Company : Sol Infotech Pvt. Ltd. Website : www.courtkutchehry.com Credit Information Companies Regulations, 2006 CONTENTS CHAPTER 1 :- PRELIMINARY 1. Short title and commencement 2. Definitions CHAPTER 2 :- SPECIFIED USERS 3. . CHAPTER 3 :- REGISTRATION OF COMPANIES AS CREDIT INFORMATION COMPANIES 4. Submission of application by companies for grant of certificate of registration 5. Grant of certificate of registration CHAPTER 4 :- BUSINESS OF CREDIT INFORMATION COMPANIES 6 . Form of business in which credit information companies may engage CHAPTER 5 :- COLLE CT I ON, FURNISHING OF CREDIT INFORMATION AND PURPOSES THEREOF 7. Form of notice for collection and furnishing of credit information 8. Extension of time for providing credit information. 9. Permissible uses of credit information CHAPTER 6 :- PRIVACY PRINCIPLES 10. . 11. Principles and procedures relating to personal data CHAPTER 7 :- MAXIMUM AMOUNT OF FEES 12. . SCHEDULE 1 :- . Credit Information Companies Regulations, 2006 In exercise of the powers conferred by section 37 of the Credit Information Companies (Regulation) Act, 2005 (30 of 2005), the Reserve Bank of India hereby makes the following regulations, namely:- CHAPTER 1 PRELIMINARY 1. Short title and commencement :- (1) These regulations may be called the Credit Information Companies Regulations, 2006. (2) They shall come into force on the date of their publication in the Official Gazette. 2. Definitions :- (1) In these regulations, unless the context otherwise requires, - (a) "Act" means the Credit Information Companies (Regulation) Act, 2005, (30 of 2005); (b) "collector" means a credit institution, or a credit information company, or a specified user, as the case may be, which collects data, information, or credit information in respect of a borrower, or a client; (c) "commodity exchange" means an association or a company or any other body corporate organising futures trading in commodities for which license has been granted by the Forwards Markets Commission established under the Forward Contract (Regulation) Act, 1952, (74 of 1952); (d) "data management service" means the service of collecting, storing, devising systems for retrieving, collating, analysing and distributing, publishing, disseminating data, information, and providing of other inputs by a credit information company to its members and specified users; (e) "Form" means a form appended to the Schedule to these regulations; (f) "fees" means such amount as is payable by a credit institution, or a credit information company, as the case may be, to a credit information company, towards membership fees or annual fees; (g) "Government Securities" means a security created and issued by the Central Government or a State Government for the purpose of raising a public loan in a form specified in the Public Debt Act, 1944 (18 of 1944) and the government securities as included in the definition of securities in the Securities Contracts (Regulation) Act, 1956 (42 of 1956); (h)"Insurance Regulatory and Development Authority" means the Insurance Regulatory and Development Authority established under S.3 of the Insurance Regulatory and Development Authority Act, 1999 (41 of 1999); (i)"Securities" means securities as defined in clause (h) of S.2 of the Securities Contracts (Regulation) Act, 1956 (42 of 1956). (j)"Securities and Exchange Board of India" means the Securities and Exchange Board of India established under S.3 of the Securities Exchange Board of India Act 1992 (15 of 1992); (k) "Telecom Regulatory Authority of India" means the Telecom Regulatory Authority of India established under S.3 of Telecom Regulatory Authority of India Act, 1997 (24 of 1997); (l) "trading member" means and include a member, a broker or a stock broker, who has been admitted as such by National Stock Exchange or Bombay Stock Exchange and who holds a registration certificate as a stock broker from the Securities and Exchange Board of India; (2) Words and expressions used in these regulations and not defined herein but defined in the Act, or the rules shall have the same meanings respectively assigned to them in the Act or the rules. CHAPTER 2 SPECIFIED USERS 3. . :- In addition to the specified user as provided in clause (l) of Section 2 of the Act, the following companies shall also be regarded as a specified user, namely:- (a) an insurance company as defined in the Insurance Act, 1938 (4 of 1938) and registered with the Insurance Regulatory and Development Authority; (b) a company providing cellular or phone services and registered with the Telecom Regulatory Authority of India; (c) a credit rating agency registered with the Securities and Exchange Board of India; (d) a stock broker as defined in the Securities and Exchange Board of India (Stock Brokers and Sub-Brokers) Regulations 1992 and registered under S.12 of the Securities and Exchange Board of India Act, 1992 (15 of 1992); (e) a trading member registered with a recognized commodity exchange; (f) the Securities Exchange Board of India; and (g) the Insurance Regulatory and Development Authority. CHAPTER 3 REGISTRATION OF COMPANIES AS CREDIT INFORMATION COMPANIES 4. Submission of application by companies for grant of certificate of registration :- Every application by a company for grant of certificate of registration under Section 4 of the Act shall be made in form A to the Chief General Manager-in-Charge of Department of Banking Operations and Development of the Reserve Bank at Central Office Building, Mumbai 400 001, or to such other office and officer of the Reserve Bank as may be specified by it in this behalf. 