TL;DR

• RBI’s device-locking, disclosure, and call-recording rules each create a separate compliance record, but no single rule tells you how those records connect into one defensible audit trail
• A complete recovery audit record needs six elements tied together: agent identity, contact channel, timestamp, model decision basis, consent status, and outcome
• iTuring’s Model Governance layer builds this trail automatically, from the moment a model scores an account to the moment an outreach decision is logged
• The traceability question matters more than the recovery-rate question when a regulator asks “show me why you contacted this borrower on this day”
• A live NBFC deployment shows every outreach decision traceable to a model, a timestamp, and a rule, with a 116% recovery rate increase as the secondary outcome, not the headline
• Banks and NBFCs have until January 2027 to inventory their existing recovery records against this standard

Three Separate Rules Do Not Make One Defensible Record

If you have been tracking RBI’s recovery-conduct rules one at a time, you have three separate compliance projects: device locking for recovery apps, agency disclosure on your website, and call recording for outreach. Each has its own deadline and its own paragraph reference.

None of them tells you how to connect these records into a single audit trail a regulator can actually follow.

That gap is the practical problem this post addresses. Not another rule to track, but the question of what a complete NBFC recovery agent audit trail looks like once you have all three pieces, and what your collections software has to do to build it without manual reconciliation.

What a Complete Recovery Audit Record Actually Has to Contain

A defensible record for a single recovery contact needs six linked elements:

1. Agent identity: which recovery agent or automated channel made contact
2. Contact channel: call, SMS, app notification, or in-person visit
3. Timestamp: down to the minute, cross-checked against permitted contact hours
4. Model decision basis: which model version and score triggered this contact, and which rule translated that score into an action
5. Consent status: whether the borrower’s consent covers this channel and this type of outreach
6. Outcome: what happened on contact, logged back into the system

Why the NBFC’s Own Systems Have to Produce This Record

RBI’s Risk Based Internal Audit framework, effective since March 2022, requires NBFCs to demonstrate that internal controls work, not just that they exist on paper. This is not a recovery-specific rule. It is a general audit framework, and we are applying its logic here as a reasonable inference: a control that cannot produce evidence of its own operation does not satisfy an internal audit function built around demonstrable effectiveness.

Applied to recovery, this means the model that decided to contact a borrower, the rule that governed the timing, and the outcome of that contact all need to exist as one connected record. Not because a single named clause says so, but because the audit framework’s underlying logic requires it, and the recovery-specific rules on device locking, disclosure, and call recording each supply a piece of the evidence that logic demands.

A Platform Walkthrough: How Model Governance Builds the Trail

Here is how this works end to end inside iTuring’s platform:

1. A collections model scores an account and assigns a propensity and a recommended action
2. Model Governance logs the model version, the score, and the timestamp of that scoring event, immutably
3. The rule engine translates the score into a specific contact decision, bounded by permitted hours and consent status, and that decision is logged with the rule version that produced it
4. Agentic execution carries out the contact through the appropriate channel and logs the channel, the agent identity, and the exact contact time
5. The outcome of the contact feeds back into the record, closing the loop from model decision to logged result

Every step in this sequence writes to the same maker-checker-approved, immutable log. No step is a manual entry a recovery agent fills in after the fact.

Case Study: Every Outreach Decision Traceable to a Model, a Timestamp, and a Rule

An Indian NBFC using iTuring’s collections platform can now trace every recovery outreach decision back to the specific model version, timestamp, and rule that produced it. When a compliance query comes in about a specific borrower contact, the answer is a lookup, not a reconstruction from call logs, agent notes, and app data pulled from three different systems.

The same deployment saw a 116% increase in collections recovery rate, which is a meaningful result. But the traceability is what makes the recovery rate defensible. A recovery-rate improvement built on outreach decisions the NBFC cannot explain individually is a liability waiting for the wrong complaint to surface it.

Inventorying Records Before the January 2027 Deadline

The device-locking, disclosure, and call-recording rules converge on the same deadline. Before then, the practical step is inventorying what your current systems already log against the six-element record above, and identifying where the gaps sit.

Most gaps show up in one place: the link between a model’s scoring decision and the specific contact action taken on it. Call recording tells you what was said. Disclosure tells you who the agency is. Device locking tells you how the app behaved. None of them tell you why that contact happened on that day, which is the question a model governance layer is built to answer.