RBI’s Digital Lending Guidelines and Device Locking: What Borrowers Need to Know

Introduction

Digital lending has made borrowing money easier than ever. People can apply for personal loans, purchase smartphones on EMIs, and receive credit through mobile applications without visiting a bank. But what happens when someone misses a payment?

This question has become more important as lenders adopt technology that can remotely restrict the functions of smartphones and other electronic devices purchased through loans.

The Reserve Bank of India (RBI) has introduced rules to address these concerns. Its Digital Lending Directions, 2025, establish protections for digital borrowers, while separate loan-recovery amendments issued on August 6, 2026, specifically regulate device locking.

The key point: Under the new recovery framework, lenders cannot lock just any phone to recover unpaid debt. Device restrictions are permitted only in qualifying device-financing arrangements and must follow strict safeguards.

The updated recovery rules are scheduled to take effect on January 1, 2027.

Quick Facts

Particular	Details
Regulatory authority	Reserve Bank of India (RBI)
Main digital lending framework	RBI Digital Lending Directions, 2025
Digital lending directions issued	May 8, 2025
Device-locking amendments issued	August 6, 2026
New recovery rules effective	January 1, 2027
Devices covered	Financed smartphones, tablets, laptops and similar devices
Earliest restriction	After 30 days overdue, subject to conditions
Full permitted restrictions	After 60 days overdue
Essential features	Incoming calls, SMS and emergency SOS must remain accessible
Device restoration	Within one hour after the lender receives the overdue payment
Compensation for wrongful locking	₹250 per hour, capped at the loan amount disbursed

Understanding India’s Digital Lending Regulations

Digital lending involves obtaining and servicing loans through digital platforms. These may include banking applications, fintech services and online lending marketplaces.

Instead of submitting physical documents at a bank branch, borrowers can complete much of the process electronically.

This has improved access to credit. However, digital lending also introduced concerns about hidden charges, excessive data collection, misleading loan offers and aggressive debt recovery.

The RBI responded by strengthening its regulatory framework.

Its Digital Lending Directions, 2025, brought earlier instructions together and introduced additional requirements for regulated lenders and their service providers.

These directions cover several important areas:

• Clear disclosure of interest rates and loan charges.
• Protection of borrowers’ personal information.
• Responsible collection and recovery practices.
• Transparency in lending arrangements involving third parties.
• Complaint-handling procedures.
• Borrower rights when accepting and repaying digital loans.

A lender cannot avoid its regulatory responsibilities simply by outsourcing lending activities to a financial technology company or recovery service.

What Is Device Locking in Digital Lending?

Device locking refers to technology that allows a lender or its authorised technology provider to restrict certain functions of an electronic device when the borrower fails to meet agreed repayment obligations.

For example, a customer purchases a smartphone using a financed EMI plan.

The financing arrangement may include software capable of limiting specific device functions if payments become overdue.

Such technology can give lenders additional control over financed equipment.

However, smartphones are no longer used only for communication.

People rely on them for banking, education, employment, emergency services and everyday activities.

A disabled phone could prevent someone from earning money or accessing important information.

That is why unrestricted remote device locking raises serious consumer-protection concerns.

Can Banks Lock a Smartphone for Unpaid EMIs?

Under the RBI’s updated recovery framework, lenders may restrict a financed device only when specific conditions are satisfied.

The device must have been purchased using the relevant loan.

The loan agreement must clearly permit technology-based restrictions and explain the applicable procedure.

The borrower must receive the required repayment notices, including information about the restrictions that may follow.

Most importantly, restrictions cannot begin immediately after a missed instalment.

A lender cannot use device-locking technology to disable an unrelated personal phone simply because a borrower has defaulted on another loan.

For instance, defaulting on a general personal loan does not give the lender automatic authority to restrict a smartphone that was not financed through that loan.

The RBI’s framework distinguishes between recovering money owed for a financed electronic device and using an unrelated device as pressure for repayment.

When Can a Lender Restrict a Financed Device?

