Recovery Agent Harassment: What the Law Actually Allows

A recovery agent may telephone a borrower, write to a borrower and visit a borrower to ask for payment of an overdue loan. That is where the permission ends. The Reserve Bank of India's Fair Practices Code, read with its directions to regulated entities employing recovery agents, prohibits recovery calls before 8:00 a.m. or after 7:00 p.m. (9:00 a.m. to 6:00 p.m. for microfinance loans), intimidation or harassment of any kind whether verbal or physical, the use of muscle power, public humiliation, intrusion upon the privacy of a borrower's family, referees and friends, anonymous or threatening calls, and persistent calling — and the lender, not the agency, answers for every breach.

Two things follow from that, and they are usually confused. The first is that a demand for money that is actually due is not harassment merely because it is unwelcome or repeated in measured terms. The second is that the manner of demand is regulated independently of the merits of the debt, so a borrower who genuinely owes the money still has the full protection of the Code. This note sets out what the regulator actually requires, how the escalation ladder works in the order it has to be climbed, and where abusive conduct stops being a regulatory matter and becomes a criminal one.

Where does the Fair Practices Code for recovery actually live?

There is no single "recovery agents Act" in India. The obligations are regulatory, and they sit in three overlapping places.

For non-banking financial companies, the Fair Practices Code was consolidated in the Master Direction on Scale Based Regulation of 19 October 2023. For banks, the equivalent obligations sat in the RBI's fair practices and customer service instructions and in its instructions on the engagement of recovery agents. Cutting across both were the prohibitions set out in the RBI circular dated 12 August 2022 on outsourcing of financial services and the responsibilities of regulated entities employing recovery agents. That circular is the source of the specific prohibitions most borrowers are looking for, and it applied to regulated entities generally rather than to one class of lender.

In the Reserve Bank's consolidation of its instructions on 28 November 2025, these instructions were carried into the entity-wise directions issued that day — for commercial banks, the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Directions, 2025, and for NBFCs, the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Directions, 2025. Those are the instruments in force today.

On 6 August 2026 the Reserve Bank amended both sets to replace the recovery-agent provisions with a fuller framework: the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Fourth Amendment Directions, 2026 (RBI/2026-27/223) and the Reserve Bank of India (Non-Banking Financial Companies – Responsible Business Conduct) Third Amendment Directions, 2026 (RBI/2026-27/230), with parallel amendments the same day for other categories of lender. Both come into effect on 1 January 2027. Until that date the provisions carried over from the 2022 circular govern; from it, the new framework applies. Its main additions are set out below.

Where the loan was sourced or serviced digitally, the RBI's digital lending framework adds a further layer, including restrictions on what a lending application may access on a borrower's device and a requirement that the borrower be told who the recovery agent is.

None of these is a criminal statute. They are conditions of the lender's licence to operate, enforced by the RBI through supervisory action and by borrowers through the grievance and ombudsman machinery described below.

What exactly is a recovery agent prohibited from doing?

The August 2022 circular, whose terms were carried into the 2025 directions, directs regulated entities to strictly ensure that neither they nor their agents resort to intimidation or harassment of any kind, verbal or physical, against any person in their debt collection efforts. It then particularises. The following table sets out the prohibited conduct alongside what it means in practice.

The Fair Practices Code adds the general formulation that the lender shall not resort to undue harassment, expressly including persistently bothering borrowers at odd hours and the use of muscle power for recovery of loans.

Two points of precision are worth holding onto. The 8:00 a.m. to 7:00 p.m. window attaches to contact for recovery of overdue loans; it is not a general prohibition on the lender ever communicating outside those hours for other purposes. And persistent calling is a separate breach from calling out of hours — a lender that confines itself to daylight but calls eleven times before lunch has still breached the Code.

