Recovery Agent Harassment: What the Law Actually Allows

A recovery agent may telephone a borrower, write to a borrower and visit a borrower to ask for payment of an overdue loan. That is where the permission ends. The Reserve Bank of India's Fair Practices Code, read with its directions to regulated entities employing recovery agents, prohibits contact before 8:00 a.m. or after 7:00 p.m., intimidation or harassment of any kind whether verbal or physical, the use of muscle power, public humiliation, intrusion upon the privacy of a borrower's family, referees and friends, anonymous or threatening calls, and persistent calling — and the lender, not the agency, answers for every breach.

Two things follow from that, and they are usually confused. The first is that a demand for money that is actually due is not harassment merely because it is unwelcome or repeated in measured terms. The second is that the manner of demand is regulated independently of the merits of the debt, so a borrower who genuinely owes the money still has the full protection of the Code. This note sets out what the regulator actually requires, how the escalation ladder works in the order it has to be climbed, and where abusive conduct stops being a regulatory matter and becomes a criminal one.

Where does the Fair Practices Code for recovery actually live?

There is no single "recovery agents Act" in India. The obligations are regulatory, and they sit in three overlapping places.

For non-banking financial companies, the Fair Practices Code forms part of the Master Direction – Reserve Bank of India (Non-Banking Financial Company – Scale Based Regulation) Directions, 2023, issued on 19 October 2023, which consolidated the earlier standalone Fair Practices Code circulars. For banks, the equivalent obligations sit in the RBI's fair practices and customer service instructions and in the long-standing guidance on engagement of recovery agents.

Cutting across both is the RBI circular dated 12 August 2022 on outsourcing of financial services and the responsibilities of regulated entities employing recovery agents. That circular is the operative source of the specific prohibitions most borrowers are looking for, and it applies to regulated entities generally rather than to one class of lender.

Where the loan was sourced or serviced digitally, the RBI's digital lending framework adds a further layer, including restrictions on what a lending application may access on a borrower's device and a requirement that the borrower be told who the recovery agent is.

None of these is a criminal statute. They are conditions of the lender's licence to operate, enforced by the RBI through supervisory action and by borrowers through the grievance and ombudsman machinery described below.

What exactly is a recovery agent prohibited from doing?

The August 2022 circular directs regulated entities to strictly ensure that neither they nor their agents resort to intimidation or harassment of any kind, verbal or physical, against any person in their debt collection efforts. It then particularises. The following table sets out the prohibited conduct alongside what it means in practice.

The Fair Practices Code adds the general formulation that the lender shall not resort to undue harassment, expressly including persistently bothering borrowers at odd hours and the use of muscle power for recovery of loans.

Two points of precision are worth holding onto. The 8:00 a.m. to 7:00 p.m. window attaches to contact for recovery of overdue loans; it is not a general prohibition on the lender ever communicating outside those hours for other purposes. And persistent calling is a separate breach from calling out of hours — a lender that confines itself to daylight but calls eleven times before lunch has still breached the Code.

Is the lender responsible for an outsourced agency?

Yes, and this is the single most useful thing a borrower can know.

The RBI's outsourcing framework proceeds on the principle that outsourcing an activity does not diminish the regulated entity's obligations, or those of its board and senior management, and that the entity remains responsible for the actions of its service providers. The Fair Practices Code applies to the lender's recovery activity whether that activity is carried out by its own staff or by an appointed agency.

The practical consequences are immediate. The complaint is addressed to the lender. The lender cannot dispose of it by saying the agency was independent, or that the individual concerned was a freelancer, or that the agency has been terminated. Where the account has been assigned to an asset reconstruction company, that company is itself an RBI-regulated entity bound by the Fair Practices Code applicable to asset reconstruction companies, and the complaint lies to its grievance redressal officer; whether the Integrated Ombudsman Scheme reaches it is a separate question, answered by the list of entities the Scheme covers rather than assumed. And the borrower is entitled to know who is calling: an agent should be able to identify himself, name the agency, and produce authority from the lender.

