Credit Reporting Act, 2017

(e) promote responsibility in the credit market by encouraging responsible borrowing, avoidance of over-indebtedness and fulfilment of financial obligations by consumers and discouraging reckless credit granting by credit providers and contractual default by consumers; and

(f) facilitate credit information sharing.

PART II-LICENCING AND REGULATION OF CREDIT BUREAUX

No operation without a licence and conditions for the grant of licence

2. (1) No person shall establish, operate or conduct business as a credit bureau or otherwise engage in, or perform the functions or activities of a credit bureau, unless such person is licensed by the Bank in accordance with the provisions of this Act.

(2) Any person desiring to undertake business as a credit bureau in Nigeria shall apply in writing to the Governor of the Central of Nigeria for the grant of a licence and shall accompany the application with such documentation and information as the Bank may, by regulations prescribe.

(3) A person shall not be licensed by the Bank to operate as a credit Bureau unless such person:

(a) is duly incorporated in Nigeria as a company limited by shares in accordance with the provisions of the Companies and Allied Matters Act (or any replacement thereof); and

(b) meets the minimum capital requirements satisfies such other requirements and procedures as the Bank may, by regulations prescribe from time to time.

(4) Upon satisfying the conditions in subsections (1) and (2) of this section, the Bank shall issue a licence to such person, subject to such terms and conditions as may be specified by the Bank in the licence.

(5) Where an application for a licence is refused, the Bank shall state the reasons for such refusal in a notice of refusal to the applicant, and where applicable the Bank may advise the applicant of the necessary actions which the applicant needs to take before resubmitting a fresh application for a licence.

(6) The Bank shall communicate its decision on an application for a Licence within three months from the date of receipt of the application and all accompanying documentation and requirements.

PART III-OPERATIONS OF CREDIT BUREAUX

Functions of Credit Bureau

3. (1) A credit bureaux shall perform the following functions:

(a) creating and maintaining a database of credit and credit-related information in accordance with the provisions of this Act;

(b) receiving, collating and compiling credit and credit-related information from Credit Information Providers; Credit Information Users; and such other persons as the Bank may prescribe;

(d) investigating, at the request of a Credit Information User, an application for credit on behalf of any person to whom an application for a credit based transaction has been made;

(e) carrying out such other functions and services that are compatible with the nature of the foregoing activities provided that the confidentiality of any information which they obtain in the course of carrying out such functions or rendering such services shall be maintained in the manner prescribed under this Act; and

(f) carrying out such other functions and activities as the Bank may by regulations prescribe.

(2) No credit bureau shall engage in any form of business other than those referred to in subsection(1)

(3) In performing its functions, a credit bureau:

(a) shall not offer an opinion on the creditworthiness or otherwise of a Data Subject when issuing Credit Reports;

(b) shall implement procedures and systems that ensure that the Credit Information on its database is updated on an on-going basis, and update its database as often as necessary in accordance with the nature of the information stored, or whenever information is provided by a credit information provider;

(c) shall, where the information reported or submitted to it appears to be inaccurate, incomplete, misleading, or contains any manifest error, take reasonable steps to verify the accuracy of such credit information;

(d) shall not include information relating to race, ethnicity, colour, religion or political affiliation either in its data format or in the Credit Reports or any other report or feedback that it provides to credit information users;

(e) shall not release or provide credit information to any credit information user with which it does not have a data exchange agreement, unless the written or other authenticated consent of the relevant Data Subject has been obtained and shown to the Credit Bureau (such consent to be in a form and substance satisfactory to the Credit Bureau); and

(f) may charge such fees, as the Bank may approve, for providing Credit Information.

Collaboration with CRMS Other Public Registries.

4. (1) The Credit Reporting Management System shall continue to perform its regulatory and prudential functions on behalf of the Bank

(2) In performing its functions, a credit bureau may request for Credit Information from the CRMS and Other Public Registries, and shall, upon such request, provide the requested information to the Credit Bureau, and the Credit Bureau may include such information in Credit Reports issued to Credit Information Users.