What changes on 1 January 2027

The amendment directions of 6 August 2026 delete the existing recovery-agent provisions and insert a fuller framework. For commercial banks it sits in a new Section L of the Responsible Business Conduct Directions (paragraphs 454A to 454AB); the NBFC directions carry a parallel framework (paragraphs 100A to 100AB). The points a borrower is most likely to need are these:

• Contact hours. Calls and visits are confined to 08:00 to 19:00, unless the borrower has expressly requested or authorised otherwise, and a request to avoid a particular time is to be honoured in normal circumstances (paragraph 454Y(4)).
• Advance intimation. The lender must give the borrower or guarantor the details of the recovery agency at least one day before the first in-person visit (paragraph 454L), and must tell the borrower of any change of agency (paragraph 454M).
• Identity and authority. An agent must display an identity card and carry an authorisation letter and a copy of the lender's notice, which must show the agency's telephone number and the grievance officer's details (paragraph 454X).
• Recorded calls. The lender must log the time and number of recovery calls, record their content, take reasonable precautions such as telling the borrower that calls are recorded, and keep the records for six months from the call or, where the matter is sub judice, until it is disposed of (paragraph 454P).
• Certification and disclosure. Agents must hold a debt recovery certificate linked to the Indian Institute of Banking and Finance (paragraph 454I), and the lender must list its recovery agencies on its website (paragraph 454K).
• Harsh practices. Abusive language, posting recordings or personal details on social media, inappropriate messages, excessive or out-of-hours contact, threats, intimidation, violence and false or misleading statements about the debt are expressly prohibited (paragraph 454Z).
• A dedicated grievance route. The lender must run a recovery-grievance mechanism, give its details in the loan agreement, and print the grievance officer's name, email, telephone number and address on recovery communications (paragraph 454AA).

Paragraph numbers are those of the commercial bank directions.

Is the lender responsible for an outsourced agency?

Yes, and this is the single most useful thing a borrower can know.

The RBI's outsourcing framework proceeds on the principle that outsourcing an activity does not diminish the regulated entity's obligations, or those of its board and senior management, and that the entity remains responsible for the actions of its service providers. The Fair Practices Code applies to the lender's recovery activity whether that activity is carried out by its own staff or by an appointed agency.

The bank directions put it in terms: the bank, as principal, is responsible for the actions of its agents. The practical consequences are immediate. The complaint is addressed to the lender. The lender cannot dispose of it by saying the agency was independent, or that the individual concerned was a freelancer, or that the agency has been terminated. Where the account has been assigned to an asset reconstruction company, that company is itself an RBI-regulated entity bound by the Fair Practices Code applicable to asset reconstruction companies, and the complaint lies to its grievance redressal officer. Asset reconstruction companies are not among the categories of regulated entity the Integrated Ombudsman Scheme 2026 covers, so a complaint the company does not resolve goes to the Reserve Bank's other grievance arrangements, such as its Consumer Education and Protection Cells. And the borrower is entitled to know who is calling: an agent should be able to identify himself, name the agency, and produce authority from the lender.

Two related requirements are worth asking about in writing. Lenders were directed to give borrowers the details of the recovery agency, and agents have historically been required to carry an authorisation letter together with a copy of the notice from the lender. Banks were separately directed to ensure that agents engaged for recovery had completed a prescribed training and certification programme before being deployed. From 1 January 2027 the amended directions restate each of these in firmer terms — agency details at least one day before the first visit, an identity card, authorisation letter and copy of the notice, and certification — as listed above.

What can an agent lawfully do about the asset?

Nothing, by himself. A recovery agent has no statutory power of seizure, no power of entry, and no power to detain a person or a vehicle. Whatever power exists is either contractual or statutory, and it belongs to the lender.

