RBI Bans Remote Device Disabling for Loan Recovery by 2027

The Reserve Bank of India (RBI) has issued new directions prohibiting commercial banks from remotely disabling mobile phones, tablets, or laptops belonging to borrowers as a method for recovering unpaid loans. These regulations become effective on January 1, 2027, marking a significant step to curb aggressive technology-driven recovery practices.

An exception to this broad prohibition exists only if the device itself was directly financed through a loan provided by the bank. Even in such specific circumstances, lenders are not permitted to immediately disable the device, requiring adherence to a strict, gradual process.

Understanding Device Restriction Rules

For banks to restrict a financed device, several stringent conditions must be met. The loan agreement must explicitly and unambiguously permit such an action, detailing the precise procedure involved before any restrictions are applied.

• The loan must be at least 30 days past due (dpd), and prior notices must have been sent to the borrower.

• Full restrictions can only be imposed after 60 days dpd, ensuring a phased approach to device limitation.

• Essential functions, including incoming calls, SMS, and emergency SOS features, must always remain accessible.

• Banks are expressly forbidden from preventing borrowers from utilizing their devices for work-related activities.

Upon the borrower’s payment of outstanding dues, any restrictions placed on the device’s functionality must be reversed promptly. This restoration must occur within one hour of payment receipt, ensuring immediate resumption of full device access.

• If a bank wrongfully restricts a device or delays its restoration, it must compensate the borrower at a rate of ₹250 per hour.

• This compensation amount is capped at the total disbursed loan amount, providing a clear limit to the bank’s liability.

Furthermore, the new directions include robust provisions for data privacy. Banks and their associated third-party technology providers are strictly prohibited from accessing or using any personal information stored on a borrower’s device for any purpose. This includes contacts, SMS, call logs, photos, or location history, reinforcing the importance of personal data security.

Tighter Regulations for Loan Recovery Agents

These comprehensive new directions, officially part of the Reserve Bank of India (Commercial Banks—Responsible Business Conduct) Fourth Amendment Directions, 2026, also extend to significantly tightening the rules governing loan recovery agents. Banks are now mandated to develop detailed policies for recovery processes.

• Policies must include clear triggers for initiating recovery proceedings and an escalation matrix.

• A robust code of conduct for agents is required, alongside a framework specifically for borrowers experiencing financial distress.

Recovery agents themselves face enhanced scrutiny and qualification requirements. They must undergo thorough due diligence and background verification processes before being engaged by banks.

• Agents are required to obtain certification from the Indian Institute of Banking and Finance (IIBF), ensuring a baseline level of professional competence.

• Contact with borrowers or guarantors is strictly restricted to between 8 am and 7 pm, unless the borrower has explicitly requested contact outside these hours.

The framework explicitly prohibits several practices deemed unacceptable in loan recovery. These measures aim to protect borrowers from undue pressure and harassment during the recovery process.

• Harassment, abusive language, or public shaming, such as posting personal details or recordings on social media, are forbidden.

• Excessive calls, anonymous calls, and the harassment of relatives or co-workers are also strictly prohibited.

Banks bear significant responsibility for overseeing their recovery agencies’ compliance with these new rules. They must actively monitor agency activities and maintain meticulous records of all recovery calls.

• Records of recovery calls, including the time, number, and content, must be kept for at least six months.

• Banks must ensure that recovery targets do not inadvertently encourage harsh or unethical practices by their agents.

• A dedicated grievance redressal mechanism must be established by banks specifically for handling recovery-related complaints, providing borrowers with a clear avenue for recourse.

These comprehensive amendments underscore the RBI’s commitment to fostering responsible business conduct within commercial banks and protecting borrower rights, effective from the beginning of 2027.