The August 2026 rules establish a staged approach.

Loan repayment status	Permitted action under the new framework
Less than 30 days overdue	No technology-based device restrictions
30 days overdue	Gradual restrictions may begin after the required notices and other conditions
Between 30 and 60 days	Limited restrictions may apply, but outgoing calls cannot yet be restricted
After 60 days overdue	The full set of contractually permitted restrictions may apply
After overdue dues are received	Restrictions must be reversed within one hour

The lender must follow the actual loan agreement and regulatory requirements. Reaching a particular number of overdue days does not automatically authorise restrictions without the required notices.

The rules also require lenders to apply restrictions gradually rather than disabling the device completely at the first opportunity.

Which Phone Features Must Remain Accessible?

One of the strongest borrower protections concerns essential device functions.

Even when restrictions are otherwise permitted, lenders must protect features that are necessary for safety and basic communication.

These include incoming telephone calls, SMS messages and emergency SOS functionality.

Restrictions also cannot deny borrowers access to activities connected with their work or employment.

This is particularly important for delivery workers, drivers, freelancers, online sellers and other people who depend on smartphones to earn an income.

Imagine a delivery worker who purchased a phone through an EMI plan.

If the lender restricts the device in a way that prevents the worker from performing their job, the action could conflict with the new safeguards.

The purpose of the regulations is not to eliminate a lender’s ability to recover legitimate dues. It is to prevent recovery methods from causing unnecessary harm.

Can Loan Apps Access Personal Data?

Privacy is another major concern in digital lending.

Some borrowers worry that lenders may access contacts, photographs, text messages or location information through software installed on financed devices.

The RBI’s recovery amendments expressly prohibit lenders and their device-locking technology providers from accessing or using personal data stored on a borrower’s device.

Protected information includes:

• Contacts and telephone numbers.
• SMS messages and call logs.
• Personal photographs.
• Location history.
• Other personal information stored on the device.

The restriction applies to data use for loan recovery or any other purpose under the device-locking provisions.

Separately, the Digital Lending Directions require regulated lenders to follow consent-based and need-based data collection practices.

Digital loan applications must not treat access to unrelated personal information as an unrestricted condition of obtaining credit.

What Happens After the Borrower Pays?

A borrower who clears the overdue amount should not remain locked out of permitted device functions indefinitely.

Under the updated framework, the lender must reverse the restrictions promptly and no later than one hour after it receives the overdue dues.

This distinction matters.

The restoration period is linked to the lender’s receipt of payment, rather than merely the moment a borrower starts a transaction.

Once the entire loan has been repaid, the lender must also give up control over the device-locking mechanism or disable that mechanism as applicable.

If the borrower needs to uninstall software, the lender must explain the necessary steps.

The borrower also retains the right to make partial or full prepayments at any stage.

Compensation for Wrongful Device Locking

The RBI has also introduced a financial consequence for lenders that wrongly restrict devices or fail to restore their functions within the required timeframe.

The compensation rate is ₹250 per hour.

This applies when a restriction is wrongful or when a delay in reversing it is attributable to the lender.

However, total compensation is capped at the amount of the loan originally disbursed.

For example, if a lender is responsible for a qualifying five-hour delay, the hourly calculation would be ₹1,250, subject to the applicable compensation cap.

Borrowers should preserve payment receipts, screenshots, restriction notices and relevant communications when making a complaint.

These records can help establish when payment was received and when the device became usable again.

RBI Rules for Recovery Agents

The device-locking provisions form part of a wider effort to regulate loan recovery.

The RBI’s updated rules require lenders to strengthen oversight of recovery agencies and their representatives.

Recovery agents must follow conduct requirements designed to prevent harassment, intimidation and misleading recovery practices.

The framework also addresses recovery-call records, identification of recovery agencies and advance communication before certain in-person visits.

Lenders remain responsible for monitoring the conduct of recovery agencies acting on their behalf.

A borrower who misses an EMI still has a repayment obligation.

But missing a payment does not mean losing the right to fair treatment.

