Fintech Brief — August 11, 2026 RBI Finalises Landmark Recovery Guidelines for NBFCs — Device-Locking Gets Strict Guardrails The RBI issued its Third Amendment Directions to the NBFC — Responsible Business Conduct framework on August 6 (Notification DOR.MCS.REC.No.199/01-01-039/2026-27), effective 1 January 2027. The final text transforms debt recovery from an outsourced back-office function into a governed, audited, and accountable process.
Key provisions:
Device-locking rules: NBFCs financing smartphones/laptops may only restrict devices tied to the specific loan, after 30 days past due. Full restrictions kick in at 60 days. Essential functions — incoming calls, SMS, emergency SOS — can never be cut off. Unlocking must happen within one hour of payment; wrongful delays attract compensation of ₹250 per hour, capped at the loan amount. No data access: Neither the NBFC nor its tech partner may access personal data (contacts, photos, location) on the borrower’s device. Recovery agent certification: All agents must hold an IIBF Debt Recovery Agents certificate. Existing agents get a one-year grace period. Transparency: NBFCs must publish empanelled recovery agencies on their websites. Borrowers must be notified of agency details at least one day before in-person visits. Contact hours restricted to 8 AM–7 PM. Borrower distress framework: Lenders must build a documented pre-escalation engagement process — a pause before pressure — for borrowers in genuine financial difficulty. Why it matters: This is the RBI’s most comprehensive recovery governance framework. Device-financing NBFCs and small-ticket digital lenders face the biggest compliance lift. With barely four months to the January 1 deadline, NBFCs need to start re-papering loan agreements, re-onboarding vendors, and building grievance channels now.
...