AI in loan collections under RBI's rules: what an agent may do, and what stays with people
What an AI agent may do in NBFC collections under RBI's conduct rules and draft model risk guidance, what stays with people, and what each contact should log.
RBI has no separate rulebook for AI in collections. The conduct rules that bind a human agent bind an automated one: no recovery calls before 8 a.m. or after 7 p.m. on NBFC loans other than microfinance, no persistent calling, no threats and no misleading statements. RBI’s June 2026 draft model risk guidance, not yet final, adds that AI talking to customers should say it is AI and offer a person on request.
If you run collections at an NBFC and someone has pitched you an AI agent that calls borrowers, the rules it has to follow are already written. They were written with people in mind, and they bind the NBFC and whoever acts for it.
The useful test for any AI collections tool is whether it refuses a contact the rules forbid before it happens, and whether the NBFC can later show, contact by contact, that each one passed.
- No exemption for software. Paragraph 100 of the conduct directions binds the NBFC and its agents, whatever makes the contact.
- A wrong figure can be a misleading representation. An agent that quotes dues from anywhere but the live record runs that risk.
- The draft guidance asks for disclosure. Customers should know they are dealing with AI and be able to reach a person.
- People keep the judgement calls. Settlements, hardship, disputes, legal notices and repossession stay with named staff.
- The NBFC answers for the vendor. Outsourcing a collections agent, human or automated, leaves the responsibility where it was.
Does RBI allow AI in loan collections?
Nothing in RBI’s directions for NBFCs forbids it, and nothing exempts it. Two sets of text apply.
The first is binding. The Responsible Business Conduct Directions, 2025, set how an NBFC and its agents may pursue a debt, and the Managing Risks in Outsourcing Directions, 2025, keep the NBFC responsible for anyone it engages to do the work. The recovery-agent rules post sets out which of those rules apply to which loans. For digital loans, a vendor whose AI does recovery work for the NBFC falls within the Credit Facilities Directions’ definition of a lending service provider (paragraph 4(1)(xix)), so it goes on the NBFC’s website list of service providers (paragraph 9(4)) and the borrower gets the recovery agent’s details before the first contact (paragraph 9(6)).
The second is a draft. On 24 June 2026 RBI released its Guidance on Regulatory Principles for Model Risk Management for comment, covering NBFCs along with banks and other regulated entities. It defines a model broadly enough to include an AI system used in collections, and it has a section on AI that faces customers. It says “should”, not “shall”, and the comment period closed on 24 July 2026. RBI had not issued a final version as of this post.
Which conduct rules bind an automated contact?
All of them. Paragraph 100 says the NBFC shall strictly ensure that “it or its agents” do not harass or intimidate anyone in collecting a debt. Read against an automated contact, each ban becomes something the system has to check before it acts:
| Rule | What the system can check before acting | Source |
|---|---|---|
| No recovery calls before 8 a.m. or after 7 p.m. | The borrower’s local time against the window, before the call is placed | RBC para 100 |
| No persistent calling | Attempts counted across every channel and every system that contacts the borrower | RBC para 100 |
| No threatening or anonymous calls, no inappropriate messages | Approved wording only, with the lender and the purpose identified | RBC para 100 |
| No intrusion on family, referees or friends | Automated contact limited to the borrower and co-obligors on record, with nothing about the debt disclosed to anyone else | RBC para 100 |
| No false or misleading representations | Every amount and date read from the live loan record, never generated | RBC para 100 |
| Reminders for non-compliance state the applicable penal charges | The applicable charge read from the account and included | RBC para 30(7) |
| Microfinance: no calls before 9 a.m. or after 6 p.m. | A separate window for microfinance loans, with the microfinance conduct list | RBC para 91 |
| Digital loans: no access to the borrower’s contacts or call logs | No calling list built from data the lending app may not collect | CF para 13(1) |
The misleading-representation ban deserves the most attention for AI. A language model that answers “how much do I owe?” from memory, or rounds a figure, or guesses a foreclosure amount, is making a representation for the NBFC. The only safe source for an amount is the loan record on the day, and the only safe wording for a regulated disclosure is the approved text.
What does RBI’s draft model risk guidance add?
Expectations aimed at AI in particular. The ones that bear on collections:
- AI models that interact with customers should carry extra cyber controls, such as defences against prompt injection and adversarial inputs, limits on session and context persistence, and detection of unusual usage (paragraph 59(i))
- customers should be told they are interacting with an AI or ML system, and its limitations, and should be able to switch to a person on request (paragraph 59(ii) and (iii))
- models that interact with customers or generate content should go through structured challenge, including red-teaming or equivalent testing (paragraph 55)
- risk tiering for an AI model should consider how far decisions rely on it and how much autonomy it has (paragraph 52)
- human oversight should include override, suspension or deactivation, including a kill switch, and periodic human review of model outputs, with attention to automation bias (paragraphs 60 and 61)
- where a third-party provider does not disclose enough about its AI model, the lender should identify the risks and mitigate them, for example by limiting its use (paragraph 51)
The draft reaches further than AI. It counts a pricing spreadsheet or a decision rule as a model when it materially drives decisions, which is the subject of the model risk guidance post. For collections, it means the system that ranks accounts for contact belongs in the model inventory as much as the one that talks to borrowers.
Should the borrower be told they are talking to AI?
The draft guidance says yes, and the final directions are silent. Paragraph 59(ii) says customers of a model with a customer interface should get disclosures and warnings that they are dealing with an AI or ML system, and 59(iii) says they should be able to ask for a person.
Both carry extra weight in collections. A borrower under stress may not realise a caller is automated, or may need a person to explain the options, and any complaint that follows lands with the NBFC’s grievance officer either way.
Which collections tasks can an agent take on?