Why These Regulations Matter for Fintech Companies

The new rules affect more than borrowers.

Banks, non-banking financial companies, lending platforms and technology providers involved in device financing must examine how their products operate.

A company offering smartphone financing needs to consider whether its agreements clearly describe any device-locking conditions.

Its technology must also support gradual restrictions, protect essential functions and allow timely restoration.

Where certification is provided by the device manufacturer or operating-system platform, the RBI’s recovery framework requires the locking mechanism to obtain that certification.

Companies must also prevent their technology partners from accessing borrowers’ personal information through the device-locking system.

These requirements mean that compliance cannot depend only on written policies.

It must be reflected in the actual software, customer communications and recovery procedures.

How Borrowers Can Protect Themselves

Before accepting a smartphone loan or digital financing offer, borrowers should read the agreement carefully.

Check whether the contract contains a device-restriction clause. Understand which features may be affected and when those restrictions can legally begin.

Review the Key Facts Statement, repayment schedule, annual percentage rate and applicable charges.

Borrowers should also verify the identity of the regulated lender behind a lending application.

If a payment becomes difficult, contacting the lender early may help identify available repayment options.

If restrictions are imposed, keep copies of notices and records of any outstanding payment.

Where a device is locked incorrectly, submit a written complaint to the lender’s grievance redressal officer.

If the complaint remains unresolved or no satisfactory response is received within the applicable period, eligible borrowers may seek redress through the RBI’s complaint mechanism.

The RBI’s Complaint Management System is available at https://cms.rbi.org.in.

Digital Lending and Consumer Rights in India

India’s digital lending market continues to change how people borrow and repay money.

For many customers, instant financing and affordable monthly payments can make electronic devices more accessible.

But technology also creates new risks when it gives financial companies control over products people use every day.

The RBI’s framework attempts to balance those interests.

Lenders have legitimate reasons to recover outstanding loans. Borrowers have legitimate expectations of privacy, fair notice and uninterrupted access to essential services.

The 2025 digital lending requirements and 2026 recovery amendments address different parts of that relationship.

Together, they establish clearer expectations for responsible digital credit.

Final Thought

RBI’s digital lending framework makes one thing clear: loan recovery must operate within defined consumer-protection boundaries.

The updated device-locking provisions do not give lenders unrestricted power over borrowers’ smartphones.

Restrictions must relate to the financed device, follow contractual and notice requirements, and respect protections for essential functions, employment and personal data.

With the new recovery rules taking effect on January 1, 2027, borrowers and lending companies have a clearer picture of how technology-based debt recovery will be regulated.

For consumers, understanding these rules before signing an EMI agreement is the best starting point.

Frequently Asked Questions

1. What are RBI’s digital lending guidelines?

They are regulatory requirements governing digital loans, including loan disclosures, borrower consent, data protection, repayment processes and complaint handling.

2. Can a lender remotely lock my smartphone for missing an EMI?

Under the updated rules taking effect in January 2027, this may be permitted only for a qualifying device-financing loan, subject to contractual, notice and timing requirements.

3. Can my phone be restricted after one missed EMI?

Not immediately. The new framework prevents restrictions before the relevant loan becomes at least 30 days overdue, and additional conditions must be satisfied.

4. Can a lender block emergency calls?

No. Incoming calls, SMS and emergency SOS functions are protected under the updated device-locking requirements.

5. Can a loan recovery app access my contacts and photos?

The device-locking provisions prohibit lenders and their technology partners from accessing or using personal information stored on the device.

6. How quickly must a lender unlock a phone after payment?

Under the new framework, permitted restrictions must be reversed within one hour after the lender receives the overdue dues.

7. Is compensation available for wrongful phone locking?

Yes. The updated rules provide compensation of ₹250 per hour for qualifying wrongful restrictions or lender-attributable restoration delays, capped at the amount of the loan disbursed.

8. When do the new RBI device-locking rules take effect?

The recovery amendments issued in August 2026 are scheduled to become effective on January 1, 2027.