Why the Financial Institutions (Credit Reference Bureau) regulations 2022 were long overdue?

The Financial Institutions Act of 2004 mandates the Central Bank to license Credit Reference Bureaus in Uganda. The relevant regulations then, being the FI (Credit Reference Bureau) regulations, 2005 operationalized this mandate. However, no licenses were issued until 2008 when, Compuscan Credit Referene Bureau the first Credit Reference Bureau to obtain  a license under the 2005 regulations opened shop. Compuscan dominated this Credit Reference Services space until much later in 2015 when Metropol Uganda Limited was licensed as the other Credit Reference Bureau.

For those who may not know, A Credit Reference Bureau is a company like any other but licensed by the Central Bank to collect and process credit information on individual and company borrowers as provided by various lenders. The aim of this information gathering is to enable the Credit Reference Bureau to conclude a Credit Report about a particular individual or company which then is availed to intending lenders.

The said Credit Report later becomes important for both borrowers and lenders as it forms a reference point for access to credit. Borrowers can use credit reports as reputation collateral hence negotiating the cost of credit much lower while lenders will use credit reports and particularly credit scores of particular borrowers to assess credit risk associated with such borrowers.

The Central Bank has recently promulgated the Financial Institutions (Credit Reference Bureau) regulations of 2022 (herein referred to as the “2022 Regulations”) repealing the 2005 regulations that have been hitherto the enabling law. The 2022 Regulations capture several aspects of the Credit Reference Services that were never catered for by the 2005 regulations or any other law.

In the next text, I will try to highlight the salient features contained in the 2022 regulations and their implications.

Reg.7 of the 2022 Regulations introduces the fit and proper person test. Essentially, this requires the top management of a licensed Credit Reference Bureau to pass the test before they are confirmed to work as such. The regulations require a Central Bank approval of the relevant individual seeking to occupy a top management position. The affected positions include directors of the company, managers and substantial shareholders. The fit and proper test contained in the 2022 regulations is identical to that contained in the Financial Institutions Act of 2004.

The 2022 Regulations have also intensified the requirements for the application for a license. Proposed individuals seeking to operate Credit Reference Services business are supposed to submit their curriculum vitae and professional record. The regulations also require a business plan and plans to undertake national coverage.

The other important feature under the 2022 regulations is the focus on data protection and privacy of the data subject. The regulations have underscored the requirement for prior informed consent from the data subjects whose information is collected by the Credit reference bureaus and the licensed credit providers as defined under the regulations.  However, Reg 21 does provide for some licensed credit providers to transfer particular personal data to the Credit Reference Bureau without seeking consent but rather by just the prescribed notice to the data subject. Other exceptions are contained in Reg 24 which permits for Credit Reference Bureaus to share public information (information that has been made available to the public). Whereas the latter exception is no strange requirement, the same cannot be said of the former. The requirement to serve notice on the data subject might not be sufficient to protect the data subjects’ interests.

That notwithstanding, the 2022 regulations seem to have substantially upheld the rights of a data subject almost as contained in the Data Protection and Privacy Act, 2019. These include among others; Right to information on what the data collected is to be used for, for how long it shall be retained, the right to correct the information and to require a copy thereof.

The 2022 regulations further provide for the appointment of Agents by Credit Reference Bureaus. Reg 17 requires an approval from the Central Bank for the appointed agent. Just like it is with Agent Banking, the Agents to be appointed under the 2022 regulations are appointed on a non-exclusive basis, meaning they can serve more than one Credit Reference bureau. The Agents so appointed have limited roles they can perform for different Credit Reference Bureaus. Fundamentally, they are to do delivery of credit reports, sensitize customers and perform complaint management. The relationship between the Credit Reference Bureau and the Agent is codified by an Agreement.

The requirement for a Bank Guarantee under Reg 19 is also a new introduction to the Credit Reference Bureau regulatory space. Over and above the minimum capital requirement, CRBs are required to maintain a Bank guarantee throughout the duration of their license. The importance of this Bank Guarantee is to act as a fall back for imposed penalties by the Central bank. In case of failure by the Credit Reference Bureau to pay an imposed fine, the Central Bank would call on the irrevocable Bank Guarantee.

The 2022 regulations under part 14 contain a host of provisions on competition. Regulations 55, 56 and 57 all provide for anti-competitive practices, misuse of market power and predatory pricing respectively. Under part 14, Credit Reference Bureaus are prohibited from price fixing which is defined thereunder as an agreement between competitors to fix the price of services provided by the said competitors. The other anti-competitive practice prohibited is misuse of market power. Credit Reference Bureaus like Compuscan which have enjoyed an almost exclusive service offering will now open up space for the rest of the players. The law also imposes a penalty of 250 currency points (about UGX 5,000,000) on any violation of the anti-competition provisions.

The 2022 regulations also encourage Credit Reference Bureaus to conduct value added services to credit providers. Value added Services are defined to mean services intended to provide synergy and complement credit reports in order to enhance user benefits. However, under Reg 66, the Credit Reference Bureau is not to engage in businesses which in the opinion of the central bank may conflict with the business for which it was licensed.

Last but not least in importance, the Central Bank owns all the data and data bases developed by the Credit Reference Bureau and shall retain perpetual access to the same even after revocation of the Credit Reference Bureau Services license. This provision calls into question where the liability in case of any falls, is it with the owner of the data or the collector? The answer to this question is not clear. The only apportionment of liability is found in Reg 42 which shifts the liability of inaccurate data to the responsible credit provider.

In conclusion, the new Credit Refence Bureau Regulations will go a long way in improving access to credit at a subsided cost which will in turn grow the financial sector through improving the turnaround time within which accurate and reliable information can be accessed by both lenders and borrowers. The worrying information asymmetry between lenders and borrowers will further be reduced as access to credit information will greatly improve under this legal regime.

Keith Namara Kyaruzi