Region

Jurisdiction

Regulator

2019-01-24

Credit Reference Bureau (Licensing, Supervisory and Operational Requirements) Regulations 2011

The Malawi Minister of Finance and Development Planning, acting under the Credit Reference Bureau Act 2010, has established comprehensive licensing and operational rules for credit reference bureaus. The regulations mandate a minimum USD50,000 capital, restrict licenses to limited liability companies, and require robust data security, accurate record-keeping, and authorized user access with borrower consent. The framework grants consumers the right to inspect and challenge inaccurate data within strict timelines, while empowering the Registrar to enforce compliance through monetary penalties up to one million Kwacha.

Malawi

Reserve Bank of Malawi

173 The Malawi Gazette Supplement, dated 21st October, 2011, containing Regulations, Rules, etc. (No. 12A)

GOVERNMENT NOTICE NO. 41 CREDIT REFERENCE BUREAU ACT (ACT NO. 18 OF 2010)

CREDIT REFERENCE BUREAU (LICENSING, SUPERVISORY AND OPERATIONAL REQUIREMENTS) REGULATIONS, 2011

ARRANGEMENT OF REGULATIONS

PART 1.—PRELIMINARY

REGULATION

Citation
Interpretation
Eligibility for a licence
Application for a licence
Minimum capital requirements
Validity of a licence
Granting of licence
Permissible activities
Obligations of Credit Reference Bureaus with respect to operations
Obligations of Credit Reference Bureaus with respect to customer data
Obligations of Credit Reference Bureaus with respect to authorized users
Obligations of Credit Reference Bureaus in relation to data providers
Users access of the Credit Bureau Database
The right to inspect credit information
Right to challenge incorrect credit information
Process of dealing with challenges to incorrect credit information
Recording of challenges to incorrect information
Fee for a Credit Report
Penalties
Public awareness FIRST SCHEDULE

IN EXERCISE of the powers conferred by section 33 of the Credit Reference Bureau Act, 2010, I, KEN DISTON LIPENGA, Minister of Finance and Development Planning, make the following Regulations—

These Regulations may be cited as the Credit Reference Bureau Citation (Licensing, Supervisory and Operational Requirements) Regulations, 2011.
In these Regulations, unless the context otherwise requires— Interpretation “Act” means the Credit Reference Bureau Act; “borrower” means a natural person or a legal person, and any other party to the credit, who has obtained a credit from the lending institution as a result of a legal agreement signed with them;

174 21st October, 2011

“credit agreement” means the contractual agreement between the lender and the borrower that sets out the rights and obligations of parties on the disbursement and the repayment of the credit; “permissible purposes” means users allowed to obtain information from a credit reference bureau only for the following purposes— (a) in compliance with a court order; (b) in accordance with the written instructions of the consumer to whom it relates and as it relates to any type of credit transaction; or (c) in accordance with the written request of the subject of a credit report in order to obtain a copy of their personal credit report; “Registrar” means the Registrar of Financial Institutions appointed under the Financial Services Act, 2010; “search inquiry” means a request, made by a user, for information from the credit reference bureau database.

Act No. 26 of 2010

Eligibility for a licence 3.—(1) Application for a credit reference bureau licence shall be restricted to limited liability companies. (2) The licence shall not be transferred or sold.

Application for a licence First Schedule 4.—(1) An application for a credit reference bureau licence shall be made in a form as prescribed in the First Schedule. (2) An applicant shall pay a non-refundable application fee of one hundred thousand Kwacha (MK100,000) in a form of a bank certified cheque, payable to the Reserve Bank of Malawi.

Minimum capital requirements 5.—(1) A minimum start-up capital for a credit reference bureau business shall be an equivalent of Malawi Kwacha of fifty thousand United States Dollars (USD50,000). (2) The capital must be domiciled in Malawi. (3) In case of a foreign investor, the capital shall be registered with Exchange Control Department of the Reserve Bank of Malawi.

