Chapter Three: Rules Regulating Credit Rating and Information Companies

-1 Introduction:

Information systems have acquired great importance due to their positive impact on the efficiency of the banking system, particularly regarding credit granting operations to customers. International practices have indicated the importance of having effective systems for collecting and analyzing credit and information data, given their role in improving credit risk management. This supports better availability of financing for customers and serves their economic interests, contributing to maintaining the integrity and stability of the banking and financial sectors, and enhancing economic growth rates.

Based on this, the framework for the operation of Credit Rating and Information Companies was included in the Central Bank and Banking System Law No. 194 of 2020. They were included among the entities licensed by the Central Bank to conduct their activities, as well as supervised and monitored by it, with the establishment of effective frameworks for their management and rules related to preventing conflicts of interest within them, ensuring they achieve their intended objectives.

-2 Definitions:

The following words and phrases have the meanings indicated next to each of them when applying the provisions of these instructions:

1-2 The Law The Central Bank and Banking System Law issued by Law No. 194 of 2020.

2-2 Credit Rating and Information Companies Companies that collect and analyze personal and credit information and data related to customers of banks and credit granting entities, as well as collect available financial and non-financial data held by entities and companies managing public utilities, with the aim of evaluating the creditworthiness of customers and issuing credit reports for them, as well as providing credit rating and information services or other services.

3-2 Information and Data Providers Entities that have personal, credit, or any other information and data that can be used in the credit rating and evaluation of customers, and which declare or make such data available to Credit Rating and Information Companies. These include: 1-3-2 Banks. 2-3-2 The Central Credit Registration System at the Central Bank. 3-3-2 Credit granting entities. 4-3-2 Credit Rating and Information Companies licensed by the Central Bank. 5-3-2 Insurance companies. 6-3-2 Companies operating in the securities field in accordance with the provisions of the Capital Market Law issued by Law No. 95 of 1992 and its amendments. 7-3-2 Suppliers of goods and services on a deferred sale or installment service payment system, as well as companies operating in the field of installment sales financing. 8-3-2 Supervisory authorities over public registries, which include the Civil Registry, Commercial Registry, Real Estate Registry, Court Registries, and Movable Collateral Registry. 9-3-2 Entities and companies managing public utilities, including telecommunications companies. 10-3-2 Any other entities that have information and data serving the purposes of Credit Rating and Information Companies.

4-2 Credit Granting Entities

Entities or companies, other than banks, that grant credit, including: 1-4-2 Real estate financing companies. 2-4-2 Financial leasing companies. 3-4-2 Institutions, companies, and associations for financing micro, small, and medium enterprises. 4-4-2 Small and Medium Enterprises Development Agency. 5-4-2 Consumer financing companies. 6-4-2 Suppliers of goods and services on a deferred sale or installment service payment system, as well as companies operating in the field of installment sales financing. 7-4-2 Factoring companies. 8-4-2 Nasser Social Bank. 9-4-2 Any other entities licensed by the Central Bank or the Financial Regulatory Authority to grant credit.

5-2 Inquirers

Anyone with the authority to access or view information and data available in the databases of Credit Rating and Information Companies, as follows: 1-5-2 Customers who inquire and obtain the report on their debts with banks and credit granting entities. 2-5-2 Corporate customers of the company who inquire on behalf of their customers applying for or having obtained financing or credit facilities for the following inquiry purposes: 1-2-5-2 Granting new financing. 2-2-5-2 Renewal, and/or increase, and/or reduction, and/or modification, and/or review of existing limits. 3-2-5-2 Reviewing the customer's credit position to verify their regularity in meeting obligations. 4-2-5-2 Accepting a guarantee or collateral. 5-2-5-2 Reviewing a complaint submitted by the customer. 6-2-5-2 Requesting an inquiry by the customer about themselves. 7-2-5-2 Based on authorization from the customer or their legal representative. 8-2-5-2 Based on a judicial ruling, arbitral award, or court order.

6-2 Customer File

An electronic file containing the personal and credit information and data of the customer and other data collected, processed, and retained by the company.

