CP26/7: Credit Information Market Study: Proposed Approach to Implementing FCA Remedies

Consultation Paper CP26/7*** Credit Information Market Study Proposed Approach To Implementing FCA Remedies February 2026

How to respond We are asking for comments on this Consultation Paper (CP) by 1 May 2026. You can send them to us using the form on our website. Or in writing to: Consumer Finance Policy Team Financial Conduct Authority 12 Endeavour Square London E20 1JN Telephone: 0207 066 1000 Email: creditinformationmarketstudy @fca.org.uk Disclaimer When we make rules, we are required to publish: • a list of the names of respondents who made representations where those respondents consented to the publication of their names, • an account of the representations we receive, and • an account of how we have responded to the representations. In your response, please indicate: • if you consent to the publication of your name. If you are replying from an organisation, we will assume that the respondent is the organisation and will publish that name, unless you indicate that you are responding in an individual capacity (in which case, we will publish your name), • if you wish your response to be treated as confidential. We will have regard to this indication, but may not be able to maintain confidentiality where we are subject to a legal duty to publish or disclose the information in question. By responding to this publication, you are providing personal data to the FCA, including your name, contact details (including, if provided, details of the organisation you work for), and any opinions expressed in your response. This data will be used by the FCA to inform regulatory policy and rulemaking, in the public interest and in the exercise of official authority under FSMA and other applicable legislation. The FCA may share personal data where necessary to perform their public tasks and to support regulatory cooperation and joint policy development. Please note that we will not regard a standard confidentiality statement in an email message as a request for non-disclosure. Irrespective of whether you indicate that your response should be treated as confidential, we are obliged to publish an account of all the representations we receive when we make the rules. Further information on about the FCA’s use of personal data can be found on the FCA website at: https://www.fca.org.uk/privacy. All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts See all our latest press releases, consultations and speeches.

3 Contents Chapter 1 Summary Page 4 Chapter 2 The wider context Page 7 Chapter 3 Proposed rules on mandatory reporting and firm requirements Page 14 Chapter 4 Proposed rules on the designation of credit reference agencies Page 30 Chapter 5 Proposed rules on permitted use Page 35 Chapter 6 Implementation period Page 37 Chapter 7 Other FCA remedies – current position and next steps Page 39 Annex 1 Questions in this paper Page 41 Annex 2 Cost benefit analysis Page 45 Annex 3 Compatibility statement Page 94 Annex 4 Glossary Page 102 Appendix 1 Draft Handbook text

4 Chapter 1 Summary Why we are consulting 1.1 Consumer credit information is an important part of a modern credit market, contributing to the UK economy and its sustainable growth. It helps lenders and other users make better commercial decisions, enhances risk management and supports regulatory compliance. It also supports public policy objectives including responsible lending, widening access to financial and non-financial services and tackling fraud. 1.2 We published our Credit Information Market Study (CIMS), Final Report (MS19/1.3) in December 2023, setting out a package of remedies to improve the credit information market. These included proposed new FCA rules and guidance alongside reforms to industry governance arrangements and other industry-led remedies. 1.3 A new Credit Information Governance Body (CIGB) has now been set up and industry participants are working on industry-led remedies. This consultation focuses on FCA-led remedies: new Handbook requirements to improve the coverage and quality of credit information. 1.4 Our proposals include mandatory reporting requirements for firms in the credit and mortgage markets and connected obligations. This would create a regulatory framework for how credit information is shared and used across these markets. 1.5 To inform our proposals we engaged extensively with a wide range of stakeholders. This included a detailed information request to industry participants to assess the costs and benefits of different options. We also considered how our proposals interact with existing industry rules and practice. We want to make sure that, wherever possible, they reflect or are complementary to these arrangements. What we want to change 1.6 This consultation focuses on: • Remedy 2A: Mandatory data sharing with Designated Consumer Credit Reference Agencies (DCCRAs). We propose new mandatory reporting requirements for firms undertaking certain activities to share consumer credit information with DCCRAs. This includes related obligations around the use of consumer credit information. • Remedy 2D: Requirements for firms on improving the accuracy of information shared, improving processes for dealing with error correction/disputes and reporting satisfied County Court Judgments (CCJs) and decrees. Some of these relate to information provided under the mandatory reporting requirement, while some have a wider application.

5 1.7 We also set out our proposed next steps on Remedy 2C (DCCRA information reporting to the FCA) and Remedy 3A (signposting to statutory credit reports). This includes our expectations on signposting under the Consumer Duty. Outcomes we are seeking 1.8 Our analysis indicates our proposals would likely lead to significantly improved outcomes for firms and consumers: • Firms would have access to more comprehensive and better-quality credit information, enabling more effective and efficient assessments of credit risk and affordability. This would enable them to make better-informed decisions about credit access and pricing. • More credit would be extended on aggregate, meaning consumers would see improved access to credit where appropriate. This includes through reductions in the numbers of ‘thin files’ (a credit file containing limited information) and ‘credit invisibles’ (individuals with no consumer credit information), promoting financial inclusion. • Credit would be better allocated including through a reduction in unaffordable lending that would improve wellbeing for consumers and reduce losses for firms. • Increased competition in retail lending markets. This would improve outcomes for consumers and unlock innovation among lending firms, increasing choice for consumers. • Stimulating competition and innovation between DCCRAs. This includes on the price and quality of their products, analytics, and potential new data sources. • Consumers would face less confusion as their credit obligations would be more consistently reflected at each DCCRA making it easier to spot errors. • For firms and consumers, improvements to the effectiveness of identity verification and fraud prevention processes. 1.9 Given the large size of retail lending markets, even small improvements in these areas can yield considerable benefits. See the cost benefit analysis in Annex 2 for further discussion of the benefits of our proposals. Measuring success 1.10 If implemented, we will monitor the effectiveness of our interventions in line with the Rule Review Framework. This will include engaging with the CIGB to consider interactions with related industry work. We would assess how effective the interventions have been in improving outcomes for consumers and firms, including the impact on competition between Credit Reference Agencies (CRAs). This will help us to understand whether the mandatory reporting framework and our approach to designating CRAs remains appropriate.

6 1.11 We propose that our monitoring would be informed by: • Initial information requests to DCCRAs once the mandatory reporting requirements have started. • Proposed new information reporting requirements for DCCRAs (see Chapter 7). • Other data sources including Product Sales Data (PSD) returns submitted to us by firms. This will enable us to monitor trends in credit provision. • Tracking changes in consumer awareness and engagement with consumer credit information through the Financial Lives survey. • Supervisory information and other intelligence received on the practical operation of the framework. This includes any related compliance issues or trends. • Engaging with CIGB, trade bodies and consumer groups on their experience and views of the framework. 1.12 Further information on our monitoring and evaluation approach is set out in our cost benefit analysis (CBA) available at Annex 2. Next steps 1.13 We welcome feedback on our draft rules and questions by 1st May 2026.

7 Chapter 2 The wider context Market overview 2.1 In the UK, the credit information market has evolved over several years. Three large firms (Equifax, Experian and TransUnion) account for a significant majority of the market. Newer entrants generally operate in niche or adjacent markets. Their business models largely do not involve collecting credit information directly from lenders or other data contributors. Those that do collect consumer credit information directly hold significantly less credit information compared to the 3 largest CRAs. 2.2 Customers of the credit information market are typically lenders and other credit information users (rather than consumers). However, consumer credit information affects consumer outcomes, even when mediated through lenders and other users, as it is often key to lender decision making. Many UK adults currently have a mortgage, while according to the FCA Financial Lives survey 2024, approximately 79% held at least one regulated credit product in May 2024 or had done so at some point in the previous 12 months. Consumer credit information therefore impacts a significant number of consumers. The harm we are trying to reduce 2.3 The coverage and quality of credit information can significantly influence how regulated products are accessed, priced and managed. Differences in coverage can lead to harm as lenders may accept and decline consumers inappropriately where they would otherwise have made a different decision based on more comprehensive information. 2.4 In MS19/3, we found significant differences in credit information coverage between the 3 large CRAs. Our analysis conducted with data from 2019 and 2024 has identified that while coverage of consumer credit information is high overall, firms do not share credit information on a significant volume of agreements across all 3 large CRAs. We have also seen that newer sectors or products entering the retail lending market can sometimes coalesce around sharing to just 1 or 2 of the 3 large CRAs. This fragments data and restricts the visibility of a customer’s financial standing for firms using the other CRAs. 2.5 Publicly available information on CCJs and decrees can also significantly affect a consumer’s credit file. This information is sometimes not updated when debts are satisfied because consumers are unaware of the need to inform the Courts. Being able to more reliably distinguish between satisfied and unsatisfied CCJs/decrees would help firms to more effectively assess risk. 2.6 Our proposals aim to mitigate the harms caused by these issues. We want to make sure consumers have appropriate access to credit that is more fairly priced based on better informed decision-making.

8 CIMS remedies 2.7 We proposed several remedies in the CIMS Final Report. These included: • FCA-led remedies: Designed to improve the coverage and quality of consumer credit information, supporting better consumer outcomes, more effective competition and better credit decision-making. Includes remedies to be delivered using new Handbook rules and remedies we expect to see delivered under the Consumer Duty. • A joint governance remedy: Creating a new independent Credit Information Governance Body (CIGB) to strengthen oversight and coordination in the market. The FCA and industry established the Interim Working Group (IWG) to design the new governance framework which published its final report on 23 May 2025. The CIGB has now been formed and will be fully operational by summer 2026. • Industry-led remedies: Targeted at improving the quality of consumer credit information, enhancing consumer access to credit information and improving understanding. Many of these remedies require technical and digital innovation, such as a common format for submitting credit information and streamlining access to statutory credit reports (SCRs). Work is under way to deliver these remedies through the CIGB. These remedies complement the Handbook rules and other measures proposed in this CP. 2.8 The role of the CIGB is key to delivering the industry-led remedies. It also has an important role to play in the delivery and effectiveness of the overall package of CIMS remedies. We are committed to supporting the CIGB’s delivery of relevant industry-led workstreams. 2.9 Our proposals focus on the remedies we are leading through new Handbook requirements. We set out in the table below how these proposals interact with relevant industry-led work and other initiatives. Remedy Overview of Remedy as listed in Final Report (MS19/1, 2023) Changes from Final Report to position in this CP Covered in CP / relevant links 1: Reformed Industry Governance Arrangements Establishing a new credit reporting governance body with broader objectives. The CRGB is to be more inclusive, transparent and accountable. Name of industry governance body now Credit Information Governance Body (CIGB). No, CIGB has now been established. We will engage with CIGB on any interactions between our proposals and industry rules and practice.

9 Remedy Overview of Remedy as listed in Final Report (MS19/1, 2023) Changes from Final Report to position in this CP Covered in CP / relevant links 2A: Mandatory data sharing with designated CRAs A mandatory reporting requirement for all FSMA-regulated data contributors to share credit information with designated CRAs. The designation scheme will be a proportionate regulatory framework for sharing consumer credit information between firms and certain CRAs. These proposals would require all firms who share any consumer credit information with at least 1 DCCRA to share all consumer credit information with all DCCRAs. We are also consulting on a range of connected obligations for firms and DCCRAs, and on our approach to designating DCCRAs. Yes, Handbook rules proposed. Links to industry arrangements on the terms of access and use of consumer credit information, including the general principle of reciprocity which incentivises sharing with CRAs. 2B: Common data format A common data reporting format to improve consistency and granularity of credit information across CRAs. N/A No, industry-led remedy. Firms subject to the mandatory reporting requirement may provide consumer credit information to DCCRAs in the common data format. 2C: Designated CRA regulatory reporting to FCA A new regulatory reporting framework for designated CRAs which aims to monitor the mandatory reporting framework and give the FCA insight into potential issues. The CP sets out proposals for initial data requests to DCCRAs at 12 months post￾implementation and to then consider the introduction of appropriate Handbook reporting requirements through subsequent consultation. Yes, but no Handbook rules consulted on in this CP.

10 Remedy Overview of Remedy as listed in Final Report (MS19/1, 2023) Changes from Final Report to position in this CP Covered in CP / relevant links 2D: Data contributor requirements (error correction and reporting satisfied CCJs/ decrees) Proportionate requirements for FSMA-regulated data contributors that aim to provide regulatory certainty, aid supervision and deliver transparency to consumers. No significant changes. Yes, Handbook rules proposed. Includes requirements applicable to firms subject to the mandatory reporting requirement and more broadly. Links to industry remedy 3C on streamlining the way that CRAs and lenders deal with disputes. 3A: CRA/CISP signposting to SCR Increasing consumer awareness of the availability of free consumer credit information via the statutory process – SCRs. No significant changes. Yes, but no Handbook rules proposed in this CP given our expectations on consumer understanding and support under the Consumer Duty. 3B: Streamlined access to SCR Streamlined access to consumer credit information, including SCRs, through a ‘one-stop shop’. No significant changes. No, industry-led remedy. 3C: Streamlined disputes process Streamlined process to help consumers dispute errors in the credit information held on their credit file. No significant changes. No, industry-led remedy. Links to our proposed requirements for firms to investigate and resolve errors under Remedy 2D. 3D: Streamlined Notice of Correction (NoC) and vulnerability markers Streamlined process for improved consumer outcomes which builds upon existing processes. No significant changes. No, industry-led remedy. Supports recommendations and related industry work on coerced debt set out in the Financial Inclusion Strategy.

11 Remedy Overview of Remedy as listed in Final Report (MS19/1, 2023) Changes from Final Report to position in this CP Covered in CP / relevant links 4A: More timely reporting of key data to designated CRAs Provision of an accurate and up￾to-date view of consumers’ credit commitments to further support lenders in making decisions. No significant changes. No, industry-led remedy. Links to our requirements for firms to share consumer credit information on a monthly basis initially. Any changes would be informed by industry work on assessing costs/benefits of more timely sharing of consumer credit information. 4B: Reviewing the Principles of Reciprocity (PoR) and related issues Complementing the proposed mandatory reporting requirement implemented by the FCA. No significant changes. No, industry-led remedy. Links to our proposed requirements on the permitted use of consumer credit information shared under mandatory reporting requirements. 4C: Improved Current Account Turnover (CATO) data with updated access arrangements Assessment of how access arrangements to CATO data can be updated for non￾PCA providers, and how CATO data can be improved. We do not propose to include CATO data in scope of the 2A mandatory reporting requirement at this time. No, industry-led remedy. Potential links to industry remedy 2B (common data format) Subject to the outcome of industry work on enhancing CATO we may consider whether it is appropriate to include CATO in scope of consumer credit information to be shared under the mandatory reporting requirements at a later time. Wider effects of this consultation 2.10 The remedies set out above impact a wide range of activities and are relevant to other regulatory and Government-led initiatives. This includes financial inclusion, SME lending, open finance, the regulation of DPC, reform of the Consumer Credit Act 1974 (CCA) and our work on certain credit builder products. The remedies are also relevant to sectors and credit information users outside of retail lending markets. This reflects the importance of credit information and the need for co-ordination across different

12 stakeholders to make sure industry and regulatory requirements are flexible enough to adapt to emerging or unforeseen issues and can facilitate innovation. In developing our proposals, we have considered these related issues and set out below how they interact with our proposed requirements. Financial inclusion 2.11 In November 2025, the Government published its Financial Inclusion Strategy. It includes various initiatives which align with our ambitions to enhance access to affordable credit and tackle the impact of coerced debt on victim-survivors’ credit files. We support these initiatives and will work with stakeholders to consider the interactions between the initiatives set out in the Financial Inclusion Strategy and our proposals to help make sure effective solutions can be implemented as quickly as possible. Business lending and the Commercial Credit Data Sharing Scheme 2.12 There are some parallels between our proposals and the Commercial Credit Data Sharing Scheme (CCDS). Some CRAs designated under that scheme may also be designated under our proposals. Business lending is not in scope of our mandatory reporting proposals although we have a separate and discrete statutory function for monitoring and enforcing relevant CCDS requirements. 2.13 In September 2025, the Treasury launched the Commercial Credit Data Sharing (CCDS): Consultation and Call for Evidence. We are engaging with the Treasury on the CCDS and considering potential interactions with the broader suite of CIMS remedies. Open banking and open finance 2.14 Open banking is currently used by many firms to support lending decisions, typically alongside credit information provided by CRAs. We are aware of a handful of smaller lenders who offer credit solely based on open banking data. 2.15 In our 2025–2030 strategy, we committed to publishing a roadmap for the roll-out of open finance. Open finance extends open banking style data sharing and third-party access to a broader range of financial sectors and products beyond payment accounts. It aims to give consumers and businesses greater control over a broader range of their financial data. Our CEO’s December 2025 letter to the Prime Minister noted our commitment to setting out a plan for open finance in 2026, prioritising SME lending. 2.16 We see open finance advancing some of the same goals that our proposed measures would further. For example, increased access to credit for ‘thin file’ consumers and empowering consumers to access their own financial information more conveniently. Open finance could unlock significant additional sources of data, which could be used to support lending decisions. However, we expect that credit information provided by CRAs will continue to play a significant role for the foreseeable future, and we consider that the development of open finance would complement these proposals.

13 Deferred Payment Credit 2.17 The Government has legislated to bring DPC (Deferred Payment Credit), more commonly known as Buy-Now Pay-Later, into our regulatory perimeter. This will take effect from 15 July 2026 and our approach to regulation is set out in PS26/1. If implemented, the requirements proposed in this CP would also apply to regulated DPC agreements. This will help to build the credit profile of DPC customers and provide greater visibility of DPC commitments to the wider credit market. Consumer Credit Act Reform 2.18 In May 2025 the Government consulted on Phase 1 of its proposals to reform the Consumer Credit Act 1974 (CCA) with a view to modernising the regime. Some of our proposals relate to s159 of the CCA which provides a mechanism for disputing and correcting information held by CRAs. The Government’s Phase 1 consultation did not include any proposals on s159 of the CCA. Our proposals aim to complement this provision so that firms deal with disputes and corrections quickly and effectively. We recognise that it may be necessary to further consider interactions between the statutory framework and our proposals as a part of the wider CCA reform agenda. We will continue to engage with the Treasury and other stakeholders as this work develops. Credit builders 2.19 The CIMS Final Report highlighted concerns around the reporting of certain ‘credit builder’ products to CRAs. This included whether these products represented a genuine payment commitment. We have since published information for consumers on these products, which are solely aimed at ‘building’ credit profiles or scores. We are continuing to engage with Equifax, Experian and TransUnion to make sure only appropriate information is shared that accurately reflects repayment performance. Impact on non-financial services sectors 2.20 Credit information is contributed and used across a range of other sectors. It can have a broader impact on consumer outcomes outside of retail lending markets. We consider that enhancing the coverage and quality of information provided by firms subject to our regulation will benefit other credit information users and their customers. Additionally, further benefits could arise from more comprehensive information sharing with CRAs in sectors outside of our regulation. We will engage with the CIGB and relevant stakeholders, including other sectoral regulators, to consider whether and how a cross￾sectoral regulatory approach could help deliver more comprehensive credit information across other sectors.

14 Chapter 3 Proposed rules on mandatory reporting and firm requirements Mandatory reporting requirement 3.1 We propose to introduce a mandatory reporting requirement under which firms that share consumer credit information on any in scope agreement with at least one DCCRA must share all available consumer credit information on that agreement with all DCCRAs. The framework specifies the regulated activities, agreements and types of information that fall within scope. 3.2 Our proposals represent a shift in the way the credit information market operates and they would interact with industry rules and practices, notably the ‘Principles of Reciprocity’ (PoR). Where possible we have sought to ensure our proposals are complementary to these industry arrangements, which we expect to be adopted and reviewed by the CIGB in due course. What we said previously and proposed approach 3.3 In the Final Report, we set out 3 high-level ways the mandatory reporting requirement could be structured: • An absolute requirement: Requiring all firms involved in the provision or administration of regulated credit agreements or regulated mortgage contracts to share certain credit information with DCCRAs. • A portfolio approach: Requiring firms who share credit information on a lending portfolio with at least 1 DCCRA to share credit information on that portfolio with all DCCRAs. Firms who did not wish to use consumer credit information from DCCRAs would not be subject to the mandatory reporting requirement. So, the decision as to whether to share or to cease sharing, would rest with firms. • A prescribed product/activity approach: Requiring firms involved in particular types of activities to share credit information on those portfolios with all DCCRAs. 3.4 We indicated that the absolute requirement could be the most effective way to achieve comprehensive coverage across DCCRAs and would be straightforward for firms and consumers to understand. However, we also recognised the need for further analysis to assess its implications and to determine whether it would be proportionate once costs and benefits were fully considered. 3.5 The retail lending market includes many small firms with only a few regulated agreements whilst a smaller number of large firms hold most of the agreements. In developing our approach, we considered this market structure alongside current credit reporting practices, recognising the differing sizes of firms and whether they share consumer credit information with one or multiple CRAs.

15 3.6 Our analysis indicates that around 1,150 firms that hold only a small number of regulated agreements do not currently share consumer credit information with any CRAs. Proceeding with the absolute requirement would require many smaller firms to establish new systems and processes, irrespective of whether they choose to use credit information and products. We found that an approach such as the portfolio approach would capture most regulated agreements that would be in scope of the absolute approach (around 98% by number of agreements and 96% by value). 3.7 We recognise that the absolute requirement would deliver benefits for consumers and the wider market. However, we currently consider that the operational and cost burdens for smaller firms, that are less likely to use CRA products, are likely to be disproportionate. 3.8 We have also considered how our proposals interact with existing industry rules and guidance, particularly the PoR, which require firms to contribute credit information in order to access it. While firms’ decisions to commence or cease sharing credit information reflect their business models and commercial strategies, the ‘reciprocity’ principle encourages sharing with CRAs. 3.9 We have concluded the most proportionate approach is one aligned with the reciprocity principle, capturing firms that already share with a DCCRA or choose to do so in future. This would still cover most agreements that an absolute requirement would capture, while building on existing commercial incentives to share with DCCRAs and minimising costs. 3.10 So, as outlined above, we propose that where firms in scope share any consumer credit information on reportable agreements with at least one DCCRA, they must share all available consumer credit information on those agreements with all DCCRAs. 3.11 This approach, which is similar to the portfolio approach, preserves firms’ discretion over whether to share consumer credit information with DCCRAs based on their business models and commercial strategies. Given the commercial value of this information, we consider it unlikely that firms would stop sharing as a direct result of our proposals. However, we will monitor trends in credit reporting practices to assess the impact of our proposed requirements. 3.12 In the Final Report, we proposed an industry-led remedy (Remedy 4B) to review the existing PoR and related issues. We will engage with CIGB on this work to monitor and assess any impact on our proposed framework. 3.13 We currently propose to designate 3 CRAs (see Chapter 4). So, if no additional CRAs were designated, firms already sharing with a DCCRA will not be required to share with any more than 2 others. Firms in scope will already have a mechanism in place for sharing with at least 1 DCCRA. We expect the incremental costs to extend sharing with 1 or 2 additional DCCRAs to be relatively modest (see Annex 2 (CBA), para. 137-141). 3.14 We have considered introducing de minimis ‘thresholds’ (potentially by reference to size of firms or volume of agreements held), below which our requirements would not apply. Thresholds could potentially reduce compliance costs for smaller firms. However, the potential benefits of thresholds would need to be weighed against the risk of increased

16 regulatory complexity and possible confusion about when consumer credit information should be shared with DCCRAs. Under our proposed approach, we think that even smaller firms will need to make only incremental changes to systems and processes. So, we propose an approach without thresholds, but welcome views on this point. 3.15 DCCRAs will need to onboard additional firms, and ingest, manage and process consumer credit information from them. DCCRAs have established systems for handling large volumes of consumer credit information. However, any increase may require adjustments to their processes and increased resources. 3.16 We have reflected these issues in our implementation approach to minimise costs for firms and DCCRAs. As some parties need time to establish new processes, we propose an implementation period for the mandatory reporting framework and a lead‑in time for ‘first‑time providers’ of consumer credit information who begin sharing once the framework is in effect. Further details are in Chapter 6. 3.17 We have set out the proposed scope of the mandatory reporting requirement by reference to our existing regulatory remit. However, we encourage firms and other credit information users and contributors, who are not within the scope of the proposed requirements, to consider whether better consumer outcomes could be achieved by increased sharing of credit information, where appropriate and beneficial. We will engage with the CIGB and relevant stakeholders, including other sectoral regulators, to consider whether and how a cross-sectoral regulatory approach could help deliver more comprehensive credit information across other sectors. Question 1: Do you agree with our overall approach of proposing new Handbook rules to achieve more consistent market-wide outcomes in this area? Question 2: What are your views on our proposal that where firms in scope of the requirements share any consumer credit information on reportable agreements with at least one DCCRA, they should share all available information on those agreements with all DCCRAs, and do you agree with the rationale for the proposed approach? If not, please explain why. Question 3: Do you agree that the approach outlined above is a proportionate way of capturing the majority of regulated agreements and do you agree with our reasons for not proposing an absolute requirement? Please provide reasons for your answer.

17 Scope 3.18 The scope of the proposed mandatory reporting requirement is drawn by reference to: • A defined list of certain regulated activities (paragraphs 3.19 to 3.21). • The agreements which relate to those activities (paragraphs 3.22 to 3.32). • The consumer credit information relating to those agreements (paragraphs 3.33 to 3.37). Regulated activities in scope 3.19 We want to capture the broad range of regulated activities across the consumer credit and home finance sectors that may generate consumer credit information which may be shared with DCCRAs. This scope will be set out in new chapters of the CONC (Consumer Credit) and MCOB (Mortgages And Home Finance) Sourcebooks which will contain requirements on sharing consumer credit information with DCCRAs and other connected obligations. 3.20 We propose that firms undertaking the following regulated activities will be in scope of the mandatory reporting requirement. This applies if they share, or commence sharing, consumer credit information relating to a reportable agreement with at least 1 DCCRA: • Entering into a regulated credit agreement as lender or exercising, or having the right to exercise, the lender’s rights and duties under a regulated credit agreement. • Debt collecting in relation to a regulated credit agreement. • Debt administration in relation to a regulated credit agreement. • Entering into or administering a: – regulated mortgage contract. – regulated sale and rent back agreement. – home purchase plan. – home reversion plan. • Operating an electronic system in relation to lending in relation to a borrower under a Peer-to-peer (P2P) agreement. • Facilitating a home finance transaction as a P2P platform operator. 3.21 Not all firms carrying out these regulated activities currently share consumer credit information. However, our analysis shows that some sharing already occurs across these activities, and further sharing could support good consumer outcomes. We are therefore proposing a scope broad enough to capture both agreements already being shared and those that might be shared in future. This will help ‘future-proof’ the framework and ensure it remains flexible as market practices evolve while providing certainty to market participants. Question 4: Do you have any views on the proposed scope of regulated activities set out above? Are there any other types of regulated activities that should be in scope?

18 Agreements in scope 3.22 We have developed a new Handbook glossary term ‘reportable agreement’. This will identify agreements in scope of our requirements by reference to specified regulated activities to which the agreements relate (subject to some exclusions). 3.23 This will apply when an agreement relates to any of the regulated activities outlined in 3.20, and the agreement is one where the customer is a consumer (as defined in our Handbook). 3.24 We propose the following types of agreements will be in scope: • Regulated credit agreements. • Regulated mortgage contracts. • Home purchase plans. • Home reversion plans. • Regulated sale and rent back agreements. • P2P agreements in relation to a borrower (facilitated by firms operating an electronic system in relation to lending). • Home finance transactions facilitated by P2P platform operators. DPC 3.25 From July 2026, DPC agreements will fall within scope of regulated credit agreements under the Financial Services and Markets Act 2000 (Regulated Activities etc.) (Amendment) Order 2025. Any in-scope DPC agreements will therefore be captured by the mandatory reporting requirement. Currently, where DPC is shared with DCCRAs, it is recorded under a separate ‘account type’. This means it can be separated from other forms of credit enabling tailored approaches to how DPC is reflected in DCCRAs’ products and firms’ lending processes. Home-collected credit (HCC) 3.26 The Home Credit Market Investigation Order 2007 (HCMIO) requires certain HCC firms to share credit information with at least 2 of the 3 large CRAs. HCC firms will also fall within our proposed framework where they enter into, or exercise rights in relation to, regulated credit agreements. So, HCC firms that share consumer credit information with a DCCRA, whether voluntarily or in compliance with the HCMIO, will be required to share all available consumer credit information with all DCCRAs. The Competition and Markets Authority (CMA) published a consultation on the HCMIO in January 2026 and is considering setting it aside. We will engage with the CMA and assess whether to change our approach on HCC in view of the outcome of the CMA’s consultation. High Net Worth (HNW) individuals 3.27 Our proposed framework does not capture consumer credit lending to HNW individuals. But it does capture mortgage lending to HNW individuals for primary residence. This approach reflects the existing distinction in regulatory scope between these two areas.