Validity of a licence 6.—(1) A credit reference bureau licence shall be valid for a period of two years. (2) An applicant for a renewal of a licence shall pay a non-refundable fee of one hundred thousand Kwacha (MK100,000) in a form of a bank certified cheque, payable to the Reserve Bank of Malawi.

Granting of licence 7. Registrar may grant a credit reference bureau licence if he is satisfied that the following conditions exist— (a) applicants, owners, directors, executive officers and senior management— (i) have never been declared bankrupt by a court of law; (ii) have not defaulted on any credit obligation; (iii) have never been convicted of any criminal offence for the past seven years which affects their financial integrity;

21st October, 2011 175

(iv) have never been refused any licence under any financial service laws; (v) have never been subjects of supervisory actions (cease and desist orders, licence suspensions or evocations, etc.); and (vi) have never been liable of any breach in connection with credit or credit reporting business; (b) the applicant has human, technical, financial and operational resources that will enable the credit reference bureau to function effectively and efficiently; (c) the applicant has put in place concise and detailed policies and procedures for the storage and use of credit data that would include ensuring the security, confidentiality and integrity of the credit data; (d) the applicant has put in place detailed policies and procedures to ensure— (i) the provision of accurate credit information and that it is only accessible by authorized users; (ii) that access of credit information from the credit registry database is conducted in a secure and confidential manner; (iii) the provision of robust consumer rights and protection related to their personal credit information; (e) the credit reference bureau has certified hardware and software for its credit information database; (f) proof of the existence of the minimum capital requirement; and (g) the applicant has met any other conditions that the Registrar may have prescribed.

8.—(1) A credit reference bureau shall not engage in any other activities Permissible other than those specified in these Regulations or as approved by the Registrar activities in writing. (2) A credit reference bureau shall not transfer or provide credit information to any user outside Malawi, except with a written consent of the Registrar. (3) The Registrar may withdraw the consent referred to in subregulation (2) above if deemed necessary.

A credit reference bureau shall ensure that— Obligations of Credit (a) all data received or collected is properly and accurately Reference recorded, maintained, collated and processed in a timely manner; Bureaus with (b) its premises are safe and conducive to operate its data systems, respect to database and any other operations related to credit reference bureau operations business; (c) it provides suitable policies and sufficiently trained personnel for the provision of adequate customer service; (d) it uses hardware and software that ensure data security of users and providers;

176 21st October, 2011

(e) it prepares and maintains operational manuals that ensure the accuracy of information contained in its database including manuals for handling of queries, loading of data, source quality control, maintenance, security and procedure for handling complaints; (f) through a written contract or agreement, data providers and users comply with provisions of the Credit Reference Bureau Act, these Regulations, and other financial sector laws; (g) it adopts measures and systems for the recording of requests or queries from customers concerning credit reference bureau reports and misuse of data held in its database; and (h) it provides to the Registrar all the data or information as may be required by the Registrar.

Obligations of Credit Reference Bureaus with respect to customer data 10. A credit reference bureau shall implement the following measures in relation to data obtained and stored in its database as well as data accessed by authorized users— (a) establish controls and procedures to be applied when authorized data providers supply information to the credit reference bureau database; (b) establish controls and procedures to be applied when authorized users request information from the credit reference bureau database; (c) maintain automated logs of all accesses, amendment to credit file information and audit trails to data; (d) maintain logs of proven or suspected breaches of security that would include details of files affected, details of the breach and any action taken as a result of an investigation; (e) review, on a regular basis, password controls of all credit reference bureau personnel and authorized data providers and users; (f) monitor, on a regular basis, patterns of usage of credit reports, with a view to detecting and investigating any unusual or excessive usage; (g) communicate at least annually, to authorized data providers and users their responsibilities under these Regulations; (h) as necessary, conduct workshops in relation to these Regulations and, in particular, good security practices for the benefit of authorized data providers and users and other stakeholders that may be deemed relevant; (i) formulate guidelines, disciplinary and contractual procedures to be applied in relation to improper use of credit bureau database access by credit reference bureau personnel and by authorized data providers or users; and (j) formulate operational guidelines to ensure adequate protection to minimize the risk of unauthorized entry into the information or interception of communications made to and from the credit reference bureau database.