5. A credit bureau shall maintain Credit Information for a period of not less than 6 years from the date on which such Credit Information was provided to it or, if later, from the date on which it last provided, such information to a Credit Information User, after which such Credit Information shall be archived for a further period of 10 years and may thereafter be destroyed by the Credit Bureau.

Obligations of Credit Bureau

5. (1) A credit bureau shall at all times:

(a) implement strict, data quality control procedures in order to ensure the quality of its database and the continuity of its services;

(b) utilise the Credit Information collected solely for the purposes allowed under this Act;

(c) adopt measures and procedures to detect the misuse of data held in its database and ensure the confidentiality and security of such data;

(d) adopt procedures to allow Credit Information Providers to correct data found to be inaccurate, invalid, incomplete or out of date;

(e) provide to the Bank for the purpose of supervision, unrestricted access to all the Credit Information managed by the Credit Bureau, either through access to its systems or in other manner stipulated by the Bank;

(f) maintain reasonable and accessible dispute resolution processes and procedures to allow data subject to request for the correction of Credit Reports or Credit Information which are alleged to be inaccurate, invalid, incomplete or outdated; and

(g) issue, at no cost to the data subject, a corrected copy of a credit report, either

(i) at the end of a dispute resolution process challenging the accuracy of the information in a credit report; or

(ii) (ii) upon the request of the Data Subject, when the Credit Report of a Data Subject is found to contain inaccurate, invalid or incomplete data.

(2) A credit bureau shall refuse to provide a credit report or to perform any other function if the provision of such report or the performance of such function contravenes a provision of this Act or any other law.

Permissible Purposes for accessing Credit Information

7. (1) A credit information user may only seek credit information from a credit bureau for a Permissible Purpose.

(2) For the purpose of this Act, Permissible Purpose includes:

(a) considering n application for credit by any person or considering a person's qualification to act as a guarantor for any credit;

(b) reviewing renewing, restructuring or monitoring of existing credit facilities;

(d) assessing the credit worthiness of a prospective tenant in any lease or tenancy;

(e) underwriting, reviewing, renewing insurance policies or analysing insurance claims;

(f) considering applications for credit contracts or other post-paid services;

(g) taking actions in respect of debt collection, enforcement of a monetary judgment or enforcement of any other debt;

(h) satisfying a request by a data subject to validate the correctness or otherwise of Credit Information held by a credit bureau in respect of such data subject;

(i) providing credit scoring services by Credit Bureaus;

(j) complying with any court order to provide credit information or where a person is required by applicable law to provide credit information in respect of any other person;

(k) complying with the directive of a regulatory authority or a public body to provide credit information;

(l) carrying out know-your-customer cheeks on any person for any permissible purpose or as may be required by law; and

(m) such other purposes as the Bank may specify or direct.

PART IV: POWERS OF THE CENTRAL BANK OF NIGERIA

Powers of the Central Bank of Nigeria

8. (1) The Bank shall have powers to:

(a) license and regulate Credit Bureaux;

(b) make regulations and issue guidelines on the licensing, management, ownership and operations of credit bureaux and for the general operations of the credit reporting system in Nigeria;

(d) vary or impose fresh or additional conditions on a Licence;

(e) revoke or suspend licences in accordance with the provisions of this Act;

(f) periodically publish information and statistics on the activities of Credit Bureaux;

(g) carry out routine or special examination or investigation of the books and affairs of Credit Bureaux and take appropriate actions as the circumstances may require following such examinations to ensure that Credit Bureaux continue to operate optimally and in accordance with this Act;

(h) take measures to protect the interests of data subjects and to generally protect the integrity of the credit reporting system against abuses;

(i) impose pecuniary and other penalties for the contravention of this Act;

(j) undertake other activities necessary or expedient to give full effect to the provisions of this Act; and

(k) perform other functions specified under this Act.

(2) The Ban may authorise or instruct any officer or employee of the Bank to perform any of the functions, exercise any powers, or discharge any of its duties under this Act, and may either generally or in any particular case, appoint any person who is not an officer or employee of the Bank, to render such assistance as the Bank may specify in the exercise of its owners, the performance of its functions, or the discharge of its duties under this Act, on behalf and in the name of the Bank.

