI's Responsible Business Conduct Directions, 2025
What it did
Consolidated these instructions, with separate Directions for banks, NBFCs and other lender types. This is the version in force today.
From 1 January 2027
Instrument
Amendments issued 6 August 2026
What it did
Replace the recovery chapter with one detailed set of rules for banks and NBFCs.
| When | Instrument | What it did |
|---|---|---|
| May 2003 | Fair Practices Code for Lenders | Banned undue harassment in recovery, such as calls at odd hours and use of muscle power. |
| April 2008 | RBI guidelines on recovery agents engaged by banks | Set the first full framework: due diligence, ID and authorisation letter, call recording, no harsh targets, IIBF training. |
| August 2022 | RBI circular on recovery agents (all lenders) | Banned intimidation, public humiliation, anonymous calls and calls before 8 a.m. or after 7 p.m. |
| November 2025 | RBI's Responsible Business Conduct Directions, 2025 | Consolidated these instructions, with separate Directions for banks, NBFCs and other lender types. This is the version in force today. |
| From 1 January 2027 | Amendments issued 6 August 2026 | Replace the recovery chapter with one detailed set of rules for banks and NBFCs. |
What a Lender Must Do Before Sending an Agent
Drawn from RBI's recovery rules for banks and NBFCs. Items marked 2027 are new in the version that applies from 1 January 2027.
- check_circleHave a written policy on collection and recovery, covering when recovery starts, an escalation ladder, a code of conduct and how to treat a borrower in financial distress.
- check_circleRun due diligence on every recovery agency, and verify each agent's background before engagement. RBI's 2008 guidelines suggested police verification as a precaution.
- check_circleUse only agents who hold the IIBF Debt Recovery Agent certificate.
- check_circleGet a written undertaking from the agency that its agents will follow the lender's code of conduct.
- check_circlePublish an up-to-date list of its recovery agencies on its website, updated within seven calendar days of any change (2027).
- check_circleTell the borrower which agency is coming at least one day before the first visit (2027), and inform the borrower at once if the agency changes or is dropped.
What a Lender Must Do While Recovery Is On
- check_circleShare only the borrower details the agent needs, and penalise misuse of customer data.
- check_circleRecord recovery calls, as RBI has asked since 2008. From 2027, also log the time and number of calls, keep the recordings for six months (longer if the case is in court), and tell the borrower the call is being recorded.
- check_circleSet targets and incentives that do not push agents towards harsh methods.
- check_circleMonitor its agencies and review the arrangement from time to time.
- check_circleRun a dedicated grievance desk for recovery complaints. From 2027, every recovery letter must carry the name, email, phone number and address of the lender's grievance redressal officer.
- check_circlePay compensation where its own or its agent's actions broke these rules, as set out in its policy (2027).
Quick practice on banking basics. No signup.
Outsourcing Does Not Move the Blame
RBI's outsourcing rules say a bank stays responsible for the actions of its recovery agents. A borrower who is harassed complains to the lender, and the lender answers for it. That is why lenders insist agents follow the code to the letter.
How the DRA Exam Tests This
Expect questions that ask who carries a duty. Due diligence, the website list, call recording and the grievance desk are the lender's jobs. Carrying an ID card and an authorisation letter is the agent's. A common trap is an option saying the agency, not the lender, is answerable for an agent's misconduct.
IIBF's rules say questions can cover RBI guidelines issued up to a cut-off date (31 December for exams held March to August, 30 June for exams held September to February). The amendments were issued on 6 August 2026, after the 30 June 2026 cut-off, so they can first appear in exams held from March 2027. Learn the old and new versions side by side.
FAQs
Is the bank responsible for what its recovery agent does?expand_more
Yes. RBI treats the lender as responsible for the actions of the agents it engages. A complaint about an agent goes to the lender first, and then to the RBI Ombudsman if it is not resolved.
Can a bank use a recovery agent without the IIBF certificate?expand_more
No. RBI requires lenders to ensure the agencies they engage use only agents who hold the IIBF Debt Recovery Agent certificate. The rules that apply from 1 January 2027 state this for banks and NBFCs alike, and give NBFC agents already working without the certificate one year to obtain it.
Will the bank tell me before a recovery agent visits?expand_more
RBI requires the lender to give the borrower the agency's details. Under the rules that apply from 1 January 2027, this must happen at least one day before the agent's first visit.
Where can I see which recovery agencies a bank uses?expand_more
On the lender's website. RBI asks lenders to publish their list of recovery agencies and keep it current.
Next steps
- Code of Conductarrow_forward
- Calling Hoursarrow_forward
- Harassment Complaintsarrow_forward
- Syllabusarrow_forward
100 questions, 2 hours, scored instantly.