TL;DR
- The obligation: every NBFC and bank must publish an up-to-date list of empanelled recovery agencies on its website.
- The deadline: the list has to be refreshed within seven calendar days of any change, and promptly when an agency’s engagement ends.
- What the list must show: name, type, correspondence address, period of engagement, and purpose, for every agency currently empanelled.
- This is a different obligation from telling a borrower who is calling them. The two get confused often, and confusing them is a compliance gap on its own.
- Honest caveat: the 7-day citation traces to the same secondary-sourced NBFC 2026 amendment paragraph (100K) already used elsewhere in this cluster, not yet primary-confirmed against rbi.org.in.
Most NBFC compliance teams treat their recovery agency list as a static page, published once and forgotten. That assumption is now a liability. The 2026 amendment to RBI’s Responsible Business Conduct Directions turns this list into a live document with a hard deadline attached to every change.
This piece covers exactly what the list has to contain, what counts as a change that starts the seven-day clock, and why this is a separate requirement from a different disclosure obligation that gets confused with it constantly.
What the recovery agency list actually has to contain and where
Every NBFC and bank must publish a current list of its empanelled recovery agencies on its own website, updated within seven calendar days of any change, naming each agency’s type, correspondence address, period of engagement, and purpose. A terminated agency comes off the list promptly, not on the next scheduled update.
The list needs five things for every agency currently empanelled:
- Name. The agency’s full registered name, not a shortened or informal version.
- Type. Whether the agency is an in-house recovery function or an external empanelled agency.
- Correspondence address. A real, reachable address, not a registered-office placeholder that goes unanswered.
- Period of engagement. When the engagement started and, where applicable, when it is set to end.
- Purpose. What the agency is engaged to do, so a borrower or examiner can see the scope of the relationship.
The list has to live on the NBFC’s own website, publicly accessible, not behind a login or buried three clicks deep in a compliance PDF. A borrower, an examiner, or a journalist should be able to find it without asking anyone for help.
Why this is a different obligation from telling a borrower who is calling them
The published website list and the individual borrower notice are two separate obligations, not one requirement described two ways. The list is a transparency measure for anyone who wants to see which agencies an NBFC currently uses. The individual notice is a protection for one specific borrower before one specific visit.
Confusing the two creates a real compliance gap. An NBFC that only maintains the published list, and never notifies a specific borrower before that agency’s first in-person visit, has satisfied one obligation and missed the other. The reverse is also true: notifying borrowers individually does not exempt an NBFC from keeping the public list current.
This distinction matters because a separate, earlier instrument, the digital lending framework, already requires disclosing the specific agent handling a borrower’s account before an automated recovery contact begins. That is a third, related but distinct obligation, and it is worth naming here because our own piece on what the digital lending directions mean for NBFC debt recovery covers that individual-disclosure requirement in depth. Nothing in that requirement replaces the published list. The two obligations come from different instruments, apply at different moments, and both stay in force at the same time.
The 7-day clock: what counts as a “change” that triggers it
Onboarding a new recovery agency, terminating an existing one, or updating an agency’s correspondence address, engagement period, or scope of purpose all count as a change that starts the seven-day clock. The list has to reflect the update within that window, and a termination has to come off the list promptly rather than waiting for the next scheduled review.
Three situations that reset the clock, in practice:
- A new agency goes live. The day the engagement becomes active is the day the seven-day window starts.
- An existing agency’s details change. A new correspondence address or an extended engagement period is a change, even when the agency itself stays the same.
- An agency’s engagement ends. This one moves faster than seven days. The requirement is prompt removal, and an NBFC should treat “prompt” as immediate, not as the outer edge of the window.
Most NBFCs that fail this requirement do not fail it through bad faith. They fail it because the list update sits with a marketing or web team that has no visibility into recovery agency onboarding decisions made by the collections function. Closing that gap means the compliance team, not the web team, owns the trigger for every update.
What happens before an agent’s first in-person visit
Before a recovery agency’s first in-person visit to a borrower, the NBFC must inform that borrower at least one day in advance, identifying the specific agency that will visit. This is the individual notice obligation, distinct from the published website list, and it protects the specific borrower rather than the public at large.
The one-day notice only has to happen once per agency assignment, not before every subsequent visit from the same agency to the same borrower. But if the NBFC reassigns a different agency to the same account, a fresh notice is required before that new agency’s first visit.
Getting this right depends on the same underlying data the published list depends on: an accurate, current record of which agency is assigned to which account, and when. An NBFC that struggles to keep its public list current is very likely also struggling with this individual notice, because both draw from the same underlying agency-assignment record.
An NBFC using iTuring’s platform for collections recovery already tracks agency assignments and outreach timing as part of its governed audit trail, the same underlying record that both the published list and the individual notice depend on. Book a working session to see how a governed collections platform keeps that record current instead of split across teams.
Sources
- Tax Update India, “RBI’s New Loan Recovery Rules From January 1, 2027,” 2026. https://taxupdate.in/finance/843/rbi-loan-recovery-rules-2027-responsible-business-conduct-amendment-directions-6-august-2026-recovery-agents/
- Corporate Professionals, analysis of RBI/2026-27/230 (Third Amendment Directions, 2026), 6 August 2026. https://www.corporateprofessionals.com
