Recovery Agents Crossing the Line: The RBI Rules That Make Your Bank Liable for Harassment

When a loan account slips into default, the law gives lenders well-defined recovery routes. What it does not give them is a licence to intimidate. Yet thousands of borrowers across India still field calls before dawn, find their photographs pasted in housing-society lobbies, or watch strangers arrive at their doorstep claiming to "seize" assets. The Reserve Bank of India drew a hard line against exactly this conduct in its notification on Recovery Agents dated 24 April 2008, and reinforced it through later master directions. The single most important thing to understand is this: under that 2008 framework, the bank, as principal, is legally answerable for everything its recovery agent does in its name.

This guide sets out the statutory position, the procedure a compliant lender must follow, the defences and remedies a harassed borrower can deploy, and the judicial strictures that gave these rules their teeth. With the RBI repo rate held at 5.25% as of 8 April 2026 and floating-rate EMIs resetting within roughly three months of each policy move, stressed borrowers are a large and vulnerable group, which is precisely why the conduct rules matter.

The Statutory Position

The recovery-agent rules do not float free; they rest on the Reserve Bank's power to issue binding directions to banks under Section 35A of the Banking Regulation Act, 1949. Using that power, the RBI issued its consolidated guidance on Recovery Agents engaged by banks on 24 April 2008, making the bank vicariously responsible for its agents. A breach is therefore not a mere contractual lapse between bank and agent; it is a regulatory violation the RBI can punish directly.

It is important to separate lawful recovery from extra-judicial harassment. For a secured loan, the lender's legitimate route is the SARFAESI Act, 2002, the bare text of which is published on the Government of India's India Code portal. Once an account is classified as a non-performing asset, Section 13(2) of SARFAESI requires the secured creditor to serve a 60-day demand notice, and only on non-compliance can it move to enforcement under Section 13(4). None of these provisions authorise a recovery agent to take physical possession of a vehicle on the street or a flat by force; that power flows only through the District Magistrate under Section 14 of the same Act.

Where the dues are large, the Recovery of Debts and Bankruptcy Act, 1993 routes the matter to a Debts Recovery Tribunal, which has jurisdiction over bank debts of Rs 20 lakh and above under Section 17 of that Act. The point for a borrower is structural: genuine recovery happens before a DRT or under a magistrate's order, not through phone threats. Anything outside these channels is conduct the RBI's 2008 notification was written to stop.

The framework also recognises that the borrower's own assets are not infinitely exposed. Section 31 of SARFAESI, 2002 exempts certain property from enforcement altogether, including agricultural land, a pledge or lien, and small financial assets. A recovery agent who pressures a farmer over exempt agricultural land is therefore pushing for something the statute itself withholds from the lender. Knowing these limits, set out in Section 31 of the 2002 Act, lets a borrower distinguish a lawful demand from an empty threat.

The 2008 framework imposes concrete obligations on banks before an agent may even make contact. The table below distils the core requirements, each traceable to the Reserve Bank's notification.

A bank that hands a defaulting account to an uncertified, unverified agent who then calls at midnight has breached the 24 April 2008 notification on at least three counts simultaneously, regardless of how much money the borrower actually owes.

Procedure Step by Step

A compliant recovery process under the 2008 RBI framework, read with SARFAESI, 2002, follows a defined sequence. Where any step is skipped, the borrower has a documented breach to point to.

1. Default and classification. The account must first be classified as a non-performing asset under RBI's prudential norms, typically after 90 days of non-payment, before SARFAESI machinery can be invoked at all.
2. Statutory demand, not agent threats. For a secured loan, the lender serves the 60-day notice under Section 13(2) of SARFAESI, 2002. This is a formal legal document, not a recovery-agent phone call.
3. Agent due diligence. Before any agent is assigned, the bank must complete police verification and confirm the agent holds the 100-hour IBA/IIBF certification mandated by the 24 April 2008 notification.
4. Authorisation and identification. The agent visiting the borrower must carry the bank's authorisation letter and disclose the agency's name and contact details, as the 2008 framework requires.
5. Contact within limits. Communication must stay within reasonable hours and be tape-recorded by the bank, so that any dispute about what was said can be checked against a record rather than memory.
6. Borrower representation. If the borrower objects to the SARFAESI notice, Section 13(3A) entitles them to make a representation, and the secured creditor must respond with reasons within 15 days.
7. Enforcement only through law. If dues remain, the lender proceeds under Section 13(4) and, for physical possession, applies to the District Magistrate under Section 14, who is directed to dispose of the application within 30 days under the post-2016 amendment. No agent may seize property on his own authority.

The discipline here is deliberate. The 2008 notification, layered over the 60-day and 15-day timelines in SARFAESI, 2002, leaves a paper trail at every stage. Borrowers who keep copies of each notice and log each agent call are well placed to identify exactly where a lender stepped outside the rules.

Borrower Defences Available

A borrower facing aggressive recovery has several distinct lines of defence, and they operate in parallel rather than in sequence.

Insist on documentary proof of authority. Under the 24 April 2008 notification, a recovery agent who cannot produce the bank's authorisation letter has no standing to be at your door. You are entitled to ask for the letter, the agency's name, and the certification status of the individual agent before discussing anything.

