Key Facts
- Effective Date: 1 January 2027
- Press Release: 2026-2027/827, dated 6 August 2026
- Applies To: All Regulated Entities — Commercial Banks, SFBs, LABs, RRBs, UCBs, RCBs, AIFIs, NBFCs, HFCs
- Device Locking: Only allowed for loans specifically financing that device
- Timeline: No restrictions before 30 DPD; full lock only after 60 DPD
- Protected Features: Incoming calls, SMS, emergency SOS, work-related functionality
- Restoration: Within one hour of payment realisation
- Compensation: ₹250 per hour for delayed unlocking, capped at loan amount
- Recovery Agent Certification: Mandatory IIBF Debt Recovery Agent certificate
- Call Recording: All recovery calls must be recorded, preserved for 6 months
Direct Answer
On 6 August 2026, the Reserve Bank of India issued final Amendment Directions on ‘Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents’, effective 1 January 2027. The framework introduces comprehensive safeguards for borrowers, including strict rules on device locking, data privacy, recovery agent certification, and grievance redressal.
Lenders can only remotely restrict financed devices if the loan specifically financed that device, with restrictions beginning only after 30 days past due and complete locks only after 60 days. Essential services like incoming calls, SMS, and SOS must remain active.
Lenders cannot access personal data like photos, contacts, or location history. Devices must be restored within one hour of payment, with compensation of ₹250 per hour for delays.
Recovery agents must obtain IIBF certification, calls must be recorded and preserved for six months, and harassing recovery practices are explicitly prohibited.
In this article:
- The New Device Locking Rules: A Graduated Approach
- Privacy and Data Protection: What Lenders Cannot Access
- Restoration and Compensation: One-Hour Rule
- New Mandates for Recovery Agents
- Prohibited Recovery Practices
- What Lenders Must Do by 1 January 2027
- Compliance Timeline and Industry Feedback
- FAQ
By Adv. Shoeb Hakim — Criminal defence, AML, digital forensics, and cybercrime specialist; former General Counsel, Credit Suisse; training police and judiciary since 1996.
The New Device Locking Rules: A Graduated Approach
The RBI has introduced a “graduated approach” to device locking, replacing the earlier ad-hoc practices where lenders could disable devices immediately after missed EMIs.
Only Financed Devices Can Be Locked
A bank “shall not deploy any technology-based mechanism… which restricts or disables any of the functionalities of a mobile device of a borrower… except to recover its loan dues arising out from financing of such a device.”
This means:
- Device locking is only permitted if the loan was specifically taken to purchase that device
- Personal loans, credit card defaults, or other loans cannot trigger a phone lock
- The loan agreement must explicitly state the right to lock the device
The Graduated Timeline
The RBI explicitly mandates “a gradual approach rather than disabling the device, ab initio.”
| Days Past Due (DPD) | Permitted Action |
|---|---|
| < 30 DPD | ❌ Zero restrictions allowed |
| 30-60 DPD | ⚠️ Partial restrictions allowed (blocking specific non-essential apps); outgoing calls must remain active |
| 60+ DPD | 🔒 Full restrictions allowed; but incoming calls, SMS, and SOS must never be blocked |
Essential Services That Must Remain Active
Even after full device restrictions, lenders cannot render the device completely unusable. The following must always remain functional:
Privacy and Data Protection: What Lenders Cannot Access
The RBI has strictly prohibited lenders from accessing borrowers’ personal data for recovery purposes. This effectively bans the “predatory lending” practice of shaming borrowers by messaging their contact lists.
Specifically, lenders cannot access:
- Contact lists
- Photographs
- Videos
- SMS messages
- Call logs
- Location history
- Any other personal data unrelated to loan recovery
Data Disclosure Limits
The RBI directed banks to ensure that disclosure of any borrower’s/guarantor’s information to employees or recovery agencies is “limited to the extent required to enable them to discharge their loan recovery related duties.”
Protection from Shaming
The framework explicitly prohibits:
- “Public shaming on social media”
- “Contacting relatives, friends, or co-workers to harass borrowers”
- “Posting borrowers’ personal details, videos or audio recordings on social media”
Restoration and Compensation: One-Hour Rule
Fast Unlock Requirement
The RBI has established strict timelines for restoring device access after dues are cleared. Under the final guidelines, restrictions must be reversed “not later than one hour of realisation of the dues from the borrower.”
Important Clarification: The one-hour timeline was originally linked to the borrower “curing the default.” Lenders argued this was ambiguous, and the RBI accepted the suggestion to define the trigger as the “realisation of dues” by the lender. This means the clock starts only after funds are actually received, not when payment is initiated.
