RBI Guidelines for Credit Card Recovery Agents: What They Cannot Do

RBI guidelines for credit card recovery agents are rules set by the Reserve Bank of India (RBI) that every bank, NBFC (non-banking financial company), and their third-party recovery firms must follow. These rules come from two main sources: the RBI's Fair Practices Code and the Master Directions on Outsourcing of Financial Services, most recently updated in late 2024.

The guidelines cover what agents can say, when they can call, where they can visit, and how they must behave. They apply whether the recovery agent works directly for the bank or has been hired from an outside agency.

One important principle runs through all of it: vicarious liability. This means the bank is legally responsible for everything a recovery agent does on its behalf. If an agent from an outside firm harasses you, the complaint goes to the bank, not just the agency. The bank cannot pass the blame. https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=57594)]

Banks must also publish their Board Approved Recovery Policy on their official website. This tells you exactly what their agents are and are not permitted to do. If you want to check what HDFC, ICICI, SBI, or any other bank allows, look for this document on their site.

These are your rights as a borrower. They exist regardless of how much you owe or how long you've missed payments.

The rule is straightforward. A recovery agent can only contact you between 8 AM and 7 PM. This applies to every channel: phone calls, WhatsApp messages, SMS, automated voice bots, and any other digital communication.

A payment reminder sent at 9 PM is an RBI violation. A call at 6:30 AM is an RBI violation. There are no exceptions based on the amount owed or how old the debt is. [(RBI Responsible Business Conduct Directions, effective July 1, 2026: https://freed.care/blog/rbi-guidelines-for-loan-recovery)]

The 2025 updates to RBI's guidelines added an important provision: banks must now maintain digital logs of all agent contact attempts. These logs must record the time, channel, and nature of the communication. This matters for you. If you claim a contact happened outside allowed hours, the burden of proof now falls on the bank to show it didn't. Screenshot every message you receive with the timestamp visible. Save call logs with dates and times. This is your evidence. [(RBI Digital Lending Directions 2025, effective May 8, 2025: https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=57594)]

Automated calls are covered by the same rule. A bot calling you at 8 PM is as much a violation as a human agent doing the same.

These are the clear prohibitions. Any one of them, if violated, is grounds for a formal complaint.

Yes. A recovery agent can visit you in person. But there are conditions, and they are firm.

Before any visit, the agent must give you prior notice. They cannot show up unannounced. When they arrive, they must carry a valid ID card issued by the bank and a written authorisation letter confirming they are acting on the bank's behalf. If they cannot produce both documents, you are not obligated to engage with them. (https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12848&Mode=0 )

You have the right to choose the time and place of any in-person meeting. If the proposed time doesn't work, you can reschedule. The agent must respect that. (https://rbi.org.in/Scripts/NotificationUser.aspx?Id=12378&Mode=0 )

At a workplace, the rules are stricter. The agent cannot disclose the nature of their visit to your colleagues, manager, or anyone else at your office. They cannot create a scene, raise their voice, or embarrass you in front of others. The visit must remain private and civil. If the agent does anything that draws attention to your debt situation at your workplace, that is a reportable violation.

If you ask an agent to leave your home or office, they must leave. Staying after being asked to go is trespassing. (https://vakilsearch.com/bns/sections/329 )

Loan apps (app-based lending platforms) are increasingly the source of the worst recovery behaviour. Contact list scraping, mass shaming messages sent to everyone in your phonebook, bots calling from rotating numbers hundreds of times a day. These are real and documented.

The RBI Digital Lending Guidelines (updated through 2024) explicitly cover this. App-based financial companies are subject to the same Fair Practices Code as banks. They cannot access your phone contacts, photos, or location data for recovery purposes. They cannot send messages to people in your phonebook disclosing your debt. They cannot use collection bots that make automated calls in bulk or at off-hours. (https://www.rbi.org.in/scripts/NotificationUser.aspx?Id=12848&Mode=0 )

If a loan app is doing any of these things, report it to cybercrime.gov.in. If the app is not registered with the RBI, it has no legal standing to recover the debt at all. An unregistered digital lender has no authority to contact you for recovery. Any threats they make carry no legal weight. (https://www.rbi.org.in/Scripts/Sachet.aspx + https://cybercrime.gov.in )

Check whether the app appears on the RBI's list of registered NBFCs and payment aggregators before engaging with their recovery calls at all.

When you miss credit card payments, the bank's internal system tracks it through DPD (Days Past Due). This is the number of days since your last missed payment. At first, the bank's own collections team handles outreach. This is usually automated reminders and in-house calls.

If the account continues in default, the bank flags it internally and can outsource recovery to a third-party agency. This is when most borrowers start receiving calls from numbers they don't recognise. The chain is: card issuer (the bank), then internal collections team, then an external recovery agency acting on the bank's instruction.

One important protection: the bank cannot transfer your account to a recovery agent if you have already raised a grievance (formal complaint) with the bank about the same account. The grievance must be resolved first. This is a direct protection you can use. (https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=62215 )

At 90+ days past due, the account moves into NPA (loan the bank has classified as bad debt, usually after 90 days of non-payment) status. Banks track this closely because NPA classification has regulatory implications for them. This is also when banks are more open to discussing revised repayment plans, if you ask.

Document first. Act second. Here's the path.

When recovery calls get threatening, most people don't know where to start. FREED has helped over 20,000 borrowers work through exactly this kind of situation. FREED's team can help you understand your rights clearly, and, helps you settle your loans. FREED handles the paperwork and the process so you don't have to figure it out alone.

If you're also finding it genuinely difficult to keep up with credit card payments, that's a separate conversation worth having. Settlement is not something a borrower chooses out of preference. Banks only consider it when repaying in full has become genuinely difficult. FREED's Loan Settlement Plan is for borrowers in that situation. It builds a savings fund in your name, then negotiates with the bank once sufficient funds are ready. You authorise every settlement before any money moves. The loan ends with a "Settled" mark on your CIBIL report, which stays for up to 7 years, and FREED helps borrowers settle their unpaid/overdue loans at up to 50%* less.

If that's not where you are yet, and you're still paying but stretched thin across multiple loans, FREED's Debt Consolidation Program gets all your eligible unsecured loans paid off through one new consolidated loan at a lower EMI. Your CIBIL score is not harmed. Unlike settlement, debt consolidation does not add a negative mark to your CIBIL report

One call to FREED's team is enough to understand which of these applies to your situation. No pressure. Just clarity.