Law of the Republic of Azerbaijan on Credit Bureaus

THE LAW OF THE REPUBLIC OF AZERBAIJAN on Credit Bureaus This Law shall determine the legal basis for the establishment and functioning of credit bureaus in the Republic of Azerbaijan, formation of credit histories by credit bureaus and principles for the use of information; and regulate rights and responsibilities of credit bureaus, credit history subjects, data providers and users, as well as supervision of credit bureaus in accordance with Article 94, Part I, Para 10 and 27 of the Constitution of the Republic of Azerbaijan. Chapter 1 GENERAL PROVISIONS A r t i c l e 1. The goal of the Law The goal of this Law shall be to improve access of individuals and legal entities to financial services, strengthen financial discipline in debt relations, and financial system stability by forming a long-term database on performance of their financial liabilities. A r t i c l e 2. Main definitions used in this Law 2.0. The definitions used in this Law shall bear the following meanings: 2.0.1. credit bureau – a commercial legal entity, state registered in accordance with the Law of the Republic of Azerbaijan ‘on State registration and the state register of legal entities’ that provides the activity specified in Articles 6.1 and 6.2 herein. 2.0.2. credit history – regardless of the method and form of data storage, totality of information on current and paid debts of the credit history subject, related to securitization of debt liabilities, as well as other information necessary under this Law for the assessment of creditability and the discipline of performance of debt liabilities. 2.0.3. the subject of the credit history – an individual and legal entity on whom a credit history is generated. 2.0.4. debt – loans issued, credit lines opened, loans written off from the balance sheet, guarantees, warranty, bills of exchange accounted, cost of goods sold on hire purchase, the debt resulting from lease and factoring operations. 2.0.5. database for credit histories – data resources of credit bureaus based on information systems that meet the requirements established in the Law of the Republic of Azerbaijan ‘on Personal Data’. 2.0.6. credit report – credit history information provided to data users within the scope and purposes permitted by this Law. 2.0.7. data provider – subjects specified in Articles 12.1-12.3 of this Law that provide the credit bureau with data either directly or through the Electronic Government Information System (hereinafter - EGIS).

2.0.8. data user – subjects specified in Article 13.2 of this Law entitled to receive credit reports from the credit bureau. 2.0.9. financial markets supervisory authority – an institution established by a relevant executive power authority to regulate and supervise financial markets (hereinafter – the supervisory authority). 2.0.10. centralized credit registry – a centralized credit registry established at the Central Bank of the Republic of Azerbaijan (hereinafter – the Central Bank). 2.0.11. positive information – any information that positively characterizes creditability of the credit history subject and the discipline of performance of debt liabilities from the time the debt liability was created. 2.0.12. negative information – any information that negatively characterizes creditability of the credit history subject and the discipline of performance of debt liabilities from the time the debt liability was created. A r t i c l e 3. Legal basis for activities of credit bureaus 3.1. The legal basis for activities of credit bureaus shall include the Constitution of the Republic of Azerbaijan, the present Law, other normative acts of legal nature, regulations of the Central Bank, and international treaties seconded by the Republic of Azerbaijan. 3.2. Relations on credit bureaus in the Alat economic zone shall be regulated according to the requirements of the Law of the Republic of Azerbaijan ‘on the Alat Free Economic Zone’. A r t i c l e 4. Credit history formation and principles for its use 4.0. Principles for the formation of credit histories and the use of the database of credit histories shall be as follows: 4.0.1. formation and use for legal purposes. 4.0.2. consent of the credit history subject (as per Articles 14.0.1 and 14.0.2 herein). 4.0.3. privacy, protection of rights and freedoms, legal interests. 4.0.4. adequacy of the volume of information with the purpose of use. 4.0.5. accuracy and timely update of information. 4.0.6. non-discrimination of data users. 4.0.7. protection of the credit history database and relevant information systems. 4.0.8. ensuring confidentiality of information protected by law. 4.0.9. cross-border transmission of credit reports considering the requirements of the Law of the Republic of Azerbaijan ‘on Personal Data’. Chapter 2 ESTABLISHMENT AND OPERATION OF CREDIT BUREAUS. SUPERVISION OF CREDIT BUREAUS A r t i c l e 5. Establishment of credit bureaus

