AI Collections Compliance in India: How to Design a Controlled Collections Workflow

A collections team can read a policy document. A production system needs that policy turned into something it can enforce.

Suppose a lender has an applicable restriction on recovery-call timing. A policy can tell agents when they may call; a workflow can prevent an outbound call from being placed outside that window. Similarly, a policy may require appropriate handling of disputes. A workflow can detect a dispute intent and route the case to a human process instead of continuing the automated collection script.

That distinction — requirement versus control — is the foundation of a useful AI collections design.

**RBI recovery-agent conduct.** RBI’s August 12, 2022 instructions state that regulated entities remain responsible for the actions of their recovery agents, and require them and their agents not to use intimidation or harassment. The instructions specifically address inappropriate messages, threatening or anonymous calls, persistent calling, false or misleading representations, and calls before 8:00 a.m. or after 7:00 p.m. for recovery of overdue loans. RBI also states that these particular instructions apply to commercial banks (other than payment banks), co-operative banks, NBFCs, ARCs and AIFIs, while excluding microfinance loans covered by the separate 2022 microfinance directions.

For AI, the operational takeaway is not that software receives a special exemption. It is that applicable conduct requirements should become explicit controls in the workflow.

**TRAI and commercial communications.** TRAI’s TCCCPR framework is designed to protect customers from unsolicited commercial communication while enabling registered entities to send commercial communication according to applicable preferences and consent mechanisms. TRAI’s sender guidance says senders need, among other things, registered content templates and customer consent through the prescribed process before sending commercial communication.

That makes message governance part of the collections workflow. A message should not be treated as an unrestricted AI-generated output simply because it is being sent automatically.

**DPDP Act and the 2025 Rules.** The Digital Personal Data Protection Rules, 2025 were notified on November 13, 2025. Their commencement is staggered: Rules 1, 2 and 17–21 came into force on publication; Rule 4 (consent managers) is scheduled to commence one year after publication; and Rules 3, 5–16, 22 and 23 are scheduled to commence eighteen months after publication.

For collections teams, the practical lesson is to build disciplined data handling into the workflow and to check which statutory obligations are currently in force at the time of deployment. Privacy, access, security, retention and purpose should be designed deliberately rather than added after automation goes live.

The useful move is to map each requirement area to a concrete system control.

The safest automation boundary is based on the nature of the interaction, not on how technically capable the model appears.

Write the escalation rules as explicit conditions before production. A simple pattern is:

**AI interaction → intent/outcome detected → rule or confidence condition → escalation → relevant context passed → human continues → outcome recorded.**

This connects naturally to the deeper discussion of AI-to-human handoff and context continuity in AI + human handoff in loan collections.

• Identify the regulated entity, loan/product type and applicable RBI framework.
• Map every applicable requirement to a concrete workflow control.
• Configure and test permitted contact windows.
• Define approved language, prohibited behaviours and required disclosures.
• Define identity and privacy checks before sensitive account information is disclosed.
• Set contact-frequency and retry rules.
• Define dispute, hardship, complaint and human-request escalation triggers.
• Define what interaction data is recorded and who can access it.
• Define retention and deletion rules with the relevant legal/compliance owner.
• Connect automated interactions to the lender’s grievance process.
• Test wrong-party, dispute, complaint, hardship, low-confidence and repeated-contact scenarios.
• Create an ongoing review process for policy and regulatory changes.

NexShift brings AI voice, WhatsApp, SMS and human agents into a connected customer-engagement workflow. For a collections team, the important question is how those capabilities are configured around the lender’s rules: which interactions are automated, which channels are used, what outcomes are captured and where a human takes over.

That positioning matters. The platform can support the operational layer, but the lender’s compliance and legal teams remain responsible for determining the requirements that apply to its business and approving the resulting workflow.

1. RBI — Outsourcing of Financial Services: Responsibilities of regulated entities employing Recovery Agents (12 August 2022). rbi.org.in
2. RBI — Recovery-agent calling-hour scope. m.rbi.org.in
3. TRAI — TCCCPR, 2018. trai.gov.in
4. TRAI — Advice to Senders. trai.gov.in
5. MeitY — Digital Personal Data Protection Rules, 2025 (notified 13 November 2025). meity.gov.in
6. Google Search Central — Creating helpful, reliable, people-first content. developers.google.com