Yes, debt collection agencies are legal in India — but unlike some of the other businesses covered in this series, they don’t operate in a regulatory vacuum. Instead, they’re governed through a genuinely distinctive model: the Reserve Bank of India doesn’t license debt collection agencies directly, but it regulates them indirectly, by holding banks and NBFCs directly accountable for how the recovery agents they hire behave. And as of 2026, that oversight has become considerably stricter. Here’s exactly how this framework works.
The Legal Basis: RBI’s Fair Practices Code
Debt collection in India operates under regulatory authority that carries genuine legal weight, not just guidance.
- Recovery activity is governed by the RBI’s Fair Practices Code (FPC), a set of rules dictating how banks and NBFCs (non-bank lending companies) can pursue overdue debt
- This isn’t mere suggestion — RBI directives, master circulars, and directions carry statutory authority under Section 21 and Section 35A of the Banking Regulation Act, 1949, alongside relevant provisions of the Reserve Bank of India Act, 1934, and NBFC regulations, making them legally binding
- The framework applies to every RBI-regulated entity — commercial banks, NBFCs, and cooperative banks alike — and no regulated lender can exempt itself from these obligations
- Rather than licensing the collection agency itself as an independent entity, the RBI holds the lending institution directly responsible for the conduct of any recovery agent or agency it engages on its behalf
A Major 2026 Update: Responsible Business Conduct Directions
This year brought the most significant tightening of debt collection rules India has seen in decades, and it took effect on July 1, 2026.
- The RBI issued the Commercial Banks – Responsible Business Conduct (Second Amendment) Directions, 2026, introducing the most comprehensive set of borrower protections the country has had
- This consolidates and strengthens what had previously been a fragmented set of circulars — the earlier primary reference was the RBI/2022-23/108 Master Circular on Recovery Agents of Lending Institutions — into a unified, stricter regulatory framework
- The update reflects a deliberate shift in philosophy: from “forceful recovery” toward “regulated communication”, addressing years of borrower complaints about aggressive, sometimes harassing collection tactics
- Every regulated lender must now maintain a formal, written loan recovery policy specifically approved by its board of directors — recovery is no longer something a bank can treat as an informal, outsourced afterthought
Mandatory Certification: No More Untrained Recovery Agents
One of the genuinely significant changes addresses a longstanding weak point in the old system.
- As of 2026, no individual can act as a recovery agent without a valid certification from the Indian Institute of Banking and Finance (IIBF)
- This directly addresses a historical problem — individuals with no formal training in law or ethics were often entrusted with the genuinely sensitive task of debt collection, contributing to widespread trust deficits between financial institutions and the public
- Recovery agents are now required to carry a valid ID card, a copy of the bank’s authorization letter, and their IIBF certification — if an agent cannot produce all three of these documents, you are not obligated to interact with them at all
The “Notice of Assignment” Requirement
This is a genuinely important protection that closes a loophole borrowers previously had no way to verify.
- Before sending any recovery agent, the bank must first provide the borrower a “Notice of Assignment” — written confirmation of exactly which agency has been assigned to their case, along with the name of the primary contact person
- The bank must also provide a specific authorization letter naming the exact agent or agency permitted to recover the debt from that specific account
- If an agent from an agency not named in your official bank notice contacts you, this is treated as a privacy leak and a major regulatory violation — a genuinely useful, concrete way for borrowers to identify when something is off
Vicarious Liability: Banks Can No Longer Hide Behind “Independent” Agencies
This principle represents a genuine structural shift in how accountability works in Indian debt recovery.
- Historically, lenders sometimes attempted to distance themselves from harassment complaints by claiming the aggressive behavior was the fault of an “independent” third-party agency they had merely outsourced to
- The RBI has closed this loophole entirely — under the current framework, vicarious liability is now a cornerstone of the regulatory system, meaning banks bear direct accountability for the behaviour of every agent they engage, regardless of how the outsourcing relationship is structured
- This shifts genuine legal exposure back onto the regulated lender itself, giving banks and NBFCs a much stronger incentive to properly vet and monitor the recovery agencies they work with
The Strict Calling Hours Rule
One of the most widely discussed protections in the 2026 update addresses exactly when borrowers can be contacted.
