Credit Reference Bureau Regulations, 2020

GO pr4P.I tifilL fUtt LAW REr:RTING bEIVED :17 APR 2C!

PliAl4V1441N1W" :$719231 FAX: iT ;moil
SPECIAL ISSUE
Kenya Gazette Supplement No. 42 669 8th April, 2020 (Legislative Supplement No. 28) LEGAL NOTICE NO. 55 THE BANKING ACT (Cap. 488) ARRANGEMENT OF REGULATIONS Regulation PART I—PRELIMINARY 1 - Citation 2—Interpretation PART II—ESTABLISHMENT AND LICENSING OF BUREAUS 3—Licensing of bureaus 4—Application for a license 5—Review of application 6—Inspection of systems and premises 7—Issuance of license 8—Bank guarantees 9—Refusal to issue a license 10—Notification of licensed bureaus 11—Revocation or suspension of licenses 12—Annual license fee 13—Fees not refundable or payable pro rata 14—License non-transferable PART III—OPERATION OF BUREAUS 15—Activities of bureaus 16—Use of agents 17—Actions requiring prior approval 18—Nature of information to be shared 19—Identification details 20—Protection from liability 21—Prohibited information 22—Form of consent

23—Disclosures 24—Other sources of information 25—Use of public data by bureaus 26—Duty to notify customer of furnishing negative information to bureau 27—Confidentiality of customer information 28—Responsibilities of a bureau 29—Customer rights 30—Subscribers' obligations in respect of information obtained from bureaus 31—Receipt of credit reports by third parties 32—Restrictions on fees charged by bureaus 33—Data management and quality control 34—Retention of information 35—Updating customer information 36—Security and control measures 37—Customers' rights of access and correction 38—Access to own information 39—Credit scores 40—Use of credit scores PART IV—CROSS-BORDER CREDIT INFORMATION SHARING 41—Authority to share cross-border credit information 42—Establishment of places of business outside Kenya PART V—GOVERNANCE AND MANAGEMENT OF BUREAUS 43—Management and composition of a bureau 44—Functions of the Board 45—Meetings of the Board 46—Decisions of the Board 47—Attendance of meetings 48 - Videoconference 49—Capital 50—Disqualification of officers and employees 51—Suitability test PART VI—DISSOLUTION AND LIQUIDATION 52—Dissolution and winding up of a bureau

53—Central Bank approval for voluntary liquidation 54—Notification to the Central Bank 55—Forwarding data to the Central Bank 56—Notification to institutions and bureaus PART VII—POWER OF THE CENRAL BANK 57—Powers of the Central Bank 58—Inspection of bureaus 59—Ownership of information in possession of a bureau 60—Periodic returns 61—Audited report PART VIII—GENERAL PROVISIONS 62—Mandatory standards for data collection, storage and use 63—Responsibilities of institutions and credit information providers 64—Central Hub and Industry tool 65—Data submission templates 66—Notification of the amount owing 67—Mode of service 68—Obtaining information under false pretences 69—Publication of list of third-party credit information providers 70—Public education 71—Compliance with guidelines, rules or directives 72—Penalties 73—Repeal of L.N. 5/2013.

74—Savings FIRST SCHEDULE—Application Form for a License to Carry Out Bureau Business SECOND SCHEDULE—Personal Declaration Form for Individuals Proposed to Become Significant Shareholders, Directors or Senior Officers of a Bureau THIRD SCHEDULE—Fees

672 The Banking Act (Cap. 488)

Citation.

Interpretation.

IN EXERCISE of the powers conferred by section 31 (3) of the Banking Act, the Cabinet Secretary for the National Treasury and Planning makes the following Regulations—

The Banking (Credit Reference Bureau) Regulations, 2020 Part I—Preliminary

1. These Regulations may be cited as the Banking (Credit Reference Bureau) Regulations, 2020.

2. In these Regulations, unless the context otherwise requires -
   "adverse action notice" means a notice issued by an institution to a customer conveying denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavourable change in the terms of coverage or amount of, any loan, existing or applied for, or any other action or determination adversely affecting the customer, based on customer information obtained from a bureau; "agent" means an entity contracted by a Bureau and approved by the Central Bank to provide the services on behalf of the Bureau, in such manner as may be prescribed by the Central Bank; "amendment notice" means a written notice from an institution advising a bureau of an amendment to credit information previously incorrectly reported to a bureau by that institution; "bank" means a bank licensed under the Banking Act; "bureau" means a credit reference bureau licensed under these Regulations to prepare or provide credit reports to credit information recipients based on data maintained by the bureau and to carry out such other activities as are authorised under these Regulations; "Cabinet Secretary" means the Cabinet Secretary responsible for matters relating to finance; "Central Bank" means the Central Bank of Kenya established by Article 231 (1) of the Constitution; "credit information" means any positive or negative information bearing on an individual's or entity's credit worthiness, credit standing, credit capacity, to the history or profile of an individual or entity with regard to credit, assets, and any financial obligations; "credit information provider" means a person other than a subscriber who has been approved by the Central Bank to furnish credit information to a Bureau; "credit report" means an electronic, written or other communication of any information by a credit reference bureau, relating to a person's creditworthiness, credit standing, credit capacity, character or general reputation which is used or collected to serve as a