For a hypothecated movable — typically a vehicle — the power to repossess ordinarily rests on the loan contract rather than on statute, though a secured creditor may in principle also proceed under the SARFAESI Act where the security interest is not one the Act excludes. The NBFC Fair Practices Code requires the loan agreement to contain a built-in, legally enforceable repossession clause; a bank that relies on a repossession clause must ensure that it is legally valid and brought to the borrower's notice when the contract is executed. In either case the clause must set out the notice period before possession is taken, the circumstances in which the notice period may be waived, the procedure for taking possession, a provision for a final chance to repay before the sale or auction, the procedure for returning possession to the borrower, and the procedure for sale or auction. A repossession carried out without that contractual foundation, or in disregard of the procedure the contract prescribes, is not an exercise of a right; and a repossession carried out by force is not saved by the existence of a clause.

For immovable property, and for secured assets generally where the lender is a secured creditor within the SARFAESI Act 2002, self-help is not available at all outside the statutory machinery. The lender must classify the account, issue a demand notice under Section 13(2), consider any representation under Section 13(3A), and only then take measures under Section 13(4). Where physical possession requires assistance, the route is an application to the District Magistrate or Chief Metropolitan Magistrate. The mechanics are set out in the notes on replying to a Section 13(2) notice and on the Section 14 District Magistrate application. An agent turning up at a house with a tow truck and a crowd is not that process.

Where the lender is outside SARFAESI, or chooses not to use it, the lawful routes are an original application before a Debts Recovery Tribunal, a civil suit, a complaint under Section 138 of the Negotiable Instruments Act where a cheque has been dishonoured, or an insolvency application. Each of those is slow, formal and supervised, which is precisely why pressure is applied outside them.

Can a lender contact my family, employer or phone contacts?

Tracing a borrower who has gone silent is legitimate. Calling a borrower's mother, employer or landlord in order to embarrass him is not, and the August 2022 circular says so in terms by prohibiting acts intended to intrude upon the privacy of the borrower's family members, referees and friends.

The digital lending context has sharpened this. The RBI's digital lending framework restricts the device permissions a lending application may seek — access to a borrower's contact list, call logs, media and files is not a permissible collection for the purposes of servicing a loan, and access to camera, microphone or location is permitted only where necessary and with the borrower's explicit consent. A collections operation built on a scraped contact list breaches the lending directions now, and once the data-fiduciary provisions of the Digital Personal Data Protection Act 2023 commence in May 2027 — eighteen months after the commencement notification of 13 November 2025 — processing those contacts' personal data without a lawful basis will engage that Act as well, as discussed in the note on DPDP Act compliance for Indian businesses.

Where a defamatory or shaming message has already gone out to a borrower's contacts or onto a platform, there is a parallel takedown route through the intermediary's grievance officer under the Information Technology intermediary rules, which prescribe short timelines for acknowledgement and for removal of certain categories of content on complaint by the affected individual. That route runs independently of the complaint to the lender and should be started at once, because the evidentiary value of a screenshot is lower than that of a preserved and reported post.

How do I complain, and in what order?

The order matters, because the ombudsman will not entertain a complaint that has not first been made to the lender.

Step one — build the record before you write anything. Note the date, time and duration of each call, the calling number, the name given by the caller and the agency named. Preserve messages rather than describing them. Where a doorstep visit occurred, note who was present and what was said. A recording made by a party to the conversation is ordinarily available as material to be placed before the lender and the ombudsman. A complaint supported by a call log is a different document from a complaint that asserts harassment in the abstract.

Step two — write to the lender's grievance redressal officer. The Fair Practices Code requires the lender to have a grievance redressal mechanism and to display the name and contact details of the officer, at its offices and on its website. Send the complaint by email so that despatch is provable. State the dates and times, identify the specific Code provision breached rather than complaining generally, demand the identity and authority of the agent, and ask for the agency's appointment to be disclosed. Ask expressly for a written reply.

Step three — escalate internally and wait out the clock. Larger regulated entities are required to route wholly or partly rejected complaints through an internal ombudsman before issuing a final reply, and most have a nodal or principal nodal officer above the branch level. The clock that matters is thirty days from the lender's receipt of the complaint.