- Recovery agents may only contact borrowers between 8:00 AM and 7:00 PM — this window applies absolutely, across every form of communication: phone calls, WhatsApp messages, SMS, and physical visits to the borrower’s premises
- Any communication outside these hours is treated as a direct violation of the Fair Practices Code
- This specifically addresses a well-known historical tactic — agents targeting borrowers late at night or early in the morning specifically to catch them off guard and apply maximum psychological pressure, which regulators have now explicitly recognized as a form of harassment
- Agents also cannot visit borrowers on public holidays or during personal events, extending the same underlying principle of respecting a borrower’s basic dignity and personal space
What Recovery Agents Are Explicitly Prohibited From Doing
Beyond the calling hours, the Fair Practices Code sets clear behavioral boundaries.
- Threats, harassment, or repeated pressure calls are explicitly prohibited under the current framework
- Communication must remain professional, documented, and respectful, reflecting the RBI’s broader “borrower-first” approach to structuring the recovery relationship
- Banks are required to protect borrower personal information, limiting how widely account and debt details can be shared or disclosed during the recovery process
- The overall philosophy embedded in these rules is explicit: while a debt genuinely must be paid, the process of recovery must not violate a borrower’s basic dignity or personal liberty
What Borrowers Can Do If an Agent Crosses the Line
The regulatory framework also builds in genuine, accessible escalation routes if these rules are violated.
- If a recovery agent violates these protections, borrowers can lodge a complaint through three routes: directly with the bank, through the RBI Ombudsman under the Integrated Ombudsman Scheme, or with the police, depending on the severity of what occurred
- Documenting any violation — dates, times, specific behavior, and whether the agent could produce their required ID, authorization letter, and IIBF certification — genuinely strengthens any formal complaint
- If the harassment stems from a genuine outstanding debt rather than agent misconduct, resolving the underlying loan through proper repayment, restructuring, or settlement addresses the root issue — though it’s worth knowing a “Settled” status can remain on your CIBIL credit report for up to seven years, so this shouldn’t be treated as a first-resort solution
FAQs
Q1. Do debt collection agencies in India need their own separate government license to operate, similar to a security agency under PSARA?
No — debt collection agencies aren’t independently licensed as a standalone business category. Instead, the RBI regulates them indirectly by holding the banks and NBFCs that hire them directly accountable through the Fair Practices Code, with individual recovery agents now required to hold IIBF certification as of 2026.
Q2. How can I tell if someone contacting me about a debt is a legitimately authorized recovery agent or a scammer?
A legitimate recovery agent must be able to produce a valid ID card, a copy of the bank’s specific authorization letter naming them for your account, and their IIBF certification — if they can’t provide all three, you’re not obligated to engage with them. You should also have already received a formal “Notice of Assignment” from your bank naming that exact agency before any agent contacts you, so an agent from an unnamed agency is itself a red flag.
Q3. Can a recovery agent legally call or message me late at night to pressure me about an overdue loan?
No — under the 2026 RBI directions, recovery agents can only contact borrowers between 8:00 AM and 7:00 PM, and this rule applies absolutely across phone calls, WhatsApp messages, SMS, and physical visits. Any contact outside this window is a direct violation of the Fair Practices Code that you can formally report.
Q4. If a recovery agency harasses me, can I hold the bank responsible, or only the individual agent or agency involved?
Yes — under the principle of vicarious liability that now anchors this regulatory framework, banks bear direct accountability for the behaviour of every recovery agent they engage, and cannot deflect responsibility by claiming the agency operated independently. This means your complaint can and should go directly to the bank itself, in addition to the RBI Ombudsman or police if the situation genuinely warrants it.