factor in establishing that person's eligibility for credit or other service or product provided by an institution or for such other purposes as may be permitted or required by law or contract; "credit score" means a numerical expression of a customer's creditworthiness contained in a credit report; "customer" means any consumer of services or products who has or had a formal engagement to receive services or products on agreed terms and conditions from an institution or a third party and includes a person who seeks to open an account with an institution; "customer information" means credit information, or any other positive or negative information provided by a customer or obtained from an institution, a third party, or public record information, which may be exchanged pursuant to these Regulations; "database" means a set of customer information collected, managed and disseminated by a bureau; "day" means a calendar day; "delinquent loan" means any loan which the principal or interest remains unpaid after the due date in accordance with the provisions of the Sacco Societies Act, 2008, and the Sacco Societies (Deposit-Taking Sacco Business) Regulations, 2010; "director" means a member of the board of directors of a bureau; "institution" for the purposes of these Regulations, means an institution within the meaning of section 2 of the Banking Act, section 2 of the Microfinance Act, 2006, and a Sacco society with the meaning of section 2 of the Sacco Societies Act, 2008; "investigation" means, in respect to a bureau, a formal inquiry to an institution or third-party credit information provider on the authenticity of credit information submitted to the Bureau; "loan" means direct, indirect and contingent obligations incurred by an individual or entity with third parties and includes any credit, discount, advance, overdraft, export bills purchased, other bills receivable or purchased, import bills, customers' liability on off balance sheet items or any other credit facility extended to a customer; "microfinance bank" means a microfinance bank licensed under the Microfinance Act, 2006; "negative information" means any adverse customer information relating to a customer which includes - (a) non-performing loan or credit default or late payment on all types of facilities or claims; (b) dishonour of, other than for technical reasons, cheques meant for settlement of credits in favour of institutions; (c) accounts compulsorily closed other than for administrative reasons;

(d) cases of frauds and forgeries;
(e) proven cases of cheque kiting;
(f) false declarations and statements;
(g) receiverships, bankruptcies and liquidations; (h) tendering of false securities; and (i) misapplication of borrowed funds.

"non-executive director" means a director who is not engaged in the day to day management of a bureau;

"Non-Performing Loan" Means —

(a) pursuant to the Banking Act and Prudential Guidelines, 2013— (i) in respect of, loan accounts and other credit extensions having pre-established repayment programs, when principal or interest is due and unpaid for ninety days or more or interest payments for ninety days or more have been re- financed or rolled-over into a new loan; (ii) in respect of, current accounts, overdrafts, and other credit extensions not having pre-established repayment programs, when the balance exceeds the customers approved limit for more than ninety consecutive days, the customers borrowing line has expired for more than ninety days or interest is due and unpaid for more than ninety days; or (iii) in respect of, off-balance sheet items, when the offbalance sheet item crystallize and the customer's account is debited and the principal and interest is subsequently unpaid for ninety days or more; (b) pursuant to the Microfinance Act, 2006 and the Microfinance (Deposit Taking Microfinance Institutions) Regulations, 2008 a credit facility that is not generating income and the principal or interest is due and unpaid for, more than thirty days and includes a loan or credit facility classified either as substandard, doubtful or loss; (c) pursuant to the Sacco Societies Act, 2008, and the Sacco Societies (Deposit-Taking Sacco Business) Regulations, 2010, means a delinquent loan; "notice of change" means a written notice sent by a bureau to an institution concerning a significant change to customer information that had previously been obtained by the institution from the Bureau for a period not exceeding twelve months prior to the date of the notice of change; "notice of dispute" means a notice furnished to a subscriber or third party credit information provider by a bureau notifying the

subscriber or the third party credit information provider that specified information submitted to the bureau by the subscriber or the third party credit information provider is disputed by the person to whom the information relates and requires the subscriber or the third party credit information provider to investigate the disputed information and respond to the bureau within the prescribed period; "notice of resolution" means a written notice sent from an institution to a bureau, advising the results of an investigation the institution has made into customer information previously reported to the bureau by the institution where the customer has disputed the accuracy of information reported; "officer" means any person who takes part in the general management of a bureau and includes a director, the secretary to the board, the chief executive officer, deputy chief executive officer, chief financial officer, chief information technology officer, chief internal auditor, or manager of a significant unit of the Bureau or a person with a similar level of seniority, position or responsibility; "performing loan" means any loan which has not been classified as a non-performing loan under the Banking Act, the Microfinance Act, 2006, and the Sacco Societies Act, 2008; "place of business" means any premises including the head office, branch, agency or such other premises as may be approved by the Central Bank, at which a bureau conducts its business; "positive information" means any information on performing loan or other credit; "regulator or supervisory authority" means an agency responsible for supervising institutions or credit reference bureaus; "Sacco society" means a Sacco society within the meaning of section 2 of the Sacco Societies Act, 2008; "significant shareholder" means a person other than the Government or a public entity, who holds directly or indirectly or otherwise has a beneficial interest in five percent or more of the share capital of a bureau or if it is proposed that such a person shall hold or have such a beneficial interest; "subscriber" means an institution licensed under the Banking Act, the Microfinance Act or the Sacco Societies Act and has subscribed to receive customer information from a bureau.