5.1. Credit bureaus shall be established as limited liability or joint-stock companies. 5.2. The Central Bank shall set minimum amount of authorized capital required for the operation of a credit bureau. 5.3. Authorized capital of a legal entity founded as a credit bureau shall be paid as per the Civil Code of the Republic of Azerbaijan. 5.4. The information system of the credit bureau shall meet the requirements specified in the Law of the Republic of Azerbaijan ‘on Personal Data’. 5.5. The credit bureau shall provide its activities related to formation of information resources of personal data and creation of information systems and their maintenance, based upon a license issued in accordance with the Law of the Republic of Azerbaijan ‘on Licenses and Permits’. 5.6. Only commercial organizations and their associations established and operating under this Law may use the words ‘credit bureau’ in their name. 5.7. The Central Bank shall determine the requirements on professional suitability of the head (members) of the executive body of the credit bureau. 5.8. The credit bureau should deliver to the Central Bank the following documents for information within 5 days after the last document specified in Articles 5.8.6-5.8.9 herein is received: 5.8.1. copies of the credit bureau’s state registration and foundation documents either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 5.8.2. a document on payment of minimum authorized capital required. 5.8.3. copies of documents on the name and address of the head (members) of the executive body of the credit bureau, copies of education, work activity and other relevant certificates confirming compliance with the professional suitability requirements determined by the Central Bank either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 5.8.4. a business plan of the credit bureau covering its commercial strategy, activity types to be provided, the volume and scope of services to be supplied, organizational structure, including an internal control system, as well as financial forecasts for the first three years (balance sheet, income statement). 5.8.5. internal rules and procedures for the operation of the credit bureau to ensure security, confidentiality, and integrity of the database of credit histories, including the policy for setting service fees. 5.8.6. license for the formation of information resources of personal data and creation of information systems, providing them with services either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 5.8.7. excerpt from the state register on state registration of information systems of personal data either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’.

5.8.8. certificate on compliance of information systems of personal data either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 5.8.9. information on the state examination of information systems of personal data and their draft documents. A r t i c l e 6. Activities of the credit bureau 6.1. A credit bureau shall collect, store, analyze and issue credit reports that make up the credit history of the credit history subject. 6.2. In addition to the type of activity provided for in Article 6.1 of this Law, the credit bureau shall: 6.2.1. develop and commission dedicated software to automate the generation and use of credit histories. 6.2.2. develop and publish special literature and other materials related to activities of credit bureaus. 6.2.3. develop credit histories and provide advisory services related to their use. 6.2.4. assess credit history subjects' creditability and debt liabilities enforcement discipline and issue individual credit ratings to credit history subjects. 6.2.5. conduct statistic research. 6.2.6. provide other activities supporting the main activity of the credit bureau. 6.3. The credit bureau shall provide activities on the formation of credit histories and issue of credit reports with data providers and data users on a contractual basis (excluding negative data providers specified in Article 12.3 and data users specified in Articles 13.2.2 and 13.2.3 herein). Agreements should specify rights and duties of parties, including objectives of data providers and users specified in this Law, the content of the information submitted and deadlines for submission, the procedure for submitting credit report requests and issuing credit reports, as well as responsibilities of parties. 6.4. The credit bureau may include the information open for general use in official publications, official information resources and other official sources in the section related to the subject of the credit history in the credit history. A r t i c l e 7. Regulation and supervision of credit bureaus 7.1. In regulating and supervising activities of credit bureaus, along with the authorities specified in the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’ the Central Bank shall be entitled to: 7.1.1. adopt regulations in the cases determined by the relevant executive authority regarding the activity of credit bureaus. 7.1.2. inspect activities of credit bureaus, including compliance of information systems with the security requirements determined under the present Law according to the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’.

