What Should Indian NBFCs Know About Vulnerable Borrowers?
For Indian NBFCs, the relevant regulatory discussion begins with borrower protection, recovery-agent conduct, customer confidentiality, and fair collection practices.
The Reserve Bank of India's August 12, 2022 circular on recovery agents states that regulated entities remain responsible for the actions of their outsourced recovery agents.
The circular addresses conduct such as intimidation, harassment, intrusions into the privacy of borrowers' family members, threatening communications, persistent calling, and false or misleading representations.
For loans covered by that circular, recovery calls must not be made before 8:00 a.m. or after 7:00 p.m. Separate rules apply to certain microfinance loans, and firms must determine the applicable requirements for each product.
These expectations are relevant when an NBFC uses AI voice agents for collections.
Although RBI guidance does not prescribe a universal AI-based vulnerable-customer detection score, NBFCs can use conversation monitoring to strengthen oversight of borrower interactions.
Recommended Monitoring Areas for NBFCs
| Monitoring Area | Potential Risk | Suggested Control |
|---|
| Financial hardship disclosures | Agent continues pressing for payment despite communicated inability to pay | Detect the disclosure and evaluate whether the approved hardship workflow was followed |
| Bereavement or major life events | Inappropriate collection pressure during a sensitive situation | Flag the conversation for suitable handling or specialist review |
| Distress or confusion | Borrower misunderstands obligations or cannot engage effectively | Detect repeated confusion and offer clarification or human support |
| Third-party pressure | Sensitive loan information is exposed to an unauthorized person | Check identity verification and potential third-party disclosures |
| Threatening language | Collection behavior becomes intimidating or misleading | Evaluate conversation content against the NBFC's approved code of conduct |
| Repeated contact | Borrower experiences persistent or inappropriate calls | Combine transcript analysis with cross-call contact logs |
| Language barriers | Borrower cannot understand the agent's explanation | Offer supported-language assistance or an appropriate transfer |
| Human assistance requests | AI agent ignores a request for human help | Evaluate escalation recognition and successful handoff |
These are recommended operational controls to help implement appropriate collections oversight, not a list of individually mandated RBI vulnerability KPIs.
The appropriate response should follow the NBFC's approved policies, loan-specific rules, and applicable regulatory requirements.
Source: RBI: Responsibilities of Regulated Entities Employing Recovery Agents
How Do Vulnerable Customer Requirements Differ Across Markets?
Organizations operating AI collections agents internationally need to account for differences in local regulations and consumer-protection frameworks.
The original vulnerability monitoring framework covers eight markets.
| Market | Relevant Framework | Expectations Relevant to Collections |
|---|
| India | RBI recovery agent and applicable NBFC/microfinance directions | Appropriate recovery conduct, protection against harassment, confidentiality, and applicable borrower grievance processes |
| UK | FCA FG21/1, Consumer Duty, CONC 7 | Identify support needs, treat customers fairly, consider individual circumstances, provide forbearance where required, and support appropriate referrals |
| Australia | ACCC/ASIC Debt Collection Guideline, National Credit Code s72, Banking Code | Consider personal circumstances, handle financial hardship, and respond appropriately to family violence or economic abuse |
| Malaysia | Bank Negara Malaysia Fair Treatment of Financial Consumers framework | Consider needs arising from over-indebtedness, age, disability, limited literacy, or language barriers |
| UAE | Central Bank Consumer Protection Regulation and Standards | Identify and support consumers experiencing repayment difficulties and protect vulnerable consumers against exploitation |
| South Africa | National Credit Act, including section 129 | Follow applicable debt-enforcement procedures and provide required information about debt counseling or dispute-resolution options |
| US | FDCPA and Regulation F, where applicable | Avoid harassment, abuse, deception, and prohibited communications; additional protections may apply under other laws |
| Kenya and Nigeria | Applicable digital lending and consumer-protection rules | Avoid harassment, threats, shaming, and prohibited collection practices |
These frameworks are not equivalent. Their legal scope, definitions, and obligations differ.
For example, Australia has specific hardship-notice obligations under the National Credit Code, while the UK's FCA provides broader guidance on identifying and responding to customer vulnerability.
The US Regulation F framework contains prohibitions relevant to distressed consumers but does not establish an equivalent general vulnerability duty.
For a global AI collections deployment, monitoring criteria should therefore be configurable by jurisdiction.
Relevant sources include:
What Vulnerability Signals Can AI Observability Detect on Live Calls?
Potential vulnerability often shows up in what a borrower says, how the conversation unfolds, and whether the person seems able to understand and participate.
An observability tool can analyze conversation content using configurable evaluation checks and, where supported and appropriate, additional signals such as pauses, interruptions, and emotional cues.