"summary of rights" means a key facts document prepared by a bureau under regulation 29; and "third-party credit information provider" means a credit information provider other than a subscriber.

PART II—ESTABLISHMENT AND LICENSING OF BUREAUS
3. (1) A person shall not establish or operate a bureau business in Kenya or otherwise hold himself out to the public as engaging in any bureau business for the benefit of institutions unless such person is— Licensing of bureau business.

(a) established and incorporated as a limited liability company under the Companies Act, 2015; (b) licensed under these Regulations; or (c) is an agent of a bureau.

(2) A person who contravenes the provisions of this regulation commits an offence and shall, on conviction, be liable to a fine of five hundred thousand shillings or to imprisonment for a term of two years or to both.

Application for a licence.

4. (1) A person seeking to conduct bureau business shall apply to the Central Bank for a license in the form set out in the First Schedule.

(2) The applicant under paragraph (1) shall furnish the following information accompanied by supporting documents and such other information as may be required by the Central Bank - (a) certified copies of the applicant's certificate of incorporation and memorandum and articles of association; (b) a feasibility study by the applicant showing the organizational structure, internal control systems and monitoring procedures of the company with respect to— (i) market analysis; (ii) the ownership structure of the company; (iii) governance and management structure of the company; (iv) business plan; (v) business continuity plan; and (vi) operation manuals of the business; (c) sworn declarations by proposed directors, officers and significant shareholders in the form set out in the Second Schedule; (d) management processes, including— (i) development schedule of the software required for operation; (ii) characteristics of products and services to be provided to subscribers; (iii) service provision policies and procedures manuals; and (iv) proposed security and control measures aimed at preventing misuse or improper management of information; (e) overview of operations including the description of systems and the design of the data collection including the unique identification system for individuals and enterprises that is

adequate to ease the collection of data and handling of the database; (f) a description of the applicant's premises and their suitability for customer service and the description of the security measures to be adopted; (g) the proposed fees and cost structure of products and services; (h) audited financial statements for the last three years where applicable; (i) a prototype of the final product that demonstrates the principal features and functions of the system; (j) a banker's cheque of ten thousand shillings payable to the Central Bank, being a non-refundable application processing fee; and (k) evidence that the applicant has adequate capital to conduct the business.

(3) Operations manuals prepared under this regulation shall - (a) ensure the accuracy of the information contained in the applicant's database; (b) the timely updating of information held in the applicant's database through signing of contracts with information sources approved by the Central Bank; and (c) include query module manual, data loading module manual, source quality control manual, maintenance module manual, security module manual, operating manual, user manual, data privacy manual and manual for procedures for handling complaints.

5. (1) On receipt of an application under regulation (4), the Central Bank shall, within fourteen days from the date of receipt of the application, review the application and notify the applicant, where necessary, of any missing information which the applicant ought to have provided.

(2) When reviewing an application under paragraph (1), the Central Bank shall take into consideration all relevant matters including - (a) the background, reputation, integrity, experience and capacity of the proposed significant shareholders, directors and senior officers of the applicant; (b) the business plan of the applicant, including plans to undertake national coverage, the applicant's roll-out plan and a mechanism to integrate, gather, input, update and validate data; (c) the design of data collection for customer information and Review of application.

flexibility in structuring the information;
(d) the adequacy of the applicant's capital structure; (e) the availability of human, financial and operational resources necessary for the effective and efficient conduct of bureau business; (f) the existence of adequate infrastructure for the collection of information and preparation of credit reports; (g) the ability of the applicant to maintain the confidentiality of customer information; and (h) the applicant's ability to conduct effective due diligence and identity verification on any person seeking credit information from the applicant.

6. The Central Bank shall carry out an on-site inspection of the applicant's premises to determine the adequacy of the applicant's safety and security systems and to confirm— Inspection of systems and premises.

(a) the suitability of the premises for bureau operations; (b) the adequacy of the applicant's management information system, administrative and operational processes and internal control systems; (c) the security of information held by the applicant; and (d) the separation of the proposed bureau business from any other business carried out by the applicant or the applicant's associates.

7. (1) Where the Central Bank is satisfied that the applicant Issuance of meets the requirements for licensing, it shall issue an interim license in licence.

the form of a letter of intent to the applicant.

(2) Where an applicant is issued with a letter of intent, the Central Bank shall notify the applicant to submit - (a) a banker's cheque for one hundred thousand shillings payable to the Central Bank being licence fee; (b) a statutory declaration by the applicant's chief executive officer in the form set out in the Third Schedule.

(3) Where the applicant complies with the requirements of paragraph (2), the Central Bank shall issue a licence to conduct bureau business to the applicant.

(4) The Central Bank may impose conditions on a licence issued under this regulation as the Central Bank may consider necessary and may, at any time, add, vary or substitute such conditions.

(5) The Central Bank shall determine an application for a licence within ninety days from the date of receipt of information required under these Regulations:
Provided that a licence shall not be granted where the applicant

has not fully established the physical structure necessary to conduct bureau business including management information system.