7.1.3. receive and analyze credit bureau activity reports, including financial statements. 7.1.4. impose enforcement measures against credit bureaus. 7.1.5. obtain any documents, information, including internal documents (statutes, rules, procedures, etc.) related to activities of the credit bureau and receive information on them from credit bureau managers, staff, as well as from auditors who review or have reviewed the credit bureau. 7.2. The credit bureau shall submit a report on its activity (excluding financial statements) in the form and manner determined by the Central Bank. 7.3. Credit bureaus shall pay fees to the supervisory authority in the amount and order set by the latter. 7.4. Relations on maintenance of accounting by credit bureaus and development, submission and publication of financial statements shall be regulated with the Law of the Republic of Azerbaijan ‘on Accounting’. Credit bureaus shall submit annual financial reports and consolidated financial statements to the Central Bank within the timeframe specified in Article 12.1 of the Law of the Republic of Azerbaijan ‘on Accounting’. 7.5. Where the Central Bank reveals the violation or the cases likely to lead to the violation of the requirements of the present Law, the Law of the Republic of Azerbaijan ‘on Personal Data’ and regulations of the Central Bank, it shall be entitled to: 7.5.1. request a commitment letter from the credit bureau on elimination of violations or circumstances that may cause violations. In the commitment letter submitted to the Central Bank the credit bureau shall specify actions to be taken and deadlines to eliminate violations or circumstances that may cause violations. 7.5.2. issue a written binding instruction to the credit burau on elimination of violations or circumstances that may cause violations. 7.5.3. request from the competent management body of the credit bureau to remove or release from office the head (members) of the executive body of the credit bureau until violations or circumstances that may cause violations are eliminated. 7.6. Where security requirements of information systems of personal data have been found to be violated by the credit bureau, the Central Bank shall provide related written information to the authority (institution) designated by the relevant executive power authority. 7.7. State control over the credit bureau’s compliance with competition legislation shall be exercised in accordance with the Competition Code of the Republic of Azerbaijan. A r t i c l e 8. Requirements for protection of the database of credit histories 8.1. The database of credit histories should meet the requirements set by the relevant executive authority on the protection of personal data. 8.2. The credit bureau should have internal rules and procedures on the protection of information in the database of credit histories and measures to prevent any illegal intrusion to this database. 8.3. Data collection and processing in the database of credit histories, submission and execution of requests, results of registration and review of applications, as well as

records of operations related to system management and protection shall be entered into the appropriate control-audit log. A r t i c l e 9. Confidentiality 9.1. Officials and other employees of the credit bureau may disclose the information known to them in the credit history database in connection with the discharge of their official duties only in cases determined by this Law and other laws. 9.2. Officials and other employees of the credit bureau should provide a written undertaking not to illegally distribute the information known to them in the credit history database during the period of operation and after leaving the job. 9.3. Submission of credit history information in accordance with this Law shall not be deemed a breach of information confidentiality. 9.4. The Central Bank and its employees should protect confidentiality of the information known to them regarding the credit bureau activity, including the information contained in the database of credit histories, while performing their official duties, during the period of operation and after leaving the job in the manner established by law. A r t i c l e 10. Storage of credit history information 10.1. The credit bureau shall keep collected information for 10 years after the last change to that information and ensure that the information is provided to users. After this period, the information shall be destroyed or archived with the consent of the credit history subject. 10.2. The credit history subject may not demand the destruction of negative information earlier than the period specified in Article 10.1 of this Law. A r t i c l e 11. Reorganization and liquidation of credit bureaus 11.1 Credit bureaus shall be reorganized and liquidated as per the Civil Code of the Republic of Azerbaijan. 11.2. The database of the reorganized credit bureau shall be handed over to another credit bureau, its legal successor. In this case, the credit bureau that has accepted the database of credit histories should inform data providers accordingly within 10 working days from the day of accepting credit histories and publish an announcement in media outlets disseminated throughout the country. 11.3. When a credit bureau is liquidated, or the legal successor of the credit bureau reorganized fails to meet the requirements of Articles 5.1-5.5 and 5.7 herein, the database of credit histories may be transferred to another acting credit bureau under the conditions determined by the liquidated (reorganized) credit bureau (in the part where consent is given in accordance with Article 15.1.4 of this Law). When the database of credit bureau’s credit histories (its relevant part) is not given to another credit bureau,

