What Do RBI Guidelines Say About Loan Recovery Calls?
RBI's recovery-agent guidance is especially relevant when NBFCs automate collections.
The August 2022 circular states that regulated entities should not engage in intimidation, harassment, inappropriate messages, threatening or anonymous calls, persistent calling, privacy intrusion, or false and misleading representations.
For covered overdue-loan recovery calls, the circular restricts calls before 8:00 a.m. and after 7:00 p.m.
The circular excludes microfinance loans covered under the separately applicable microfinance regulatory framework.
RBI's consolidated NBFC Responsible Business Conduct Directions, issued in 2025 and subsequently updated, also address collections conduct, confidentiality, and product-specific requirements.
Certain microfinance provisions contain different restrictions, including a 9:00 a.m. to 6:00 p.m. calling window.
An NBFC must therefore configure its collections controls based on the applicable loan category and current regulatory framework, rather than apply a single generic calling rule across every product.
1. Borrower Confidentiality
An AI agent may reach someone other than the intended borrower.
For example, the agent calls a registered number and a family member answers.
If the agent reveals overdue amounts or sensitive loan information without appropriate authorization, the conversation can create privacy and borrower-confidentiality concerns.
Monitoring should check whether the agent verified the borrower's identity before disclosing sensitive information.
2. Harassment and Threatening Language
A collections agent must not use abusive or intimidating language.
For AI agents, risks may emerge when a prompt is optimized too aggressively for repayment commitments.
For example, the agent might repeatedly insist on immediate payment after the borrower states they cannot afford it.
Another failure would be an unsupported threat of legal action.
Evaluate these situations against the institution's approved recovery policies and relevant rules.
3. Calling-Hour Restrictions
AI dialers can initiate large numbers of calls automatically.
Incorrect scheduling logic, borrower time-zone handling, or campaign configuration can therefore create repeated calling-hour violations.
Monitoring should include call timestamps and campaign records.
A transcript alone cannot establish whether a call was placed during a permitted window.
4. False or Misleading Representations
An AI agent may generate a repayment amount that does not match the loan management system.
It might incorrectly describe the legal consequences of non-payment or suggest a settlement arrangement that the lender has not authorized.
Treat these errors as potential conduct risks, not ordinary conversational imperfections.
5. Financial Hardship and Borrower Assistance
A borrower may disclose unemployment, illness, bereavement, or inability to meet repayment obligations.
The agent should respond according to the applicable borrower assistance and escalation procedures.
For microfinance loans, RBI's relevant NBFC framework includes specific provisions on identifying borrowers experiencing repayment difficulties and providing information about available recourse.
For other loan products, assess the exact regulatory and contractual obligations separately.
Primary sources: RBI's recovery-agent circular of August 12, 2022, and the RBI Non-Banking Financial Companies Responsible Business Conduct Directions, 2025, as updated.
Why Are Repeated AI Collections Failures Particularly Risky?
A human collections agent may make an isolated mistake.
An AI agent can also make an isolated mistake, but an incorrectly configured prompt, tool, or workflow may reproduce the same failure across many conversations.
Consider an NBFC handling 100,000 AI collections calls per month.
Assume a particular failure affects 0.5% of calls.
That represents 500 potentially affected conversations in one month.
If the failure continues for three months without detection, approximately 1,500 conversations could be affected under the same assumptions.
This does not mean every affected call automatically constitutes a legal violation.
However, it shows how a systematic configuration problem can create substantial exposure before a lender recognizes it.
The important distinction is between a single error and a recurring control failure.
For example, a prompt that regularly skips borrower verification can produce repeated unauthorized disclosure risks.
A missing account-data validation rule can produce incorrect repayment amounts across many calls.
A dialer configuration error can affect an entire campaign.
Production monitoring should therefore measure not only individual failures but also their frequency, severity, and relationship to changes in the AI system.
What Can a Failed AI Collections Call Cost in the United States?
The United States has several legal frameworks relevant to automated debt collection.
These include the Telephone Consumer Protection Act (TCPA), the Fair Debt Collection Practices Act (FDCPA), Regulation F, and applicable state laws.
Their scope differs, so legal exposure depends on the caller, debt, technology, consent, and specific conduct.
TCPA: AI-Generated Voice Calls
In February 2024, the Federal Communications Commission issued Declaratory Ruling FCC 24-17.
It clarified that calls using AI-generated human voices fall within the TCPA's provisions covering artificial or prerecorded voice calls.
Applicable consent and disclosure requirements therefore matter for covered AI-generated voice calls.
