RBI Tightens Loan Recovery Rules, Limits Harassment and Remote Device Locking

Mumbai: The Reserve Bank of India (RBI) has introduced a comprehensive framework to regulate loan recovery practices and protect borrowers from harassment, with the new norms coming into effect from January 1, 2027.

Under the guidelines, recovery calls and visits will generally be allowed only between 8 AM and 7 PM. Contact outside these hours will require the borrower's prior request or explicit consent. Recovery agents must also avoid approaching borrowers during sensitive situations such as bereavement, medical emergencies and family events.

The RBI has prohibited abusive, threatening or intimidating recovery practices, including anonymous calls, repeated harassment, public humiliation and threats against borrowers or their families. Agents are also barred from sharing borrowers' personal information, photographs, videos or recordings on social media to pressure them into repayment.

For physical visits, borrowers must receive at least one day's prior notice before the first visit. Recovery agents must carry valid identification, an authorisation letter and the relevant recovery notice. Banks must disclose the recovery agency involved and remain responsible for the actions of outsourced agents.

Lenders must record recovery-related conversations and maintain details such as call timings and phone numbers, generally for at least six months. Banks must also ensure recovery agents are properly trained and that incentive systems do not encourage aggressive recovery practices.

The framework also introduces safeguards for remote locking of financed smartphones, tablets and laptops. Such restrictions can apply only when the loan was specifically taken to purchase the device.

A device cannot be remotely restricted immediately after an EMI default and must remain overdue for at least 30 days before any restriction. A complete restriction can be imposed only after 60 days of continued overdue status.

Even then, essential services such as incoming calls, SMS and emergency communications, along with functions required for employment, must remain accessible. Lenders cannot use remote access to collect unrelated personal data such as contacts, photos, videos, call logs, messages or location history.

Once dues are cleared or the loan is regularised, full device functionality must ordinarily be restored within one hour. Failure to do so could attract compensation of Rs 250 per hour of delay, subject to the prescribed maximum.

The RBI has also mandated that borrowers be clearly informed in advance if their financed device may be remotely restricted in case of default.

Also Read: Assam Floods: Death Toll Reaches 98 as 13 Districts Remain Affected