the Central Bank shall take a decision on the use (considering Article 15.1.4 herein), maintenance or destruction of the database. Chapter 3 FORMATION AND USE OF A DATABASE OF CREDIT HISTORIES A r t i c l e 12. Data providers 12.1. Credit institutions should submit the information that makes up their credit histories to at least one credit bureau in action. 12.2. The following may provide data that make up credit histories to credit bureaus: 12.2.1. insurers, reinsurers, lessors subject to leasing contracts and factors subject to factoring agreements. 12.2.2. the Central Bank (in the cases stipulated in Articles 33, 54.3 and 54.3-1 of the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’). 12.2.3. except for the persons specified in Article 12.1 of this law, other legal entities and unincorporated individuals engaged in sale of goods on hire purchase. 12.2.4. mobile phone operators. 12.2.5. utilities (cold and hot water supply, sewerage, electricity, gas and heat supply). 12.2.6. other entities that provide the credit bureau with personal data (including data providers specified in Article 12.3 of this Law when delivering positive information). 12.3. The following shall deliver negative credit history data as per Article 17.5 herein: 12.3.1. relevant executive power authorities, courts (if in the cases provided for in the Administrative Procedural Code of the Republic of Azerbaijan, they carry out measures for the execution of court decision themselves), notaries and enforcement authorities. 12.3.2. the Central Bank and Audiovisual Council of the Republic of Azerbaijan (on the information specified in Articles 16.1.10 and 16.1.11 of this Law on the cases on administrative errors they reviewed). 12.4. Data providers shall: 12.4.1. obtain consent of the credit history subject on whom negative and positive information shall be delivered (except for the cases of submission of negative information by data providers specified in Articles 12.2.4 and 12.2.5 and the information specified in Article 23.2 of this Law, by data providers specified in Article 12.3 of this Law), provide its storage and accounting. 12.4.2. provide accurate information on the credit history subject. 12.4.3. provide information to the subject of the credit history on the credit bureau the information shall be provided to (name, address, and other necessary details) (except for data providers specified in Article 12.3 herein).