5. Grant of certificate of registration :- (1) If, on consideration of the particulars furnished by an applicant company, the Reserve Bank is satisfied that the conditions as specified in sub-section (1) of Section 5 of the Act are generally fulfilled and the company is in a position to fulfill the remaining conditions, it may - (a) grant 'in-principle approval' to such applicant company and provide time to the company, not exceeding three months, for fulfilling the conditions included therein; and (b) in any particular case the Reserve Bank may grant further extension of such time not exceeding three months for the purpose of fulfillment of the conditions stipulated in the 'in- principle approval', where it is satisfied with respect to the cause for failure of the company to fulfill such conditions within the time so provided. (2) The Reserve Bank may, after being satisfied that the conditions as per sub-section (2) of Section 5 of the Act and sub-regulation (1) are fulfilled, grant a certificate of registration in form 'B' to the applicant company to commence or carry on the business of credit information, as the case may be, and may also impose such other conditions as it may consider fit. CHAPTER 4 BUSINESS OF CREDIT INFORMATION COMPANIES 6. Form of business in which credit information companies may engage :- I n addition to the business of credit information, and subject to such conditions as specified in these regulations, credit information companies may engage in any one or more of the following forms of business, namely :- (a)providing to any person his own credit credit information; (b) providing data management services to its member credit institutions; (c) collecting, processing, collating and disseminating data, relating to properties mortgaged to credit institutions; (d) collecting, processing, collating and disseminating data relating to investments made by its member credit institutions in securities other than government securities; (e) collecting, processing, collating data , relating to, frauds perpetrated in borrowal accounts of credit institutions and money laundering, and dissemination thereof to its members and specified users. CHAPTER 5 COLLECTION, FURNISHING OF CREDIT INFORMATION AND PURPOSES THEREOF 7. Form of notice for collection and furnishing of credit information :- (1) A notice required to be issued by a credit information company or any person authorised in that behalf by the company under sub- section (1) of Section 17 of the Act for collection of credit information from its member credit institutions or credit information companies, as the case may be, shall be sent in form C or as near thereto. (2) Every credit information company shall adopt a format with the approval of the Reserve Bank, for collecting credit information and forward the format to its member credit institutions or credit information company, as the case may be, along with the notice in form C sent to them for collecting credit information. (3) On receipt of such notice and format, the addressee credit institution or credit information company, as the case may be, shall furnish credit information in the format received along with the notice issued by the credit information company. 8. Extension of time for providing credit information. :- (1) In case a credit institution or a credit information company, as the case may be, for any justifiable reason, is not able to comply with the notice sent by a credit information company as per sub- regulation (1) of regulation 7 within the time stipulated therein, it may approach the concerned credit information company in writing for extension of time to comply with the same. (2) If the concerned credit information company is not satisfied with the reasons submitted by the member credit institution or the member credit information company, as the case may be, for their failure to comply with the notice sent by a credit information company as per sub-regulation (1) of regulation 7, in such case the credit information company shall refer the matter to the Reserve Bank and the decision of the Reserve Bank shall be final in this regard. 9. Permissible uses of credit information :- (1) Credit information shall be provided by every credit information company to a specified user as per sub-section (3) of Section 17 of the Act, for the following purposes, namely:- (a) to make effective credit decisions; (b) to deter concurrent borrowers and serial defaulters; (c) to keep adverse selection of customers to the minimum; (d) to review and evaluate risk of its customers; (e) to effectively discharge their statutory and regulatory functions; (f) to effectively discharge the functions as a credit rating agency; (g) generally in relation to and for purposes of taking credit decision, or for judging credit worthiness of a borrower or a client, as the case may be; (h) to take a credit decision on a person who accepts liability for payment on a bill of exchange drawn by another person who has applied to the specified user for availing new credit facility or for review or renewal or enhancement or of extension, as the case may be, of his existing credit facility granted by the specified user; (i) to take credit decision in relation to a person who draws a promissory note in favour of another person, or who has applied to a specified user for availing new credit facility or for review or renewal or enhancement or of extension, as the case may be, of his existing credit facility granted by any specified user; (j) to take credit decision in relation to a person who proposes to act as a guarantor for another person who has applied to a specified user for availing new credit facility or for review or renewal or enhancement or of extension, as the case may be, of his existing credit facility granted by the specified user; (k) to enable a person to know his own credit information. CHAPTER 6 PRIVACY PRINCIPLES 10. . :- In addition to the principles and procedures as provided in Section 20 of the Act, every credit information company, credit institution and specified user, shall adopt the following privacy principles in relation to their functioning, namely:- (a) Care in collection of credit information: (i) Every credit information company shall take all such necessary precautions, in respect of information received or collected by it so as to ensure that such information is - (A) properly and accurately recorded, collated and processed; and (B) protected against loss, unauthorised access, use, modification or disclosure thereof. (ii) Every credit institution shall - (A) keep the credit information maintained by it, updated regularly on a monthly basis or at such shorter intervals as may be mutually agreed upon between the credit institution and the credit information company; and (B) take all such steps which may be necessary to ensure