Step four — file under the Reserve Bank – Integrated Ombudsman Scheme 2026. The 2026 Scheme came into force on 1 July 2026 and repealed the 2021 Scheme, which continues to govern complaints received before that date. A complaint lies where the lender has rejected the complaint wholly or partly or the complainant is not satisfied with the reply, or where no reply has been received within thirty days. The complaint must reach the Ombudsman within ninety days from the expiry of those thirty days or the date of the lender's last communication, whichever is later — a much shorter window than the one year the 2021 Scheme allowed. It may be filed through the RBI's Complaint Management System portal at cms.rbi.org.in, by email to the Centralised Receipt and Processing Centre, or in physical form to that Centre.

Step five — check that your lender is covered. The Scheme covers commercial banks, regional rural banks, specified co-operative banks, and non-banking financial companies — other than housing finance companies and certain other excluded categories — that are authorised to accept deposits or that have a customer interface and an asset size of one hundred crore rupees or more. A small NBFC below the asset threshold may fall outside it, and a complaint against an entity outside the Scheme has to be pursued by other routes, including the Reserve Bank's other grievance arrangements such as its Consumer Education and Protection Cells.

Step six — run the criminal and civil routes in parallel where the facts justify it. Nothing in the Scheme requires a borrower to choose. But note the corollary: the Ombudsman will not entertain a complaint whose subject matter is pending before, or has been dealt with on merits by, a court, tribunal or other forum. A criminal proceeding or police investigation does not count for this purpose, but a civil or consumer proceeding does. Sequencing therefore needs thought, and a hurried consumer complaint can close the ombudsman door on the same grievance.

What can the RBI Ombudsman actually do?

More than borrowers expect on compensation, and less than they expect on punishment.

The Ombudsman may facilitate a settlement, and failing that may pass an Award. Under the 2026 Scheme there is no limit on the amount in dispute that can be brought, but compensation for consequential loss suffered by the complainant is capped at thirty lakh rupees. Separately, and in addition, the Ombudsman may award compensation of up to three lakh rupees for the complainant's loss of time, expenses incurred, and harassment or mental anguish. In a harassment complaint it is usually the second head that is in issue, because direct financial loss is often nil.

An Award is not self-executing in the borrower's favour indefinitely. The complainant must furnish a letter of acceptance in full and final settlement within thirty days of receiving the Award, failing which the Award lapses. An appeal against an Award lies to the Appellate Authority, the Executive Director in charge of the Reserve Bank's Consumer Education and Protection Department, within thirty days — running, for the complainant, from receipt of the Award, and for the regulated entity, from receipt of the complainant's letter of acceptance. A regulated entity may appeal only with the prior sanction of an official of the rank the Scheme specifies.

What the Ombudsman cannot do is prosecute anyone or direct the arrest of an agent, and it is not the forum for deciding whether the debt is owed: a complaint that needs elaborate documentary and oral evidence can be rejected as unsuited to its summary proceedings. A dispute about whether the account should have been declared a non-performing asset at all is a different proceeding, addressed in the note on challenging a wrongful NPA classification. The Ombudsman also declines complaints that are, in substance, about a commercial judgement of the lender rather than a deficiency in service.

Which criminal offences does abusive recovery engage?

The Bharatiya Nyaya Sanhita 2023 replaced the Indian Penal Code with effect from 1 July 2024, and the relevant offences carried over with renumbering. Abusive recovery conduct typically engages the following.

Four cautions belong with that table.

First, extortion is not made out simply because a lawful demand is pressed firmly. The offence requires that the person be put in fear of injury and thereby dishonestly induced to part with property. A demand for what is genuinely due, made without threat, is not extortion however unwelcome; a demand backed by a threat of harm, or a demand for money the agent knows is not owed, is a different matter.