Under the TCPA, private statutory damages can be $500 for an actionable violation, with potential trebling to $1,500 for willful or knowing violations.
However, not every AI-powered collection call automatically violates the TCPA.
Whether a claim exists depends on the specific call, applicable restrictions, consent, exemptions, and other legal requirements.
Why Consent Revocation Matters
A borrower may tell the agent:
"Stop calling me."
Where that statement constitutes a valid revocation of consent under the applicable TCPA rules, the organization must handle it appropriately.
The relevant FCC rules address reasonable revocation methods and a time period for honoring valid requests.
If the AI agent fails to recognize or record the request, later calls may create additional exposure.
This is why observability must connect individual conversation events with subsequent contact records.
FDCPA and Regulation F
For covered debt collectors, the FDCPA and Regulation F restrict conduct such as prohibited third-party communications, certain misleading representations, harassment, and failures to provide required disclosures.
Under 15 U.S.C. §1692k, an individual FDCPA action may involve actual damages and additional statutory damages of up to $1,000, subject to the applicable provisions.
For class actions, additional statutory damages are subject to separate statutory limits.
Relevant AI collections failures may include:
- Discussing debt details with unauthorized third parties.
- Misrepresenting the amount or legal status of a debt.
- Making unsupported threats of legal action.
- Failing to provide required debt-collector disclosures.
State Laws
State and local laws may impose additional requirements.
Examples in the original regulatory comparison include California's Rosenthal Fair Debt Collection Practices Act, New York City's debt collection rules, and Utah's AI-related disclosure provisions.
Because these requirements differ and may change, organizations should validate the current provisions and their applicability before deploying AI collections agents.
Historical TCPA Enforcement and Settlement Examples
The original article references Capital One's approximately $75 million TCPA class-action settlement in 2014 involving prerecorded and automated calls.
It also cites a multimillion-dollar settlement involving prerecorded debt collection calls to wrong numbers.
These examples predate current generative AI voice systems.
They illustrate potential exposure from unlawful automated calling, not proven violations involving modern AI collections agents.
What Does the FCA Do When Collections Calls Go Wrong in the UK?
The UK's regulatory approach differs from the United States.
The Financial Conduct Authority regulates relevant consumer credit and arrears-handling activities, while customers may also seek redress through applicable complaint and ombudsman processes.
FCA CONC 7 contains requirements relevant to customers in arrears or default.
These include appropriate forbearance, consideration of individual circumstances, limits on unreasonable pressure, and rules concerning communications with customers and third parties.
The FCA's Consumer Duty also requires in-scope firms to deliver appropriate customer outcomes, including support for customers with characteristics of vulnerability.
Lloyds Bank: £64 Million FCA Fine
In June 2020, the FCA fined Lloyds Bank, Bank of Scotland, and The Mortgage Business £64,046,800 for failures in mortgage arrears handling.
The FCA identified weaknesses in how the banks assessed customer circumstances and affordability.
The institutions estimated that around 526,000 customers would receive approximately £300 million in redress.
For AI collections, the lesson is operational.
A system that fails to gather or use relevant information about a borrower's circumstances can cause widespread customer harm.
This case did not involve AI voice agents.
Volkswagen Financial Services: £5.4 Million Fine
In October 2024, the FCA fined Volkswagen Financial Services UK about £5.4 million for failures in how it treated customers experiencing financial difficulty.
The institution agreed to pay more than £21.5 million in redress to around 110,000 potentially affected customers.
The FCA identified problems involving inadequate understanding of customer circumstances and insufficiently tailored assistance.
Poorly templated, automated communications compounded the issues.
This case is particularly relevant to lenders automating collections because it demonstrates the risks of rigid processes that fail to respond appropriately to individual circumstances.
However, it should not be described as an enforcement case against generative AI.
The Broader UK Lesson
A collections system should not be assessed only by how consistently it follows a script.
It must also support the institution's obligations toward customers experiencing financial difficulties.
For AI agents, monitoring should examine whether disclosures are recognized, appropriate assistance is offered, and human escalation works when needed.
What Penalties Have ASIC and the ACCC Imposed in Australia?
Australia provides another important set of examples involving hardship handling and collection conduct.
NAB and AFSH: A$15.5 Million Penalty
In August 2025, the Federal Court ordered National Australia Bank and AFSH Nominees to pay A$15.5 million for failing to respond appropriately to customers' financial hardship notices within statutory timeframes.
ASIC reported that it did not respond to 345 hardship applications as required.
