Decree No. 2023-029 BIC

REPUBLIC OF MADAGASCAR

MINISTRY OF ECONOMY AND FINANCE DECREE No. 2023-029 setting the implementation procedures for certain provisions of Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Reporting Agencies

THE PRIME MINISTER, HEAD OF GOVERNMENT,

Having regard to the Constitution, Having regard to Law No. 2014-038 of January 9, 2015 on the protection of personal data, Having regard to Law No. 2016-004 of July 29, 2016, supplemented by Law No. 2016-057 of February 2, 2017, establishing the statutes of the Central Bank of Madagascar, Having regard to Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Reporting Agencies, Having regard to Decree No. 2019-093 of February 13, 2019, modified and supplemented by Decree No. 2021-699 of July 7, 2021, setting the attributions of the Ministry of Economy and Finance and the general organization of its Ministry, Having regard to Decree No. 2019-1407 of July 19, 2019 appointing the Prime Minister, Head of Government, Having regard to Decree No. 2021-822 of August 15, 2021, modified and supplemented by Decrees No. 2022-400 of March 16, 2022 and No. 2022-1468 of October 18, 2022, appointing members of the Government; On the proposal of the Minister of Economy and Finance, In Council of Ministers,

DECREES:

Article 1. Subject Matter This decree aims to set the implementation procedures for certain provisions of Law No. 2017-045 of February 15, 2018 governing the activity and supervision of Credit Reporting Agencies, in accordance with its Article 65.

Article 2. Scope of Application This decree applies to Unsupervised Entities or UEs as defined by Article 2 of Law No. 2017-045 of February 15, 2018, as well as to Credit Reporting Agencies or CRAs governed by the same law.

Article 3. Coordination of CRAs CRAs operating in Madagascar must coordinate their activities in accordance with the provisions set forth in BFM Instructions.

Article 4. Status of Data Providers for UEs For the application of Article 2 of Law No. 2017-045 of February 15, 2018, the following UEs are qualified as data providers:

• private or public water and electricity distribution companies operating within the national territory;
• companies providing telecommunications services;
• automobile dealerships;
• large-scale retail companies conducting credit sales;
• companies offering hire-purchase services;
• satellite channel distributors;
• entities referred to as "non-subject to" as provided for in Articles 2.1 and 2.3 of Law No. 2017-026 of February 8, 2018 on Microfinance.
• large-scale retail stores or other suppliers of goods and services capable of providing information related to the credit or payment history of a natural or legal person.

As the credit data sharing landscape in Madagascar evolves, the established list will be revised.

Article 5. Data Provision Obligation In their capacity as data providers, the UEs listed in Article 4 above are bound to comply with the provisions of Law No. 2017-045 of February 15, 2018, whose Article 39 stipulates the obligation to provide data to the CRA within the timeframe set forth in Article 18 of this decree.

The procedures for data submission and consultation are described in the code of conduct agreed upon between the CRA and the UEs and previously approved by Banky Foiben'i Madagasikara (BFM) or, where applicable, in the membership contract established between the CRA and the UEs.

The frequency of data submission to the CRA by the UE must be at least once per month and according to the formats or transmission methods agreed upon by both parties.

Article 6. Principle of Reciprocity In application of Article 40 of Law No. 2017-045 of February 15, 2018, UEs, in their capacity as data providers, have access to the information and services produced by the CRA.

Any CRA operating in Madagascar must respect and enforce this principle in the exercise of its activities.

Article 7. Consent of the Data-Holder Client 7.1- UEs are required to:

• obtain the free, informed, and explicit consent of their client prior to any collection, compilation, and sharing of the client's personal data for processing at the CRA level, and the subsequent dissemination of resulting information.
• inform each data holder of the scope of their consent, particularly regarding the purposes of data processing. To this end, UEs will provide all information required by data holders regarding the granting of their consent.
• ensure that the data communicated to the CRA has been subject to prior consent as indicated in the preceding paragraph.
• explicitly state, from the outset, in the membership contract signed with the client, the existence of the client's explicit consent.

The provisions of this paragraph also apply to natural persons acting as agents or holding executive or corporate leadership positions within a legal entity that is a client of the data provider.

In accordance with applicable legislation, competent judicial authorities may request the disclosure of UE data notwithstanding the absence of consent, as well as data processed by the CRA.

7.2- The document formalizing the Client's consent must be distinctly drafted and signed by the Client, and must bear the handwritten mention "read and approved" according to the consent clause model attached to Annex A of this decree. It may take the form of:

• an independent written document, or included in another document such as a membership contract,
• an electronic document meeting legal validity requirements.

The document must clearly and explicitly highlight the client's intention that their personal data, credit and payment history, and information resulting from value-added services be shared with CRAs and users defined by Law No. 2017-045 of February 15, 2018.

7.3- For loan applications or online transactions, client consent may be obtained from electronic platforms guaranteeing:

• identification of the establishment issuing the consent form;
• confidentiality of its content;
• non-repudiation of the consent form by its author;
• integrity of its content;
• client authentication;
• availability of consent form archiving.

7.4- A data holder who refuses to give consent for the processing of their data must not suffer any prejudice, in any form whatsoever, particularly in their contractual relationship with the UE.

Article 8. Duration of Consent Retention The client's consent must be retained in their file for the entire duration of their relationship with the UE.

Article 9. Confidentiality and Professional Secrecy The CRA and UEs must ensure that their respective employees have been sufficiently trained and that required controls are in place to manage client consent.

It is the responsibility of UEs to verify the client's identity during consent collection by implementing necessary due diligence.