12.4.4. provide the credit history subject with written information on his/her credit history related rights (except for data providers specified in Article 12.3 herein). 12.4.5. verify accuracy of and make relevant corrections to submitted information at the request of the credit bureau and credit history subject. 12.4.6. confirm the fact of obtaining a credit history subject’s consent in accordance with Article 12.4.1 of this Law for the credit bureau as per Article 15.7 herein. 12.4.7. timely deliver relevant information to the credit bureau in the case specified in Article 17.3 herein. 12.5. Data providers specified in Articles 12.1 and 12.2 (except for Articles 12.2.4 and 12.2.5) of this Law shall submit negative and positive data on the credit history subject by obtaining his/her consent (except for the case specified in Article 23.2 herein) to the credit bureau. Data providers specified in Article 12.3 herein place negative information on the credit history subject in the ‘Electronic Government’ portal in the EGIS without his/her consent. The credit bureau shall be obliged to receive negative information. A r t i c l e 13. Data users 13.1. Data users (except for those specified in Articles 13.2.2 and 13.2.3 herein) may use credit reports only to assess creditability and the discipline of execution of debt liabilities during regulation of the creation, modification and other debt liability related relations between them and credit history subjects. 13.2. The following shall be entitled to receive credit reports from the credit bureau: 13.2.1. data providers specified in Articles 12.1 and 12.2 of this Law. 13.2.2. the subject of credit history. 13.2.3. with respect to cases in charge, courts, investigative bodies, enforcement authorities, subjects of law enforcement intelligence operations, the Central Bank (for investigation of complaints submitted to the Central Bank by subjects of credit history), notaries (for approval of debt agreements, wills, and inheritance cases), the heir(s) of credit history subject(s). 13.3. except for data users specified in Articles 13.2.2 (considering Articles 21.2 and 21.3 herein) and 13.2.3 of this Law, other data users shall: 13.3.1. obtain a consent of a credit history subject to receive a credit report (except for obtaining information from the sources specified in Article 6.4 herein and the case specified in Article 23.3-1 herein). 13.3.2. submit written information to credit history subjects on their rights related to credit histories. 13.3.3. confirm the fact of obtaining the consent of the subject of the relevant credit history to receive the credit report for the credit bureau as per Article 15.7 herein. 13.3.4. not disclose credit history information to third parties. 13.3.5. use a credit report only for purposes specified in this Law. 13.3.6. provide a credit history subject with information on the credit bureau that delivered a credit report (name, address, and other necessary details).

13.3.7. pay a service fee specified to the credit bureau to receive a credit report (except for the cases specified in the 2nd sentence of Article 18.2 and the 1st sentence of Article 18.4 herein). 13.4. Data users specified in Article 13.2.3 herein shall provide information on the credit bureau that submitted the credit report to the credit history subject upon his/her request. A r t i c l e 14. The rights of the credit history subject 14.0. The credit history subject shall be entitled to: 14.0.1. consent to submission of negative and positive information to the credit bureau for the development of the credit history (except for the cases of submission of negative information by data providers specified in Articles 12.2.4 and 12.2.5 and information specified in Article 23.2 and by data providers specified in Article 12.3 herein). 14.0.2. consent to a data user (except for those specified in Articles 13.2.2 and 13.2.3 herein) to obtain credit history information from the credit bureau (obtaining information from the sources specified in Article 6.4 and except for the case specified in Article 23.3-1 herein). 14.0.3. obtain a credit report from the credit bureau about him/herself and receive a free of charge notification from the credit bureau about negative information submitted to the credit bureau regarding him/her (indicating the data provider that submitted the negative information) in accordance with the rules established by the credit bureau. 14.0.4. apply to the credit bureau and data provider with respect to verification of the information he/she finds erroneous and making correction to that information. 14.0.5. request destruction of information in the credit history on him/herself (considering the requirement specified in Article 10.2 herein). 14.0.6. request the legal justification of the collection, processing, and provision of credit history information on him/her, receive information on legal ramifications of the collection, processing, and provision of this information (except for the cases of submission to the data users specified in Articles 13.2.2 and 13.2.3 herein). 14.0.7. withdraw the consent given in accordance with Articles 14.0.1 and 14.0.2 of this Law in the part related to positive information. A r t i c l e 15. Consent of the credit history subject 15.1. In the cases specified in Articles 14.0.1 and 14.0.2 herein, a consent of the credit history subject shall be documented in writing (including electronic documents signed with strengthened signature). A written consent shall include: 15.1.1. information allowing to identify the credit history subject. 15.1.2. information allowing to identify the body that obtained a consent of the credit history subject. 15.1.3. the objective of the data collection and processing. 15.1.4. lists of data consented to be collected and processed by the credit history subject for the purposes established by this Law and their processing operations

