RBI's New Loan Recovery Rules for NBFCs: What the 2026 Draft Directions Mean

The Reserve Bank of India (RBI) has proposed a new set of rules for how Non-Banking Financial Companies (NBFCs) recover loans. The rules also cover how they hire and manage the recovery agents who do that work on their behalf. Both sides of the recovery process are now in focus.

These rules sit inside a draft document called the Reserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) Amendment Directions, 2026. They build on the parent RBI (NBFC - Responsible Business Conduct) Directions, 2025, which RBI issued on November 28, 2025.

One point is worth being clear about up front: as of now, this is still a draft. RBI has shared it to collect public feedback before it becomes final, and the draft says the rules will take effect from October 1, 2026. In other words, nothing is binding yet, but the direction of travel is obvious, so NBFCs are better off treating this as an early warning and preparing now rather than waiting for the final text.

This NBFC draft is also part of a wider RBI push on loan recovery. In May 2026, RBI released a broader draft covering all regulated entities, including banks, so if you want the bigger picture across both banks and NBFCs, our guide on the RBI May 2026 loan recovery draft walks through it. The blog you are reading now zooms in on what the rules mean for NBFCs specifically, explained in plain language, covering what the draft says, who it affects, and the practical steps NBFCs need to take.

What is the RBI draft on NBFC loan recovery?

At its core, the draft is an amendment that changes the existing RBI (NBFC - Responsible Business Conduct) Directions, 2025. Rather than adding another scattered instruction, RBI took a fresh look at its older rules on recovery agents. It decided they needed to be clearer and stronger, and pulled everything into one detailed section that covers the whole recovery process. That new section is called "Conduct of NBFCs in Recovery of Loan Dues and Engagement of Recovery Agencies," and RBI has issued it using its powers under Sections 45JA, 45L, and 45M of the Reserve Bank of India Act, 1934.

The reason behind all of this is borrower protection. Over the past few years, complaints about aggressive loan recovery have piled up: borrowers have faced threats, late-night calls, and public shaming, and a few apps have even gone as far as locking people's phones. The draft is RBI's attempt to put a stop to those practices and set a single, clear standard for fair conduct.

Why is RBI doing this now?

Loan recovery itself is a normal and necessary part of lending. What matters is how it is done, and RBI's view here is simple: a loan default is a financial matter, not a reason to harass or humiliate a person.

What made the issue more urgent was the rise of digital lending. Some lenders began using apps that could control a borrower's phone, while others shared borrower details on social media to pressure them into paying. The draft takes direct aim at exactly these methods.

Who do these rules apply to?

The draft applies to most NBFCs, but not all of them. Broadly, it covers any NBFC that recovers loan dues from borrowers in default, including cases where the NBFC takes possession of a security such as a vehicle or other asset.

A handful of NBFC types are deliberately left out. The draft does not apply to the following:

The simplest way to read this is that if your NBFC lends to customers and recovers dues, you should assume these rules apply to you. It is also worth noting that while most of the rules apply to borrowers in default, some of them extend to normal collection from borrowers who are not in default, and the draft makes that clear wherever it applies.

What are the key guidelines NBFCs must follow?

This is the heart of the draft. To make it easier to follow, we have grouped the main rules into simple themes below.

1. Every NBFC needs a clear recovery policy

Everything starts with a written policy. The draft requires each NBFC to have one that sets out how it collects and recovers loans, and this policy is the foundation that the rest of the rules rest on.

At a minimum, the policy must cover:

• When the recovery process can start.
• A step-by-step escalation plan for recovery.
• A code of conduct for staff and agents.
• How to handle recovery if a borrower passes away.
• How to pick, check, and review recovery agencies.
• What action to take against agents who break the rules.
• How to compensate borrowers if a wrong recovery action causes them loss.

Put simply, the policy is what turns these regulatory rules into a clear internal process that staff and agents can actually follow.

2. Recovery agents must be trained and verified

NBFCs cannot simply hand recovery work to anyone, because the draft sets clear standards for who is allowed to do it. Every recovery agent must hold a certificate from the Indian Institute of Banking and Finance (IIBF), earned after completing the IIBF training program for Debt Recovery Agents.

There is also a transition rule for agents who are already on the job without that certificate: they have one year from the date the final rules are issued to obtain it. On top of training, NBFCs must verify the background of every agent, both before hiring and on a regular basis afterward.

3. NBFCs must be transparent about their agents

Borrowers have a right to know who is contacting them, and the draft turns that into a firm rule. The table below sets out exactly what NBFCs must do:

Taken together, these steps shut the door on fake agents and surprise visits, because the borrower always knows who is actually authorized to contact them.

4. Borrowers must be treated fairly

Beyond transparency, the draft puts the borrower's dignity at the center of the recovery process, with several rules designed to protect them. To begin with, NBFCs can only share borrower data with agents to the extent needed for recovery, and any misuse of that data must carry a penalty.