PART V-RIGHTS, OBLIGATIONS AND RESPONSIBILITIES OF VARIOUS PERSONS

Confidential rights of Data subjects

9. (1) Except this Act provides otherwise, Data Subjects shall have the right to the privacy, confidentiality and protection of their credit information.

(2) Notwithstanding any other provision of this Act;

(a) Credit Information relating to a Data Subject may be disclosed by a credit information provider to a Credit Bureau without the prior consent of the Data Subject to which such information relate;

(b) a credit bureau shall not disclose information relating to a data subject to a credit information user except:

(i) it has a data exchange agreement with the Credit Information User and the disclosure is for a permissible purpose, provided that a credit bureau shall be entitled to assume that consent has been obtained by the Credit Information User, unless the Credit Bureau knows, believes or has reasons to believe that such consent has not been obtained;

(ii) written consent of the Data Subject has been obtained by the Credit Information User in accordance with this Act, and provided to the Credit Bureau (such consent to be in a form and substance satisfactory to the Credit Bureau); or

(c) a credit information user shall not disclose any credit information received from a Credit Bureau to any person or use such information for any purpose other than a permissible purpose, except with the written consent of the Data Subject.

(3) Notwithstanding subsections (1) and (2) or any other provision of this Act:

(a) a credit bureau, a credit information provider or a credit information user shall upon written request, disclose any information relating to a Data Subject to:

(i) the Bank,

(ii) any other person pursuant to a court order, or

(iii) where such disclosure is otherwise required under applicable law, in each case, whether or not Consent has been obtained; and

(b) the consent of a Data Subject shall not be required to disclose Credit Information on such Data Subject where the Data Subject is involved in the issuance of dishonoured cheques owning to lack of funds or involved in any other financial or credit-related malpractice and such disclosure is required for the purpose of investigating or prosecuting such malpractice.

(4) Where such disclosure is otherwise required under this section, the consent shall be valid only for the specific transaction or purpose in respect of which it was obtained and shall lapse immediately after that transaction is consummated or purpose is satisfied, such that, the consent shall be obtained for subsequent transaction or purpose.

(5) For the purpose of this At any confidentiality obligation owed to a Data Subject by a credit information provider or a credit information user (whether under law or contract) are hereby waived or modified to the extent required to bring the obligation in conformity with the provisions of this Act.

(6) Data Subjects shall have the following additional rights:

(a) a right to request and obtain, once a year, one free Credit Report fro a Credit Bureau, provided that a Data Subject shall be entitled to, at any time, request additional Credit Reports on him or her upon payment of any applicable fee;

(b) the right to contest the accuracy of information in his or her Credit Report and have same resolved in line with the provisions of this Act, provided that a Data Subject that seeks to contest the accuracy of the information on the Credit Report must do so within 15 working days of receiving the relevant Credit Report; and

(c) if an application or a transaction involving the Data Subject is declined based on information in his or her Credit Report, the Data Subject shall be entitled to be informed by the Credit Information User within 15 working days the reason for the denial, and to receive a copy of the report from the Credit Information User at no extra cost.

Obligation of Data Subjects to update information.

10. The Data Subject shall notify the relevant Credit Information Provider of any change in such Data Subject's demographic data from time to time.

Rights of Credit Information Providers.

11. A credit information provider shall be entitled:

(a) to receive services from a credit bureau subject to the execution of a data exchange agreement with the Credit Bureau; and

(b) subject to the provisions of this Act, to the integrity and protection of dta submitted by it to a Credit Bureau.

Responsibilities of Credit

12. The obligations of Credit Information Users shall include:

(a) protecting the integrity and confidentiality of information obtained on a Data Subject;

(b) using Credit Reports obtained from a credit bureau only for permissible purposes;

(c) furnishing the Data Subject with the contact details of a credit bureau that issues a credit report on the basis of which the decision to deny an application or credit transaction was made;

(d) obtaining consent before requesting for the Credit Report of a data subject form a Credit Bureaux, except in instances where consent can be dispensed with under section 9 (2) of this Act;

(e) entering into a valid data exchange agreement with a credit bureaux to enable it access or receive Credit Information or other data from such Credit Bureau:

Provided that where a credit information user does not have a data exchange agreement with the relevant Credit Bureau, it may access such information upon presenting to the Credit Bureau the written consent of the Data Subject (such consent to be in a form and substance satisfactory to the Credit Bureau);

(f) obtaining Credit Report from at least one Credit Bureau before granting any form of credit:

Provided that the persons mentioned in paragraphs (viii) and (ix) of the definition of Credit Information Providers, shall not in their capacity as Credit Information Users, be obligated to obtain at least a credit report before extending credit or entering into credit based transactions (except where such persons are otherwise regulated under any applicable law); and

(g) fulfilling any other obligations in accordance with any other law including regulations and guidelines issued by the Bank.