7-2 Data Base

An electronic database at the company containing customer files.

8-2 Credit Report

A report issued by the company (physically or electronically) containing some or all of the information and data available in the customer's file, as well as their credit rating.

9-2 Credit Rating

A numerical assessment reflecting the degree of credit risk of the customer, reached by using information and data available at the company according to statistical bases applied to all customers without discrimination.

10-2 Affiliated Parties

Persons who have an agreement for the purpose of acquiring or actual control over one of the companies, natural persons and their relatives up to the second degree, as well as legal entities subject to the actual control of the same persons, and also the sum of legal entities subject to the actual control of the same persons who have an agreement to exercise their rights in the General Assembly or Board of Directors in a manner leading to actual control over either.

-3 Scope of Application:

These instructions apply to the following parties in respect of each: 1-3 Credit Rating and Information Companies. 2-3 Banks licensed by the Central Bank, including branches of foreign banks. 3-3 Credit granting entities.

-4 Licensing Rules, Conditions, and Procedures

1-4 General Rules:

1-1-4 The company must take the form of an Egyptian joint stock company, and all its shares must be registered. 2-1-4 The company's issued and paid-up capital must not be less than two hundred million Egyptian pounds. 3-1-4 The license must not conflict with the general economic interest of the state, nor lead to violating competition rules and preventing monopolistic practices. 4-1-4 Companies are obliged to pay an annual supervision fee of one hundred thousand Egyptian pounds, to be paid during January of each year. 5-1-4 Interested parties submit license requests to the Central Bank - Supervision and Inspection Sector - on forms prepared for this purpose, in accordance with the requirements stated below.

2-4 Initial Approval Procedures:

1-2-4 A request is submitted to the Central Bank for initial approval to conduct credit rating and information activities, attaching the documents and data specified in Annex (1) to this request. 2-2-4 The request is presented to the Central Bank Board of Directors to issue a decision within ninety days from the date of submission of the complete request. The company is notified of the Board of Directors' decision within fifteen days from the date of its issuance. 3-2-4 Necessary steps for establishment must be taken within one year from the date of notifying interested parties of the Board of Directors' decision granting initial approval for establishment; otherwise, the approval is considered void. The Central Bank Board of Directors may extend this period for a similar additional period. 4-2-4 The company informs the Central Bank of the completion of establishment procedures, and an inspection of the company's premises is conducted.

3-4 Final Approval Procedures:

1-3-4 Companies that have obtained initial approval must submit to the Central Bank for final approval and registration in the Credit Rating and Information Companies Registry within the period specified for completing establishment procedures as stated in item 3-2-4. The documents specified in Annex (2) must be attached to the request. 2-3-4 The request is presented to the Central Bank Board of Directors to issue a decision within ninety days from the date of completing the required documents. The company is notified of the Board of Directors' decision within fifteen days from the date of its issuance. In case of final approval, the decision is published immediately upon issuance in the Official Gazette and on the websites of the company and the Central Bank. 3-3-4 The company is not allowed to start conducting its activity until it is notified of the issuance of final approval for its activity and its registration in the Credit Rating and Information Companies Registry at the Central Bank. 4-3-4 The company is obliged to conduct its activity within one year from the date of issuance of the final approval; otherwise, the license decision is considered void. The Central Bank Board of Directors may extend this period for a similar additional period. 5-3-4 The Central Bank must be notified at least two weeks before the actual start date of conducting the activity.

4-4 Data Modification:

1-4-4 Credit Rating and Information Companies must obtain Central Bank approval before making any modifications to the company's articles of association or bylaws, as well as when any modification occurs to the data submitted during licensing procedures, accompanied by supporting documents. These modifications must not be presented to the company's General Assembly or announced until Central Bank approval is obtained, and the modification is not implemented until approved by the company's General Assembly. 2-4-4 The request is presented to the Central Bank Board of Directors to issue a decision within thirty days from the date of completing the required documents. The company is notified of the Board of Directors' decision regarding the modification request within fifteen days from the date of its issuance.

