Region

Jurisdiction

Regulator

2022-01-01

Financial Institutions (Credit Reference Bureau) Regulations 2022

The Bank of Uganda has issued the Financial Institutions (Credit Reference Bureau) Regulations 2022 to establish a comprehensive licensing and supervisory framework for credit reference bureaus and data providers. The regulations mandate minimum capital thresholds, strict data collection and security standards, and clear protocols for consent, privacy, and cross-border information sharing. By standardizing credit reporting, enforcing anti-competitive practices, and defining data subject rights, the framework aims to enhance consumer credit access, ensure market integrity, and strengthen overall financial system stability.

Uganda

Bank of Uganda

5927 STATUTORY INSTRUMENTS 2022 No. 106. THE FINANCIAL INSTITUTIONS (CREDIT REFERENCE BUREAU) REGULATIONS, 2022 ARRANGEMENT OF REGULATIONS Part I—Preliminary Regulation

Title
Application
Interpretation
Purpose Part II—Licensing of Credit Reference Bureaus
Prohibition of operating a regulated business without a licence
Application for licence
Application processing fee
Licensing criteria for credit reference bureau business
Minimum capital requirements for credit reference bureau business
Pre-licensing inspection
Grant of licence
Annual licence fee
Refusal to grant licence
Duration of licence STATUTORY INSTRUMENTS SUPPLEMENT No. 40 30th September, 2022 STATUTORY INSTRUMENTS SUPPLEMENT to The Uganda Gazette No. 61, Volume CXV, dated 30th September, 2022 Printed by UPPC, Entebbe, by Order of the Government.

5928 Regulation 15. Non-transferability of licence and share transfer approval 16. Appointment of agents 17. Revocation and expiry of licence 18. Bank guarantee Part III—Operations of Credit Reference Bureaus 19. Collection of information 20. Submission of negative information 21. Disclosure of positive information 22. Form of consent 23. Public data and investigative reports 24. Data retention and inclusion periods 25. Information dissemination by credit reference bureaus 26. Minimum standards for credit reports Part IV—Supervision of Credit Reference Bureaus 27. General powers of the central bank to regulate and supervise 28. On-site and off-site supervision 29. Reporting requirements Part V—Accounts and Audits 30. Accounts and audits Part VI—Corporate Governance 31. Management and governance of credit reference bureaus 32. Qualifications for appointment as director 33. Appointment and disqualification of officers and employees Part VII—Data and Information Management 34. Obligations of a credit reference bureau and data provider as regards information 35. Database management and security 36. Central data hub

5929 Regulation 37. Restrictions on use of data and information 38. Authority to share credit information across borders 39. Rights of data subjects to information Part VIII—Review, Rectification and Cancellation of Data 40. Review and rectification of data 41. Remedy for inaccurate information 42. Offences related to data and information management Part IX—Mandatory Checks 43. Mandatory checks Part X—Data Privacy and Confidentiality 44. Protection against invasion of the right to privacy 45. Mandatory standards for data collection, storage, processing and use outside jurisdiction 46. Data confidentiality 47. Obtaining information under false pretences 48. Unauthorised disclosures by officers or employees of a credit reference bureau or data provider 49. Identity theft 50. Information security Part XI—Ownership of Data 51. Ownership of data Part XII—Accredited Credit Providers 52. Accredited credit providers Part XIII—Competition 53. Anti-competitive practices 54. Misuse of market power 55. Predatory pricing 56. Penalties for anti-competitive practices Part XIV—Dispute Resolution 57. Dispute resolution and mediation

5930 Regulation Part XV—Service Level Agreements 58. Service level agreements Part XVI—Dissolution and Liquidation 59. Dissolution and liquidation 60. Authorisation of the central bank for voluntary liquidations Part XVII—Inspection of Records, Search and Seizure 61. Inspection of records, search and seizure Part XVIII—Fees 62. Fees Part XIX—General Provisions and Prohibitions 63. Claims and inquiries department 64. General prohibitions 65. Compliance and internal dissemination 66. Other penalties for non-compliance 67. Amendment of schedules 68. Revocation of SI- 59 of 2005 69. Transitional period SCHEDULES SCHEDULE 1 — Currency point SCHEDULE 2 — Application for a licence to establish a credit reference bureau. SCHEDULE 3 — Information sheet SCHEDULE 4 — Personal declaration Form SCHEDULE 5 — Criteria for fit and proper person SCHEDULE 6 — Fees SCHEDULE 7 — Quarterly statistical return SCHEDULE 8 — Credit reference bureau annual compliance return SCHEDULE 9 — Minimum Standards for credit reports

5931 STATUTORY INSTRUMENTS 2022 No. 106 The Financial Institutions (Credit Reference Bureau) Regulations, 2022. (Under Sections 78 and 131(1)(k) and (m) of the Financial Institutions Act, 2004) IN EXERCISE of the powers conferred on the central bank by sections 78 and 131(1) (k) and (m) of the Financial Institutions Act, 2004 and in consultation with the Minister responsible for finance, these Regulations are made this 26th day of September, 2022. Part I—Preliminary

Title. These Regulations may be cited as the Financial Institutions (Credit Reference Bureau) Regulations, 2022.
Application. These Regulations shall apply to all credit reference bureaus and data providers.
Interpretation. In these Regulations, unless the context otherwise requires— “Act” means the Financial Institutions Act, 2004; “accredited credit provider” has the meaning assigned to it in regulation 52; “biometric data” means the unique physical and other traits of a person as detected and recorded by an electronic device or system as a means of confirming identity or building a reference template;

5932 “board of directors” means the board of directors of a credit reference bureau; “central bank” means Bank of Uganda established under the Bank of Uganda Act; “credit information” means information concerning— (a) the credit history of a person, including applications for credit, credit borrower agreements to which the person is or has been a party, pattern of payment or default under any such credit borrower agreements, credit scores, incidence of enforcement actions with respect to any such credit borrower agreement, the circumstances of termination of any such credit borrower agreement and related matters; (b) financial history of a person, including the past and current income of a person, cash payments and debts, and other matters within the scope of financial means or dealings of a person; (c) employment history of a person, his or her career, professional or business history, including the circumstances of termination of any employment, career, professional or business relationship, and related matters; or (d) identity of a person including— (i) in the case of a natural person the national identification number or alien identification number as the primary identifier and other identifiers including the name, date of birth, financial card number, passport number, refugee identification number or other

5933 identification number recognised by law as applicable to the data subject, marital status and family relationships, current addresses, other contact details, biometric data and related matters; (ii) in the case of an entity the name of the entity, the registration certificate number, names of directors, shareholders holding five percent or more of the shares of the entity or partners in the case of a partnership, trustees in case of trusts or officials in case of other entities, current addresses, other contact details and related matters; (e) the nature and details of security or securities taken or proposed to be taken by an institution as security for the loans, advances and other credit facilities; and (f) any other information relating to the assessment and determination of the credit profile or history of a person. “credit provider” has the meaning assigned to it in the Act; “credit reference bureau” means a limited liability company licensed by the central bank under the Act and these Regulations to conduct credit reference bureau business; “credit reference bureau business” means the business of collecting, compiling, disseminating, processing, storing and updating credit information among financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers;

5934 “credit report” means any compilation of credit information supplied by a credit reference bureau in form of hard copies or in electronic form, related to the financial obligations of a natural or legal person; “credit score” means a numerical or text or alphanumeric expression of the credit worthiness of the customer, derived from the credit history of a customer at a given point in time; “currency point” has the value assigned to it in Schedule 1 to these Regulations; “customer” means a person who has or is proposing to establish a business relationship with a financial institution or microfinance deposit-taking institution or registered society or accredited credit provider in the ordinary course of its business; “data” means information collected by a credit reference bureau from a financial institution,microfinance deposit-taking institution, registered society or accredited credit provider for the purposes of identification, credit referencing and credit analysis; “data provider” means a financial institution, microfinance deposit-taking institution, registered society or a ccredited credit provider that provides data to a credit reference bureau under these Regulations; “data subject” means a person or entity whose credit information is collected or proposed to be collected for processing and administration by a credit reference bureau; “database” means a structured set of information or comprehensive collection of related information

5935 administered by a financial institution, microfinance deposit-taking institution, registered society, accredited credit provider, or credit reference bureau; “debt” means direct, indirect or contingent obligation incurred by an individual or entity with a third party; “financial institution” has the meaning assigned to it under the Act; “identity theft”is a form of stealing the identity of another person, in which someone pretends to assume another person’s identity in order to access resources or obtain credit and other benefits in the names of that person; “licence” means a licence issued under the Act and these Regulations; “licensee” means a credit reference bureau licensed under the Act and these Regulations; “microfinance deposit-taking institution” means an institution licensed under the Micro Finance Deposit-Taking Institutions Act, 2003; “negative information” means any adverse data relating to a customer including credit default on all types of facilities, bounced cheques, fraud or forgery, tendering false securities, false declarations and statements, receiverships, bankruptcies and liquidations, accounts compulsorily closed other than for administrative reasons; “non-performing loan” has the meaning assigned to it in the Act, the Micro Finance Deposit-Taking Institutions Act, 2003 and regulations made under the Act and the Micro Finance Deposit-Taking Institutions Act, 2003;

5936 “person” means any individual, a personal representative, company, partnership, trust, fund, foundation or enterprise wherever located or incorporated; “personal identification data” means information about an individual that can be used with one or more sources to uniquely identify the individual; “place of business” means any premises including the head office, branch or such other premises as may be approved by the central bank, at which a credit reference bureau conducts its business; “positive information” means all favourable data pertaining to the credit track record of a person in keeping up with credit and other financial obligations; “registered society” means a cooperative society registered under the Cooperative Societies Act; “substantial shareholder” means any person who holds more than five percent of the shares of a credit reference bureau; “user” means any person or entity that is entitled to request credit, biometric or personal identification information from a credit reference bureau. 4. Purpose The purpose of these Regulations is to— (a) regulate the operation of credit reference bureaus; (b) regulate the obligations of financial institutions, microfinance deposit-taking institutions, registered societies accredited credit providers and credit reference bureaus with regard to the operation of the credit reference system in Uganda;

5937 (c) regulate the use of personal information and provide for the protection of data and privacy of personal information; (d) improve consumer credit information and reporting; (e) make provision for expansion of the credit reference system to accredited credit providers; and (f) provide for collection of data from other sources to enrich credit data and to provide for other credit information related services. Part II—Licensing of Credit Reference Bureaus 5. Prohibition on operating credit reference bureau business without a licence (1) A person shall not operate credit reference bureau business in Uganda without a licence issued in accordance with these Regulations. (2) A person who contravenes the provisions of this regulation commits an offence and is liable, on conviction, to a fine not exceeding two hundred and fifty currency points or to imprisonment for a term not exceeding two years, or both. 6. Application for licence (1) A person who intends to operate credit reference bureau business shall apply to the central bank in the form specified in Schedule 2 to these Regulations. (2) The application referred to in subregulation (1) shall be accompanied by— (a) a description of the premises and the security measures adopted or to be adopted when the person commences operations; (b) information sheet in respect of each of the substantial

5938 shareholders if corporate, subsidiaries or affiliates, as the case may be, in the form specified in Schedule 3 to these Regulations; (c) sworn declaration of each of the current and proposed directors, managers and substantial shareholders if natural persons, in the form specified in Schedule 4 to these Regulations; (d) Any information necessary to assess whether the proposed managers, directors and substantial shareholders are fit and proper persons in accordance with the criteria specified in Schedule 5 to these Regulations; (e) information necessary for assessing the trustworthiness of the applicant including a credit report; (f) information necessary for assessing the expertise and qualifications of the current and proposed senior managers of the credit reference bureau; (g) management processes, including— (i) characteristics of products and services to be provided to users; (ii) service provision policies and procedure manuals; (iii) existing and proposed security and control measures aimed at preventing the use of credit information for a purpose other than that for which the credit information is intended; and (iv) an overview of operations including the description of systems and the design of the data collection and security;

5939 (h) the proposed fee and cost structure of products and services; and (i) experience in handling credit reference bureau business. (3) An application for a licence shall be accompanied by the following supporting documents— (a) a certified copy of the certificate of incorporation of the applicant; (b) a certified copy of the memorandum and articles of association of the applicant, (c) a feasibility study by the applicant company, showing the nature of the planned business, organisational structure and internal monitoring procedures of the company and covering the following aspects— (i) mission statement and goals; (ii) market analysis; (iii) ownership and governance; (iv) management; (v) financial analysis; (vi) balance sheets or projected balance sheets; (vii) description and projected investments; (viii) at least three years’ projection of financial statements; (ix) profitability analysis; (x) business plan; and (xi) business continuity, recovery plan and procedures;

5940 (d) sworn statements of current and proposed directors, managers and shareholders, specifying their respective assets and liabilities, income and expenditure in the form specified in Schedule 3 to these Regulations; and (e) submission of an illustration of the proposed product. (4) The central bank may require the applicant for a licence to furnish additional information in the form, manner and time as may be specified by the central bank. (5) A credit reference bureau shall within six months of being granted a licence submit to the central bank operational manuals referred to in subregulation (6) for clearance. (6) The operational manuals shall cover the following areas— (a) an overview of the intended business; (b) software configuration management; (c) data loading procedures; (d) data security and privacy policies; (e) dispute or complaint management and resolution policy and procedures; (f) systems maintenance; (g) query handling; (h) source code quality control; (i) user training manual; and (j) other policies and procedures relevant and necessary for the conduct of credit reference bureau business and for the services the credit reference bureau intends to provide.

