Quick Take
- RBI now lets banks lock only financed phones, and only after a loan turns 30 days past due.
- Full restrictions need a 60-day default, and incoming calls, SMS and SOS must always work.
- Wrong locking costs banks Rs 250 per hour compensation, effective from January 1, 2027.
In This Article
The RBI Device Locking Rules allow banks to remotely restrict a financed phone only after the loan is 30 days overdue, and full restrictions need a 60-day default. The Reserve Bank of India (RBI) notified these norms on August 6, 2026, and they take effect from January 1, 2027.
The rules sit inside the Reserve Bank of India (Commercial Banks, Responsible Business Conduct) Fourth Amendment Directions, 2026. They replace scattered older instructions with a single loan recovery framework. The change matters because over one-third of consumer electronics in India are bought on small-ticket loans, and some lenders had locked phones with little notice. You can read the RBI’s own recovery-agent framework in its 2022 notification on recovery agents.
StartupFeed Insight
The real signal here is not the lock, it is the price of a wrong lock. By fixing compensation at Rs 250 per hour and a one-hour reversal window, the RBI turns sloppy recovery software into a direct cost centre for lenders. Fintech firms that built device-locking tools as a cheap collections shortcut will now need audit trails, OEM certification and consent clauses baked in. Watch small-ticket device financiers closely. We expect at least two large digital lenders to publicly revamp their collection stacks before the January 1, 2027 start date, or quietly pause device locking altogether. By Harshvardhan Jain.
What the new norms actually say
The RBI Device Locking Rules permit a lender to disable functions on a phone, tablet or laptop only when the loan was taken to buy that same device. StartupFeed notes the RBI has drawn a hard line here: a bank cannot lock your phone to recover a car loan, a home loan or an unrelated personal loan.
The loan agreement must also expressly permit the action and spell out the exact procedure. Banks and their technology partners cannot access personal data such as contacts, messages, call logs, photographs or location history for recovery. Borrowers keep the right to prepay the loan, in part or full, at any stage, according to the RBI.
RBI Device Locking Rules: the 30 and 60 day timeline
The RBI Device Locking Rules follow a phased approach, so restrictions cannot be applied all at once. The table below shows when each step is allowed under the RBI framework.
| Stage | What banks can do | Notes |
| Before 30 days past due | No restriction allowed | Borrower must first be served notices to repay |
| 30 to 60 days past due | Graduated curbs on non-essential functions | Outgoing calls cannot be blocked in this period |
| After 60 days past due | Full contractual restrictions permitted | Only functions listed in the loan agreement |
| Always protected | Incoming calls, SMS, emergency SOS | These cannot be blocked under any circumstance |
| On repayment | Restrictions removed within 1 hour | Rs 250 per hour compensation for bank-caused delay |
The most striking detail is the compensation cap. If a bank wrongly locks a device or fails to restore it after dues are cleared, the Rs 250 per hour penalty is capped at the full loan amount disbursed, the RBI said.
About the Reserve Bank of India
The Reserve Bank of India (RBI) is India’s central bank and chief banking regulator, established in 1935 and headquartered in Mumbai. It sets monetary policy, issues currency, and supervises banks and non-bank lenders. The RBI frames rules on lending, recovery and consumer protection for commercial banks, NBFCs and cooperative banks across the country.
What does this mean for borrowers?
For borrowers, the RBI Device Locking Rules add clear safeguards that did not exist before. Even when a phone is restricted, essential services must keep working, and borrowers must always be able to see the status of restrictions on their device.
Incoming calls, SMS services and emergency SOS functions must continue to work, and restrictions must not stop borrowers from doing work-related activities, the RBI stated in its directions.
This protects a borrower’s livelihood and safety during a repayment dispute. It also blocks the harshest tactic seen earlier, a phone going fully dark overnight. The one-hour reversal rule means a borrower who pays up should regain full use almost immediately, not days later.
Which lenders and devices are covered?
The RBI Device Locking Rules apply to commercial banks, but exclude Small Finance Banks, Payments Banks, Regional Rural Banks and Local Area Banks. Parallel directions cover NBFCs (Non-Banking Financial Companies) and other regulated lenders, so most firms financing consumer gadgets fall within scope.
| Rule area | Old practice | New requirement |
| Locking software | Varied third-party tools | OEM or OS-platform certification required |
| Recovery agents | Loosely supervised | IIBF-certified agents only |
| Recovery visits | Often unannounced | At least one day’s prior notice |
What makes this framework different is certification. Any locking software must now be certified by the device’s original equipment manufacturer or the operating system platform, which shuts out unreliable tools, the RBI said. Banks must also publish an updated list of empanelled recovery agencies on their websites. For historical context, the RBI’s 2010 guidelines on recovery agents first set out fair-conduct expectations that this framework now hardens.
What’s Next
Lenders have until January 1, 2027 to align their systems, consent forms and collection software with the new rules. Loan contracts signed on or after that date must carry the required restriction and grievance clauses. Existing device-financing contracts may need fresh consent before any lock is deployed. Will India’s largest digital lenders overhaul their recovery stacks in time, or step back from device locking entirely?
Frequently Asked Questions
Have a tip? Write to us at editorial@startupfeed.in.