Two related requirements are worth asking about in writing. Lenders were directed to give borrowers the details of the recovery agency, and agents have historically been required to carry an authorisation letter together with a copy of the notice from the lender. Banks were separately directed to ensure that agents engaged for recovery had completed a prescribed training and certification programme before being deployed.

What can an agent lawfully do about the asset?

Nothing, by himself. A recovery agent has no statutory power of seizure, no power of entry, and no power to detain a person or a vehicle. Whatever power exists is either contractual or statutory, and it belongs to the lender.

For a hypothecated movable — typically a vehicle — the power to repossess ordinarily rests on the loan contract rather than on statute, though a secured creditor may in principle also proceed under the SARFAESI Act where the security interest is not one the Act excludes. The Fair Practices Code requires the loan agreement to contain a built-in repossession clause, and requires that clause to set out the notice period before possession is taken, the circumstances in which the notice period may be waived, the procedure for taking possession, a provision for a final chance to repay before the sale or auction, the procedure for returning possession to the borrower, and the procedure for sale or auction. A repossession carried out without that contractual foundation, or in disregard of the procedure the contract prescribes, is not an exercise of a right; and a repossession carried out by force is not saved by the existence of a clause.

For immovable property, and for secured assets generally where the lender is a secured creditor within the SARFAESI Act 2002, self-help is not available at all outside the statutory machinery. The lender must classify the account, issue a demand notice under Section 13(2), consider any representation under Section 13(3A), and only then take measures under Section 13(4). Where physical possession requires assistance, the route is an application to the District Magistrate or Chief Metropolitan Magistrate. The mechanics are set out in the notes on replying to a Section 13(2) notice and on the Section 14 District Magistrate application. An agent turning up at a house with a tow truck and a crowd is not that process.

Where the lender is outside SARFAESI, or chooses not to use it, the lawful routes are an original application before a Debts Recovery Tribunal, a civil suit, a complaint under Section 138 of the Negotiable Instruments Act where a cheque has been dishonoured, or an insolvency application. Each of those is slow, formal and supervised, which is precisely why pressure is applied outside them.

Can a lender contact my family, employer or phone contacts?

Tracing a borrower who has gone silent is legitimate. Calling a borrower's mother, employer or landlord in order to embarrass him is not, and the August 2022 circular says so in terms by prohibiting acts intended to intrude upon the privacy of the borrower's family members, referees and friends.

The digital lending context has sharpened this. The RBI's digital lending framework restricts the device permissions a lending application may seek — access to a borrower's contact list, call logs, media and files is not a permissible collection for the purposes of servicing a loan, and access to camera, microphone or location is permitted only where necessary and with the borrower's explicit consent. A collections operation built on a scraped contact list is therefore doubly exposed: it breaches the lending directions, and the processing of those contacts' personal data without a lawful basis engages the Digital Personal Data Protection Act 2023, discussed in the note on DPDP Act compliance for Indian businesses.

Where a defamatory or shaming message has already gone out to a borrower's contacts or onto a platform, there is a parallel takedown route through the intermediary's grievance officer under the Information Technology intermediary rules, which prescribe short timelines for acknowledgement and for removal of certain categories of content on complaint by the affected individual. That route runs independently of the complaint to the lender and should be started at once, because the evidentiary value of a screenshot is lower than that of a preserved and reported post.

How do I complain, and in what order?

The order matters, because the ombudsman will not entertain a complaint that has not first been made to the lender.

Step one — build the record before you write anything. Note the date, time and duration of each call, the calling number, the name given by the caller and the agency named. Preserve messages rather than describing them. Where a doorstep visit occurred, note who was present and what was said. A recording made by a party to the conversation is ordinarily available as material to be placed before the lender and the ombudsman. A complaint supported by a call log is a different document from a complaint that asserts harassment in the abstract.

Step two — write to the lender's grievance redressal officer. The Fair Practices Code requires the lender to have a grievance redressal mechanism and to display the name and contact details of the officer, at its offices and on its website. Send the complaint by email so that despatch is provable. State the dates and times, identify the specific Code provision breached rather than complaining generally, demand the identity and authority of the agent, and ask for the agency's appointment to be disclosed. Ask expressly for a written reply.

