The Reserve Bank of India (RBI) has barred lenders from using technology to disable a borrower's mobile phone, tablet or laptop as a recovery tool, except when the device itself was financed through a loan, according to Business Today. The new framework, which will come into effect from January 1, 2027, replaces earlier draft norms and follows rising borrower complaints of harassment in the recovery process, including intimidation through social media and the use of abusive language.
RBI’s device-lock rules: what lenders may and may not do
"A bank shall not deploy any technology-based mechanism...which restricts or disables any of the functionalities of a mobile device of a borrower such as mobile phone, tablet and laptop as a recovery tool, except to recover its loan dues arising out from financing of such a device," RBI said in the final norms, as reported by Business Today. Even for financed devices, restrictions must be gradual and follow a defined timeline.
| Overdue period | What lenders can do |
|---|---|
| Less than 30 days | No action on the device; lender must send a formal notice |
| 30–60 days | Gradual restrictions may be introduced |
| More than 60 days | Full contractual restrictions can be imposed |
Any device-locking software used must be certified by the original equipment manufacturer or the operating system provider, Business Today reported. Restrictions cannot block outgoing or incoming calls, SMS, Emergency SOS, or any functionality impacting work or employment. Lenders are also barred from accessing contacts, photos, call logs, location history or SMSes on the borrower's device.
Timeline to January 1, 2027
The final norms build on earlier regulatory actions. In 2024, RBI asked lenders to stop locking phones of defaulting borrowers, a practice lenders had implemented through an app installed at the time of loan issuance. In May this year, the central bank released a draft framework titled "Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents" and invited comments from stakeholders, according to Business Today. The final norms have now been released and take effect on January 1, 2027.
A bank shall not deploy any technology-based mechanism...which restricts or disables any of the functionalities of a mobile device of a borrower such as mobile phone, tablet and laptop as a recovery tool, except to recover its loan dues arising out from financing of such a device.
Borrower rights and lender obligations
Once the borrower repays the overdue amount, the lender must unlock the device within one hour. Any delay on the lender's end requires compensation of Rs 250 per hour, up to the amount of the loan. Additionally, no uncertified recovery agents will be allowed to interact with borrowers, Business Today reported.
The rules also clarify that devices bought through loans for purposes other than financing that specific device — such as home, car or personal loans — cannot be disabled at all. A study by Home Credit Finance cited by Business Today found that the single biggest reason for borrowing in 2025 remained the purchase of smartphones and home appliances, underscoring the relevance of these protections for consumers.
The framework introduces direct cost implications for lenders: certified software requirements raise compliance spending, the Rs 250-per-hour compensation creates a penalty for operational delays, and the prohibition on accessing borrower data limits recovery-enforcement options. For regulated entities, the January 2027 deadline provides a window to update recovery protocols, vendor contracts and software certification processes before the rules are enforced.
Sources:
