The Reserve Bank of India (RBI) has barred banks from using technology to disable or restrict the functionality of borrowers' mobile phones, tablets and laptops as a tool to recover unpaid loans, bringing a significant regulatory check on technology-driven recovery practices. The exception is narrowly defined: banks may use such mechanisms only when the device itself was purchased with a loan financed by the bank. Even in such cases, the lender cannot immediately disable the device and must follow a gradual process with advance notice and several safeguards, the central bank clarified. The directions will come into force from 1 January 2027.
The new framework draws a clear line between legitimate recovery of loan dues and coercive, technology-based or personal harassment tactics. For ordinary loan defaults, a bank cannot remotely disable a borrower's phone, tablet or laptop. Where the device itself was financed by the bank, restrictions may be used only within RBI's prescribed framework, with advance notice, gradual escalation, essential services protected, personal data kept off limits and functionality restored promptly after payment.
RBI has expressly prohibited banks from deploying technology that restricts or disables the functionality of a borrower's mobile phone, tablet or laptop for recovery of loan dues.
The amendment states: "A bank shall not deploy any technology-based mechanism" to restrict or disable the functionalities of a borrower's mobile device as a recovery tool, except when the loan dues arise from financing that particular device.
This means a bank cannot, for instance, remotely lock a customer's smartphone because the borrower has defaulted on a personal loan, car loan, home loan or another credit facility that was not used to purchase that device.
The restriction applies even when banks use an outside technology provider. RBI has made it clear that a bank cannot bypass the requirement by outsourcing the device-locking mechanism to a third party.
Limited Use for Financed Devices
RBI has permitted limited use of device restrictions where the bank has actually financed the purchase of the mobile phone, tablet or laptop.
However, several conditions have to be met before any restriction can be imposed. The device must have been financed by the bank and the loan agreement must 'expressly and unambiguously' permit the action and explain the procedure that will be followed.
The borrower must also receive notice about the outstanding dues and the proposed restrictions. The notice must spell out the gradual restrictions that could be imposed on the device.
Most importantly, the bank cannot activate the technology-based restriction as soon as a payment is missed.
RBI has prescribed a minimum timeline before lenders can begin restricting the functionality of a financed device.
The amendment says a bank cannot initiate restrictions until the associated loan has become 30 days past due (dpd) and the borrower has failed to pay despite receiving notices. Only after that point can gradual restrictions begin.
Even then, the lender cannot immediately impose the full set of restrictions permitted under the loan agreement. RBI says the complete set of restrictions can become effective only after the loan has remained unpaid for 60 days.
Outgoing calls also cannot be restricted before the loan reaches 60 days past due.
Incoming Calls, SMS and SOS Can’t Be Blocked
RBI has separately identified essential functions that must remain available even when restrictions are imposed on a financed device.
The amendment directs banks to adopt "a gradual approach rather than disabling the device, ab initio." It also prohibits restrictions on essential functions such as "access to incoming calls, SMS and emergency SOS features."
The restrictions cannot prevent the borrower from using the device for work or employment-related activities either. Borrowers must also be able to see the status of any restrictions imposed on their devices.
This effectively prevents a lender from turning a financed smartphone or laptop into a completely unusable device merely because the borrower has fallen behind on repayments.
Banks Must Unlock Devices within 1 Hour of Payment
RBI has also prescribed a strict restoration timeline. Once the borrower pays the dues, restrictions on device functionality must be reversed 'not later than one hour of realisation of the dues', according to the amendment.
If a bank wrongfully restricts the device or delays restoring its functionality after the dues have been paid, and the delay is attributable to the bank, the lender must compensate the borrower at ₹250 per hour until the problem is rectified.
The total compensation, however, is capped at the amount of the loan disbursed.
Once the loan has been repaid in full, the bank must promptly relinquish access to or control over the technology used to restrict the device. If the borrower needs to uninstall the mechanism, the bank must provide instructions on how to do so.
Borrowers will also retain the right to prepay the loan, in whole or in part, at any time. Banks must have a grievance redressal mechanism specifically for complaints relating to delays or problems in unlocking the device.
Banks and Technology-providers Cannot Access Personal Data
RBI has placed a separate privacy restriction on the use of device-locking technology. Banks and their third-party service providers cannot access or use personal information stored on a borrower's device for loan recovery or any other purpose. The amendment specifically covers data such as 'contacts, SMS, call logs, photos, location history, etc'.
Therefore, even in cases where a bank is legally permitted to use a technology-based mechanism to restrict a financed device, that permission does not extend to accessing the borrower's personal data stored on the phone, tablet or laptop.
RBI Also Tightens Rules for Recovery Agents
The device-locking provisions form part of a much broader overhaul of loan recovery practices.
RBI has directed banks to formulate a comprehensive policy covering recovery by their own employees and recovery agents. This policy must include triggers for starting recovery proceedings, graded actions under an escalation matrix, a code of conduct and a framework for borrowers facing financial distress.
The amendment also formally defines a recovery agency as an entity or individual engaged by a bank to assist in recovering loan dues, regardless of the contractual terminology used. Business correspondents (BCs) involved in recovery activities will also be treated as recovery agencies under the directions.
Banks must carry out due diligence and background verification of recovery agents. They must also ensure that recovery agents have completed the required debt recovery agent training and obtained certification from the Indian Institute of Banking and Finance (IIBF) or an institute having the required tie-up with IIBF.
Recovery Calls Restricted to Specified Hours
RBI has also prescribed when recovery agents can contact borrowers. Employees and recovery agents can contact or visit borrowers or guarantors only between 8am and 7pm, unless the borrower or guarantor has expressly requested or authorised contact outside those hours.
The rules also require recovery agents to identify themselves and carry the necessary authorisation and notice documents when visiting a borrower or guarantor. Recovery discussions must be confined to the borrower or guarantor concerned.
RBI has further directed recovery personnel to avoid inappropriate occasions such as bereavement, medical emergencies and marriage functions while seeking repayment.
Harassment and Public Shaming Prohibited
The new framework explicitly identifies several recovery practices as harsh. These include abusive or threatening language, posting a borrower's personal details or audio and video recordings on social media, inappropriate messages, excessive calls or messages, anonymous calls and harassment of relatives, friends or co-workers.
RBI has also prohibited intimidation, threats of violence and misleading borrowers about the extent of their debt or the consequences of non-payment.
Banks are required to ensure that borrower and guarantor information shared with employees or recovery agencies is limited to what is necessary for carrying out recovery duties. They must also put safeguards in place against the misuse of customer information.
Banks Made Responsible for Recovery Practices
The amendment places responsibility on banks to monitor recovery agencies and ensure that their practices comply with the RBI's requirements.
Banks must maintain records of recovery calls, including the time and number of calls and the content or text of conversations. These records are to be preserved for six months or longer where the matter is sub judice. Borrowers should also be informed that calls are being recorded.
RBI has also said that recovery targets and incentive structures must not encourage employees or recovery agencies to adopt harsh recovery practices.
In addition, banks must maintain a dedicated mechanism to handle recovery-related complaints and provide borrowers with the contact details of the relevant grievance redressal officer.