PART VI COMPALAINTS AND DISPUTE RESOLUTION

Dispute Resolution Process

13. (1) Where a data subject has any complaint regarding the accuracy, validity, completeness or otherwise of any credit information or the contents of a credit report, the Data Subject shall submit a complaint in writing (whether by electronic mail or other written means) to the Credit Information Provider or Credit Bureau.

(2) A credit information provider or credit bureau shall upon receipt of a complaint investigate, determine and communicate the outcome of the determination of such complaint to the Data Subject within 10 working days following the receipt of the complaint.

(3) If the complaint is not resolved within 10 working days of receiving same, the Credit Provider shall immediately (but not more than 3 working days) refer the complaint to the Bank and the Bank shall resolve the complaint within 10 working days of the receipt of the complaint.

(4) If the Bank does not resolve the complaint within ten (10) working days or a party to the complaint is otherwise dissatisfied with the decision of the Bank, the dissatisfied party shall have a right to proceed to a court of competent jurisdiction for resolution of the dispute.

(5) A dispute shall be deemed resolved where the Credit Information Provider which provided the contested information admits that the information is inaccurate, invalid, incomplete or out-of-date and forwards the rectified Credit Report to the Credit Information Provider and the Data Subject.

(6) For the duration of the investigation or resolution of any complaint under this section, or any other section of this Act, the Credit Information in the Credit Bureau must indicate that the Data Subject's Credit Information is under dispute.

(7) Where there are legal liabilities or costs arising from the inaccurate data as a result of illegal activity, gross negligence, misconduct or reckless behaviour, the Credit Information Provider or the credit Bureau shall be liable, depending upon their degree of culpability.

(8) A credit bureau may claim against the Credit Information Provider whenever it is held liable for any incorrect, incomplete or out-of-date information and Credit Information Users shall be held liable in the event of wrongful or fraudulent use of the Credit Information.

PART VII - REVOCATION AND SUSPENSION OF LICENCES

Revocation of licence.

14. A licence may be revoked by the Bank if the Credit Bureau:

(a) ceases to carry on business in line with the terms in the Licence granted for a continuous period of 6 months or any period aggregating 6 months during a continuous period of 12 months;

(b) a winding-up or analogous order has been made against it or a resolution for voluntary winding up has been passed or it is otherwise dissolve;

(c) fails to comply with minimum capital requirements prescribed by the Band, from time to time, or to comply with any condition subject t which the Licence was granted;

(d) fails to commence business within 6 months immediately after the date of issue of a Licence, unless it notifies the Band of, and the Bank confirms in writing that it is satisfied with, the reason for not commencing business within that period;

(e) breaches the provisions of a law which deals with data protection, computer misuse, or electronic transactions;

(f) obtained the Licence on the premise of wrong, false, misleading information or concealment of material information which, if known at the time of evaluation of the application for the Licence, the Bank would not have granted the Licence;

(g) applies to the Band for the revocation of the Licence; or

(h) fails to comply with the provisions of this Act or the regulations, guidelines or other directives made or issued by the Bank pursuant to this Act, and the Bank is of the opinion that such failure justifies the revocation of the Licence.

Suspension of a licence

15. The Bank may suspend a licence for a specified period if the licensee has engaged in any of the activities justifying a revocation of the Licence under section 14 of this Act, but the Bank is of the opinion that a suspension of the Licence is a more appropriate action to take in the circumstance.

Notice of revocation or suspension of a licence.

16. (1) Where the Bank proposes to revoke or suspend a licence, it shall before exercising such power give notice of its intention to the Credit Bureau concerned, and give the Credit Bureau an opportunity to make representations in respect thereof.

