RBI tightens loan recovery rules: EMI defaulters can’t be harassed; strict norms on calls and phone-lock tactics
The Reserve Bank of India (RBI) has introduced a comprehensive loan recovery framework to protect borrowers from harassment while ensuring fair recovery practices by banks and regulated lenders.
Effective 1 January 2027, the new guidelines lay down detailed rules governing how lenders and recovery agents can communicate with borrowers, conduct field visits, and even use technology to recover dues. The framework also formally regulates the remote locking of financed smartphones, tablets and laptops in the event of prolonged loan defaults.
Under the revised norms, recovery-related calls and visits will generally be permitted only between 8 AM and 7 PM. Any communication beyond these hours will require the borrower’s prior request or explicit consent.
Agents told to exercise sensitivity
The RBI has also instructed recovery agents to exercise sensitivity in exceptional circumstances. Borrowers should not be approached during situations such as bereavement, medical emergencies or family celebrations like weddings.
The central bank has taken a tough stance against coercive recovery practices. Recovery agents are prohibited from using abusive, threatening or intimidating language. Anonymous calls, repeated harassment, public humiliation or threats involving a borrower’s family, assets or reputation are strictly forbidden.
Personal data misuse prohibited
The misuse of social media has also been addressed. Recovery agents cannot publish or circulate a borrower’s personal information, photographs, videos or audio recordings to pressure or shame them into repayment.
Transparency has been strengthened for physical recovery visits. Before the first visit by a recovery agency, borrowers must receive at least one day’s prior notice. Banks are also required to disclose the identity of the recovery agency handling the case.
As a general rule, borrowers should be contacted at a location of their choice. If no preference has been provided, or if the borrower repeatedly fails to appear at the agreed location, recovery agents may visit the borrower’s residence or workplace.
During such visits, recovery agents must properly identify themselves. They are required to carry a valid identity card, an authorisation letter and the relevant recovery notice. The authorisation letter must also include contact details of both the recovery agency and the bank’s grievance redressal officer.
The RBI has further tightened accountability for lenders by requiring them to closely supervise recovery activities. Banks must record recovery-related conversations and maintain details such as call timings and phone numbers. These records are generally required to be preserved for at least six months.
Such documentation will help resolve disputes if borrowers allege misconduct by recovery agents. The RBI has made it clear that banks cannot escape responsibility by blaming outsourced agencies. Even when recovery operations are assigned to third parties, lenders remain fully accountable for ensuring compliance with regulatory standards.
Banks have also been directed to ensure recovery agents receive proper training. Additionally, lenders must review their incentive structures to ensure they do not encourage aggressive or unethical recovery practices.
Privacy protection is another major feature of the new framework. Recovery agents should have access only to information necessary for recovering dues. Banks must implement safeguards to prevent misuse or unauthorised disclosure of borrowers’ personal data.
Stricter rules on restricting financed electronic devices
The guidelines also clarify when lenders can remotely restrict financed electronic devices after loan defaults. Such restrictions apply only if the loan was specifically taken to purchase the smartphone, tablet or laptop. Lenders cannot disable devices financed through unrelated personal loans.
Even in eligible cases, restrictions cannot begin immediately after an EMI is missed. A financed device may be remotely restricted only after the loan remains overdue for at least 30 days.
A complete restriction can be imposed only if the account continues to remain overdue for 60 days. However, the RBI has ensured that essential functions remain operational. Borrowers must continue to have access to incoming calls, SMS services, emergency communications and features necessary for work or employment.
The central bank has also prohibited lenders from using remote access technology to view or collect unrelated personal information, including contacts, photographs, videos, call logs, text messages or location history.
Once the borrower clears outstanding dues or regularises the loan, lenders are expected to restore full device functionality promptly. The RBI has specified that restoration should ordinarily take place within one hour of payment or settlement.
If the lender fails to reactivate the device within the prescribed time, the borrower may be entitled to compensation of ₹250 for every hour of delay, subject to a maximum limit linked to the outstanding loan amount.
Finally, the RBI has stressed that borrowers must be informed upfront if their financed device may be remotely restricted in case of default. Such conditions must be clearly disclosed and cannot be hidden within lengthy loan agreements or fine print.