Step three — escalate internally and wait out the clock. Larger regulated entities are required to route wholly or partly rejected complaints through an internal ombudsman before issuing a final reply, and most have a nodal or principal nodal officer above the branch level. The clock that matters is thirty days from the date of the complaint to the lender.

Step four — file under the Reserve Bank – Integrated Ombudsman Scheme 2021. A complaint lies where the lender has rejected the complaint wholly or partly and the complainant is not satisfied with the reply, or where no reply has been received within thirty days. The complaint must be filed within one year after receipt of the lender's reply or, where no reply was received, within one year and thirty days from the date of the complaint to the lender. Filing is free. It may be done through the RBI's Complaint Management System portal at cms.rbi.org.in, by email to the Centralised Receipt and Processing Centre, or in physical form to that Centre.

Step five — check that your lender is covered. The Scheme covers commercial banks, regional rural banks and specified co-operative banks, and non-banking financial companies that are authorised to accept deposits or that have a customer interface and an asset size of one hundred crore rupees or more. The coverage clause carries exclusions, and a small NBFC below the asset threshold may fall outside it. A complaint against an entity outside the Scheme is not lost — it is routed to the RBI's Consumer Education and Protection machinery through the same portal, which is a supervisory channel rather than an adjudicatory one.

Step six — run the criminal and civil routes in parallel where the facts justify it. Nothing in the Scheme requires a borrower to choose. But note the corollary: the Ombudsman will not entertain a complaint whose subject matter is pending before, or has been dealt with by, a court, tribunal or other forum. Sequencing therefore needs thought, and a hurried consumer complaint can close the ombudsman door on the same grievance.

What can the RBI Ombudsman actually do?

More than borrowers expect on compensation, and less than they expect on punishment.

The Ombudsman may facilitate a settlement through conciliation or mediation, and failing that may pass an Award. The Award may direct the regulated entity to pay compensation for loss suffered by the complainant as a direct consequence of the act or omission, capped at the actual loss so suffered or twenty lakh rupees, whichever is lower, and exclusive of the amount in dispute. Separately, and in addition, the Ombudsman may award compensation not exceeding one lakh rupees for mental agony and harassment, including loss of time and expenses incurred by the complainant. In a harassment complaint it is usually the second head that is in issue, because direct financial loss is often nil.

An Award is not self-executing in the borrower's favour indefinitely. The complainant must furnish a letter of acceptance in full and final settlement within the period the Scheme allows, failing which the Award lapses. An appeal against an Award lies to the Appellate Authority, the Executive Director in charge of the Reserve Bank department administering the Scheme, within thirty days — running, for the complainant, from receipt of the Award, and for the regulated entity, from receipt of the complainant's letter of acceptance. A regulated entity may appeal only with the prior sanction of its chief executive.

What the Ombudsman cannot do is prosecute anyone, direct the arrest of an agent, reverse the classification of the account, or decide whether the debt is owed. A dispute about whether the account should have been declared a non-performing asset at all is a different proceeding, addressed in the note on challenging a wrongful NPA classification. The Ombudsman also declines complaints that are, in substance, about a commercial judgement of the lender rather than a deficiency in service.

Which criminal offences does abusive recovery engage?

The Bharatiya Nyaya Sanhita 2023 replaced the Indian Penal Code with effect from 1 July 2024, and the relevant offences carried over with renumbering. Abusive recovery conduct typically engages the following.

Four cautions belong with that table.

First, extortion is not made out simply because a lawful demand is pressed firmly. The offence requires that the person be put in fear of injury and thereby dishonestly induced to part with property. A demand for what is genuinely due, made without threat, is not extortion however unwelcome; a demand backed by a threat of harm, or a demand for money the agent knows is not owed, is a different matter.