19 Authorised servicers and special purpose vehicles (SPVs) 3.28 Authorised servicers as defined in paragraph 55 of Schedule 1 to the Financial Services and Markets Act 2000 (Exemption) Order 2001 will be in scope of the proposed requirements. This includes scenarios where the creditor is a SPV that is not itself an authorised firm, but owns regulated credit agreements, and relies on the exemption provided under paragraph 55. In these cases, the SPV must enter into a servicing arrangement with the authorised servicer to manage the debt on its behalf. Forward flow arrangements 3.29 Forward flow arrangements can be made by investors to originate regulated mortgage contracts through regulated firms which are subsequently passed on to other firms undertaking mortgage administration activity. These firms will be in scope of our requirements for any reportable agreement they share, or start sharing, with DCCRAs. Business lending 3.30 Regulated credit agreements for business lending purposes will not be in scope of the proposed framework. 3.31 The CIMS findings and remedies focused specifically on non-business lending. Credit information relating to business lending is generally held in different technical infrastructure by a different range of CRAs. In addition, the CCDS scheme already exists to facilitate the sharing of business credit information with CRAs designated by the Treasury. Consumer Buy-To-Let (CBTL) 3.32 CBTL business is excluded from regulated mortgage activities and our rules and guidance in MCOB do not apply to it. So, CBTL agreements will not be in scope of the proposed framework. We understand that some firms share credit information about CBTL agreements with at least 1 of the CRAs that we are proposing to designate. These firms may wish to consider sharing with all DCCRAs to improve the coverage of credit information about CBTL agreements. Question 5: Do you have any views on the types of agreements that are to be in and out of scope of the proposed mandatory reporting requirement? Consumer credit information to be shared and frequency 3.33 We propose introducing a new Handbook glossary term ‘consumer credit information’. This will identify the types of information that the framework applies to and relates to both consumer credit lending and certain home finance activity. The term ‘credit information’ is already defined in the FCA Handbook so the new term ‘consumer credit information’ is distinct to our proposed mandatory reporting framework.

20 3.34 We considered whether to specify the consumer credit information to be shared by prescribing particular data formats. While this could offer advantages, it would require frequent rule updates as formats evolve, creating unnecessary regulatory burden and repeated adjustments for firms. 3.35 To balance certainty with flexibility, we instead propose setting clear, high‑level expectations for the types of consumer credit information that must be shared. This gives firms confidence about requirements while allowing industry practices and data formats to develop organically. The types of consumer credit information we have identified broadly reflect what firms already share with CRAs and are intended to be wide enough to accommodate future changes. 3.36 We will continue to monitor the appropriateness of these types of information in light of evolving market practice. This includes the further progression of industry work on the common data format. Types of consumer credit information 3.37 The proposed new glossary definition of “consumer credit information” specifies the types of information we propose firms will be required to share. We also give illustrative and non-exhaustive examples of related data points. Type of consumer credit information Examples of what this information may comprise identification information Title, first name, surname, date of birth, address. account information Type of account, start date, end date. credit obligations Frequency of payments, expected payments, payments made, current balance, credit limit. full repayment history Payments made on time, late payments, whether account is up to date or in arrears, how long the account has been in arrears. default information Default date, original default balance, default satisfaction date. forbearance information. Arrangements, payments made. Question 6: Do you consider the types of consumer credit information we have proposed strike the right balance between regulatory certainty and flexibility for evolving market practice, including ongoing industry work on the common data format? If not, please explain your reasoning and suggest any changes you think would be appropriate. Timeliness of sharing 3.38 We propose that firms subject to the mandatory reporting requirement must share all consumer credit information they hold for reportable agreements with all DCCRAs

21 at least once a month. This frequency of sharing reflects current market practice. We recognise that more frequent sharing may deliver further benefits and will be explored through industry‑led Remedy 4A. At this time, we think monthly reporting is a proportionate baseline, balancing regular updates with current operational realities, but it does not prevent firms from sharing more frequently. 3.39 We will monitor industry developments in this area. We remain open to amending the baseline reporting frequency in light of future innovation or other changes that may arise from industry work under Remedy 4A. ‘Full data’ expectation 3.40 We propose that firms be required to share ‘all’ of the types of consumer credit information that they hold for a reportable agreement. This is often referred to as both ‘positive’ and ‘negative’ data. We think this approach is important to help consumers build a positive repayment history where that information is available and that this would all be captured within our proposed types of consumer credit information. Question 7: Do you agree that firms should be required to share both ‘positive’ and ‘negative’ data where available? Question 8: Are there any other type of information that should be included under ‘type of consumer credit information’ in the table above? If so, confirm which ones and explain why. Question 9: Do you agree that firms in scope of the mandatory reporting requirement should be required to share consumer credit information with DCCRAs at least once per month? Current account turnover (CATO) data 3.41 Some personal current account providers share CATO data with the CRAs we are proposing to designate, and this information supports CRAs affordability and income estimation services. We previously indicated we would consider the costs and benefits of including CATO data in the mandatory reporting framework, noting that governance and data privacy considerations may differ for this type of data. We are also mindful that CATO data is not necessarily derived from underlying credit accounts and that other regulatory initiatives, including open banking, could affect the proportionality of further regulatory intervention in this area. 3.42 Industry Remedy 4C (improved CATO data with updated access arrangements) will progress further work in this area. UK Finance (UKF) has led related industry work, and we believe it is appropriate at this stage to allow this work to progress further before considering whether it is necessary to include CATO data in the mandatory reporting framework. We also note potential links to the industry Remedy 2B (common data format). Our proposed approach would not prevent the inclusion of CATO within a common data format.

22 Question 10: Do you have views on our proposal to exclude CATO data from the mandatory reporting framework at this time? First-time provider firms 3.43 To support new entrants to the proposed framework, we are introducing the concept of ‘first‑time provider firms’ which would become a new Handbook glossary term. Firms that begin sharing consumer credit information with any DCCRA, for the first time after the coming‑into‑force date of the framework, will benefit from a 6‑month lead‑in period during which the mandatory reporting requirement will not apply (see Chapter 6). This allows for a proportionate transition and gives firms time to explore the benefits of sharing consumer credit information, and to establish the necessary systems, processes and contractual arrangements before being required to share consumer credit information with all DCCRAs. Ending sharing of consumer credit information 3.44 Some firms subject to the mandatory reporting requirement may need or choose to stop sharing consumer credit information with DCCRAs. Our proposed rules would allow for this, though we expect such instances to be rare given firms’ commercial incentives to continue sharing consumer credit information with DCCRAs. 3.45 To align with the nature of the reporting requirement, we propose that firms stop sharing with all DCCRAs at the same time, as far as is reasonably practicable. We think this mitigates potential adverse impacts and consumer confusion. However, we recognise that operational arrangements may differ between firms and DCCRAs, and this may not always be feasible. 3.46 We propose that firms subject to the mandatory reporting requirement must notify us at least 2 months in advance of the earliest date on which they intend to stop sharing with any of the DCCRAs. The notification must include: • The date on which the firm intends to stop sharing consumer credit information with each DCCRA. • A description of the reportable agreements the notice relates to. • The measures the firm is taking to minimise any related adverse impacts on consumers, such as resolving data disputes or marking accounts as closed or settled. 3.47 This approach is intended to provide firms with the flexibility to end sharing either entirely or for some agreements, subject to appropriate obligations, notification and oversight. 3.48 To allow first-time provider firms time to assess the commercial merits of sharing consumer credit information with DCCRAs, as explained in paragraph 3.43 above, they will not be subject to the mandatory reporting requirement until 6 months after they first provide consumer credit information to any DCCRA. So, they will not be subject to the cessation provisions and notification requirements during this period.

23 Transfer of reportable agreements 3.49 Firms subject to mandatory reporting requirements may transfer agreements out of their business (whether by sale, insolvency, or other transaction) and stop sharing consumer credit information. In those circumstances, firms will not be required to serve us notice, as per the cessation provisions (see paragraph 3.46). They continue to be subject to the mandatory reporting requirement up until the point of transfer. We think that requiring firms to serve notices in these circumstances would likely be impractical and disproportionate. 3.50 We propose that firms transferring agreements out and ending information sharing must take all reasonable steps to minimise any related adverse impacts on consumers. This may include actions such as marking accounts as closed or settled or resolving any data disputes. 3.51 Our proposals do not require firms acquiring reportable agreements to start sharing consumer credit information with DCCRAs. However, where firms continue reporting consumer credit information on transferred agreements with DCCRAs, they must take all reasonable steps to minimise any adverse impacts on consumers caused by any interruption in the sharing of consumer credit information with DCCRAs during the transfer. Question 11: What are your views on our proposed approach to ending sharing of consumer credit information? Do you agree that rules are necessary in this area? Question 12: Where firms transfer agreements which are being reported to another firm (for sale, insolvency, or otherwise), do you agree that specific rules are necessary to set clear expectations or would it be sufficient if we were to only refer firms to their obligations under Principle 12 (Consumer Duty) to ensure that their approach supports good consumer outcomes? Ending sharing on individual agreements 3.52 There may be circumstances where a firm considers that continuing to share information on a particular agreement with DCCRAs would breach the principles for processing personal data set out in Article 5(1) of the UK General Data Protection Regulation. These include requiring personal data to be handled lawfully, fairly and transparently. The ICO has published guidance on the data protection principles. In such circumstances a firm would not be required to continue sharing the relevant information. 3.53 Firms must consider all information of which they are aware including information provided by consumers about their personal circumstances or other information relevant to the processing of personal data. While such information may not justify ending sharing, there may be exceptional cases where firms decide this is necessary to comply with data protection principles.

24 3.54 Where a firm decides it must stop sharing information on a particular agreement to avoid breaching the data protection principles, it is free to later resume sharing if it is satisfied that doing so would no longer breach those obligations. We do not propose to set out indicative circumstances in which firms might breach data protection principles, as this will depend on the specific facts and information available in each case. 3.55 Where firms end sharing on individual reportable agreements on this basis, we do not propose requiring them to notify us. The proposals outlined in this section are intended to preserve firms’ ability to respond appropriately to individual cases without triggering formal notification requirements. 3.56 We do not consider our proposed framework would prevent firms from amending or deleting previously shared consumer credit information or flagging that consumer credit information should be suppressed on a temporary or permanent basis where appropriate. Question 13: Is it helpful to include these provisions on the interaction of the proposed framework with data protection legislation? Firm requirements 3.57 We are also proposing a broader framework of rules to support high-quality credit reporting. As stated in the CIMS Final Report, we think it is important to set clear requirements as to the quality of information shared, which adds to existing processes for dealing with data disputes and correcting errors. 3.58 We previously highlighted a need to switch the burden of notifying the relevant court or Registry Trust Ltd (RT) of a ‘satisfied’ (fully paid) CCJ/decree, away from the consumer and onto firms who own the debt. These issues were included in the CIMS Final Report as part of Remedy 2D. 3.59 Some aspects of our proposals apply to the same firms as the mandatory reporting requirement (accuracy of data and error correction). Other elements have a broader scope (data disputes and CCJs/decrees). 3.60 The CIMS Final Report highlighted 3 areas where it was considered necessary to introduce specific Handbook rules: • Quality of data provided by FSMA regulated data contributors (caught by the mandatory reporting requirement) to designated CRAs, with a focus on data diligence standards and security. This included: – Testing the accuracy of data before submission. – Implementing processes to address repeat errors uncovered by these tests. – Regular reviews of the efficacy of sharing processes in light of root cause analysis where errors are identified by CRAs or consumers.

25 • Process for error investigation and correction. This included: – Requiring FSMA regulated data contributors to take reasonable steps to investigate and respond to disputes raised by CRAs (following a notice under s159 CCA) in a timely manner (14 days). – Where an error is found, data contributors caught by the mandatory reporting requirement to correct information shared with DCCRAs. – Where an error is found, information should be corrected on a real-time basis wherever possible (rather than via regular monthly batch sharing). • Reporting satisfied CCJs/decrees, to the Courts/RT. This included: – Requiring all FSMA-regulated firms to report to the courts/RT when a CCJ/decree has been satisfied. Such a requirement would not override existing processes that enable either the respondent or claimant to contact the relevant court/ RT with proof of payment, but this would place an obligation on firms to report where relevant. Recent evidence 3.61 Our Financial Lives 2024 survey shows that just over one-third (35%) of adults who raised a query or dispute with a CRA received a response within 1 month, 22% said it took more than 1 month but less than 3 months and 27% said it took more than 3 months to receive a response. 3.62 Our survey of firms in October 2024 also highlighted mixed practices in how errors and disputes were dealt with. In a portfolio letter, published on the 10 January 2025, we highlighted our concerns that the process of raising a data dispute or complaint can be difficult for consumers to navigate. Consumer Duty 3.63 The Consumer Duty provides an important basis for consumer protection and goes some way to achieving our desired outcomes. However, we believe new rules and guidance are needed to make clear our expectations and reduce the risk of ambiguity and inconsistency between the approaches firms take. 3.64 On error correction and disputes, some outcomes rely on the timing of information exchanges between CRAs and firms, rather than on any action of the consumer (eg when a consumer raises a dispute/error on a credit file and the CRA needs information from the lender to deal with the dispute). To ensure a standard approach for firms to respond to CRAs, we propose to impose a deadline of 14 days for firms to respond to CRAs. 3.65 The proposals set out below will support industry-led remedy 3C on providing a streamlined disputes process. We understand that industry has been considering how best to deliver this remedy and we will engage with them on this as their work develops.

26 Firm requirements linked to the mandatory reporting framework Information accuracy, governance and error correction under the mandatory reporting framework 3.66 These proposed requirements apply to firms who are, or will be, subject to the mandatory reporting requirement and any consumer credit information that is shared. They apply as soon as firms begin sharing consumer credit information with 1 DCCRA. In developing these proposals, we have looked to build on existing practice. Many firms may already have processes in place which would meet the proposed requirements. There are existing provisions in parts of the Handbook, such as Senior Management Arrangements, Systems and Controls (SYSC) and Dispute Resolution (DISP), which set high-level standards for firms on managing systems and processes and treating complainants fairly. However, specific requirements for this framework support a level playing-field for firms and transparency for consumers. 3.67 We are proposing that firms should have systems and processes in place to ensure the information they share with DCCRAs is as accurate as possible and that it is tested for accuracy prior to submission. This generally reflects what happens now and we acknowledge that most firms already do this as a part of their submission process. However, each firm’s processes will differ so we are not proposing to introduce specific rules on how this should be done, but firms must take all reasonable steps to ensure that the information shared is accurate. We also propose that firms should monitor systems and processes for sharing information, to identify systemic errors or issues which affect the accuracy of shared information. 3.68 Where inaccuracies are identified (through any method) in consumer credit information already shared with DCCRAs, we want firms to take prompt action to correct any error across all DCCRAs. They should also correct errors across all other CRAs with whom they have shared the information and identify and correct any systemic cause of errors. We think this is important given the impact incorrect information can have on access to credit and the challenges consumers may face in correcting information with potentially multiple CRAs. 3.69 Prompt action means correcting errors before, or as part of, the next regular sharing event. The next regular sharing event would act as a backstop, but we would like to see corrections made to a quicker timescale. Ultimately, we think there should be an aim to move to real time correction of errors in most cases, delivered through industry￾led remedies. 3.70 We also propose that where firms are aware that any delay to correction is likely to have a material adverse impact on a consumer’s financial situation, the information should be corrected as soon as reasonably practicable. An example of this might be where a consumer identifies an error when making a mortgage application, and that error is preventing them from progressing that application (where time is of the essence). Question 14: Do you agree that the Consumer Duty alone is not sufficient to make sure information shared under the framework is of high quality and additional requirements

27 are necessary to deliver consistent outcomes for consumers and effective enforcement where firms do not meet our requirements? Question 15: Do you have any views on: (i) errors being corrected across all CRAs to which information was shared? (ii) the timeliness for correcting errors, with the backstop being the next sharing event, unless any delay will have a material adverse impact on the consumer? Firm requirements – wider application 3.71 The proposed amendments to CONC 6 and 7 and MCOB 13, and creation of MCOB 16.6, would apply to all relevant firms - some of whom may not necessarily be subject to the mandatory reporting requirement. Correction of wrong information under s159 Consumer Credit Act 1974 (CCA) 3.72 Section 159 CCA provides a statutory mechanism for consumers to challenge and correct inaccurate information held by CRAs. We propose to build on this mechanism. 3.73 Under s159, if an individual considers an entry on their credit file is incorrect and could cause prejudice, they can give notice to the CRA requiring it to either remove or amend the entry. The CRA then has 28 days to inform the individual whether it has either removed the entry, amended the entry (and provide a copy of the amended file), or taken no action. If the individual has not received a reply from the CRA within a 28-day period (except where they have been informed by the CRA that it has removed the entry), they can require the CRA to add a notice of correction to the file. Section 159 also contains provision for either party to apply to the Information Commissioner, or us (as appropriate), for adjudication. 3.74 CRAs are sometimes unable to respond within the 28-day deadline because they haven’t received a timely response from lenders. Section 159 is concerned with the relationship between the CRA and the individual, rather than the lender, so there is no requirement on the lender to respond to the CRA immediately (although we recognise that delays may be caused in other parts of the process as well). There is a need to set clear expectations on lenders to investigate these disputes to make sure this mechanism operates effectively within an appropriate timescale. 3.75 The right for an individual to raise a dispute under s159 applies to any information held by a CRA and would not be directly linked to information that may be shared with DCCRAs under the mandatory reporting requirement. Our proposed requirements would apply to all firms where the information relates to an individual and is shared with any CRAs (designated or not). The reference to an individual, rather than consumer, is also intended to cover information where it relates to some small business lending (small partnership or certain types of unincorporated body).

28 3.76 The proposed requirement would apply when firms are informed by a CRA that it has received a dispute under s159. Under s159 the CRA then has 28 days in which to reply to the consumer. The new framework would require firms to: • Take all reasonable steps to investigate the dispute. • Respond to the CRA within 14 days setting out the results of its investigation. • Take prompt action to correct information across all CRAs with whom inaccurate information was shared and identify and correct any systemic causes. 3.77 The results of firms’ investigations must include sufficient information for the CRA to determine whether to either remove the information in question from the relevant file, amend the information, or take no action. 3.78 Our proposals contain a provision for a holding response to be sent, in exceptional circumstances, where a full response cannot be given within 14 days for reasons beyond the control of firms. This must state the reason for the delay and provide a new timescale for a full reply. Where a holding response is sent, our proposed rules would require firms to complete the investigation and respond without undue delay. Question 16: Do you have any comments on our proposal to require all FSMA mortgage and credit firms (not just those subject to the mandatory reporting framework) to respond to a s159 CCA notice from a CRA, within a 14-day deadline (unless exceptional circumstances)? Reporting satisfied CCJs and decrees 3.79 CCJs (in England, Wales and Northern Ireland) and decrees (in Scotland) represent important public information that can play a significant role in how consumers are viewed by lenders, CRAs and other organisations. CRAs obtain information on CCJs and decrees from RT, a not-for-profit organisation that receives information from the courts (for CCJs) and directly from claimants for decrees. CCJs and decrees stay on a credit file for 6 years. A fully paid CCJ or decree can be marked as ‘satisfied’ (paid in full) on the register (which feeds through to the consumer’s credit file), if proof of full payment is provided to the courts (in the case of CCJs) or RT (in the case of decrees). Lenders are not currently obliged to report that the debt it has been satisfied, it is the responsibility of the debtor who is often unaware of the need to do so.. 3.80 Consumer Duty non-Handbook guidance (para 9.10), published in July 2022, provides an example of good practice for firms as ‘consistently record customers CCJs as satisfied’. Latest statistics published by RT show that the proportion of CCJs/decrees marked as satisfied is around 12%. There is however a general view that a material proportion of CCJs/decrees may be satisfied but not marked as such. Given this, we believe the onus should be on firms to report satisfied debts. 3.81 We propose to introduce a requirement for firms to report satisfied CCJs/decrees to the courts/RT. Our proposal aims to make sure information held by both the RT and CRAs is accurate and up-to-date, to improve both access to credit and the integrity of

29 the wider market. It would not override existing processes that enable either the debtor or claimant to contact the relevant court/RT with proof of payment. 3.82 This proposal is not linked to the mandatory reporting framework. It would apply to all firms undertaking the following regulated activity in relation to a debt for which a CCJ or decree has been obtained (regardless of whether they are caught by the mandatory reporting requirement): • Consumer credit lending. • Administering a home finance transaction. • Debt collecting, in relation to regulated credit agreements. • Debt administration, in relation to regulated credit agreements. • Operating an electronic system for lending in relation to a borrower under a P2P agreement. • Facilitating a home finance transaction as a P2P platform operator. 3.83 When firms become aware that a CCJ or decree has been satisfied, they must notify the relevant court/RT, providing the relevant information, as soon as reasonably practicable. The reference to reporting to a ‘court’ includes county courts and the High Court, as well as the sheriff court and the Court of Session. 3.84 We are aware of scenarios where a natural person may take out a mortgage or credit agreement in their own name, but which is used wholly or partly for business purposes (such as sole traders or unincorporated partnerships). These provisions therefore extend to some business lending where it is in scope of the above regulated activities. The definition of ‘home finance transaction’ includes lending to natural persons for some business purposes. We do not propose to narrow the application of the CCJ/ decree provisions here either. 3.85 The proposed rules would not apply to unregulated agreements (i.e. exempt agreements) for the regulated activities of debt collecting and administration. Question 17: Do you support our proposal to introduce a requirement for firms (as listed above) to report CCJs and decrees as satisfied when they become aware they have been paid in full? If not, do you favour retaining the current approach and relying on the Consumer Duty example of good practice? Question 18: We have excluded ‘home finance providing activity’ from the scope of these provisions. This is because we are not aware of a scenario where such activity would apply to a debt for which a CCJ/decree has been obtained. If you disagree, please explain why?

30 Chapter 4 Proposed rules on the designation of credit reference agencies 4.1 The proposed mandatory reporting framework depends on the creation of a mechanism for us to designate certain CRAs. 4.2 We considered a range of possible alternative models. These included more fundamental changes to the way credit information is shared that could avoid the need to designate certain CRAs. As set out in the Final Report, we do not think alternative models such as a single repository for credit information or requiring CRAs to share credit information directly with each other are feasible or justified in the light of the evidence gathered during the market study. 4.3 Other options we considered include relying solely on industry to deliver improvements in the market. For example, by encouraging market participants to introduce firmer expectations around sharing credit information with certain CRAs. However, we do not consider there are sufficient commercial incentives to achieve material changes in this area. We also note that current industry guidance which recommends sharing credit information with the 3 large CRAs is not consistently adhered to. 4.4 So, we propose an approach which broadly aligns with current market structure and practice. This is to make sure it is proportionate and compatible with our statutory objectives. We recognise that some stakeholders may disagree with this approach. But on balance we consider it appropriate given the significant potential benefits, including for competition. If implemented, we would closely monitor how designating CRAs affects competition between CRAs as well as the broader competition impacts. If necessary, we will make changes to both the CRA designation framework and the list of designated CRAs. The CBA in Annex 2 provides more detail on how we have taken into account the effect of our proposals on competition in the market. 4.5 We have also reflected on whether we need to be the decision-maker in terms of designating CRAs and considered whether the CIGB could have a formal decision￾making role in designating CRAs. However, including the the designation of CRAs within the mandatory reporting framework ensures that there is clear regulatory accountability for those decisions that may have significant market-wide implications. In addition, while a more industry-led approach could offer benefits in terms of stakeholder engagement and sector expertise, it may also introduce risks around conflicts of interest or reduced public confidence in the impartiality of the process. We think we are better placed to balance these considerations and to adapt the framework as the market evolves. 4.6 Under our proposals, we would use our FSMA rule-making powers to ‘designate’ the CRAs with whom certain firms would be required to share consumer credit information. The term ‘DCCRA’ would become a glossary term in our Handbook and would be distinct from a similar glossary term ‘designated credit reference agency’ which already exists

31 in the FCA Handbook for the purposes of the CCDS scheme. The DCCRA definition is therefore only relevant to our proposed mandatory reporting framework for consumer credit information. 4.7 The CRA designation framework, and the identity of the CRAs that we propose to designate, would be set out in a new ‘DCCRA Sourcebook’ in the FCA Handbook. Any changes to either the framework or the list of designated CRAs would be effected by the FCA Board amending the relevant Handbook rules and guidance. 4.8 We also propose various connected obligations for DCCRAs in the new DCCRA Sourcebook including restrictions on how they may refer to designation status and provisions relating to the receipt and use of consumer credit information shared under the proposed requirements. Further details on our approach to the permissible use of consumer credit information for both DCCRAs and firms providing consumer credit information are in Chapter 5. 4.9 This consultation covers our proposed, non-exhaustive, designation factors and the identity of the CRAs we propose to designate in order to provide stakeholders with maximum transparency on the nature and implications of the CRA designation framework. Question 19: Do you agree with our proposed approach to name the DCCRAs in a new sourcebook in our Handbook? Designation factors 4.10 To enhance transparency and provide context for our decisions on designating and de￾designating CRAs we propose to set out non-exhaustive factors we would consider when determining which CRAs to designate. They are: • Relevant Part 4A permission: a firm must be a CRA that has Part 4A permission to provide credit references, as set out in Article 89B of the Regulated Activities Order. • Coverage of the CRA: We will consider the extent of the CRA’s coverage of consumer credit information received from firms carrying out activities that are in scope of the mandatory reporting requirement. • Impact on consumer outcomes: the extent to which the services and consumer credit information provided by the CRA could or would facilitate good consumer outcomes. • Proportionality of designating or de-designating CRAs: proportionality, particularly in relation to the requirements on firms in scope of the mandatory reporting requirement, and the implications of data processing. 4.11 These factors reflect our aims of improving consumer outcomes through enhanced coverage of consumer credit information while also being mindful of proportionality and burden on firms.

32 Question 20: Do you have any views on the proposed non-exhaustive factors listed above that we will consider when deciding whether to designate or de-designate CRAs? Please explain your response. CRAs we propose to designate 4.12 There are around 22 firms with the relevant Article 89B permission to operate as a CRA. But most of them operate in niche markets and generally do not collect credit information directly from lenders or other data contributors at scale. Some of these firms obtain credit information indirectly, sourcing it from larger CRAs or relying on alternative data sources. 4.13 Consulting on the identity of DCCRAs at this stage enables us to assess how the mandatory reporting framework, together with our proposed approach to designating CRAs, may affect competition in the credit information market. 4.14 Having considered our proposed designation factors and statutory objectives, we propose to designate Equifax Ltd, Experian Ltd, and TransUnion International UK Ltd. Collectively, they account for the vast majority of consumer credit information shared in the UK. They are the primary sources of credit information and related products used in retail lending markets for most lenders. 4.15 We recognise that designating a small number of CRAs has the potential to affect market structure and competition. Our assessment at this stage is that our proposed approach would stimulate competition between DCCRAs on factors other than coverage of agreements in scope of the mandatory reporting requirement. We do not believe it would materially increase barriers to entry or expansion in the CRA market. We found during CIMS that overall competition in the provision of credit information to firms was working well but improvements could be made. 4.16 If implemented, we will monitor the competitive landscape and the impact of the framework on both DCCRAs and non-designated CRAs over time. If evidence emerges that the framework is having significant adverse effects on competition, we would remain open to making adjustments to make sure it appropriately balances any trade￾offs between our statutory objectives. Question 21: Do you agree with the proposal to designate Equifax Ltd, Experian Ltd and TransUnion International UK Ltd? If not, please provide reasons. Question 22: Are there any other CRAs you think we should designate? If so, confirm which ones and provide reasons. Referring to designation 4.17 Responses received to our information requests indicate that, although designation may have some impact on stakeholder perceptions, it is not expected to generate a

33 significant ‘halo effect’ that would materially influence firm behaviour. Respondents to our information requests emphasised that procurement decisions will remain primarily influenced by considerations such as product quality, data coverage, pricing, and the effectiveness of technical integration. 4.18 However, to mitigate any further risk around designation status being used to proactively influence firm behaviour, the proposed rules specify that DCCRAs (and any person acting on their behalf) must not use the designation status as a basis for marketing or promoting the DCCRA or its services. This safeguard, while similar but not analogous to the prohibition in the Critical Third Parties regime, is intended to help maintain a competitive environment in which procurement decisions are based on considerations such as quality and value of services provided, rather than perceived regulatory endorsement. Question 23: Do you agree that the proposal to prohibit DCCRAs from presenting their designation status as the basis for marketing or promoting the DCCRA or its services is sufficient to mitigate the emergence of a ‘halo effect’ in the market? If not, please explain why. Receiving consumer credit information 4.19 Firms in scope of the mandatory reporting requirement will be required to share consumer credit information with DCCRAs. So, we would not typically expect DCCRAs to reject that information or place unreasonable restrictions on how it may be submitted. However, there are circumstances where it may be inappropriate for DCCRAs to accept consumer credit information. For example, because of concerns that the information is inaccurate or incomplete. 4.20 We understand there are often complex issues to consider when assessing information quality. This may require engagement between CRAs and data contributors before credit information is accepted. We do not intend to restrict this engagement, or the ability of CRAs to reject credit information because of concerns about quality, as these processes will benefit consumers and the market. In these cases, we would expect DCCRAs and firms to work together to resolve any quality issues so the information can be accepted. 4.21 In addition, there may be further scenarios where DCCRAs consider it appropriate to reject consumer credit information. This could include where the DCCRA suspects that the information provided is fraudulent, or where they reasonably consider it is misleading or would have a negative impact on broader consumer outcomes. For example, where the underlying product structure to which the information relates is not suitable for acceptance because it cannot be accurately and appropriately recorded within existing technical infrastructure; or it would otherwise pose risks to the integrity of the credit information market. 4.22 We anticipate that rejecting consumer credit information on these grounds would be rare but may potentially raise broader issues around the operation of the framework or conduct of firms.

