The buck stops with the Regulated Entity — why the NBFC is liable for its agents

When a recovery agent calls and abuses you, threatens you, or messages your contacts, it is common to be told — or to assume — that "the bank has nothing to do with this; it's a separate agency." That belief is exactly what makes harassment work. It leaves you feeling that you are dealing with a faceless, lawless party who answers to no one. The truth is the opposite. In India, the buck stops with the Regulated Entity — the bank or non-banking financial company (NBFC) that actually gave you the loan. That entity is accountable to the Reserve Bank of India for everything done in its name.

This article explains, in plain language, why the lender remains liable for its agents, why this matters so much for you, and how to use that accountability to make the harassment stop. None of this is about avoiding a genuine debt. Repaying what you owe is fair. But the manner of recovery is governed by rules, and those rules bind the lender — not a vague "agency" that supposedly cannot be reached.

What "Regulated Entity" means

A Regulated Entity (RE) is an institution that the RBI licenses and supervises — most commonly a bank or an RBI-registered NBFC. When you take a loan, the money is lent by an RE, even if you applied through a slick app or spoke only to a call centre. The RE sits at the centre of the arrangement, and RBI holds it answerable for how the loan is marketed, disbursed, serviced and recovered.

Around that RE there may be several other players: a recovery agency, a tele-calling team, a Lending Service Provider (LSP), or a digital loan app. These are agents and partners. They work on behalf of the RE. Crucially, under RBI's framework, their conduct is treated as the RE's conduct. The lender cannot outsource the loan's profits to itself while outsourcing the blame for misbehaviour to someone you can never trace.

The rule: the lender owns its agents' conduct

The RBI Fair Practices Code for lenders, together with RBI's specific guidelines on the recovery of loans and engagement of recovery agents, makes the lender responsible for the acts of the agents it engages. The Code requires that recovery be carried out without harassment, without intimidation, and with due regard to the borrower's privacy and dignity. Where a lender uses a recovery agency, RBI directs that the lender ensure the agents are properly trained and that they follow the same standards the lender itself is bound by.

RBI's Digital Lending Directions reinforce this for app-based lending. They make clear that the Regulated Entity remains responsible for the conduct of its Lending Service Providers and Digital Lending Apps, including the way they recover dues. The Directions also require transparency about who the actual lender is — so an app cannot keep you guessing about which RE is behind your loan.

So the principle to remember is simple: whoever is harassing you in connection with your loan, the lender that gave you that loan is accountable for it. "That was a third-party agent" is a description of who made the call. It is not a defence to the lender's responsibility.

Why this matters so much for you

This single principle changes your position completely.

• You always have a real party to complain against. Even if the recovery agent hides behind a spoofed number, a fake name, or a shadowy "agency", the RE behind your loan is identifiable and regulated. Your complaint has a clear addressee.
• You have a free regulator standing behind you. Because the RE answers to RBI, you can escalate to the RBI Ombudsman at no cost if the lender does not act. The agent is not above the law; the agent's principal is supervised by the central bank.
• The lender has a strong incentive to control its agents. A flood of grievances about agent misbehaviour is a regulatory risk for the RE. When you put your complaint in writing and cite the lender's own accountability, you are reminding it of a liability it genuinely wants to avoid.

In short, you are not chasing a ghost. You are dealing with a licensed institution that the regulator can reach.

Identify the Regulated Entity behind your loan

To use this accountability, you first confirm which RE is behind your loan. The lender's name should appear in your loan agreement, the Key Fact Statement (KFS), your sanction letter, and the app's disclosures. If an app obscures this, that itself is a red flag worth recording.

It helps to verify that the entity is genuinely RBI-registered and to make sure the party contacting you is really connected to your loan, because impersonators sometimes pose as recovery agents. You can cross-check a lender's details before you respond using our lender check tool. This protects you twice: it pins down who is accountable, and it guards against a stranger pressuring you over a loan that may not even be theirs.

Quietly build your record

Accountability works best when you can show exactly what happened. You do not need to confront the agent. You simply document, calmly and privately.

• Keep a log of date, time, the number that called, who they claimed to represent, and what was said.
• Save call history and keep screenshots of SMS, WhatsApp and app messages with timestamps.
• Note any calls or messages made to your family, employer, neighbours or contacts — these strengthen a harassment and privacy complaint.
• Preserve the loan agreement, KFS and any disclosures naming the lender, so the RE's identity is on record.

Store these safely, away from prying eyes, in one place using the document locker so your evidence is ready if you later need to complain.

How to hold the lender accountable — step by step

You have a clear, escalating path, and each step is free.

1. Write to the lender's grievance officer. Every RE must have a grievance redressal mechanism and a named grievance officer, with details on its website and in your loan documents. Send a short written complaint setting out the dates, times and nature of the harassment, name the agent or agency if known, and state plainly that under the RBI Fair Practices Code the lender is responsible for the conduct of its recovery agents. Ask them to stop the misconduct and confirm in writing. Keep a copy.

2. Escalate to the RBI Ombudsman. If the lender does not resolve your complaint within 30 days, or rejects it, approach the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme (RB-IOS). File online, free of cost, through cms.rbi.org.in.

3. Report unfair practices on Sachet. RBI's Sachet portal (sachet.rbi.org.in) lets you report unfair or unauthorised practices, including coercive recovery, directly to the regulator.

4. If there are threats, abuse or data misuse. Threats and intimidation can attract provisions of the Bharatiya Nyaya Sanhita (BNS). Misuse of your personal data or contacts can raise issues under the Digital Personal Data Protection Act, 2023 (DPDP Act). For these, you can report to the police, and for online or app-based harassment the cybercrime helpline 1930 and cybercrime.gov.in are available.

Often, a calm written complaint to the grievance officer — squarely placing the responsibility on the lender — is enough to bring the agent's conduct under control, because the RE knows it is the one answerable to RBI.

If you cannot afford a lawyer

You do not need to hire anyone to assert these rights. The complaint routes above are built for borrowers to use directly, free of cost. If your matter is more serious and you need legal help but cannot afford it, India's free legal aid system exists for exactly this. Under the Legal Services Authorities framework, the National Legal Services Authority (NALSA), State Legal Services Authorities (SLSA) and District Legal Services Authorities (DLSA) provide free legal assistance to eligible people. You can learn how to approach them through our free legal aid guide.

A calm closing thought

Harassment relies on you believing that the person on the phone answers to no one. They do. They answer to the lender who sent them, and that lender answers to the Reserve Bank of India. The chain of accountability runs straight from the agent's call to a regulated institution that very much wants to stay on the right side of its regulator. When you write your complaint, address it to that institution and remind it of its responsibility. You are not arguing with a ghost — you are holding a licensed lender to a standard it is already bound by.

If you would like to read more, our blog has further explainers on recovery harassment, calling hours, and your rights as a borrower.

This is general information, not legal advice. Rules and procedures can change, and your situation may have specific facts that matter. For advice on your own case, consider free legal aid through NALSA/DLSA or a qualified professional.