5941 (7) Notwithstanding subregulation (5) above, the central bank may require some operational manuals to be submitted at the time of application. 7. Application processing fee An applicant shall pay to the central bank an application processing fee specified in Schedule 6 to these Regulations. 8. Licensing criteria for credit reference bureau business The central bank shall, in addition to other requirements in these Regulations, take into account the following factors when evaluating an application for a licence to operate a credit reference bureau in Uganda— (a) the background, reputation, integrity, experience and capacity of the proposed owners, directors and board members of the applicant company as evidenced by the curriculum vitae and professional record of the proposed persons; (b) the business plan of the applicant, including plans to undertake national coverage, roll-out plan and a mechanism to integrate, gather, input, update and validate data; and (c) the design of data collection for negative and positive information and flexibility in structuring the information in accordance with these Regulations and other applicable laws. 9. Minimum capital requirements for credit reference bureau business (1) A credit reference bureau shall not be granted or hold a licence unless the credit reference bureau has a minimum paid up capital of ten thousand currency points to be invested initially in such liquid assets as the central bank may approve. (2) The minimum capital funds of a credit reference bureau referred to in subregulation (1) unimpaired by losses, shall, at all times, not be less than ten thousand currency points.

5942 (3) The central bank may vary the minimum capital requirements specified in subregulation (1) and (2). 10. Pre-licensing inspection The central bank or its appointed agent shall carry out on-site inspection of the premises of the applicant to determine the adequacy of the physical security system of the applicant and to confirm the following matters— (a) suitability of premises for the operations of credit reference bureau business; (b) separation of the proposed credit reference bureau business from other businesses performed by the applicant; and (c) the adequacy of the administrative and operational processes and the internal control systems. 11. Grant of licence (1) The central bank may, upon evaluating an application, grant a licence, with or without conditions. (2) Where a licence is granted with conditions, the central bank shall attach to the licence the specific conditions and may add, vary, revoke or substitute such conditions as the central bank may consider appropriate and the licensee shall comply with those conditions. (3) The central bank shall before adding, varying, revoking or substituting conditions attached to a licence— (a) notify the licensee of its intention to take such action; (b) give the licensee an opportunity to submit in writing within fourteen working days, reasons as to why its licence should not be varied, revoked or substituted; (c) upon considering the submissions of the licensee, the central bank shall make its decision and notify the applicant of the decision and reasons for that decision in writing within fourteen working days; and

5943 (d) a decision of the central bank taken in accordance with this regulation shall be binding on the licensee. (4) Any licensee who fails to comply with any of the conditions of a licence shall have the licence suspended and where no steps are taken by the licensee to comply with the conditions set within ninety days suspension of the license, the central bank shall revoke the licence. 12. Annual licence fee (1) A licensee shall pay an annual license fee specified in Schedule 6 to these Regulations on or before the 31st day of January of each year. (2) The central bank shall revoke the licence where a licensee fails to pay the licence fee specified in subregulation (1). 13. Refusal to grant licence (1) The central bank may refuse to grant a licence to an applicant and the central bank shall give reasons for the refusal. (2) The central bank shall communicate the reasons for refusal to grant a licence to the applicant in a letter of refusal, within six months. (3) The period referred to in subregulation (2) shall be reckoned from— (a) the date of receipt of the application; or (b) where additional information is required, the date of submission by the applicant of the information, whichever is later. 14. Duration of licence A licence issued under these Regulations shall be valid unless revoked.

5944 15. Non-transferability of licence and share transfer approval (1) A licence granted by the central bank under these Regulations shall not be transferable or assignable and any purported transfer or assignment shall be null and void. (2) A person shall not sell, assign or transfer in any way more than five percent or more of the shares of a credit reference bureau licensed under these Regulations,without the prior approval of the central bank. 16. Appointment of agents (1) A credit reference bureau may, with the approval of the central bank, appoint an agent on non-exclusive basis to provide the following services— (a) delivery of credit reports to requesting persons as may be authorised under these Regulations; (b) public sensitisation of customers, institutions and other credit information providers; (c) receiving and channelling complaints to the credit reference bureau; and (d) other services as may be approved by the central bank upon application by a credit reference bureau. (2) An application for approval to appoint agents shall be accompanied with a draft agency agreement to be signed by the credit reference bureau and its appointed agents. (3) A credit reference bureau shall carry out a suitability assessment on the capability of an agent and shall satisfy itself as to the— (a) existence of adequate infrastructure for delivery of credit reports to requesting persons; (b) ability of the agent to keep, maintain and secure confidentiality of customer information;

5945 (c) ability to conduct proper and sufficient due diligence and identity authentication on any person or entity requesting for credit information; and (d) compliance by the agent with the requirements under the Data Protection and Privacy Act, 2019 and the regulations made under that Act. (4) For purposes of this regulation, “agent” means an entity or person contracted by a credit reference bureau to provide the services referred to in subregulation (1) on behalf of the credit reference bureau, in such a manner and complying with such criteria as may be prescribed by the central bank. 17. Revocation and expiry of licence (1) Notwithstanding regulation 14, a licence shall automatically expire if the licensee has not commenced credit reference bureau business during the first twelve months immediately after the date of issue of the licence. (2) The central bank may by notice in writing, revoke a licence issued under these Regulations if— (a) the central bank is satisfied that the licensee— (i) has ceased to transact credit reference bureau business in Uganda; (ii) has furnished information or a document to the central bank, in connection with its application for a licence which is false or misleading in material particular; (iii) has been found by the central bank to be insolvent or unable to pay its liabilities as they mature; (iv) has gone into liquidation; (v) has been wound up;

5946 (vi) has been dissolved; (vii) is in the opinion of the central bank, carrying on its business in a manner which violates the conditions of the licence; (viii) is unable or has failed to protect the confidentiality or to secure the integrity of data or information the licensee collects; (ix) has contravened these Regulations; (x) has, without the consent of the central bank, amalgamated with another entity or sold or otherwise transferred its assets and liabilities to another entity; (xi) has failed to comply with any direction or order or guidance or circular or directive given by the central bank, with respect to the operations or conduct of the licensee; (xii) has been engaged in using, sharing or distributing the information collected as authorised under these Regulations, for a purpose for which is not permitted by these Regulations; and (b) if the central bank considers that it is in public interest to revoke the licence. (3) The central bank shall, as far as it is reasonably practicable, before revoking any licence under subregulation (2), serve a notice in writing on the licensee to show cause why the licence should not be revoked and specifying a date, not less than thirty calendar days after the date of the notice, upon which the revocation will take effect. (4) A person served with a notice under subregulation (3) may, upon receipt of the notice, make written representations to the central bank to justify why the licence should not be revoked.

5947 (5) The central bank shall consider the representation and take a decision. (6) The central bank shall, upon revoking a licence of a credit reference bureau under subregulation (2), immediately inform the credit reference bureau in writing of the revocation, giving the reasons for the revocation. (7) The central bank shall, upon revocation of the licence of a credit reference bureau, take over control of the business of the licensee and wind up the affairs of a credit reference bureau in accordance with the applicable laws and procedures for winding up companies in Uganda. (8) For the purposes of subregulation (7) the credit reference bureau shall hand over all credit reference bureau data in a format that the central bank shall specify and provide unlimited access to the central bank to any information that the central bank may require for the orderly winding up of the affairs of the credit reference bureau. (9) Upon revocation of the licence or commencement of winding up proceedings,the central bank shall retain ownership and access rights to the data collected by the credit reference bureau pursuant to these Regulations. 18. Bank guarantee (1) Every licensee shall, within thirty days after being granted a licence, submit to the central bank a confirmed irrevocable bank guarantee of five thousand currency points from a financial institution licensed by the central bank and in a format acceptable to the central bank. (2) A licensee shall maintain, throughout the duration of the license, the valid bank guarantee referred to in subregulation (1). (3) Where a licensee is required to pay a penalty under these Regulations and fails to do so within such time as may be prescribed

5948 by the central bank, the central bank may recover the amounts due on the penalty from the bank guarantee issued under subregulation (1). (4) Where a penalty has been recovered from the bank guarantee in accordance with subregulation (3), the licensee shall within thirty calendar days after being notified, restore the diminished irrevocable bank guarantee in favour of the central bank to its original amount and format acceptable to the central bank. (5) Where a credit reference bureau contravenes subregulation (1) or (4), the central bank shall suspend the license of credit reference bureau for a period of thirty days and thereafter the central bank shall revoke the licence if the contravention continues. (6) The central bank may revise the amount of the irrevocable bank guarantee required under subregulation (1). Part III—Operations of Credit Reference Bureaus 19. Collection of information (1) A credit reference bureau shall collect from financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers, negative or adverse information on the background and credit history relating to the nonperforming obligations of the customers of such financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers. (2) A credit reference bureau shall, with the authorisation of the data subject or customer of a financial institution, microfinance deposit-taking institution, registered society and accredited credit provider, compile positive information regarding economic, financial and commercial obligations of such customer or data subject in order to determine their overall debt exposure and capacity to repay. (3) A credit reference bureau shall ensure contractually that the data provider, at the time of submitting the information referred

5949 to in subregulation (1) and (2), confirms that the data provider has obtained the following— (a) credit information of the customer or data subject; and (b) a duly executed waiver of consent for disclosure of information to other financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers for positive information. (4) The data provider shall confirm to the credit reference bureau that the information submitted is supported with the corresponding waiver of consent. (5) The data provider shall ensure that the information submitted to the credit reference bureau is accurate. (6) A credit reference bureau shall not include any of the following in a credit report— (a) any information where the name and address of the source of the information is not recorded or retained in the files of the credit reference bureau or is not readily ascertainable by the customer or data subject; (b) any information not based on the most reliable evidence reasonably available; (c) information regarding any criminal charges against the customer or data subject unless the charges relate to a debt obligation or financial impropriety and have resulted into a conviction; (d) information as to any judgment against the customer or data subject unless mention is made of the name and, if available, the address of the judgment creditor or agent of the creditor as given at the date of entry of the judgment and the amount of the judgment;

5950 (e) any information given orally unless the source of the information is identified and the content of the oral report is noted in writing in the file; (f) information about the race, sexuality, creed, colour, ancestry, ethnic origin, religious or spiritual inclination or political affiliation of a customer or data subject; and (g) with regard to natural persons, any information relating to entities in which they are shareholders, directors, partners, trustees or officials in those entities unless the natural person so referred, guaranteed any of the loan or credit obligations of the entity. 20. Submission of negative credit information (1) All financial institutions, microfinance deposit-taking institutions and registered societies shall, without any requirement for consent from the customer, submit to a credit reference bureau the following information— (a) all the details of non-performing loans and other accredited credit facilities classified as doubtful, substandard or loss, subject to the following conditions— (i) a formal demand has been served on the customer and the customer having failed to provide a satisfactory repayment proposal; (ii) the amount owed is not be in dispute; and (iii) the customer is notified at least twenty eight days in advance, of the intention to submit the information to credit reference bureaus. (b) Information on customers involved in financial malpractices including bouncing of cheques due to lack of funds and fraud. (2) The notification referred to in subregulation (1)(a)(iii) above shall be considered to have been given if it is sent to the last

5951 known address or contact details of the data subject by registered mail, email, short message service through the registered telephone number of the customer or physical delivery of the letter evidenced by acknowledgement of receipt by the customer or his or nominee and the data provider shall retain the evidence of notification served under this regulation for at least five years. (3) A financial institution, microfinance deposit-taking institution or registered society which fails or neglects to submit to credit reference bureau information that is required to be submitted under this regulation shall pay to the central bank a civil penalty of two hundred currency points, and, in the case of a continuing violation, an additional civil penalty not exceeding fifty currency points for each calendar day on which the violation continues. 21. Disclosure of positive information A data provider may, with the express written consent of the customer, disclose to a credit reference bureau positive information about the credit history of a customer, economic, financial and commercial obligations of the customer in order to determine their overall debt exposure and capacity to repay. 22. Form of consent (1) Where consent or authorisation of a customer is required under these Regulations for submission or sharing of credit information, such consent or authorisation shall be obtained by the customer appending his or her signature to any document giving express consent or authorisation for the submission or sharing of credit information. (2) The documents referred to in subregulation (1) may include, account opening documents, loan application forms, loan agreements or any other agreement between a financial institution, microfinance deposit-taking institution or registered society and a customer or an agreement between a customer and an accredited credit provider or by any other documentary means as may be agreed by the parties.

5952 (3) The documents referred to in subregulation (1) and (2) shall at a minimum— (a) inform the customer that his or her credit information shall be disclosed to a credit reference bureau for dissemination to the users of the credit information; (b) inform the customer of his or her rights to— (i) refuse to give the consent and the consequences of such refusal; (ii) request for rectification of the credit information in case of any inaccuracies; (iii) receive notification of the results of a credit information check before an adverse action or decision is taken by a person basing wholly or partly on the result of the credit information check; and (iv) seek for and obtain independent legal advice in relation to the consent given and to take legal action against any person who violates his or her rights to privacy. (4) For purposes of subregulation (1), “signature” means any symbol executed or adapted or any methodology or procedure employed or adapted by the customer with the intention of authenticating a document, including an electronic or digital method. 23. Public data and investigative reports (1) A credit reference bureau may with the approval of the central bank, disseminate public information relating to a customer or information from public sources and public entities such as, the Uganda Registration Services Bureau, business and trade licensing authorities, the land registry, collateral registries, the Uganda Revenue Authority, local governments, court registries and other public entities, provided that, before including such information in any credit report

5953 or using the information to generate a credit score, a credit reference bureau shall— (a) follow reasonable procedures to confirm the accuracy and authenticity of the information from a source that has independent and direct knowledge of the information; (b) where such information relates to any court proceeding of a civil or criminal nature or any public record, verify the accuracy of the information not more than one month before the date on which the information is included in any report; and (c) ensure that use of the information does not in any way violate the rights and liberties of the data subject. (2) For purposes of subregulation (1), a credit reference bureau may enter into memoranda of understanding with public entities for the provision of information and such memoranda shall specify— (a) the conditions for the provision of information; (b) the obligation to furnish accurate and updated information; (c) the obligation to promptly correct any information submitted to the credit reference bureau which is inaccurate, false, misleading or erroneous in any form or has been overtaken by events; (d) details on data to be provided; and (e) the manner and form through which the information shall be submitted to the credit reference bureau. (3) Every credit reference bureau shall periodically report to the central bank the source and details of the public data included in the reports of the credit reference bureau together with the process of verification carried out to authenticate the veracity of such data.

