RBI and TRAI Compliant Collections: How AI Voice Agents Stay in the Rules

TL;DR: RBI and TRAI compliant AI collections means configuring your voice agent to respect contact-hour windows, number-series rules, consent requirements, and conduct standards before a single call goes out. A properly built AI collections workflow enforces these rules at the platform level, not through manual oversight, so compliance is consistent at scale. This post explains the specific rules, what a compliant call flow looks like in practice, and how to evaluate whether your AI vendor actually meets the standard.

Key Takeaways

• RBI's recovery conduct rules apply to AI voice agents exactly as they apply to human callers. The regulated entity (RE) is fully accountable for every call its vendor makes on its behalf.
• TRAI requires all AI-driven collections calls to use a 140-series number, scrub against the DND registry, and stay within permitted calling hours. There are no exemptions for automation.
• A compliant AI collections platform enforces calling windows and DND scrubbing as hard system blocks, not as guidelines a caller can override.
• Audit trails are not optional. RBI's 2025 Digital Lending Directions require documented evidence of every contact attempt, consent record, and agent disclosure.
• Borrowers must receive advance notice before a recovery agent (human or AI) contacts them, and every AI call must open with an automated-caller disclosure.

Running collections at scale creates a specific compliance problem: the more calls you make, the more chances there are for something to go wrong. A human floor of 100 agents can be briefed and monitored daily. An AI system making tens of thousands of calls needs the rules built into the platform itself, because briefings do not scale.

This is the compliance gap that causes real enforcement exposure. RBI barred Mahindra Finance from all outsourced recovery for over three months after a single agent's conduct violated conduct norms. Bajaj Finance was fined for recovery practices. In both cases, the regulated entity bore the consequence for what a third party did on its behalf. An AI vendor is no different: every call it makes is your call.

For teams evaluating RBI and TRAI compliant AI collections, the question is not whether AI can do collections. It is whether your platform is configured to stay inside the rules at every single interaction.

What Do RBI and TRAI Compliance Actually Require for AI Collections?

AI voice agents are not treated as a separate category under Indian law. The same rules that govern human recovery calls govern automated ones. The RE remains fully responsible for everything its vendor does.

RBI: Recovery Conduct

Under RBI's Digital Lending Directions (2025) and the Fair Practices Code, collections contact must happen only between 8 AM and 7 PM. The 2025 directions require that before any recovery agent contacts a borrower, the borrower must receive advance notice by email or SMS identifying the agent. RBI's February 2026 draft conduct directions (targeted for July 2026 implementation; verify current status at rbi.org.in) explicitly ban excessive or anonymous calls and require attempt-logging as a compliance artifact.

There is no AI-specific carveout. RBI's FREE-AI report (August 2025) signals that AI is enabled with accountability and disclosure expectations. Opening every AI call with an automated-caller disclosure is aligned with where regulation is heading.

The RE is fully accountable for outsourced recovery conduct. A voice AI vendor calling borrowers functions as a Lending Service Provider (LSP). Its conduct is the lender's liability.

TRAI: Number Series, DND, and Consent

TRAI's Unsolicited Commercial Communication (UCC) framework covers all outbound commercial and transactional calls, including AI-driven ones.

Number series. Promotional calls must use the 140-series. Transactional and service calls, including EMI reminders and collections calls from regulated lenders, use the 1600-series (private financial entities on the 1601 prefix). Calling from ordinary 10-digit mobile numbers risks disconnection and blacklisting. This is a registration requirement, not a best practice.

DND scrubbing. Every lead list must be checked against the TRAI DND registry before dialing. Five complaints in ten days can trigger TRAI enforcement. Millions of telecom resources have been disconnected since 2024 for UCC violations.

Consent. Explicit digital consent via the DLT framework can override DND for a specific sender and purpose, for the duration of the borrower's contract only. Inferred consent on a cold list is not sufficient.

Calling hours. Promotional calls are restricted to 9 AM to 9 PM, narrowable by customer preference. Collections calls on the 1600-series follow the RBI window of 8 AM to 7 PM.