(6) Where the Central Bank declines to issue a licence, it shall state the grounds of refusal in writing and where applicable, advise the applicant of the necessary action to be taken before submitting a fresh application for a licence.

8. (1) Where a bureau is licensed under these Regulations, it shall, within thirty days of being granted the licence, submit to the Central Bank an irrevocable bank guarantee of one million shillings from a bank or a microfinance bank and such form as may be specified by the Central Bank.

(2) Where a bureau is required to pay a penalty under these Regulations and fails to do so within the time specified by the Central Bank, the Central Bank may recover the amount due on the penalty from the bank guarantee issued under paragraph (1).

(3) Where a penalty has been recovered from a bank guarantee in accordance with paragraph (2), the bureau shall, within thirty days of being notified, furnish the Central Bank with a new irrevocable bank guarantee of one million shillings in such form as may be specified by the Central Bank.

(4) Where a bureau fails to comply with the provisions of this regulation, its licence shall be revoked.

9. (1) A person aggrieved by the refusal of the Central Bank to issue a licence under these regulations may, within twenty-one days from the date of the refusal, apply to the Cabinet Secretary in writing for a review of the Central Bank's decision.

(2) The Cabinet Secretary shall, while considering an application under paragraph (2), consider the material in the administrative record relating to the application for a license and may invite the Central Bank or the applicant or both to make presentations with respect to the application for review.

(4) The Cabinet Secretary may reverse the decision of the Central Bank if— (a) the Central Bank failed to follow the laid down procedure; (b) the decision was contrary to law; (c) there was no factual basis for the decision; or (d) based on a review of the record, there was a manifest error in the assessment of facts relating to the application for registration; or (e) based on a review of the record, the Central Bank abused its discretion.

(5) A person dissatisfied by the decision of the Cabinet Secretary may appeal to the High Court against the decision and the decision of the High Court shall be final.

Bank guarantees.

Refusal to issue a license.

Notification of licensed bureaus.

Revocation or suspension of licenses.

10. The Central Bank shall, within thirty days from the date a licence has been issued to a bureau, by notice in the Gazette, notify members of the public of the name of the bureau and the date the licence was issued.

11. (1) The Central Bank may suspend or revoke a licence issued to a bureau if the bureau—
    (a) does not commence business within twelve months from the date it was issued with a license; (b) has ceased or suspended operations for a period exceeding three months; (c) obtained the licence by providing wrong, false or misleading information or the concealment of material information which, if known at the time of evaluating the application for a licence, the bureau would not have been granted a licence; (d) applies to the Central Bank for the revocation or suspension of the licence; (e) has ceased to meet the requirements prescribed in these Regulations; (f) has failed to comply with any conditions imposed on the licence; (g) is insolvent or unable to effectively conduct its operations; (h) has contravened the provisions of the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law; (i) has engaged in activities which are restricted or not permitted under these Regulations; (j) is unable or has consistently failed to protect the confidentiality of data or information in its possession or control; (k) has, without the consent of the Central Bank, amalgamated with another entity or sold or otherwise transferred its business, assets or liabilities to another entity; (1) has had a winding-up order made against it or a resolution for the voluntary winding up of the bureau has been passed by its shareholders; (m) has used the information in its possession or control for any purpose which is not permitted by these Regulations; or (n) fails to pay the annual licence fee in accordance with these Regulations.

(2) Before the Central Bank revokes or suspends the licence of a bureau, the Bureau shall be given an opportunity to make representations as to why the licence should not be revoked or

suspended and the Central Bank shall take into consideration the representations made by the bureau in its decision on the matter.

(3) The Central Bank may, in lieu of revoking or suspending the licence, require the bureau to take such measures as may be necessary to regularise the breach or violation within such period as the Central Bank may specify and impose such monetary or other sanctions as it may consider necessary in the circumstances.

(4) The Central Bank shall, within seven days of suspending or revoking a license, inform the affected bureau of the suspension or revocation.

(5) The Central Bank shall, upon revocation of the licence of a Bureau, take over control of the business of the bureau to safeguard the information in the bureau's possession or control and facilitate the winding up of the bureau business.

(6) Where the Central Bank takes over the bureau business under paragraph (5), the bureau shall hand over the entire database in a format as the Central Bank may specify and shall thereafter erase all data in its database in the manner specified by the Central Bank.

(7) Where a licence is revoked by the Central Bank, the holder of the licence shall, within seven days from the date of being notified of the revocation, surrender the licence to Central Bank and shall cease to carry out bureau business or any other activity authorized under these Regulations.

(8) A person who fails to comply with paragraph (7) commits an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand shillings or to imprisonment for a term not exceeding two years or to both.

(9) The Central Bank shall publish in the Gazette a notice of the suspension or revocation of a license issued under these Regulations and the grounds for the suspension or revocation.

12. (1) In this regulation, "anniversary date" means the period ending on the 31st December of each year.

(2) A bureau shall be required to pay to the Central Bank an annual licence fee of one hundred thousand shillings.

(3) The annual licence fee shall be paid on or before the anniversary date.

(4) Where a bureau fails to pay the annual license fee by the end of the anniversary date, it shall pay a fee of two hundred thousand shillings within ninety days from the end of the anniversary date.