5954 (4) Where a credit reference bureau has included in any report, public domain data, and the central bank is satisfied that a credit reference bureau did not take all reasonable measures to verify the veracity and accuracy of the data, the central bank shall impose a civil penalty of two hundred and fifty currency points on the credit reference bureau. (5) For the purposes of this regulation, “public information” means any information that has been disclosed, disseminated or made available to the public. 24. Data retention and inclusion periods (1) A credit reference bureau shall retain all data for ten years from the time the credit reference bureau received or created the data except that where such data relates to a debt obligation, the credit reference bureau shall retain the data for ten years after the debt is fully paid off or has been extinguished by any other procedure such as being written-off. (2) Notwithstanding subregulation (1), a credit reference bureau shall not include in a credit report any of the following— (a) information regarding the repayment of any debt five years after the obligation has been fully paid or has been extinguished by any other procedure except writing-off; (b) information on inquiries made on the record of a customer two years after the inquiry has been made; (c) information on disputes lodged by customers such as the number and nature of complaints lodged and whether complaint was rejected except those complaints that were upheld eighteen months after the dispute has been lodged; (d) information on bankruptcy of a customer five years after the date of discharge unless the customer has been bankrupt more than once;

5955 (e) information as to any judgment against a customer five years after the judgment was given unless the judgment creditor, or his or her agent, confirms that the judgment debt remains unpaid and the confirmation appears in the file; (f) information on non-performing credit facilities after the last payment was made or if no payment was made five years after the debt was incurred; and (g) information on fines and unpaid taxes seven years after the fine was imposed or the tax was assessed. 25. Information dissemination by credit reference bureaus (1) A credit reference bureau shall through a formal request provide credit information services to financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers. (2) In the case of accredited credit providers the information to be provided to accredited credit providers shall be in such form and with such content as may be approved by the central bank. (3) In addition to credit information services in subregulation (1), a credit reference bureau may provide value-added services to financial institutions, microfinance deposit-taking institutions, registered societies and accredited credit providers subject to approval by the central bank. (4) For the purposes of subregulation (3), “value added services” means services beyond the ordinary credit reference bureau business that are intended to provide synergy and complement credit reports in order to enhance user benefits. (5) A credit reference bureau shall exchange credit information with other licensed credit reference bureaus in a manner prescribed by the central bank.

5956 (6) A person receiving credit information from a credit reference bureau shall ensure protection, security, confidentiality, retention and destruction of such information as specified in the Data Protection and Privacy Act, 2019. 26. Minimum standards for credit reports The minimum standards for credit reports shall be as specified in Schedule 9 to these regulations. Part IV—Supervision of Credit Reference Bureaus 27. General powers of the central bank to regulate and supervise The central bank shall regulate and supervise all credit reference bureaus licensed under these Regulations and may issue directives or guidance on any matter relating to the conduct of credit reference bureau business. 28. On-site and off-site supervision (1) The central bank shall cause an inspection to be made, by an officer of the central bank or other person appointed by the central bank, of any credit reference bureau, the premises, the operational and financial records, books of accounts, information technology systems and all such other records as the central bank may require for supervision and regulation of the credit reference bureau, and the central bank shall provide to that credit reference bureau a copy of the report on such inspection. (2) A credit reference bureau shall furnish to the officer or other person making an inspection under subregulation (1), all operational records, books of account, financial records and other documents in the custody or power of the credit reference bureau and such statements or information relating to the affairs of the credit reference bureau as the officer may require within such reasonable time as the officer may specify. (3) A credit reference bureau which, without reasonable cause, fails to comply with subregulation (2) shall pay to the central

5957 bank a civil penalty of two hundred and fifty currency points, and, in the case of a continuing violation, an additional civil penalty not exceeding fifty currency points for each calendar day on which the violation continues. (4) An officer of the central bank or any person appointed by the central bank under subregulation (1) shall after inspection of the credit reference bureau prepare and submit a report which shall draw the attention of the credit reference bureau to any contravention of the Act and Regulations, any weaknesses or deficiencies in systems control and procedures or in the manner of conduct of the business of the credit reference bureau inspected, any mismanagement, and any other matter relating to the business of the credit reference bureau not consistent with sound operation and practice or the principles of effective competition. (5) A credit reference bureau shall furnish to the central bank all information and data of its operations in Uganda including periodic returns required by the central bank and the audited books of account of the credit reference bureau which the central bank may require for the proper discharge of its functions under these Regulations. (6) A credit reference bureau which, without reasonable cause, fails to comply with subregulation (5), or submits inaccurate returns or reports, shall pay to the central bank a civil penalty of two hundred and fifty currency points, and, in the case of a continuing violation, an additional civil penalty not exceeding fifty currency points for each calendar day on which the violation continues. (7) The central bank may, upon request made to it by any monetary or financial regulatory authority in the ordinary course of its business, disclose any of the information provided under this regulation to that monetary or financial regulatory authority within or outside Uganda, except that the central bank shall, before disclosing any information under this regulation, satisfy itself that the information is required for the proper discharge of the functions of the requesting monetary authority or financial regulatory authority and the information shall not be used for any other purpose.

5958 29. Reporting requirements (1) A credit reference bureau shall submit to the central bank, by the fifteenth day of the month following the end of the calendar quarter in issue, a statistical report in the form specified in Schedule 7 to these Regulations. (2) The central bank may by notice to a credit reference bureau vary the period for submission of the statistical report referred to in subregulation (1). (3) A credit reference bureau licensed under these Regulations shall, within three months after the end of the calendar year, submit to the central bank an annual compliance report in the form specified in Schedule 8 to these Regulations and the report shall, among others, address the following matters— (a) accuracy of data received and reported; (b) incidence of complaints and complaint resolution; (c) adequacy of procedures employed to ensure— (i) that data received and reported by the credit reference bureau is accurate; (ii) that integrity and confidentiality of data is maintained; (iii) that complaints are resolved promptly and satisfactorily; (iv) data retention periods are adhered to; and (v) that credit scoring is done in a transparent manner and in accordance with the Act, these Regulations and other applicable laws; (d) adequacy and implementation of operational policies and procedures;

5959 (e) whether the credit reference bureau only receives data from sources, or disseminates data or information to users permitted under these Regulations; (f) incidence of material change in management, key operational areas, business disruption any implication of the business disruption and remedial action undertaken; (g) compliance with the minimum information technology standards as may be prescribed by the central bank; and (h) any other matter prescribed or requested for by the central bank. (4) The annual compliance report referred to in subregulation (3) shall be subject to an audit by the external auditors of the credit reference bureau or any other auditor appointed by the credit reference bureau and approved by the central bank to audit the annual compliance report. (5) The cost of the annual compliance audit report shall be borne by the credit reference bureau. (6) A credit reference bureau shall, within twelve months of being licensed by the central bank and thereafter, by the fifteenth day of the month following the end of the calendar quarter, submit an independent information technology audit report. (7) The central bank may require a credit reference bureau to submit a report other than the report referred to in subregulations (1), (3) and (6) and shall determine the manner, form and frequency for submission of the report. (8) A credit reference bureau which, without reasonable cause, fails to comply with this regulation or submits inaccurate reports, may have its licence suspended or revoked or pay a civil penalty of fifty currency points per day of default.

5960 Part V—Accounts and Audits 30. Accounts and Audits (1) A credit reference bureau shall keep proper books of account and records in accordance with International Financial Reporting Standards and the Companies Act, 2012. (2) A credit reference bureau shall nominate annually for appointment as external auditor, a firm from the pre-qualified list of auditors of the central bank and seek the approval of the central bank for appointment of the nominee. (3) A credit reference bureau shall submit a copy of its audited financial statements to the central bank within three months after the end of the financial year and the copy of the audit report shall also contain findings and opinion of the auditor on the state of management information systems of the credit reference bureau. (4) The external auditor shall submit to the central bank a management letter in which the external auditor shall disclose all weaknesses or lapses in internal controls and risk management procedures or any contravention of the Act and these Regulations which may not be fundamental to lead to qualification of the accounts. (5) Where the central bank is of the opinion that the credit reference bureau is conducting its business in contravention of the Act and these Regulations, the central bank may commission a special audit of the credit reference bureau. (6) The cost of all audits shall be paid and met in full by the affected credit reference bureau. (7) The central bank may prescribe the timing and types of audits and the frequency of such audits, to be conducted on acredit reference bureau.

5961 Part VI—Corporate Governance 31. Management and governance of credit reference bureaus (1) The governance of a credit reference bureau shall vest in the board of directors consisting of not less than five members the majority of whom should be non-executive. (2) The functions of the board shall be to— (a) ensure that the credit reference bureau maintains, at all times, an effective system of internal controls; (b) perform annual evaluation of the performance of the chief executive officer and oversight over senior management; (c) be responsible for the strategic direction of the credit reference bureau, approval of policies and procedures; and (d) ensure that the activities conducted by a credit reference bureau conform with the Act and these Regulations. (3) A person is qualified for appointment as a director, if that person is approved by the central bank in accordance with regulation 32. (4) The directors referred to under subregulation (1), shall elect a non-executive chairperson from amongst their members. (5) The board of a credit reference bureau shall meet at least once every quarter. (6) The quorum for a meeting of the board shall not be less than three members. 32. Qualification for appointment as director (1) The central bank shall not approve the appointment of a person as director unless the person—

5962 (a) possesses adequate professional credentials or experience or both for the position for which he or she is proposed; (b) is of sound mind; (c) is not a minor; (d) is of a proven moral integrity; (e) is not an undischarged bankrupt; (f) has not been convicted of a criminal offence involving moral dishonesty or fraud; (g) is not a director or an officer of another credit reference bureau; and (h) meets the fit and proper requirements specified in Schedule 5 and such other suitability test as may be determined by the central bank from time to time; (2) A person shall be removed from the office of director if that person— (a) has been convicted of an offence under the Act; (b) has been convicted of a criminal offence involving dishonesty or fraud; (c) is an undischarged bankrupt or enters into a composition scheme or arrangement with his or her creditors; (d) is of unsound mind; (e) has defaulted in the repayment of any advance or loan made to him or her by any institution licensed by the central bank; or (f) is an auditor of a credit reference bureau licensed under these Regulations. 33. Appointment and disqualification of officers and employees (1) A credit reference bureau shall not appoint any person as an officer or employee of the credit reference bureau, or if already in office or employment, shall disqualify such a person, if such person is—

5963 (a) an undischarged bankrupt or enters into a composition or scheme of arrangement with his creditors; (b) convicted of an offence involving fraud or dishonesty; or (c) removed from office under the provisions of these Regulations. (2) A credit reference bureau shall not appoint any person as a senior manager without the approval of the central bank. (3) For purposes of subregulation (2) a senior manager shall be a person at the rank of head of department and above. (4) A credit reference bureau shall submit to the central bank an updated information sheet as specified in Schedule 3 to these Regulations not later than the 31st day of January each year. (5) A credit reference bureau which contravenes this regulation commits an offence and is liable to a penalty of two hundred fifty currency points. Part VII—Data and Information Management 34. Obligations of a credit reference bureau and data provider as regards information (1) Every credit reference bureau shall— (a) implement strict quality control procedures in order to ensure the quality of the database of the credit reference bureau and continuity of the services; (b) utilise the information collected solely for the purposes set out in these Regulations; (c) provide authentic, legitimate, reliable, accurate, truthful and current information that reflects the existing situation of the data subject at any given time and if the information

5964 is found to be illicit, inaccurate or no longer valid, the credit reference bureau shall promptly take the corrective measures necessary to remedy the deficiencies; (d) within not more than one hundred eighty calendar days of submission of information by an accredited credit provider, share that information with the other credit reference bureaus; (e) provide the central bank with access to all the information managed by the credit reference bureau in the manner stipulated by the central bank; (f) observe, through the shareholders, directors and employees, a perpetual duty of confidentiality with regard to the information obtained by it under the provisions of these Regulations; (g) take all such steps as are reasonably necessary to ensure that the information maintained by the credit reference bureau is duly protected against any loss, unauthorised access, use or disclosure; (h) manage the data in the possession of the credit reference bureau or that which the credit reference bureau has access to in accordance with these Regulations and the laws applicable to data privacy and protection in Uganda. (2) A credit reference bureau shall only release credit information to a financial institution or microfinance deposit-taking institution or a registered society or an accredited credit provider upon satisfaction that the person to whom information is to be released— (a) requires the information to evaluate a customer’s application for credit or other customer initiated business transactions; (b) has certified to the credit reference bureau that the person will use the credit information for the purpose of making

5965 a credit decision or other customer initiated business transactions; (c) shall store the credit information so provided in a secure manner and will enforce rigorous standards of security, reliability and efficiency; and (d) has agreed to properly dispose of credit information so that the credit information cannot reasonably be read or reconstructed after using it for the stated purpose except that this requirement shall not be construed to mean that information cannot be stored for future reference by the user. (3) A financial institution or microfinance deposit-taking institution, registered society or an accredited credit provider shall submit and update all credit information to the credit reference bureau in accordance with these Regulations. (4) A financial institution, microfinance deposit-taking institution, registered society or an accredited credit provider shall not use the information obtained from a credit reference bureau for any purpose other than to make a credit decision or other customerinitiated business transactions. (5) A financial institution, microfinance deposit-taking institution, registered society or an accredited credit provider shall not release such information to any third party, other than the agent of a financial institution, microfinance deposit-taking institution, registered society or an accredited credit provider appointed for the purpose of providing external services to the financial institution or microfinance deposit-taking institution, registered society or accredited credit provider. (6) A person to whom information is disclosed under subregulation (5) shall be under the same obligation of confidentiality as the data provider, except that the data provider shall remain liable for any misuse of this information by the third party.

5966 (7) A person shall not knowingly obtain any information in respect of a data subject or data provider from a credit reference bureau except for purposes described in subregulation (2). (8) A person who contravenes this regulation is liable to pay a civil penalty of fifty currency points for each breach. 35. Database management and security (1) The central bank may prescribe the formats for data standardisation and submission. (2) A data provider is responsible for the timely submission of up-to-date information to a credit reference bureau. (3) A credit reference bureau shall implement procedures to ensure that the information in its database is up-to-date. (4) A credit reference bureau, its employees and agents shall take the necessary security and control measures in order to avoid improper use of, access to and mismanagement of information in its possession or information to which the credit reference bureau has access. (5) For the purposes of subregulation (4), “improper use or mismanagement of information” means any act or omission not permitted by the licence, irrespective of whether or not the improper use causes loss or damage to the data subject or produces a benefit of any kind in favour of a credit reference bureau or the employees of the credit reference bureau. 36. Central data hub The central bank or its appointed agent or any other person authorised by the central bank may establish a central data hub or such other industry tool for submission of credit information to the credit reference bureaus. 37. Restrictions on use of data and information. (1) The central bank or a professional advisor of the central bank may use the data collected by a credit reference bureau for the

5967 performance of the functions of the central bank under the Bank of Uganda Act. (2) For the purposes of subregulation (1) “professional advisor” means any individual, company or other entity appointed by the central bank to carry out any instructions, advisory or otherwise, in relation to the dispensation of the mandate of the central bank under the Bank of Uganda Act. (3) The central bank may publish data on industry statistics and trends, where such information does not identify any particular consumer or relate a particular consumer to any information published. (4) A credit reference bureau shall not request, collect, disseminate or process information or data for any other purpose, other than in relation to the licensed business of the credit reference bureau in Uganda. (5) A credit reference bureau shall not sell, lease or transfer title, ownership or possession of any data except as shall be permitted by the central bank pursuant to these Regulations. (6) A credit reference bureau which contravenes this regulation is liable, to pay a civil penalty not exceeding two hundred and fifty currency points. (7) A person who obtains any information in contravention of this regulation is liable, to pay a civil penalty not exceeding two hundred and fifty currency points. 38. Authority to share credit information across boarders (1) Subject to the Data Protection and Privacy Act, 2019, the following persons may share credit information across borders— (a) the central bank and other entities performing regulatory or supervisory roles; and

5968 (b) credit reference bureaus or entities performing similar roles. (2) The sharing of information under subregulation (1) shall only be done where there is a reciprocal arrangement between the persons sharing the credit information. (3) The central bank shall publish and maintain on its website or in any other manner, an up-to-date list of reciprocal arrangements for purposes of subregulation (2). (4) Where an authorised person seeks to obtain credit information of a person from another authorised person located in another country, the following requirements shall apply— (a) the request shall be made in writing and shall set out — (i) the complete identity details of the requesting person including details of the principal place of business of that person; (ii) the nature of its business or functions; (iii) the identity details of the person whose credit information is sought; (iv) the nature of credit information that is being sought; (v) the purpose for which the information sought will be used and how it will assist in discharging a function, performing a duty or the rendering of a service; (vi) documentary evidence with respect to a matter that would require the credit information sought; (vii) the grounds on which the requesting person reasonably believes that the credit information is in possession of the other person; (viii) evidence establishing that the legal framework of the country in which the requesting person is located permits cross-border sharing of credit information;

5969 (ix) an irrevocable undertaking that the information shall be used solely for the stated purpose and shall be kept confidential at all times even after the information has been used; and (x) an irrevocable undertaking that the confidentiality of the information shall be maintained at all times even after the information has been used for the purposes for which it was sought; (b) upon receipt of the request referred to in subregulation (4)(a), the receiving person shall analyse the request and establish that the request meets the requirements of these Regulations and may, if it does not, request for additional information; (c) where the credit information sought is in the possession of the requested person, the person may furnish the requesting person with the information; and (d) where the information sought is not in the possession of the requested person or the information is in the possession of another person or, for whatever reason, the requested person does not wish to share the information with the requesting person, the requested person shall notify the requesting person in writing of its decision. (5) A person who contravenes this regulation is liable to pay a civil penalty of fifty currency points for each breach. 39. Rights of data subjects to information (1) A credit reference bureau shall, at least twice every year, provide a data subject with a free copy of his or her information held by the credit reference bureau. (2) A credit reference bureau shall upon request by the data subject and on payment of the fee set by the credit reference bureau and prescribed by the central bank in accordance with these Regulations, provide additional copies of a data subject’s information to the data subject.

5970 (3) The information referred to in subregulation (1) and (2) shall be provided in such form and with such content as shall be appropriate to inform the data subject of his or her current status. (4) Where a data subject requests for information under this regulation, the credit reference bureau shall, within five working days of receiving a request in writing and such particulars as may reasonably be required to identify the data subject, provide to the data subject a copy of all information relating to the data subject. (5) Where the information held by a credit reference bureau includes public information or information obtained as a result of an investigation, the data subject is entitled to know from the credit reference bureau the source of the information. (6) A data subject has the right to receive notification from the data provider of the results of a credit information check before an adverse action or decision is taken by the data provider basing wholly or partly on the result of the credit information check. (7) A credit reference bureau shall not require a data subject to give an undertaking or waive or release any rights as preserved by law or under these Regulations as a condition precedent to the data subject’s access to a credit report pursuant to this regulation. (8) A data subject may— (a) in writing, authorise a third party to access a copy of his or her credit report from the credit reference bureau; or (b) in writing, request a credit reference bureau to share a copy of his or her credit information with a third party. (9) A credit reference bureau shall, for requests made under subregulation (8), ensure that appropriate identification for the data subject and authorised person have been verified before issuing the data subject’s information.

5971 (10) A person who contravenes this regulation is liable to pay a civil penalty of fifty currency points for each breach. Part VIII—Review, Rectification and Cancellation of Data 40. Review and rectification of data (1) Where the data subject has reasonable cause to believe that the information contained in the database held by a credit reference bureau under these Regulations was obtained illegally, is inaccurate, erroneous or outdated, he or she may in writing request a review by the credit reference bureau of the information and any deficiencies identified shall be promptly remedied. (2) Where any legal liability or cost arises from the illegal, inaccurate, erroneous or outdated information, the financial institution,microfinance deposit-taking institution, registered society or accredited credit provider which provided the inaccurate, erroneous or outdated information is liable for the relevant cost of reviewing the information. (3) Where the complaint of a data subject is received by a financial institution, microfinance deposit-taking institution, registered society or an accredited credit provider, that financial institution, microfinance deposit-taking institution, registered society or accredited credit provider shall immediately notify the credit reference bureau to which the complaint relates, of the complaint. (4) The credit reference bureau shall, within seven working days after receipt of the notice referred to in subregulation (3), conduct an investigation, based on all relevant information provided by the complainant and contact the responsible data provider as necessary to confirm the accuracy of information. (5) The credit reference bureau shall, within three working days of being notified that the credit information of the data subject is disputed, attach a note to the credit report of the data subject stating which information is currently disputed and under investigation, which note shall remain on the file until resolution of the dispute.

5972 (6) When a data provider receives a notice of dispute from a credit reference bureau under subregulation (4) the data provider shall, within seven working days after receiving the notice, complete all necessary investigations into the disputed information and give the credit reference bureau a notice of resolution, advising whether the disputed information is to be deleted, corrected or remain unchanged. (7) Where the investigation reveals an error, the credit reference bureau shall immediately remedy the error. (8) If the investigation is not completed within fourteen working days after the request of the data subject, the credit reference bureau shall suppress the disputed or corrected information as requested by the complainant and a note of this suppression shall be displayed on the report until the complaint is upheld or rejected. (9) If the data provider does not take the requisite steps to resolve the dispute as required under subregulation (6), the data provider is liable to pay a civil penalty not exceeding two hundred and fifty currency points and may be excluded from receiving credit information from any credit reference bureau. (10) Where the request for rectification of credit information is made and the credit reference bureau fails to comply with the request within the period prescribed under this regulation, the complainant may inform the central bank in writing and the central bank may, following investigations into the matter, order the credit reference bureau to comply with the request or to erase the data which is inaccurate or misleading. (11) Where information of a data subject is disputed and subsequently corrected, the data subject shall be entitled to a free updated credit report as proof of the fact that the data has been corrected. (12) Where the complainant has made a claim under subregulation (1) which is prima facie unfounded, a credit reference

5973 bureau or data provider may notify the complainant that, based on the information available to credit reference bureau, the claim is prima facie unfounded and shall not be investigated further. (13) Where the complainant insists that the complaint should be investigated and the complaint proves to be unfounded after investigation, the credit reference bureau or data provider may claim reimbursement from the complainant for the costs associated with or incurred in its investigation. (14) A credit reference bureau shall submit to the central bank a quarterly report on all data which is under dispute or investigation and the report shall include all amended data. (15) A credit reference bureau shall submit to the central bank a monthly report of all customer complaints received during the month indicating the complaints which have been resolved and those that remain unresolved. 41. Remedy for inaccurate information. (1) A person who is aggrieved by reason of the inaccuracy of the credit information disseminated may apply to court for redress. (2) In any proceedings under subregulation (1), it is a defence to prove that a credit reference bureau or data provider took reasonable care in the circumstances to ensure that the credit information was correct and accurate at the material time. 42. Offences related to data and information management. A credit reference bureau or data provider which— (a) wrongfully alters, modifies or deletes records from its database; (b) fails to adopt security and control measures that are necessary to prevent the wrongful use, unauthorised access or mismanagement of information; or

5974 (c) fails to comply with an order of the central bank on data and information management, contravenes these Regulations and is liable to pay a civil penalty of two hundred and fifty currency points and in the case of a continuing violation, an additional civil penalty not exceeding fifty currency points for each day on which the violation continues. Part IX—Mandatory Checks. 43. Mandatory checks A financial institution, microfinance deposit-taking institution or registered society shall, unless the central bank directs otherwise, conduct a mandatory credit check at a credit reference bureau on all the customers of the financial institution,microfinance deposit-taking institution or registered society at the time they apply for credit. Part X—Data Privacy and Confidentiality. 44. Protection against invasion of the right to privacy (1) A credit reference bureau or data provider which obtains data or information directly or indirectly in violation of a person’s right to privacy shall not process such data in any way and for any purpose and shall not include such data in any credit report or other related service. (2) A person who procures or causes to be procured any data or information in violation of a person’s right to privacy contravenes this regulation and is liable to pay a civil penalty of two hundred and fifty currency points. 45. Mandatory standards for data collection, storage, processing and use outside jurisdiction (1) Subject to the Data Protection and Privacy Act, 2019, all data and information collected by a credit reference bureau shall, unless the central bank approves otherwise, be stored and processed within the borders of Uganda.

5975 (2) The central bank may upon application by a credit reference bureau authorise the credit reference bureau to store and process data outside Uganda if the central bank is satisfied that the following conditions exist— (i) that the host country has in place adequate laws for the protection of the rights and freedoms of data subjects in relation to the processing of personal data; (ii) that the credit reference bureau has entered into an agreement with the data importer under which the data importer undertakes to comply with all the legal requirements for data protection in the host country and all provisions in these Regulations; (iii) the agreement referred to in paragraph (ii) confers upon third parties such as the data subject and the central bank the right to enforce the agreement against the data importer or the credit reference bureau; (iv) the agreement referred to in paragraph (ii) contains a provision empowering the central bank to direct the data importer to stop processing all data or any part of the data. (v) that the data importer and the credit reference bureau have executed a fidelity bond in form of a bank guarantee for such sums as the central bank shall consider adequate to secure compliance with the obligations of both the credit reference bureau and the data importer and the central bank may direct the credit reference bureau to provide an additional or amended bank guarantee taking into account the prevailing circumstances such as change in risk levels; (vi) that the host country has a reciprocal enforcement of judgments arrangement with Uganda;

5976 (vii) that there exists a memorandum of understanding or other legal arrangements under which the central bank and the regulator of the data importer in the host country can exchange information on the operations of the data importer and the compliance of the data importer with the relevant laws; (viii) that the credit reference bureau is willing to pay for the additional supervisory costs necessitated by the exporting of the data outside Uganda; (ix) the information or data shall be used only for the specified purpose for which it was obtained and which purpose shall be consistent with the provisions of these Regulations; and (x) the information or data shall be adequate and relevant in relation to the purpose for which it was obtained. (3) For the purposes of subregulation (2)— (a) “host country”means the country outside Uganda to which the data in question will be transferred; and (b) “data importer” refers to the entity outside Uganda responsible for importing data with which the credit reference bureau has entered into an agreement as provided under regulation 45(2)(ii). (4) A person shall not use the information obtained under this regulation for any purpose other than the purpose for which the information was obtained and that purpose shall be consistent with the provisions of these Regulations. (5) A person who contravenes this regulation commits an offence and is liable, on conviction, to a fine not exceeding two hundred and fifty currency points or to imprisonment for a term not exceeding two years, or both.

