RBI tightens loan recovery rules to protect borrowers

New rules coming into force from January 2027 seek to protect borrowers from coercive recovery practices, strengthen lender accountability, regulate recovery communications and establish safeguards for remotely restricting financed electronic devices.

The Reserve Bank of India (RBI) has introduced a detailed framework governing loan recovery practices, putting greater emphasis on borrower protection, privacy and accountability among banks and other regulated lenders. The new provisions will take effect from January 1, 2027, and establish specific standards for recovery agents, including how they contact borrowers and conduct physical visits.

Under the framework, recovery calls and visits will generally be allowed between 8 AM and 7 PM. Contact outside this window will require a borrower’s prior request or explicit consent. Recovery agents have also been directed to exercise sensitivity when dealing with borrowers facing exceptional circumstances, including bereavement, medical emergencies or significant family occasions.

The RBI has prohibited threatening, abusive or intimidating behaviour during recovery efforts. Agents cannot use anonymous calls, repeatedly contact borrowers to harass them, publicly shame them or threaten borrowers by referring to their families, assets or reputation.

Greater accountability for recovery agencies

The new framework places tighter restrictions on the use of personal information during recovery. Agents cannot use social media or other platforms to distribute borrowers’ photographs, videos, audio recordings or personal details as a means of pressuring them to repay loans.

Physical recovery visits will also require greater transparency. Borrowers must receive at least one day’s notice before the first visit by a recovery agency, while lenders must disclose which agency has been assigned to the account. Borrowers should generally be approached at a location of their choice. Where no location has been specified, or repeated attempts to meet at the agreed location fail, agents may visit the borrower’s home or workplace.

During such visits, agents must carry valid identification, an authorisation letter and the relevant recovery notice. The authorisation document must also provide contact details for the recovery agency and the lender’s grievance redressal officer.

The RBI has made lenders responsible for monitoring outsourced recovery operations. Banks must record recovery-related conversations and maintain information such as telephone numbers and call timings, with records generally retained for at least six months. Lenders must also train recovery personnel and review incentive systems to ensure they do not promote aggressive collection methods.

Rules for remote device restrictions

The framework also introduces specific safeguards around the remote restriction of financed smartphones, tablets and laptops. Such restrictions will be permitted only when the loan was taken specifically to purchase the device and not when the equipment was financed through an unrelated loan.

A device cannot be restricted merely because an EMI has been missed. Remote restriction can begin only after the loan has remained overdue for at least 30 days, while complete restriction is permitted only after 60 days of continued default.

Even then, essential functions such as incoming calls, SMS and emergency communications must remain available. Lenders are also prohibited from using remote-access technology to collect unrelated personal information, including contacts, photographs, videos, messages, call records or location data.

Once dues are cleared or the account is regularised, lenders must restore full functionality promptly, ordinarily within one hour. Delays may attract compensation of ₹250 per hour, subject to the prescribed maximum linked to the outstanding amount.

Borrowers must also be informed upfront about any possibility of remote device restriction, with such conditions clearly disclosed rather than buried in loan documentation.