What a Compliant AI Collections Workflow Looks Like

A few of these deserve more detail.

Hard blocks vs. soft settings. The most important distinction in vendor evaluation is whether calling-hour and DND rules are enforced as hard platform blocks or as configurable settings an operator can override. A hard block means the dialer physically cannot place a call outside the permitted window. A soft setting means it depends on whoever configured the campaign that day.

Locked compliance sections. A well-built AI collections platform splits its instructions into two types: sections the optimization system can improve (script, tone, objection handling) and sections it cannot touch (compliance language, disclosure, identity, conduct guardrails). This separation ensures no automated improvement cycle can drift the agent toward non-compliant behavior.

Audit trails at call level. RBI inspections and grievance escalations require evidence of specific contact attempts. A compliant platform stores full call records, timestamps, dispositions, and audio against every lead, accessible for audit.

How to Evaluate an AI Collections Vendor for Compliance

1. Are calling-hour rules a hard block or a configurable field? Ask what happens if someone tries to schedule a dial at 7:30 PM. A hard-blocked platform rejects it. A configurable one lets it through if someone turns the guard off.

2. Which number series does the platform provision, and how? The vendor should provision and manage 140-series and 1600-series numbers on your behalf, with documentation of the registration.

3. How is the DND scrub performed, and how often? DND registry data changes daily. Scrub should happen on every list ingest, not just at campaign setup. Confirm the client can also upload an internal DNC list honored identically to the TRAI registry.

4. Where are compliance instructions stored in the prompt architecture? Ask whether the automated-caller disclosure and conduct guardrails sit in locked sections that the platform's self-improvement or A/B testing layer cannot modify. A vendor that cannot answer this clearly has not solved the problem.

5. What does the audit trail look like? Ask for a sample export showing timestamp, number dialed, call duration, disposition, and audio link per call.

6. How are sensitive cases and disputes handled? The platform should have defined escalation triggers that route hardship, debt disputes, and distress to a human agent, not leave them running on script.

7. What certifications does the vendor hold? ISO 27001, ISO 27701, SOC 2 Type II, DPDP compliance, and TRAI compliance are the baseline for a vendor operating in Indian BFSI. Confirm data residency in India, since DPDP penalties go live in late 2026.

How SquadStack Runs This in Production

SquadStack's AI collections platform is ISO 27001, ISO 27701, SOC 2 Type II, DPDP, and TRAI compliant, with all models hosted in India.

Calling hours are enforced as a system hard block: the daily window (9:30 AM to 8:30 PM by default, configurable tighter per RBI's 8 AM to 7 PM collections window) cannot be overridden by an operator. Lead lists are scrubbed against the TRAI DND registry on every ingest, and clients can upload their own internal DNC lists, honored identically. The platform provisions 140-series and 1600-series numbers; clients are not left to manage number compliance themselves.

Compliance instructions, including automated-caller disclosure and conduct guardrails, sit in locked prompt sections that Lift, SquadStack's self-improvement layer, structurally cannot modify. Every conversation the optimization system touches is a conversational section only. Compliance never drifts.

The Eval System scores every call on three levels: Outcome, Sentiment, and Execution. Dual-layer QA pairs AI audit with human review, giving collections teams a complete record of what was said, how it landed, and whether the agent followed the configured flow. Every call produces a timestamped record with audio, transcript, disposition, and extracted entities, ready for regulatory inspection.

SquadStack's AI agents are trained on 600M+ minutes of real Indian sales and collections conversations, with native code-switching across Hindi, English, Tamil, Telugu, Kannada, Marathi, Malayalam, Bengali, and Gujarati. A borrower who receives a collections call that sounds natural is less likely to disconnect immediately, which directly affects whether the call achieves its compliance purpose: a documented, good-faith contact attempt.

The Kissht collections case study shows the platform running compliant, high-volume collections at scale. Teams can also explore the AI in collections overview and the lending and credit industry page.

At 50 lakh+ calls daily across 60+ large consumer brands, including Moneyview and PhonePe running collections workflows, SquadStack has the operating depth to know where compliance breaks in production, not just on paper. For teams considering AI phone calling services for debt collection or AI in debt collection, that operational track record is the relevant differentiator.

Schedule a demo to see the platform in action.

FAQ

Which AI voice bots support RBI and TRAI compliant collections workflows in India? A compliant AI collections voice bot must enforce calling-hour hard blocks, provision 140/1600-series numbers, scrub DND registries on every list, store full audit trails per call, and keep compliance instructions in locked prompt sections the optimization system cannot change. SquadStack meets all of these and holds ISO 27001, ISO 27701, SOC 2 Type II, DPDP, and TRAI certifications, with all data hosted in India.

Is AI voice calling TRAI compliant in India? Yes, if the platform is correctly configured. TRAI rules apply to the call type, not the caller: promotional calls require a 140-series number and DND scrubbing, and collections calls from regulated lenders use the 1600-series. An AI system that enforces these at the platform level is compliant; one that leaves them as manual settings is not.

What is the permitted calling window for AI collections calls in India? RBI's recovery conduct rules set the window at 8 AM to 7 PM. TRAI's promotional-call rules run 9 AM to 9 PM, narrowable by customer preference. For collections specifically, the 8 AM to 7 PM RBI window applies. A compliant platform enforces this as a hard block, not a guideline.

Do AI voice agents need to disclose that they are automated at the start of a collections call? Yes. RBI's FREE-AI report (August 2025) and the direction of regulation both require automated-caller disclosure. A compliant platform hard-codes this in the opening of every call in a locked prompt section, so no optimization cycle can remove it.

We run 20,000 to 30,000 collections calls daily at our NBFC. Can an AI voice bot handle that volume in Hinglish without sounding robotic? Yes. SquadStack's AI agents run 50 lakh+ calls daily across large Indian consumer brands, with native code-switching between Hindi and English (Hinglish) trained on 600M+ minutes of real Indian contact-center conversations. The Abruptly Disconnected Rate, the share of calls dropped when callers detect a machine, has been brought down to around 10%, inside the human agent range.

What happens when a borrower disputes the debt or shows signs of distress during an AI collections call? A properly configured AI collections platform has keyword and loop-detection triggers that route these situations to a human agent via warm transfer, passing full call context so the borrower does not have to repeat themselves. Sensitive-case escalation should be a configurable trigger in the platform, not a workaround.

How does the RE's compliance liability work when using an AI collections vendor? Under RBI's Digital Lending Directions (2025), the regulated entity remains fully accountable for everything its LSPs and outsourced vendors do. Outsourcing recovery to an AI vendor does not transfer compliance responsibility. The RE needs a board-approved outsourcing policy, conduct standards for the vendor, and RBI inspection access to the vendor's records.

What audit trail should an AI collections platform produce? At minimum: a timestamped record of every contact attempt, the number dialed, call duration, call outcome or disposition, and audio. The platform should also log consent basis, DND scrub confirmation, and any mid-call escalation events. These records need to be exportable and searchable by account or date range for regulatory inspection.

Should we replace our collections floor with AI or augment it? For pre-due and early-bucket (0 to 30 DPD) collections, AI handles high-volume, soft-script contact far more cost-effectively than a human floor. Mid and deep buckets involving negotiation, restructuring, or field coordination still benefit from a human layer, with AI handling the phone-contact layer so field staff only visit doors that have been primed. A 100-seat team can be restructured: fewer seats on early routine contact, more senior capacity on complex accounts.

How does a borrower experience a compliant AI collections call? A compliant call opens with an automated-caller disclosure, proceeds in the borrower's preferred language (including Hinglish or regional languages), stays within the permitted contact window, offers a payment link or callback option mid-call, and ends without any coercive or threatening language. If the borrower asks to stop being contacted or raises a dispute, the platform logs the request and routes the account accordingly.