5977 (6) A person whose information has been used in contravention of this regulation may institute a civil action against the offender. 46. Data confidentiality. (1) A credit reference bureau shall keep confidential all data and information submitted to the credit reference bureau under these Regulations whether or not that data or information has been processed or has become the intellectual property of the bureau and shall not disclose to any other person any of the information or data or provide credit information or credit reports except under the following circumstances— (a) to a data provider being duly satisfied that the information is intended to be used by that data provider in connection with a credit transaction involving the customer whoseinformation is sought to be disclosed or any other business transaction initiated by the customer; (b) in compliance with these Regulations, any other law, an order of court or the central bank; or (c) where the data subject has authorised sharing of the credit information with a third party in accordance with regulation 39(8). (2) A credit reference bureau shall ensure that all information provided to a person making an inquiry is up-to-date, accurate and relevant. (3) A person furnished with information by a credit reference bureau shall dispose of the information in such a manner that the information cannot reasonably be read or reconstructed. (4) A credit reference bureau shall not furnish any information relating to a person if— (a) the credit reference bureau knows or has reasonable cause to believe that the information is inaccurate;

5978 (b) the credit reference bureau has been notified by the person whose information was processed or by the person who provided the information that the specific information is inaccurate. (5) An employee of a credit reference bureau who knowingly or wilfully provides information in contravention of subregulation (1) or (4) is liable to pay a civil penalty not exceeding two hundred and fifty currency points. 47. Obtaining information under false pretences A person who knowingly and wilfully obtains information from a credit reference bureau under false pretences commits an offence and is liable, on conviction, to a fine not exceeding two hundred and fifty currency points or imprisonment for a term not exceeding two years, or both. 48. Unauthorised disclosures by officers or employees of a credit reference bureau or data provider An employee of a credit reference bureau or data provider who knowingly or wilfully provides any data or information obtained under these Regulations to a person who is not authorised to receive such information commits an offence and is liable, on conviction, to a fine not exceeding two hundred and fifty currency points or imprisonment for a term not exceeding two years, or both. 49. Identity theft (1) A data subject who is a victim of identity theft shall, after discovering that fact, immediately notify the credit reference bureaus. (2) A credit reference bureau shall, immediately upon receipt of the notice in subregulation (1) stop processing the information, block access to such information and shall not disseminate the information until an investigation is conducted to ascertain the accuracy of the information and the veracity of the claim of identity theft.

5979 50. Information security (1) A person who is authorised to collect, process or disseminate data or information under these Regulations shall at all times maintain adequate and appropriate security measures and written procedures to safeguard the security of information or data obtained under the provisions of these Regulations to avoid unlawful or unauthorised access or processing, accidental or unlawful destruction or accidental loss of or damage to the information. (2) Every user of credit information from a credit reference bureau shall identify themselves, indicate the purposes for which the credit information is sought and undertake that the credit information will be used for no other purpose. (3) A credit reference bureau may refuse to furnish credit information to a user if the credit reference bureau has reasonable grounds to believe that the credit information shall be used for a purpose other than that permitted under these Regulations. (4) Where a credit reference bureau fails to comply with the provisions of subregulation (1), the central bank may suspend the licence of the credit reference bureau for a period it may deem fit or until adequate security measures are, in the opinion of the central bank, installed. Part XI—Ownership of Data 51. Ownership of data. (1) The central bank shall, notwithstanding any agreements to the contrary, own all credit reference bureau data and databases obtained and created under the licence or pursuant to the provisions of these Regulations. (2) The central bank shall retain the right of access to data even after revocation or expiry of the licence.

5980 Part XII—Accredited Credit Providers 52. Accredited credit providers (1) A credit provider or service provider may apply for approval as an accredited credit provider in accordance with these Regulations. (2) An application referred to in subregulation (1) shall be submitted to a credit reference bureau. (3) The central bank shall, in consultation with the credit reference bureaus, develop and issue the criteria for accreditation of prospective accredited credit providers. (4) A credit reference bureau shall, on receipt of an application under subregulation (2), conduct an assessment of the application to determine whether the applicant satisfies the accreditation criteria issued under subregulation (3). (5) A credit reference bureau shall, within a period of not more than a month after receipt of a complete application, conclude the assessment under subregulation (4) and communicate its decision regarding the application to the applicant. (6) A credit reference bureau shall furnish the central bank with quarterly reports regarding the accredited credit providers indicating— (a) the number of applications received under subregulation (2); (b) the list of applicants that were successfully accredited during the quarter; (c) the list of applicants that were not accredited and reasons for not accrediting them; (d) the list of accredited credit providers that have issued the credit reference bureau with a notification under subregulation (7) or (8); and

5981 (e) the level of participation of the accredited credit providers in the credit reference bureau. (7) An accredited credit provider shall notify a credit reference bureau of any sale of records or any part of the loan book of the accredited credit provider which may impact on the submissions of the accredited credit provider to the credit reference bureau. (8) An accredited credit provider may stop submitting data to a credit reference bureau provided the accredited credit provider issues three months’ notice to the credit reference bureau of the accredited credit provider’s intention to do so. (9) An accredited credit provider shall, at all material times while participating in the credit reference system, comply with— (a) the provisions of these Regulations; (b) orders, directives and guidelines of the central bank; and (c) applicable industry code of conduct as may be approved by the central bank. (10) An accredited credit provider shall submit to a credit reference bureau such information and on such conditions as shall be determined by the central bank. (11) The central bank may from time to time prescribe the type of data that the credit reference bureaus may provide to accredited credit providers. (12) The central bank may suspend the participation of an accredited credit provider from the credit reference system for breach of any of the provisions of these Regulations or non-adherence to an order issued by the central bank. (13) In these Regulations, “accredited credit provider” means a person not licensed by the central bank that is involved in the provision

5982 of goods or services on credit or credit services to the public and that has made an application to a credit reference bureau to use the services of a credit reference bureau and having complied with the accreditation criteria specified by the central bank, has been approved to submit and receive information from a credit reference bureau. Part XIII—Competition. 53. Anti-competitive practices (1) A credit reference bureau shall not engage in anticompetitive practices, contracts, arrangements or undertakings that are likely to substantially lessen competition in a market. (2) For the purpose of this regulation, the prohibited anticompetitive practices include price fixing, cartels, taking advantage of market power and predatory pricing. (3) For the purposes of subregulation (2), “price fixing” refers to a contract, arrangement or undertaking written or otherwise, where two or more of the parties to the agreement who are competitors enter into the agreement or arrangement for the purpose or effect of fixing, controlling or maintaining the price of services provided by the parties to the agreement, and it shall also include fixing a discount, allowance, rebate or credit in relation to services supplied or acquired by the parties to the agreement. 54. Misuse of market power (1) A credit reference bureau that has a substantial market share shall not take advantage of that share in the market for the purpose of— (a) eliminating or substantially damaging a competitor of a credit reference bureau in the market; (b) preventing the entry of a person into the market; or (c) deterring or preventing a person from engaging in competitive conduct in the market.

5983 (2) The central bank may, for the purposes of this regulation, in determining whether by engaging in a particular conduct, a credit reference bureau has taken advantage of its substantial degree of market share, have regard to any or all of the following— (a) whether the conduct was materially facilitated by the credit reference bureau’s substantial degree of market share; (b) whether it is likely that the credit reference bureau would have engaged in the conduct if it did not have a substantial degree of market share; or (c) whether the conduct is otherwise related to the credit reference bureau’s substantial degree of market share. (3) For the purposes of regulation 53 and 54, the central bank shall formulate criteria which shall be used to determine whether or not a credit reference bureau has a substantial market share. 55. Predatory pricing. A credit reference bureau which holds a substantial market share shall not supply or offer to supply goods or services at a price that is less than the relevant cost to the credit reference bureau of supplying such goods or services, for the purpose of— (a) eliminating or substantially damaging competitors in the market; (b) preventing the entry of any person into the market; and (c) deterring or preventing a person from engaging in competitive conduct in the market. 56. Penalties for anti-competitive practices. (1) A credit reference bureau which engages in any anticompetitive practice, contract, arrangement or undertaking prohibited under these Regulations commits an offence and is liable to pay to the central bank a civil penalty of two hundred fifty currency points for every act of infringement and fifty currency points for each day the act of infringement persists.

5984 (2) Where the contraventions are persistent, the central bank may suspend or revoke the licence of the credit reference bureau. (3) For purposes of subregulation 2, “persistent” means repeated contraventions occurring over a period of at least fourteen days. Part XIV—Dispute Resolution. 57. Dispute resolution and mediation (1) In any dispute relating to a matter provided for under these Regulations, where such a dispute involves a credit reference bureau and a data subject or a data provider, the central bank may, upon application of any of the parties, act as a mediator to assist the parties in an independent and impartial manner to reach an amicable settlement of the dispute. (2) Where the parties agree to apply to the central bank for the purposes of mediation, the central bank shall appoint a person to act as mediator. (3) Where any of the parties objects to the appointment of the named person as mediator, they shall state the reasons for the objection and the central bank may appoint another person. (4) The provisions of Part V of the Arbitration and Conciliation Act, Cap. 4 shall apply to mediation under this regulation. (5) The central bank or a person appointed by the central bank shall not incur any liability for carrying out an act as mediator under this regulation. (6) Where either before or during mediation any party commences any legal proceedings or arbitration in respect of any dispute, no mediation shall be conducted.

5985 Part XV—Service Level Agreements. 58. Service level agreements. (1) A credit reference bureau, financial institution, microfinance deposit-taking institution, registered society and accredited credit provider may enter into service level agreements to govern their operations for the purposes of carrying out the respective obligations under these Regulations. (2) The terms and provisions of the service level agreements shall be consistent with the licence issued to a credit reference bureau under these Regulations. (3) Any term of a service level agreement that is inconsistent with the licence issued under these Regulations shall be void to the extent of the inconsistency and shall not be binding on the parties. (4) The central bank may, in exercise of its supervisory powers under these Regulations, prescribe the minimum requirements of the service level agreements, the maximum duration and may review the contents of the service level agreements before or after execution. (5) Where the central bank conducts a review of a service level agreement and finds that the terms are inconsistent with these Regulations, any other law, the licence or are generally undesirable in public interest, the central bank shall order the parties to the service level agreement to remove such terms from the agreement. Part XVI—Dissolution and Liquidation. 59. Dissolution and liquidation. (1) A credit reference bureau may be compulsorily or voluntarily liquidated in accordance with the provisions of the laws relating to insolvency and liquidation of companies in Uganda except that no application for voluntary liquidation shall be entertained by any court without the prior written consent of the central bank as required under these Regulations.

5986 (2) Upon commencement of liquidation, a credit reference bureau shall deliver any data and databases containing information to the central bank or its nominated recipient in the form and in accordance with the terms and conditions stipulated by the central bank, and may also, with the express prior authorisation of the central bank, transfer the database to another credit reference bureau that has an operating licence. (3) Where a credit reference bureau transfers any data and database containing information to any person in contravention of subregulation (2), the contravention shall render the credit reference bureau and each of the directors jointly and severally liable for contravening these Regulations and the credit reference bureau and each of the directors shall be responsible for any damages arising from the contravention. (4) Where a credit reference bureau through its shareholders, directors or employees discloses any information in its database, before or after its dissolution, the responsible party commits an offence and is liable, on conviction to pay a fine of two hundred and fifty currency points and in the case of a continuing offence, an additional fine, not exceeding fifty currency points for each day on which the offence continues. 60. Authorisation of the central bank for voluntary liquidation. (1) A credit reference bureau may, with the prior approval of the central bank, apply to the High Court for voluntary liquidation of its business. (2) An application by a credit reference bureau referred to under subregulation (1) shall be accompanied by the following documents— (a) a copy of the minutes of the special meeting of shareholders in which the agreement to dissolve was recorded; (b) a certified copy of the resolution for winding up of the credit reference bureau;

5987 (c) financial statements as of the date the agreement to dissolve was made, with a report from the external auditor who was auditing the credit reference bureau and had been appointed by the central bank; and (d) a sworn statement from the chief executive officer specifying that there is no employee, corporate or tax obligations pending the resolution and that the credit reference bureau is able to meet the obligations of all its creditors. (2) The central bank may, before granting the approval for voluntary liquidation of the credit reference bureau, appoint an external auditor to conduct a due diligence on the credit reference bureau. (3) Where the central bank is fully satisfied with the merits of the application, the central bank may grant approval for a voluntary liquidation on such terms and conditions as it may deem appropriate. (4) Where the central bank is not satisfied with the application and deems it necessary that the credit reference bureau be wound up, the central bank or the appointed agent of the central bank shall become the liquidator of the credit reference bureau. Part XVII—Inspection of Records, Search and Seizure. 61. Inspection of records, search and seizure. (1) The central bank may, at any time and without prior notice, if the central bank has reason to believe that a person is carrying on credit reference bureau business in contravention of these Regulations, authorise an officer of the central bank in writing to— (a) demand the production of and inspect any record or data of the person with respect to whom an audit, investigation or inquiry is being made, and any person who has custody, possession or control of that record or data shall produce and permit inspection of the record by the central bank;

5988 (b) enter any premises which the central bank has reason to believe are occupied or used by a person to conduct a regulated business in contravention of these Regulations; (c) seize or make a copy of any book, record, statement, documents or other item referred to in paragraph (a); (d) question any person who is present on the premises referred to in paragraph (b), or the auditors, directors, members or partners of any person conducting business on the premises, in connection with the conducting of the business on the premises; (e) direct that the premises referred to in paragraph (b) or any part of the premises or anything on the premises, should be left undisturbed for as long as is necessary to search the premises for any book, record, statement, document or item under paragraph (a); (f) by notice in writing addressed and delivered to any person who has control over or custody of any book, record, statement, document or other item referred to in paragraph (a), require the person to produce the book, record, statement, document or other item to the officer of the central bank issuing the notice, at the place, on the date and at the time specified in the notice; (g) examine any book, record, statement, document or other item referred to in paragraph (a) and may require from any person referred to in paragraph (d) an explanation regarding any entry in the book, record, statement, document or other item; and (h) by notice in writing delivered to any person referred to in this regulation, direct that the business of that person be summarily suspended, pending the investigation by the central bank under this regulation.

5989 (2) The central bank shall, where a person has been convicted of an offence under regulation 6 (2), close down the business of that person. (3) If the officer of the central bank referred to in subregulation (1) performs a function under this regulation in the presence of any person affected by the performance of the function, the officer shall, at the request of the person affected, exhibit to the person the written authorization referred to in subregulation (1). (4) A person shall not— (a) hinder or obstruct an officer of the central bank authorised under subregulation (1) in the performance of his or her functions; (b) refuse or fail to comply with any request made by an officer under subregulation (1) in the performance of the functions of the officer; (c) refuse or fail to answer any question which an officer under subregulation (1) lawfully directs at that person in the performance of the functions of the officer; (d) wilfully furnish false or misleading information to an officer under subregulation (1); or (e) falsely give himself or herself out as an officer under subregulation (1). (5) For the purposes of this regulation, “premises” includes any building or structure, information technology systems and infrastructure, software and hardware, or part of a building or structure, whether above or below the surface of the land or water, or any vehicle, vessel or aircraft. (6) A person who contravenes subregulation (4) commits an offence and is liable, on conviction, to a fine not exceeding two hundred fifty currency points or to imprisonment for a term not exceeding one year or both.