34 4.23 So, we propose that if a DCCRA prevents a firm from providing consumer credit information on grounds other than accuracy and completeness it should notify us of its reasons for doing so. Question 24: Have we sufficiently captured scenarios where it may be necessary and appropriate for DCCRAs to reject consumer credit information? If not, please explain why. Question 25: Do you have any views on the requirement for DCCRAs to notify us on the grounds described above? We believe this is necessary to ensure transparency and accountability, given the potential implications of rejecting consumer credit information. Levying charges 4.24 In the CIMS Final Report, we indicated that we did not expect DCCRAs to levy direct charges for the receipt of consumer credit information provided under the mandatory reporting requirement. We consider that receiving the additional consumer credit information provided under these requirements will directly benefit DCCRAs by enhancing the quality and breadth of their credit information coverage. 4.25 We do not consider it necessary to introduce requirements prohibiting DCCRAs from levying charges on firms in relation to the receipt of consumer credit information at this time. But we will keep this under review. Should evidence emerge of DCCRAs imposing charges that could undermine the framework’s objectives or create undue barriers to effective credit information sharing, we may consider further regulatory intervention. 4.26 Our proposals are not intended to have any effect on commercial arrangements for the provision of consumer credit information and related products from DCCRAs to firms subject to the mandatory reporting requirement, or on arrangements between DCCRAs and credit information users and contributors outside the scope of our mandatory reporting framework. Question 26: Do you agree with our proposal not to introduce requirements prohibiting DCCRAs from levying charges for the receipt of consumer credit information?

35 Chapter 5 Proposed rules on permitted use 5.1 Currently, complex interactions between data protection legislation, industry arrangements and commercial incentives create the framework for the permitted use of credit information. A mandatory reporting framework gives us an opportunity to codify how consumer credit information shared under the proposed requirements may be used by firms and DCCRAs in retail lending markets. This will help enhance transparency for consumers and ensure a level playing field for both firms and DCCRAs. 5.2 In the CIMS Final Report, we noted it may be necessary to set out the broad purpose for which consumer credit information is being shared under a mandatory reporting requirement. We have considered these issues further including potential interactions with data protection legislation and industry governance arrangements. 5.3 We consider it appropriate to include a high-level requirement on permitted use within the mandatory reporting framework. This is to provide sufficient transparency to consumers and regulatory certainty to market participants. So, we are consulting on provisions which would apply to firms and DCCRAs within the new framework. 5.4 These provisions would not apply to credit information shared with, or provided by, DCCRAs outside the scope of the mandatory reporting framework, including consumers and other credit information users. However, data protection legislation and industry arrangements will remain relevant to the provision and use of that information. 5.5 We recognise that we need a balanced approach. Broadly, we consider the purposes for which credit information is currently used by firms and CRAs across retail lending markets are appropriate and necessary to deliver good outcomes for consumers. We are not seeking to materially change these purposes but aim to provide enhanced transparency and regulatory certainty to consumers and market participants. To reflect this, the proposed high-level requirement aims to reflect the high-level principles already contained in industry guidance and sets out the activities we think relate to the general purpose of promoting responsible lending. 5.6 Consumer credit information may be used in a variety of forms, at various stages of the consumer journey. It may also be used for purposes which may be ancillary to specific lending decisions. So, our provisions are broad. This reflects the range of potential use cases relevant to the general purpose of promoting responsible lending. 5.7 Firms and DCCRAs subject to the mandatory reporting framework would only be permitted to use consumer credit information shared between them for activities related to this general purpose. We have set out a non-exhaustive list of what is included within the meaning of ‘promoting responsible lending’ for both DCCRAs and firms carrying out regulated credit activity or in-scope home finance activity. This reflects the different business models and existing regulatory requirements across these sectors.

36 5.8 Our proposal on permitted use is intended to complement related industry arrangements and provide an appropriate degree of certainty while not being unduly restrictive or preventing innovation. 5.9 Additionally, there may be interactions between the proposed requirement and Remedy 4B of the CIMS Final Report (reviewing the PoR). The PoR set out more detailed guidance on permissible use cases which is relevant to firms who would be in scope of our proposed requirement and to other credit information users and contributors. The PoR also sets out the terms of access to consumer credit information and embeds the general principle of reciprocity. Our proposal is not intended to affect these terms of access and is focused solely on the permitted use of consumer credit information when shared between firms subject to the mandatory reporting framework. 5.10 As set out in the CIMS Final Report, we consider that relevant industry and other stakeholders are best placed to review the PoR in light of this further clarity around the proposed nature and scope of the mandatory reporting framework. We are open to working closely with the CIGB and other stakeholders as this work is progressed. Question 27: Do you agree with the proposed approach of setting a high-level requirement on the permitted use of consumer credit information shared under the mandatory reporting framework, while leaving scope for more specific use case scenarios to be addressed by industry arrangements? Question 28: Are the proposed range of activities relating to the general purpose of promoting responsible lending sufficient and appropriate to provide clarity to market participants and transparency to consumers about how consumer credit information may be used in this context? Question 29: Will it be sufficiently clear to recipients of consumer credit information (including DCCRAs or firms subject to the mandatory reporting requirement) whether the consumer credit information received has been shared under the mandatory reporting requirement, and is therefore subject to provisions on permitted use? Question 30: Are there any other implications, for example in relation to contractual arrangements or adherence to data protection legislation, that may arise in relation to these proposals?

37 Chapter 6 Implementation period 6.1 We propose that the new regime is commenced, including provisions on the designation of CRAs, 12 months after our Policy Statement is published (the coming into force date). We believe this will give firms who are subject to the mandatory reporting requirement, and the connected obligations, sufficient time to adapt systems and processes to share consumer credit information with all DCCRAs and comply with the other requirements. It will also allow DCCRAs time to prepare for receiving and processing additional information. 6.2 Firms sharing consumer credit information in relation to a reportable agreement with any DCCRA, before the coming into force date, will need to make sure they have arrangements to provide that information to all DCCRAs after the coming into force date. 6.3 Firms that first start sharing consumer credit information with any DCCRAs after the coming into force date (first-time provider firms) will be given 6 months to make arrangements to share that information with all DCCRAs. 6.4 This means firms which first begin sharing with a DCCRA closer to the coming into force date, will not benefit from the full 6-month period that applies to first-time provider firms. However, we expect this will affect only a small number of firms. Information we have received from firms suggests that few firms, who do not currently share with any DCCRAs, will begin doing so during the implementation period. So, we consider this approach to be proportionate and will not lead to unfairness as firms will have been given a significant notice period before the proposed rules come into force. 6.5 The additional 6-month period for first-time provider firms is to incentivise these firms to share consumer credit information. This window would allow those firms time to explore the benefits of sharing consumer credit information and to put in place the necessary contractual relationships with all DCCRAs if they wish to continue sharing. 6.6 It may be that first-time provider firms decide they wish to commence sharing with all DCCRAs simultaneously. We encourage this and the proposed framework would not prevent them from doing so. 6.7 The proposed rules set out information accuracy and governance requirements as well as requirements on the permitted use of consumer credit information (which applies to both DCCRAs and firms). These provisions also come into force 12 months after the date on which our Policy Statement is published. This is the case regardless of how many DCCRAs firms are sharing consumer credit information with, so these proposed provisions would apply to first-time provider firms from the date on which they commence sharing. This requirement will help to make sure that consumer credit information is of high quality, whenever it is shared.

38 6.8 The provisions relating to notices under s159 of the CCA and reporting CCJs/decrees will also come into force for all firms to which they apply, 12 months after the date on which our Policy Statement is published. Question 31: Do you agree that firms who are sharing consumer credit information with at least one DCCRA on the coming into force date should be subject to the mandatory reporting requirement at that time? Question 32: Do you agree that firms who begin sharing consumer credit information with at least one DCCRA after the coming into force date should be given a 6-month lead-in time before being subject to the mandatory reporting requirement? We would be interested to hear your reasons for supporting the 6-month lead in time, and if you disagree with the 6-month period, how long this should be and why? Question 33: Do you have any concerns or foresee any practical issues with the proposals set out above?

39 Chapter 7 Other FCA remedies – current position and next steps 7.1 The CIMS Final Report set out 2 further FCA remedies. These were:  • Remedy 2C – DCCRA regulatory reporting to the FCA. • Remedy 3A – CRA/Credit Information Service Provider (CISP) signposting to SCR. 7.2 We do not propose to consult on these remedies at this time and set out below the reasons for this. DCCRA reporting to the FCA (Remedy 2C)  7.3 In the CIMS Final Report, we outlined potential Handbook rules requiring DCCRAs to report to the FCA every 12 months. This would help to provide insight on the operation and impact of the mandatory reporting framework, aid monitoring of our approach to CRA designation and provide insight into potential supervisory issues. 7.4 To ensure any future rules are necessary, targeted and proportionate, we now propose to first gather relevant information from DCCRAs through a section 165 FSMA request, issued around one year after the mandatory reporting requirements take effect. This will allow us to work with stakeholders, including DCCRAs, to refine any future reporting framework and ensure it is proportionate and minimises burdens. This approach also supports our 2025–2030 strategy commitment to collect only data we need and will use. 7.5 Any future requirements would be subject to consultation as a part of our usual FSMA rule‑making process. Question 34: Do you agree with our proposed approach of sending a section 165 request to DCCRAs approximately 12 months after the mandatory reporting requirement comes into force? Signposting to statutory credit reports (Remedy 3A)  7.6 In the CIMS Final Report, we proposed Remedy 3A, which provided that CRAs and CISPs should prominently signpost consumers to their free SCRs. 7.7 Most stakeholders supported Remedy 3A. We recognise that CRAs and CISPs can add value through subscription‑based services but improving awareness of SCRs may strengthen incentives for them to innovate, delivering further benefits for consumers.

40 7.8 Currently, we do not propose to consult on making Handbook rules under Remedy 3A.  Relevant firms should already be considering how best to signpost consumers to SCRs under the consumer understanding and support outcomes of the Consumer Duty as set out in our portfolio letter to CRAs/CISPs on 10 January 2025.  7.9 Clear signposting will help consumers compare SCRs with subscription‑based services and choose how they access their credit information. We will continue to monitor how firms respond to our expectations, and if the Consumer Duty does not deliver the desired outcomes, we will consider consulting on specific Handbook rules to implement this remedy. Question 35: Do you agree with our proposed approach of setting expectations for industry via the Consumer Duty rather than using Handbook rules to introduce a signposting requirement at this time? 

41 Annex 1 Questions in this paper Question 1: Do you agree with our overall approach of proposing new Handbook rules to achieve more consistent market-wide outcomes in this area? Question 2: What are your views on our proposal that where firms in scope of the requirements share any consumer credit information on reportable agreements with at least one DCCRA, they should share all available information on those agreements with all DCCRAs, and do you agree with the rationale for the proposed approach? If not, please explain why. Question 3: Do you agree that the approach outlined above is a proportionate way of capturing the majority of regulated agreements and do you agree with our reasons for not proposing an absolute requirement? Please provide reasons for your answer. Question 4: Do you have any views on the proposed scope of regulated activities set out above? Are there any other types of regulated activities that should be in scope? Question 5: Do you have any views on the types of agreements that are to be in and out of scope of the proposed mandatory reporting requirement? Question 6: Do you consider the types of consumer credit information we have proposed strike the right balance between regulatory certainty and flexibility for evolving market practice, including ongoing industry work on the common data format? If not, please explain your reasoning and suggest any changes you think would be appropriate. Question 7: Do you agree that firms should be required to share both ‘positive’ and ‘negative’ data where available? Question 8: Are there any other type of information that should be included under ‘type of consumer credit information’ in the table above? If so, confirm which ones and explain why. Question 9: Do you agree that firms in scope of the mandatory reporting requirement should be required to share consumer credit information with DCCRAs at least once per month?

42 Question 10: Do you have views on our proposal to exclude CATO data from the mandatory reporting framework at this time? Question 11: What are your views on our proposed approach to ending sharing of consumer credit information? Do you agree that rules are necessary in this area? Question 12: Where firms transfer agreements which are being reported to another firm (for sale, insolvency, or otherwise), do you agree that specific rules are necessary to set clear expectations or would it be sufficient if we were to only refer firms to their obligations under Principle 12 (Consumer Duty) to ensure that their approach supports good consumer outcomes? Question 13: Is it helpful to include these provisions on the interaction of the proposed framework with data protection legislation? Question 14: Do you agree that the Consumer Duty alone is not sufficient to make sure information shared under the framework is of high quality and additional requirements are necessary to deliver consistent outcomes for consumers and effective enforcement where firms do not meet our requirements? Question 15: Do you have any views on: (i) errors being corrected across all CRAs to which information was shared? (ii) the timeliness for correcting errors, with the backstop being the next sharing event, unless any delay will have a material adverse impact on the consumer? Question 16: Do you have any comments on our proposal to require all FSMA mortgage and credit firms (not just those subject to the mandatory reporting framework) to respond to a s159 CCA notice from a CRA, within a 14-day deadline (unless exceptional circumstances)? Question 17: Do you support our proposal to introduce a requirement for firms (as listed above) to report CCJs and decrees as satisfied when they become aware they have been paid in full? If not, do you favour retaining the current approach and relying on the Consumer Duty example of good practice? Question 18: We have excluded ‘home finance providing activity’ from the scope of these provisions. This is because we are not aware of a scenario where such activity would apply to a debt for which a CCJ/decree has been obtained. If you disagree, please explain why?

43 Question 19: Do you agree with our proposed approach to name the DCCRAs in a new sourcebook in our Handbook? Question 20: Do you have any views on the proposed non-exhaustive factors listed above that we will consider when deciding whether to designate or de-designate CRAs? Please explain your response. Question 21: Do you agree with the proposal to designate Equifax Ltd, Experian Ltd and TransUnion International UK Ltd? If not, please provide reasons. Question 22: Are there any other CRAs you think we should designate? If so, confirm which ones and provide reasons. Question 23: Do you agree that the proposal to prohibit DCCRAs from presenting their designation status as the basis for marketing or promoting the DCCRA or its services is sufficient to mitigate the emergence of a ‘halo effect’ in the market? If not, please explain why. Question 24: Have we sufficiently captured scenarios where it may be necessary and appropriate for DCCRAs to reject consumer credit information? If not, please explain why. Question 25: Do you have any views on the requirement for DCCRAs to notify us on the grounds described above? We believe this is necessary to ensure transparency and accountability, given the potential implications of rejecting consumer credit information. Question 26: Do you agree with our proposal not to introduce requirements prohibiting DCCRAs from levying charges for the receipt of consumer credit information? Question 27: Do you agree with the proposed approach of setting a high-level requirement on the permitted use of consumer credit information shared under the mandatory reporting framework, while leaving scope for more specific use case scenarios to be addressed by industry arrangements? Question 28: Are the proposed range of activities relating to the general purpose of promoting responsible lending sufficient and appropriate to provide clarity to market participants and transparency to consumers about how consumer credit information may be used in this context? Question 29: Will it be sufficiently clear to recipients of consumer credit information (including DCCRAs or firms subject to the mandatory reporting requirement) whether the consumer

44 credit information received has been shared under the mandatory reporting requirement, and is therefore subject to provisions on permitted use? Question 30: Are there any other implications, for example in relation to contractual arrangements or adherence to data protection legislation, that may arise in relation to these proposals? Question 31: Do you agree that firms who are sharing consumer credit information with at least one DCCRA on the coming into force date should be subject to the mandatory reporting requirement at that time? Question 32: Do you agree that firms who begin sharing consumer credit information with at least one DCCRA after the coming into force date should be given a 6-month lead￾in time before being subject to the mandatory reporting requirement? We would be interested to hear your reasons for supporting the 6-month lead in time, and if you disagree with the 6-month period, how long this should be and why? Question 33: Do you have any concerns or foresee any practical issues with the proposals set out above? Question 34: Do you agree with our proposed approach of sending a section 165 request to DCCRAs approximately 12 months after the mandatory reporting requirement comes into force? Question 35: Do you agree with our proposed approach of setting expectations for industry via the Consumer Duty rather than using Handbook rules to introduce a signposting requirement at this time? Question 36: Do you have any comments on our cost benefit analysis? Question 37: Do you agree with the assumptions made in our cost benefit analysis? Question 38: Are there any significant costs or benefits that we did not adequately consider in our cost benefit analysis?

45 Annex 2 Cost benefit analysis Executive summary

1. Credit information provides insight into a consumer’s financial standing. It is used by lenders to inform their lending decisions, as well as by other firms in the financial services sector and beyond in other risk-based decisions.
2. The credit information market is served by credit reference agencies (CRAs), who collect data from lenders and other data contributors and combine it with data from other sources, such as publicly available information including on County Court Judgments and Decrees. Under longstanding industry reciprocity principles, firms can generally only access credit information from a CRA if they also provide their credit information to that CRA. In the UK, 3 large CRAs – Equifax, Experian and TransUnion – account for almost all of the market for consumer creditworthiness products. Our Credit Information Market Study found that competition between CRAs is largely working well in the market but improvements could be made.
3. The 3 large CRAs’ coverage of regulated lending is high overall and credit information relating to the vast majority of regulated lending is shared with at least 1 of the 3 large CRAs. However, there are aspects of the market which mean it is not working as effectively as it could, meaning credit information does not inform retail lending and other risk-based decisions as well as it could. Namely: • A material proportion (around 17%, by number of outstanding agreements) of regulated lending is held by firms who share credit information with only 1 or 2 of the 3 large CRAs but not all of them. • Errors in credit information and failures to mark fully paid court judgments as satisfied mean that some consumers’ credit files do not accurately reflect their financial history. • Some consumers report long delays in getting issues with their credit file fixed.
4. The resulting harm is that lenders lend less overall than they otherwise would – especially to those about whom CRAs hold little or no information – and extend unaffordable credit where they might not have done with further information.
5. In response, we propose a mandatory reporting requirement, under which firms who share consumer credit information relating to reportable agreements with one or more ‘designated’ consumer credit reference agencies (DCCRAs) will be required to do so with all DCCRAs. We are proposing to designate Equifax, Experian and TransUnion, though our proposed designation framework allows for the designation of a further CRA(s) or the de-designation of a CRA(s) if appropriate and proportionate given market developments. We also propose requirements on data contributors that aim to improve

46 the quality of credit information. Some of these relate to information provided under the mandatory reporting requirement, while some have a wider application. Together, these proposals will improve the coverage, consistency and quality of credit information. 6. We expect our proposals to be pro-competitive and to broadly go with the grain of existing market practices. We do not expect our proposed designation of the 3 large CRAs to materially add to existing barriers to entry and expansion in the credit information market. Meanwhile, by making their coverage of in-scope agreements more consistent, we expect our proposals to encourage DCCRAs to compete more intensely on other factors including prices and the value-add of analytical products and to stimulate innovation such as through the integration of new datasets. We also expect that the proposals will make switching between DCCRAs (that is, a firm changing which DCCRA(s) it buys products and services from) easier, further stimulating competition between them. Lastly, we expect that our interventions will enhance competition in retail lending markets by reducing the informational advantages larger lenders often have over smaller ones. 7. We expect there to be one-off and ongoing costs associated with our proposals for DCCRAs and for data contributors. For DCCRAs, costs will primarily arise from onboarding additional data contributors and receiving and managing larger quantities of data. Data contributors not already compliant with our proposals would face costs associated with setting up the systems and processes needed to comply and the ongoing resource needed to maintain compliance. Our central estimate of the present value of these costs across all our proposals, assessed over a 10-year period and using a 3.5% discount rate, is £63.4m. 8. We expect our proposals to benefit both firms and consumers. We expect that firms will extend more credit in aggregate, in response to an improved ability to assess creditworthiness. We also expect that firms will extend less credit that is unaffordable because they will have more comprehensive information about consumers’ financial circumstances, avoiding losses from ‘bad’ loans for firms and improving wellbeing for affected consumers. It is not reasonably practicable to quantify these benefits because of the complexity of lending decisions and assumptions required about lender behaviour. However, the large size of retail lending markets means that even small relative impacts can translate to benefits that are large in absolute terms. We expect further benefits in terms of better-informed pricing of credit, greater choice and reduced confusion for consumers and, for firms, cost savings from efficiencies in assessing creditworthiness. 9. We expect our proposals to support the productivity and international competitiveness of the UK financial services sector by stimulating competition and innovation in both the credit information market and retail lending markets. We also expect modest positive growth impacts in the real economy as greater access to affordable credit should stimulate spending by consumers, though the size of these impacts is uncertain. 10. We propose to monitor the impact of our proposals through a range of metrics that will provide us with insights on compliance with our proposals, dynamics in the credit information and retail lending markets, and consumers’ access to affordable credit.

47 Introduction 11. The Financial Services and Markets Act (2000) requires us to publish a cost benefit analysis (CBA) of our proposed rules. Specifically, s138I requires us to publish a CBA of proposed rules, defined as ‘an analysis of the costs, together with an analysis of the benefits that will arise if the proposed rules are made’. 12. This analysis presents estimates of the significant impacts of our proposals. We provide monetary values for the impacts where we believe it is reasonably practicable to do so. For others, we provide a qualitative explanation of their impacts. Our proposals are based on weighing up all the impacts we expect and reaching a judgement about the appropriate level of regulatory intervention. Evidence 13. We have collected substantial amounts of evidence to inform this CBA. In particular, this CBA draws on (inter alia): • Analysis of portfolio-level data gathered from Equifax, Experian and TransUnion in October 2024; • Responses from 5 credit reference agencies (CRAs) and 74 lenders (including debt purchase firms) to questionnaires issued in October 2024 about the potential benefits and competition impacts of our proposals and alternative options; • Responses from 5 CRAs and 51 lenders (including debt purchase firms) to questionnaires issued in October 2024 about the potential costs of our proposals and alternative options; • Engagement with stakeholders; and, • The FCA’s Credit Information Market Study (CIMS) and evidence gathered during it. The market What is credit information? 14. Credit information provides insight into an individual’s financial standing. Information on a consumer’s credit history and repayment patterns is obtained from their lenders and other data contributors such as utilities companies and often supplemented with publicly available information such as information on County Court Judgments (CCJs) and Decrees. Structure of the credit information market 15. In this CBA, when we refer to ‘the credit information market’, we mean the market for the provision of credit information to firms.

48 16. This market is served by CRAs, who provide products and services derived from credit information to other firms. Long-standing arrangements in the market, known as the Principles of Reciprocity (PoR; discussed further below), mean that the clients of CRAs – who are often, but not exclusively, lenders – generally play a dual role as both users and contributors of credit information. Consumers do not participate as buyers or sellers in the credit information market. The Principles of Reciprocity 17. At present, the supply of and access to credit information are generally governed by the PoR. The PoR are industry guidelines and are embedded into the contracts that CRAs, including the 3 large CRAs Equifax, Experian and TransUnion, enter into with their clients. 18. Under the PoR, a firm can typically only access credit performance data from a CRA if it contributes the same level of data to that CRA. Firms are expected to share all such information that is available. So, for example, if a firm wishes to access full (i.e., both positive and negative) credit performance data on credit cards from a CRA, it must (unless covered by an exemption) share full credit performance data with that CRA on all of its credit cards, where available and where the appropriate privacy notifications have been provided. This prevents firms from free riding on the shared data by using it without contributing to it. Which firms use credit information? 19. The users of credit information include lenders (including debt purchase firms) in the consumer credit and mortgage markets and other firms, including firms outside the financial services sector such as utilities companies. 20. The consumer credit market contains a variety of lenders offering many different products, such as cash loans, credit cards, overdrafts, motor finance, finance for insurance premiums, and other products. Lenders in the mortgage market include banks, building societies and other, specialist lenders. 21. Lenders (including debt purchasers) in the consumer credit market hold around 210 million outstanding regulated agreements with outstanding balances of over £300 billion (see paragraph 49 for more information on what these figures cover). There are around 9 million outstanding regulated mortgages, whose outstanding balances total over £1.4 trillion. 22. The consumer credit and mortgages markets are characterised by a relatively small number of very large lenders and a ‘long tail’ of much smaller lenders. Of the roughly 2,000 lenders (including debt purchase firms) that have at least one outstanding regulated consumer credit agreement, nearly 1,600 of these firms have 1,000 or fewer outstanding agreements. Around 50 large lenders that have more than 1 million outstanding agreements account for more than 85% of all outstanding agreements. Meanwhile, the largest 6 mortgage lenders account for around 73% of mortgage transactions by volume. Larger lenders are generally more likely to purchase credit information from CRAs than smaller ones, though many smaller lenders do so.

49 How do firms use credit information? 23. Firms use credit information for a range of functions. Lenders use credit information to help them assess both credit risk and affordability – which together represent ‘creditworthiness’ – when they receive applications for credit. Lenders and other firms also use credit information for pre-qualification checks, anti-money laundering (AML) and know-your-customer (KYC) checks, account management, collections and tracing, and other functions. 24. In assessing creditworthiness, lenders – especially larger ones – tend not to rely just on CRA-generated scores. Rather, lenders tend to build their own proprietary models that draw on credit information and scores sourced from a CRA(s) as well as internally￾held and customer-supplied data, public data, and other data such as current account turnover (CATO) data. Credit performance data from CRAs is nonetheless a crucial input to these models. In our recent firm survey, many lenders described it as the most or second-most important type of data for their creditworthiness assessments. 25. The credit information market therefore influences consumers’ ability to access credit and the terms on which they can do so. Credit plays a vital role in consumers’ financial lives. In May 2024 nearly four-fifths of UK adults held at least one regulated credit agreement (not including any mortgages), or had done so in the previous 12 months. Most house purchases in the UK are financed by a mortgage. Who provides credit information to firms? 26. Equifax, Experian and TransUnion (‘the 3 large CRAs’) are currently the only firms that collect and aggregate credit performance data from lenders on a large scale. They are also the only CRAs who receive Current Account Turnover (CATO) data, which is an important input to several affordability products and services. 27. There are also around 20 smaller firms who hold CRA permissions (often alongside other permissions). A number of these are focused on business, rather than consumer, credit information. Amongst those that are focused on consumers, these smaller firms tend not to compete directly with the 3 large CRAs on traditional consumer creditworthiness products and account for a small share of that market. We are not aware of any smaller CRAs that collect credit performance data directly from lenders at a comparable scale to the 3 large CRAs. Current state of competition in the credit information market Business models 28. CRAs provide 4 main categories of products: • Products for the assessment of creditworthiness, • Identity verification and fraud solutions, • CIS for consumers, and • Other products and services e.g. consultancy services.