21st October, 2011 177

11.—(1) A credit reference bureau shall— Obligations of Credit (a) only approve, as users, financial institutions and those entities or Reference persons on which it has completed due diligence and has been satisfied Bureaus with that the prospective user maintains a good reputation, and conducts its respect to business activities in a legally and responsible manner; authorized users (b) develop and utilize a standard application form and contract for a potential user to complete when requesting for approval to access credit files; (c) ensure that its relationship with a user is formalized in a contract that outlines the conditions for obtaining and use of credit reference bureau information as outlined in these Regulations; (d) re-verify the qualifications of users on an annual basis; (e) ensure that only users who provided their relevant proprietary credit information to the credit reference bureau access information from the credit bureau; (f) ensure that access to the credit reference bureau database is only through user codes and passwords that must be changed on a regular basis; (g) ensure that prior to accessing information from a credit reference bureau, the users have written and signed consent of the borrower; (h) ensure that users do not sell, transfer or otherwise use the information obtained from the credit reference bureau for purposes other than outlined in the definition of permissible purposes; and (i) ensure that users maintain a hard copy of the written consent, along with a copy of the subject’s credit application, and be prepared to surrender the hard copy at the request of the Registrar. (2) A credit reference bureau shall immediately suspend supply of credit bureau information to any authorized user who fails to comply with the provisions of regulation 12.

A credit reference bureau shall ensure that every data provider— Obligations of Credit (a) provide complete, accurate and timely proprietary credit Reference information to the credit reference bureau; Bureaus in (b) promptly investigate any case on inaccurate credit information relation to and conclude the investigation within ten working days; data providers (c) promptly eradicate the inaccuracy in its database and update customer’s information; (d) take responsibility for any errors or inaccuracies in the data provided to credit reference bureau; and (e) fulfils any other obligations as specified by the Registrar.

13.—(1) Users may only access a credit reference bureau database Users access with the written consent of the subject on whom a search inquiry is being of the Credit conducted. Bureau Database (2) Users must maintain a hard copy of the written consent, along with a copy of the subject’s credit application, and be prepared to surrender the hard copy at the request of the Registrar or the credit reference bureau.

178 21st October, 2011

The right to inspect credit information 14.—(1) A person shall have the right to request in writing to a credit reference bureau for a copy of any or all personal credit information stored in the credit reference bureau database. (2) A credit reference bureau shall request the person to provide it with legally acceptable identity before releasing the information.

Right to challenge incorrect credit information 15. A person shall have a right to challenge any incorrect personal credit information provided by a credit reference bureau.

Process of dealing with challenges to incorrect credit information 16. Where a person challenges any inaccurate credit information, a credit reference bureau shall— (a) institute corrective action within five working days from a day it received the concern; (b) contact and direct the data provider to re-verify the accuracy of the credit information within ten working days; (c) ensure that the credit information is immediately corrected both in the database of the data provider and credit reference bureau; (d) notify all users who may have used the inaccurate information in the past twelve months; (e) provide the subject of the credit file with a hard copy of the corrected report; (f) report the matter to the Registrar if a data provider fails to correct the information upon the expiry of the stipulated period; and (g) suspend the data provider’s access to the credit reference bureau database where a data provider fails to correct the credit information within the stipulated period and without giving valid written reasons for the failure.

Recording of challenges to incorrect information 17.—(1) A credit reference bureau shall maintain records of— (a) all challenges it receives concerning incorrect credit information; and (b) all efforts taken to investigate challenges, results of the investigation and any action taken. (2) The credit reference bureau shall, on quarterly basis, submit a report on the challenges, the investigations and action taken to the Registrar for a review.

