Managing personal loans or home loan EMIs can be stressful. Missing due dates or defaulting on repayments carries serious implications, including the risk of being pursued by recovery agents. Borrowers must have a repayment strategy before applying for loans.
The Reserve Bank of India (RBI) has now issued new directions to protect borrowers from intrusive loan-recovery practices. The guidelines, titled Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents, were issued on 6 August and will take effect from 1 January 2027.
The framework sets strict limits on how banks and recovery agents can contact borrowers, use personal data and deploy technology to recover unpaid dues.
Banks barred from locking borrower devices
Banking institutions cannot use technology or advanced mechanisms to forcibly restrict a borrower’s mobile phone, tablet, laptop or other similar devices to ensure recovery of pending dues from a personal, car, home or auto loan. The only exception in such cases is when the loan was specifically taken to finance that particular device.
Even in such cases, lending institutions must follow a gradual process and provide due notice and time.
| RBI rule | What it means for borrowers |
|---|---|
| Personal devices | Cannot be disabled for recovery of unrelated loans |
| Financed devices | Restrictions may apply, subject to RBI safeguards |
| Notice period | The borrower must receive due notice before restrictions |
| 30 days past due | Device restrictions cannot begin before this stage |
| 60 days past due | Full restrictions may be imposed as per the loan agreement |
| Essential functions | Incoming calls, SMS and emergency SOS must remain available |
| Personal data | Contacts, photos, SMS, call logs and location history cannot be accessed for recovery |
Note: For complete details, refer to the official RBI notification.
Recovery agents prohibited from harassment and data misuse
The RBI has also tightened rules governing recovery agents. Customer integrity and privacy are of paramount importance. Banks must ensure that only information necessary for recovery is shared with employees or agencies.
Recovery agents cannot use abusive language, personal attacks, threaten or publicly shame borrowers, or contact relatives, friends or colleagues to intimidate them.
The rules also prohibit banks and their technology providers from accessing personal information stored on a borrower’s device, including contacts, photos, text messages, call records and location history, for loan recovery purposes. Any such attempt is against the law and can result in appropriate remedial action.
Borrowers reminded of EMI obligations under new rules
For borrowers, it is essential to keep in mind that the new rules do not cancel or dilute loan obligations in any way. Borrowers remain responsible for unpaid EMIs, any pending debt obligations and applicable interest. Non-compliance can have legal ramifications and impact credit profiles and credit scores.
The RBI framework makes it clear that loan recovery must follow regulated, transparent and fair processes rather than intrusive and threat-driven tactics. For borrowers facing financial difficulty, the RBI has said that banks must have systems in place to address financial distress and to explain available resolution options.
Radhika Goyal is Author of Taxconcept Gurugram head office, for deeply reported tax, gst and income tax articles on issues that matter. He splits her time between New Delhi and Bengaluru, and has worked as a reporter, a podcaster and an editor for publications across India.