50 29. Products for the assessment of creditworthiness form the core business of the 3 large CRAs and generate the greatest proportion of their revenues. We focus on these products in the remainder of this section. 30. We are aware of a number of ways that smaller firms with CRA permissions seek to offer products for assessing creditworthiness. These include offering affordability tools based on open banking data, offering products focused on assessing the creditworthiness of particular groups of consumers (such as subprime borrowers), or ‘partnering’ with one or more of the 3 large CRAs to gain access to forms of the credit performance data they have collected. Market structure 31. The market for the provision of credit information to firms is highly concentrated. The CIMS Interim Report found that the 3 large CRAs accounted for almost all (by revenue) of the market for products for the assessment of creditworthiness, and responses to our recent firm surveys do not indicate that this has changed materially since then. Such concentration is consistent with what is observed in other countries with credit information markets served by private CRAs (as opposed to a public credit information repository), such as the United States, Australia and Germany. Barriers to entry and expansion 32. This high concentration is consistent with several barriers to entry and expansion in this market: • Structural features of the market encourage concentration. The market’s reciprocity arrangements (the PoR) give rise to ‘network effects’, where a CRA gains more comprehensive data on which to base its products and services as its client base grows. These network effects give an advantage to large incumbents. In addition, economies of scale tend to give larger CRAs cost advantages relative to smaller competitors; • Strategic considerations also favour incumbent CRAs. There is a first-mover advantage in the market since CRAs who have been in the market for longer will tend to have established relationships with their clients and to have built track records. These factors can make it more difficult for new CRAs to establish a ‘foothold’ in the market. Lenders and other clients of CRAs can also face high costs in switching between CRAs; and, • Regulatory and legal obligations around the sharing of data (such as those contained in the Data Protection Act 2018 and the UK General Data Protection Regulation) can be relevant to lenders and other data contributors sharing credit information more widely, as it is personal in nature. This can serve as a barrier to CRAs entering and expanding in the market. 33. There has, however, been an example in the past of a firm successfully entering the market and reaching the same scale as the established CRAs. Callcredit – now TransUnion following its acquisition in 2018 – was formed in 2000. After taking 7 years to turn a profit, it grew to become the second largest CRA in the UK, disrupting the

51 previous status quo in which Experian and Equifax had been the two large incumbents. Callcredit’s successful entry and expansion can be attributed to two factors. First, the firm was aided by several large lenders, including some banks, who agreed to share credit performance data with it. Second, it differentiated its product offering from those of Experian and Equifax and sought to develop a competitive advantage in specific areas – in particular, in its coverage of high-cost short term credit and in affordability solutions. In the case of the latter, it was advantaged by its exclusive access to CATO data between 2006 and 2012. We discuss Callcredit’s entry in our assessment of the competition impacts of our proposals, in paragraph 123 below. Competitive dynamics and key dimensions of competition 34. Our recent firm surveys and evidence gathered in CIMS suggest that the 3 large CRAs compete on a range of factors, especially: • Price – with CRAs setting prices with reference to rate cards, which set out their price lists; • Population coverage – the extent to which the CRA has credit performance data on the population of consumers and accounts that the lender is interested in; • Completeness and accuracy – by ‘completeness’, we mean the extent to which credit information on an individual gives the fullest possible picture of their financial obligations. By ‘accuracy’, we mean the extent to which data held on an individual is accurate and up to date. Both completeness and accuracy can depend on the coverage and quality of the data received by the CRA as well as how well the CRA can match data to the right individual; • Predictive power – lenders test the degree to which CRAs’ data and products can help them assess creditworthiness. This depends on the power of the models and analytics that the CRAs apply to their data as well as the coverage, completeness and accuracy of the data itself; and, • Ease of integration – the cost associated with integrating CRA data into a lender’s systems. 35. In CIMS, we found evidence of competition between the 3 large CRAs on price and quality, and of the CRAs investing in innovation to differentiate themselves. We concluded that competition between CRAs was largely working well but improvements could be made. Many respondents to our Interim Report agreed with this finding. We have not received evidence that has led us to change our assessment since then. Other recent trends and developments in the credit information market 36. Chapter 2 of the Consultation Paper above discusses other recent trends and developments in or relevant to the credit information market, such as the wider package of CIMS remedies, deferred payment credit (DPC) coming into our regulatory perimeter, and open banking and open finance.

52 Problem and rationale for intervention Overview 37. While the credit information market is working well across several dimensions, CIMS found that there are material differences in the information held on consumers by the 3 large CRAs. One important source of these differences is that data contributors do not all share credit information with all 3 large CRAs. We also found evidence during CIMS of some data quality issues in the information provided by firms to CRAs. 38. Inconsistent coverage of, and errors in, credit information hamper its ability to reduce information asymmetries in retail lending markets and other markets in which it is used. The persistence of such information asymmetries can lead both to reduced access to credit overall and to unaffordable lending, as well as harms outside lending markets. 39. This theory of harm is summarised in the figure below. Figure 1: Summary of harm Drivers of harm Externalities relating to the provision of credit information by firms to CRAs 40. There is a positive externality associated with a firm sharing credit information with a CRA. When a firm shares credit information with a CRA, it increases the amount of information available to other clients of that CRA. However, it (not those other firms) Data coverage at each CRA is inconsistent because some firms do not report to all 3 large CRAs Errors exist in information held by CRAs and are not always resolved promptly The information asymmetries in retail lending and other financial services markets persist Credit is misallocated and consumers receive unaffordable credit Access to credit is reduced overall Other functions, such as ID verification and KYC and AML checks, work less well Asymmetric information exists in retail lending and other financial services markets Externalities mean data contributors have insufficient incentives to share information with all 3 large CRAs amd to share high-quality information Drivers of harm Transmission of harm Harm

53 bears the cost of that information sharing. This means that in the absence of any rules or requirements, less credit information would be shared by firms with CRAs than is optimal. 41. The PoR mitigate this issue to an extent. Under the PoR, firms are only able to access and use credit information from a CRA if they contribute credit information at the same level to that CRA. Firms therefore benefit if they share credit information with a CRA (since it allows them to access other shared data) and are unable to ‘free ride’ on credit information shared by other firms by using it without contributing their own. 42. However, the PoR do not fully address this concern. The PoR do not require firms to share credit information with CRAs that they do not access credit information from. While some users of credit information – especially larger ones – use all 3 large CRAs, most do not. Because of the externality described above, there are insufficient incentives at present for firms who do not use all 3 large CRAs to share credit information with them all. 43. There is a similar externality associated with a firm sharing information that is high￾quality with a CRA(s). Other firms benefit when a firm ensures that the information it shares is high-quality and does not contain errors, but the effort and cost of data diligence sit with the contributing firm itself. This externality means that incentives for data contributors to ensure that the information they share with CRAs is high-quality can be insufficient. Asymmetric information in retail lending markets 44. Information asymmetry is a key feature of retail lending markets and many other financial services markets. In the absence of information gathering and sharing, lenders will have less information than (prospective) borrowers about those borrowers’ characteristics when they apply for credit and their behaviour after being extended credit. 45. Credit information reduces this information asymmetry. However, if the credit information market is not working optimally, information asymmetries will persist, resulting in the following drivers of harm: • Adverse selection – to the extent information asymmetries persist, lenders will be limited in their ability to discern riskier applicants from less risky applicants. Higher interest rates will tend to attract a riskier pool of applicants for credit, so without information sharing it can be unprofitable for lenders to raise their interest rates to the market-clearing level (Stiglitz and Weiss (1981)). The sharing of credit information allows lenders to better ‘screen out’ riskier individuals and/or to offer interest rates tailored to individuals’ risk levels; • Moral hazard – information asymmetries reduce the incentive for borrowers to avoid taking on unaffordable debt and to repay their debts (Padilla and Pagano (2000)). In the absence of information sharing, any defaults are visible just to the lender who extended the loan and not to the wider market, and so the potential negative impact on future access to credit associated with defaulting is lower; and,

54 • Informational advantages to large lenders – without information sharing, large, incumbent lenders will have access to more information on consumers’ creditworthiness than smaller lenders and new entrants (by virtue of their existing relationships with a greater number of consumers). This can give larger lenders a competitive advantage over smaller, newer ones and act as a barrier to entry and expansion for new lenders. The sharing of credit information reduces such informational advantages held by larger lenders (HM Treasury’s Impact Assessment for the Commercial Credit Data Sharing (CCDS) scheme and Padilla and Pagano (1997)). Transmission of harm 46. The insufficient incentives for firms to share high-quality information and to do so with all 3 large CRAs leads to (1) inconsistent coverage across the CRAs and (2) data quality issues. Inconsistent coverage 47. In CIMS, we found material differences in the information held on a representative sample of consumers by the 3 large CRAs. That analysis (presented in the data quality annex to the Interim Report) of 2019 data found that one source of these differences was the fact that some data contributors do not share data with all 3 large CRAs. 48. We have conducted new analysis, using 2024 data, to assess the 3 large CRAs’ coverage of regulated consumer credit and mortgages. We requested data under section 165 of FSMA from each of the 3 large CRAs on the portfolios of data they receive containing consumers’ credit information. We then combined this data with information the FCA collects from regulated firms on their consumer credit and mortgage lending activities. We identified which firms in the FCA data were present in each CRA’s data. Using FCA￾held data on the volume and value of loans held by each lender (including debt purchase firms), we then calculated the proportion of lending held by firms that shared credit information with each of the CRAs, and the proportion held by firms sharing with none of the 3 large CRAs, with 1 of them, with 2 of them, or with all 3 of them. We also mapped product types in the FCA data to the account types in the CRA data to examine what proportion of each lender’s loans were of product types that they shared with a CRA. 49. We treat DPC as regulated consumer credit for the purposes of this analysis as it will be within our perimeter (and within the scope of our proposals) by the time our proposals would come into effect. However, the FCA-held data reflects only part of the DPC market (since it was collected while DPC was outside our perimeter). Our analysis does not include regulated consumer credit agreements facilitated by peer-to-peer lending platforms entered into by lenders who are not FCA-regulated because of a lack of comparable data, but data from other sources indicate that these agreements are generally not shared with all 3 large CRAs. It also does not include agreements held by exempt special purpose vehicles (SPVs) that are not part of debt purchase firms’ groups. 50. By using FCA-held data as a source of ‘ground truth’ on the number and value of loans held by each lender and by using portfolio-level information rather than information on individuals’ credit files, this analysis isolates the effect of data contributors not sharing

55 credit information with all 3 large CRAs from other sources of differences in coverage, such as discrepancies in the data supplied by data contributors to the different CRAs on the same portfolio or differences in CRAs’ matching algorithms. 51. We estimate that 42.1 million, or around 19% of, outstanding regulated consumer credit agreements (excluding business lending, which is outside the scope of our proposals) and mortgages are held by firms that do not share credit information with all 3 large CRAs. Of these, the vast majority – over 37.4 million, or 17% of the total – are held by firms who share with 1 or 2, but not all 3, of the large CRAs. Our findings are consistent, though not directly comparable, with analysis presented in the data quality annex to the CIMS Interim Report. Figure 2: Percentage of outstanding consumer credit agreements (excluding business lending) and mortgages held by data contributors sharing credit information with 0, 1, 2 and 3 of the large CRAs Source: FCA analysis of portfolio-level CRA data and data on lending volumes collected from regulated firms Note: excludes agreements held by exempt SPVs that are not part of debt purchase firms’ groups and most peer-to￾peer lending, for data availability reasons, and business lending, which is outside the scope of our proposals. Coverage of the DPC market in the data is not complete. 52. We estimate that a further 4.2 million outstanding agreements are held by data contributors that share credit information with all 3 large CRAs but are themselves shared with only 1 or 2 of the large CRAs (i.e., the data contributor shares something with all 3 large CRAs, but shares credit information on a certain product type(s) with only 1 or 2 of them). 3 CRAs 177.6m agreements 81% 2 CRAs 26.0m agreements 12% 0 CRAs 4.7m agreements 2% 1 CRA 11.4m agreements 5%

56 53. These figures indicate that the 3 large CRAs’ coverage of regulated agreements is high overall, but that nonetheless credit information on a significant volume of regulated agreements is not shared with all 3 large CRAs. 54. The picture varies by product type. Coverage is highest and most consistent for mainstream forms of credit such as overdrafts, credit cards and mortgages. Coverage is less consistent for product types such as DPC, finance for insurance premiums and high-cost short-term credit. Even for these product types, though, a high proportion of outstanding agreements are held by firms who shared with at least 1 large CRA (just not all 3). 55. During CIMS, some stakeholders indicated that the differences in coverage amongst the 3 large CRAs are now smaller than they once were, especially in relation to certain product types. Nonetheless, our analysis indicates that such differences persist and are meaningful in scale, in line with analysis conducted during CIMS. Moreover, the experience of DPC illustrates how the emergence of new products could see increases in differences in coverage between CRAs. While a significant proportion of DPC agreements are now shared with CRAs, coverage of DPC remains highly inconsistent across the 3 large CRAs. 56. Even where lenders share data with and use multiple CRAs, they may not conduct a search at all 3 large CRAs for each credit application they receive. In our analysis of data from the 3 large CRAs during CIMS, we found that more than 90% of credit applications involved a search at just 1 CRA. So the coverage of the data shared with each CRA – not just the coverage of the data shared with the 3 large CRAs collectively – is important to lending decisions, as well as other decisions in which CRA data is used. Issues with the quality of information supplied to CRAs, with error correction and with the recording of County Court Judgments and Decrees as satisfied The quality of information supplied to CRAs 57. The FCA’s Financial Lives survey (FLS) found that in 2024, 10% of UK adults who had obtained their credit report or checked their credit score in the previous 12 months had found an error or issue with their credit file, down from 16% in 2022. A survey conducted in 2022 for Royal London found that a higher proportion – 29% – of UK adults who had checked their credit report at any time had found errors. Similarly, a Which? survey in July 2024 found that 32% of people who had checked their credit report in the previous 5 years had found an error. 58. Errors in the information supplied to CRAs by data contributors are a cause of errors in consumers’ credit files. It should, though, be noted that they are not the sole cause – for instance, information that is ‘correct’ may be matched to the wrong individual by the CRA. Error correction 59. Under the statutory information dispute process under section 159 (s159) of the Consumer Credit Act, CRAs have 28 days to inform a consumer whether data has been

57 corrected, removed, or left unchanged. However, CRAs often have to liaise with data contributors when investigating and correcting errors, and data contributors are not explicitly subject to this 28-day deadline at present. 60. Many data contributors do respond to CRA queries relating to information disputes in a timely manner. Information from CRAs suggests that the average time for information disputes to be resolved is well below 28 days. 61. However, in FLS 2024 only just over one-third of adults who raised a query or dispute with a CRA received a response within one month, and just over one-quarter said that it took more than 3 months for them to receive a response. Sample sizes were low but reportable for both these results. Delays in data contributors responding to CRAs are one source, but not the sole cause, of these delays in error correction. County Court Judgments and Decrees 62. At present, county court judgments (CCJs, in England, Wales and Northern Ireland) and Decrees (in Scotland) that are fully paid are sometimes not marked as ‘satisfied’ on the public register. CIMS found that consumers are often unaware of the need to provide proof of payment to the court (in England and Wales) or the Registry Trust (in Scotland and Northern Ireland) in order for a fully paid CCJ or Decree to be marked as satisfied. Some firms do this for judgments they have taken out, but some do not. 63. In cases where a fully paid CCJ or Decree is not marked as satisfied, the information held by CRAs does not accurately reflect the consumer’s financial history, even if it correctly reflects the public register. We expect that this is likely to disproportionately affect vulnerable consumers on the basis that they are more likely to have CCJs or Decrees taken out against them. 64. It cannot be determined with available data what percentage of fully paid CCJs and Decrees are not reported as satisfied. However, Registry Trust data indicates that only around 12% of all CCJs and Decrees are marked as satisfied and that this proportion has declined over time. The harm Reduced access to credit 65. Information asymmetries in retail lending markets can mean that lenders extend less credit overall than they would have in the presence of more information (see, for instance, Stiglitz and Weiss (1981)). This can mean that consumers are unable to access credit they otherwise would be able to or can only access credit at a lower amount or limit than they otherwise could. Difficulties in accessing credit 66. A significant proportion of UK adults seeking credit in the UK have difficulty accessing it. FLS 2024 found that 22% of adults who had applied for at least one regulated credit agreement in the two years to May 2024, equating to 3.2 million adults, were declined.

58 67. This cannot be attributed wholly to a lack of credit information, and in some cases it is appropriate for a consumer not to be able to access credit. However, our recent survey of lenders indicates that a lack of credit information is reducing access to credit. Around half of respondents reported that they would extend more credit, on aggregate, if they could better assess creditworthiness. This included several large lenders who account for an appreciable share of all lending in the UK. A number of studies (e.g. Barci et al. (2019) and Blattner et al. (2022)) find that more comprehensive credit information leads to higher lending volumes and greater access to credit in aggregate. Financial exclusion 68. Consumers about whom CRAs hold little, or no, information can have particular difficulty in accessing credit. Firms not sharing with all 3 large CRAs will tend to increase the number of such consumers. We refer to consumers who are not traceable or identifiable at a CRA as ‘invisible’, and we refer to credit files containing limited credit information as ‘thin’ files. These terms (or variations like ‘credit invisibles’) are widely used but do not have a universally agreed definition. 69. Responses to our 2024 lender survey indicated that some lenders – especially smaller ones – do not lend to invisibles and thin file consumers, either across all their product lines or across some. L.E.K. Consulting estimated that in 2023, UK consumers with non￾standard credit needs had around £2 billion of credit need that was not met but that would be commercially viable to meet. Invisibles and thin file consumers accounted for nearly two-thirds of the consumers that they identified as being in this group. 70. There are differing estimates of the number of invisible consumers and consumers with thin files – though each suggests that there is an appreciable number: • Experian published research in 2022 according to which there were over 5 million adults in the UK with little or no credit history. • Combining data from 2 CRAs as well as other data sources, LexisNexis Risk Solutions found that in 2021 over 600,000 people were invisible and that 1.7 million people had no financial or credit activity in CRA data in the previous 2 years. • L.E.K. Consulting estimated that in 2023 around 10.5 million people in the UK had little or no credit history. 71. Young people, recent immigrants, older people and others who face difficulty accessing mainstream credit (such as the long-term unemployed or the homeless) are particularly likely to have thin files or to be invisible. Unaffordable lending 72. Information asymmetries hinder lenders’ ability to assess the affordability of credit, as well as credit risk. This means that while information asymmetries can suppress lending volumes in aggregate, they can also lead to lenders extending credit that is unaffordable to the consumer. 73. More concretely, to the extent that not all lenders share information with all 3 large CRAs, some consumers’ credit files will not reflect all of their credit commitments.

59 This will mean that other lenders may extend credit that the consumer cannot afford where they would not have if they had a more comprehensive picture of the consumer’s financial situation. This can lead to consumers becoming over-indebted. 74. FLS 2024 found that 18% of UK adults were over-indebted in that they were in financial difficulty (failed to pay domestic bills and/or meet credit commitments in 3 or more of the last 6 months) or considered keeping up with their domestic bills and/or credit commitments to be a heavy burden. 5.5% of UK adults missed one or more credit or loan, or mortgage, payments in the 6 months to May 2024. 75. In FLS 2024, 44% of over-indebted adults reported that their debt had had a detrimental impact on their wellbeing – such as anxiety and stress, embarrassment, or loneliness – in the previous 12 months. Empirical research commissioned by the FCA (Warner and Garforth-Bles (2024)) found that the negative wellbeing impact of a consumer entering into arrears on their debt – as is more likely to happen if the debt is unaffordable – is around four-fifths as big as the impact of becoming unemployed. Impacts outside lending decisions 76. Errors in credit information and gaps or inconsistencies in the coverage of credit information can cause harm in areas other than lending decisions where it is used, such as in ID verification and KYC and AML processes. Our proposed interventions 77. To increase and make more consistent the coverage of credit information, we propose to require FSMA-regulated firms that share consumer credit information in respect of reportable agreements with one or more of certain ‘designated’ consumer credit reference agencies (DCCRAs) to share all available consumer credit information on those agreements with all DCCRAs. This approach is similar to what was referred to as the ‘portfolio approach’ in the CIMS Final Report. At this stage, we are proposing to designate the 3 large CRAs, Equifax, Experian and TransUnion. 78. We also propose to introduce requirements on data contributors that aim to improve the quality of consumer credit information. 79. More details on the proposals are provided above in the Consultation Paper. 80. We also intend to send an information request to DCCRAs under section 165 FSMA around 1 year after the mandatory reporting requirement is introduced, before any consultation on rules we may propose for a regulatory reporting framework for DCCRAs. The rest of this CBA does not focus on the costs and benefits of such a reporting framework. 81. The figure below summarises how we expect our intervention to lead to the outcomes it aims to achieve.

60 Figure 3: Causal chain – summary of how our proposed interventions will reduce harm Interventions Firm changes Outcomes Drivers of international growth and competitiveness Effect on international growth and competitiveness HARM REDUCED Consumers' credit files give a more accurate, consistent and comprehensive picture of their financial history and position Credit information users can access more comprehensive credit information from just one CRA Smaller lenders are better able to compete with larger lenders, who are currently more likely to use data from multiple CRAs Consumers benefit from greater choice and lower interest rates because of greater competition in retail lending markets Coverage of information on reportable agreements removed as a parameter of competition amongst DCCRAs DCCRAs compete more intensely on price, quality of analytical products, efficacy of matching processes, and other parameters of competition Credit information users benefit from lower prices and better quality analytical products Number of 'credit invisibles' is reduced and credit files are thickened Fewer consumers are extended credit they cannot afford Access to affordable credit increases and consumer needs are better met Overall lending volumes increase Lenders make fewer losses from 'bad' loans Information asymmetry reduced – lending decisions better reflect individuals' true creditworthiness (encompassing credit risk and affordability) Firms conduct appropriate checks before sharing information with DCCRAs and regularly review the efficacy of reporting processes in light of root cause analysis where errors are identified Firms share credit information on reportable agreements across all DCCRAs Firms respond promptly to CRAs in relation to information disputes, meaning information disputes are resolved more quickly Firms report fully-paid CCJs and Decrees as satisfied to the Courts or Registry Trust Data contributor requirements concerning: • Information accuracy, governance and error correction under the mandatory reporting framework; • Error investigation and correction in relation to s159 disputes; and, • Reporting fully-paid CCJs and Decrees as satisfied to the Courts or Registry Trust Requirement for firms that share credit information in respect of reportable agreements with one or more DCCRAs to do so with all DCCRAs Designation of CRAs Effective competition Improved trust and reputation Innovation spurred by intensified competition Proportionate regulation that goes with the grain of existing market practice Sustainable growth

61 Options 82. We considered and assessed several alternative policy options while we developed our proposed intervention. We describe key alternatives and summarise our assessment of them here. We do not discuss the idea of a single credit repository or national credit database, or access to historic credit information, since we addressed these in Chapter 5 of the CIMS Final Report and our assessment of them has not changed since then. Not introducing rules – delivering through the Consumer Duty Description 83. We considered not introducing rules in this area and relying on existing rules and guidance – in particular, the Consumer Duty – to achieve the outcomes we want to see in the market. Assessment 84. We do not think that the Consumer Duty or any other existing rules and guidance are sufficient to address the issues our proposals seek to address. 85. The evidence of continued inconsistencies in coverage (identified in analysis of data from 2019 and 2024) show that existing rules and guidance and the PoR have not been effective in ensuring consistent coverage across CRAs. 86. Most respondents to the CIMS Interim Report felt that the Consumer Duty and existing Handbook provisions are not sufficient to achieve the outcomes we desire from the proposed data contributor requirements. Designating more CRAs Description 87. We are consulting on designating the 3 large CRAs. We have considered whether it would be appropriate to designate one or more additional, smaller CRAs. Assessment 88. Currently, we do not believe that designating an additional CRA, or CRAs, would be necessary to achieve the outcomes we want to see in the market or proportionate. Chapter 4 in the Consultation Paper above sets out a non-exhaustive list of factors we have had regard to when considering the list of CRAs we propose to designate, and sets out and explains the list of CRAs we propose to designate. 89. We do not expect that our proposals will materially raise barriers to entry and expansion for non-designated CRAs relative to the status quo. Our assessment is that entry and expansion remain possible for CRAs with innovative, differentiated offerings. See the

62 ‘Competition assessment: competition impacts’ section below for our assessment of our proposals’ competition impacts. 90. Our proposed designation framework retains flexibility to respond to market developments. It allows for CRAs who are not initially designated to be designated or for CRAs to be de-designated if appropriate and proportionate. An absolute requirement Description 91. An absolute requirement would mean all firms involved in the provision or administration of reportable agreements being required to share certain credit information with the DCCRAs. Under an absolute requirement, it may be appropriate to exempt certain product types where regular repayments are not typically expected – for instance, pawnbroking agreements and lifetime mortgages. 92. An absolute requirement would mean (in contrast with our proposed approach) that firms who do not share credit information with CRAs at all would be required to begin sharing information with all the DCCRAs. Assessment 93. Most respondents to the CIMS Interim Report favoured an absolute approach to the mandatory reporting requirement. However, in light of the analysis we have conducted, we consider that the approach that we are proposing is a more proportionate way of addressing the problems we have identified in the market. 94. Our analysis of portfolio-level data from the 3 large CRAs, introduced in the ‘Problem and rationale for intervention’ section above, indicates that an absolute requirement would yield little additional uplift in the consistency of coverage beyond that secured by the approach we are proposing. We estimate that only around 2% of outstanding reportable agreements are held by firms who do not share credit information with any of the 3 large CRAs. 95. An absolute requirement would, however, be significantly more costly for firms than our proposed approach. It would affect vastly more data contributors – potentially as many as 1,150 more depending on which product types, if any, were exempted. These firms are mostly small with relatively few outstanding agreements, reflecting the ‘long tail’ of smaller lenders described above. Moreover, these additional firms would tend to face greater cost and disruption than the firms captured under our proposed approach – since they would have to set up entirely new systems and processes in order to begin sharing with CRAs. As well as these greater costs to data contributors, there would be significant further costs to the DCCRAs associated with them having to onboard such large additional numbers of data contributors when the proposals are implemented.

63 Including a threshold(s) in the mandatory reporting requirement Description 96. We have considered if we ought to set thresholds that determine whether the mandatory reporting requirement applies to a certain portfolio, data contributor or agreement. Assessment 97. Given the ‘long tail’ of small lenders in the market, including thresholds could exempt a relatively large number of smaller firms from the mandatory reporting requirement without significantly reducing the number of outstanding agreements caught by it. For instance, exempting firms with fewer than 1,000 outstanding reportable agreements could reduce the number of firms needing to make changes in response to our proposed mandatory reporting requirement by around one-third, while capturing more than 99% by number and 97% by value of the outstanding reportable agreements not reported to all 3 large CRAs that an approach without thresholds would capture. 98. However, we expect that those firms who would be exempted by a threshold will face relatively limited costs and disruption from complying with our proposals. This is because they already have systems and processes in place for sharing with a CRA(s). 99. A threshold(s) would also increase the complexity of our intervention both for firms and for consumers. Complex considerations would surround how requirements would apply to firms who intermittently fall just below or rise just above the threshold. Consumers, meanwhile, are likely to expect all of their financial commitments to be reflected in their credit files across all 3 large CRAs, irrespective of the size of their lender. 100. Given these considerations, we consider that, on balance, an approach without thresholds is proportionate. Most respondents to the CIMS Interim Report favoured an approach without thresholds. Including CATO data in the mandatory reporting requirement Description 101. We considered mandating the sharing of CATO data with DCCRAs as part of the mandatory reporting requirement, as was suggested by some stakeholders in response to the CIMS Interim Report. Assessment 102. While we recognise that there are potential benefits from including CATO data in the mandatory reporting requirement, we think that we should allow time for industry￾led initiatives in this area to progress and ‘bed in’ before seeking to intervene through regulation. As such, we propose not to include CATO data in the requirement at this time.

64 Requiring information sharing between DCCRAs Description 103. Under this option, we would require each DCCRA to share the credit information they receive relating to reportable agreements with the other DCCRAs. The DCCRAs would be required to share the raw data they receive rather than the processed or matched information. Assessment 104. Our proposed intervention seeks to work largely with the grain of existing market practices, in recognition of the fact that the market broadly works well currently. To require the sharing of raw credit information between DCCRAs would represent a fundamental change to how the market operates, and would require altogether new systems and processes to be established to support this data sharing. This is likely to involve greater costs and disruption than building on existing systems and processes. We do not consider that such a change would be proportionate given our findings about the market. 105. There would be significant practical difficulties associated with this option. It would cause challenges for DCCRAs in managing data quality and responding to information disputes as they would receive information originating from some data contributors with whom they did not have a relationship (since it came via another DCCRA). It may also require DCCRAs to do significant amounts of deduplication if they receive information both directly from a data contributor and from another DCCRA, imposing a burden on the DCCRAs and introducing room for errors. There would also be data protection considerations around this sharing of data supplied by lenders between DCCRAs. Lastly, requiring close competitors (as the DCCRAs would be) to share information of this nature with each other on an ongoing basis creates greater risks of coordination or reductions in the intensity of competition on certain key parameters of competition. 106. Overall, we do not consider that this is a viable or proportionate way of achieving our desired outcomes. Baseline and key assumptions 107. In our CBA, we assess the costs and benefits of our proposals against a baseline. In this baseline, we assume that the status quo will continue over the appraisal period. That is, we assume for the purposes of our modelling that absent intervention, firms would continue to share with the same number of DCCRAs as they do now (including where they currently do not share with any DCCRAs), and therefore inconsistencies in coverage between the 3 large CRAs would persist. This assumption is supported by responses to our recent lender survey, with almost all respondents saying they had no plans to start sharing with a new CRA or to cease sharing with a CRA in the following 18 months.