Second, not all of these offences are cognizable. Criminal intimidation is classified as non-cognizable in the general scheme, although several States had by notification made the corresponding offence cognizable within their territory under the previous Code; whether a given State's notification carries across to the renumbered provision is a point to check locally. Defamation is not investigated by the police at all: a court takes cognizance of it only on a complaint by the person aggrieved. Criminal trespass, house-trespass, wrongful restraint, wrongful confinement and extortion are ordinarily cognizable. The classification in the First Schedule to the Bharatiya Nagarik Suraksha Sanhita 2023, as applicable in the relevant State, is what governs.

Third, the procedural route follows from the classification. For a cognizable offence, information may be given under Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, including electronically and irrespective of the area in which the offence was committed. If the officer in charge refuses to register it, the substance may be sent in writing by post to the Superintendent of Police under Section 173(4), and thereafter an application may be made to the Magistrate under Section 175(3), who may direct an investigation after hearing the police officer. For a non-cognizable offence, the police may not investigate without a Magistrate's order, and the practical route is a complaint to the Magistrate.

Fourth, the two gender-specific offences need care rather than enthusiasm. Section 78 is drafted around a man contacting a woman to foster personal interaction, and it carries an express exception where the conduct was pursued under a law, or was reasonable and justified in the particular circumstances — which is exactly what will be argued for a call made to recover a debt that is in fact due. It is the abusive content and pattern of the contact, not the fact of repeated contact for recovery, that has to be established. Section 79 turns on the intent to insult modesty, and is engaged by the language used rather than by the demand itself.

Which forum for which grievance?

The forum split matters because complaints filed in the wrong place waste the limitation available in the right one, and because the ombudsman's exclusion of matters pending elsewhere makes parallel filings a tactical decision rather than a free option. The tribunals and courts referred to above are described on the courts and jurisdictions page, and the vocabulary on the legal glossary page.

A record-keeping checklist

The quality of the record decides the outcome far more often than the quality of the grievance. Keep the following from the first incident, not from the point at which the decision to complain is taken.

• Date, time, duration and calling number of every contact, in a single running log
• The name given by the caller and the name of the agency, and whether either was refused
• Screenshots of messages, retained with the sender's number visible and the device timestamp intact
• Photographs of any notice affixed at the premises, and the names of witnesses to a doorstep visit
• The loan account number, sanction letter and loan agreement, particularly the repossession clause
• Every written communication from the lender, including any demand notice, with the envelope and date of receipt
• The grievance officer's name and email, and proof of despatch of the complaint
• A note of any payment made under pressure, with the mode and the receipt

Where the borrower is a business rather than an individual, the log should also record contact made to customers, suppliers and bankers, because that conduct engages the humiliation limb of the Code directly and is separately damaging.

What a complaint will not achieve

Three expectations need managing, and it is fairer to say so plainly.

A harassment complaint does not extinguish the debt, suspend interest or stay enforcement. The Code regulates conduct, not liability. A borrower who succeeds before the Ombudsman still owes what he owed.

A complaint is not a substitute for engaging with the underlying default. Where the account is genuinely stressed, the productive conversation is about restructuring or settlement, and the framework for that is set out in the note on the legal framework for one-time settlements. A well-documented harassment record improves the tone of that conversation; it does not replace it.

Finally, harassment is not a defence to the substantive proceeding. A borrower facing enforcement should run the substantive challenge on its own footing — a securitisation application before the Debts Recovery Tribunal, a defence in the recovery proceeding, or a response to a statutory notice — and treat the conduct complaint as a parallel track. The tribunal process is described in the Debt Recovery Tribunal guide, and the practice areas this chambers works in are set out under debt recovery. Institutions designing collections processes that stay inside the Code will find the related documentation expectations on the institutional counsel page.

The regulatory position is, in the end, narrower and more usable than the noise around it suggests. A lender may demand payment. It may do so in daylight, in its own name, without threats, without an audience, and without involving people who are not party to the loan. Everything outside that is a breach the lender owns, and there is a free, documented and time-bound route to saying so.

This article is general information on the law and regulation as it stands and is not legal advice; the correct course in any matter depends on its own facts, the terms of the loan documentation and the conduct actually recorded. Queries may be directed through the contact page.