The Reserve Bank of India (RBI) has introduced a comprehensive loan recovery framework aimed at protecting borrowers from harassment while ensuring fair and transparent recovery practices by banks and regulated lenders.
Effective January 1, 2027, the new guidelines lay down detailed rules governing how lenders and recovery agents can communicate with borrowers, conduct field visits and use technology to recover dues. The framework also formally regulates the remote locking of financed smartphones, tablets and laptops in cases of prolonged loan defaults.
Recovery calls and visits restricted to specific hours
Under the revised norms, recovery-related calls and visits will generally be permitted only between 8 AM and 7 PM. Any communication beyond these hours will require the borrower's prior request or explicit consent.
The RBI has also instructed recovery agents to exercise sensitivity in exceptional circumstances. Borrowers should not be approached during situations such as bereavement, medical emergencies or family celebrations, including weddings.
The central bank has taken a tough stance against coercive recovery practices. Recovery agents are prohibited from using abusive, threatening or intimidating language. Anonymous calls, repeated harassment, public humiliation and threats involving a borrower's family, assets or reputation are strictly forbidden.
Personal data misuse prohibited
The RBI has also addressed the misuse of social media during loan recovery. Recovery agents cannot publish or circulate a borrower's personal information, photographs, videos or audio recordings to pressure or shame them into repayment.
The guidelines also strengthen transparency during physical recovery visits. Before the first visit by a recovery agency, borrowers must receive at least one day's prior notice. Banks are also required to disclose the identity of the recovery agency handling the case.
As a general rule, borrowers should be contacted at a location of their choice. If no preference has been provided, or if the borrower repeatedly fails to appear at the agreed location, recovery agents may visit the borrower's residence or workplace.
During such visits, recovery agents must properly identify themselves and carry a valid identity card, an authorisation letter and the relevant recovery notice. The authorisation letter must also include contact details of both the recovery agency and the bank's grievance redressal officer.
Banks remain accountable for recovery agents
The RBI has further tightened accountability for lenders by requiring them to closely supervise recovery activities. Banks must record recovery-related conversations and maintain details such as call timings and phone numbers. These records generally need to be preserved for at least six months.
The documentation is intended to help resolve disputes if borrowers allege misconduct by recovery agents. The RBI has made it clear that banks cannot escape responsibility by blaming outsourced agencies. Even when recovery operations are assigned to third parties, lenders remain fully accountable for ensuring compliance with regulatory standards.
Banks have also been directed to ensure that recovery agents receive proper training. Lenders must review their incentive structures to ensure they do not encourage aggressive or unethical recovery practices.
Privacy protection strengthened
Privacy protection is another key feature of the new framework. Recovery agents should have access only to information necessary for recovering dues. Banks must implement safeguards to prevent the misuse or unauthorised disclosure of borrowers' personal data.
Stricter rules for restricting financed electronic devices
The guidelines also clarify when lenders can remotely restrict financed electronic devices following loan defaults.
Such restrictions will apply only when the loan was specifically taken to purchase the smartphone, tablet or laptop. Lenders cannot disable devices financed through unrelated personal loans.
Even in eligible cases, restrictions cannot begin immediately after an EMI is missed. A financed device may be remotely restricted only after the loan remains overdue for at least 30 days.
A complete restriction can be imposed only if the account continues to remain overdue for 60 days. However, the RBI has ensured that essential functions remain operational. Borrowers must continue to have access to incoming calls, SMS services, emergency communications and features necessary for work or employment.
The central bank has also prohibited lenders from using remote-access technology to view or collect unrelated personal information, including contacts, photographs, videos, call logs, text messages or location history.
Device functionality must be restored after payment
Once the borrower clears the outstanding dues or regularises the loan, lenders are expected to restore full device functionality promptly. The RBI has specified that restoration should ordinarily take place within one hour of payment or settlement.
If a lender fails to reactivate the device within the prescribed time, the borrower may be entitled to compensation of ₹250 for every hour of delay, subject to a maximum limit linked to the outstanding loan amount.
The RBI has also stressed that borrowers must be informed upfront if their financed device may be remotely restricted in case of default. Such conditions must be clearly disclosed and cannot be hidden in lengthy loan agreements or fine print.
The new framework seeks to strike a balance between lenders' right to recover legitimate dues and borrowers' right to privacy, dignity and protection from coercive recovery practices.