65 108. We also make the following overarching assumptions in our analysis of the impacts of our proposals: • The 3 large CRAs are designated, per our proposal above. • Costs and benefits are analysed over a 10-year appraisal period following implementation. • The present value (PV) of costs and benefits are estimated by applying a 3.5% discount rate, in alignment with HM Treasury’s Green Book. • Firms comply with our proposed rules (where relevant). • Firms begin to comply, where relevant, with our proposed rules at some point during the 12-month period between our rules being made and them applying (as opposed to exactly when the rules come into force), such that firms begin to incur costs in the first year after our rules are made. As in the baseline, we assume, for the purposes of our modelling, that firms who do not currently share with any DCCRAs do not begin to do so. • No firms cease sharing with any DCCRAs during the sharing period. As we explain in paragraph 206 below, we think that it is unlikely that a significant number of firms will cease sharing with any DCCRAs as a result of our proposals, as we expect the costs to each firm of complying to be low and the industry’s reciprocity principles mean that firms must, in general, share data with a CRA in order to receive data from it. • Data shared with DCCRAs under the mandatory reporting requirement is shared on a monthly basis. • We include DPC providers in our firm populations, as DPC will be within our regulatory perimeter by the time our proposals would be implemented. 109. In determining the populations of firms that would be affected by our proposals, we draw on the analysis of portfolio-level data from the 3 large CRAs and FCA-held data on lending volumes described in the ‘Problem and rationale for intervention’ section above. 110. Our estimates of the costs to firms associated with our proposals draw on our Standardised Cost Model (SCM; see our Statement of Policy on CBAs for further detail) as well as responses to the cost surveys we sent to firms. The cost surveys were sent to firms while we were still developing our proposals, and so did not contain all the details of our proposed approach as set out in the Consultation Paper above. Some firms did not provide cost estimates as they considered that they would not need to make any changes, either because they believed they were already compliant or because they believed the proposals would not apply to them. Some firms provided only qualitative responses, and where firms did provide estimates these were very varied. For these reasons, we use firms’ responses to guide our assumptions rather than incorporating them in a mechanical way. We welcome further evidence on the costs of our proposals now that the full details are available to firms. 111. We discuss the specific assumptions we make in relation to individual estimates further in the relevant places below.

66 Summary of impacts 112. This section provides a summary of the key impacts of our proposals. 113. Together, the proposed mandatory reporting requirement and data contributor requirements will increase the coverage, quality and consistency of credit information. We expect this to improve the functioning of retail lending markets and other markets in which credit information is used, with benefits for firms and consumers. 114. The table below summarises the benefits and costs we expect as a result of our proposals. Figures in italics show the range between our central estimate and the higher estimates from sensitivity analysis we conducted on some of our estimates. It is not reasonably practicable to assign monetary values to the benefits we expect from our proposals, because of the complexity of how credit information feeds into decisions in retail lending and other markets, and uncertainties in how firms would respond to having access to better credit information. Nonetheless, we expect these benefits to be substantial. In our assessment below, we describe the likely scale of these benefits and provide quantitative evidence on their size where possible. Table 1: Summary table of benefits and costs Group affected/ proposal Item description Benefits Costs One-off Ongoing (annual) DCCRAs All proposals Familiarisation and gap analysis £9k Mandatory reporting to DCCRAs Staff and system costs £3.15m £1.95m Greater opportunity to compete and innovate on non-coverage parameters Unquantified FSMA regulated data contributors All proposals Familiarisation and gap analysis £2.27m Increased revenue from lending Unquantified Reduced loss provisioning and reduced losses from ‘bad’ loans Unquantified DCCRAs innovating more and competing more intensely on price, quality of analytical products, efficacy of matching processes and other parameters beyond coverage Unquantified Cost savings from efficiencies in creditworthiness assessments [Transfer from CRAs to credit information users] Unquantified

67 Group affected/ proposal Item description Benefits Costs One-off Ongoing (annual) Mandatory reporting to DCCRAs £8.94m £1.25m Data contributor requirements Information accuracy, governance and error correction under the mandatory reporting requirement £228k (£228k to £594k) £556k (£556k to £1.44m) Error investigation and correction in relation to s159 information disputes £683k (£683k to £1.01m) £1.65m (£1.65m to £2.44m) Reporting fully paid CCJs/ Decrees as satisfied £287k (£287k to £575k) £150k (£150k to £299k) Consumers All proposals Improved access to affordable, appropriate credit Unquantified Loss of access to some credit deemed unaffordable or inappropriate Unquantified Reduced confusion around credit files Unquantified Reduced unaffordable lending Unquantified Better informed pricing of credit Unquantified Greater choice in consumer credit and mortgage markets Unquantified Stronger competition in retail lending markets, enhancing innovation and placing downward pressure on interest rates Unquantified Total £15.6m one off costs (£15.6m to £16.6m) £5.6m annual costs (£5.6m to £7.4m) Note: figures may not sum due to rounding. 115. Table 2 below presents the total net present value of our proposals and notes key unquantified impacts. Table 3 shows the Equivalent Annual Net Direct Cost to Business (EANDCB).

68 Table 2: Present Value and Net Present Value PV Benefits PV Costs NPV (10 yrs) (benefits-costs) Total impact Unquantified £63.4m (£63.4m to £80.0m) -£63.4m (-£63.4m to -£80.0m) Key unquantified items to consider Benefits to consumers and firms from improvements to the quality, consistency and coverage of credit information. Benefits in relation to competition in retail lending markets and between DCCRAs Table 3: Net direct costs to firms Total (Present Value) Net Direct Cost to Business (10 yrs) EANDCB Total net direct cost to business (costs to businesses – benefits to businesses) £63.4m (£63.4m to £80.0m) £7.36m (£7.36m to £9.30m) Competition assessment: competition impacts Impacts on competition in the market for the provision of credit information to firms Impact on competition between DCCRAs 116. Our proposals will homogenise, to an extent, the data received by each of the DCCRAs. We expect that this will re-focus competition between the DCCRAs onto areas other than coverage – such as price and the quality of analytical products – rather than reducing the competition between them. Indeed, we expect that our proposals will stimulate competition between, and innovation by, DCCRAs by making it easier and more likely for firms to switch between them. 117. Our proposals will not mean that the data each DCCRA holds is the same. CRAs collect and maintain a wide range of additional data that falls outside the scope of the proposed policy. Some lenders responding to our recent survey highlighted that coverage of non￾FSMA regulated products like utilities and telecoms accounts is an important factor when selecting a CRA. They also indicated that the integration of alternative datasets not within the scope of our proposals will remain a key means of differentiation between DCCRAs once the policy is implemented. Differences in data cleaning and matching processes will also persist.

69 118. Moreover, evidence from our recent survey of lenders indicates that, in addition to coverage, factors such as price, the quality of matching techniques and analytical products, and compatibility with the user’s own systems are also very important to firms’ choice of CRA. We expect DCCRAs to compete more intensely on these parameters when coverage becomes more homogenous. This was supported by CRAs’ responses to our recent survey. 119. We also expect our proposals to stimulate competition between DCCRAs by making it easier to switch between them (in terms of which DCCRA(s) a firm purchases products and services from). By making the data received by DCCRAs more homogenous, our proposals would make it easier to compare the value-add offered by DCCRAs’ products and reduce the disruption and (perceived) risk associated with switching between DCCRAs. Nonetheless, there are technological and contractual constraints to switching that would persist after our proposals are implemented. In our recent survey of lenders, more than a third of respondents said our proposals would make them more able or likely to switch CRA, though a majority said it would not affect their switching behaviour (note that the respondents to this question may not be representative of the whole market, but these findings nonetheless provide evidence to support our assessment). 120. Our proposals may lead to some firms reducing the number of DCCRAs they purchase data and products from, as the coverage of the data available from each will be more similar (though not the same). To the extent this happens, this would increase the competition between DCCRAs for each contract with a credit information user. However, we note that firms often maintain relationships with multiple CRAs for reasons other than differences in coverage, such as business continuity, and so we do not expect a large reduction in the extent of ‘multi-homing’ (the use of multiple CRAs). We expect that it will be more common for firms to continue to contract with multiple DCCRAs where they currently do so, but to need to make fewer calls to a second or third DCCRA for applications because their search at the first DCCRA returned a thin file or no record. We discuss these issues further in paragraph 200 below. Impact on competition between DCCRAs and non-designated CRAs 121. Some stakeholders have suggested that the designation of a small number of CRAs – for instance, just the 3 large CRAs – would raise barriers to entry and expansion in the market. However, our assessment at this stage is that our proposals will not materially raise these barriers relative to the status quo. 122. High barriers to entry and expansion are already present in the market before the introduction of our proposals. Designation will not alter these existing barriers. The key impact of designation that could affect competition between DCCRAs and non-designated CRAs would be increasing the coverage of DCCRAs but not of non￾designated ones. However, the big 3 CRAs, whom we propose to designate, already have far greater coverage in the credit performance data they collect than any other CRA. This disparity is not created by our proposals, nor is it hugely increased given that the 3 large CRAs already have high coverage of in-scope accounts and we are not aware of any other CRA that collects credit performance data directly from lenders at a comparable scale. Moreover, several types of accounts, such as utilities and telecoms

70 accounts, are outside the scope of our proposals. Coverage of these types of accounts will not be directly affected by our proposals and will continue to serve as an important area of differentiation for CRAs. 123. The entry of Callcredit – now TransUnion – into the market indicates that entry and expansion is possible, albeit challenging, for CRAs with innovative, differentiated offerings. We do not expect designation to alter that. Around 37% of respondents to our lender survey (excluding those who do not use CRAs at all and would not do so after designation) said they would consider using non-designated CRAs as well as DCCRAs. Several of those respondents said they would be particularly open to using a non￾designated CRA where it had some especially innovative or high-value-add proposition. Where firms said that they would only use DCCRAs, this was generally because they expected those CRAs to have the greatest coverage, or because they expected the CRA(s) they currently use to be designated – rather than because of any perceived regulatory ‘endorsement’ of the DCCRAs or their products. 124. Lastly, our proposed designation framework allows for the designation in the future of CRAs that are not initially designated (see Chapter 4 of the Consultation Paper above). Firms who are not initially designated would therefore not be ‘shut out’ from becoming designated. Impacts on competition in retail lending markets 125. We expect that our proposals will promote effective competition in the interests of consumers in retail lending markets by working to ‘level the playing field’ between larger and smaller lenders. HM Treasury’s post-implementation review of the CCDS scheme, which mandated 9 designated banks to share credit information and certain current account data on SMEs with 4 (initially 3) designated CRAs, found that the policy was proving successful in increasing competition in the market for lending to SMEs. We expect similar benefits to arise in retail lending markets under our proposed policy measure. 126. Currently, differences in data coverage between CRAs advantage large, established lenders. These lenders are more likely to multi-home (i.e. access data from multiple CRAs), which enables them to triangulate and reconcile disparate credit information to form a more comprehensive view of a borrower’s credit history. In addition, these lenders often benefit from their own internal datasets that they have accumulated through longstanding relationships with customers. 127. Our proposals aim to reduce differences in data coverage across DCCRAs. In turn, we consider that this will narrow the information gap between large and small or specialist lenders, who currently often rely on a single CRA. This will allow smaller lenders to compete more effectively with their larger counterparts. 128. Greater competition between lenders can place downward pressure on the cost of credit and encourage innovation in lenders’ offerings to consumers. The FCA’s 2022 Final Report on competition in retail banking markets, for instance, found that increased competition in mortgage markets had contributed to downward pressure on prices, reflected in a reduction in risk-adjusted yields (a measure of the margin made by

71 lenders). It also found evidence of price competition being reflected in reductions in risk￾adjusted yields in the markets for personal loans and credit cards in the run-up to the Covid-19 pandemic. Costs Costs to consumers Loss of access to credit for some consumers 129. While (on the basis of the evidence set out in the ‘Benefits’ section below) we expect that our proposals will improve access to credit overall, firms being better able to assess creditworthiness may mean that some consumers may lose access to credit that they would otherwise have qualified for or may be offered worse terms, e.g. a higher interest rate or a lower credit limit. This may be the case where, for example, lenders become aware of additional negative information about a consumer that leads them to judge them as too risky, or if lenders assess a loan as unaffordable when they have more comprehensive information about a consumer’s existing credit commitments. 130. It is not reasonably practicable to estimate the extent of any loss of access to credit for some consumers resulting from our proposals, for the reasons set out in paragraph 177 below. The cost to consumers of any loss of access to credit also depends on how they respond. The cost is likely to be greater where the consumer funds the purchase they were intending to make with higher cost credit or if the consumer is unable to make an essential purchase, and lower if it means the consumer chooses to forgo the consumption of a non-essential good. FLS 2024 found that adults who were declined regulated credit in the two years to May 2024 were more likely to borrow from a family member or friend (20%) or to cut back on their spending (20%) than to get a similar product or service but with different terms or conditions (12%) or to be able to get the product or service but have to pay extra for it (5%). Only a very small proportion of adults reported turning to illegal moneylenders when declined regulated credit in the two years to May 2024. 131. The effect of consumers being denied credit will depend on the type of credit in question, since different lending products are used differently by consumers. Being denied a mortgage, for instance, is likely to have a particularly large impact on a consumer. We expect that any loss of access resulting from our proposals is likely to be smaller with respect to mortgages than other types of credit, because mortgage decisions draw on particularly large amounts of non-CRA data and because existing coverage of mortgages in CRA data is very high. 132. Moreover, any loss of access to credit resulting from our proposals reflects lenders having better information with which to make their own lending decisions based on their own policies, risk appetites and strategies, rather than a direct consequence of our proposals. Where better information means that lenders are better able to identify unaffordable credit before extending it, this can mean that consumers avoid significant negative impacts on their wellbeing (see paragraphs 182 to 185 below).

72 Pass-through of firms’ costs 133. Consumers may face some additional costs, for instance through increases in the cost of credit, to the extent that lenders pass on the costs associated with our intervention. It is not reasonably practicable to estimate the extent of any cost pass￾through, but it is unlikely to be large given that we expect the costs to lenders of our proposed interventions to be relatively modest. Any such cost pass-through would also be mitigated to the extent that lenders pass through any savings they realise from efficiencies in their creditworthiness assessment processes (see paragraphs 199 to 202 below). Costs to firms Familiarisation and gap analysis costs 134. Firms will need to familiarise themselves with the contents of the consultation. They will also need to assess their current practices against what is required to understand the changes they may need to make. We have modelled these familiarisation and gap analysis costs as in Table 4 below using our standard approach and assumptions from our SCM. These estimates are likely to overstate these costs for many data contributors, since many of our proposals apply only to a subset of data contributors (those who currently share with at least one DCCRA). Table 4: One-off familiarisation and gap analysis costs – all proposals Firm size Large Medium Small Assumptions Number of DCCRAs - 3 - Number of data contributors 43 194 1973 Number of FTE compliance staff assumed to read Consultation Paper per firm 20 5 2 Average hourly cost of compliance staff time (including overheads) £75 £70 £58 Average reading speed, pages per hour 20 Length of Consultation Paper, pages 50 Size (FTE) of legal team (or equivalent) reading legal text 4 2 1 Hours per team member to review 50 pages of legal text 28 21 7 Average hourly cost of legal team (or equivalent) time (including overheads) £87 £81 £77 Number of pages of legal instrument 32

73 Firm size Large Medium Small Costs One-off cost per DCCRA - £3k - Total one-off costs, DCCRAs £9k One-off cost per data contributor £10k £3k £1k Total one-off costs, data contributors £2.27m Note: figures may not sum due to rounding. Mandatory reporting to DCCRAs Costs to DCCRAs 135. We expect the proposed DCCRAs would incur one-off and ongoing staff and system costs as a result of our proposals, as they would need to onboard additional data contributors and receive and manage larger volumes of data. One-off costs would include those associated with arranging data sharing agreements with new data contributors, testing and validating data files from new contributors, and any systems changes to prepare for the receipt and storage of larger volumes of data. Ongoing costs would include those associated with monitoring and validating a greater volume of data and with dealing with a greater volume of information disputes and complaints (because of larger volumes of data being received and held). 136. We have used DCCRAs’ responses to our cost survey to inform our estimates of the costs they would face. We scale DCCRA-provided cost estimates to reflect the fact that each DCCRA would, under our proposals, need to onboard and receive data from around 150 new data contributors. We present common per-firm one-off and ongoing costs for the 3 DCCRAs, though in practice there will be some variation in costs between the DCCRAs since the exact number of new data contributors will vary between them and each DCCRA’s systems and processes will differ somewhat. Table 5: One-off and ongoing costs for DCCRAs – mandatory reporting Description Estimate One-off cost per DCCRA £1.05m Ongoing cost per DCCRA £0.65m Total one-off costs £3.15m Total ongoing costs £1.95m Costs to data contributors who report to 1 or 2 DCCRAs 137. We expect that firms with outstanding reportable agreements who currently share with only 1 or 2 of the 3 DCCRAs would incur one-off and ongoing costs to comply with our proposals. We present our estimates of these costs in the tables below. These estimates are guided by responses to our cost survey.

74 138. Data contributors who share credit information with just 1 or 2 of the 3 DCCRAs will face one-off IT costs associated with setting up the connection to the additional DCCRA(s) and initial testing and validation of their files with that DCCRA(s). The 3 DCCRAs each accept each other’s data formats and the Standard Industry Reporting Format, so data contributors will not need to create a new data file or reformat their existing files in order to share credit information with the other DCCRAs. We assume that small firms do not have in-house IT departments and face a fixed £ cost associated with work by their IT provider. Our assumptions about the magnitude of these IT costs are informed by responses to our cost survey. 139. Data contributors will also need to put in place the relevant data sharing agreements and contractual arrangements with the additional DCCRA(s). We model this as a change project requiring Executive Committee (ExCo) review. We use the SCM’s ‘Very small’ change project scenario, since respondents to our cost survey did not generally flag this as a significant cost. We assume, conservatively, that the one-off IT and change costs associated with sharing credit information with 2 new DCCRAs are double those associated with sharing with 1 new DCCRA (though we assume the training costs and costs of ExCo review of the change project are the same). In practice, firms may be able to achieve efficiencies where they are required to set up sharing with 2 new DCCRAs. Lastly, we assume that firms will need to disseminate how the mandatory reporting framework applies to them, and the associated updates to their processes, internally. 140. We do not model costs associated with firms updating their privacy notices to reflect sharing with all 3 DCCRAs, since most respondents to our cost survey reported that their privacy notices would not need to be updated if just the 3 large CRAs were designated (as we are proposing). We also do not model costs associated with firms needing to make changes to comply with our proposed requirement to share both positive and negative information, as opposed to just negative information, on reportable agreements. Our analysis of portfolio-level data from the 3 large CRAs showed that negative-only sharing is done for only a very small proportion of portfolios, owned by debt purchase firms. Our engagement with industry suggests that in these cases those debt purchasers are sharing all the information there is to share on those portfolios, such that our proposals would not require them to share more data.

75 Table 6: One-off costs for data contributors who currently share credit information with 1 or 2 DCCRAs – mandatory reporting Large Medium Small Assumptions Number of firms currently sharing with 1 DCCRA 4 33 148 Number of firms currently sharing with 2 DCCRAs 2 34 54 IT set-up – person-days or cost, per new DCCRA sharing with 60 person￾days 40 person￾days £15,000 Change project – person-days, per new DCCRA sharing with 45 14 3 ExCo review required for change project? Yes Number of (compliance) staff that new processes are to be disseminated to 20 5 2 Mode of dissemination Written/basic briefing, 2 hours Costs Total one-off cost per firm - firms currently sharing with 1 DCCRA £110k £52k £33k Total one-off cost per firm - firms currently sharing with 2 DCCRAs £57k £27k £16k Total one-off costs £553k £2.63m £5.70m £8.88m Note: figures may not sum due to rounding. 141. These data contributors will also face ongoing costs associated with sharing credit information with additional DCCRAs – in particular, dealing with a greater number of queries from DCCRAs in relation to the data they share (since they will be sharing data with more DCCRAs). Our assumptions about the magnitude of these costs are based on the ‘Very small’ IT project scenario in the SCM. Respondents to our cost survey generally indicated that these costs would be relatively minor. Again, we assume that the ongoing resource required to deal with additional queries from 2 further DCCRAs is twice that required to deal with additional queries from 1 further DCCRA, which may overstate these costs.

76 Table 7: Ongoing costs for data contributors who currently share credit information with 1 or 2 DCCRAs – mandatory reporting Large Medium Small Assumptions Number of firms currently sharing with 1 DCCRA 4 33 148 Number of firms currently sharing with 2 DCCRAs 2 34 54 Ongoing resource – person-days, per new DCCRA sharing with 46 8 5 Costs Total ongoing cost per firm - firms currently sharing with 1 DCCRA £47k £7k £4k Total ongoing cost per firm - firms currently sharing with 2 DCCRAs £23k £4k £2k Total ongoing costs £232k £370k £621k £1.22m Note: figures may not sum due to rounding. Costs to data contributors who share with all 3 DCCRAs, but have at least one portfolio that they share with at least one DCCRA but not all 3 142. In general, we assume that data contributors who already share credit information with all 3 DCCRAs would not need to make any changes to comply with our proposed mandatory reporting requirement. An exception, however, is data contributors who share credit information with the 3 DCCRAs but have at least 1 portfolio that they share credit information with 1 or 2 of the DCCRAs but not all 3. Our analysis of the portfolio￾level data from CRAs indicates that there are 10 such firms. 143. We expect that these firms would incur one-off IT and change costs to set up the sharing of credit information on the relevant set of agreements with one or more additional CRAs, as well as ongoing costs to deal with additional queries in relation to the data they will be sharing more widely. We did not receive evidence on the magnitude of these costs for this group of firms in our cost survey, so we model these costs using the ‘Very small’ IT and change project scenarios in the SCM (with the ‘very small’ IT project scenario being used to model both the one-off IT set-up and the ongoing resource requirements). This reflects the fact that these firms will already be sharing credit information on the agreements in question with at least one DCCRA, so will not need to develop a new file to share them more widely, and they will already have relationships with each DCCRA, so they will not need to establish any new relationships. We also assume that affected firms will need to disseminate the new requirements under the mandatory reporting framework within the firm.

77 Table 8: One-off and ongoing costs for data contributors who currently share credit information with 3 DCCRAs (but not all portfolios) – mandatory reporting Large Medium Small Assumptions Number of firms 0 4 6 IT set-up – person-days (one-off) - 8 5 Change project, person-days (one-off) - 14 3 ExCo review required for change project? No Ongoing resource – person-days - 8 5 Number of (compliance) staff that new processes are to be disseminated to (one-off)

• 5 2 Mode of dissemination Written/basic briefing, 2 hours Costs Total one-off cost per firm - £11k £3k Total ongoing cost per firm - £4k £2k Total one-off costs - £43k £19k £61k Total ongoing costs - £15k £11k £26k Note: figures may not sum due to rounding. Data contributor requirements

144. Below we estimate the costs we expect firms to incur in relation to each of our proposed data contributor requirements. As with our estimates of the costs associated with the mandatory reporting requirement, we draw on evidence from our cost survey as well as the SCM and our judgement. However, we received relatively few estimates of the costs of these proposals. Some firms said they could not assess these costs until they knew the details of what we were proposing. A number of firms did not think they would incur any costs as a result of the proposals either because they were already compliant or because the proposal did not apply to them.
145. Our estimates of the costs of these requirements are sensitive to assumptions about the proportion of in-scope firms that will need to make changes to comply. We present sensitivity analysis showing how our estimated costs would differ if we assumed a higher proportion of firms needed to make changes. Information accuracy, governance and error correction under the mandatory reporting requirement
146. All data contributors within the scope of our proposed mandatory reporting requirement would be subject to our proposals around information accuracy, governance and error correction under the mandatory reporting requirement. This would include firms who

78 are already compliant with the mandatory reporting requirement itself because they share credit information on all of their reportable agreements across all of the DCCRAs. 147. We expect that many data contributors already comply with these proposed data diligence requirements. This is supported by responses to our cost survey. There is, though, uncertainty around exactly what proportion of firms are already compliant. We expect that large firms are likely to already be compliant. We draw on FLS 2024’s findings around the prevalence of errors and issues in credit files to inform our assumptions about the proportion of medium and small data contributors that will need to make changes to achieve compliance. 148. Firms who are not already compliant will incur one-off costs in setting up systems and updating processes as needed to meet the proposed requirements. We model these costs using the ‘Very small’ IT project scenario in the SCM. We also expect firms to incur costs in relation to one-off internal governance processes associated with the changes, which we model through the SCM’s ‘Very small’ change project scenario. Firms who are not already compliant will also face costs associated with the ongoing resource required to maintain compliance, for instance in undertaking checks prior to data submission and conducting root cause analysis where errors are found by CRAs or consumers. Guided by firms’ responses to our cost survey, we model these costs using a blend of the SCM’s ‘Small’ and ‘Very small’ IT project scenarios. Table 9: One-off and ongoing costs for data contributors – information accuracy, governance and error correction under the mandatory reporting requirement (central estimate) Large Medium Small Assumptions Number of firms 30 139 252 Of which, share of firms not already compliant 0% 10% 10% IT set-up – person-days (one-off) - 8 5 Change project – person-days (one-off) - 14 3 ExCo review required for change project? Yes Ongoing resource – person-days - 57 20 Costs Total one-off cost per firm - £11k £3k Total ongoing cost per firm - £27k £7k Total one-off costs - £154k £74k £228k Total ongoing costs - £378k £177k £556k Note: figures may not sum due to rounding.

79 149. As a sensitivity analysis, in Table 10 we present cost estimates assuming that a higher proportion of firms, including some large firms, would need to make changes to comply with this proposal. Table 10: One-off and ongoing costs for data contributors – information accuracy, governance and error correction under the mandatory reporting requirement (higher estimate) Large Medium Small Assumptions Number of firms 30 139 252 Of which, share of firms not already compliant 10% 20% 20% IT set-up – person-days (one-off) 46 8 5 Change project – person-days (one-off) 45 14 3 ExCo review required for change project? Yes Ongoing resource – person-days 212 57 20 Costs Total one-off cost per firm £46k £11k £3k Total ongoing cost per firm £109k £27k £7k Total one-off costs £138k £307k £149k £594k Total ongoing costs £327k £757k £355k £1.44m Note: figures may not sum due to rounding. Error correction and investigation in relation to s159 information disputes 150. As set out in the Consultation Paper above, some of our proposals in relation to error investigation and correction apply more broadly than just to information shared through the mandatory reporting requirement. In particular, we propose to require firms to respond within 14 days (except in exceptional circumstances) when they are informed by a CRA that it has received a s159 notice relating to information provided by the firm. This obligation would apply irrespective of whether the firm is subject to the mandatory reporting requirement and of whether the CRA is designated or not. Relevant data contributors who share credit information with a non-designated CRA but not with any DCCRAs could therefore be caught by this part of the proposals. We do not have comprehensive data on which data contributors share with CRAs other than the 3 large CRAs, but evidence from CIMS and our recent firm surveys suggests that there will be very few data contributors who do not share with any of the 3 large CRAs but who share with another CRA. We therefore use the set of credit and home finance firms (including debt purchasers and, given the scope of the s159 provisions, firms who extend regulated consumer credit for business purposes) who share with at least one DCCRA as our firm population for the purposes of estimating the costs of this proposal.