5990 Part XVIII—Fees 62. Fees (1) A credit reference bureau may charge fees for its services, which shall be agreed upon between the financial institutions, microfinance deposit-taking institutions, registered societies, accredited credit providers and the credit reference bureau. (2) The fees referred to in subregulation (1) shall be denominated in Uganda Shillings. (3) Notwithstanding subregulation (1), the central bank may fix the maximum fees chargeable for a standard credit report and for any other services provided by the credit reference bureau, especially where the central bank is of the opinion that the current fees charged by the credit reference bureau are exorbitant or extortionate. (4) A credit reference bureau shall notify the central bank of the fee structure for all products through the periodic returns of the credit reference bureau submitted to the central bank as prescribed. Part XIX— General Provisions and Prohibitions. 63. Claims and inquiries department. (1) A credit reference bureau shall have a customer claims and inquiry service section to attend to customers who may be affected by the information contained in the database and who allege that the information is illegal, inaccurate, erroneous or outdated under these Regulations. (2) A credit reference bureau shall have a number sufficient of number of employees to provide the services referred to in subregulation (1) and the employees shall work to remedy the errors in the database of the credit reference bureau. (3) A data provider shall establish and maintain a functional unit or dedicate competent staff to receive and resolve claims, complaints or disputes arising from credit information sharing activities.

5991 64. General prohibitions. (1) A credit reference bureau shall not directly or indirectly engage in any other business which, in the opinion of the central bank, may conflict with the business for which the credit reference bureau acquired the licence. (2) A financial institution, microfinance deposit-taking institution, registered society or accredited credit provider shall not own directly or indirectly any shares or interest in or exercise control over a credit reference bureau. (3) A credit reference bureau shall not obtain any data by use of illegal means. (4) A credit reference bureau shall not amalgamate with another entity or sell or otherwise transfer its assets and liabilities to another entity without the prior written approval of the central bank. (5) A credit reference bureau shall not change the location or place of business of the credit reference bureau without the approval of the central bank. (6) A person shall not be a director in more than one credit reference bureau. 65. Compliance and internal dissemination. The chief executive officer of a financial institution, microfinance deposit-taking institution, registered society, accredited credit provider or credit reference bureau shall be responsible for ensuring compliance with, and internal dissemination of, these Regulations. 66. Other penalties for non-compliance. Unless otherwise provided in these Regulations, where a credit reference bureau fails to comply with these Regulations, the central bank may impose any of the following penalties—

5992 (a) issue a warning, in writing, to the credit reference bureau; (b) impose a civil penalty not exceeding two hundred and fifty currency points or higher in respect of a second or subsequent contravention; or (c) suspend the credit reference bureau for a period not exceeding six months; or (d) revoke the licence of the credit reference bureau. 67. Amendment of schedules (1) The Minister may, with the approval of Cabinet, amend Schedule 1 to these Regulations. (2) The central bank may, in consultation with the Minister, amend Schedules 2, 3, 4, 5, 6, 7, 8 and 9 to these Regulations. 68. Revocation of S.I 59 of 2005 (1) The Financial Institutions (Credit Reference Bureaus) Regulations, 2005 are revoked. (2) Notwithstanding the revocation in subregulation (1), all licences issued under the revoked Financial Institutions (Credit Reference Bureaus) Regulations, Statutory Instrument No. 59 of 2005 shall, in so far as they are consistent with these Regulations, remain valid and binding and shall be deemed to have been issued under the Act and these Regulations. 69. Transitional period For the avoidance of doubt, any credit reference bureau whose licence is deemed to have beenissued under regulation 70 (2) shall comply with these Regulations within a maximum of twelve months, or a further period as the central bank may determine at its discretion on a case by case basis.

5993 Schedule 1 Currency Point Regulation (3) A currency point is equivalent to twenty thousand shillings.

5994 Schedule 2 Regulation 6(1) APPLICATION FOR A LICENCE TO ESTABLISH A CREDIT REFERENCE BUREAU (To be submitted in duplicate) The Governor, Bank of Uganda, P.O. Box 7120, KAMPALA.

I, the undersigned, acting as principal/promoter/in the capacity of duly authorized agent on behalf of………………………………, a Company incorporated under the Companies Act, No. 1 of 2012 (“the principal”), hereby apply for a licence to carry on ………………………………………………..business..
I submit the documentation specified in regulation 6(2) of the Financial Institutions (Credit Reference Bureau) Regulations 2022. ……………………………… ……………………………… Date Applicant Applicant’s address and Tel. Principal’s address and Tel. ……………………………… ……………………………… ……………………………… ……………………………… ……………………………… ……………………………… Certification and Undertaking I, the undersigned, ……………………………..hereby certify that all information contained in and accompanying this application is complete and accurate to the best of my knowledge and belief. I undertake to forthwith notify the Bank of Uganda, of any material change in the particulars of this application.

5995 Sworn at …………………… this …......day of …………………, 20……

Signature of Deponent Principal/ Promoter/Agent Deponent understands the contents of this declaration. Before me,

COMMISSIONER FOR OATHS

5996 Schedule 3 Regulation 6(2)(b), 33(4) INFORMATION SHEET

Name:__________________________________________________
Former name(s) (if any) by which the applicant has been known:

Any name the applicant proposes to use for purposes of or in connection with any business carried on by it, including any name the applicant is or will be obliged to disclose in connection with any business carried on by it by virtue of the Business Names Registration Act (Cap.109 Laws of Uganda)

Principal Business Activities:________________________________
Head Office: _____________________________________________ (a) Address:________________________________________

(b) Telephone No: _____________________________________

5997 7. Management: (1) Board of Directors; Name: Designation Present Term No. of Years as Board Member

Board Committees Name and Purpose of Committee(s): Name of Members:

(2) Officers: Name: Position: No. of Years as Officer

Ownership Profile: Name Country of Residence Number Citizenship a nd percentage shareholding

other shareholders owing less than 5% (Number______) ____________ _______ TOTAL ____________ _______

5998 9. Subsidiaries & Affiliates: Name and Type Number of Shares Held % of Shares Held to of Business Total

Organisation Profile: (1) Organisation Chart – attach one indicating major departments or divisions with names, positions and titles of officers heading each department or division (2) Functions – attach a list of functions or responsibilities for each department or division listed in the organisation chart indicating the number of personnel or staff for each. (3) Qualifications of shareholders, directors and senior management. (4) Annex Personal Declaration Form of each shareholder, director and officer and an Information Sheet for each corporate shareholder. (5) Powers and Purposes – attach the latest copies of the Memorandum and Articles of Association if not previously submitted to the central bank.
Shareholding in any other companies: Name of Company Shares Owned % of Amount Number Capital

5999 QUESTIONNAIRE ( FOR APPLICANTS ONLY) 12. Name(s) and address (es) of the applicant’s bankers within the last ten years. (Please also indicate the applicant’s principal bankers) ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 13. Name and address of the applicant’s external auditors ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 14. Does the applicant hold, or has it ever held, any authorisation from a supervisory body to carry on any business activity in Uganda or elsewhere? If so, give particulars. If any such authority has been revoked, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 15. Has the applicant ever applied for any authorisation from a supervisory body to carry on any business in Uganda or elsewhere other than the authority mentioned in answer to Question 13? If so, give particulars. If any such application was for any reason refused or withdrawn after it was made, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 16. Has the applicant or any company in the same group within the last ten years failed to satisfy a judgement debt under a court in Uganda or elsewhere within a year of the making of the Order? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………

6000 17. Has the applicant or any company in the same group made any compromise or arrangement with its creditors within the last ten years or otherwise failed to satisfy its creditors in full? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 18. Has a receiver or an administrative receiver of any property of the applicant or any company in the same group been appointed in Uganda, or has a substantial equivalent of any such person been appointed in any other jurisdiction, in the last ten years? If so, give particulars, including whether the receiver is still acting under the appointment. ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 19. Has a petition been served in Uganda for an administrative order in relation to the applicant or company in the same group, or has the substantial equivalent of such a petition been served in any other jurisdiction, in the last ten years? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 20. Has a notice of resolution for the voluntary liquidation of the applicant or any company in the same group been given in Uganda, or has the substantial equivalent of such a petition been served in any other jurisdiction, in the last ten years? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………

6001 21. Has a petition been served in Uganda for the compulsory liquidation of the applicant institution or any company in the same group, or has the substantial equivalent of such a petition been served in any other jurisdiction, in the last ten years? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 22. State whether the applicant company has ever been under any criminal investigation, prosecution disciplinary action(s),public criticism or trade sanctions in connection with banking and financial services in Uganda or elsewhere……………. ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 23. Are there any material matters in dispute between the applicant institution and the Uganda Revenue Authority or any equivalent taxation authority in any other jurisdiction? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 24. Is the applicant or any company in the same group engaged, or does it expect to be engaged, in Uganda or elsewhere in any litigation which may have a material effect on the resources of the institution? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 25. Is the applicant company engaged, or does it expect to be engaged, in any business relationship with any of its (prospective) directors, officers or managers? If so, give particulars

6002 ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 26. Is the business of the applicant’s directors, officers or managers or of companies in the same group guaranteed or otherwise underwritten or secured, or expected to be guaranteed or underwritten or secured, by the applicant company? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 27. Please provide any other information which may assist the central bank in reaching a decision on the application…………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… DECLARATION We certify that we have read regulations of the Financial Institutions (Credit Reference Bureau) Regulations, 2021. We are aware that it is an offence under the regulation …….to knowingly or recklessly provide to the central bank or any other person any information which is false or misleading in a material particular in connection with the application for a licence under the Regulations. We certify that all the information contained in and accompanying this form is complete and accurate to the best of our knowledge, information and belief and that there are no other facts relevant to this application of which the central bank should be aware. We undertake to inform the central bank of any material changes to the applications which arise while the Central Bank is considering the application. We recognise the (applicant) company’s obligation under the Regulations to provide the central bank with any information in its possession relevant

6003 to the exercise by the central bank of its functions under the Regulations in relation to the licencee. Consistent with this obligation, we undertake that, in the event that the institution is granted a licence under theRegulations, we shall notify the central bank of any material changes to, or affecting the completeness or accuracy of, the answers to the questions above as soon as possible, but in any event no later than 21 days from the day that the changes come to our attention. Sworn at Kampala this _____________________ day of _______________

Name Position held

Signed Date 2. ……………………………… …………………………………… Name Position Held ……………………………… …………………………………… Signed Date

Deponent understand the contents of this affidavit Before me,

A COMMISSIONER OF OATHS N.B.

All sections of this form must be filled.
If any space provided is inadequate, the required information or data needed may be supplied as an attachment
All attachments should be labelled using the relevant section requiring the attachment

6004 Schedule 4 Regulation 6(2)(c) PERSONAL DECLARATION FORM [For Promoters and individuals who are, or are proposing to become directors, managers or substantial shareholders of the Credit Reference Bureau licensed under these Regulations] NB: In case the space provided is inadequate, attach additional information on separate pages. Passport Size Photograph Full name of person making this declaration: ……………………………………………………………………………… ……………………………………… ……………………………………….

Name of Credit Reference Bureau in connection with which this form is being filled ………………………………………………………………………
Former Surname(s) and /or Forenames by which you may have been known:

Please state the capacity you are completing this form, i.e. as a current or prospective director, manager, substantial shareholder or any combination of these. Please state your full title and describe the particular duties and responsibilities attaching to the position(s) which you hold or will hold. If you are completing this form in the capacity of director, indicate whether, in your position as director, you have or will have executive responsibility for the management of the institution’s business. In addition, please provide a copy of your curriculum vitae unless it is already provided.

6005 ………………………………………………………………………… ………………………………………………………………………… ………………………………………………………………………… ………………………………………………………………………… ………………………………………………………………………… 5. Your date and place of Birth: ________________________________

(1) Citizen of:________________ (2) Resident of :___________ (Country) (Country) Since _________________ Since: _______________ (Year) (Year)
Addresses: (1) Present Business Address (Uganda Since________) (Outside Uganda Since_____)

(2) Present Residential Address: (Uganda Since__________) (Outside Uganda Since______)

(3) Last two addresses in Uganda, if any, during the past ten years: (Since________________) (Since____________________)

6006 8. Professional & Academic Qualifications: Particulars Year Obtained Highest Academic Qualification

(1) Special Awards or Honours (if any)

(2) Training Courses and Seminars

(3) Membership in Professional Organizations

Occupation or Employment (Present or most recent and for the past ten years) Inclusive Date (Month & Year)

6007 Name & Business of Employer Positions Held From Year

Names and address(es) of your bankers within the last ten years ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………
Bodies corporate (other than the institution) where you are now a director, officer, shareholder, or manager? Give relevant dates ……………………………………..……………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………
Bodies corporate other than the institution and those listed above where you have been a director, shareholder, controller or manager at any time during the last ten years. Give relevant dates……………………………………………………………
Have you, in the Uganda or elsewhere, been dismissed from any office or employment, or subjected to disciplinary proceedings by your employer or barred from entry to any profession or occupation? If so give particulars:

6008 14. Past and present business Affiliations (Direct and Indirect): Nature of affiliation i.e. Director, Officer, Share Inclusive Date holder with__ % holdings (Month and Year) Nature of Business specified etc. From To

Do any of the above business affiliations maintain a business relationship with you? If so, give particulars.________________________________________

Do you hold or have you ever held or applied for a licence or equivalent authorization to carry on any business activity in Uganda or any other country? If any such application was refused or withdrawn after it was made or any authorisation was revoked, give particulars: _______________________________

State whether the institution with which you are, or have been, associated as a director, officer, shareholder or manager holds, or has ever held or applied for a licence or equivalent authorization to carry on any business activity. If so, give particulars. If any such application was refused, or was withdrawn after it was made or any licence revoked, give particulars

6009

State whether any of your past or current employer(s) or institution in which you were affiliated as shareholder, director, officer, etc has ever been under criminal investigation, placed under receivership or insolvent liquidation by any regulatory body or court of law.

