RBI Allows Banks to Restrict Loan-Financed Phones, Other Devices After Default

The Reserve Bank of India has allowed banks to use technology-based mechanisms to restrict functionalities of mobile phones and other devices financed by them when borrowers default on loans, subject to safeguards including a 30-day waiting period and mandatory gradual restrictions.

Under revised responsible business conduct norms issued Thursday, banks will be permitted to restrict or disable functionalities of mobile phones, tablets and laptops only where the loan was specifically used to finance the acquisition of that device. The provisions will come into effect from January 1, 2027.

The loan agreement must expressly and unambiguously permit such action and specify the procedure to be followed. Banks must also give borrowers prior notice detailing the restrictions that may be imposed.

Restrictions cannot be initiated until the loan has remained overdue for at least 30 days and the borrower has failed to make payment despite notices. Banks will then have to impose restrictions gradually, while the full set of restrictions permitted under the loan agreement can be activated only once the loan becomes 60 days past due.

Outgoing calls cannot be restricted before the 60-day mark.

The RBI has also barred banks from cutting off essential functionalities such as incoming calls, SMS and emergency SOS features. Restrictions cannot prevent borrowers from carrying out activities related to their work or employment.

Once overdue amounts are paid, restrictions must be reversed expeditiously and no later than one hour after realisation of the dues. In case of wrongful restrictions or delays attributable to the bank, the lender will have to compensate the borrower at ₹250 per hour, capped at the amount of the loan disbursed.

Banks and their technology service providers have also been prohibited from accessing personal data stored on the device, including contacts, SMS, call logs, photographs and location history, either for loan recovery or any other purpose.

The device-locking framework forms part of a wider overhaul of the RBI's rules governing recovery of loans and engagement of recovery agencies by commercial banks. The new directions replace and consolidate existing instructions on recovery practices.

Other Key Provisions

• Recovery calls and visits restricted to 8 AM-7 PM: Bank employees and recovery agents can contact or visit borrowers only between 0800 and 1900 hours, unless the borrower expressly requests or authorises communication outside these hours.
• Banks must record recovery calls: Banks will have to document the time and number of recovery calls and maintain recordings of the content or text of calls between borrowers and recovery personnel. The records must generally be retained for six months.
• No abusive or intimidating recovery practices: Recovery personnel cannot use abusive or threatening language, make anonymous or excessive calls, publicly humiliate borrowers, misuse social media or threaten violence against borrowers, their families, assets or reputation.
• Banks accountable for recovery agencies: Banks must have policies governing recovery agencies, including due diligence, performance assessment, audits and action against non-compliant agencies. Policies must also provide for compensation to borrowers or guarantors for losses caused by recovery actions inconsistent with the RBI directions.
• Recovery agents must be certified: Banks must ensure that recovery agencies employ only agents who have obtained the required certification after completing the debt recovery agent training programme of the Indian Institute of Banking and Finance or an institute tied up with it.
• Banks must disclose recovery agencies: Banks will have to publish an updated list of empanelled recovery agencies on their websites, including their addresses, period and purpose of engagement. Borrowers must also be informed at least one day before the first in-person visit by an assigned recovery agency.
• Recovery agents must identify themselves: Agents making recovery visits must carry an identity card, authorisation letter and a copy of the notice issued by the bank.
• Borrower information must be protected: Banks can share information with employees and recovery agencies only to the extent necessary for recovery and must put safeguards in place against misuse of customer information.
• Special framework for borrowers in financial distress: Banks' recovery policies must include documented pre-escalation engagement with borrowers facing financial distress and guidance on available resolution options.
• Dedicated grievance mechanism: Banks must establish a mechanism for recovery-related complaints, with contact details of the grievance redressal officer included in recovery communications.