If you are building outbound calling for Indian lending, the interesting
constraints are not technical. They are regulatory, they are changing right
now, and most of them have to be enforced in the architecture rather than in a
prompt.
The window
Recovery contact in India is restricted to 8:00 AM - 7:00 PM. Not just
calls — SMS, WhatsApp and physical visits too. It applies to NBFCs, fintech
lenders, and any third-party agency acting for them.
Eleven hours sounds generous until you subtract hours when nobody answers. A
salaried borrower is commuting, in a standup, or on a shop floor for most of
it. Every lender is aiming at the same narrow slice.
The architectural consequence: a collections system is not throughput-limited
by headcount. It is limited by a legally fixed, partially unusable window that
no amount of hiring widens.
What is changing
RBI issued draft Responsible Business Conduct directions in May 2026, then
amendments in August 2026 consolidating recovery conduct into a single
framework across banks, NBFCs and housing finance companies. Reporting puts
commencement at 1 January 2027.
Direction of travel matters more than any single clause. Accountability for
agent conduct moves up to the regulated entity: due diligence before engaging
an agency, verification of individual agents at onboarding and periodically
after, documented code of conduct, borrower disclosure before first contact,
and monitoring that produces evidence rather than assurances.
RBI fined Bajaj Finance ₹2.5 crore in connection with recovery agent conduct.
Outsourced behaviour lands back on the lender.
The compliance question you will be asked is not whether your policy prohibits
harassment. It is whether you can demonstrate, call by call, that it did not
occur.
The certification angle nobody budgets for
The draft framework contemplates mandatory IIBF certification for recovery
agents. Put that next to attrition on a collections floor: every seat you fill
must be certified, and every seat that turns over must be certified again
before that person can legally call.
A voice agent is not a person requiring certification. Its conduct is defined
in configuration and identical on call one and call one hundred thousand. The
compliance surface moves from "did this individual behave correctly today" to
"is this script correct" — a question you can answer in advance.
Certification scales with headcount and attrition. Script review scales with
neither.
The refusal set
Most vendor material describes what an agent can do. For collections, the
useful spec is what it must be structurally unable to do:
Refuse to call outside the window. Enforced at the dialer, in the
borrower's local time. A prompt instruction is not a control; a scheduler that
cannot emit the call is.
Refuse to exceed frequency caps. Per borrower, per cycle, counted across
voice + SMS + WhatsApp together — because the borrower experiences them
together and a complaint will describe them together.
Refuse to discuss the debt with a third party. If the person answering is
not the borrower, state purpose generically and end. Disclosing a debt to a
family member is the classic harassment finding.
Agent: नमस्ते, मैं XYZ Finance से बोल रहा हूँ।
क्या मेरी बात राजेश कुमार जी से हो सकती है?
Caller: वो घर पे नहीं हैं, मैं उनकी पत्नी हूँ। क्या बात है?
Agent: कोई बात नहीं। यह एक personal call है,
मैं बाद में कोशिश कर लूँगा। धन्यवाद।
No amount. No due date. No mention of a loan. Even to a spouse.
Refuse to escalate tone. Pressure tactics are what the conduct rules exist
to eliminate. An agent that cannot be provoked into them beats one
instructed to avoid them.
Hand off rather than improvise. Dispute, hardship, bereavement — anything
the script does not cover routes to a human. An agent improvising through a
hardship disclosure is the worst available outcome.
DPDP: consent is a state, not a checkbox
India's Digital Personal Data Protection Rules were notified November 2025,
with substantive obligations phasing in through 2027. For collections:
- Voice recordings are personal data
- Consent must be purpose-specific, not blanket
- Consent logs must be timestamped
- Consent is withdrawable at any time
- Penalties reach ₹250 crore for significant data fiduciaries
"Purpose-specific" breaks legacy practice. Consent captured at origination for
servicing communication is not self-evidently consent to record a recovery
call for quality assurance. Different stated purposes.
The architectural bit: withdrawal has to propagate to the dialer before the
next attempt, not at the next nightly sync. If a borrower withdraws at 11:00
AM and your system calls at 3:00 PM because the suppression list refreshes
overnight, the architecture produced the violation.
The honest framing
Voice AI does not remove regulatory exposure. It moves it — from the
unpredictable behaviour of a rotating certified workforce to the reviewable
content of a script and the enforced behaviour of a dialer.
That is a smaller surface, and critically, one you can audit before a
complaint rather than after.