(5) The Central Bank shall revoke the license of a bureau that fails to pay the annual license fee and, in the case of such failure, the fee prescribed by paragraph (4).

13. Any fees payable to the Central Bank Regulations shall not be— Annual license fee.

under these Fees not refundable or payable pro rata.

(a) refundable where the licence is cancelled or revoked or a Bureau ceases to carry on business at any time before the end of the year; (b) shall not be payable on a pro rata basis if the licence fee is paid in the course of the year for the commencement of bureau business:
Provided that for a bureau that was in existence on the date of the commencement of these Regulations, the annual licence fees already paid shall be prorated up to the 31st December 2020.

14. (1) A person shall not transfer a licence granted to him by License non-the Central Bank to another person. transferable.

(2) A person who contravenes paragraph (1) commits an offence and shall be liable, on conviction, to a fine not exceeding five hundred thousand shillings.

PART 111—OPERATION OF BUREAUS
15. (1) A bureau licensed under these Regulations may, in the Activities of conduct of bureau business— bureaus.

(a) obtain and receive customer information; (b) store, manage, evaluate, update and disseminate customer information to subscribers in accordance with these Regulations; (c) compile and maintain a database of customer information; (d) generate reports from the customer information database; (e) develop a credit score for every customer whose credit information has been submitted to the bureau.

(f) sell to institutions specialized literature and other information material related to its activities; (g) carry out, on its own or with another person approved by the Central Bank, market and statistical research relating to matters set out under these Regulations; (h) conduct Know Your Customer due diligence on behalf of another person; and (i) carry out any other activity as may be approved by the Central Bank in accordance with the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law.

(2) A bureau shall not engage in any activity that is not specified in these Regulations or approved by the Central Bank in accordance with the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law.

(3) Where a bureau fails to comply with paragraph (3) it shall be liable to pay a penalty of five hundred thousand shillings and in the case of continued failure, it shall be liable to an additional penalty of

ten thousand shillings for each day on which such failure continues.

16. (1) A bureau may contract an agent for the following Use of agents.

purposes -
(a) delivery of credit reports to requesting persons in accordance with these Regulations; (b) sensitization of customers, institutions and other credit information providers; (c) receiving and channelling complaints; and (d) any other purpose as may be approved by the Central Bank on application by the bureau.

(2) A bureau shall not contract an agent unless the proposed agent has been approved by the Central Bank:
Provided that a person who has been approved by the Central Bank as an agent under the Banking Act or the Microfinance Act shall not need to be approved by the Central Bank for the purposes of rendering services under these Regulations but a bureau shall be required to obtain a letter of no objection from the Central Bank in respect of such an agent.

(3) An application for approval of an agent shall be accompanied by a report on the suitability assessment of the proposed agent, the services to be rendered by the proposed agent and the application fees set out in the Third Schedule.

(4) A bureau shall, at least two months before the end of each year, apply to the Central Bank for the renewal of the approval of its agents and shall submit a list of its agents whose approvals it wishes be renewed and the annual renewal fees for each agent set out in the Third Schedule.

(5) A person is not qualified to be appointed as an agent of a bureau if that person - (a) is a minor or of unsound mind; (b) has been convicted of an offence involving theft, fraud, forgery, causing financial loss or perjury; (c) has not been vetted in such manner as may be prescribed by the Central Bank; (d) has been removed from any office on account of misconduct, abuse of office, corruption or incompetence in the preceding ten years; or (e) for such other reasons as may be prescribed in the Guidelines.

(6) A bureau shall ensure that no agent has unlimited access to credit information in the possession or control of the bureau.

(7) A bureau shall only grant an agent access to a customer's credit information upon the agent's lawful request or for the purposes of a lawful transaction under these Regulations.

Actions requiring prior approval.

(8) A bureau shall conduct a suitability assessment on the capabilities of an agent and shall satisfy itself as to the - (a) existence of adequate infrastructure for the collection of information and delivery of credit reports by the agent; (b) ability of the agent to maintain the confidentiality of customer credit information; and (c) ability to conduct proper and sufficient due diligence and identity verification with respect to any person requesting customer credit information.

(8) A bureau shall contract each agent on a non-exclusive basis.

(10) The Central Bank may prescribe guidelines for the contracting and operations of agents.

17. (1) A bureau shall apply to the Central Bank in writing for approval before conducting any of the following activities -
    (a) the appointment of directors and officers of the bureau; (b) the acquisition of at least five per cent of the shares of a bureau by any person except as may be authorised by the Central Bank under these Regulations; (c) the opening, relocation or closure of a place of business in or outside Kenya; (d) the temporary closure of a place of business; (e) the appointment of agents; (f) changes in the memorandum and articles of association of the bureau; (g) the passing of a shareholders' resolution to voluntarily wind up the bureau; (h) the introduction of new products or services; (i) fees payable by customers and any increase of such fees; (j) arrangements or agreements— (i) for the sale, transfer or disposal of the shares or business of the Bureau; or a merger, amalgamation, acquisition, take over or assignment; and (ii) affecting the voting power, management or other matters which may result in a change in the control or management of the Bureau.

(2) With respect to the permanent closure of a place of business, a bureau shall notify the Central Bank three months before the closure.