(2) If following such representations, under section (1) the Bank determines that the Licence should by revoked or suspended, the Bank shall give notice in writing of that decision in the Credit Bureau and shall specify in the notice, the defect, omission or breach which occasioned the revocation or suspension (as the case may be), and make such consequential directives in the notice as the Bank may deem fit to make in the circumstance.

17. The Bank may, in lieu of revoking or suspending a licence, require the Credit Bureau to take such measures to regularise the breach or violation within such time as the Bank may specify and may, in addition, impose monetary penalty or other sanctions as it may consider necessary.

18. The Bank may, by regulations stipulate, the manner in which the business or affairs of a credit bureau which licence has been revoked may be wound up or continued by another person including on matters such as safeguarding information or data on the Credit bureau's database, handing over the Credit Bureau's entire database to another person and such other matters as the Bank may deem appropriate to regulate as the consequences of the revocation of a Licence.

19. A person who is dissatisfied with the decision of the Bank to revoke or suspend a licence may apply to the Federal High Court for a review of the decision.

Offences under the Act

20. (1) A person who:

(a) contravenes section 2 of this At or provides credit bureau services after a licence has been revoked or suspended commits an offence under this Act;

(b) intentionally or negligently provides inaccurate, incomplete, misleading or false information to Credit Bureaux, Credit Information Provider, Credit Information User or Data Subjects commits an offence under this Act;

(c) intentionally or negligently discloses Credit Information in contravention of the provisions of this Act commits an offence under this Act;

(d) tapers or alters Credit Information received in such a manner as incorrectly represents the information received commits an offence under this Act;

(e) intentionally or wilfully obtains information from a credit bureau under false pretence or for a purpose other than a permissible purpose commits an offence under this Act;

(f) uses Credit Information for a purpose other than a permissible purpose commits an offence under this Act;

(g) wrongfully alters, modifies or delete records by a credit bureau from its database commits an offence under this Act;

(h) makes an unauthorised disclosure or use of Credit Information, or provides Credit Information to any person carrying on the business, or performing the functions, of a credit bureau without a licence commits an offence under this Act and

(i) fails, either a credit information provider or a credit bureau to submit or update data within the timeframe stipulated under this Act or within such other time frame that may be specified by the bank commits an offence under this Act.

(2) Any person being a director, manager, secretary or other similar officer of a credit bureau who fails to take all reasonable steps to:

(a) secure compliance by the Credit Bureau with the requirements of this Act; or

(b) correctly represent information received in any statement submitted under the provisions of this Act, commits an offence.

Fines and penalties.

21. (1) A person who commits an offence under subsection (1) (a) of section 20 of this Act shall on conviction be liable to a term of imprisonment not exceeding 10 years or a fine not less than N 10million.

(2) Any person who commits an offence under subsection (1) (b) - (i) of section 20 of this Act shall on conviction be liable to a fine not less than N 10million.

(3) Any person who commits an offence under subsection 2 of section 20 of this Act shall on conviction be liable to imprisonment for a term of 3 years or a fine less than N 3million.

(4) Notwithstanding any of the provisions of this Act, the Bank may impose a prescribe monetary penalty or suspend a licence for failure to comply with any rules, regulations, guidelines or administrative directives made, given or issued to the Credit Bureaux under this Act.

Liability of directors and other officers

22. Where any offence against any provision of this Act or any regulations made under this Act have been committed by a body corporate or a firm or any person who was a director, manager, secretary or other similar officer of the body corporate or firm purporting to act in such a capacity shall in addition to be body corporate or firm be deemed to be guilt of that offence unless he proves that the offence was omitted without his consent or connivance and that he had exercised all such diligence to prevent the commission of the offence as he ought to have exercised, having regard to the nature of his function, in that capacity and all the circumstances.

Penalties not otherwise provided for.

23. Any person who contravenes or fails to comply with any of the provisions of this Act or any regulations made under this Act for which no penalty is expressly provided shall, on conviction, be liable to a prescribed monetary penalty or a fine not less than N 10million or imprisonment for a term of 10 years or to both such imprisonment and prescribed monetary penalty.

