‘No Threats, No Late Night Calls’: RBI Issues New Rules For Loan Recovery

The Reserve Bank of India (RBI) has rolled out a detailed loan‑recovery framework designed to shield borrowers from harassment while guaranteeing that banks and regulated lenders pursue dues in a fair and transparent manner.

Starting January 1, 2027, the new rules spell out exactly how lenders and their recovery agents may contact borrowers, conduct field visits, and employ technology for debt collection. The framework also formally governs the remote disabling of financed smartphones, tablets, and laptops when a loan stays unpaid for an extended period.

Limits on recovery calls and visits

According to the updated norms, recovery‑related phone calls and personal visits are normally allowed only between 8 a.m. and 7 p.m. Contact outside this window is permissible only if the borrower has expressly requested it or given prior consent.

The RBI urges recovery agents to act with sensitivity in special situations. Borrowers should not be approached during times of bereavement, medical emergencies, or family celebrations such as weddings.

The central bank adopts a firm stance against coercive tactics. Agents may not use abusive, threatening, or intimidating language. Anonymous calls, repeated harassment, public shaming, or threats directed at a borrower’s family, assets, or reputation are strictly prohibited.

Ban on personal‑data misuse

The RBI also tackles the misuse of social media during recovery. Agents are forbidden from publishing or circulating a borrower’s personal information, photos, videos, or audio recordings to pressure or embarrass them into repayment.

The guidelines enhance transparency for physical visits. Before the first visit by a recovery agency, borrowers must receive at least one day’s advance notice. Banks must also disclose the identity of the agency handling the case.

As a rule, borrowers should be contacted at a location they choose. If no preference is given, or if the borrower repeatedly fails to show up at the agreed spot, agents may visit the residence or workplace.

During such visits, agents must clearly identify themselves, carry a valid ID card, an authorization letter, and the relevant recovery notice. The authorization letter must contain contact details for both the recovery agency and the bank’s grievance‑redressal officer.

Bank accountability for recovery agents

The RBI tightens lender oversight by obliging banks to closely supervise recovery activities. Banks must record recovery‑related conversations, noting call times and phone numbers, and retain these records for a minimum of six months.

This documentation helps resolve disputes if borrowers allege misconduct by agents. The RBI makes clear that banks cannot shift blame to outsourced firms; even when recovery work is outsourced, lenders remain fully responsible for ensuring compliance with regulatory standards.

Banks are also required to provide proper training to recovery agents and to review incentive structures so they do not encourage aggressive or unethical collection practices.

Strengthened privacy protection

Privacy safeguards are a cornerstone of the new framework. Agents may access only the information needed to recover dues. Banks must put in place measures to prevent misuse or unauthorized disclosure of borrowers’ personal data.

Tighter rules on remote locking of financed electronic devices

The guidelines also clarify when lenders may remotely restrict financed smartphones, tablets, or laptops after a default.

Such restriction applies only when the loan was taken specifically to purchase the device. Devices financed through unrelated personal loans cannot be disabled.

Even in eligible cases, restriction cannot begin immediately after a missed EMI. A financed device may be remotely locked only after the loan remains overdue for at least 30 days.

A full lock can be imposed only if the account stays overdue for 60 days. Nevertheless, the RBI ensures that essential functions stay active: borrowers must retain access to incoming calls, SMS, emergency communications, and features needed for work or employment.

The central bank also bars lenders from using remote‑access technology to view or collect unrelated personal data such as contacts, photos, videos, call logs, text messages, or location history.

Device functionality restored after payment

Once the borrower clears the outstanding dues or regularises the loan, lenders should restore full device functionality promptly. The RBI states that restoration ought to occur, as a rule, within one hour of payment or settlement.

If a lender fails to reactivate the device within the prescribed time, the borrower may claim compensation of ₹250 for each hour of delay, up to a ceiling linked to the outstanding loan amount.

The RBI also stresses that borrowers must be informed upfront if their financed device could be remotely restricted in case of default. Such conditions must be disclosed clearly and cannot be buried in lengthy loan agreements or fine print.

The new framework seeks to balance lenders’ legitimate right to recover dues with borrowers’ right to privacy, dignity, and protection from coercive recovery practices.