Circular 01 of 2019: Additional Form 43 Requirements for Re-seller Credit Bureaux

Circular 01 of 2019 is applicable to re-seller credit bureaux, their independent auditors. The purpose of this circular is to provide clarity to re-seller credit bureaux and their independent auditors in respect of the annual compliance report by credit bureaux outlined in Section 52 (6) and Regulation 70 after publishing Circular Number 23/October 2016. The NCR expects registered re-seller credit bureaux to report on the following information in compliance with Section 52 (6) of the National Credit Act 34 of 2005 in the annual Form 43 reports:

1. Maintenance and retention of consumer credit information by a credit bureaux , Regulation 18 (4) and Regulation 19 (12) 1.1 Section 18 (4) states that the prescribed purposes, other than for purposes contemplated in the Act, for which a report may be issued in terms of Section 70 (2) (g) are : (a) An investigation into fraud, corruption or theft, provided that the South African Police Services or other statutory enforcement agency conducts such an investigation; (b) Fraud detection and fraud prevention services; (c) Considering a candidate for employment in a position that requires honesty in dealing with cash or finances; (d) An assessment of the debtors book of a business for purposes of : (i) The sale of the business or debtors book of that business; or (ii) Any other transaction that is dependent upon determining the value of the business or debtors book of that business; (e) Settling a limit in respect of the supply of goods, services or utilities; (f) Assessing an application for insurance; (g) Verifying educational qualifications and employment;

Re-seller Credit Bureau Circular on Additional Form 43 Requirements 1 Disclaimer: While the NCR has taken reasonable care to ensure the factual accuracy of this circular, it cannot guarantee such accuracy especially with regards to future events. Accordingly, NCR does not accept any liability for damages incurred by any party as a result of decisions or actions taken on the basis of information supplied in this Circular. Number 01 | January 2019

(h) Obtaining consumer information to distribute unclaimed funds, including pension funds, including pension funds and insurance claims; (i) Tracing a consumer by a credit provider in respect of a credit agreement entered into between the consumer and the credit provider; (j) Developing a credit scoring system by a credit provider or credit bureau. 2. Regulation 19 (12) states that a consumer credit records may not be accessed by an employment agency, recruitment consultant, staffing company or employer unless they certify that any and all requests for consumer credit records relate to positions requiring honesty in dealing with Cash or finances and the job descriptions such position are clearly outlined. 2.1 In terms of assessing compliance for the purposes of Regulation 18, the auditors are required to: (a) Obtain a copy of the policies and procedures of full process flows and functions in each process, including operations operational resources and systems, which have been implemented by the credit bureau to comply with Regulation 18 ; (b) In terms of assessing Regulation 18(4) (c) and Regulation 19(12) the auditors are required to obtain a copy of the policies and procedures, which have been implemented by the credit bureau to ensure compliance with Regulation 18 (4) (c) and Regulation 19 3. Review the information security policy to ensure that the Applicant has adequate: (i) security measures and processes in place to protect consumer credit information; (ii) policies and procedures and systems to protect unauthorized access to consumer credit information; and (iii) information transfer policies, procedures and mechanisms. 4. Review the Business continuity management plan to ensure that the Applicant has an adequate: (i) disaster recovery plan in terms of IT systems, data and employees; (ii) off-site infrastructure; (iii) disaster site which provides for load shedding /generators; (iv) operational plans: short and long term. 5. Review of the IT infrastructure, systems and IT resources both onsite (at organisation’s premises) and off site (business continuity site) to ensure that the IT system has adequate: (i) intrusion detection mechanisms, firewalls and connectivity; and (ii) controls against malware. 4. Review and confirm that the Applicant is adequately destroying consumer credit information within 72 hours of receiving the same from a credit bureau. 4.1 In terms of assessing compliance for the destroying of consumer credit information 2 Disclaimer: While the NCR has taken reasonable care to ensure the factual accuracy of this circular, it cannot guarantee such accuracy especially with regards to future events. Accordingly, NCR does not accept any liability for damages incurred by any party as a result of decisions or actions taken on the basis of information supplied in this Circular.

within 72 hours of receiving same from credit bureaus , the auditors are required to: (a) Obtain a copy of the policies and procedures of full process flows and functions in each process, including operations operational resources and systems, which have been implemented by the credit bureau to comply with the automatic deletion of the data ; b) Run a script into the system to ensure that no data is older than the seventy two (72) hours of receipt of the information from the credit bureaux. Further Information Please contact Ms Nosipho Zikishe on 011 554 2822 or nzikishe@ncr.org.za should you have any queries. 3 Disclaimer: While the NCR has taken reasonable care to ensure the factual accuracy of this circular, it cannot guarantee such accuracy especially with regards to future events. Accordingly, NCR does not accept any liability for damages incurred by any party as a result of decisions or actions taken on the basis of information supplied in this Circular.