Winning Bizness Desk

Mumbai.RBI bars banks from locking personal devices over unpaid loans from January 2027

The Reserve Bank of India has barred banks and financial institutions from locking or disabling a borrower's mobile phone, laptop or tablet to recover personal, home or car loans, providing greater protection against coercive recovery practices.

The RBI clarified on August 6 that device-locking will be permitted only when the particular device itself was purchased through a loan or financing provided by the bank or financial institution concerned.

The move is aimed at curbing threats, privacy violations and harassment reported during loan recovery, while putting tighter controls on how lenders and recovery agencies can use technology and personal data.

New rules limit device-locking powers

Under the revised framework, lenders cannot use software to disable a borrower's phone, laptop or tablet merely because another loan has remained unpaid.

The only exception applies when the device itself was financed by the same lender. Even in such cases, however, banks cannot immediately lock the device and must follow a phased process.

The RBI has also specified safeguards for essential services if a financed device is eventually restricted:

• Incoming calls must continue to work.
• SMS services cannot be blocked.
• Emergency SOS features must remain operational.

The central bank has also moved to prevent the misuse of device-locking technology by lenders or third-party recovery service providers.

Only authorised technology can be used

Banks and their recovery partners will not be allowed to use unverified or unauthorised third-party software to lock devices. They must obtain proper certification from the original equipment manufacturer (OEM) or the relevant operating system (OS) platform.

The RBI's move follows complaints that borrowers were being subjected to aggressive recovery methods, including threats, abusive language and attempts to publicly shame them on social media.

The revised framework also puts restrictions on the sharing of borrowers' and guarantors' personal information with recovery agents and employees. Lenders must disclose only the information that is strictly necessary for carrying out the recovery assignment.

Borrowers retain important privacy and complaint rights

The RBI's directions make it clear that loan recovery does not give banks or their agents unrestricted access to a borrower's personal information, photographs or contact list.

Borrowers have the following protections:

• Personal data, photographs or contact lists cannot be made public for recovery purposes.
• Recovery agents can contact borrowers only between 8 am and 7 pm.
• Complaints about abusive behaviour can first be raised with the bank's designated nodal officer.
• If the issue remains unresolved, borrowers can approach the RBI Ombudsman through its complaint mechanism.

The revised rules will take effect from January 1, 2027. The RBI had first issued a draft framework in May under the proposed 'Conduct of Regulated Entities in Recovery of Loans'. The final guidelines have now been issued after considering feedback received on the draft.

The new framework therefore seeks to draw a clear line between legitimate loan recovery and coercive tactics. While lenders retain the right to recover legitimate dues, they will have to ensure that recovery methods do not compromise borrowers' privacy, essential device services or basic safeguards.