The original framework identifies eight important signal categories.
| Signal | What It Can Sound Like | How to Detect It | Appropriate Agent Response |
|---|
| Bereavement | "My husband passed away last month." | Conversation-content evaluation | Acknowledge the loss, avoid immediate payment pressure, offer time or appropriate specialist assistance |
| Illness or mental health | "I've been in hospital." / "I can't cope." | Content-based evaluation, with distress cues as supporting context | Respond sensitively, avoid pressuring the borrower, and offer appropriate assistance |
| Job loss or income shock | "I lost my job." / "My hours were cut." | Detection of financial hardship disclosures | Consider the approved hardship process and appropriate repayment-support options |
| Confusion or low capability | Repeated "Sorry, what?" or difficulty understanding questions | Repeated-question detection, pauses, and conversation evaluation | Slow down, simplify the explanation, and offer human assistance |
| Distress | Crying, raised voice, or extended silence | Relevant audio and conversational cues, with validation | Pause pressure, acknowledge the situation, and offer appropriate support |
| Third-party pressure | Another person prompting answers or controlling the conversation | Speaker changes and relevant statements | Protect confidentiality and offer an appropriate safe contact process |
| Family violence or economic abuse | "He took out the loan in my name." | Disclosure detection | Stop inappropriate collection pressure and use an approved specialist or safe-contact workflow |
| Language barrier | Frequent misunderstandings or a request for another language | Language and comprehension checks | Use an available supported language or offer an appropriate callback or transfer |
These examples are indicators requiring attention, not proof of a medical condition, cognitive impairment, domestic abuse, or permanent vulnerability.
A borrower switching languages does not necessarily have low financial capability. A long silence does not establish distress. A raised voice does not automatically mean a person is at risk.
The system should identify relevant moments for review and assistance without making unsupported assumptions about the person.
What Should an AI Collections Agent Do When It Detects Vulnerability?
Recognizing a vulnerable customer signal is only the beginning.
The more important question is whether the AI agent responds appropriately.
A practical response framework contains four steps.
1. Acknowledge the Disclosure
The agent should acknowledge what the borrower said in clear and respectful language.
For example, if a borrower mentions losing their job, the agent should not immediately ask about the payment.
An appropriate response might be:
"I'm sorry to hear that you've lost your job. I understand that this may affect your ability to make the payment. Would you like me to connect you with someone who can discuss the available support options?"
The wording should remain appropriate to the borrower, the lender's policies, and the situation.
2. Stop Inappropriate Payment Pressure
An agent optimized for promise-to-pay conversion may continue asking for a commitment even when the borrower has disclosed serious financial difficulty.
That is the failure the monitoring system should look for.
A borrower who mentions bereavement should not be pressured to promise immediate repayment on the spot.
The UK's FCA CONC 7.3 includes requirements on forbearance and considering individual circumstances in arrears and default situations.
For Indian NBFCs, the appropriate workflow should follow applicable RBI requirements, the institution's recovery policies, and any product-specific borrower assistance procedures.
3. Offer the Appropriate Support Route
Different markets have different assistance mechanisms.
Examples from the original framework include:
- UK: Free debt advice resources such as MoneyHelper.
- Australia: Financial counseling services such as the National Debt Helpline.
- Malaysia: AKPK, which provides financial counseling and debt management assistance.
- UAE: Applicable credit counseling or financial assistance arrangements.
- South Africa: Appropriate debt counseling or statutory dispute-resolution mechanisms.
- India: The NBFC's designated grievance, hardship assistance, customer support, or specialist collections team, according to its approved policies.
The agent should explain the available support route rather than merely reciting an unfamiliar organization's name.
It should also avoid promising a restructuring, waiver, moratorium, or revised repayment arrangement unless the lender has authorized that option.
4. Hand Off and Record the Support Need
The agent should transfer the interaction when human review is appropriate or required by policy.
The handoff should preserve enough relevant context to avoid forcing the borrower to repeat a difficult personal disclosure unnecessarily.
For example, a workflow note might state:
"Customer reported recent job loss and requested repayment assistance. Human review required."
This is preferable to generating a speculative diagnosis or unnecessary personal profile.
The FCA's 2025 review of vulnerable customer outcomes identified problems where consumers were transferred among multiple handlers before receiving the support they needed.
An effective handoff should therefore be evaluated by whether the customer received appropriate assistance, not merely by whether the AI agent initiated a transfer.
Source: FCA: Delivering Good Outcomes for Customers in Vulnerable Circumstances
Why Does Traditional QA Sampling Miss Vulnerable Customers?
Vulnerability disclosures can be brief, context-dependent, and distributed across thousands of conversations.
Consider an NBFC or collections operation handling 50,000 AI voice agent calls per month.
Assume 3% contain a relevant vulnerability disclosure.
That represents 1,500 calls.
Now assume the quality assurance team reviews a random sample of 2% of calls.
| Measurement | Illustrative Value |
|---|
| Total monthly calls | 50,000 |
| Calls containing relevant disclosures | 1,500 |
| Manual QA sampling rate | 2% |
| Calls reviewed manually | 1,000 |
| Expected disclosure calls in the sample | 30 |
| Disclosure calls outside the sample | Approximately 1,470 |
The 30 disclosure calls in the sample may still be reviewed against a general scorecard.
