The Reserve Bank of India (RBI) has introduced a major overhaul of its loan recovery framework, placing stricter limits on recovery practices adopted by banks and financial institutions. The revised draft norms prohibit lenders and recovery agencies from blocking borrowers’ mobile phones or using social media and public disclosures as tools for recovery pressure. The implementation of the framework has been deferred from July 1, 2026 to October 1, 2026 to provide institutions with additional time for compliance.
The revised framework seeks to strengthen borrower rights while balancing lenders’ recovery interests through technology-driven and conduct-based safeguards. The move comes amid increasing concerns over aggressive recovery mechanisms and privacy violations in digital lending and recovery processes.
Under the amended rules, financial institutions may restrict access to a financed device only after obtaining explicit contractual consent from borrowers. Even in such cases, restrictions cannot be imposed immediately after a missed payment. Lenders will be required to wait for a 90-day default cycle and follow a structured notice process consisting of a 60-day notice and an additional 7-day warning period before initiating such action.
Importantly, the RBI has mandated that essential device functions must remain available at all times. Core services such as incoming calls, internet access, SOS facilities and public alerts cannot be disabled. The central bank has sought to ensure that device restrictions do not compromise an individual’s safety or access to critical communication tools.
The revised norms further require lenders to unlock blocked devices within one hour after repayment. Failure to comply with this timeline may attract a compensation penalty of ₹250 per hour payable to borrowers.
The central bank has also placed significant emphasis on data privacy. Lenders and recovery agents will be prohibited from accessing borrower data stored on devices. Sharing borrower details on social media platforms or publicly disclosing creditor information for recovery purposes will also be banned.
Recovery practices involving humiliation or public pressure have come under stricter scrutiny. The amended framework broadens the definition of harsh recovery methods to include misuse of social media and unauthorised circulation of borrower information, recordings, or personal details.
The scope of recovery-related regulation has also been widened. Business correspondents involved in loan recovery activities and personnel handling routine EMI collections have been brought within the regulatory ambit, closing gaps that previously existed in the framework.
Further safeguards have been introduced concerning borrower interaction. Borrowers must receive prior communication through text messages or email at least one day before a recovery visit. Where digital communication is unavailable, a physical notice must be delivered at least three days in advance.
The RBI has also tightened the conduct standards applicable to banks and recovery agencies. Contact hours have been restricted to the period between 8:00 a.m. and 7:00 p.m. Banks will also be required to preserve call recordings for at least six months, and longer where disputes remain pending.
Additionally, lenders must establish compensation mechanisms to reimburse borrowers or guarantors for losses arising due to violations of the new directions.
The revised framework reflects the RBI’s growing focus on privacy protection, fair treatment of borrowers, and responsible recovery practices in an increasingly digital lending ecosystem. The three-month extension before implementation is expected to allow banks, non-banking financial companies and recovery agencies sufficient time to align their systems and procedures with the new regulatory standards.