80 151. There is uncertainty about the proportion of firms who would need to make changes to comply with these proposals. Our assumptions reflect the fact that data from CRAs indicates that many information disputes are already resolved in 14 days or less, but FLS 2024 indicated that a material proportion of adults who raised a query or dispute with a CRA did not receive a response within 1 month. We understand that CRAs often already provide data contributors with certain timeframes for investigations in relation to information disputes, but there is no requirement for the data contributor to comply. We assume that larger firms are more likely to already be compliant with our proposals as they will tend, on average, to have larger teams available to investigate any issues referred to them by CRAs. Responses to our cost survey also suggest that some firms who are not already compliant per se would face only minimal costs because in practice they investigate potential errors in short timeframes even though they have a 28-day service-level agreement, or because the volumes of information disputes referred to them are low. 152. We model the costs to each firm that is not already compliant using the same assumptions as for the data diligence proposals. Firms will need to make one-off changes to set up the required systems and processes. Ongoing resource will be required to investigate errors within the required timeframes and notify all relevant CRAs of any corrections. Table 11: One-off and ongoing costs for data contributors – error correction and investigation in relation to s159 information disputes (central estimate) Large Medium Small Assumptions Number of firms 30 139 268 Of which, share of firms not already compliant 10% 20% 30% IT set-up – person-days (one-off) 46 8 5 Change project – person-days (one-off) 45 14 3 ExCo review required for change project? Yes Ongoing resource – person-days 212 57 20 Costs Total one-off cost per firm £46k £11k £3k Total ongoing cost per firm £109k £27k £7k Total one-off costs £138k £307k £238k £683k Total ongoing costs £327k £757k £568k £1.65m Note: figures may not sum due to rounding. 153. Below we present a sensitivity analysis in which we assume that a larger share of firms need to make changes to comply with our proposal.

81 Table 12: One-off and ongoing costs for data contributors – error correction and investigation in relation to s159 information disputes (higher estimate) Large Medium Small Assumptions Number of firms 30 139 268 Of which, share of firms not already compliant 15% 30% 40% Other assumptions As in central estimate Costs Total one-off cost per firm £46k £11k £3k Total ongoing cost per firm £109k £27k £7k Total one-off costs £230k £461k £318k £1.01m Total ongoing costs £545k £1.13m £760k £2.44m Note: figures may not sum due to rounding. Reporting fully paid CCJs and Decrees as satisfied 154. All FSMA-regulated firms carrying out certain consumer credit or home finance activities would be subject to our proposal for firms to report fully paid CCJs and Decrees as satisfied when they become aware of them. This includes firms who are not caught by the mandatory reporting requirement and firms who do not report to any CRAs. 155. Data is not available on how many FSMA-regulated firms take out CCJs or Decrees, nor on how many of those firms already report fully paid CCJs and Decrees as satisfied. Responses to our cost survey suggest that only a minority of lenders and debt purchase firms take out CCJs or Decrees against consumers, and that most firms who do so already report them as satisfied where they are fully paid. This assumption (that most firms who take out CCJs already report them as satisfied where they are fully paid) is not inconsistent with a significant number of fully paid CCJs and Decrees not being marked as satisfied, especially as a relatively small proportion of claimants account for a large proportion of all judgments. Drawing on responses to our cost survey, we assume for the purposes of our analysis that 30% of lenders and debt purchase firms take out CCJs or Decrees, and that 10% of those firms will need to make changes in response to our proposal. We do not vary these assumptions by firm size. 156. We expect that affected firms will need to make one-off changes to set up the systems to notify the courts or Registry Trust, and that there will be internal governance processes associated with this. We model these using the ‘Very small’ IT and change project SCM scenarios respectively. We also assume that some resource will be needed for the process on an ongoing basis. We, again, model this using the ‘Very small’ IT project scenario in the SCM. CCJs can be marked as satisfied using an online portal (in England and Wales) or by email (as opposed to, say, via a letter); we therefore expect the associated costs to be relatively low.

82 Table 13: One-off and ongoing costs for data contributors – reporting fully-paid CCJs and Decrees as satisfied (central estimate) Large Medium Small Assumptions Number of firms 43 194 1973 Share of firms who take out CCJs/ Decrees 30% Of which, share of firms not already compliant 10% IT set-up – person-days (one-off) 46 8 5 Change project – person-days (one-off) 45 14 3 ExCo review required for change project? Yes Ongoing resource – person-days 46 8 5 Costs Total one-off cost per firm £46k £11k £3k Total ongoing cost per firm £23k £4k £2k Total one-off costs £46k £66k £176k £287k Total ongoing costs £23k £22k £105k £150k Note: figures may not sum due to rounding. 157. Below is a sensitivity analysis in which we assume that a higher share of firms are not already compliant. Table 14: One-off and ongoing costs for data contributors – reporting fully-paid CCJs and Decrees as satisfied (higher estimate) Large Medium Small Assumptions Number of firms 43 194 1973 Number of firms not already compliant Twice as many as in central estimate Other assumptions As in central estimate Costs Total one-off cost per firm £46k £11k £3k Total ongoing cost per firm £23k £4k £2k Total one-off costs £92k £132k £351k £575k Total ongoing costs £45k £45k £209k £299k Note: figures may not sum due to rounding.

83 Indirect costs to firms Short-term impacts on model performance and potential prudential impacts 158. Lenders and other firms may experience some cost and disruption in the short term as a result of the introduction of additional data to each DCCRA’s databases. CRA data is used by many lenders and other firms as an important input into various internal models, including models of credit risk that are used to determine regulatory capital requirements. The introduction of additional data may mean that these models, trained on existing CRA data (and other data), need to be recalibrated. 159. The recalibration of models would require time and effort from affected firms’ analytical functions. Major changes would be likely to require internal governance approvals and, for dual-regulated firms, liaison with the Prudential Regulation Authority (PRA). These impacts, and the associated costs, are likely to be larger to the extent that the volume of additional data is greater and the additional data is more dissimilar to the existing data that underpins the models in question. 160. Overall, we do not think that firms are likely to experience significant costs and disruption from such impacts on the performance of their internal models, for the following reasons: • While we expect our proposals to achieve a meaningful increase in the consistency and comprehensiveness of the coverage of CRA data, we do not expect them to fundamentally transform the volume of data being shared with the 3 large CRAs. Moreover, our proposed approach means that the additional data each CRA receives under our proposals will be data that is already shared with at least one DCCRA. Therefore, the additional data shared with each DCCRA will not be data that is of a fundamentally different type – e.g., associated with an entirely new product that is currently not shared with CRAs – from existing data; • Firms monitor their models’ performance and recalibrate them from time to time as part of business-as-usual (BAU) processes, since input data regularly changes and causes models to ‘drift’. Any recalibration necessary after the introduction of our proposals may be able to be implemented through these BAU processes; and, • When DPC agreements began being shared with CRAs, which involved a significant volume of data on a new type of product, industry worked to mitigate any disruptive impacts on model performance. They would be likely to do so again if model performance issues were to materialise after the implementation of our proposals. 161. More broadly, any short-term disruption of this sort will be countervailed by improvements to models in the longer term, with firms benefiting in the ways described in the ‘Benefits to firms’ section below. Nonetheless, we propose to monitor this issue and we will liaise with the PRA as appropriate. Potential impacts on CRA revenues 162. If lenders and other credit information users reduce their total expenditure on DCCRAs’ data and products because the credit information they can obtain from each DCCRA is more consistent and comprehensive (see paragraphs 199 to 202 below), DCCRAs’ revenues will be lower. However, access to more consistent and comprehensive data will

84 offer DCCRAs new opportunities for competition and innovation, which could provide new revenue opportunities and offset any such loss in revenue. 163. Similarly, if our proposals mean that lenders and other credit information users make less use of non-DCCRAs than they otherwise would, non-DCCRAs will experience lower revenues as an indirect cost of our proposals. As set out in the ‘Competition assessment: competition impacts’ section above, however, our assessment is that our proposals will not materially alter the dynamics of competition between the 3 large CRAs (which we propose to designate) and smaller CRAs. Costs to the FCA 164. We do not expect significant costs to the FCA arising from the proposals considered in this CBA. Some FCA resource is likely to be required on an ongoing basis to supervise compliance with the proposals, to maintain the operation of the CRA designation framework (for instance, considering any representations from a CRA seeking designation), and to monitor the CRA designation and mandatory reporting frameworks. However, we expect that these activities can be absorbed by existing resources without any significant displacement and we do not consider that it is reasonably practicable to estimate any associated costs. Benefits 165. Our proposals will directly increase the quality, consistency and coverage of the credit information held by DCCRAs. We also expect improvements to the quality of credit information and DCCRA products through two indirect channels. Firstly, we expect that our intervention will lead to DCCRAs competing more intensely on the quality of their analytical products and matching techniques (see the ‘Competition assessment: competition impacts’ section above). Secondly, we expect that increases to the quality and volume of data supplied to each DCCRA will enhance the efficacy of the processes they use to match information they receive to the ‘right’ individual. This impact is likely to be greater for individuals who currently have ‘thin’ files than for those about whom the DCCRAs already hold larger amounts of information. 166. Together, these improvements to the quality and coverage of credit information and DCCRA products will improve firms’ ability to assess creditworthiness. 167. The remainder of this section presents our assessment of the resulting benefits to firms and consumers and provides estimates of the potential scale of these benefits. 168. There is likely to be some lag between our rules coming into force and these benefits materialising. The new data received into each DCCRA’s database is likely to begin offering insights to firms after it has been received for around 3 months, when trends and patterns of consumer behaviour will begin to be discernible. Any redevelopment and recalibration of scoring models needed in light of this new data by both DCCRAs and lenders is likely to take longer. This may require around 2 years of data as well as being subject to internal governance processes within firms and, in some cases, regulatory approval by the PRA.

85 Benefits to consumers Improved access to credit 169. We expect that our proposals will improve access to credit in aggregate. By increasing the quality and coverage of the credit information available at each DCCRA, our proposals will improve firms’ ability to assess creditworthiness. We expect that lenders will (all else equal) respond by increasing lending volumes in aggregate, since they will be able to do more lending for a given amount of credit risk. 170. Evidence from our survey of lenders supports this. We discuss this evidence further below; while firms responding to these survey questions may not be representative of the whole market, they are a diverse range of firms and collectively account for a substantial share of the market. Moreover, previous research (cited above) has found that more comprehensive credit information is associated with increased access to credit overall. However, the extent of this increase will vary across product types, lenders and consumers. The increase is likely to be greatest (in relative terms) for unsecured product types and product types where coverage is currently lowest, and amongst consumers who are at the margins of lending decisions or about whom little or no credit information currently held about them by at least one DCCRA. 171. Those who currently have ‘thin’ files or are ‘invisible’ could particularly benefit from improved access to credit as a result of our proposals. Some people have a ‘thin’ file or are ‘invisible’ because there is credit information about them but that information is not shared with all 3 large CRAs. Others do indeed have little or no (recent) financial history, for instance because they recently moved to the UK or recently became an adult. We expect that our proposals will help both groups. For the first group, our proposals will ensure their financial history is shared across all DCCRAs. For the second group, our proposals will mean that their credit files ‘thicken’ more quickly as they build up a financial history – since a higher proportion of any credit they take out will be reflected in their credit files at each DCCRA. Increased effectiveness of creditworthiness assessments 172. Lenders responding to our recent survey generally agreed that greater data coverage across DCCRAs would increase the effectiveness of their credit risk assessments. Just under half of respondents said that the extent to which this would happen was unknown without knowing the quantity, quality and nature of the any additional data. Of those that expressed a view on the magnitude of the increase, opinions were mixed. The most common position, and the position held by most of the largest lenders, was that the improvement was likely to be relatively modest – that is, more likely to be smaller than, rather than greater than, 10% – given CRAs’ high coverage at present. 173. Lenders also reported that greater data coverage across DCCRAs would improve their ability to assess affordability – particularly in relation to consumers’ total indebtedness. 174. Taken together, these findings indicate that lenders expect our proposals to increase their ability to assess creditworthiness – though DCCRAs’ existing high coverage means that this increase is unlikely to be transformative in magnitude.

86 Increased lending volumes in response to an improved ability to assess creditworthiness 175. Nearly half (45%) of lenders responding to our survey reported that an improved ability to assess creditworthiness would see them extend more credit in aggregate. These lenders collectively accounted for over 50 million outstanding consumer credit agreements and mortgages, which is two-thirds of the total held by lenders responding to our survey and around a quarter of the market-wide total. One large lender suggested that the impact was likely to be limited to unsecured lending and that there was likely to be little impact for mortgages. Several lenders suggested they would be likely to extend more credit to those who currently have ‘thin’ files. 176. However, a similar number of lenders, including some major ones, said that an improved ability to assess creditworthiness because of greater coverage at DCCRAs would not affect their lending volumes. These lenders generally said that their lending volumes depended on factors such as their strategy, risk appetite, and the markets they operated in, rather than CRA coverage and its effect on their ability to assess creditworthiness. Only a small number of lenders (10%) said they would extend less credit in aggregate, because they would have sight of a greater volume of negative information (to the extent this occurs, this may be positive if the avoided lending would have been unaffordable and only extended because of a lack of information). Illustrative calculations 177. It is not reasonably practicable to estimate the expansion in access to credit that would result from our proposals. This is because: • Lending decisions are complex and lending criteria vary across lenders. Lenders often use credit information from CRAs together with data and information from other sources as part of complicated algorithms; • Lenders will have different options for how to respond to an improved ability to assess creditworthiness. They could choose to increase lending volumes while maintaining the same number of ‘bad’ loans they extend, to maintain lending volumes while reducing the number of ‘bad’ loans they extend, or to do something in the middle of the two (i.e., to increase lending overall while reducing the number of ‘bad’ loans, but with each of those two changes being smaller than in the other two scenarios); • The extent of the improvement in lenders’ ability to assess creditworthiness as a result of our proposals will vary substantially across lenders, products and populations of consumers; and, • Lending volumes are subject to other important influences, such as consumer behaviour and macroeconomic conditions. 178. However, we provide here some illustrative calculations of the value of additional credit that would be extended if our proposals increased the amount of various types of credit extended by different percentages. 179. A firm responding to our firm survey reported it had estimated, with a generic sample, that using credit information that reflected all the possible data being supplied to CRAs would allow it to improve the predictive power of its models to an extent that would

87 support an increase in the lending acceptance rate of 3% without an increase in the number of ‘bad’ loans extended. This is broadly consistent with the magnitude of the improvement in their ability to assess creditworthiness that firms responding to our survey in general estimated would result from greater data coverage across DCCRAs (see paragraph 172 above). As the firm noted, however, the size of such impacts will vary significantly across models and populations of consumers. Impacts will be concentrated where new information becomes available on consumers about whom lending decisions were previously marginal and greater in cases where the additional data is relevant to the lending decision in question (for instance, additional data on credit card portfolios would have a larger impact on credit card models than on other models). 180. Table 15 below summarises the additional value of credit that could be extended each year for certain product types if our proposals increased lending by 0.5%, 1%, 2% or the 3% from the firm’s modelling described above. We focus on unsecured lending since we expect the impact to be greater here than in the case of secured lending (e.g., mortgages). For the purposes of this illustration, we consider 3 types of fixed-sum unsecured lending offered by firms who said in their response to our firm survey that they would extend more credit in aggregate if they could better assess creditworthiness. We use data on new advances over a 12-month period, collected from regulated firms, to define the value of lending on which the uplift is calculated. 181. These figures are not predictions or forecasts of the exact impact of our proposals. Rather, they demonstrate that – due to the huge size of consumer credit markets – even uplifts in the volume of certain types of credit extended that are small in relative terms can be very large in absolute terms. This is true even when one does not consider any impacts on some of the largest forms of credit, such as overdrafts, credit cards and mortgages. Table 15: Illustration of the magnitude of different percentage uplifts in the value of credit advanced each year for various forms of unsecured consumer credit 0.5% 1% 2% 3% High-cost short-term credit £1.7m £3.4m £6.7m £10.1m Cash loans £145.5m £291.0m £582.0m £873.0m Finance for goods and services other than mobile phones, motor vehicles and insurance premiums £34.8m £69.5m £139.1m £208.6m Note: figures rounded to the nearest £100,000. By ‘high-cost short-term credit’, we mean cash loans that meet the definition of high-cost short-term credit. By ‘cash loans’, we mean cash loans that do not meet the definition of home credit loan agreements or high-cost short-term credit, that are not pawnbroking agreements (i.e. where the lender does not take an article in pawn), and that are not offered by lenders who have been identified as offering cash loans solely to borrowers intending to use the cash loans for business purposes. Lastly, by ‘finance for goods and services other than mobile phones, motor vehicles and insurance premiums’, we mean borrower-lender￾supplier agreements for fixed-sum credit excluding those to pay for motor vehicles, mobile phones, premiums for general insurance contracts, rent-to-own agreements or direct alternatives, and those for which the lenders have not been identified as offering finance agreements solely to borrowers intending to use the finance agreements for business purposes. Source: FCA calculations using data on lending volumes collected from regulated firms.

88 Reduced unaffordable lending 182. We expect that consumers will benefit from a reduction in unaffordable lending as a result of our proposals, as lenders will have a more comprehensive picture of consumers’ financial circumstances. Lenders responding to our recent survey reported that our proposals would enhance their ability to assess affordability, especially by giving them a more accurate indication of consumers’ total indebtedness. Lenders will therefore be able to avoid extending some credit that they would extend given current credit information but that consumers cannot afford. 183. Preventing unaffordable lending will improve the wellbeing of the affected consumers – for instance, by avoiding the stress associated with unaffordable debt. Other research on the wellbeing impact of debt indicates that this benefit will be significant for affected consumers. For instance, previous research commissioned by the FCA has estimated the change that entering arrears causes in consumers’ subjective wellbeing. Combining the findings of this research with supplementary guidance to the Treasury's Green Book on monetising the value of these wellbeing effects, we estimate that entering arrears has a negative impact on household wellbeing worth around £13,100 (in 2024 prices and with 2024 incomes).1 184. FLS 2024 found that 3.0 million adults had missed one or more credit or loan, or mortgage, payments in the 6 months to May 2024. It is not reasonably practicable to estimate the proportion of these adults who would have avoided going to arrears if our proposals had been in place. However, to illustrate the potential scale of the wellbeing benefits from avoided unaffordable lending, if we assume that our proposals would have meant that just 0.5% of these consumers avoided going into arrears, this implies a wellbeing benefit to them and their households of around £197 million. This demonstrates how even modest improvements in affordability assessments can have large benefits. 185. Preventing unaffordable lending means that some consumers will not receive credit where they currently may do, even though we expect access to credit to be improved in aggregate through our proposals. We discuss this in the ‘Costs to consumers’ section above. Better-informed pricing of credit 186. Consumers will benefit from lenders being able to more accurately price credit against risk as a result of our proposals. Lenders often set the cost of credit with reference to their assessment of the borrower’s riskiness, as well as several other factors. Our proposals will give lenders a more comprehensive picture of consumers’ financial standing, allowing them to more accurately assess prospective borrowers’ riskiness and set prices accordingly in line with their own policies. 1 In particular, we take the central estimate of consumers’ willingness to pay (WTP) for one wellbeing adjusted life year (‘WELLBY’) from the Green Book supplementary guidance: £13,000 in 2019 prices and values. We use ONS data on (real) GDP per capita and GDP deflators to uprate this to 2024 prices and values, giving a WTP for 1 WELLBY of around £16,000 (note that this differs slightly from the value used in the CBA in CP25/23, reflecting the use of more recent ONS data released since CP25/23 was published). Following the research we commissioned from Oxford Economics, we treat entering arrears as a household good or outcome – that is, we assume that changes in wellbeing from entering arrears accrue to all adult members of the household – and multiply this WTP by 2 (i.e. assuming that the average number of adults in a household is 2). We then multiply the resulting figure by the estimated coefficient of entering arrears on life satisfaction, -0.41.

89 187. Some consumers will face higher interest rates if more comprehensive credit information increases their assessed level of risk. Others will face lower interest rates. It is fairer, however, for consumers if any risk-based pricing that lenders choose to adopt is based on more accurate risk assessments. 188. Moreover, we expect our proposals to put downward pressure on the cost of credit in general by stimulating price competition between lenders and between DCCRAs (see the ‘Competition assessment: competition impacts’ section above), and by allowing lenders to achieve cost savings by enabling efficiencies in creditworthiness assessments (see paragraphs 199 to 202 below). 189. It is not reasonably practicable to quantify this benefit, since pricing decisions are complex and draw on a range of information and data beyond just credit information from CRAs. The magnitude of this effect will also vary substantially across lenders and products. Greater choice 190. Consumers are likely to benefit from greater choice in the credit products available to them as a result of our proposals. As firms will have more information on consumers, firms will be better able to group consumers according to their risk profiles and other characteristics. Some firms will respond by offering a broader range of products. 191. In our recent firm survey, around a quarter of respondents – including large banks and other large lenders – said that being better able to assess creditworthiness would mean that they would offer a broader range of products. However, around half of respondents said they would not make such a change, since the breadth of their product offering depended on other factors such as their strategy and risk appetite. 192. It is not reasonably practicable to quantify this benefit because of a lack of evidence on the value consumers would place on greater choice of credit products, and uncertainty on the precise extent to which firms would broaden their product offering as a result our proposals. Reduced confusion 193. Finally, our proposals will avoid consumers being confused because a reportable credit agreement is present in their credit file with one DCCRA but not with another. They are also likely to reduce the frequency with which consumers encounter errors on their credit files. These changes should help consumers to better understand their credit files. However, our proposals will not be a panacea in this regard. Credit information is complex, and our proposals will not remove all errors and differences in consumers’ credit files across DCCRAs. 194. It is not reasonably practicable to quantify this benefit since it is not reasonably practicable to quantify the number of instances of confusion that will be avoided or their value.

90 Benefits to firms Increased revenues from lending 195. By allowing them to better assess creditworthiness, our proposals will allow lenders to extend more credit without increasing, and potentially while reducing, their risk exposure. We therefore expect firms to extend more credit, in aggregate, as a result of our proposals (see paragraphs 169 to 181). Firms will benefit from greater revenues associated with this increased lending activity. 196. It is not reasonably practicable to quantify this benefit for the reasons set out in paragraph 177 above. Nonetheless, Table 15 above illustrates how this benefit could be large in magnitude even if the relative increase in lending is small. 197. The margins lenders make on loans vary by lending product, so the profit associated with such increases in revenues from lending will depend on which products they are concentrated in. Reduced loss provisioning and losses from ‘bad’ loans 198. To the extent that lenders use their enhanced ability to assess creditworthiness to reduce the number of ‘bad’ loans they extend, they will benefit from reduced losses from ‘bad’ loans and a reduced need to provision for such losses. It is not reasonably practicable to estimate the extent of these benefits for the reasons set out above. The savings to firms could be appreciable, however, given the scale of these provisions; for instance, amongst respondents to the DPC firm survey for CP25/23, provisions for non￾payment and fraud were £78m in 2023 and accounted for 25-30% of their revenue from merchant fees from 2021-2023. Cost savings from efficiencies in creditworthiness assessments 199. We expect lenders to benefit from cost savings arising from efficiencies that our proposals will facilitate in creditworthiness assessments. Lenders who currently use multiple CRAs are the most likely to realise these savings. 200. As lenders will be able to access more comprehensive credit information from a single CRA, they will need to refer to manual underwriting or conduct a search at a second or third CRA will be for a lower proportion of applications and will therefore avoid some of the associated costs. To the extent that lenders choose to end their relationships with second or third CRAs entirely, these cost savings will be greater. Responses to our lender survey indicated that this is likely to be less common than firms retaining relationships with multiple CRAs but making fewer searches with secondary or tertiary ones, since firms maintain contracts with multiple CRAs for reasons other than just differences in coverage, especially operational resilience. 201. It is not reasonably practicable to quantify the extent of these cost savings because their scale depends on individual lenders’ decisions about how to use CRAs after the introduction of our proposals given their own circumstances. However, responses to our 2024 survey offer some evidence as to their scale. Around 40% of respondents

91 to our lender survey reported that higher and more consistent coverage of data from FSMA-regulated data contributors across DCCRAs would reduce the cost to them of making creditworthiness assessments. Most of these firms expected this to be a slight reduction rather than a significant one. Just over half of respondents expected no change in the cost to them of assessing creditworthiness. Amongst those who justified their response, most of these firms said that when assessing creditworthiness they either only use 1 CRA currently or do not use CRAs at all. 202. To the extent that lenders achieve cost savings by reducing their expenditure on CRA data and products for use in creditworthiness assessments, this represents a transfer from CRAs to lenders (since any cost saving to lenders would be matched by a loss in revenue for CRAs). Nonetheless, such savings for lenders could benefit consumers through reductions in the cost of credit or greater innovation. Benefits outside creditworthiness assessments 203. Lastly, we expect firms to benefit from more effective CRA products and services in areas other than creditworthiness assessments, such as ID verification and KYC/AML checks. As in the case of creditworthiness assessments, our proposals will improve these products and services directly by increasing the amount of data shared with each DCCRA as well as indirectly through their impacts on the efficacy of DCCRAs’ matching processes and on competition between DCCRAs. Improvements to products and services used in ID verification and KYC/AML checks will help to prevent fraud and other forms of financial crime. 204. It is not reasonably practicable to quantify this benefit because of a lack of quantitative evidence and because there will be variation between credit information users in how they use products and services from CRAs in their ID verification and KYC/AML checks. Potential unintended consequences 205. In this section, we consider potential unintended consequences of our proposals and assess their likelihood. 206. One potential unintended consequence of this intervention would be if it led some firms to stop, or not begin, sharing with DCCRAs altogether to avoid being subject to the mandatory reporting requirement. If this were to happen to a significant degree, this could reduce the amount of data being shared with the DCCRAs and undermine the policy’s aim of improving the coverage of credit information. However, we do not consider that this is likely. We expect that the additional cost of sharing with all designated DCCRAs relative to sharing with just 1 or 2 of them to be relatively modest. Meanwhile, the PoR mean that firms must share credit information with a CRA in order to access it. Given the utility of credit information to firms, we think that most firms will accept the relatively modest costs of any additional sharing that our intervention requires of them in order to access that data. Our proposed commencement provisions also provide firms who begin sharing with a DCCRA after the rules are commenced with a lead-in time before the mandatory reporting requirement applies to them, reducing any disincentive to begin sharing because of our rules.

92 207. Another potential unintended consequence of our intervention would be if increased costs of sharing credit information were to create a barrier to entry to retail lending markets or cause some smaller firms to exit the market. We do not expect this to happen to a significant extent, for two reasons. Firstly, our proposed approach to the mandatory reporting requirement means that the many small lenders who do not report to any DCCRAs will not be subject to mandatory reporting. Secondly, we expect the costs of our proposals to be relatively modest for each affected firm. 208. Finally, we have considered whether these proposals would have unintended impacts on the development of creditworthiness solutions based on open banking or open finance data. Open banking data has been a source of innovation particularly in relation to affordability assessments, and open finance may further spur innovation in credit risk and affordability assessments in the future. We do not think that our proposals will be an obstacle to such innovation. Nothing in our proposals prevents firms from using open banking or open finance data, either as a complement to or a substitute for ‘traditional’ credit information, if they find it useful. If a firm wished to cease using CRA data and sharing with CRAs in order to use solutions based on open banking or open finance data, our proposals would not prevent them from doing so. Wider economic impacts, including on secondary objective 209. We expect these proposals to support the productivity and international competitiveness of the UK’s financial services sector, through the following channels: • Well-functioning markets – by enhancing the availability of accurate and consistent credit information, we expect our proposals to improve the functioning of retail lending markets by enabling better-informed decisions by lenders. • Effective competition – we expect, for the reasons set out above, these proposals to enhance competition between DCCRAs and to stimulate competition in retail lending markets. • Innovation – greater competition between DCCRAs on dimensions other than coverage of regulated agreements and between retail lending firms will encourage innovation, offering benefits for firms using credit information and for consumers. • Regulatory efficiency – we consider that our proposals represent a proportionate way of achieving the changes we want to see in the market and go with the grain of existing market dynamics. 210. We also expect that these proposals would tend to support the UK economy’s growth through their impact on the real economy. We expect that our proposals would improve access to affordable credit and thereby stimulate consumption by households. The magnitude of this impact is uncertain. We have, though, illustrated above how even small relative increases in the amount of credit extended can be large in absolute value. We also expect that our proposals would improve the allocation and management of risk in the economy, since lenders would be better able to assess risk.

93 Monitoring and evaluation 211. We propose that we would monitor the impact of our proposed interventions using the information we propose to collect from DCCRAs under CIMS remedy 2C, our data returns covering the consumer credit and mortgage markets, and the FLS. 212. The FLS will allow us to monitor the prevalence of errors in consumers’ credit files and how quickly they are being resolved, providing insights on the impacts of our proposed data contributor requirements. The FLS will also allow us to monitor consumers’ access to regulated credit and the proportion of consumers who are over-indebted, though we would not be able to attribute changes to our proposals causally. 213. The information we propose to collect from DCCRAs would provide us with insights on the operation of, and compliance with, the mandatory reporting regime. It would provide us with information on the coverage and quality of data being shared through the regime, as well as other key issues in the market such as the efficacy of matching techniques. 214. The information we propose to collect from DCCRAs and regulatory returns for consumer credit and mortgages would help us to monitor if the risks discussed in the ‘Potential unintended consequences’ section above (for instance, around firms stopping data sharing with DCCRAs altogether) are materialising. Question 36: Do you have any comments on our cost benefit analysis? Question 37: Do you agree with the assumptions made in our cost benefit analysis? Question 38: Are there any significant costs or benefits that we did not adequately consider in our cost benefit analysis?