that the credit information furnished by it, is update, accurate and complete. (b) Access to, and modification of, the credit information: (i) Every credit information company shall - (A) establish and adopt procedures relating to disclosure to a person, upon his request, his own credit information and subject to his satisfactory identification; and (B) provide reasonable time and opportunity to such person for establishing his identity and the credit information company may call for his personal attendance, if so necessary, and production of such other documents as may be necessary as proof of his identity. (ii) Every specified user on receipt of a request as per sub- section (3) of Section 21 of the Act, from a client or a borrower, as the case may be, for updating of his credit information, shall intimate about such request to the credit information company which had furnished such credit information to the specified user. (iii) Every credit information company on receipt of the intimation from a specified user, shall intimate about the request made by the borrower or the client, as the case may be, the credit institution which had furnished such credit information to the credit information company . (iv) Every specified user, credit information company, and credit institution, shall take prompt action in relation to updating of the credit information and to send the intimation and their response with proper co-ordination amongst them so as to ensure that the requisite action is taken in this behalf within the time limit as provided under sub-section (3) of Section 21 of the Act. (c) Data use limitation : Obligation to disclose.- Every specified user, in case of denying credit or any other service to a borrower or a client, as the case may be, on the basis of his credit information report within thirty days of its such decision shall - (A) send a written intimation to such borrower, or the client about the rejection ; (B) include in such intimation the specific reasons for rejection; (C) forward a copy of the credit information report relied upon for such decision; and (D) also provide the name and address of the credit information company which had provided the credit information report to the borrower or client, as the case may be. (d) Length of preservation of credit information: (i) every credit information company and credit institution shall retain credit information collected, maintained and disseminated by them for a minimum period of seven years. (ii) Every credit information company and credit institution shall develop guidelines and procedures to be adopted by them, with the approval of the Reserve Bank in respect of preservation and destruction of credit information. 11. Principles and procedures relating to personal data :- (1) Every credit institution, credit information company and specified user, as the case may be, shall adopt the following principles and procedures in respect of; (a) the manner and purpose of collection of personal data; (b) solicitation of personal data from individual concerned; (c) their extent of accountability; and (d) for redressal of grievances of individuals in respect of personal data. (2) Manner and purpose of collection of personal data. - No credit institution or credit information company, or specified user, as the case may be shall collect, or publish or disclose, personal data except for the purposes relating to their functions: (a) as per the provisions of the Act, or their activities incidental or relating to their such functions; or (b) in relation to their capacity and function as an employer of an individual who is or has been in their employment. (3) Solicitation of personal data from an individual. - In case of collection and use of personal data as per this regulation, by a credit institution, credit information company, or a specified user, as the case may be, they shall take such steps as are, in the circumstances, reasonable to ensure that, before such data is collected or, if that is not practicable, as soon as practicable after such data is collected - (a) the individual concerned is informed of the purpose for which such data is being collected, or disclosed, or used, as the case may be; and (b) such data maintained by them is protected against any loss, or unauthorized access, or use, or modification or disclosure, thereof. (4) Length of preservation of personal data. - (i) Every credit information company and credit institution shall retain personal data collected, maintained and disseminated by them for a minimum period of seven years. (ii) Every credit information company and credit institution shall develop guidelines and procedures to be adopted by them, with the approval of the Reserve Bank in respect of preservation and destruction of personal data. Explanation:- For the purpose of this regulation, "personal data" means such other data relating to an individual other than what a credit institution, or a credit information company, or a specified user, is permitted to collect as per the provisions of the rules made under the Act. CHAPTER 7 MAXIMUM AMOUNT OF FEES 12. . :- (1) Every credit information company shall be entitled to charge such amount, as it may deem appropriate, not exceeding Rs.15,00,000/- towards fee, from credit institutions or credit information companies for admitting them as their member. (2) Every credit information company shall be entitled to charge such amount, as it may deem appropriate, not exceeding Rs.15,00,000/- in case of member credit information company and Rs.50,000/- in case of member credit institution towards the annual fee. (3) Every specified user shall furnish a copy of the credit information to such person as referred to in sub-section (1) of Section 21 of the Act, subject to a charge of amount not exceeding Rs.50/-. (3) For providing to an individual his own credit information, a credit information company may charge such amount as it deems appropriate not exceeding Rs.100/-. (4) Every credit information company shall be entitled to charge from a specified user, such amount, as it may deem appropriate, not exceeding Rs.500/- for providing credit information report of an individual, and Rs 5000/- for others. SCHEDULE 1 .