The issuer needs an accountable recovery trail
For commercial banks within the scope of RBI’s Credit Cards and Debit Cards: Issuance and Conduct Directions, 2025, paragraphs 37–42 govern card-recovery conduct, agent identification, confidentiality and outsourcing controls. The text used here is updated to 1 October 2026 and checked on 27 October 2026. Its commercial-bank definition excludes Small Finance Banks, Payment Banks and Local Area Banks; other issuer populations require their own applicable directions. RBI Commercial Banks Credit Cards and Debit Cards Directions, 2025, updated 1 October 2026: paragraphs 3 and 37–42.
Separate two disclosures
Paragraph 38 requires recovery-agent communications to contain the concerned issuer senior officer’s name, email, telephone and address. It also requires the issuer to give the cardholder the recovery agent’s name and contact details immediately on assignment. Those are different tests: an agent’s telephone number in a message does not supply the issuer escalation contact, and a generic senior-officer footer does not prove the cardholder was informed of an assignment.
Make the assignment event auditable
A useful control record links the card account, agency and assigned agent, assignment or reassignment event, notice content, send time and delivery evidence. Reconcile the source assignments to sent notices rather than sampling only successfully sent messages. This record design is a professional recommendation, not an RBI-prescribed template or an invented grace period for immediate notification.
Limit the information released
Paragraph 41 limits disclosed customer information to what enables the agent to perform the duty and bars release of personal information not required for recovery. Use a documented field-level purpose review and access controls rather than giving every agency a full customer profile. Count exposed records separately from the number of unnecessary fields. A confidentiality clause alone does not demonstrate that the exported dataset is appropriately limited.
Conduct rules apply even to an undisputed balance
Paragraph 39 prohibits intimidation and harassment, including public humiliation, intrusion on family or friends’ privacy, threatening or anonymous calls and false representations. Do not treat a verified debt as permission for prohibited conduct. Paragraphs 37 and 40 also require the applicable fair-practices and recovery-agent instructions to be followed. This guide isolates the card-specific controls and does not provide a complete calling-hours, repossession or future regulatory-transition manual.
Reconcile money independently of agent performance
An agency status of settled should be supported by payment allocation and the issuer ledger. Investigate duplicate collections, refunds and unallocated receipts through the proper process. Escalate conduct complaints through the issuer’s current complaint framework; this article invents no fixed compensation tariff or automatic cancellation of the debt. Review changes effective after the date of this guide before reusing it.
Applicable primary references
Six worked illustrations
All facts and amounts below are fictional. Assumptions describe the model, not additional statutory rules.
Illustrative example 1: Assignment notices
A day has 200 new agent assignments. Matched evidence shows 185 cardholder notices; 15 are unmatched, or 7.5%. Investigate all 15 and compare the timing of the 185 sent notices with the assignment event. A matched notice is not automatically timely.
Illustrative example 2: Complete senior-officer contacts
Of 50 sampled agent communications, 42 include all four required senior-officer contact elements and eight omit the address. Complete samples are 84%; the eight exceptions require correction even if they include the agent’s own telephone number.
Illustrative example 3: Overlapping communication defects
Among 30 messages, ten omit the officer email and seven omit the telephone; three omit both. Fourteen unique messages have at least one defect: 10 + 7 − 3. Count unique affected messages separately from the 17 missing-field occurrences.
Illustrative example 4: Data minimisation
An agency export contains 18 fields per account. A documented purpose review identifies 12 as necessary and six as unnecessary. Six ÷ 18 = 33.33% of fields require removal from this model. That percentage describes columns, not the number of customers exposed or a statutory permissible-data quota.
Illustrative example 5: Duplicate collection reconciliation
The verified payable balance is ₹8,000. Two channels collect ₹5,000 and ₹4,000 before synchronisation. Total collections are ₹9,000, creating a ₹1,000 excess against the assumed balance. Investigate allocation and the appropriate refund process; an agent’s collection target does not justify retaining an excess.
Illustrative example 6: Late assignment notification
An assignment occurs at 10:00 and the notice is sent at 12:45 on the same day. Elapsed time is 165 minutes. This is an exception for review against the requirement for immediate notice, not evidence of an RBI-approved 165-minute grace period.
Ten-step verification table
| Step | Action | Evidence |
|---|---|---|
| 1 | Confirm issuer population and version | Applicable RBI directions and check date |
| 2 | Inventory recovery assignments | Issuer source event register |
| 3 | Identify agency and assigned agent | Approved assignment record |
| 4 | Match cardholder assignment notice | Name, contacts and delivery evidence |
| 5 | Test immediacy | Assignment and notice timestamps |
| 6 | Test agent communication contents | All senior-officer contact elements |
| 7 | Restrict exported customer information | Field-purpose matrix and access logs |
| 8 | Review conduct allegations | Messages, call evidence and investigation |
| 9 | Reconcile collected money | Issuer ledger and collection allocation |
| 10 | Correct and retest exceptions | Owner, remediation and verified closure |
Sixteen practitioner FAQs
1. Do these directions apply to every type of card issuer?
This article uses the specified commercial-bank directions; determine the correct framework for other institutions.
2. Who supplies agent details to the cardholder?
The issuer must provide the name and contacts immediately on assignment under paragraph 38.
3. What changes when an agent is reassigned?
Capture the new assignment and test the related identification and notice controls.
4. Are the agent and senior-officer disclosures interchangeable?
No. They identify different people and serve different accountability functions.
5. Which senior-officer details belong in agent communications?
Name, email-id, telephone number and address of the concerned issuer senior officer.
6. Is an agency’s customer-care email necessarily sufficient?
Check whether the disclosure actually identifies the required issuer senior officer and complete contacts.
7. Does immediate notice mean a fixed number of hours?
The cited card paragraph supplies no such grace period; do not invent one.
8. Can the agency receive the entire customer profile?
Review each field against recovery necessity and restrict unnecessary personal information.
9. Does signing an NDA settle data minimisation?
No. Inspect the actual export, purpose and access permissions.
10. May a genuine debt be collected through threats?
No. An undisputed balance does not remove the conduct restrictions.
11. Can relatives be publicly pressured to secure payment?
The prohibition covers harassment and privacy intrusion involving family, referees and friends.
12. Does this article state every recovery rule?
No. Paragraph 40 requires other current recovery-agent instructions to be followed too.
13. Should unmatched notices be excluded from the sample?
No. Start from the assignment population so missing notices remain visible.
14. Does an agency’s settled flag establish ledger closure?
Match actual receipts, allocation and the issuer’s balance before accepting closure.
15. Do these controls create automatic debt waiver or fixed compensation?
No such remedy is calculated here. Evaluate any actual complaint and legal entitlement separately.
16. What should management see in the control report?
Unmatched assignments, timing exceptions, incomplete contacts, unnecessary disclosures, conduct issues and unreconciled collections.
Conclusion
Test recovery-agent assignments and communications for contact disclosures, appropriate information access and prohibited conduct under the current card directions.