94 Annex 3 Compatibility statement

1. This Annex records the FCA’s compliance with a number of legal requirements applicable to the proposals in this consultation, including an explanation of the FCA’s reasons for concluding that our proposals in this consultation are compatible with certain requirements under the Financial Services and Markets Act 2000 (FSMA).
2. When consulting on new rules, the FCA is required by s138I(2)(d) of FSMA to include an explanation of why it believes making the proposed rules (a) is compatible with its general duty, under s1B(1) of FSMA, so far as reasonably possible, to act in a way which is compatible with its strategic objective and advances one or more of its operational objectives, (b) so far as reasonably possible, advances the secondary international competitiveness and growth objective, under s1B(4A) of FSMA, and (c) complies with its general duty under s1B(5)(a) of FSMA to have regard to the regulatory principles in s3B of FSMA. The FCA is also required by s138K(2) of FSMA to state its opinion on whether the proposed rules will have a significantly different impact on mutual societies as opposed to other authorised persons.
3. This Annex also sets out the FCA’s view of how we are advancing the FCA’s competition objective. The competition duty in s1B(4) of FSMA does not therefore apply.
4. In addition, this Annex explains how we have considered the recommendations made by the Treasury under s1JA of FSMA about aspects of the economic policy of the government to which we should have regard in connection with our general duties.
5. This Annex includes our assessment of the equality and diversity implications of these proposals.
6. Under the Legislative and Regulatory Reform Act 2006 (LRRA) the FCA is subject to requirements to have regard to a number of high-level ‘Principles’ in the exercise of some of our regulatory functions and to have regard to a ‘Regulators’ Code’ when determining general policies and principles and giving general guidance (but not when exercising other legislative functions like making rules). This Annex sets out how we have complied with requirements under the LRRA. The FCA’s objectives and regulatory principles: compatibility statement
7. The proposals set out in this consultation are primarily intended to advance the FCA’s operational objective of protecting consumers. They are also relevant to the FCA’s operational objective of promoting effective competition in the interest of consumers and protecting the integrity of the UK financial system.

95 Consumer protection objective 8. The FCA’s consumer protection objective is to secure an appropriate degree of protection for consumers. In the development of the proposals in this CP, we have had regard to the matters listed in s1C(2)(a)-(h) of FSMA. We consider that our overall approach, comprising new rules and guidance and reliance on the Duty where possible, delivers an appropriate degree of consumer protection. 9. Credit information helps consumers to access regulated credit and other products, and is used by a large variety of firms, both in retail lending markets and beyond, for a range of different purposes, from creditworthiness assessments to identity verification, amongst other purposes. 10. We consider that enhanced consumer credit information will help protect consumers from unaffordable credit, aid appropriate access to credit with better informed pricing through greater visibility of consumers’ repayment history and have a positive impact on tackling financial crime. Market integrity objective 11. We consider these proposals are compatible with the FCA’s strategic objective of ensuring that the relevant markets function well as they aim to increase trust in the market and improve market efficiency. For the purposes of the FCA’s strategic objective, “relevant markets” are defined by s1F FSMA. 12. Improving the quality of consumer credit information could help to ensure users have access to sufficiently comprehensive, accurate and up-to-date credit information. This would enable those who use it to make effective assessments of credit risk and affordability, resulting in increased trust in the market and enhanced market efficiency through reducing consumer credit information asymmetry between lenders. This would unlock improved outcomes for consumers and firms and result in a more efficient retail lending market. Competition objective 13. The FCA’s competition objective is to promote effective competition in the interests of consumers in the markets for regulated financial services. As we have developed the proposals in this CP, we have had regard to the matters listed in sections 1E(2)(a)- (e) of FSMA on promoting competition. Overall, we believe our approach is advancing this objective. 14. We consider that our proposals will encourage innovation by DCCRAs and increase competition between them in areas other than coverage of reportable agreements, such as the value-add of analytical products. We do not expect our proposals to materially add to existing barriers to entry and expansion in the credit information market. 15. We also believe our proposed measures will increase competition between DCCRAs by focusing on service standards and innovation rather than on the coverage of the consumer credit information that they hold.

96 16. Moreover, as we set out in paragraphs 125-128 of our CBA (Annex 2) we expect that our proposals will promote greater competition in retail lending markets by levelling the playing field between larger and smaller lenders (allowing smaller lenders to more easily access more comprehensive credit information and compete more effectively with their larger counterparts). The Treasury’s post-implementation review of the Commercial Credit Data Sharing (CCDS) scheme found that mandating data sharing was successful in increasing competition in SME lending markets. We expect similar benefits to arise in retail lending markets under our proposed policy. 17. We set out our assessment of the current state of competition in the consumer credit information market and of the impact of our proposals on competition in the credit information market and retail lending markets in our CBA in Annex 2. Secondary international competitiveness and growth objective 18. We consider our proposals advance the FCA’s secondary international competitiveness and growth objective, as set out in s1B(4A) FSMA. 19. As we set out above, we expect our proposals to stimulate competition and innovation in both the credit information market and retail lending markets. This in turn will support the productivity and international competitiveness of the UK financial services sector. 20. Our proposals align with the FCA’s 2025-2030 strategy, aiming to support growth, help consumers and fight crime. Together with industry remedies and reformed governance arrangements, our proposals will secure significant advances in modernising and making the UK consumer credit information market more efficient and effective. Moreover, we expect our proposals to an extent to increase the aggregate volume of affordable credit provided while broadening access. This would facilitate increased consumer consumption and contribute to economic growth. The FCA’s regulatory principles 21. In preparing the proposals set out in this consultation, the FCA has had regard to the regulatory principles set out in s3B FSMA. The need to use our resources in the most efficient and economic way 22. We are only seeking to introduce new Handbook rules where we think they are necessary and appropriate. In line with our commitment to the Prime Minister in January 2025, we have considered where we may be able to rely on the Consumer Duty in place of new rules. Our view is that we cannot rely solely on the Consumer Duty. Rules and guidance are necessary to effectively deliver Remedies 2A and 2D, given the need for consistent, market-wide approaches to the issues identified. 23. At this time, we do not propose to consult on new Handbook rules under Remedy 3A. Relevant firms should already be considering how best to signpost consumers to SCRs under the consumer understanding and support outcomes of the Consumer Duty.

97 24. Our proposals have been crafted to ensure that where information is shared, it is accurate and appropriate measures are in place to deal with errors quickly and efficiently. We expect that these clear expectations will help ensure our supervisory resources are used efficiently. The principle that a burden or restriction should be proportionate to the benefits 25. We have considered the impact of our proposals on both firms and consumers. We have undertaken a cost-benefit analysis which is included in Annex 2 of this CP. Our analysis indicates that the benefits of our proposals for both firms and consumers are likely to be substantial. These include (but are not limited to) increased access to appropriate credit, a reduction in unaffordable lending and the associated costs to lenders, efficiencies in creditworthiness assessment processes, and improvements in competition and innovation in the credit information market and retail lending markets. As a result, we consider the costs of our proposals to be proportionate to their benefits for firms and consumers. The need to contribute towards achieving compliance by the Secretary of State with section 1 of the Climate Change Act 2008 (UK net zero emissions target) and section 5 of the Environment Act 2021 (environmental targets) 26. In developing this Consultation Paper, we have considered the environmental, social and governance (ESG) implications of our proposals and our duty under ss.1B(5) and s.3B(1) (c) of FSMA to have regard to contributing towards the Secretary of State achieving compliance with the net-zero emissions target under section 1 of the Climate Change Act 2008 and environmental targets under s.5 of the Environment Act 2021. Overall, we do not consider that the proposals are relevant to contributing to those targets. We will keep this issue under review during the consultation and when considering whether to make the final rules. The general principle that consumers should take responsibility for their decisions 27. We consider that improved coverage and accuracy of credit information will enable consumers to assess their own financial position more effectively, thereby enabling them to make better decisions regarding their engagement with retail lending markets. The responsibilities of senior management 28. Relevant senior management will need to ensure that firms comply with our proposed rules, having regard to their responsibilities under the senior managers and certification regime (SMCR) which has applied to all FCA-authorised firms since 9 December 2019.

98 The desirability of recognising differences in the nature of, and objectives of, businesses carried on by different persons including mutual societies and other kinds of business organisation 29. We recognise that the credit information and retail lending markets are diverse, with firms of different sizes and with different levels of resources. Our approach to the mandatory reporting requirement ensures that firms retain discretion on whether to share credit information with DCCRAs in the light of their commercial strategies and incentives. Our proposals are designed to be proportionate, providing clarity and certainty for firms in the regulated credit and mortgage sectors, CRAs and others. We do not consider that our proposals will adversely impact a subset of businesses. The flexibilities contained within our proposals recognise that different businesses may benefit from different approaches. The desirability of publishing information relating to persons subject to requirements imposed under FSMA, or requiring them to publish information 30. Consumer credit information does not constitute information relating to persons subject to requirements imposed under FSMA, and therefore we do not expect that our proposals will result in firms publishing information regarding persons subject to requirements imposed under FSMA. The principle that we should exercise of our functions as transparently as possible 31. In developing these proposals, we have acted as transparently as possible. Throughout the market study and more recently, we have engaged extensively with participants in the credit information market, including CRAs, credit/mortgage firms as well as parties who represent the interests of consumers. We have also attended some of our statutory panels (the Consumer Panel and the Smaller Business Practitioner Panel) for views on our proposals. Financial crime 32. In formulating these proposals, the FCA has had regard to the importance of taking action intended to minimise the extent to which it is possible for a business carried on (i) by an authorised person or a recognised investment exchange; or (ii) in contravention of the general prohibition, to be used for a purpose connected with financial crime (as required by s1B(5)(b) FSMA). 33. We consider that our proposals will have a positive impact with regard to tackling financial crime. Enhanced coverage of credit information would increase the likelihood of consumers being aware if credit is fraudulently taken out in their name. Reducing instances of ‘thin’ credit files may also improve the reliability of identity verification products offered by DCCRAs, which could indirectly reduce financial crime.

99 Expected effect on mutual societies 34. The FCA does not expect the proposals in this paper to have a significantly different impact on mutual societies. We consider that these proposals would broadly impact mutual societies in the same way as any firm where the mutual society is engaged in relevant regulated activities and therefore our view is that our proposals do not present them with any more or less of a burden than other providers of regulated agreements. Compatibility with the duty to promote effective competition in the interests of consumers 35. As set out above, the competition duty in s1B(4) of FSMA does not apply as we are advancing the competition objective. Equality and diversity 36. We are required under the Equality Act 2010 in exercising our functions to ‘have due regard’ to the need to eliminate discrimination, harassment, victimisation and any other conduct prohibited by or under the Act, advance equality of opportunity between persons who share a relevant protected characteristic and those who do not, and foster good relations between people who share a protected characteristic and those who do not. As part of this, we have considered how our proposals may affect equality and diversity. Overall, we do not consider that the proposals directly impact any of the groups with protected characteristics under the Equality Act 2010 (in Northern Ireland, the Equality Act is not enacted but other anti-discrimination legislation applies). 37. We do not think our proposals will have a negative impact on those with protected characteristics. We do not consider that the policy will have a direct positive impact on persons sharing a protected characteristic, although it will be positive for consumers generally. We consider that it is possible that our policy benefits groups of consumers who are at an increased likelihood of having certain protected characteristics, such as those with a ‘thin’ credit file, but we consider that those links are too indirect to constitute a positive impact on those with a protected characteristic specifically. 38. However, the demographic characteristics of those likely to be considered ‘invisible’ or with a ‘thin’ credit file, who are likely to benefit from our proposals, include both consumers in younger age groups with limited credit history, and older cohorts of consumers who are less likely to have recently relied on credit. This information is based on our Request for Information to firms and CRAs asking about the impact of our proposals on individuals with ‘thin’ credit files and ‘invisible’ individuals (those where no data exists). In addition, renters, lower income groups and those not able to engage with mainstream credit will likely benefit from our policy, and while these are not themselves protected characteristics for the purposes of the Equality Act 2010, these cohorts may contain a disproportionately higher number of individuals with protected characteristics, for example younger people and those with disabilities. Due to the indirect nature of the

100 link between these groups and those with protected characteristics, we do not consider that we have sufficient evidence to consider that these policies will benefit persons with legally protected characteristics directly more so than consumers without protected characteristics. We consider that the overall impact of our policy will be positive for consumers, enhancing their ability to access credit products. 39. We will keep this under review during the consultation and when considering whether to make the final rules. Further specified matters to which the FCA must have regard – remit letter 40. We have had regard to the Treasury’s November 2024 remit letter. Our view is that our proposals support the recommendations in the remit letter in particular through supporting growth, enabling informed and responsible risk-taking and in helping to tackle financial crime. Legislative and Regulatory Reform Act 2006 (LRRA) 41. We have had regard to the principles in the LRRA for the parts of the proposals that consist of general policies, principles or guidance and consider that our proposals are proportionate and result in an appropriate degree of consumer protections when balanced with their impact on firms and competition. • Transparent – We are consulting on our proposals with industry and the market. We have engaged with stakeholders over a sustained period of years to inform the proposals in this CP, which forms the culmination of our work on the Credit Information Market Study, and will continue our discussions with them ahead of finalising our rules, including through CIGB. • Accountable – We are acting within our statutory powers and will publish final rules after we have considered feedback on the proposals outlined in this CP, and any other views that we receive from our engagement with stakeholders. • Proportionate – Our proposals aim to introduce proportionate rules to improve the coverage and accuracy of consumer credit information. We are seeking an outcomes-based approach which enables firms to continue to make commercial decisions regarding whether to report credit information or not, while aiming to enhance outcomes for consumers through broader reporting of credit information. • Consistent – Our proposals will result in greater similarity in consumer credit information held between DCCRAs, which we anticipate would result in better consumer outcomes when engaging with retail lending markets. • Targeted only at cases in which action is needed – We think that our proposals are targeted towards using Handbook rules only where necessary to deliver the required outcomes. We believe that our approach to the mandatory reporting requirement ensures that firms will retain an appropriate degree of optionality.

101 42. We have had regard to the Regulators’ Code for the parts of the proposals that consist of general policies, principles or guidance and consider that our proposals are consistent with the principles of the code. We believe that our proposals constitute a proportionate approach to resolving the issues we have identified in the consumer credit information market which will deliver significantly better outcomes for both consumers and firms, while allowing firms to retain some flexibility.

102 Annex 4 Glossary Glossary of terms used in this document. Term Description Affordability assessment Assessment of a customer’s ability to make repayments without having a significant adverse impact on the customer’s financial situation. Consumer credit information The types of data that firms must share with DCCRAs when they are subject to the mandatory reporting requirement. County Court Judgment (CCJ) / Decree A County Court Judgment (CCJ) (used in England, Wales and Northern Ireland) and a Decree (the Scottish equivalent) are forms of public court judgments issued when a claimant takes legal action against a debtor for nonpayment of a debt. Credit file The information that a CRA holds about an individual related to their financial standing. Credit information service provider (CISP) Provider of credit information services to consumers. Credit reference agency (CRA) An entity providing credit references. Creditworthiness assessment A lender’s assessment of credit risk (to the firm) and affordability for the borrower. Current Account Turnover (CATO) data CATO data refers to certain information on account turnover derived from consumers’ personal current accounts shared with certain CRAs. Data contributor Provider of data (relevant to an individual’s financial standing) to a CRA. Typically includes lenders and non-financial services firms. Data quality Coverage, accuracy and timeliness of credit information. Deferred payment credit (DPC) The type of product sometimes referred to as buy-now pay￾later. Designated consumer credit reference agency (DCCRA) A DCCRA is a CRA that the FCA will formally designate through Handbook rules. Once designated, firms who share consumer credit information on reportable agreements with one of the DCCRAs, must share that information with all DCCRAs. Designated credit reference agency (CRA) A CRA designated for the purposes of regulation 9 of the Small and Medium Sized Business (Credit Information) Regulations.

103 Term Description First-time provider firm A firm that begins sharing consumer credit information with any DCCRA for the first time after the new rules come into force. Notice of Correction (NoC) A NoC is a short statement that a consumer can require a CRA to add to their credit file under section 159 of the Consumer Credit Act 1974, where the consumer believes an entry on their credit file is incorrect and may cause them prejudice. Open banking A secure way for customers to control their banking data and share it with organisations other than their own bank. Permitted use High-level requirements that set out the purposes for which consumer credit information may be used when it is shared between firms and DCCRAs under the mandatory reporting framework. Principles of Reciprocity (PoR) Industry rules and guidelines that govern how data contributors, data users and credit reference agencies share and access credit information. Receiving firm A firm that acquires or takes over reportable agreements that another firm (the transferring firm) has transferred. Reportable agreement An agreement that is a type of agreement listed within the scope of the mandatory reporting requirement, relates to specific regulated activities and where the customer is a consumer. Statutory credit report Credit file information available for free through a statutory process. Transferring firm A firm that transfers its reportable credit agreements to another firm, and as a result, stops sharing consumer credit information on those agreements.

Appendix 1 Draft Handbook text

FCA 202X/YY DESIGNATED CONSUMER CREDIT REFERENCE AGENCIES INSTRUMENT 202X Powers exercised A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the following powers and related provisions in the Financial Services and Markets Act 2000 (“the Act”): (1) section 137A (The FCA’s general rules); (2) section 137T (General supplementary powers); and (3) section 139A (Power of the FCA to give guidance). B. The rule-making powers listed above are specified for the purposes of section 138G(2) (Rule-making instruments) of the Act. Commencement C. This instrument comes into force on [12 months after the date the final rules are published]. Amendments to the Handbook D. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes in this instrument listed in column (2) below. (1) (2) Glossary of definitions Annex A Principles for Businesses (PRIN) Annex B Mortgages and Home Finance: Conduct of Business sourcebook (MCOB) Annex C Consumer Credit sourcebook (CONC) Annex D Making the Designated Consumer Credit Reference Agencies sourcebook (DCCRA) E. The FCA makes the rules and gives the guidance in accordance with Annex E to this instrument. F. The Designated Consumer Credit Reference Agencies sourcebook (DCCRA) is added to the Specialist sourcebooks block within the Handbook, immediately after the Consumer Credit sourcebook (CONC). Notes G. In the Annexes to this instrument, the notes (indicated by “Editor’s note:”) are included for the convenience of readers but do not form part of the legislative text.

FCA 202X/YY Citation H. This instrument may be cited as the Designated Consumer Credit Reference Agencies Instrument 202X. I. The sourcebook in Annex E to this instrument may be cited as the Designated Consumer Credit Reference Agencies sourcebook (DCCRA). By order of the Board [date] Page 2 of 31

FCA 202X/YY Annex A Amendments to the Glossary of definitions In this Annex, underlining indicates new text, unless otherwise stated. Insert the following new definitions in the appropriate alphabetical position. All the text is new and is not underlined. consumer any of the types of information listed in column (1) of the table below: credit information (1) Type of consumer credit information (2) Examples of what this may comprise Identification information Title, first name, surname, date of birth, address Account information Type of account, start date, end date Credit obligations Frequency of payments, expected payments, payments made, current balance, credit limit Full repayment history Payments made on time, late payments, whether the account is up to date or in arrears, how long the account has been in arrears Default information Default date, original default balance, default satisfaction date Forbearance information Arrangements, payments made DCCRA designated consumer credit reference agency first-time provider firm the Designated Consumer Credit Reference Agencies sourcebook. the credit reference agencies listed in DCCRA 2.1.1R. (in MCOB and CONC) a firm that: (1) has not provided any type of consumer credit information relating to any reportable agreement to any designated consumer credit Page 3 of 31

FCA 202X/YY reference agency between [date of publication] and [12 months after the date of publication]; and (2) provides any type of consumer credit information in relation to a reportable agreement to a designated consumer credit reference agency for the first time after [12 months after the date of publication]. reportable agreement (1) (in MCOB) an agreement which relates to any of the activities listed in MCOB 16.1.2R(1) and which is not excluded by MCOB 16.1.2R(2); (2) (in CONC) an agreement which relates to any of the activities listed in CONC 17.1.3R(1) and which is not excluded by CONC 17.1.3R(2). (3) in DCCRA, an agreement as described in (1) or (2). Amend the following definition as shown. data processing (in COBS 19.11 and DCCRA 2.2) has the same meaning as ‘processing’ in section 3(4) of the Data Protection Act 2018, which in relation to information, means an operation or set of operations which is performed on information, or on sets of information, such as: … Page 4 of 31

FCA 202X/YY Annex B Amendments to the Principles for Businesses (PRIN) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Rules about application … 3.2 What? … Principle 12 and PRIN 2A: additional application provisions … 3.2.8 R Subject to PRIN 3.2.7R, Principle 12 and PRIN 2A do not apply to activities to the extent that those activities are not included in a rule which sets out the scope of protections offered to retail customers by COBS, ICOBS, MCOB, BCOBS, CMCOB, FPCOB, PROD or, CONC or DCCRA. … Page 5 of 31

FCA 202X/YY Annex C Amendments to the Mortgages and Home Finance: Conduct of Business sourcebook (MCOB) In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. 1 Application and purpose … 1.2 General application: who? what? … Application of MCOB where agreements are facilitated by a P2P platform … 1.2.24 R In this section and in MCOB 15 and MCOB 16: … 1.2.25 G … Mandatory information sharing with designated consumer credit reference agencies 1.2.26 G MCOB 16 contains rules requiring certain firms to provide certain information to designated consumer credit reference agencies. A firm which has already elected to provide some consumer credit information to a designated consumer credit reference agency is required to provide all applicable consumer credit information to all of the designated consumer credit reference agencies, at least once per month. The firm can only cease doing so in certain prescribed situations (see MCOB 16.3). The firm is also required to ensure the accuracy of that information and to only use consumer credit information that it receives from a designated consumer credit reference agency for certain purposes. Correction of wrong information following a notice under section 159 of the CCA 1.2.27 G MCOB 16.6 requires a firm to investigate and to correct any information that is incorrect when it is informed by a credit reference agency that the agency has received a relevant notice under section 159 of the CCA. … Payment difficulties and repossessions: regulated mortgage contracts and home purchase plans Page 6 of 31 13

FCA 202X/YY 13.1 Application Who? 13.1.1 R This chapter applies to a firm in a category listed in column (1) of the table in MCOB 13.1.2R in accordance with column (2) of that table. Table: This table belongs to MCOB 13.1.1 R 13.1.2 R (1) Category of firm (2) Applicable section … … home purchase administrator, and a firm that was a home purchase administrator before the sale of a repossessed property As for a mortgage lender, plus: MCOB 13.6 and MCOB 13.8; and MCOB 13.4 and MCOB 13.5 in accordance with MCOB 13.8 P2P platform operator, where the firm is facilitating a home finance transaction in that capacity MCOB 13.9 … Insert the following new section, MCOB 13.9, after MCOB 13.8 (Home purchase plans). All the text is new and is not underlined. 13.9 Reporting satisfied county court judgments and decrees Application 13.9.1 R Subject to MCOB 13.9.2R, this section applies to a firm which is: (1) administering a home finance transaction; or (2) facilitating a home finance transaction as a P2P platform operator, in relation to a debt for which a judgment or decree has been obtained. Reporting requirement 13.9.2 R Where a firm to which this section applies becomes aware that the relevant judgment or decree has been satisfied, that firm must: Page 7 of 31

FCA 202X/YY (1) in relation to a judgment in England and Wales, notify the relevant court that the judgment has been satisfied by providing the court with proof of payment; (2) in relation to a decree in Scotland, provide original proof of payment to Registry Trust Limited along with the following information in writing: (a) the name and address the decree was recorded against; (b) the case number; (c) the name of the court; (d) the amount of the decree; and (e) the date that the debt was repaid in full; and (3) in relation to a judgment in Northern Ireland, provide original proof of payment to Registry Trust Limited along with the following information in writing: (a) the defendant’s name and address that the judgment was recorded against; (b) the case number; (c) the name of the court; (d) the amount of the judgment; and (e) the date that the debt was repaid in full. 13.9.3 R A firm must carry out the steps described in MCOB 13.9.2R as soon as reasonably practicable. 13.9.4 R In this section: (1) ‘court’ means: (a) in England and Wales and Northern Ireland, the county court or the High Court; and (b) in Scotland, the sheriff court or the Court of Session; (2) ‘judgment’ means any judgment or order of the court for a sum of money; (3) ‘Registry Trust Limited’ means the company of this name with registered company number 01896592; and (4) ‘satisfied’ means that the debt has been repaid in full. Page 8 of 31

FCA 202X/YY Insert the following new chapter, MCOB 16, after MCOB 15 (P2P home finance activities). All the text is new and is not underlined. 16 Consumer credit information 16.1 Application 16.1.1 R A rule in this chapter applies to Gibraltar-based firms, so far as the rule would have applied were it in effect before IP completion day. Application: mandatory reporting (reportable agreements) 16.1.2 R (1) Subject to (2), MCOB 16.2 to MCOB 16.5 apply to a firm with respect to: (a) home finance providing activity; (b) administering a home finance transaction; and (c) facilitating a home finance transaction as a P2P platform operator. (2) MCOB 16.2 to MCOB 16.5 do not apply to a firm with respect to any agreement where the customer is not a consumer. (3) An agreement which relates to any of the activities listed in (1) and which is not excluded by (2) is a reportable agreement. 16.2 Mandatory information sharing with designated consumer credit reference agencies Requirement to share consumer credit information 16.2.1 R Where a firm provides any type of consumer credit information relating to a reportable agreement to a designated consumer credit reference agency, it must comply with MCOB 16.2.2R. 16.2.2 R In relation to MCOB 16.2.1R, the firm must provide all the types of consumer credit information that it holds in relation to that reportable agreement to: (1) that designated consumer credit reference agency; and (2) all the other designated consumer credit reference agencies, subject to MCOB 16.2.4R. 16.2.3 R Where a firm has become subject to MCOB 16.2.2R, it must provide all types of consumer credit information that it holds in relation to that reportable agreement to all designated consumer credit reference agencies at least once per month. Page 9 of 31

FCA 202X/YY 16.2.4 R A first-time provider firm is not required to comply with MCOB 16.2.2R until 6 months after it first provides any type of consumer credit information relating to a reportable agreement to a designated consumer credit reference agency. 16.2.5 R A first-time provider firm is not required to comply with MCOB 16.2.2R where that firm: (1) provides consumer credit information in relation to a reportable agreement to a designated consumer credit reference agency for the first time; and (2) ceases providing that consumer credit information to that designated consumer credit reference agency within a period of 6 months. 16.2.6 G The effect of MCOB 16.2.5R is that a first-time provider firm can begin providing consumer credit information to a designated consumer credit reference agency, but if it then ceases doing so within a period of 6 months, it will not be caught by MCOB 16.2.2R. 16.2.7 G A first-time provider firm is subject to the requirements of MCOB 16.4 and MCOB 16.5 whenever it provides consumer credit information in relation to a reportable agreement to a designated consumer credit reference agency. 16.2.8 G The scenario described in MCOB 16.2.1R includes situations where the firm provides consumer credit information to more than one designated consumer credit reference agency. 16.3 Ceasing information sharing 16.3.1 R Where a firm becomes subject to the requirements in MCOB 16.2.2R or MCOB 16.2.3R, it may cease providing consumer credit information to designated consumer credit reference agencies in relation to any or all reportable agreements, subject to the requirements in MCOB 16.3.2R. Procedure when a firm ceases sharing consumer credit information 16.3.2 R When a firm intends to cease providing consumer credit information as described in MCOB 16.3.1R, it must: (1) as far as reasonably practicable, cease providing consumer credit information to all designated consumer credit reference agencies simultaneously; (2) take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by the cessation are minimised, in line with its obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty); Page 10 of 31