Fee for a credit report 18. A credit reference bureau shall charge a reasonable fee for any credit report.

Penalties 19.—(1) Where a credit reference bureau or user is in violation of any of the provisions of these Regulations or the Act, the Registrar may— (a) impose penalties or other remedial measures or enforcement actions as provided for in the Financial Services Act; 2010; or (b) impose a monetary penalty not exceeding one million Kwacha (MK1,000,000).

Act No. 26 of 2010

21st October, 2011 179

A credit reference bureau shall develop a programme of public Public awareness relating to rights and obligations of users of credit reference bureau awareness services.

FIRST SCHEDULE (reg. 4)

APPLICATION FORM FOR A LICENCE TO CARRY OUT CREDIT REFERENCE BUREAU BUSINESS IN MALAWI

SECTION 1 This section requests information about the proposed Credit Reference Bureau (CRB) and its shareholders.

Name of proposed Credit Reference Bureau: ....................................................................................
Date of Incorporation: ........................................................................................................................
Physical Address of Business: ........................................................................................................... ................................................................................................................................................................ Postal Address of Business: ................................................................................................................... Telephone Number: ................................................... Fax Number: ....................................................... E-mail: .............................................................. Website: ...................................................................
Software description (owned or leased), data centre and back-up installations: ............................... ................................................................................................................................................................ ................................................................................................................................................................
Capital Structure: Please indicate the amount of capital for the proposed Credit Reference Bureau (CRB): ..................... ................................................................................................................................................................ Proof of such capital (cash, software, equipment and installations) will be verified by the Registrar. Borrowed funnds are not allowed: ........................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Subsidiaries and Affiliates: Name and Type of Business | Amount of Shares | % of Shares Held --- | --- | --- .................................................. | .................................. | .................................. .................................................. | .................................. | .................................. .................................................. | .................................. | ..................................

180 21st October, 2011

Directors and Executive Officers: (a) Board of Directors: Name | Designation | Physical Address --- | --- | --- .................................................. | .................................. | .................................. .................................................. | .................................. | .................................. .................................................. | .................................. | ..................................

(b) Executive Officers:

Name	Designation	Physical Address
..................................................	..................................	..................................
..................................................	..................................	..................................
..................................................	..................................	..................................

Principal Shareholders: Name and Address | Amount of Shares | % of Shares Held --- | --- | --- .................................................. | .................................. | .................................. .................................................. | .................................. | .................................. .................................................. | .................................. | ..................................

Other shareholders owning less than ten per cent (10%) (Total Shares: ............................)

Attachments: Please attach the following— (a) signed letter of commitment that the applicant agrees to be bound by terms and conditions of the Credit Reference Bureau Act, 2010, and regulations for CRB; (b) organization chart indicating major departments or divisions with names, positions and titles of officers heading each department or division; (c) Curriculum Vitae of each Director and Senior Management Official; (d) audited financial statements of the proposed CRB for the past three years; (e) if the proposed CRB is a newly established company and has no audited financial statements as stipulated in (d) above; then submit audited financial statements for each principal shareholder for the past three years; (f) copy of Certificate of Incorporation; (g) copies of Memorandum and Article of Association; (h) Business Plan for the next three years including proforma statements of financial position, statement of comprehensive income and cash-flow projections; (i) policies and procedures for storage and use of credit data to ensure security, confidentiality and integrity of the credit data including any agreements with software/hardware providers; and

21st October, 2011 181

(j) Business Continuity Policies and Procedures. 10. Applicant’s shareholding in any other financial institution whether in Malawi or abroad.

Name of Financial Institution	Number of Shares	% of Shares Held
..................................................	..................................	..................................
..................................................	..................................	..................................
..................................................	..................................	..................................