Compensation for Delayed Unlocking
If a lender fails to remove restrictions within the one-hour timeline:
- The lender must pay ₹250 per hour for delays attributable to the bank
- Total compensation payable to the borrower is capped at the amount of the loan disbursed
New Mandates for Recovery Agents
Mandatory IIBF Certification
All recovery agents must now hold a Debt Recovery Agent certificate from the Indian Institute of Banking and Finance (IIBF) or an equivalent recognised program. Uncertified agents are barred from interacting with borrowers.
Transition Period: Entities newly brought under the mandatory certification requirement will get an additional one year from the effective date for their existing recovery agents to obtain certification.
Background Verification
Lenders are directly responsible for:
- Conducting police verification and due diligence of recovery agents before appointment
- Periodically reviewing recovery agents
- Establishing mechanisms for monitoring, audits, and penal action
Identification Requirements
Borrowers must be informed before the first recovery visit, whenever the recovery agency changes, or if its engagement is terminated.
Recovery agents must:
- Carry valid identity cards
- Carry an authorisation letter issued by the bank or recovery agency
- Carry a copy of the notice issued by the bank
Call Recording Mandate
All recovery-related calls (both to and from borrowers) must be:
Prohibited Recovery Practices
The RBI has explicitly prohibited recovery agents and bank employees from using harsh recovery methods.
Explicitly Banned Practices:
- Abusive or threatening language
- Excessive calls or contacting borrowers outside permitted hours (8 AM-7 PM)
- Anonymous calls
- Public shaming or humiliation
- Contacting relatives, friends, or co-workers to harass borrowers
- Using social media to publish borrower information
- Intimidation or violence
- Making false or misleading representations regarding the debt
Inappropriate Occasions
Recovery agents must avoid inappropriate occasions such as:
Communication Boundaries
- Recovery calls or visits can normally be made only between 8 AM and 7 PM, unless the borrower specifically requests otherwise
- Agents must only communicate with the borrower or guarantor regarding the loan
What Lenders Must Do by 1 January 2027
Board-Approved Recovery Policy
Banks must formulate a board-approved policy on collection and recovery of loan dues. The policy should specify:
- Triggers for initiating recovery
- An escalation matrix
- Code of conduct for employees and recovery agents
- Procedures for handling cases involving borrower death
- A structured framework for borrowers facing financial distress
Recovery Agency Oversight
Banks remain responsible for ensuring outsourced recovery complies with RBI regulations. They must:
- Carry out due diligence before engaging recovery agencies
- Verify antecedents of recovery agents
- Periodically review them
- Establish mechanisms for monitoring, audits, and penal action
Grievance Redressal Mechanism
Banks must establish a dedicated recovery-related grievance redressal mechanism. Details of the grievance officer—including name, email address, telephone number, and address—must be:
Technology Certification
Lenders or their tech providers must obtain certification for their locking mechanism from:
- The Original Equipment Manufacturer (OEM) (e.g., Samsung, Xiaomi), or
- The operating system platform (e.g., Google/Android)
Explicit Consent
The loan agreement must contain a specific clause detailing the locking procedure, which the borrower must separately sign or consent to.
Compliance Timeline and Industry Feedback
Implementation Date
The regulations will be effective from 1 January 2027. The RBI had earlier proposed 1 October 2026, but extended the timeline “considering the technical and operational changes necessitated by the directions.”
Industry Feedback Incorporated
The RBI issued a draft on 20 May 2026 and received several suggestions, which were incorporated into the final framework:
💬 FREQUENTLY ASKED QUESTIONS (FAQ)
Q: What is the graduated timeline for device locking?
Ans: Zero restrictions below 30 Days Past Due (DPD); partial restrictions (blocking non-essential apps) between 30-60 DPD; full restrictions after 60 DPD, while preserving incoming calls, SMS, and SOS.
Q: Do recovery agents require special certification under these rules?
Ans: Yes. All recovery agents must hold a Debt Recovery Agent certificate from the Indian Institute of Banking and Finance (IIBF) or an equivalent recognized program.
Q: Are bank employees covered under the recovery agent restrictions?
Ans: No, the terms ‘recovery agency’ and ‘recovery agent’ do not cover lenders’ own internal employees engaged in recovery activities.
Q: What phone functions must remain active even during a full device lock?
Ans: Incoming phone calls, SMS services, emergency SOS functions, and features necessary for work and employment.
What are the new RBI rules on device locking?
The RBI’s new framework, effective 1 January 2027, regulates how lenders can remotely restrict financed smartphones, tablets, and laptops. Lenders can only lock devices if the loan specifically financed that device, with restrictions beginning only after 30 days past due and complete locks only after 60 days. Essential services like incoming calls, SMS, and SOS must remain active.