Family Group: Business affiliation (State name of business and nature of affiliation i.e. Director, Officer, Shareholder with _% holdings specified) Name : (1) Spouse (s):

(2) Children:

(3) Parents:

6010 (4) Brothers or Sisters:

Have you failed to satisfy any debt adjudged due and payable by you as a judgement debtor under an order of a court in Uganda or elsewhere or made any compromise arrangement with your creditors within the last ten years? If so, give particulars………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………
Have you been adjudged bankrupt by a court in Uganda or elsewhere or has a bankruptcy petition ever been served on you? If so, give particulars………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………
Have you, in connection with the formation or management of anybody corporate, partnership or unincorporated institution, been adjudged by a court in Uganda or elsewhere, civilly liable for any fraud, misfeasance or other misconduct by you towards such body or company or towards members thereof? If so, give particulars………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………
Has anybody corporate, partnership or unincorporated institution with which you are associated as a director, shareholder, controller or manager, in Uganda or elsewhere, been wound up, made subject to an

6011 administrative order, otherwise made any compromise or arrangement with its creditors or ceased trading either while you were associated with it or within one year after you ceased to be associated with it or has anything analogous to any of these events occurred under the laws of any other jurisdiction? If so, give particulars. ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 24. Have you been concerned with the management or conduct of affairs of any institution which by reason of any matter relating to a time when you were so concerned, has been censured, warned as to future conduct, disciplined or publicly criticized by, or made the subject of a court order at the instigation of, any regulatory authority in Uganda or elsewhere? If so, give particulars………………………………..………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 25. In carrying out your duties will you be acting on the directions or instructions of any individual or institution? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 26. Do you, in your private capacity, or does any related party, undertake business with you? If so give particulars. ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ………………………………………………………………………

6012 27. How many shares in the institution are registered in your name or the name of a related party? If applicable, give name(s) in which registered and class of shares: ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 28. In how many shares in the institution (not being registered in your name or that of a related party) are you or any party beneficially interested? ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 29. Do you or does any related party to you, hold any shares in the institution as trustee or nominee? If so, give particulars ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 30. Are any shares in the institution mentioned in answer to Questions 27, 28 and 29 above equitably or legally charged or pledged to any party? If so, give particulars………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… ……………………………………………………………………… 31.What proportion of the voting power at any general meeting of the institution (or another body corporate of which it is a subsidiary) are you

6013 or any related party entitled to exercise or control the exercise of? ………………………………………………….…………………… ……………………………………………………………………… …………………………………………………………………… …………………………………………………………………… 32. Personal Record of Court cases or any investigation by governmental, professional or any regulatory body (including pending and prospective cases or on-going investigations): Name of Court or Investigative Body Full Particulars Status

Documentary Requirements: - (1) Certified Statement of assets and liabilities; (2) Latest tax compliance certificate or certified true copy of income tax returns; (3) Two letters of character references from individuals other than relatives who have personally known the undersigned for at least ten years; and (4) Letters duly certified from financial institutions with whom the undersigned has had dealings for the last five years on the performance of past and present accounts.
This questionnaire is submitted in connection with an application for licensing, please provide any other information, which may assist the central bank in reaching a decision on the application. In any other case, please provide any other information which may assist the central bank in deciding whether the director, shareholder, controller or manager fulfils the criteria in Schedule 5 to these Regulations.

6014 DECLARATION I certify that all the information contained in and accompanying this form is complete and accurate to the best of my knowledge, information and belief and that there are no other facts relevant to this application of which the central bank should be aware. I undertake to inform the central bank of any material changes to the application which arise while the central bank is considering the application as soon as possible, but in any event no later than twenty one days from the day that the changes come to my attention. Sworn at Kampala this _____ day of _______________________________ Name Position held/to be held ……………………………………….. …………………………………. Signed:……………………………… Date:…………………… I know and understand the contents of this Declaration and that I am making it under Oath. Sworn at Kampala, Uganda this __day of _____________________ Signature of Deponent:(Position): Deponent understand contents of this affidavit Before me, ____________________________ A COMMISSIONER OF OATHS

6015 N.B.

All sections of this form must be filled.
If the space provided on the form is inadequate, the required information may be provided on an attachment labelled accordingly.
Reference shall be made to the relevant section of the form by placing the words “REFER TO ANNEX….”
Information provided in this form is confidential and cannot be made available for inspection without the written consent of the central bank Governor.

6016 Schedule 5 Regulation 6(2)(d), 32 CRITERIA FOR DETERMINING WHETHER A PERSON IS A FIT AND PROPER PERSON TO MANAGE, CONTROL, BECOME A DIRECTOR OR SUBSTANTIAL SHAREHOLDER IN A CREDIT REFERENCE BUREAU

In order to determine, for the purposes of this Regulations, the professional and moral suitability of persons proposed to manage or control acredit reference bureau, to become a substantial shareholder, or director, the central bank, shall have regard to the following qualities, in so far as they are reasonably determinable, in respect of the person concerned— (a) his or her general probity; (b) his or her competence and soundness of judgement for the fulfilment of the responsibilities of the office in question; (c) the diligence with which the person concerned is fulfilling or likely to fulfil those responsibilities; and
For the purposes of and without prejudice to the general effect of paragraph (1), the central bank may have regard to the previous conduct and activities of the person concerned in business or financial matters and, in particular, to any evidence that the person— (a) has been convicted of the offence of fraud or any other offence of which dishonesty or violence is an element; (b) has contravened any law designed for the protection of members of the public against financial loss due to the dishonesty or incompetence of, or malpractice by, persons engaged in the provision of banking, insurance, investment or other financial services or the management of companies or against financial loss due to the conduct of a discharged or undischarged bankrupt;

6017 (c) was a director of an institution that has been liquidated or is under liquidation or management of the central bank or under receivership; (d) has taken part in any business practice that in the opinion of the central bank, was deceitful or oppressive, fraudulent, prejudicial or otherwise improper whether unlawful or not, or which otherwise reflect discredit on his or her method of conducting business; (e) has engaged or taken part in or been associated with any other business practices or otherwise conducted himself or herself in such manner as to cause doubt on his or her competence and soundness of judgement; (f) has defaulted on a loan or a company in which he or she is a director has defaulted on a loan. 3. The central bank may request any person to furnish such additional information as may be necessary in determining the professional or moral suitability of that person.

6018 Schedule 6 FEES Reg. 7, 12(1) No. Item Fees (Uganda shilling) a) Application processing fees 10,000,000 b) Annual licence fees Greater of 10,000,000 or 0.05% of Gross Annual Revenue

6019 Schedule 7 Regulation 29(1) CREDIT REFERENCE BUREAU QUARTERLY STATISTICAL RETURN CREDIT REFERENCE BUREAU QUARTERLY STATISTICAL RETURN

CREDIT REFERENCE BUREAU DETAILS Name of registered entity Address Contact telephone number Date of submission Year covered in return Quarterly period covered in return
CREDIT INFORMATION: INDIVIDUALS Commercial Banks Credit Institutions As at end of reporting period 2.1 Total number of individuals with a Credit Borrower Account1 2.1.1 Total number of individuals with a national identification number or alien identification number 2.1.2 Total number of individuals without a national identification number or alien identification number but with other identifiers See Instruction note 1 before completing 2.2.1 - 2.2.6 During reporting period 2.2 Total number of individuals broken down by arrears status 2.2.1 Individuals with 0 days in arrears 2.2.2 Individuals with 1-89 days in arrears 2.2.3 Individuals with 90-179 days in arrears 2.2.4 Individuals with 180-364 days in arrears 2.2.5 Individuals with more than 1 year in arrears 2.2.6 Individuals which could not be allocated as account updates were not received in reporting period. 1 Count individuals with multiple CBA records as one individual

6020 3. CREDIT INFORMATION: NON – INDIVIDUALS Commercial Banks Credit Institutions As at end of reporting period 3.1 Total number of non-individuals with a Credit Borrower Account2 3.1.1 Total number of non-individual borrowers See instruction note 2 before completing 3.2.1 - 3.2.6 During reporting period 3.2 Total number of non-individuals broken down by arrears status 3.2.1 Non-Individuals with 0 days in arrears 3.2.2 Non-Individuals with 1-89 days in arrears 3.2.3 Non-Individuals with 90-179 days in arrears 3.2.4 Non-Individualswith 180-364 in arrears 3.2.5 Non-Individualswith more than 1 year in arrears 3.2.6 Non-Individuals which could not be allocated as account updates were not received in reporting period. 4. CREDIT INFORMATION: INDIVIDUALS (NON-BANKS e.g. MDIs) As at end of reporting period 4.1 Total number of individuals with a Credit Borrower Account1 4.1.1 Total number of individuals with a national identification number or alien identification number 4.1.2 Total number of individuals without a national identification number or alien identification number but with other identifier See Instruction note 3 before completing 4.2.1 - 4.2.6 During reporting period 4.2 Total number of individuals broken down by arrears status 4.2.1 Individuals with 0-7 days in arrears 4.2.2 Individuals with 8-29 days in arrears 4.2.3 Individuals with 30-59 days in arrears 4.2.4 Individuals with 60-89 days in arrears 4.2.5 Individuals with equal or more than 90 days in arrears 4.2.6 Individuals which could not be allocated as account updates were not received in reporting period. 5. CREDIT INFORMATION: NON-INDIVIDUALS (NON-BANKS e.g. MDIs) As at end of reporting period 5.1 Total number of non-individuals with a Credit Borrower Account2 5.1.1 Total number of non-individuals 2 Count non-individuals with multiple CBA records as one individual

6021 See Instruction note 4 before completing 5.2.1 - 5.2.6 During reporting period 5.2 Total number of non-individuals broken down by arrears status 5.2.1 Non-Individuals with 0-7 days in arrears 5.2.2 Non-Individuals with 8-29 days in arrears 5.2.3 Non-Individuals with 30-59 days in arrears 5.2.4 Non-Individuals with 60-89 days in arrears 5.2.5 Non-Individuals with equal or more than 90 days in arrears 5.2.6 Non-Individuals which could not be allocated as account updates were not received in reporting period. 6. ACCESS TO RECORDS BY CONSUMERS For reporting period Individuals Non –Individuals 6.1 Total number of credit reports provided without charge3 6.2 Total number of credit reports provided with charge 7. DISPUTE RESOLUTION For reporting period Individuals Non-Individuals 7.1 Total no of calls/disputes received by the CRB 7.2 Total No of all calls/disputes related to credit information4 (Sub-set of 7.1) Reconciliation of valid cases regarding challenged information 7.4 Number of open cases7 at the beginning of the quarter 7.5 + New disputes received during the quarter - officially logged 7.6 Disputes resolved8 within the quarter 7.7 = Unresolved disputes9 at the end of the quarter Of 7.6 show: 7.8 Total No of disputes resolved8 in favour of the Complainant 7.8.1 Total No of disputes resolved8 in favour of the PI 7.8.2 Total No of disputes resolved8 in favour of the CRB 7.8.3 Total No of disputes resolved8 by other parties (Courts, BoU or others) 7.8.4 Total No of disputes resolved8 within 20 days. 7.8.5 Total No of disputes resolved8 beyond 20 days 7.10 Provide alist of the top 6 type of disputes, per month over the last quarter, on a separate page 7.11 Provide alist of the number of complaints from all PIs, per month over the last quarter, on a separate page 8. CREDIT MARKET ACTIVITY 3 This excludes credit reports requested by BOU for supervisory purposes.

6022 (Banks) Individuals Non-Individuals 8.1 Number of open credit accounts10 as at end of previous reporting period 8.2 Number of open credit accounts10 opened during the quarter 8.3 Number of open credit accounts10 closed during the quarter 8.4 Number of open credit accounts10 as at end of current reporting period Arrears Analysis for Banks See instructions note 5 before completing 8.5 - 8.10. Individuals Non-Individuals The following relates to Total Number of accounts. These include third party accounts11 8.5 Accounts which are current and within terms2 8.6 Accounts 1 day -3 months in arrears 8.7 Accounts 3-6 months in arrears 8.8 Accounts 6-12 months in arrears 8.9 Accounts more than 12 months in arrears 8.10 Accounts which could not be allocated as account updates were not received The following relates to Total Number of Judgments and Adverse listings Individuals Non-Individuals 8.11 Number of judgements as at the end of reporting period 8.12 New court orders loaded during the reporting period 8.13 Number of other court orders as at the end of reporting period (bankruptcies) (Non-Banks eg. MDIs) 8.14 Number of open credit accounts10 as at end of previous reporting period 8.15 Number of open credit accounts10 opened during the quarter 8.16 Number of open credit accounts10 closed during the quarter 8.17 Number of open credit accounts10 as at end of current reporting period Arrears Analysis for Non-Banks (eg. MDIs) See instructions note 6 before completing 8.18 - 8.23. The following relates to Total Number of accounts. Individuals Non-Individuals 8.18 Accounts which are current and within terms2 8.19 Accounts 8 days -1 month in arrears 8.20 Accounts 1-2 months in arrears

6023 8.21 Accounts 2-3 months in arrears 8.22 Accounts more than 3 months in arrears 8.23 Accounts which could not be allocated as account updates were not received The following relates to Total Number of Judgments and Adverse listings Individuals Non-Individuals 8.24 Number of judgements as at the end of reporting period 8.25 New court orders loaded during the reporting period 8.26 Number of other court orders as at the end of reporting period (bankruptcies) Individuals Individuals 8.27 Average bureau score for all consumers with credit record 9. PRODUCT ACTIVITY (Banks) See instruction note 7 As at end of reporting period Individuals Non-Individuals 9.1 Mortgage accounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.2 Secured Loan Accounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears

6024 h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.3 OverdraftAccounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.4 Unsecured Loan a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.5 Revolving Credit Facility a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears

6025 i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.6 Leasing a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 9.7 Other Credit Facilities13 a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 1 day -3 months in arrears f) Number of accounts 3-6 months in arrears g) Number of accounts 6-12 months in arrears h) Number of accounts more than 12 months in arrears i) Number of accounts where no updates were received in the reporting period Individuals Non-Individuals 9.8 Number of Bounced Cheques 10. PRODUCT ACTIVITY (Non-Banks eg. MDIs) See instruction note 8 As at end of reporting period Individuals Non-Individuals 10.1 Mortgage accounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX

6026 d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.2 Secured Loan Accounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.3 OverdraftAccounts a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.4 Unsecured Loan a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX

6027 d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.5 Revolving Credit Facility a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.6 Leasing a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period As at end of reporting period Individuals Non-Individuals 10.7 Other Credit Facilities13 a) Number of active/open accounts10 b) Aggregate gross instalment in UGX c) Aggregate gross balance outstanding in UGX

6028 d) Number of accounts with no arrears e) Number of accounts 8 days -1 month in arrears f) Number of accounts 1-2 months in arrears g) Number of accounts 2-3 months in arrears h) Number of accounts more than 3 months in arrears i) Number of accounts where no updates were received in the reporting period Individuals Non-Individuals 10.8 Number of Bounced Cheques 11. CREDIT REPORTING ACTIVITY As at end of reporting period Individuals Non-Individuals 11.1 General Credit Reporting Information a) Total number of persons residing in Kampala with a credit record b) Total number of persons residing outside Kampala with a credit record c) Total number of open accounts in banks (including status accounts, judgment etc) d) Total number of open accounts in non-banks (including status accounts, judgment etc) See instruction note 9 before completing 11.2 and 11.3. Note that 11.3a) and 11.3b) must total 11.3 Individuals Non-Individuals 11.2 Total number of enquiries or hits made during reporting period (a) Online4 (b) Pre-screening5 11.3 Total number of hits related to credit granting activities (a) Online (b) Pre-screening 11.4 Distribution of Enquiries / Hits (a) Total number of enquiries / hits by to banks (b) Total number of enquiries / hits by to non-banks (eg. MDIs) (c) Total number of enquiries / hits by other Accredited Credit providers 11.5 Total number of credit scores sold (banks) 4 Online enquiries refer to enquiries made on borrowers who have actually applied for credit and the credit provider is making an assessment of his or her creditworthiness. 5 Pre-screening refers to enquiries made by credit providers who want to offer credit to a potential borrower ie the borrower is offered credit based on an assessment of his or her credit history and where he or she did not specifically request credit in the first instance.

6029 (a) Online (b) Pre-screening 11.6 Total number of credit scores sold (non-banks) (a) Online (b) Pre-screening 12. RISK CLASSIFICATIONS As at end of reporting period Individuals Non-Individuals 12.1 Account Status (Banks, in Numbers) (a) Loss (b) Doubtful (c) Substandard (d) Watch (e) Normal (f) Restructured (g) Settled - Foreclosure (h) Settled - Normal/Matured (i) Written off (j) Settled - Early (pre-paid) 12.2 Account Status (Non-Banks, in Numbers) (a) Loss (b) Doubtful (c) Substandard (d) Watch (e) Normal (f) Restructured (g) Settled - Foreclosure (h) Settled - Normal/Matured (i) Written off (j) Settled - Early (pre-paid) 12.3 Risk Classification by Income 12.3.1 Number of Individual Accounts in Banks per Income Category (in UGX) As at end of reporting period

6030 Current 1 day – 3 months 3-6 months 6-12 months 12 months + (a) 0 - 80,000 (b) 80,001 - 165,000 (c) 165,001 - 350,000 (d) 350,001 - 650,000 (e) 650,001 - 1,200,000 (f) 1,200,001 - 2,000,000 (g) 2,000,001 - 2,800,000 (h) 2,800,001 - 4,000,000 (i) 4,000,001 - 6,000,000 (j) 6,000,001 - Above 12.3.2 Number of Individual Accounts in Non-Banks per Income Category (in UGX) As at end of reporting period Current 8 days – 1month 1-2 months 2-3 months 3 months+ (a) 0 - 80,000 (b) 80,001 - 165,000 (c) 165,001 - 350,000 (d) 350,001 - 650,000 (e) 650,001 - 1,200,000 (f) 1,200,001 - 2,000,000 (g) 2,000,001 - 2,800,000 (h) 2,800,001 - 4,000,000 (i) 4,000,001 - 6,000,000 (j) 6,000,001 - Above 13. CRB OPERATIONS DATA As at end of reporting period 13.1 Number of PI’s linked to CRB 13.2 Number of PI’s branches submitting data to CRB 13.3 Number of Accredited Credit Providers linked to CRB 13.4 Number of Accredited Credit Providers branches linked to CRB Month 1 Month 2 Month 3 13.5 Average “up time” over the last quarter 13.6 No. of days CRB was down during working hours for the periods longer than 2 hours Average Minimum Maximum 13.7 Enquiry fees charged to Banks

6031 13.8 Enquiry fees charged to Non-Banks (eg. MDIs) 13.9 Enquiry fees charged to Accredited Credit Providers 14. OPTIONAL: FURTHER QUESTIONS 14.1 Are there any developments you would like to bring to the attention of the Bank of Uganda? Declaration I/we confirm that:

I am duly authorised to sign this compliance report
this synoptic report is (to the best of my knowledge and belief) accurate and complete
appropriate procedures and controls have been implemented to ensure that the information in this report is accurate ____________________________of _____________________(credit Reference Bureau) __________________ Duly Authorised Officer Date INSTRUCTION NOTES

Disaggregate 2.2 as per the categories indicated, thus the total of the items 2.2.1 - 2.2.6 will add up to 2.2. Each individual indicated in 2.2 must be classified only once according to its worst position in any one of the categories listed.
Disaggregate 3.2 as per the categories indicated, thus the total of the items 3.2.1 - 3.2.6 will add to 3.2. Each non-individual indicated in 3.2 must be classified only once according to its worst position in any one account in one of the categories indicated
Disaggregate 4.2 as per the categories indicated, thus the total of the items 4.2.1 - 4.2.6 will add to 4.2. Each individual indicated in 4.2 must be classified only once according to its worst position in any one account in one of the categories indicated

6032 4. Disaggregate 5.2 as per the categories indicated, thus the total of the items 5.2.1 - 5.2.6 will add to 5.2. Each non-individual indicated in 5.2 must be classified only once according to its worst position in any one account in one of the categories indicated 5. Disaggregate 8.4. The total of the items 8.5 - 8.10 will add to 8.4. Each account indicated in 8.4 must be classified only once in any one of the categories below. 6. Disaggregate 8.17. The total of the items 8.18 - 8.23 will add to 8.17. Each account indicated in 8.17 must be classified only once in any one of the categories below. 7. Furnish for each type of credit agreement in each of the categories for the 3 month reporting period. (a) must equal total of (d) to (i). 8. Furnish for each type of credit agreement in each of the categories for the 3 month reporting period. (a) must equal total of (d) to (i). 9. Enquiries / Hits - Any hit on the customer profile Disaggregate 11.2. The total of the items 11.4 a) to c) will add to 11.2. Disaggregate 11.3. The total of the items 11.3 a) to b) will add to 11.3. 10. The total excludes reports requested by BOU for supervisory purposes. DEFINITIONS No Terminology Definition

Credit Record Any individual or non-individual with one or more of: An account, Payment Profile entry, adverse record, judgments, or defaults, excluding of any enquiries.
Current and within terms Account An account that is up to date with payments, and no arrears days or defaults, adverse status codes, judgments or administration orders.
Non-Individual As defined in the FIA 2004.
Related to Credit information All calls, queries, disputes regarding information held on the CRB on an individual or non-individual’s credit account.
Challenging CB information All calls challenging information held by the CRB

6033 6. Calls/queries/disputes officially logged Where investigation is required and feedback is expected, whether logged manually or electronically 7. Open cases Disputes logged and feedback still outstanding from relevant parties 8. Disputes resolved Challenges where feedback was provided or remained outstanding for more than 20 days and the challenge is closed 9. Unresolved Disputes Challenges pending feedback or under investigations 10. Open credit accounts All accounts that have not been paid or closed, and still have outstanding balances. 11. 3rd party credit accounts Private Bank label accounts underwritten by Banks 12. Credit Cards All bank credit cards including also 3rd party credit cards 13. Other credit facilities Retail accounts, store cards, including all revolving accounts not issued by a bank

6034 Schedule 8 Regulation 29(3) CREDIT REFERENCE BUREAU ANNUAL COMPLIANCE RETURN CREDIT REFERENCE BUREAU ANNUAL COMPLIANCE RETURN CREDIT REFERENCE BUREAU DETAILS Name of registered entity Name of person who completed this form Email Contact telephone number Date of submission Year covered in return

COMPANY PROFILE 1.1 Material changes in the company (e.g. change in ownership or directors, acquisition/ disposal of major assets etc.) which occurred since the date of your last return:
DATA INTEGRITY 2.1 Describe the key measures to verify the data accuracy reported to you by your contractual partners: 2.2 Confirm if you are in compliance with the data retention periods as specified in these Regulations: If not state the reasons: 2.3 Confirm that data displayed is in accordance with the terms of Regulation 19(6)(f) (such as race, medical history, political affiliation): Reasons for not being compliant:

6035 2.4 Confirm that the CRB only receives data from sources, or disseminates data or information to users permitted under the regulations. 2.5 Confirm that the CRB took necessary security and control measures to avoid unauthorised access to, improper use or mismanagement of information as specified in the regulations. 2.6 Confirm that integrity and confidentiality of data is maintained as specified in the regulations. 2.7 Confirm that the CRB complies with customer’s rights of access and correction of information requirements as stipulated in the Regulations. 2.8 Describe the key operational resources, procedures and systems (a) for the investigation of information challenged by an individual/non-individual person: (b) to ensure that incorrect information is not repeatedly reflected on the CRB: (c) on data security and confidentiality: 3. CREDIT REPORTING ACTIVITY 3.1 Total number of free credit reports accessed by consumers: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual 3.2 Total number of credit reports sold to consumers with charge: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual 3.3 Total number of PIs that furnish you with information: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Total number of commercial banks Total number of non-banks Total number of Accredited Credit Providers (ACPs) 3.4 Total number of individuals and non-individuals with a credit record: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual

6036 4. DISPUTE RESOLUTION 4.1 Total number of disputes received with respect to credit reports Individual Quarter 1 Quarter 2 Quarter 3 Quarter 4 Total number of disputes No. of disputes resolved in favour of consumer No. of disputes resolved not in favour of consumer No. of disputes whose resolution is in progress Non-Individual Quarter 1 Quarter 2 Quarter 3 Quarter 4 Total number of disputes No. of disputes resolved in favour of consumer No. of disputes resolved not in favour of consumer No. of disputes whose resolution is in progress 4.3 Total number of disputes where a particular credit agreement was linked to an incorrect borrower: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual 4.4 Total number of disputes where the wrong information pertaining to a credit Borrower account was reflected on a credit report: Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual 4.5 Total number of disputes about other instances Quarter 1 Quarter 2 Quarter 3 Quarter 4 Individual Non-Individual 4.6 Confirm that disputes are resolved promptly and satisfactorily in accordance with these regulations. Also provide average time (in days) for resolving disputes? Average time estimate:

6037 5. GENERAL INFORMATION 5.1 What activities have been undertaken for the education of the public on credit reporting and credit scoring during the period under review. 5.2 Describe the products and pricing your company offers. Please include a copy of your standard credit report together with your pricing structure for the various credit reports. Also include the pricing of all products/value added services. 5.3 List all the credit scoring models you use for producing credit bureau scores and attach a list of all variables that you use per model: 5.4 List all the sources of information you accept and load on your database: 6. OPTIONAL: FURTHER QUESTIONS 6.1 Indicate any developments in the market you are active in which you want to bring to the attention of the Bank of Uganda: Declaration I/we confirm that:

I am duly authorised to sign this compliance report;
this report is (to the best of my /our knowledge and belief) accurate and complete;
appropriate procedures and controls have been implemented to ensure that the information in this report is accurate; and
all significant instances of non-compliance are detailed in this report or in the attachments thereto. _______________________________ of ___________________________________ (Duly Authorised Officer) (Credit Reference Bureau) We, the external auditors of _________________________________, confirm we have reviewed this return and certify it to be an accurate reflection of the business over the last 12 months. ____________________________ of ____________________________ (Duly Authorised Officer) (Auditors)

6038 Schedule 9 Regulation 26 MINIMUM STANDARDS FOR CREDIT REPORTS A credit report shall at a minimum contain the following information: i. Identifying Information including national identification number or alien identification number as the primary identifier and other identifiers including; name, date of birth, social security number, financial card number, current and previous addresses, phone numbers and employment. ii. Existing credit information including lenders and creditors, the types of accounts the date those accounts were opened, credit limit or loan amount, account numbers, account balances, frequency of payment, installment payment amount, collateral pledged, guarantor details (if applicable) and payment history. iii. Information on closed accounts which shall remain on a credit report for five years. iv. Payment history including a two-year record of accounts’ status (paid/ past due), how much was owed, late payments, how late a payment was and missed payments. This information shall stay on a credit report for five years. v. Credit inquiries which is a list of companies and individuals who requested a copy of the credit report in the past two years. vi. Any other relevant data compiled by the credit reference bureau and allowed pursuant to these Regulations.

6039 Cross References The Arbitration and Conciliation Act, Cap. 4 The Bank of Uganda Act, Cap. 51 The Business Names Registration Act, Cap. 109 The Companies Act, No. 1 of 2012 The Cooperative Societies Act, Cap. 112 The Data Protection and Privacy Act, 2019 The Financial Institutions Act, 2004 The Microfinance Deposit Taking Institutions Act, 2003 MICHEAL ATINGI-EGO Deputy Governor.

6040