(3) With respect to the temporary closure of a place of business, a bureau shall notify the Central Bank at least seven days before the closure or such other shorter period as the Central Bank may approve in the circumstances.

18. (1) Bureaus may share customer information, including positive and negative credit information, only in accordance with these Regulations and such customer information may include the following details—
    (a) the customer's identity, including -
    Nature of information to be shared.

No. 29 of 2015.

(i) in the case of a natural person, the person's name, date of birth, national identity card number, personal identification number issued under the Tax Procedures Act, 2015, passport number, driving licence number, previous and current addresses, and any other contact details; and (ii) in the case of a customer who is not a natural person, the customer's name, registration number, personal identification number issued under the Tax Procedures Act, 2015, names of directors, shareholders holding more than five per cent of its shares or partners, trustees or officials, former and current addresses, and any other contact details; (b) the customer's credit status including the nature and amounts of loans or advances and other credit facilities advanced or granted, amounts outstanding thereof, credit application and related matters; (c) the nature and details of any security or securities taken or proposed to be taken by an institution as security for the loans, advances and other credit facilities; (d) details of payment of credit facilities or default in payment by the customer, debt restructuring and actions taken by the institution to recover unpaid amounts including realization of securities, legal proceedings and related matters; and (e) identity details of the shareholders, directors, partners or officials of a corporate entity or unincorporated entity which has defaulted in repaying its credit facility.

(2) An institution, third party credit information provider or any other person shall not submit to any bureau any negative credit information of a customer or any other person where the amount related to the credit information does not exceed one thousand shillings.

(3) A bureau shall include a customer's credit score in every credit report prepared with respect to that customer.

(4) A bureau shall furnish customer information using a format approved by the Central Bank.

(5) An institution or third-party credit information provider submitting credit information to a bureau shall ensure that such information is complete and accurate.

(6) An institution or third-party credit information provider that submits incomplete or inaccurate information to a bureau shall be liable to such penalty as the Central Bank may impose.

Identification details.

Protection from liability.

(7) The Cabinet Secretary may, on the recommendation of the Central Bank, by notice in the Gazette, suspend some aspects of exchange of negative information under paragraph (1) for such a period and for such reasons as the Cabinet Secretary may specify.

19. Any credit information of a person shall be submitted to a bureau with such identification details as would enable the bureau to link the customer to all the customer's transactions with any other person.

20. (1) A suit, prosecution or other legal proceedings shall not lie against the Central Bank, bureau, an institution or chairperson, director, member, auditor, adviser, officer or other employee or agent of the Central Bank, such bureau or institution or any other person authorised under these Regulations to submit, receive, use or share credit information, for any loss or damage caused or is likely to be caused by anything which is done or intended to be done in good faith in pursuance of these Regulations or guidelines issued hereunder.

(2) Nothing contained in paragraph (1) shall affect the right of any person to make a claim against the Central Bank, a bureau, an institution or chairperson, director, member, auditor, adviser, officer or other employee or agent of the Central Bank, such bureau or institution, as the case may be, in respect of loss or damage caused to him on account of any such disclosure made by anyone of them and which is unauthorised or fraudulent or contrary to provisions of these Regulations, guidelines or any other law to which these Regulations relate.

(3) A person who has been made liable for the acts or omissions of another person may seek indemnity from the person who was at fault.

21. (1) A bureau shall not include in its database or a credit report personal information of a customer relating to race, belief, colour, ethnic origin, religion, political affiliation, sexual orientation, physical and mental handicaps, state of health or medical information.

(2) Despite paragraph (1), any information relating to Shariacompliant products shall not be considered to contravene this regulation.

22. (1) Where the consent of a customer is required under these Regulations for the submission or sharing of credit information, such consent may be obtained by the customer signing any document giving express consent or authorisation for the sharing of credit information.

(2) The documents under paragraph (1) may include accountopening documents, loan application forms, loan agreements or any other agreement document between an institution and the customer or the customer and a third-party credit information provider or by any other documentary means as may be convenient or agreeable between the parties.

Prohibited information.

Form of consent.

(3) A customer may give consent through oral, print or electronic means, subject to the satisfaction of the Bureau or institution as to the authenticity of the electronic consent.

23. (1) A bureau or agent shall, before making a disclosure under these Regulations, require a customer to identify himself or herself.

(2) A disclosure by a bureau or agent may be made in writing, in person, during normal business hours, and, on reasonable notice, by telephone, email or any other electronic means, if available to the Bureau or agent, as the requesting person may choose.

(3) The customer may be accompanied by one other person of his or her choice, who shall furnish reasonable identification before he or she is allowed, on the instructions of the customer, to have access to the customer information.

(4) A bureau or agent shall require the customer to grant written or oral permission to discuss the customer's information whenever a third party is present and where the third party is authorised to act on behalf of the customer in respect of the customer's information.

(5) A bureau shall appoint trained personnel to explain to the customer any information furnished to the customer where such explanation is needed by the customer.