Escalate harassment in writing. Document each contact with date and time, then complain first to the bank's grievance officer. If unresolved within 30 days, the matter can be escalated to the RBI Ombudsman under the Reserve Bank-Integrated Ombudsman Scheme, 2021, which covers deficiency in service including improper recovery practices. Persistent threats, criminal intimidation, or public shaming can additionally attract criminal complaints, and a borrower can file a police report alongside the 30-day grievance escalation rather than waiting for the bank to act.

Use the SARFAESI appeal route for the debt itself. If you dispute the recovery measure, Section 17 of SARFAESI, 2002 lets you apply to the DRT within 45 days of the action under Section 13(4). A further appeal to the Debts Recovery Appellate Tribunal under Section 18 is possible, but only on depositing 50% of the debt due, which the tribunal may reduce to not less than 25% for reasons recorded in writing.

Negotiate a settlement on the record. A one-time settlement remains a legitimate exit. RBI's framework on compromise settlements and technical write-offs, issued in June 2023, expressly permits lenders to enter compromise settlements with board-approved policies, so a borrower can pursue a structured payoff instead of indefinite harassment. Modelling the lump sum against your outstanding principal using a foreclosure calculator or planning a debt-consolidation path can turn a panic call into a negotiated number.

The table below maps each recovery or appeal stage to its governing provision and timeline, so a borrower can see at a glance which clock is running.

Recent Tribunal/HC Position

Indian courts moved against recovery-agent abuse well before the RBI codified its 2008 rules, and that jurisprudence is what gives the conduct framework its bite. In ICICI Bank Ltd v. Prakash Kaur, (2007) 2 SCC 711, the Supreme Court of India deprecated in the strongest terms the practice of recovering loan dues through musclemen and strong-arm tactics, holding that a bank cannot take the law into its own hands and that recovery must follow due legal process. The court's strictures in that 2007 ruling were a direct catalyst for the Reserve Bank tightening its guidance the following year.

The principle that flows from this line of cases is one of vicarious liability: because the RBI's 24 April 2008 notification fixes the bank as principal, the borrower need not chase the individual agent. Consumer forums and the RBI Ombudsman have on this basis directed banks to compensate borrowers for the actions of agents acting in the bank's name, treating abusive recovery as a deficiency in service. The Consumer Protection Act, 2019 provides a parallel forum, allowing a harassed borrower to claim damages for deficient service without first deposing the disputed loan amount, a contrast to the deposit hurdles built into the SARFAESI, 2002 appeal route.

Crucially, the Reserve Bank reserved an enforcement weapon for itself. Under the 2008 framework, the RBI can bar a bank, temporarily or permanently, from engaging recovery agents in a particular area where the bank's agents engage in abusive practices or attract adverse court strictures. That sanction sits on top of the bank's separate exposure to a damages claim, meaning a single episode of harassment can expose a lender to both a regulatory ban and a compensation order. For borrowers, the practical takeaway from this body of law is that documented harassment is not just distressing; since 2008 it has been independently actionable against the institution.

FAQ

Can a recovery agent seize my car or house directly?

No. Under SARFAESI, 2002, physical possession of a secured asset requires an order from the District Magistrate under Section 14, with a 30-day disposal mandate. A recovery agent has no independent power to seize an asset, and the 24 April 2008 RBI notification holds the bank responsible if its agent attempts forced seizure.

What are the legal hours during which an agent can contact me?

Under the IBA Code of Conduct referenced in the RBI's 2008 framework, borrowers should ordinarily be contacted only between 7:00 a.m. and 7:00 p.m. Calls outside these hours, or repeated calls designed to harass, fall foul of the conduct rules, and the bank, as principal, bears the liability.

My loan is small and unsecured. Do these protections still apply?

Yes. The 24 April 2008 recovery-agent rules govern conduct regardless of loan size or whether the loan is secured. The 100-hour IBA/IIBF certification, police verification, and tape-recording requirements apply to agents pursuing any borrower, including those holding a personal loan.

Where do I complain if an agent harasses me?

First, lodge a written complaint with the bank's grievance redressal officer. If it is not resolved within 30 days, escalate to the RBI Ombudsman under the Reserve Bank-Integrated Ombudsman Scheme, 2021. Keep a dated log of every call and visit, because the 2008 rules require the bank to tape-record agent calls, which strengthens your evidence.

Can I settle the loan instead of fighting recovery?

Yes. RBI's June 2023 framework on compromise settlements and technical write-offs permits lenders to enter board-approved one-time settlements. Modelling the payoff against your outstanding balance with a foreclosure calculator helps you arrive at a defensible settlement figure before negotiating.

Is the bank really liable for an outside agency's behaviour?

Yes. The defining feature of the 24 April 2008 notification is that the bank is the principal and is responsible for its recovery agents' actions. This was reinforced by the Supreme Court in ICICI Bank Ltd v. Prakash Kaur, (2007) 2 SCC 711, where a bank was held accountable for strong-arm recovery conducted in its name.

What happens to a bank whose agents repeatedly misbehave?

The Reserve Bank can, under its 2008 framework and its Section 35A powers under the Banking Regulation Act, 1949, bar the bank temporarily or permanently from engaging recovery agents in a given area. This regulatory sanction is separate from, and additional to, any compensation a borrower may obtain for harassment.