The draft also builds in a pause for disputes: if a borrower files a grievance about the loan or its recovery, the NBFC cannot push the case to an agent until that grievance is resolved. Record-keeping is part of fair treatment too. NBFCs have to log the time and number of calls made to a borrower, record the content of those calls, and preserve those records for six months, or longer if the matter is in court.

Finally, there is a quieter but important rule about incentives. The draft says recovery targets and agent incentives must not push agents toward harsh tactics, which removes much of the pressure that tends to lead to bad behavior in the first place.

5. Strict limits on using technology to force repayment

This is one of the most significant parts of the draft, and it speaks directly to digital lending apps. The basic rule is blunt: an NBFC cannot use technology to lock or disable a borrower's phone or tablet to force loan repayment.

There is just one narrow exception, which is where the phone itself was bought using a loan from that NBFC. Even in that case, the NBFC has to follow strict conditions before it can act:

• The loan contract must clearly allow this step.
• A first notice goes out only after the loan is 60 days past due, giving the borrower at least 21 more days to pay.
• A second notice follows, giving at least 7 more days.
• The phone can only be restricted after the loan crosses 90 days past due and the borrower still has not paid.

Alongside those conditions, the draft adds a set of clear safeguards for the borrower:

All of this is a direct response to the device-locking abuse seen from some digital lenders in recent years.

6. Clear rules for taking possession of an asset

Recovery sometimes involves taking back an asset, such as a financed vehicle, and the draft insists that this process be spelled out in the loan contract well in advance. Specifically, the contract must explain:

• The notice period before possession.
• When that notice can be waived.
• The exact steps for taking possession.
• A final chance for the borrower to repay before any sale.
• How the asset is returned if the borrower clears the dues.
• How any sale or auction will work.

The principle here is that the borrower should never be caught off guard. They must know all of these terms at the point when they sign the loan, not discover them when an asset is being taken.

7. A clear code of conduct for agents and staff

The draft also lays out detailed rules for how agents and NBFC staff must behave, and the aim throughout is basic decency. In practice, agents and staff must:

• Show an identity card and carry an authorization letter during visits.
• Only discuss the loan with the borrower or guarantor.
• Speak politely and behave with decency.
• Contact the borrower only between 8:00 AM and 7:00 PM.
• Avoid calls or visits during a death in the family, a marriage, or similar events.
• Give a proper receipt when they collect any money.

On the other side of the line, the draft bans a list of harsh practices and treats them as serious violations:

• Using threatening or abusive language.
• Posting a borrower's photos, videos, or details on social media.
• Sending improper messages.
• Calling or messaging too often, or outside allowed hours.
• Making threatening or anonymous calls.
• Harassing the borrower, their family, friends, or coworkers.
• Using or threatening violence.
• Making false claims about the debt or its consequences.

8. A dedicated complaint system

Finally, every NBFC must run a clear system for handling recovery complaints, and the details of that system have to be written into the loan agreement. To make complaints easy to raise, every recovery message must include the name, email, phone number, and address of the NBFC's grievance officer, giving the borrower a direct line to someone who can help. On top of this, NBFCs must follow other relevant rules, including the telecom rules from TRAI that govern commercial messages.

What should NBFCs do to prepare?

The rules may still be in draft form, but the direction is clear enough that the smarter move is to start preparing now rather than wait for the final text. A few practical first steps go a long way:

• Review your recovery policy. Check it against the new themes above. Fill any gaps.
• Audit your agents. Make sure every agent has, or is getting, the IIBF certificate within the one-year window.
• Fix your records. Set up systems to log calls, store recordings for six months, and keep clear audit trails.
• Update your website and app. Build a process to publish and refresh the agent list within seven days.
• Check your digital tools. If you use any device-control feature, review it carefully. Most uses are now banned.
• Strengthen grievance handling. Make sure a grievance officer's details appear in every recovery message.

What most of these steps have in common is that they depend on good process and reliable record-keeping, and that is exactly where the right technology earns its place.

How can Signzy help NBFCs meet these rules?

The draft leans heavily on transparency, due diligence, and clear records, which happen to be the very areas where manual processes tend to break down. Signzy provides compliance and verification infrastructure that helps regulated lenders manage these obligations, and for NBFCs preparing for the recovery rules, that translates into a few concrete things:

• Agent and vendor due diligence: Verify the background of recovery agencies and agents during onboarding and on a regular basis, with a clear digital trail.
• Audit-ready records: Maintain organized, time-stamped records that support the six-month call logging and review requirements.
• Workflow control: Configure recovery workflows that follow the policy, escalation matrix, and notice rules the draft requires.
• Grievance and case tracking: Keep recovery cases, complaints, and agent assignments in one transparent system.

The goal in each case is the same: turn a complex rulebook into a clear, repeatable process that lowers compliance risk while protecting both the borrower and the NBFC. To see how Signzy supports compliance for banks and NBFCs, visit www.signzy.com.