24. (1) A bureau may, with the approval of the Central Bank, collect, receive, collate, compile and disseminate information relating to a customer which is obtained from a third party or is ordinarily available to the public, including information from public entities including -
    (a) the Business Registration Service established under the Business Registration Service Act, 2015; (b) registrar of business entities; (c) business and trade licensing authorities; (d) Land Registrars appointed under section 12 of the Land Registration Act, 2012; (e) the Kenya Revenue Authority established under the Kenya Revenue Authority Act, 1995; (f) county governments and county government entities; (g) court registries in respect of information on judgments on debts, insolvency or bankruptcy proceedings or winding up orders; (h) registration officers appointed under the Registration of Persons Act; (i) other relevant public bodies.

(2) An application for the approval of a third-party credit information provider shall be accompanied by the application fees Cap. 107.

No. 3 of 2012.

No. 2 of 1995.

Disclosures.

Other sources of information.

No. 15 of 2015.

specified in the Fourth Schedule and a suitability assessment report detailing the information set out in paragraph (4).

(3) A Government ministry, department or agency, public entity and other credit information provider may enter into contracts with bureaus for the provision of information and such contract shall specify - (a) the conditions for the provision of information; (b) the obligation to furnish accurate and updated information; (c) the obligation to promptly correct any information submitted to the bureau which is inaccurate, false, misleading or erroneous in any form, or has been overtaken by events; (d) details on data to be provided; and (e) the manner and form through which the information shall be submitted to the bureaus.

(4) A bureau shall, before engaging a third-party credit information provider, carry out due diligence and suitability assessment of the third-party credit information provider and establish - (a) the nature and character of the third-party credit provider's ownership and management; (b) the nature of the third-party credit provider's business and whether it is subject to any legal or regulatory framework; (c) the soundness of the third-party credit provider's information management system in relation to generation, storage and transmission of customer information; (d) the accuracy and integrity of the third-party credit provider's records; (e) the credibility of credit information of every person the third-party credit provider deals with; (f) whether the third-party credit provider's customers have expressly consented to the sharing of the customers' credit information; (g) whether the third-party credit provider's customers are fully aware of the terms and conditions of customers' relationships with the third-party credit information provider with respect to credit information sharing; and (h) any other matter as the Central Bank may specify.

(5) A bureau shall not contract a third-party credit information provider whose customer's financial or credit information is occasionally based on estimates or is subject to assessment before ascertaining the completeness of the information.

(6) A third-party credit information provider shall not furnish any credit information of a customer to a bureau or its agent except with the prior written consent of the customer.

Use of public data by bureaus.

(7) The Central Bank may, if it considers it necessary, prohibit a bureau from receiving credit information or disseminating credit information to or from any third-party credit information provider or a public entity.

(8) A third-party credit information provider shall be subject to such industry code of conduct as the Central Bank may approve.

25. (1) A bureau may obtain information from public and nonpublic sources and include public information in any report prepared under these Regulations:
    Provided that before including such information - (a) the bureau shall take such reasonable measures to confirm the accuracy and authenticity of the information from a source that has independent and direct knowledge of the information; and (b) the bureau shall, where such information relates to any court proceeding of a civil or criminal nature or any public record, verify the accuracy and authenticity of the information not more than twenty-one days before the date on which the information is included in any report.

(2) Each bureau shall periodically report to the Central Bank the sources and details of the public data included in its reports and the measures or process undertaken confirm the accuracy and authenticity of the data.

(3) Where a bureau has included in any report information from public sources, and the Central Bank is satisfied that a bureau did not take all reasonable measures the confirm the accuracy and authenticity of the data, the Central Bank shall direct the Bureau to delete the information from its database and, in addition, impose a penalty not exceeding five hundred thousand shillings.

26. (1) A credit information provider who furnishes negative information to a bureau with respect to a customer shall, in writing or through electronic means, notify the customer of the intention to submit the negative information at least thirty days before submitting the negative information to the bureau or within such shorter period as the contract between the credit information provider and the customer may provide.

(2) The provisions of paragraph (1) shall not be mandatory with respect to the furnishing of positive information of a customer to a bureau by a credit information provider.

(3) A credit information provider shall not furnish any information relating to a customer to any bureau if the credit information provider knows or has reasonable cause to believe that the information is inaccurate.

(4) A credit information provider shall not furnish information relating to a customer to any bureau if the credit information provider has been notified by the customer, in writing or verbally, at the address Duty to notify customer of furnishing of negative information to bureau.

specified by the credit information provider for such notices, that the specific information is inaccurate.

(5) Despite paragraph (4), the credit information provider may submit the credit information to a bureau once it has addressed the customer's concern on the inaccuracy of the credit information - (a) by re-affirming the accuracy of the information to the customer; or (b) by rectifying the inaccuracy.

(6) Where the credit information provider has been notified of any inaccuracy in the credit information and there is reasonable cause to believe that the information may not be accurate, the credit information provider shall inform all the bureaus to which the information has already been submitted of this fact within five days from the date of the notification and shall, within fourteen days, carry out investigations and inform the bureaus of the outcome of the investigation.

(7) A credit information provider shall -
(a) correct any inaccurate or erroneous information when the inaccuracy or erroneousness of information comes to the credit information provider's knowledge or attention; and (b) notify the bureaus within five days from the date of learning of the inaccurate or erroneous information.