Under section 72 of the National Credit Code, a borrower may notify the lender that they are or will be unable to meet their repayment obligations.
That notification can trigger specific statutory response requirements.
An AI collections agent that encounters a relevant hardship disclosure should therefore recognize it and route the information appropriately.
The NAB and AFSH enforcement case concerned failures in hardship processing, not AI voice agent behavior.
Harassment and Misleading Collection Conduct
The original article also references ACCC enforcement against ACM Group and Panthera Finance.
ACM Group faced A$750,000 in penalties for misleading, harassing, and coercive collection conduct.
Panthera Finance paid A$500,000 in penalties relating to undue harassment.
These cases show the potential consequences of collection practices involving unreasonable pressure, threats, or intrusive contact.
Australia's ACCC and ASIC debt collection guidelines address issues such as contact frequency, appropriate communication, and borrower circumstances.
For AI collections agents, those concerns translate into monitoring requirements around conversation content and contact history.
What Is the Legal Exposure in the UAE?
The United Arab Emirates has consumer-protection requirements relevant to licensed financial institutions and their collections activities.
The Central Bank of the UAE's Consumer Protection Regulation and associated standards address consumer rights, disclosure, fair treatment, and relevant collection practices.
The original regulatory analysis also identifies changes introduced through Federal Decree-Law No. 6 of 2025, including significant changes to the central bank's enforcement powers.
Published legal commentary discusses an administrative fine ceiling of up to AED 1 billion under the updated central bank framework.
That figure should not be presented as an automatic penalty for one incorrect AI collections call. Enforcement power, conditions, and the severity of the violation determine potential sanctions.
AI-Specific Governance Expectations
In February 2026, the Central Bank of the UAE issued guidance on consumer protection and the responsible adoption of AI and machine learning by licensed financial institutions.
The guidance covers principles such as transparency, fairness, governance, and human oversight.
For organizations deploying AI collection agents in the UAE, relevant controls may include:
- Accurate borrower information.
- Appropriate handling of sensitive disclosures.
- Clear escalation arrangements.
- Monitoring for unfair or misleading behavior.
- Appropriate governance of AI-generated communications.
The exact obligations depend on the institution and activity involved.
What Are the Collections Compliance Risks in Malaysia?
Bank Negara Malaysia's financial consumer protection framework addresses fair treatment and responsible conduct.
The original analysis identifies restrictions on intimidation, harassment, and deception in collections activity.
It also references requirements that hold financial institutions responsible for relevant collection agents.
Malaysia's Consumer Credit Act 2025 introduces an additional framework affecting certain consumer credit and debt collection activities.
The original research identifies possible sanctions under specified provisions, including fines of up to RM5 million or imprisonment.
These are potential statutory consequences, not a standard fine for every improper collection call.
For AI collections systems, relevant controls include avoiding misleading statements, safeguarding borrower information, and applying appropriate communication and escalation procedures.
Lenders and service providers should verify which provisions are in force and applicable to their activities.
What Do Regulators in South Africa, Kenya, and Nigeria Require?
South Africa
South Africa's National Credit Act and debt collection framework address prohibited practices, consumer protection, and relevant collection conduct.
Under section 151 of the National Credit Act, the National Consumer Tribunal may impose administrative fines subject to statutory conditions.
The original analysis identifies a maximum fine of the greater of 10% of annual turnover or R1 million, where the relevant statutory provision applies.
The Debt Collectors Code of Conduct also regulates collection behavior, including contact restrictions and inappropriate communications.
For AI agents, relevant risk scenarios include improper calling hours, disclosure to relatives or neighbors, and threatening representations.
Kenya
Kenya's digital credit provider framework and data protection laws restrict abusive and inappropriate debt collection practices.
The original analysis identifies enforcement action against Mulla Pride, operator of KeCredit and Faircash, and a KES 2.9 million data protection penalty for misusing third-party contact information.
Kenya's digital credit provider regulations also restrict relevant practices involving borrowers' phone contacts and references.
These requirements are relevant when evaluating whether an AI collections agent reveals sensitive information or initiates inappropriate communications with third parties.
Nigeria
Nigeria's Federal Competition and Consumer Protection Commission introduced the Digital, Electronic, Online or Non-Traditional Consumer Lending Regulations, 2025.
The regulations address digital lending conduct, consumer protection, and applicable registration and compliance requirements.
For corporate undertakings, Regulation 27 provides for administrative penalties of up to ₦100 million or 1% of the previous year's turnover, whichever is greater, where the relevant conditions apply.
The framework may also impose additional sanctions.