FCA 202X/YY (3) at least 2 months in advance of the earliest date that it will cease providing consumer credit information to any designated consumer credit reference agency, notify the FCA that it intends to cease; and (4) include within the notification in (3): (a) the date on which the firm will cease providing consumer credit information to each designated consumer credit reference agency; (b) a description of the reportable agreements in relation to which the firm will cease providing consumer credit information; and (c) the steps that the firm is taking to ensure it complies with (2). 16.3.3 G It may not be reasonably practicable for a firm to cease providing consumer credit information to all designated consumer credit reference agencies simultaneously if it has different arrangements with each one. MCOB 16.3.2R(3) and (4)(a) recognise this scenario, and MCOB 16.3.2R(4)(a) enables a firm to provide different cessation dates for each designated consumer credit reference agency in its notification. 16.3.4 G In relation to MCOB 16.3.2R(2), taking all reasonable steps may, for example, require the firm to resolve data disputes or mark accounts as closed or settled. 16.3.5 G With reference to MCOB 16.3.2R(3) and (4)(b), where a firm ceases providing consumer credit information in relation to multiple reportable agreements simultaneously, only one notification is required. 16.3.6 R MCOB 16.3.2R does not apply to: (1) a transferring firm within the meaning of MCOB 16.3.8R(1); and (2) a firm which ceases providing consumer credit information in accordance with MCOB 16.3.14R. 16.3.7 R Where a firm has ceased providing consumer credit information to at least one designated credit reference agency, and has complied with MCOB 16.3.2R, the mandatory reporting requirements in MCOB 16.2.2R and 16.2.3R no longer apply to it. Transfer of business 16.3.8 R MCOB 16.3.9R to MCOB 16.3.12R apply where a firm which is subject to MCOB 16.2.2R or MCOB 16.2.3R in respect of certain reportable agreements transfers those reportable agreements to another firm, whether as a consequence of insolvency, sale or other transaction. Accordingly: Page 11 of 31

FCA 202X/YY (1) ‘transferring firm’ refers to the firm originally subject to MCOB 16.2.2R or MCOB 16.2.3R, which transfers the reportable agreements; and (2) ‘receiving firm’ refers to the firm which acquires those reportable agreements. 16.3.9 R A transferring firm must take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by ceasing to provide consumer credit information are minimised. Transferring firms are reminded of their obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty). 16.3.10 G In relation to MCOB 16.3.9R, taking all reasonable steps may, for example, require the transferring firm to resolve data disputes or mark accounts as closed or settled. 16.3.11 G A transferring firm remains subject to MCOB 16.2.2R or MCOB 16.2.3R until the date that the reportable agreements are transferred to the receiving firm. 16.3.12 R (1) A firm which: (a) is a receiving firm; and (b) becomes subject to MCOB 16.2.2R as a result of providing, to a designated consumer credit reference agency, consumer credit information relating to the reportable agreements that it has acquired, must take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by any interruption in the provision of consumer credit information are minimised. (2) In relation to (1), firms are reminded of their obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty). Ceasing information sharing: data protection 16.3.13 G Firms subject to MCOB 16.2.2R or MCOB 16.2.3R are reminded of their obligation to comply with data protection legislation, specifically the data protection principles set out in Article 5(1) of the General data protection regulation. 16.3.14 R Firms are not required to continue providing consumer credit information under MCOB 16.2.3R, or comply with MCOB 16.3.2R, if they consider that doing so would be in breach of any of the data protection principles. 16.3.15 R In considering whether the condition referred to in MCOB 16.3.14R is met, a firm must consider all the information of which it is aware. Page 12 of 31

FCA 202X/YY 16.3.16 R Where a firm has ceased providing consumer credit information to at least one designated credit reference agency, in accordance with MCOB 16.3.14R, the mandatory reporting requirements in MCOB 16.2.2R and MCOB 16.2.3R no longer apply. 16.4 Information accuracy and governance 16.4.1 R (1) When a firm provides consumer credit information relating to any reportable agreement to any designated consumer credit reference agency, it must take all reasonable steps to ensure that the consumer credit information provided is accurate. (2) A firm must, as part of discharging its obligations in (1): (a) test the accuracy of the consumer credit information before providing it; and (b) monitor the systems and processes for providing the consumer credit information, to identify any systemic errors or issues which affect the accuracy of the data provided. 16.4.2 R Where a firm identifies (through any source, including internal monitoring) inaccuracies in consumer credit information which has been provided, it must: (1) take prompt action to correct that inaccurate consumer credit information across all designated consumer credit reference agencies; (2) take prompt action to correct that inaccurate consumer credit information across all other credit reference agencies to which the firm has provided that information; (3) identify any systemic cause of the inaccurate information provision; and (4) correct any systemic causes that have been identified. 16.4.3 R In MCOB 16.4.2R(1) and (2): (1) ‘prompt action’ includes: (a) correcting the consumer credit information before or as part of the next regular reporting event required by MCOB 16.2.3R; or (b) if the firm is aware that any delay to correction is likely to have a material adverse impact on a consumer’s financial situation, correcting the information as soon as reasonably practicable; and Page 13 of 31

FCA 202X/YY (2) ‘correct that inaccurate consumer credit information’ means informing the relevant designated consumer credit reference agency or credit reference agency of the inaccuracy and, if appropriate, providing the corrected consumer credit information. 16.4.4 G Providing consumer credit information will involve processing personal data. Firms processing personal data must comply with data protection legislation and, in particular, adhere to the data protection principles. 16.5 Use of consumer credit information Application 16.5.1 R This section applies to a firm which has provided consumer credit information relating to any reportable agreement to a designated consumer credit reference agency. 16.5.2 R In MCOB 16.5.3R to MCOB 16.5.5G, consumer credit information includes consumer credit information which is aggregated or summarised, where that information is attributable to a particular consumer. Permitted use of consumer credit information 16.5.3 R A firm must only use consumer credit information which it has received from a designated consumer credit reference agency for activities related to promoting responsible lending. 16.5.4 R For the purpose of MCOB 16.5.3R, promoting responsible lending includes: (1) informing and undertaking an assessment of affordability in accordance with MCOB 11.6, MCOB 11.9 and MCOB 11A.3; (2) preventing fraud and money laundering; (3) supporting debt recovery and debtor tracing; (4) managing customer accounts; (5) conducting prudential monitoring and analysis; and (6) conducting other analysis and modelling to support (1) to (5). Data protection requirements 16.5.5 G Using consumer credit information will involve processing personal data. Firms processing personal data are obliged to comply with data protection legislation and, in particular, to adhere to the data protection principles. 16.6 Correction of wrong information under section 159 of the CCA Requirement to investigate following a notice under section 159(1) of the CCA Page 14 of 31

FCA 202X/YY 16.6.1 R (1) This rule applies where a credit reference agency has received notice under section 159(1) of the CCA in relation to information provided by a firm to that credit reference agency. (2) Where the firm is informed by a credit reference agency that it has received a notice, that firm must: (a) take all reasonable steps to investigate whether the information in dispute is incorrect; and (b) respond to the credit reference agency, setting out the results of its investigation, within the period of 14 days beginning with the day after it was informed of the notice. 16.6.2 R The results of the firm’s investigation referred to in MCOB 16.6.1R(2)(b) must include sufficient information to enable the credit reference agency to determine whether to: (1) remove the information in question from the individual’s file; (2) amend the information in question; or (3) take no action. 16.6.3 R (1) In exceptional circumstances, if a response cannot be given in accordance with MCOB 16.6.1R(2)(b) for reasons beyond the control of the firm, the firm must send a holding response to the credit reference agency in a timely manner, and in any event before the deadline specified in MCOB 16.6.1R(2), setting out: (a) the reasons for the delay in responding; and (b) the timescale within which it will reply. (2) Where a firm sends a holding response in accordance with (1), that firm must investigate and respond to the credit reference agency as required by MCOB 16.6.1R(2) without undue delay. Requirement to correct wrong information 16.6.4 R Where, as a result of an investigation described in MCOB 16.6.1R(2)(a) or MCOB 16.6.3R(2), a firm identifies inaccuracies in the information provided, it must: (1) take prompt action to correct that inaccurate information across all credit reference agencies to which the firm has provided that information; Page 15 of 31

FCA 202X/YY (2) identify any systemic cause of the inaccurate information provision; and (3) correct any systemic causes that have been identified. Page 16 of 31

FCA 202X/YY Annex D Amendments to the Consumer Credit sourcebook (CONC) In this Annex, underlining indicates new text, unless otherwise stated. 6 Post contractual requirements 6.1 Application 6.1.1 R … 6.1.1A R To the extent that a rule in this chapter does not already apply to Gibraltar￾based firms as a result of GEN 2.3.1R, it applies to them so far as the rule would have applied were it in effect before IP completion day. 6.1.2 G … (5) … (6) CONC 6.9 applies to firms carrying out credit-related regulated activities. … Insert the following new section, CONC 6.9, after CONC 6.8 (Post contract business practices: credit brokers). All the text is new and is not underlined. 6.9 Correction of wrong information under section 159 of the CCA Application 6.9.1 R This section applies to firms carrying out credit-related regulated activities. Requirement to investigate following a notice under section 159(1) of the CCA 6.9.2 R (1) This rule applies where a credit reference agency has received notice under section 159(1) of the CCA in relation to information provided by a firm to that credit reference agency. (2) Where the firm is informed by a credit reference agency that it has received a notice, that firm must: (a) take all reasonable steps to investigate whether the information in dispute is incorrect; and (b) respond to the credit reference agency, setting out the results of its investigation, Page 17 of 31

FCA 202X/YY within the period of 14 days beginning with the day after it was informed of the notice. 6.9.3 R The results of a firm’s investigation referred to in CONC 6.9.2R(2)(b) must include sufficient information to enable the credit reference agency to determine whether to: (1) remove the information in question from the individual’s file; (2) amend the information in question; or (3) take no action. 6.9.4 R (1) In exceptional circumstances, if a response cannot be given in accordance with CONC 6.9.2R(2)(b) for reasons beyond the control of the firm, the firm must send a holding response to the credit reference agency in a timely manner, and in any event before the deadline specified in CONC 6.9.2R(2), setting out: (a) the reasons for the delay in responding; and (b) the timescale within which it will reply. (2) Where a firm sends a holding response in accordance with (1), that firm must investigate and respond to the credit reference agency as required by CONC 6.9.2R(2) without undue delay. Requirement to correct wrong information 6.9.5 R Where, as a result of an investigation described in CONC 6.9.2R(2)(a) or CONC 6.9.4R(2), a firm identifies inaccuracies in the information provided, it must: (1) take prompt action to correct that inaccurate information across all credit reference agencies to which the firm has provided that information; (2) identify any systemic cause of the inaccurate information provision; and (3) correct any systemic causes that have been identified. Amend the following as shown. 7 Arrears, default and recovery (including repossessions) 7.1 Application Who? What? Page 18 of 31

FCA 202X/YY … 7.1.2 G The following sections provide otherwise for application: … (2) … (3) CONC 7.20 applies to firms carrying out activity under article 60B (entering into a regulated credit agreement as lender; exercising, or having the right to exercise, the lender’s rights and duties under a regulated credit agreement), article 39F (debt collecting), article 39G (debt administration) and article 36H (operating an electronic system in relation to lending) of the Regulated Activities Order. … Insert the following new section, CONC 7.20, after CONC 7.19 (Notice of default sums under P2P agreements). All the text is new and is not underlined. 7.20 Reporting satisfied county court judgments and decrees Application 7.20.1 R Subject to CONC 7.20.2R, this section applies to a firm which is carrying out the following activities: (1) consumer credit lending; (2) debt collecting, in relation to regulated credit agreements; (3) debt administration, in relation to regulated credit agreements; or (4) operating an electronic system in relation to lending, in relation to a borrower under a P2P agreement, in relation to a debt for which a judgment or decree has been obtained. Reporting requirement 7.20.2 R Where a firm to which this section applies becomes aware that the relevant judgment or decree has been satisfied, that firm must: (1) in relation to a judgment in England and Wales, notify the relevant court that the judgment has been satisfied by providing the court with proof of payment; (2) in relation to a decree in Scotland, provide original proof of payment to Registry Trust Limited along with the following information in writing: Page 19 of 31

FCA 202X/YY (a) the name and address the decree was recorded against; (b) the case number; (c) the name of the court; (d) the amount of the decree; and (e) the date that the debt was repaid in full; and (3) in relation to a judgment in Northern Ireland, provide original proof of payment to Registry Trust Limited along with the following information in writing: (a) the defendant’s name and address that the judgment was recorded against; (b) the case number; (c) the name of the court; (d) the amount of the judgment; and (e) the date that the debt was repaid in full. 7.20.3 R A firm must carry out the steps described in CONC 7.20.2R as soon as reasonably practicable. 7.20.4 R In this section: (1) ‘court’ means: (a) in England and Wales and Northern Ireland, the county court or the High Court; and (b) in Scotland, the sheriff court or the Court of Session; (2) ‘judgment’ means any judgment or order of the court for a sum of money; (3) ‘Registry Trust Limited’ means the company of this name with registered company number 01896592; and (4) ‘satisfied’ means that the debt has been repaid in full. Insert the following new chapter, CONC 17, after CONC 16 (Requirements for firms with deferred payment credit temporary permission). All the text is new and is not underlined. [Editor’s note: This Annex takes into account the changes introduced by the Deferred Payment Credit Instrument 2026 (FCA 2025/2), which come into force on 15 July 2026.] Page 20 of 31

FCA 202X/YY 17 Consumer credit information 17.1 Application 17.1.1 G This chapter contains rules requiring certain firms to provide certain information to designated consumer credit reference agencies. A firm which has already elected to provide some consumer credit information to a designated consumer credit reference agency is required to provide all applicable consumer credit information to all of the designated consumer credit reference agencies, at least once per month. The firm can only cease doing so in certain prescribed situations (see CONC 17.3). The firm is also required to ensure the accuracy of that information and to only use consumer credit information that it receives from a designated consumer credit reference agency for certain purposes. 17.1.2 R A rule in this chapter applies to Gibraltar-based firms, so far as the rule would have applied were it in effect before IP completion day. Application: reportable agreements 17.1.3 R (1) Subject to (2), this chapter applies to a firm with respect to: (a) consumer credit lending; (b) debt collecting, in relation to a regulated credit agreement; (c) debt administration, in relation to a regulated credit agreement; and (d) operating an electronic system in relation to lending in relation to a borrower under a P2P agreement. (2) This chapter does not apply to a firm with respect to any agreement where the customer is not a consumer. (3) An agreement which relates to any of the activities listed in (1) and which is not excluded by (2) is a reportable agreement. 17.2 Mandatory information sharing with designated consumer credit reference agencies Requirement to share consumer credit information 17.2.1 R Where a firm provides any type of consumer credit information relating to a reportable agreement to a designated consumer credit reference agency, it must comply with CONC 17.2.2R. 17.2.2 R In relation to CONC 17.2.1R, the firm must provide all the types of consumer credit information that it holds in relation to that reportable agreement to: Page 21 of 31

FCA 202X/YY (1) that designated consumer credit reference agency; and (2) all the other designated consumer credit reference agencies, subject to CONC 17.2.4R. 17.2.3 R Where a firm has become subject to CONC 17.2.2R, it must provide all types of consumer credit information that it holds in relation to that reportable agreement to all designated consumer credit reference agencies at least once per month. 17.2.4 R A first-time provider firm is not required to comply with CONC 17.2.2R until 6 months after it first provides any type of consumer credit information relating to a reportable agreement to a designated consumer credit reference agency. 17.2.5 R A first-time provider firm is not required to comply with CONC 17.2.2R where that firm: (1) provides consumer credit information in relation to a reportable agreement to a designated consumer credit reference agency for the first time; and (2) ceases providing that consumer credit information to that designated consumer credit reference agency within a period of 6 months. 17.2.6 G The effect of CONC 17.2.5R is that a first-time provider firm can begin providing consumer credit information to a designated consumer credit reference agency, but if it then ceases doing so within a period of 6 months, it will not be caught by CONC 17.2.2R. 17.2.7 G A first-time provider firm is subject to the requirements of CONC 17.4 and CONC 17.5 whenever it provides consumer credit information in relation to a reportable agreement to a designated consumer credit reference agency. 17.2.8 G The scenario described in CONC 17.2.1R includes situations where the firm provides consumer credit information to more than one designated consumer credit reference agency. 17.3 Ceasing information sharing 17.3.1 R Where a firm becomes subject to the requirements in CONC 17.2.2R or CONC 17.2.3R, it may cease providing consumer credit information to designated consumer credit reference agencies in relation to any or all reportable agreements, subject to the requirements in CONC 17.3.2R. Procedure when a firm ceases sharing consumer credit information 17.3.2 R When a firm intends to cease providing consumer credit information as described in CONC 17.3.1R, it must: Page 22 of 31

FCA 202X/YY (1) as far as reasonably practicable, cease providing consumer credit information to all designated consumer credit reference agencies simultaneously; (2) take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by the cessation of sharing are minimised, in line with its obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty); (3) at least 2 months in advance of the earliest date that it will cease providing consumer credit information to any designated consumer credit reference agency, notify the FCA that it intends to cease; and (4) include within the notification in (3): (a) the date on which the firm will cease providing consumer credit information to each designated consumer credit reference agency; (b) a description of the reportable agreements in relation to which the firm will cease providing consumer credit information; and (c) the steps that the firm is taking to ensure it complies with (2). 17.3.3 G It may not be reasonably practicable for a firm to cease providing consumer credit information to all designated consumer credit reference agencies simultaneously if it has different arrangements with each one. CONC 17.3.2R(3) and (4)(a) recognise this scenario, and CONC 17.3.2R(4)(a) enables a firm to provide different cessation dates for each designated consumer credit reference agency in its notification. 17.3.4 G In relation to CONC 17.3.2R(2), taking all reasonable steps may, for example, require the firm to resolve data disputes or mark accounts as closed or settled. 17.3.5 G With reference to CONC 17.3.2R(3) and (4)(b), where a firm ceases providing consumer credit information in relation to multiple reportable agreements simultaneously, only one notification is required. 17.3.6 R CONC 17.3.2R does not apply to: (1) a transferring firm within the meaning of CONC 17.3.8R(1); and (2) a firm which ceases providing consumer credit information in accordance with CONC 17.3.14R. 17.3.7 R Where a firm has ceased providing consumer credit information to at least one designated credit reference agency, and has complied with CONC 17.3.2R, the mandatory reporting requirements in CONC 17.2.2R and CONC 16.2.3R no longer apply to it. Page 23 of 31

FCA 202X/YY Transfer of business 17.3.8 R CONC 17.3.9R to CONC 17.3.12R apply where a firm which is subject to CONC 17.2.2R or CONC 17.2.3R in respect of certain reportable agreements transfers those reportable agreements to another firm, whether as a consequence of insolvency, sale or other transaction. Accordingly: (1) ‘transferring firm’ refers to the firm originally subject to CONC 17.2.2R or CONC 17.2.3R, which transfers the reportable agreements, and (2) ‘receiving firm’ refers to the firm which acquires those reportable agreements. 17.3.9 R A transferring firm must take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by ceasing to provide consumer credit information are minimised. Transferring firms are reminded of their obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty). 17.3.10 G In relation to CONC 17.3.9R, taking all reasonable steps may, for example, require the transferring firm to resolve data disputes or mark accounts as closed or settled. 17.3.11 G A transferring firm remains subject to CONC 17.2.2R or CONC 17.2.3R until the date that the reportable agreements are transferred to the receiving firm. 17.3.12 R (1) A firm which: (a) is a receiving firm; and (b) becomes subject to CONC 17.2.2R as a result of providing, to a designated consumer credit reference agency, consumer credit information relating to the reportable agreements that it has acquired, must take all reasonable steps to ensure that any adverse impacts on consumers which may be caused by any interruption in the provision of consumer credit information are minimised. (2) In relation to (1), firms are reminded of their obligations under Principle 12 (Consumer Duty) and PRIN 2A (The Consumer Duty). Ceasing information sharing: data protection 17.3.13 G Firms subject to CONC 17.2.2R or CONC 17.2.3R are reminded of their obligation to comply with data protection legislation, specifically the data protection principles set out in Article 5(1) of the General data protection regulation. Page 24 of 31

FCA 202X/YY 17.3.14 R Firms are not required to continue providing consumer credit information under CONC 17.2.3R, or comply with CONC 17.3.2R, if they consider that doing so would be in breach of any of the data protection principles. 17.3.15 R In considering whether the condition referred to in CONC 17.3.14R is met, a firm must consider all the information of which it is aware. 17.3.16 R Where a firm has ceased providing consumer credit information to at least one designated credit reference agency, in accordance with CONC 17.3.14R, the mandatory reporting requirements in CONC 17.2.2R and CONC 17.2.3R no longer apply. 17.4 Information accuracy and governance 17.4.1 R (1) When a firm provides consumer credit information relating to any reportable agreement to any designated consumer credit reference agency, it must take all reasonable steps to ensure that the consumer credit information provided is accurate. (2) A firm must, as part of discharging its obligations in (1): (a) test the accuracy of the consumer credit information before providing it; and (b) monitor the systems and processes for providing the consumer credit information, to identify any systemic errors or issues which affect the accuracy of the data provided. 17.4.2 R Where a firm identifies (through any source, including internal monitoring) inaccuracies in consumer credit information which has been provided, it must: (1) take prompt action to correct that inaccurate consumer credit information across all designated consumer credit reference agencies; (2) take prompt action to correct that inaccurate consumer credit information across all other credit reference agencies to which the firm has provided that information; (3) identify any systemic cause of the inaccurate information provision; and (4) correct any systemic causes that have been identified. 17.4.3 R In CONC 17.4.2R(1) and (2): (1) ‘prompt action’ includes: Page 25 of 31

FCA 202X/YY (a) correcting the consumer credit information before or as part of the next regular reporting event required by CONC 17.2.3R; or (b) if the firm is aware that any delay to correction is likely to have a material adverse impact on a consumer’s financial situation, correcting the information as soon as reasonably practicable; and (2) ‘correct that inaccurate consumer credit information’ means informing the relevant designated consumer credit reference agency or credit reference agency of the inaccuracy and, if appropriate, providing the corrected consumer credit information. 17.4.4 G Providing consumer credit information will involve processing personal data. Firms processing personal data must comply with data protection legislation and, in particular, adhere to the data protection principles. 17.5 Use of consumer credit information Application 17.5.1 R This section applies to a firm which has provided consumer credit information relating to any reportable agreement to a designated consumer credit reference agency. 17.5.2 R In CONC 17.5.3R to CONC 17.5.5G, consumer credit information includes consumer credit information which is aggregated or summarised, where that information is attributable to a particular consumer. Permitted use of consumer credit information 17.5.3 R A firm must only use consumer credit information which it has received from a designated consumer credit reference agency for activities related to promoting responsible lending. 17.5.4 R For the purpose of CONC 17.5.3R, promoting responsible lending includes: (1) informing and undertaking a creditworthiness assessment; (2) preventing fraud and money laundering; (3) supporting debt recovery and debtor tracing; (4) managing customer accounts; (5) conducting prudential monitoring and analysis; and (6) conducting other analysis and modelling to support (1) to (5). Data protection requirements Page 26 of 31

FCA 202X/YY 17.5.5 G Using consumer credit information will involve processing personal data. Firms processing personal data are obliged to comply with data protection legislation and, in particular, to adhere to the data protection principles. Page 27 of 31

FCA 202X/YY Annex E Designated Consumer Credit Reference Agencies sourcebook (DCCRA) In this Annex, all the text is new and is not underlined. Insert the following new sourcebook, the Designated Consumer Credit Reference Agencies sourcebook (DCCRA), in the Specialist sourcebooks block. 1 Application and purpose 1.1 Purpose 1.1.1 G This sourcebook creates a scheme for designating certain credit reference agencies, and sets out rules and guidance for those which are designated. The status and activities of designated consumer credit reference agencies, and the rules and guidance which apply to them, form part of a framework for sharing consumer credit information. MCOB 16 and CONC 17 set out the corresponding rules and guidance which apply to firms that provide consumer credit information to designated consumer credit reference agencies. 1.2 Application Who? What? 1.2.1 G This sourcebook predominantly applies to designated consumer credit reference agencies. DCCRA 2.1 contains a list of the designated consumer credit reference agencies, which are designated as such by the FCA. DCCRA 2 and DCCRA 3 contain rules and guidance relating to designated consumer credit reference agencies’ activities within the information￾sharing framework, and to their use of the consumer credit information that they receive. 1.2.2 G DCCRA 2.2 is relevant to credit reference agencies. It sets out the factors to which the FCA will have regard when taking a decision on designation. 1.2.3 G DCCRA 2.4 is relevant to firms providing consumer credit information in accordance with MCOB 16 and CONC 17. 2 Designated consumer credit reference agencies 2.1 The designated consumer credit reference agencies 2.1.1 R The following firms are designated consumer credit reference agencies: (1) Equifax Limited, FRN 739000; (2) Experian Limited, FRN 738097; and (3) TransUnion International UK Limited, FRN 737740. Page 28 of 31

FCA 202X/YY 2.2 The FCA’s decision on designation 2.2.1 R Before taking a decision to add or remove a firm from the list of designated consumer credit reference agencies in DCCRA 2.1.1R, the FCA will comply with the requirements imposed by the Act in relation to the exercise of its rule-making powers. In considering the compatibility of the decision with the statutory objectives, the FCA will have regard to all relevant matters including, but not limited to, the following: (1) Relevant Part 4A permission: in order to be designated, the firm must be a credit reference agency with a Part 4A permission to carry on the regulated activity specified in article 89B (Providing credit references) of the Regulated Activities Order. (2) Coverage of the credit reference agency: the FCA will consider the extent of the credit reference agency’s coverage of consumer credit information received from firms conducting the activities listed in CONC 17.1.3R and MCOB 16.1.2R. (3) Impact on consumer outcomes: the FCA will consider the extent to which the services and consumer credit information provided by the credit reference agency could or would facilitate good consumer outcomes. (4) Proportionality of designating or de-designating credit reference agencies: the FCA will consider proportionality, particularly in relation to: (a) the requirements on firms under CONC 17.2 and MCOB 16.2 to regularly provide consumer credit information to all designated consumer credit reference agencies; and (b) the implications of data processing. 2.3 Referring to designation 2.3.1 R A designated consumer credit reference agency must not, and must take all reasonable steps to ensure that any person acting on its behalf does not, use its designation by the FCA in DCCRA 2.1.1R as a basis for marketing or promoting itself and the services that it provides. 2.4 Receiving consumer credit information 2.4.1 R A designated consumer credit reference agency must not prevent a firm from providing consumer credit information to it in accordance with CONC 17.2 or MCOB 16.2, except in the circumstances specified in DCCRA 2.4.2R. 2.4.2 R The exceptions to DCCRA 2.4.1R are: Page 29 of 31

FCA 202X/YY (1) the designated consumer credit reference agency considers that the consumer credit information is inaccurate or incomplete; (2) the designated consumer credit reference agency suspects that the consumer credit information may be fraudulent; or (3) the designated consumer credit reference agency reasonably considers that the consumer credit information is misleading or would have a negative impact on outcomes for retail customers. 2.4.3 R Where a designated credit reference agency prevents a firm from providing consumer credit information to it in accordance with DCCRA 2.4.2R(2) or (3), it must notify the FCA: (1) that it has done so; and (2) the reasons for its decision. 3 Use of consumer credit information 3.1 Application 3.1.1 R This chapter applies where a firm has provided consumer credit information relating to any reportable agreement to a designated consumer credit reference agency. 3.1.2 R In DCCRA 3.2 and DCCRA 3.3, consumer credit information includes consumer credit information which is aggregated or summarised, where that information is attributable to a particular consumer. 3.2 Permitted use of consumer credit information 3.2.1 R (1) This section applies when a designated consumer credit reference agency provides consumer credit information and related services to any firm which is subject to MCOB 16.2 or CONC 17.2. (2) A designated consumer credit reference agency must only use the consumer credit information which has been provided to it by those firms for activities related to promoting responsible lending. 3.2.2 R For the purpose of DCCRA 3.2.1R(2), promoting responsible lending includes: (1) informing a creditworthiness assessment; (2) informing an assessment of affordability in accordance with MCOB 11.6, MCOB 11.9 and MCOB 11A.3; (3) providing credit references; (4) preventing fraud and money laundering; Page 30 of 31

FCA 202X/YY (5) supporting debt recovery and debtor tracing; (6) supporting customer account management; (7) supporting prudential monitoring and analysis; and (8) conducting other analysis and modelling to support (1) to (7). 3.3 Data protection requirements 3.3.1 G Using consumer credit information will involve processing personal data. A designated consumer credit reference agency processing personal data is obliged to comply with data protection legislation and, in particular, to adhere to the data protection principles. Page 31 of 31

© Financial Conduct Authority 2026 12 Endeavour Square London E20 1JN Telephone: +44 (0)20 7066 1000 Website: www.fca.org.uk All rights reserved Pub ref: 1-008992 All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 1000 Sign up for our news and publications alerts