The routine ones, inside rules the system enforces. The judgement calls stay with people.
| Task | The agent’s part | What stays with people |
|---|---|---|
| Reminders and payment links | Send within the window, with the amount from the live record | The wording, approved once by compliance |
| Questions about dues | Answer from the ledger, and hand over when the record cannot answer | Disputes about the amount |
| Promises to pay | Record the amount and date, follow up when the date passes | Repeated broken promises, which change the treatment |
| Who to contact first | Propose a ranked queue from overdue and early-warning signals | Validating and approving the ranking model |
| Hardship | Recognise it and route the borrower to a person | Any change to terms |
| Settlement | Prepare the account history and the options the policy allows | The decision, under the board-approved settlement policy |
| Legal notice and repossession | Assemble the record | Everything else |
Settlement shows why the split matters. RBI’s stressed-asset directions require a board-approved policy for compromise settlements and describe settlement as a discretion the NBFC exercises on commercial judgement, not a borrower’s right. The policy must place approval with an individual or committee at least one level above the authority that sanctioned the loan (paragraph 16(5)). An agent that offers a settlement on its own is exercising a discretion the policy gives to named authorities. The bucket-by-bucket strategy post sets out where each treatment sits by days past due.
What does an AI contact add to the contact record?
Every contact, human or automated, needs the evidence in the recovery-agent post’s contact evidence list: the loan, its rule set, the time against the window, the channel and the attempt count. An automated contact adds what shows its figures and wording were right:
- the amounts quoted and the record they came from
- the approved template the wording came from
- whether the borrower was told the contact was automated, and any request for a person
- any promise, dispute or hardship signal, and where it was routed
- the model or workflow version that made the contact, so a later review can reproduce it
How should an NBFC bring AI into collections?
For a head of collections who wants to put any automated contact in front of a regulator, with the rule it passed, three setups are on offer.
- Buy a voice or messaging bot that runs campaigns from the vendor’s own platform and sends a daily report. It is quick to start. The rules live in the vendor’s scripts, the evidence lives in the vendor’s logs, and the NBFC still answers for every contact.
- Let the agent propose each contact and have the lender’s own system decide whether it goes out, after checking the window, the attempt count and the wording. The system logs each contact on the loan and routes hardship, disputes and settlements to people. It takes more setup. Each rule is enforced by the system rather than remembered by the model, and each contact can be shown later.
- Keep collections fully human. It keeps AI out of borrower conversations, though any scoring or dialler rules still count as models. The team’s size caps how many accounts get timely contact, and the same conduct rules and record-keeping gaps apply to people.
The second path gives the NBFC its own evidence for every contact, but only after each rule set, template and escalation route is configured and tested, and compliance owns the templates from then on.
In Lokta’s AI Loan Servicing the agent proposes and the deterministic core decides, applying the lender’s workflow rules, confidence thresholds and approval requirements before anything reaches the loan record. The lender configures, workflow by workflow, which questions the agent answers alone and which go to a person or are declined. The same team built Apache Fineract.
Frequently asked questions
Can AI make loan recovery calls in India?
RBI's directions do not forbid it, and they do not exempt it. An automated contact made for an NBFC falls under the same conduct rules as a human one: for loans other than microfinance, no recovery calls before 8 a.m. or after 7 p.m., no persistent calling, no threats, no false or misleading statements and no intrusion on the privacy of family, referees or friends. RBI's June 2026 draft model risk guidance adds that AI facing customers should say it is AI and offer a human on request.
Do borrowers have to be told they are talking to an AI?
RBI's final directions for NBFCs do not say so. Its draft Guidance on Regulatory Principles for Model Risk Management, released on 24 June 2026, says models that interact with customers should disclose that the user is dealing with an AI or ML system, explain its limitations, and let the customer switch to human assistance on request. The draft uses should rather than shall and may change before it is final.
Is an NBFC responsible for mistakes made by an AI collections vendor?
Yes. Outsourcing leaves the NBFC's obligations to customers and RBI intact, and paragraph 17 of the outsourcing directions names recovery agents among the providers it answers for. The draft model risk guidance adds that where a third party will not disclose enough about an AI model, the lender should identify the resulting risks and mitigate them, for example by limiting how the model is used.
What should an AI collections agent never decide on its own?
Anything that changes what the borrower owes or the state of the loan, and anything that needs judgement about the borrower's situation. Compromise settlements fall under a board-approved policy and are a discretion the NBFC exercises, not a borrower's right, so an agent can prepare one, but approval sits with an authority at least one level above whoever sanctioned the loan. Hardship requests, disputes, legal notices and repossession go to named people at the lender.
Sources:
- RBI, Reserve Bank of India (Non-Banking Financial Companies - Responsible Business Conduct) Directions, 2025, updated as on 1 July 2026: paragraph 30(7) (penal charges in reminders), paragraph 91 (microfinance recovery methods) and paragraph 100 (recovery conduct).
- RBI, Reserve Bank of India (Non-Banking Financial Companies - Managing Risks in Outsourcing) Directions, 2025: paragraphs 9 and 17 (responsibility for service providers, including recovery agents).
- RBI, Reserve Bank of India (Non-Banking Financial Companies - Credit Facilities) Directions, 2025, updated as on 15 July 2026: paragraphs 4(1)(xix), 9(4) and 9(6) (lending service providers and recovery-agent notice) and 13(1) (data collection by digital lending apps).
- RBI, Reserve Bank of India (Non-Banking Financial Companies - Resolution of Stressed Assets) Directions, 2025: paragraphs 16(5) and 87 (compromise settlement policy, approval authority and discretion).
- RBI, draft Guidance on Regulatory Principles for Model Risk Management, with the press release of 24 June 2026: the definition of a model, and paragraphs 51, 52, 55, 59, 60 and 61.
