Downloads:

• A copy of RBI’s revised draft rules on loan recovery

The Reserve Bank of India (RBI) has issued revised draft amendment directions on “Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents”. Among other things, the central bank has proposed allowing lenders to deploy technology-based mechanisms that restrict or disable certain functionalities of financed devices, including smartphones and tablets, to recover loans from borrowers in the event of default.

What do the draft rules say? Financial institutions, including banks and Non-Banking Financial Company (NBFCs), can impose restrictions only if the loan was taken specifically to purchase that device.

• The loan contract must explicitly state that lenders can impose restrictions on a borrower’s mobile device in case of default, specify events that can lead to the issuance of a notice for loan recovery, the means by which such notices will be served, the timeline for repayment, and the grievance redressal mechanism.

• A notice can only be issued after 60 days of missed payments. Borrowers will be provided another 21 days to repay the loan after issuance of the first notice.

• Lenders are required to serve a second notice to the borrower after the expiry of the first one and grant at least another 7 days for repayment.

• Restrictions on a borrower’s mobile phone can only be imposed after the loan has gone 90 days past due and the borrower has failed to repay the dues despite being served notices.

• Lenders are barred from fully blocking essential functions, including incoming calls, internet access, emergency SOS features and government notifications. They are also prohibited from accessing, storing or using any personal data available on the borrower’s device under any circumstances.

• The RBI has also proposed mandating the lifting of restrictions on device features within one hour of loan repayment. In cases involving wrongful restriction or delays in reversing restrictions, the lender must compensate the borrower at the rate of Rs 250 per hour until the issue is resolved.

• The tech-based mechanism deployed for restricting device features must be uninstalled once the loan is repaid in full.

The RBI has sought public feedback on its recommendations by May 31, 2026. The proposed framework will come into effect from October 1.

What has been banned? Recovery agents are prohibited from engaging in the following “harsh” practices for collections:

1. Use of minatory or abusive language
2. Use of social media for posting video, audio recordings, or personal details of the borrower or guarantor
3. Sending inappropriate messages either on mobile phones or through social media
4. Excessively calling or messaging the borrower, or calling or messaging outside the prescribed hour from 8 AM to 7 PM.
5. Making threatening and/or anonymous calls;
6. Intimidating or harassing the borrower, guarantor, their relatives, referees, friends, or co-workers in verbal, physical, or any other manner, including acts intended to publicly humiliate them or intrude upon their privacy
7. Using or threatening violence or similar means to harm the borrower or guarantor, their family, assets, or reputation
8. Making false or misleading representations to the borrower or guarantor, especially about the extent of the debt or the consequences of non-repayment

Where do the rules fall short?

1. Outgoing calls not protected: While the RBI has barred lenders from blocking functions such as internet access, incoming calls, emergency SOS features, and government notifications, features including outgoing calls and UPI payments can still be restricted if a borrower defaults on their loan.

For a small vendor or a daily wage worker whose income depends on their phone, for instance, someone who receives payments via UPI or stores essential documents such as a ration card on DigiLocker, device restrictions may make repayment more difficult, not easier.

2. The shared WhatsApp group problem: “The disclosure of any borrower’s/guarantor’s information to its employees/recovery agencies is limited to the extent required to enable them to discharge their loan recovery-related duties,” the RBI’s draft amendment rules state.

A recovery agency handling accounts for multiple banks may send agents into the field for debt collection. These recovery agents often coordinate with each other through WhatsApp groups for operational convenience, where they may share information about borrowers, including names, addresses, phone numbers, loan amounts, and employer details.

When agents working for one bank can access the data of another bank’s borrower, it violates the “limited to the extent required” provision. However, there is no audit trail or liability framework for misuse of information shared through these WhatsApp groups. Moreover, the bank itself may have no visibility into how the recovery agency internally communicates borrower information.

3. Incentive-driven data leak: A recovery agent is often paid per resolution. Therefore, to maximise collections, an agent may share a defaulting borrower’s employer details and outstanding loan amount with workplace contacts, not necessarily to harass the borrower, but to “facilitate” repayment.

This remains a regulatory grey zone that the revised draft rules do not address.

Also Read:

• Lowdown: RBI’s new advisory pushes for tighter data use, AI safeguards, vendor checks
• Explained: How the RBI Draft Amendments Seek to Curb Dark Patterns in Banking
• RBI mulls bringing e-commerce marketplaces within its regulatory ambit: Payments Vision 2028 report