5-4 Rules and Procedures for Initial Approval for Branch Establishment:

1-5-4 Companies submit to the Central Bank for approval before starting to establish any of their branches. 2-5-4 The request is studied to make a decision based on the following considerations: 1-2-5-4 The extent of the need to establish a new branch, considering the number of existing branches and their geographical distribution. 2-2-5-4 The extent of the company's compliance with prevailing rules and instructions. 3-2-5-4 Observations from the Central Bank's inspection of the company, as well as observations in the auditor's report. 4-2-5-4 The availability of necessary resources to manage and operate the branches. 5-2-5-4 The activities the new branches will conduct, as well as the products they will market, with a statement of all associated risks and how they are managed. 6-2-5-4 The company's information technology infrastructure and information security capability to efficiently and effectively accommodate the new branches. 3-5-4 The request is presented to the Central Bank Governor to issue a decision within thirty days from the date of completing the required documents. The company is notified of the decision within fifteen days from the date of its issuance.

6-4 Rules and Procedures for Final Approval for Branch Establishment:

1-6-4 Companies must start branch establishment procedures within six months from the date of issuance of initial approval; otherwise, the approval is considered void. The Central Bank Governor may extend this period for a similar additional period. 2-6-4 After completing establishment procedures, companies submit a request to the Central Bank to inspect the branch in preparation for registering it in the Credit Rating and Information Companies Registry at the Central Bank, attaching the following documents to the request: 1-2-6-4 An extract from the Commercial Registry indicating the branch as the branch. 2-2-6-4 An extract from the Tax Authority adding the branch to the tax file. 3-6-4 The Central Bank inspects the branch's premises. 4-6-4 The request is presented to the Central Bank Governor to issue a decision within thirty days from the date of completing the required documents. The company is notified of the decision within fifteen days from the date of its issuance. The branch is not allowed to conduct its activity until the company is notified of the endorsement in the registry prepared for that purpose. 5-6-4 The Central Bank must be notified at least two weeks before the actual start date of conducting the branch's activity. 6-6-4 When changing any data for registered branches, a request for modification of registration data must be submitted.

7-4 Suspension of Company Activity, Liquidation, and Deletion:

Credit Rating and Information Companies are not allowed to suspend their activity, liquidate, merge into, or acquire another company without prior approval from the Central Bank. The mechanism for the transfer of data and information mentioned in item 4-3-7-4 applies in this case.

-1-7-4 Cancellation of License and Deletion of Registration:

The Central Bank may cancel the license of Credit Rating and Information Companies and delete their registration by a decision of its Board of Directors in the following cases: 1-1-7-4 If a serious or repeated violation of the provisions of the Law or prevailing instructions is committed, and it is not addressed within the period and conditions specified by the Central Bank. 2-1-7-4 If a policy is adopted that harms the general economic interest, monetary policy, or the banking system. 3-1-7-4 If it is found that the license was granted based on false data submitted to the Central Bank. 4-1-7-4 If a fundamental change occurs in the data on which the license was granted. 5-1-7-4 If the company stops conducting its activity or submits a request to suspend its activity and liquidate it voluntarily. 6-1-7-4 If the company becomes insolvent. 7-1-7-4 If it loses one of the licensing conditions. 8-1-7-4 If the company is declared bankrupt or liquidated.

-2-7-4 Suspension of Activity (Total or Partial):

1-2-7-4 Any company wishing to suspend its activity, whether totally or partially, must submit a request to the Central Bank to obtain approval to begin suspension procedures, attaching the following documents to the request: a. Approval of the company's Extraordinary General Assembly, provided that the required majority for amending the company's bylaws is available. b. The study prepared by the company for suspending its activity, including the necessary justifications for that. c. The company's commitment to discharging all its legal obligations. 2-2-7-4 The Central Bank Board of Directors issues a preliminary decision within thirty days from the date of submission of the complete request. The company is notified of the decision within fifteen days from the date of its issuance. 3-2-7-4 Companies must submit the following documents within sixty days from the date of obtaining approval to begin suspension procedures, certified by the company's auditor: a. A certified certificate from the company confirming its final discharge from all its financial obligations. b. A statement of the company's financial position after settling its financial obligations. 4-2-7-4 The Central Bank Board of Directors issues a final decision regarding the request within ninety days from the date of submission of the complete documents. 5-2-7-4 The company is notified of the decision result within fifteen days from the date of its issuance. In case of approval, it is published in the Official Gazette and on the websites of the company and the Central Bank.