Second, not all of these offences are cognizable. Criminal intimidation is classified as non-cognizable in the general scheme, although several States had by notification made the corresponding offence cognizable within their territory under the previous Code. Defamation is non-cognizable, and under Section 222 of the Bharatiya Nagarik Suraksha Sanhita 2023 a court takes cognizance of it only on a complaint made by the person aggrieved. Criminal trespass, house-trespass, wrongful restraint, wrongful confinement and extortion are ordinarily cognizable. The classification in the First Schedule to the Bharatiya Nagarik Suraksha Sanhita 2023, as applicable in the relevant State, is what governs.

Third, the procedural route follows from the classification. For a cognizable offence, information may be given under Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, including electronically and irrespective of the area in which the offence was committed. If the officer in charge refuses to register it, the substance may be sent in writing by post to the Superintendent of Police under Section 173(4), and thereafter an application may be made to the Magistrate under Section 175(3), who may direct an investigation after hearing the police officer. For a non-cognizable offence, the police may not investigate without a Magistrate's order, and the practical route is a complaint to the Magistrate.

Fourth, the two gender-specific offences need care rather than enthusiasm. Section 78 is drafted around a man contacting a woman to foster personal interaction, and it carries an express exception where the conduct was pursued under a law, or was reasonable and justified in the particular circumstances — which is exactly what will be argued for a call made to recover a debt that is in fact due. It is the abusive content and pattern of the contact, not the fact of repeated contact for recovery, that has to be established. Section 79 turns on the intent to insult modesty, and is engaged by the language used rather than by the demand itself.

Which forum for which grievance?

The forum split matters because complaints filed in the wrong place waste the limitation available in the right one, and because the ombudsman's exclusion of matters pending elsewhere makes parallel filings a tactical decision rather than a free option. The tribunals and courts referred to above are described on the courts and jurisdictions page, and the vocabulary on the legal glossary page.

A record-keeping checklist

The quality of the record decides the outcome far more often than the quality of the grievance. Keep the following from the first incident, not from the point at which the decision to complain is taken.

• Date, time, duration and calling number of every contact, in a single running log
• The name given by the caller and the name of the agency, and whether either was refused
• Screenshots of messages, retained with the sender's number visible and the device timestamp intact
• Photographs of any notice affixed at the premises, and the names of witnesses to a doorstep visit
• The loan account number, sanction letter and loan agreement, particularly the repossession clause
• Every written communication from the lender, including any demand notice, with the envelope and date of receipt
• The grievance officer's name and email, and proof of despatch of the complaint
• A note of any payment made under pressure, with the mode and the receipt

Where the borrower is a business rather than an individual, the log should also record contact made to customers, suppliers and bankers, because that conduct engages the humiliation limb of the Code directly and is separately damaging.

What a complaint will not achieve

Three expectations need managing, and it is fairer to say so plainly.

A harassment complaint does not extinguish the debt, suspend interest or stay enforcement. The Code regulates conduct, not liability. A borrower who succeeds before the Ombudsman still owes what he owed.

A complaint is not a substitute for engaging with the underlying default. Where the account is genuinely stressed, the productive conversation is about restructuring or settlement, and the framework for that is set out in the note on the legal framework for one-time settlements. A well-documented harassment record improves the tone of that conversation; it does not replace it.

Finally, harassment is not a defence to the substantive proceeding. A borrower facing enforcement should run the substantive challenge on its own footing — a securitisation application before the Debts Recovery Tribunal, a defence in the recovery proceeding, or a response to a statutory notice — and treat the conduct complaint as a parallel track. The tribunal process is described in the Debts Recovery Tribunal guide, and the related practice area is described under debt recovery. Institutions designing collections processes that stay inside the Code will find the related documentation expectations on the institutional counsel page.

The regulatory position is, in the end, narrower and more usable than the noise around it suggests. A lender may demand payment. It may do so in daylight, in its own name, without threats, without an audience, and without involving people who are not party to the loan. Everything outside that is a breach the lender owns, and there is a documented and time-bound route to saying so.

This article is general information on the law and regulation as it stands and is not legal advice; the correct course in any matter depends on its own facts, the terms of the loan documentation and the conduct actually recorded. Queries may be directed through the contact page.