A bereavement disclosure might last ten seconds in a six-minute conversation. If the reviewer focuses on agent identification, standard disclosures, and repayment read-back, that moment may receive insufficient attention.
Automated observability expands monitoring coverage by evaluating far more conversations for specific signals.
It can flag calls containing relevant disclosures and check whether the agent acknowledged them, changed its behavior, and completed the required workflow.
However, evaluating every call does not mean every event will be detected correctly. Detection coverage, false positives, false negatives, language support, and evaluation accuracy still need monitoring.
The FCA's 2025 vulnerability review described good practice involving AI analysis of call recordings to identify potential vulnerability mentions, followed by checks on whether appropriate support had been provided.
The important pattern is:
Broad automated monitoring, targeted evaluation, and human action where necessary.
What Happens When an AI Collections Agent Misses a Vulnerability Disclosure?
Missing a relevant disclosure can have consequences beyond a single poor-quality conversation.
A borrower may keep receiving inappropriate collection contact, misunderstand their options, or miss available hardship assistance.
For a financial institution, the result can include complaints, operational failures, reputational damage, and regulatory exposure where applicable obligations have not been met.
Australia: A$15.5 Million Hardship Enforcement Example
In August 2025, the Australian Federal Court ordered National Australia Bank (NAB) and its subsidiary AFSH Nominees to pay A$15.5 million in penalties for failures involving responses to customers experiencing financial hardship.
ASIC said the institutions failed to respond to 345 hardship notices within the legally required timeframe.
Under section 72 of Australia's National Credit Code, a consumer may communicate that they are or will be unable to meet their credit obligations.
The lender must then handle the hardship notice under the applicable statutory process.
This case did not concern AI voice agents or automated vulnerability detection.
Its relevance to AI collections is operational: when a borrower communicates repayment difficulty, the organization needs a reliable way to recognize the information and route it into the appropriate process.
If an AI agent hears a statement such as "I cannot pay because I lost my job" but continues its standard payment script, the lender risks missing an important support request.
Source: ASIC: NAB and AFSH Penalised A$15.5 Million for Failing Customers Facing Financial Hardship
What About Other Markets?
In the UK, mishandling a vulnerable customer's circumstances may result in complaints, Financial Ombudsman Service disputes, or concerns under applicable FCA requirements.
In Australia, hardship handling and family violence considerations create specific operational responsibilities.
In the UAE, consumer-protection requirements and applicable AI governance expectations make customer fairness and oversight relevant.
For Indian NBFCs, consider missed distress or hardship signals alongside recovery conduct, complaints, customer confidentiality, and the lender's applicable assistance policies.
The precise legal consequences depend on the jurisdiction, facts, and obligations involved.
Which Vulnerability KPIs Should NBFCs Monitor?
Identifying vulnerability signals helps, but monitoring must also assess whether the agent handled them appropriately.
A practical dashboard should therefore distinguish signal detection, response quality, escalation, and downstream customer outcomes.
| KPI | Definition | Measurement Approach |
|---|
| Vulnerability signal rate | Calls containing at least one detected relevant support-need signal divided by evaluated calls | Conversation-level detection |
| Acknowledgment rate | Flagged calls where the agent appropriately acknowledged the disclosure | Response evaluation |
| Inappropriate pressure rate | Flagged calls where the agent continued inappropriate repayment pressure | Policy-based conversation evaluation |
| Successful escalation rate | Required human escalations completed successfully | Conversation and telephony records |
| Hardship referral rate | Eligible hardship disclosures routed to the approved support process | Conversation analysis and workflow records |
| Missed-disclosure rate | Relevant disclosures not recognized or appropriately handled by the agent | Human review of flagged and sampled unflagged calls |
| Repeat-disclosure rate | Customers required to repeat the same sensitive information unnecessarily | Cross-call analysis where permitted |
| Complaint rate | Complaints associated with monitored collections interactions | Conversation and complaint-system data |
Vulnerability Acknowledgment Rate
Acknowledgment rate measures whether the agent responds appropriately when a potential support need is disclosed.
Formula:
Vulnerability Acknowledgment Rate = (Appropriately Acknowledged Disclosures / Evaluated Relevant Disclosures) × 100
A high detection rate with a low acknowledgment rate indicates that identifying vulnerability is not translating into appropriate agent behavior.
Hardship Referral Rate
Hardship referral rate measures whether calls requiring assistance are routed to the approved support process.
Formula:
Hardship Referral Rate = (Appropriate Hardship Referrals / Calls Requiring Hardship Referral) × 100
Not every disclosure requires a transfer, so the denominator should reflect the institution's defined eligibility and escalation policies.
Missed-Disclosure Rate
Missed-disclosure rate helps evaluate the performance of the detection and agent-response workflow.
Human review is especially important here.
If monitoring examines only calls already flagged as potentially vulnerable, it may overlook calls where the detector itself failed.
The QA process should therefore include representative samples of both flagged and unflagged conversations.