-3-7-4 Voluntary Liquidation:

1-3-7-4 A request is submitted to the Central Bank to obtain approval for voluntary liquidation, accompanied by the following: a. A document confirming the approval of the Extraordinary General Assembly for liquidation by the majority required by law. b. The financial position at the date of agreement on liquidation, as well as the external auditor's report. c. A statement certified by the company's Board of Directors specifying its obligations (if any). d. A document confirming the appointment of the liquidator. e. Reasons and method of liquidation. f. The timeline for implementing the liquidation. g. A plan to preserve the rights of the company's employees. 2-3-7-4 The Central Bank Board of Directors issues its decision regarding the liquidation request, including the conditions the company must comply with, and notifies interested parties within thirty days from the date of submission of the complete required documents. The license is cancelled, registration is deleted, and the decision is published in the Official Gazette and on the websites of the Central Bank and the concerned company within fifteen days from the date of notifying the company. 3-3-7-4 Without prejudice to the interests of parties dealing with the company, the decision issued to stop the company from conducting its business and liquidate it entails that the Central Bank Board of Directors may decide to liquidate the company's business by conducting ongoing operations at the time of deletion or allow it temporarily - and only until completion - under the conditions it specifies. 4-3-7-4 In case of Central Bank approval for voluntary liquidation or suspension of the company's activity, the following must be complied with: a. Transfer all records, documents, information, and data related to the company's business to the Central Bank (or any party appointed by it) according to the conditions and terms it specifies, then delete them. This must be done within fifteen days from the date of notification. b. Do not transfer any records, documents, information, or data related to the company's business, directly or indirectly, to any entity other than the Central Bank (or any party appointed by it), nor keep copies of any kind for any reason. The company bears any damages arising from violating this.

-5 Governance Requirements:

The company must establish an effective governance framework regulating the relationship between the Board of Directors, senior management, shareholders, and other stakeholders, defining the duties and responsibilities of each, in addition to defining the approach the Board and senior management follow to guide the company and conduct its affairs and activities. This framework must include, at a minimum: a. The company's strategy and objectives. b. Policies and procedures for employee appointment and work follow-up, as well as performance supervision. c. Establishing effective internal policies and systems regarding governance, internal control, and risk management, and ensuring compliance with them. d. Defining the company's internal control systems and activities. e. Ensuring that the company's activity is conducted in a safe and sound manner within the framework of compliance with prevailing laws and controls. f. Defining an independent budget as well as expected financial results for each activity of the company.

1-5 Board of Directors

1-1-5 Board Formation, Balance, and Independence:

