The DRA Code in 2026: eight checks before October

Ask a collections head whether their floor is DRA-compliant and the answer is usually instant: yes, our agents are certified.

That’s the wrong proof. Certification is the entry ticket. The DRA Code — the stack of rules that governs how a recovery agent may actually behave on a live call — is something most floors treat as advisory guidance, right up until a borrower complaint turns it into a finding.

That gap is about to close. On 20 May 2026 the RBI put out a revised draft of its Responsible Business Conduct in Recovery of Loans directions, with a proposed effective date of 1 October 2026. For the first time it would pull the recovery-agent rules — certification, disclosure of agents, contact hours, recording, prior borrower intimation — into one uniform, auditable instrument across banks, NBFCs, housing finance companies and co-operatives. The directions are still draft; the comment window closed on 31 May. But the direction of travel is settled.

Which makes the next four months the cheapest time you will ever have to find out where your floor actually stands.

What the violations actually look like

Across our audit network this fortnight, the DRA breaches that recur are rarely the dramatic ones. They are quiet, procedural, and almost always invisible to a 5 percent sample.

The most common is the opening that never identifies the agency. The agent gives a first name, states the outstanding amount, and moves straight to “when can you pay” — without ever saying which agency is calling, or on whose behalf. The Code requires that disclosure. A surprising share of calls skip it.

Next is the third-party call. An agent can’t reach the borrower, so they call a listed reference — a brother, an employer, a neighbour — and discuss the overdue loan with them. Calling a third party to trace the borrower is permitted. Discussing the debt with that third party is not. The line gets crossed casually, inside a single sentence.

Then the off-hours follow-up: a dialer campaign that bleeds past 7 p.m., or an agent’s “just one more” call at 7:40. And the repeat-dialing pattern — the same borrower struck nine times in a day, each call logged as a fresh attempt.

None of these is a raised voice. All of them are DRA findings.

Where the rules actually come from

There is no single document called “the DRA Code.” What the floor calls the DRA Code is a stack.

The foundation is the RBI’s 2008 guidelines on recovery agents engaged by banks, which made the IIBF Debt Recovery Agent certificate mandatory — 100 hours of training for non-graduates, 50 for graduates — and required lenders to put every agent through it. The conduct rules were tightened on 12 August 2022, when the RBI directed regulated entities and their agents not to intimidate or harass borrowers, not to send threatening or anonymous messages, and not to call before 8 a.m. or after 7 p.m. For fintech lenders, the FACE Debt Recovery Guidelines (v1.1, August 2025) go further still, asking members to record and audit every recovery call.

The May 2026 draft gathers these threads into one instrument: mandatory certification, public disclosure of empanelled agents, prior borrower intimation, the 8 a.m.–7 p.m. window, documented call recording, and an explicit ban on coercive practice. Until it is notified — proposed for 1 October 2026 — the 2008 and 2022 rules continue to apply. They already bite: the RBI fined HDFC Bank ₹1 crore in September 2024, citing among other things the contacting of borrowers outside permitted hours.

Eight checks to run on your floor this week

Not a policy review. Eight yes-or-no questions, answerable from this month’s actual call data:

1. Certification. Can you produce a current IIBF DRA certificate for every active agent — not most of them, every one?
2. Calling hours. Is the 8 a.m.–7 p.m. window enforced at the dialer, in the borrower’s local time, rather than left to the agent to remember?
3. Identification. Does every agent name the agency and the lender they call for, in the opening — on every call, not only the monitored ones?
4. Third parties. Are agents trained that a reference may be called to trace the borrower, but that the debt itself is discussed with no one except the borrower?
5. Frequency. Do you cap contact attempts per borrower per day — and can you show, from the logs, that the cap held?
6. Language. Are you screening for coercive and threat language in the language the call actually happened in, including the idiomatic Hindi and Hinglish an English transcript flattens?
7. Recording. If a lender asked for one named borrower’s call from ninety days ago, could you retrieve it, intact, today?
8. Disclosure. Is your list of empanelled agents current and ready to publish — because the October draft will require it?

A “no” on any of these is not a certification problem. It is the gap the October directions are written to find. Better you find it first.