(including attitude to the cross-border transfer of data and the transfer to another credit bureau specified in Article 11.3 herein). 15.1.5. validity of credit history subject’s consent and its withdrawal conditions. 15.1.6. terms of destruction or archiving of information collected after the expiry of the data storage period or after the death of the credit history subject. 15.2. The consent of the credit history subject shall be given separately for each debt or another case. The credit history subject's consent shall remain valid until the debt liability is terminated, and in another case, until the consent expires or is withdrawn. The information included in the credit history shall be stored in the credit bureau for the period provided for in Article 10.1 of this Law and used accordingly. 15.3. The validity period of the credit history subject's consent and terms of its withdrawal shall be determined by mutual agreement between the data provider (user) and the subject of the credit history. 15.4. When receiving a written consent, data providers and users shall inform the subject of the credit history about their duties determined by this Law and the rights of the subject of the credit history determined by this Law. 15.5. If the credit history subject does not give his/her consent in the cases provided for in Articles 14.0.1 and 14.0.2 of this Law, an agreement on the creation of a debt liability may not be concluded between him/her and the credit institution and the persons engaged in the sale of goods on hire purchase specified in Article 12.1 of this Law. 15.6. When the subject of the credit history dies, is declared dead, is missing, is considered incapacitated, as well as in cases where he/she is a minor and unable to issue a consent, the consent required by this Law shall be given by his/her heirs, legal representatives, parents or one of his/her caretakers. 15.7. Obtaining the consent of the credit history subject (including in the case provided for in Article 23.2 of this Law), and in the cases provided for in Articles 12.4.6 and 13.3.3 of this Law, the Central Bank shall determine the procedure for confirming the fact of obtaining consent for the credit bureau. A r t i c l e 16. Data submitted to the credit bureau 16.1. Data providers shall deliver to following information to the credit bureau: 16.1.1. initial debt amount 16.1.2. current debt amount 16.1.3. the purpose of the debt 16.1.4. dates of creation and repayment of debt (principal and interest) under the contract, debt repayments. 16.1.5. overdue debt amount (payment of principal debt and/or interest in whole or in part is delinquent by more than 30 calendar days from the period stipulated in the contract). 16.1.6. prolongation of debt repayment 16.1.7. debt securitization 16.1.8. repayment of debt at the expense of collateral 16.1.9. loss loan written off from the balance

16.1.10. fines and other sanctions to be paid, alimony, taxes and social insurance fees, other mandatory payments, fines and penalties, insurance fees, debt arising from notarized debt agreements, utility debts and their repayment period. 16.1.11. any other information affecting the assessment of creditability of the credit history subject and discipline of repayment of debt liabilities, provided that the inclusion of such information in the credit history does not contradict the law. 16.2. The Central Bank shall determine the amount of information in the credit history required for the identification of the credit history subject. 16.3. Placement of personal (except for information on financial transactions) and family life information about an individual, the credit history subject, in the credit history shall be prohibited under the Law of the Republic of Azerbaijan ‘on Obtaining Information’. A r t i c l e 17. Submission of credit history information to the credit bureau 17.1. The data provider shall provide the credit bureau with the information that makes up the credit history based on the agreement with the credit bureau. The data provider may enter into an agreement with one or more credit bureaus to provide relevant information. 17.2. The data provider should submit the information constituting the credit history to the credit bureau confirming the fact of obtaining the consent provided for in Article 14.0.1 of this Law. The data provider shall keep consents of credit history subjects in its archives for a period of 5 years from the date of submission of the last information on each debt or another case to the credit bureau. 17.3. The data provider should submit information on the status of debt (or the recent situation in other cases) to the credit bureau within the period specified in the agreement concluded with the credit bureau, but no later than 30 days after the change occurred. 17.4. Credit history information shall be delivered to the credit bureau electronically. 17.5. Negative information provided for in Articles 16.1.10 and 16.1.11 of this Law shall be placed in the EGIS in the part related to their activities by courts (except for the Constitutional and the Supreme Courts of the Republic of Azerbaijan), enforcement authorities and notaries through a relevant executive power authority; by the Constitutional and Supreme Courts of the Republic of Azerbaijan, the relevant executive authority (including on behalf of subordinate institutions included and not included in its structure), the Central Bank and the Audiovisual Council directly. The procedure for posting, updating, and obtaining such information by credit bureaus on the EGIS shall be determined by the relevant executive authority. A r t i c l e 18. Request for making corrections in the credit history 18.1. If the subject of the credit history discovers that the information that makes up his/her credit report is incorrect, he/she may apply to the relevant credit bureau and