Name(s) and addresses of the applicant’s bankers within the last five years (Also indicate the applicant’s principal bankers): ................................................................................................... ................................................................................................................................................................
Name and address of the applicant’s external auditors: ................................................................... ................................................................................................................................................................
Does the applicant or its shareholders hold; or ever held any authority from a supervisory body to carry on any business activity in Malawi or elsewhere? If so, give particulars: ............................ ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Has the applicant or its shareholder or any company in the same group within the last ten years failed to satisfy a judgment debt under a court in Malawi or elsewhere within a year of the making of the order? If so, give particulars: ................................................................................................... ................................................................................................................................................................ ................................................................................................................................................................
Has the applicant or its shareholder or any company in the same group made any compromise or arrangement with its creditors within the last ten years or otherwise failed to satisfy its creditors in full? If so, give particulars: ................................................................................................... ................................................................................................................................................................ ................................................................................................................................................................

182 21st October, 2011

Has a petition for an administrative order or notice of resolution for voluntary or compulsory winding-up been served in Malawi in relation to the applicant, its shareholders or company in the same group, or has the substantial equivalent of such a petition been served in any other jurisdiction, in the last ten years? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
State whether the applicant or its shareholders have ever been under any criminal investigation, prosecution, disciplinary action(s) or trade sanctions in connection with Credit Reference Bureau, banking or financial services in Malawi or elsewhere? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Are there any material matters in dispute between the applicant or its shareholders and the Malawi Revenue Authority or any equivalent tax authority in any other jurisdiction? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Is the business of the applicant’s executive officers or of companies connected with the applicant guaranteed or otherwise underwritten or secured, or expected to be guaranteed or underwritten or secured, by the applicant or its shareholders? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Please provide any other information which may assist the Registrar in reaching a decision on the applicant: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................

21st October, 2011 183

DECLARATION We certify that all the information contained in and accompanying this form is accurate and complete to the best of our knowledge, information and belief and that there are no other facts relevant to this application of which the Registrar should be aware. We undertake to inform the Registrar of any material changes to the application which may arise while the Registrar is considering the application. We further undertake that, in the event that the institution is granted a licence under these Regulations, we will notify the Registrar of any material changes to or affecting the completeness or accuracy of the answers to the questions above as soon as possible, but in any event not later than twenty-one days after the date that the changes come to our attention.

Name: ................................................................................... Position held: ........................................... Signature: ............................................................................ Date: .........................................................

SECTION 2 PERSONAL DECLARATION OF INDIVIDUAL SHAREHOLDERS, DIRECTORS AND EXECUTIVE OFFICERS *Section 2 must be filled by each individual, that is, principal shareholder, director or executive officer.

Please state the name and capacity in which you are completing this form, i.e. as a current or prospective executive officer or any combination of these: ................................................................................................................................................................ ................................................................................................................................................................
Please state your full title and describe the particular duties and responsibilities attaching to the position(s) which you hold or will hold: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
If you are completing this form in the capacity of director, indicate whether, in your position as director, you have or will have executive responsibility for the management of the applicant’s business: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Nationality: ................................................................................. Passport Number: .............................

*In addition, please provide a copy of your Curriculum Vitae.

184 21st October, 2011

Date and Place of Birth: ....................................................................................................................
Please indicate your present business and residential address including house number, telephone, fax and e-mails as follows— (a) Present Business Address: ............................................................................................................ ................................................................................................................................................................ (b) Residential Address: ...................................................................................................................... ................................................................................................................................................................ (c) House Number: ................................................... Telephone Number: ........................................... (d) Fax Number: ....................................................... E-mail: ...............................................................
Professional and Academic Qualifications: Particulars | Year Obtained --- | --- .................................................................................................. | .................................. .................................................................................................. | .................................. .................................................................................................. | .................................. .................................................................................................. | ..................................