PART IX - MISCELLANEOUS AND SUPPLEMENTARY

Restrictions on amalgamation, transfers, etc.

24. A credit bureau shall not merge with any other entity, sell or otherwise transfer its Licence or business to any person, and no person (whether acting directly, through a proxy, nominee, trustee or other indirect means) shall acquire not more than 25% shareholding in a credit bureau, in each case without the approval of the Bank.

Guidelines to conform with the Act.

25. Except the Bank replaces or reissues the Guidelines for the Licensing, Operations and Regulation of Credit Bureaux and Credit Bureau Related Transactions n Nigeria, 203 (in this Act referred to as "the Guideline"), from the commencement date of this Act, the Guidelines shall be read in such manner as to bring its provisions in conformity with this Act.

Handover of database to the Bank.

26. Without prejudice to section 16 of this Act, when:

(a) a licence is revoked in accordance with the provisions of this Act; or

(b) a Credit Bureau is liquidated, wound up, dissolved, or otherwise ceases to carry on business:

Such Credit Bureau shall immediately, or within such timeframe as the Bank may, by regulations prescribe, hand over its entire database to the Bank.

Interpretation

27. In this Act:

"Bank" means the Central Bank of Nigeria established under section (1) of the Central Bank of Nigeria Act, 2007;

"Consent" means the authorization by the Data Subject or the Data Subject's authorized agent indicating an approval to inquire about the Data Subject's Credit Information from the Credit Bureaux and such authorization could be in writing (including by electronic email, fax or letter), verified and secured telephonic messages or conversations, and other secured and verified electronic means of consenting, but shall not include oral consent;

"Credit Bureau" means an entity duly licensed under this Act;

"Credit Information" means information bearing on a person's credit worthiness credit standing or capacity, and to the history and profile of such person with regard to credit, assets and any financial obligations, including such person's demographic data and such other information that may ad credit decision making;

"Credit Information Providers" means entities that provide or furnish Credit Information to a Credit Bureau and includes:

(a) banks, specialized banks and other financial institutions (as such terms are used or defined under the Banks and Other Financial Institutions Act Cap. B3 Laws of the Federation of Nigeria, 2004 or by the Bank);

(b) leasing companies;

(d) cooperative societies and institutions that offer credit to medium, small and micro enterprises;

(e) utility companies including electricity companies, telecommunications companies, and water corporations;

(f) asset management companies;

(g) Credit Reporting Management System (CRMS);

(h) suppliers of goods and providers of services on a post-paid, deferred or instalment payment basis (except otherwise specifically mentioned in paragraphs (a) - (h) above); and

(i) other entities that in their ordinary course of business have relevant information that complies with Permissible Purposes and serves the purposes of the Credit Bureau, provided that the Bank may issue directives or guidelines adding or removing any person mentioned under paragraphs (a) -(h)

"Credit Information Users" includes Credit Information Providers and other persons that are allowed under this Act or any regulations or guidelines made under this Act to seek Credit Information from a Credit Bureau for permissible purposes;

"Credit Report" means an electronic or other written report, credit score, or statement issued by a credit bureau and which is used or collected to serve as a factor in establishing that Data Subjects eligibility for credit or other service or product provided by a person on credit basis or for other permissible purposes, and which shall, among other things, all or part of a Data Subject's Credit Information which is available on such Credit;

"CRMS" means Credit Reporting Management System;

"Licence" means a credit bureau licence issued by the Bank under this Act;

"Other Public Registries" includes the Corporate Affairs Commission; registrar of business entities; land registries; collateral registries; tax authorities; courts; birth registries; and other public bodies and registries;

"permissible purpose" means any of the purposes outlined in section 9 of this Act;

"person" includes any individual, company, corporation, unincorporated association or body (including a partnership, trust, joint venture or consortium), government state, agency, organisation or other entity whether or not having separate legal personality;

"prescribed monetary penalty" means such monetary penalty that the Bank, or a court, may prescribe or impose or in respect of any offence committed under this Act;

"working days" means any day other than a Saturday, Sunday, or national public holiday in Nigeria.

Citations

28. This Act may be cited as the Credit Reporting Act, 2017.