In July 2026, the FCCPC announced that it had resumed implementation after a Federal High Court decision upheld the regulations.
Relevant AI collections risks include threatening borrowers, unauthorized contact with third parties, privacy violations, and inappropriate collection behavior.
AI Collections Legal Exposure by Market: Comparison Table
The following table summarizes the key regulatory frameworks and enforcement examples discussed above.
It should not be read as a list of fixed fines automatically imposed for individual AI calls.
| Market | Main Framework | Example AI Collections Failure | Potential Exposure or Historical Example |
|---|
| India | RBI NBFC conduct and recovery-agent requirements | Harassment, misleading amount, unauthorized disclosure, inappropriate calling hours | Regulatory action, complaints, potential redress, and other applicable consequences |
| US | TCPA, FDCPA, Regulation F | Unlawful AI voice calls, ignored revocation, third-party disclosure | TCPA statutory damages may be $500 to $1,500 per actionable violation; FDCPA has separate remedies |
| UK | FCA CONC 7, Consumer Duty | Inadequate hardship handling, unreasonable pressure, missed vulnerability | Lloyds £64m fine; VWFS £5.4m fine and over £21.5m redress |
| Australia | National Credit Code, ACCC/ASIC guidance | Ignored hardship notice, harassment, misleading collection behavior | NAB/AFSH A$15.5m; other debt collector penalties |
| UAE | CBUAE consumer protection and applicable financial legislation | Misleading disclosures, inappropriate contact, inadequate AI oversight | Significant administrative sanctions may apply depending on the violation |
| Malaysia | BNM requirements, Consumer Credit Act | Harassment, threats, misleading representations | Statutory penalties under applicable provisions |
| South Africa | National Credit Act, debt collection rules | Prohibited contact or improper collection pressure | Administrative sanctions and registration consequences where applicable |
| Kenya | CBK digital credit rules, Data Protection Act | Misuse of contacts, harassment, third-party disclosures | Data protection and regulatory penalties; KES 2.9m historical example |
| Nigeria | FCCPC DEON Regulations 2025 | Shaming, harassment, privacy violations | Up to ₦100m or 1% of turnover, whichever is greater, for applicable corporate penalties |
Each market has different rules governing who is covered, which communications are regulated, and what remedies may be available.
An international lender should maintain jurisdiction-specific rules rather than reuse one global compliance scorecard without adaptation.
How Can NBFCs Reduce the Legal Exposure of AI Collections Agents?
Compliance controls should operate before deployment and throughout the agent's production lifecycle.
Testing alone isn't enough, and monitoring alone cannot prevent every problem.
A practical approach combines both.
1. Test High-Risk Collection Scenarios Before Launch
Before deploying an AI collections agent, evaluate scenarios such as:
- A relative answering a borrower's phone.
- A borrower disputing the outstanding amount.
- A borrower reporting job loss or financial hardship.
- A customer requesting that further calls stop.
- A borrower asking whether the caller is an AI agent.
- The account system returning a missing repayment amount.
- The agent being asked about legal consequences it is not authorized to explain.
- A borrower requesting human assistance.
Each test should have clear acceptance criteria.
2. Monitor Production Conversations
Evaluate eligible real calls against the institution's configured quality and conduct scorecard.
Examples include identity verification, accurate repayment information, inappropriate pressure, escalation handling, and required disclosures.
3. Monitor Contact History
Not every risk appears within a single call.
Operational records across multiple calls are needed to track calling hours, contact frequency, revocation requests, and repeat communication patterns.
The system should combine conversation evidence with relevant dialer and CRM data.
4. Detect and Escalate Critical Failures
Serious potential failures should promptly reach an accountable reviewer.
Examples include suspected unauthorized disclosure, unsupported legal threats, and significant mismatches in repayment amounts.
Automated classifications should support review, not serve as final legal determinations.
5. Preserve Appropriate Evidence
When a potential incident occurs, the institution should be able to investigate the relevant conversation.
Useful evidence may include:
- Call identifiers and timestamps.
- Authorized recordings or transcripts.
- Relevant conversation turns.
- Account and tool responses.
- Prompt and agent versions.
- Evaluation results.
- Escalation and investigation records.
Evidence handling must remain consistent with applicable privacy, retention, and security requirements.
6. Turn Production Failures Into Regression Tests
Once you understand a failure, create a suitable test scenario to prevent it from recurring.
For example, if an agent disclosed a loan balance to an unverified family member, evaluate the corrected workflow before the next release.
This connects production observability with pre-launch evaluation and continuous improvement.