(a) Highest Academic Qualification: ................................................................................................... Issuing Institution: ............................................................................................................................ (b) Special Awards or Honors (if any): ............................................................................................... ................................................................................................................................................................ ................................................................................................................................................................ (c) Training courses and seminars: ...................................................................................................... ................................................................................................................................................................ ................................................................................................................................................................ (d) Membership in professional organizations: ................................................................................... ................................................................................................................................................................ ................................................................................................................................................................ (e) Occupation or employment (present or most recent and for the past ten years): ............................. ................................................................................................................................................................ ................................................................................................................................................................

21st October, 2011 185

Names and address of your bankers within the last ten years: ........................................................... ................................................................................................................................................................ ................................................................................................................................................................
Bodies corporate (other than the applicant) where you are now a shareholder or director or have been a shareholder or director in the past ten years: ........................................................................... ................................................................................................................................................................ ................................................................................................................................................................
Have you, in Malawi or elsewhere, been dismissed from any office or employment or been subjected to disciplinary proceedings by your employer or barred from entry to any profession or occupation? If so, give particulars: ................................................................................................... ................................................................................................................................................................ ................................................................................................................................................................
Do you hold or have you ever held or applied for a licence or equivalent authorization to carry on any business activity in Malawi or any other country? If any such application was refused or withdrawn after it has been made or any authorization was revoked, please give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
State whether the applicant with which you are, or have been, associated as a principal shareholder or executive officer holds, or has ever held or applied for licence or equivalent authorization to carry on any business activity in Malawi? If so, give particulars. If any such application was refused, or was withdrawn after it was made or any licence revoked, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................

186 21st October, 2011

State whether any of your past or current employer(s) or institution in which you were affiliated as shareholder, executive officer, etc., has ever been under criminal investigation, placed under receivership or insolvent liquidation by any regulatory body or court of law: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Have you ever been adjudicated bankrupt or failed to satisfy any debt? .......................................... ................................................................................................................................................................
Has any body corporate, partnership or unincorporated institution with which you are associated as a director, shareholder, controller or manager, in Malawi or elsewhere, been wound-up, made subject to an administrative order, otherwise made any compromise or arrangement with its creditors or ceased to be associated with it or has anything analogous to any of these events occurred under the laws of any other jurisdiction? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Do you, in your private capacity, or do any of your related parties, undertake business with the applicant? If so, how many shares in the applicant are registered in your name or the name of a related party? Please give names in which the shares are registered and their classes: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................
Do you or does any related party, hold any shares in the applicant as trustee or nominee? If so, give particulars: ................................................................................................................................................................ ................................................................................................................................................................
What proportion of the voting power at any general meeting of the applicant (or another body corporate of which it is a subsidiary) are you or any related party entitled to exercise or control the exercise of? ................................................................................................................................................................ ................................................................................................................................................................

21st October, 2011 187

Documentary requirements: Please attach and submit the following for each director, individual principal shareholder and executive officer— (a) certified statement of assets and liabilities; (b) latest tax compliance certificate or certified true copy of income tax returns; (c) two letters of character references from individuals other than relatives who have personally known you for at least ten years; and (d) two letters, duly certified from financial institutions with whom you have had dealings for the last two years on the performance of past and present accounts such as unauthorized overdrafts on deposit accounts, past due or delinquent accounts.
Please provide any other information which may assist the Registrar in reaching a decision on the application: ................................................................................................................................................................ ................................................................................................................................................................ ................................................................................................................................................................

DECLARATION I certify that all the information contained in and accompanying this form is complete and accurate to the best of my knowledge, information and belief and that there are no other facts relevant to this application of which the Registrar should be aware. I further undertake that, in the event that the Bureau is granted a licence under these Regulations, I will notify the Registrar of any material changes to, or affecting the completeness or accuracy of the answers to the questions above as soon as possible, but in any event not later than twenty-one days from the date that the changes come to our attention.

Made this 10th day of October, 2011.

DR. KEN D. LIPENGA Minister of Finance and (FILE NO. MF/3/1) Development Planning

Printed and published by THE GOVERNMENT PRINTER, Lilongwe, Malawi—02403—(Price K170.00)