data provider to remove the incorrect information. Copies of documents confirming incorrectness of the information should be attached with the appeal. 18.2. Upon receiving the application of the credit history subject, the credit bureau no later than the next working day, shall enter the record ‘under clarification’ in the relevant part of the database of credit histories and send a request to the data provider to verify the correctness of the information. When the application relates to the information specified in Article 6.4 of this Law in the credit history, the credit bureau shall investigate the issue within 2 working days and, depending on the result, correct the error and issue a new credit report without requiring a service fee to the data users who received the erroneous credit report, in case it is determined that the information is correct, provide a reasoned answer to the credit history subject on results of the review of the application. 18.3. The data provider shall check accuracy of the information sent to the credit bureau about the credit history subject within 3 working days from the day of receiving the request, send appropriate information to the credit bureau about correctness of the information or elimination of the discovered error. 18.4. The credit bureau shall correct the error in the credit history within 2 working days from the day of receiving the error correction information and issue a new credit report to data users who received erroneous credit reports without requiring a service fee. In accordance with Article 18.3 of this Law, the credit bureau shall provide a reasoned answer to the credit history subject about results of the review of the application within 2 working days from the day of receiving information on the correctness of the information. 18.5. From the moment the relevant note is received in accordance with the 1st sentence of Article 18.2 of this Law, until a new credit report or a reasoned answer is provided in accordance with the 2nd sentence of Article 18.2 and the 1st sentence of Article 18.4 of this Law, the credit bureau should deliver the credit report from the relevant credit history to data users with the note ‘under clarification’. 18.6. If, as a result of the investigation of the complaint, the data provider finds out that the information provided to the credit bureau is correct and the credit history subject agrees with this conclusion, no changes shall be made to the credit history. 18.7. Where the credit history subject disagrees with results of the investigation, the credit bureau shall make a relevant note in the credit history. At that, the credit history subject should be provided with an opportunity to place brief notes explaining the reasons for dissatisfaction in the credit history. 18.8. Where the credit history subject is not satisfied with results of the investigation, he/she may file a complaint with the Central Bank and the court. A r t i c l e 19. Composition of the database of credit histories 19.0. Every credit history kept in the database of credit histories should include at least: 19.0.1. the information specified in Article 16.1 herein. 19.0.2. the information on data providers that formulate a credit history.

19.0.3. relevant information, if the information is obtained from the EGIS, or the sources specified in Article 6.4 herein. 19.0.4. information on persons (institutions) that requested a credit report and on data users, as well as the date of issue of credit reports. 19.0.5. the information specified in Articles 18.2 and 18.7 herein. A r t i c l e 20. Credit report submission 20.1. In the credit report request, the data user should indicate the information required in accordance with Article 16.2 herein for the identification of credit histories of individuals and legal entities in the database and confirm the fact of obtaining the consent provided for in Article 14.0.2 herein. 20.2. The information to the data user shall be provided in the volume specified in the request. The name of the data provider shall be included in the information provided by the credit bureau only if allowed in the agreement between the credit bureau and the data provider. 20.3. Unless otherwise specified in the request of the credit history subject, the credit report should include all information on him/her in the database of credit history. 20.4. The credit bureau shall keep records of incoming requests for issuing and issued credit reports. 20.5. The credit report shall be issued in a hard and/or soft copy. 20.6. The credit bureau should submit the credit report no later than 3 working days after receiving the relevant request. A r t i c l e 21. Service fee 21.1. The credit bureau shall set a fee for using the database of credit histories. The amount of the service fee may not exceed the cost incurred for preparation and presentation of the relevant information. The order and terms of payment of the service fee shall rest upon mutual agreement between the data user and the credit bureau. 21.2. The credit bureau should provide the credit history subject with information on him/her at least 2 times per calendar year free of charge upon request. 21.3. The credit history subject shall enjoy the right to receive a credit report on him/herself at any time, regardless of the conditions stipulated in Article 21.2 of this Law, by paying the fee set by the credit bureau. 21.4. No fee shall be charged for the issuance of credit reports requested by courts, investigation authorities, enforcement authorities, law enforcement intelligence bodies, the Central Bank, notaries, and heir(s) of the credit history subject, and in the case specified in the second sentence of Article 18.2 and the first sentence of Article 18.4 herein.