Can lenders lock my phone if I default on a personal loan?
No. The RBI has made it clear that remote restriction technology can only be used when the loan has been taken specifically to finance that device. A personal loan, consumer loan, or any other loan not directly linked to purchasing a device cannot trigger a phone lock.
When can lenders start restricting my financed device?
Device restrictions can begin only after the loan account remains overdue for at least 30 days. Even then, lenders must adopt a phased approach. Complete device restrictions can be imposed only after 60 days overdue.
What phone features must remain active even if my device is locked?
The RBI has prohibited lenders from blocking: incoming phone calls, SMS services, emergency SOS functions, and features necessary for work and employment.
Can lenders access my personal data during recovery?
No. Lenders and their recovery agents cannot access contacts, photos, videos, SMS, call logs, location history, or any other personal data unrelated to loan recovery.
How quickly must my device be unlocked after I pay my dues?
Lenders must reverse device restrictions within one hour of realisation of dues. If the delay is attributable to the bank, they must compensate you at ₹250 per hour, capped at the total loan amount.
What are the new rules for recovery agents?
All recovery agents must obtain IIBF Debt Recovery Agent certification. Recovery calls must be recorded and preserved for six months. Agents must carry valid ID, disclose their identity to borrowers, and follow a strict code of conduct.
What recovery practices are now prohibited?
The RBI has banned: abusive language, excessive calls, public shaming on social media, contacting relatives or coworkers to harass borrowers, calls outside 8 AM-7 PM, and false or misleading representations about the debt.
When do these rules take effect?
The regulations are effective from 1 January 2027. The RBI extended the timeline from the earlier proposed 1 October 2026 to allow for technical and operational changes.
What must lenders do by the effective date?
Lenders must: formulate a board-approved recovery policy, conduct due diligence on recovery agents, establish a grievance redressal mechanism, obtain OEM/OS certification for locking software, and ensure loan agreements contain explicit consent clauses for device locking.
Are bank employees covered under the recovery agent rules?
No. The RBI clarified that the terms ‘recovery agency’ and ‘recovery agent’ do not cover lenders’ own employees engaged in recovery activities.
What happens if a lender fails to comply with the new rules?
Borrowers can approach the Internal Grievance Redressal Officer, escalate to the RBI Ombudsman, or approach District Consumer Disputes Redressal Forums for severe violations or uncompensated delays.
KNOWLEDGE CHECK QUIZ
Q: When does the RBI’s new recovery and device locking framework officially take effect?
Ans: 1 January 2027.
Q: Can a lender lock your smartphone if you default on a personal loan or credit card?
Ans: No. Device locking is strictly restricted to loans specifically taken to finance that exact device.
Q: What personal data are lenders explicitly prohibited from accessing for recovery purposes?
Ans: Contact lists, photographs, videos, SMS messages, call logs, and location history.
Q: What is the financial penalty if a lender fails to unlock a device within one hour of payment realization?
Ans: ₹250 per hour of delay, capped at the total amount of the loan disbursed.
By Adv. Shoeb Hakim
Criminal defence, AML, digital forensics, and cybercrime specialist; former General Counsel, Credit Suisse; training police and judiciary since 1996.
📌 Connect: https://www.linkedin.com/in/shoebhakim | https://shoebhakim.com/shoeb-hakim-blog/
📌 Visit my website for more articles: https://www.shoebhakim.com
📌 Visit my website for legal knowledge: https://www.vakilverse.com
📌 Visit my website for research fellowship: https://www.legalcomplaince.in
Disclaimer: This content is for informational purposes only and does not constitute legal advice. Readers should consult qualified legal counsel for advice on their specific circumstances.
#AdvShoebHakim #RBI #LoanRecovery #DeviceLocking #DigitalLending #BorrowerRights #ConsumerProtection #FinancialCrime #Compliance #BankingRegulation #IIBF #Vakilverse #LegalComplianceIN
Author:
Adv. Shoeb Hakim
Author Bio (for schema markup):
Adv. Shoeb Hakim is a Mumbai-based criminal defence, AML, digital forensics and cybercrime specialist. Former General Counsel at Credit Suisse. Has been training police and judiciary since 1996. Provides expert commentary on consumer protection, banking regulation, and financial crime.
Article Publisher:
Adv. Shoeb Hakim
Article Section:
Banking Regulation | Consumer Protection | Financial Crime | RBI Guidelines
Article Tags:
RBI, device locking, loan recovery, borrower protection, financed devices, smartphone loan, recovery agents, IIBF certification, data privacy, compensation, regulated entities, Adv Shoeb Hakim