1-1-1-5 The Board of Directors of the company should consist of a suitable number of qualified members who have sufficient understanding of the company's business and their tasks. The Board's composition must include at least two women. The Board is primarily responsible for determining the company's strategic objectives and working to achieve them, and supervising senior management's performance to the fullest extent to ensure these objectives are achieved, while ensuring compliance with legal and regulatory requirements, as well as ensuring the effectiveness of the company's internal control and risk management systems to ensure its stability and preserve its reputation. 2-1-1-5 The Board's composition must include at most two executive members, and the rest of the members must be non-executive. Among them, there must be at least two independent non-executive members. A member is considered independent if the following conditions are met: a. They are a non-executive member of the Board of Directors with experience. b. They are not an employee or manager of the company or one of its affiliated parties during the previous three years. c. They do not have any direct relationship with the company, or be a partner or shareholder (or their representative) during the last three years. d. They do not have any kinship ties with any of the company's advisors, board members, senior management, or any of their affiliated parties up to the second degree. e. They do not have any interests that conflict with their duties or could affect their neutrality in deliberations and decision-making. f. They do not have any joint interests with other senior officials of the company through participation in other companies or institutions. g. They do not receive any salary or monetary amount from the company except what they receive for their membership on the Board or its committees. h. They are not a partner of the company's external auditor or an employee thereof during the previous three years. i. Their membership has not exceeded six consecutive or separate years. 3-1-1-5 The company must disclose in its annual report to its Board of Directors all members considered non-executive. Proposals for their nomination are submitted through the Governance and Nominations Committee and presented to the Board of Directors for approval by the General Assembly. 4-1-1-5 The term of membership of a non-executive member of the Board of Directors does not exceed two terms, with a maximum duration of six consecutive or separate years, unless there are strong and specific reasons for extending their membership, subject to obtaining Central Bank approval. 5-1-1-5 There must be a complete separation between the tasks and responsibilities of the positions of Chairman of the Board and Chief Executive Officer / Managing Director. The same person cannot hold the position of Chairman of the Board and the tasks of Chief Executive Officer / Managing Director. Their competencies and responsibilities are determined in writing and approved by the Board of Directors. 6-1-1-5 The Chairman of the Board must be a non-executive member and is primarily responsible for the good performance of the Board as a whole. It is incumbent upon them to guide and direct the Board and ensure the effectiveness of its performance. 7-1-1-5 Non-executive Board members must meet together without the presence of executive Board members at least once a year.

2-1-5 Board of Directors Meetings:

1-2-1-5 The Board of Directors must meet regularly at least six times during the year. The principle is the physical presence of members. In case of impossibility, participation via video or telephone is allowed after the Chairman's approval (with the necessity of putting clear procedures to ensure the integrity and security of the communication means used, as well as verifying the identity of participants through these means), not exceeding two times per year per member, provided that a majority of the Board members are present. 2-2-1-5 No member of the Board may be absent from more than one-third of the Board's sessions during the year; otherwise, the Chairman of the Board must notify the company's General Assembly so that it takes what it deems appropriate.

3-1-5 Board Secretariat:

Each company must designate a competent and experienced individual to be responsible for the Board Secretariat. A Board Secretariat department may be formed. The role of the Secretariat is not limited to recording Board meeting minutes but extends to the following, by way of example and not limitation: 1-3-1-5 Preparing meeting minutes, signing them, and sending a copy to Board members for review. 2-3-1-5 Recording meeting recordings - by using a dedicated recording device that allows securing the recordings - within the company's records for an appropriate period. In case of any comments or modifications by any member, the Board Secretary modifies the minutes and presents them in the next session for approval by Board members. A copy of the meeting minutes must be provided to the Central Bank within one month from the date of their holding, with secure disposal of these recordings upon expiration of the prescribed retention period. 3-3-1-5 Following up on the implementation of Board decisions and coordinating with all company departments (especially supervisory departments: Audit, Risk, and Compliance) to present their work results to the Board. 4-3-1-5 Coordinating with all Board committees to ensure effective communication between them and the Board of Directors. 5-3-1-5 Coordinating with the Governance and Nominations Committee to provide necessary information to support the Chairman in the process of evaluating members and committees.

4-1-5 Board of Directors Responsibilities:

The Board of Directors is responsible for the following: -1-4-1-5 Approving the company's strategic objectives and following up on their achievement. -2-4-1-5 Supervising and monitoring the company's business, and ensuring that necessary measures are taken to address deficiencies. -3-4-1-5 Ensuring the periodic evaluation of the efficiency and effectiveness of the company's governance, compliance, and internal control policies and practices. -4-4-1-5 Approving professional standards and establishing a code of conduct for employees. -5-4-1-5 Approving the company's organizational structure, and defining the competencies and responsibilities of senior management and Board members. -6-4-1-5 Approving the company's policies, ensuring their effectiveness and periodic updating, as well as ensuring that senior management prepares and updates the company's internal work procedures. -7-4-1-5 Achieving transparency and ensuring the separation between executive and supervisory functions in the company. The Board's tasks must not include conducting executive work, as that is the responsibility of senior management. -8-4-1-5 Approving the company's risk management policy, reviewing it periodically. This policy must include acceptable risk limits and necessary procedures to identify, measure, monitor, and manage them. -9-4-1-5 Approving a compliance policy aimed at ensuring compliance with prevailing laws, regulations, and supervisory instructions, as well as the company's internal policies and procedures. -10-4-1-5 Approving policies related to information technology and security, and ensuring their periodic updating to ensure continuous evaluation of the efficiency and effectiveness of information security practices. -11-4-1-5 Approving policies related to reporting illegal practices, conflicts of interest, disclosure, and transparency, as well as supervising their implementation. This includes monitoring and managing any potential conflict of interest between the company's interests and those of Board members, senior management, and shareholders, including misuse of company assets and abuse of transactions with affiliated parties. In addition, rules must be established regulating what the Chairman, Board members, senior management, and employees of the company may receive as gifts. -12-4-1-5 Approving policies related to salaries, bonuses, appointments, and training, and the succession plan. -13-4-1-5 Approving the company's budget after the Audit Committee's approval.

5-1-5 Evaluation of the Company's Board of Directors' Performance Efficiency:

The company's Board of Directors must follow a specific system to conduct a self-evaluation at the Board and its committees level as a single unit, and at the performance level of each member individually. This must include the extent of the member's compliance with their job duties and the needs necessary to enhance their efficiency. The responsibility for evaluating members' performance lies with the Chairman of the Board.

6-1-5 Board of Directors Committees:

The company forms committees emanating from the Board of Directors, including the Audit Committee, Risk Committee, Remuneration Committee, Governance and Nominations Committee, and Information Technology and Security Committee - at a minimum. Some committees may be merged according to the appropriateness of their competencies (except for the Audit and Risk Committees). The company's Board of Directors has the right to form other committees as it sees fit.

1-6-1-5 Audit Committee:

a. It is formed of three non-executive Board members chosen by the Board of Directors. The Board may add an external member to the committee's composition after obtaining Central Bank approval. The Committee Chairman must be an independent non-executive member and cannot chair any other committees. b. The Audit Committee meets at least every three months with the presence of the Manager responsible for Internal Audit, the Manager responsible for Compliance, as well as anyone the Committee invites to attend without voting rights. The Committee Chairman presents the minutes of its meetings and recommendations to the Board of Directors. c. The Manager responsible for Internal Audit and the Manager responsible for Compliance at the company both submit reports directly to the Audit Committee, which in turn presents them to the Board of Directors. d. The Audit Committee has the following competencies:

• Approving the annual plan for Internal Audit and Compliance, as well as following up on the work of the Internal Audit and Compliance departments.
• Conducting an annual evaluation of the Manager responsible for Internal Audit and the Manager responsible for Compliance, and submitting the results of this evaluation and related recommendations to the Board of Directors.
• Submitting nominations to the Board of Directors regarding the appointment of the Manager responsible for Internal Audit and the Manager responsible for Compliance.
• Suggesting the appointment of the external auditor and determining their fees, and considering related matters.
• Studying periodic and annual financial statements and approving them before presenting them to the Board of Directors for approval, prepared for publication before publication, and ensuring their consistency with the rules in effect in this regard, in the presence of the Head of the Financial Sector, as well as reviewing the financial statements.
• Studying observations from the Central Bank and external auditors and presenting them to the Board of Directors accompanied by the Committee's recommendations.
• Supervising the establishment of related policies and accounting practices at the company.

2-6-1-5 Risk Committee:

a. It is formed of three Board of Directors members, the majority of whom are non-executives chosen by the Board of Directors. The Committee Chairman must be an independent non-executive member.

---

[RegAlert note: the English text above is a translation of the first 24,000 characters of a 67,159-character original (36% of the document). The remainder was not translated. The complete original-language text is stored with this document.]