Chapter 4 FINAL PROVISIONS A r t i c l e 22. Responsibility 22.1. If the credit bureau fails to deliver the relevant information to the Central Bank in accordance with Article 5.8 herein in full and on time, issues a credit report without appropriate notes in accordance with Article 18.5, includes the information in the credit history without verification of whether the data provider or data user approves the fact of obtaining consent of the credit history subject in the cases specified in Articles 12.4.6 and 13.3.3 and delivers the credit report, it shall be liable under the legislation. 22.2. The credit bureau and its employees shall be kept legally responsible for illegal use and disclosure of credit history information, as well as for distortion of information received from data providers. 22.3. The credit bureau shall not be kept responsible for the damage to the credit history subject due to incorrect information provided by the data provider to the credit bureau (in the event of discharge of the duty provided for in Article 18.5 herein). 22.4. Data providers and users shall be legally responsible for providing information on a credit history subject to a credit bureau or receiving a credit report without obtaining the consent of the credit history subject required by this Law. 22.5. If data providers fail to timely update relevant information or submit incorrect information to the credit bureau, and data providers specified in Article 17.5 herein fail to place or timely update relevant information on the EGIS, they shall be liable under the legislation. 22.6. Credit institutions and persons engaged in hire purchase of goods, provided for in Article 12.1 of this Law, shall be liable in accordance with the legislation if they fail to submit the information constituting their credit history to the credit bureau in accordance with the requirements of this Law. A r t i c l e 23. Transitional provisions 23.1. All information on borrowers of credit institutions in the centralized credit registry shall be provided once and free of charge to any credit bureau that started operating within three years from the date of entry into force of this Law, based on its request. 23.2. In accordance with Article 23.1 herein, information on subsequent changes in the information provided to the credit bureau should be provided by credit institutions to that credit bureau in the manner established by this Law (without obtaining the consent of the credit history subject when giving negative information). 23.3. The centralized credit registry shall stop providing information as follows: 23.3.1. to data users – from 1 April 2018.

23.3.2. to credit bureaus – from the date the period specified in Article 23.1 expires (by the decision of the relevant executive authority, the provision of information to credit bureaus is resumed and suspended again). 23.3-1. Credit institutions may obtain credit reports of credit history subjects, who are current borrowers with legal relations established before 1 April 2018 without obtaining their consent. 23.3-2. Until the change made by legal entities and unincorporated individuals engaged in hire purchase of goods provided for in Article 12.1 of this Law regarding the submission of credit history information to at least one operating credit bureau takes effect, persons engaged in relevant hire purchase of goods shall submit the information constituting their credit histories to the credit bureau for active agreements (payments not fully executed by the buyer) without obtaining the consent of the subject of the credit history. 23.4. Until a relevant law on supervision of financial markets is adopted, the supervisory authority shall determine a procedure for inspecting activities of credit bureaus and enforcement measures. Ilham ALIYEV, President of the Republic of Azerbaijan Baku city, 28 October 2016 № 384-VQ