RBI Will Let Lenders Lock Financed Phones for Missed EMIs Starting January 1, 2027

The Reserve Bank of India has finalized a framework that lets banks and finance companies remotely restrict smartphones, laptops and tablets financed through EMI loans if borrowers stop paying. The rules take effect January 1, 2027, according to the Times of India, LiveMint, Business Today, and multiple other outlets that reviewed the final guidelines.

The RBI is formalizing a power that lenders have wielded informally for years, now putting regulatory guardrails around it.

What Changed and Why

Back in 2024, the RBI told lenders to stop locking borrowers' phones using apps installed at the time of purchase, according to the Times of India. Lenders kept doing versions of it anyway, and complaints piled up about harassment, intimidation over social media, and abusive language from recovery agents.

In May 2026, the RBI released a draft framework called "Conduct of Regulated Entities in Recovery of Loans and Engagement of Recovery Agents" and asked for public comment, the Times of India reported. The final rules, now locked in, are notably softer than that first draft.

News24online reported that the original proposal would have allowed lenders to disable financed devices after just 90 days of non-payment. After stakeholder pushback, the RBI extended borrower protections and moved the effective date from an initially planned October 1, 2026 start to January 1, 2027.

The Actual Rules

Lenders can only use this tool on devices bought specifically through a device loan. A personal loan, a car loan, a home loan, none of that gives a bank authority to touch your phone, according to the Times of India and Business Today. The loan agreement also has to spell out the restriction procedure in writing upfront.

No restriction can happen the moment an EMI is missed. Lenders have to wait a minimum of 30 days past due, and only after sending the borrower formal notice, according to Business Today and Dynamite News. Between 30 and 60 days overdue, lenders can gradually limit non-essential functions, but outgoing calls have to keep working during that window, per News24online.

Only after 60 days of non-payment can a lender impose the full restriction spelled out in the loan contract.

Even then, certain things can never be switched off: incoming calls, SMS, emergency SOS, and anything tied to the borrower's job or ability to earn a living, according to Analytics Insight and Dynamite News. The RBI clearly does not want this tool used to cut someone off from work or emergency services over a missed payment.

Privacy Lines Lenders Can't Cross

Lenders and any third-party tech vendor they use have to get certification from the device manufacturer or OS platform where available, according to News24online. They are explicitly barred from accessing contacts, photos, videos, texts, call logs, or location history. Restrictions can only touch device functions, not personal data, according to Dynamite News and Analytics Insight.

If a lender screws this up, restricts a device wrongly or drags its feet restoring access after a borrower pays up, there's a real financial penalty. Once dues are cleared, full functionality has to be restored within one hour. Miss that window and the lender owes the borrower Rs 250 per hour of delay, capped at the total loan amount, according to News24online.

The Broader Recovery Overhaul

This device-lock framework sits inside a much bigger rewrite of loan recovery conduct. LiveMint reported that recovery calls and field visits will generally be restricted to 8 AM to 7 PM, with anything outside that window requiring the borrower's own request or explicit consent.

Recovery agents are barred from abusive or threatening language, anonymous calls, repeated harassment, public shaming, or threats against a borrower's family or assets, per LiveMint. Agents also can't post a borrower's photos or personal information on social media to pressure repayment, closing off a tactic that had become common enough to draw regulatory attention in the first place.

Before a first in-person recovery visit, borrowers must get at least one day's notice, and banks have to disclose which recovery agency is handling their case, according to LiveMint. Agents showing up have to carry ID cards and authorization letters. Banks are also required to build a formal recovery policy and vet recovery agencies before hiring them, per Dynamite News and Business Today.

What's Still Open

The rule change is roughly four and a half months out. Between now and January 1, 2027, lenders have to build the compliance systems, and it remains to be seen how consistently smaller finance companies, not just big banks, actually enforce the 30/60-day timelines and the Rs 250-per-hour compensation rule in practice. The RBI hasn't detailed what enforcement or penalties apply to lenders who ignore the framework outright, beyond the delay-compensation clause. That gap warrants attention once the rules kick in.