The draft norms also bar lenders from disabling essential features such as internet access, incoming calls, emergency SOS services and public safety notifications