The Reserve Bank of India (RBI) has introduced new draft rules to protect borrowers from harassment, pressure tactics, and misuse of digital recovery methods by banks, NBFCs, loan apps, and recovery agents.
The new rules, which will come into effect from October 1, 2026, are part of the RBI’s “Master Direction on Recovery of Loans and Conduct of Recovery Agents” and the “Responsible Business Conduct Amendment Directions, 2026.”
These guidelines aim to make loan recovery more transparent, fair, and borrower friendly. The RBI’s move comes after rising complaints about aggressive recovery calls, public shaming, and digital loan apps misusing customer data.
RBI Sets Strict Rules on Remote Locking of Smartphones
One of the biggest changes is related to “digital repossession,” where lenders remotely lock or restrict smartphones if borrowers fail to repay loans.
According to the RBI, lenders can only lock a device if the loan was taken specifically to buy that phone or tablet. Banks and loan apps cannot use remote locking for personal loans or other types of borrowing.
The RBI has also made customer consent compulsory. The loan agreement must clearly mention this feature, and borrowers must give written permission before taking the loan.
A lender cannot lock a device immediately after a missed EMI. The loan account must first become at least 90 days overdue.
The RBI has also introduced a two-step notice process. Borrowers will first receive a notice after 60 days of non-payment, giving them 21 days to clear dues. After that, a final seven-day notice must be given before any restriction starts.
The rules also say lenders cannot fully block the phone at once. They can only gradually restrict non-essential features like entertainment apps first.
Important services such as internet access, incoming calls, emergency SOS, government alerts, and customer care access cannot be blocked under any condition.
If a borrower clears the dues, the bank must restore the device within one hour. If there is any delay or wrongful restriction, the lender will have to pay Rs 250 per hour as compensation.
New Rules for Recovery Agents and Collection Calls
The RBI has also tightened rules for recovery agents to stop borrower harassment.
Recovery agents can now contact borrowers only between 8 AM and 7 PM. Any call or visit outside these hours will be treated as a violation.
Banks and NBFCs must also inform borrowers before sending a recovery agent for a visit. An SMS or email must be sent at least one day in advance. If digital communication is not available, a physical letter must be delivered at least three days earlier.
Recovery agents must carry proper documents during visits. This includes an official ID card, authorisation letter, copy of the default notice, and details of the bank’s grievance officer.
The RBI has strictly banned agents from contacting a borrower’s family members, neighbours, friends, or office colleagues for loan recovery.
Agents are also not allowed to use abusive language, threats, intimidation, or fake claims involving police action or arrest. The RBI clarified that loan default is a civil matter, not a criminal offence.
Public shaming tactics like sharing borrower details on social media or putting up posters in neighbourhoods are also banned.
Repeated and excessive calling that mentally disturbs borrowers has also been prohibited.
Stronger Data Privacy Rules for Loan Apps
The RBI has introduced stronger privacy protections for borrowers using digital lending apps.
Banks, NBFCs, and loan apps cannot access personal data stored on a borrower’s mobile phone for recovery purposes. This includes contacts, photos, videos, and private files.
Digital loan apps must clearly mention which bank or NBFC they represent. They also cannot ask for unnecessary permissions that violate India’s Digital Personal Data Protection (DPDP) rules.
These steps are expected to reduce misuse of customer data by some loan apps.
Banks Will Be Responsible for Recovery Agents
The RBI has clearly stated that banks and NBFCs will be fully responsible for the actions of third-party recovery agents hired by them. This means lenders cannot escape responsibility if recovery agents harass borrowers or break rules.
Read More : Pronto Hits $200 Million Valuation as India’s Instant Home Services Market Heats Up
The new guidelines also make it compulsory for banks to record all recovery-related calls and keep the recordings for at least six months. Recovery agents must also complete 100 hours of training on borrower rights and ethical recovery practices. They will need to pass an exam conducted by the Indian Institute of Banking and Finance (IIBF). Banks must also publicly display the list of approved recovery agencies on their websites and apps.
Borrowers Get Better Complaint and Compensation Rights
The RBI has also strengthened grievance systems for borrowers.
Banks and NBFCs must create dedicated channels for recovery-related complaints. Complaints must be acknowledged within 24 hours and resolved within 30 days.
If a borrower files a complaint about recovery practices, the bank must stop sending recovery agents until the issue is resolved.
The RBI has also announced relief measures for people affected by natural disasters. In such areas, banks must pause recovery actions and provide support like loan moratoriums.
If borrowers are unhappy with the bank’s response, they can file a free complaint with the RBI’s Integrated Ombudsman through the CMS portal.
The RBI has increased compensation limits up to Rs 30 lakh for financial losses and up to Rs 3 lakh for harassment, mental stress, or loss of time caused by unfair recovery practices.