Any person assigned to data processing and information dissemination, and any person having access to consultable information, are bound by professional secrecy under penalty of sanctions provided for by applicable criminal legislation.

Article 10. Solvency Report In application of Article 44 of Law No. 2017-045 of February 15, 2018, a solvency report request submitted by the client must be addressed personally and exclusively to the CRA by any method leaving a written record. Upon express request, the CRA will issue a free solvency report to the client once per year.

UEs may consult their clients' solvency reports with a CRA operating in Madagascar when necessary.

The solvency report must contain, among other things:

• general information on the borrower,
• the status and details of current commitments,
• the status of pending credit applications,
• negative events,
• guarantees,
• scoring and its meanings.

To respect data confidentiality, data originating from the concerned UE will be detailed, while data from other UEs will be aggregated.

Article 11. Data Protection Structure within the UE Each UE must have a Data Protection Officer who i. monitors compliance of data processing with applicable regulations and standards, ii. serves as a point of contact with the client to answer questions regarding data processing, iii. cooperates with the CRA regulatory and supervisory authority, namely BFM.

Article 12. Right to Rectification by the Data-Holder Client The client has the right to request, at any time, the correction and updating of their personal data.

A client who disputes the accuracy or completeness of any information disclosed by a CRA may file a written complaint directly with the CRA or with the UE with which they have a contractual relationship.

Article 13. Complaint Handling Procedures The UE receiving a complaint must inform the CRA of the measures taken and any potential modifications to be made within a maximum of five (5) business days from receipt of the complaint.

To resolve a complaint received directly by the CRA, the CRA will consult the UE that provided the disputed data.

The CRA and the UE, where applicable, are required to respond as soon as possible and no later than fifteen (15) business days from receipt of the complaint.

After updating the information following the complaint, the CRA will provide the data holder with a written report regarding the matter.

Article 14. Recourse A client dissatisfied with the steps taken by the CRA after filing their complaint may petition BFM within thirty (30) days of receiving the CRA's written report, by completing the form model in Annex B of this decree themselves or through their representative, which is also available on the CRA's website.

The duly signed and dated form by the client or their duly authorized representative must be accompanied by a certified copy of the report issued by the CRA mentioned in Article 13, paragraph 4, and must be sent to the BFM Department responsible for Information Central management via mail or electronic messaging.

Upon receipt of the complaint, BFM will conduct necessary investigations and may request explanations from the CRA within fifteen (15) days after receiving the complaint.

BFM may be required to reject the complaint or order the CRA to correct or supplement the disputed information, to limit or prohibit the publication of the disputed information, and to notify the persons to whom the false or incomplete information was disclosed by the CRA. BFM will also notify the client.

A client or CRA dissatisfied with BFM's decision may freely petition the competent civil court.

Article 15. Data Retention Period by the CRA All rejected credit applications or cancelled/unexecuted contracts will be removed from the CRA's database six (6) months after their registration.

All data concerning duly executed services or contracts will be removed from the CRA's database five (5) years after the closure date or the date of receipt of the last update.

Negative events will be removed from the CRA's database five (5) years from the date of occurrence of said event.

Article 16. Fees In application of Article 32 of Law 2017-045 of February 15, 2018, the fee schedule produced by the CRA for making solvency reports available to UEs is subject to prior approval by BFM.

Services agreed upon on a case-by-case basis between a CRA and a data provider qualifying as an Information User are excluded from BFM's fee approval process.

Article 17. BFM Supervision Procedures In application of Article 6 of Law No. 2017-045 of February 15, 2018, CRA activity supervision missions conducted by BFM or a duly mandated specialized entity may extend to UEs, which cannot invoke professional secrecy or obstruct controls under penalty of application of Article 53 of Law No. 2017-045 of February 15, 2018.

Controls at UEs cover any medium containing data or information on credit.

If a UE is subject to a regulatory authority, BFM will first contact said authority by any method leaving a written record, informing them of the upcoming supervision mission mentioned in paragraph 1. The main objectives of the envisaged mission will also be communicated to the regulatory authority.

Article 18. Timeframes Applicable to UEs In accordance with Article 39 of Law No. 2017-045 of February 15, 2018, the UEs listed in Article 4 of this decree must respect the following applicable timeframes:

• six (6) months to adapt their IT systems to enable data provision to the CRA;
• twelve (12) months to provide data to the CRA in accordance with related requirements.

Given the high number of UEs concerned by this decree, their membership with the CRA will occur progressively according to a list defined by BFM. The membership schedule will be established by mutual agreement between BFM and the CRA.

The aforementioned timeframes will begin to run from the date of notification to the concerned UE by BFM, followed by the publication of the schedule on its website.

Article 19. Entry into Force Due to urgency and in accordance with the provisions of Articles 4 and 6 of Ordinance No. 62-041 of September 19, 1962 on general provisions of domestic law and private international law, this decree enters into force immediately upon publication via radio and/or television broadcast or posting, regardless of its insertion in the Official Journal of the Republic.

Article 20. Final Provision The Minister of Economy and Finance, the Minister of Communication and Culture, and Banky Foiben'i Madagasikara are each charged, within their respective competencies, with the execution of this decree, which will be published in the Official Journal of the Republic of Madagascar.

Done in Antananarivo, on January 11, 2023

By the Prime Minister, Head of Government NTSAY Christian

The Minister of Economy and Finance RABARINIRINARISON Rindra Hasimbelo

The Minister of Communication and Culture RAKOTONDRAZAFY ANDRIATONGARIVO Lalatiana

FOR TRUE COPY Antananarivo, on MAR 21, 2023 THE GOVERNMENT SECRETARY GENERAL RAKOTOARISOA Miadantsata Indriamanga