(8) A bureau that has been notified under paragraph (7) of inaccurate or erroneous information shall update its database within two working days of the date of the notification.

(9) A credit information provider who has furnished credit information to a bureau shall, within thirty days from the date the information was furnished to a bureau, notify the customer that the customer's credit information has been forwarded to the bureau.

(10) A credit information provider which intentionally, recklessly or negligently submits inaccurate information to a bureau or which, after being notified by a customer, does not adequately address the inaccuracy or erroneousness of information submitted or to be submitted to a bureau, shall be barred by the Central Bank or the relevant bureau from submitting credit information to that bureau or any other bureau.

27. (1) A bureau shall protect the confidentiality of customer information in its possession or control under these Regulations and only report or release such information -
    (a) to the customer;
    (b) to the Central Bank;
    (c) to a requesting subscriber;
    (d) to a third party as authorised by the customer concerned; or Confidentiality of customer information.

(e) as required by the Act, Microfmance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law.

(2) Except as otherwise provided under paragraph (1), a director, member, officer or other employee or agent employed in the business of a bureau or a subscriber shall not disclose any information to any person and this obligation shall continue to apply even after termination of tenure, employment or relationship with the bureau or subscriber.

(3) A director, member, officer or other employee or agent of a bureau or subscriber who contravenes the provisions of paragraph (2) commits an offence and shall be liable, upon conviction, to imprisonment for a term not exceeding two years or to a fine not exceeding five hundred thousand shillings, or to both.

(4) The Central Bank may, in lieu of prosecution under paragraph (3), impose such sanctions against the bureau, subscriber, director, member, officer, other employee or agent as the Central Bank may deem fit including terminating the tenure or services of the director, member, officer, other employee or agent of the bureau.

28. (1) A Bureau shall -
    (a) utilize the information collected solely for the purposes set out in these Regulations; (b) take reasonable measures to ensure that customer information maintained by it is protected from unauthorized access, use, modification or disclosure; (c) ensure that customer information maintained by it is not charged or encumbered for any purpose; (d) ensure that customer information is obtained from reliable and credible sources which take responsibility for the accuracy, completeness and timeliness of the information; (e) observe, through its shareholders, directors, officers, employees or agents, a perpetual duty of confidentiality with regard to all customer information; (f) accept without charge the filing of customer credit information from the customer for the purpose of correcting or challenging information otherwise held by that bureau concerning that customer; (g) take reasonable measures to verify the accuracy of any customer credit information submitted to it; (h) retain customer credit information submitted to it for the prescribed period, irrespective of whether that information reflects positively or negatively on the consumer; (i) maintain records of customer credit information in accordance with the Act, these Regulations or any other relevant written law; Responsibilities of a bureau.

(j) promptly expunge from its records any prescribed customer credit information that is not permitted to be entered in its records or is required to be removed from its records in accordance with the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law; (k) issue a report to any person who requires it for a prescribed purpose or a purpose contemplated in these Regulations, upon payment of the bureau's fee except where such a fee has been specified; not knowingly, recklessly or negligently provide a report to any person containing inaccurate information; establish and maintain a complaints' resolution mechanism including by establishing a dispute resolution unit to handle queries or complaints and a dedicated telephone line for contact purposes; include in every report issued, the name of the institution or third-party credit information provider which has submitted a negative credit information on any person; maintain a database which can be searched using either a natural person's national identity card number, passport number, Personal Identification Number issued under the Tax Procedures Act, 2015, or any other valid identification number and in the case of a corporate entity or any other unincorporated entity, the Personal Identification Number of the entity and the identity card numbers and Personal Identification Numbers of their respective directors or officials, as the case may be; (p) not keep in its database such customer information which ought not to be kept in the database; (q) not delete or remove from its database any credit information which ought to remain in its database; (r) not issue a credit report that erroneously represents the status of credit information of a customer; and (s) analyze information submitted to it and establish any existing relationships between corporate entities, unincorporated entities and natural persons whose data has been submitted to the bureau.

(2) A bureau shall enter into a non-exclusive agreement or arrangement with a third-party credit information provider for credit information sharing and any other bureau may also enter into a similar agreement or arrangement with the same third-party credit information provider for credit information sharing.

(3) A bureau shall only release customer information to a subscriber— No. 29 of 2015.

(i) evaluate the customer's application for credit or other customer-initiated business transaction; (ii) for the recovery of any sum due to the institution; (iii) for customer account management, fraud detection and prevention, credit rating, employment evaluation, tracing owners of unclaimed assets, development of a scoring system, assessment of a debtor's books of business; and (iv) for any other purpose approved by the Central Bank; (b) that has certified to the bureau that it shall use the customer information for the purpose of making a lawful or permitted decision only; and (c) that has agreed to properly destroy customer information in such a manner that it cannot reasonably be read or reconstructed.

(4) A bureau shall not, in the first instance, charge any fee in respect of a clearance certificate issued to a person for any purpose.

(5) A bureau which fails or refuses to comply with the provisions of this regulation shall be liable to pay a penalty not exceeding five hundred thousand shillings and any other administrative sanction as the Central Bank may determine.

29. (1) Each bureau shall prepare a summary of the rights of customers.

(2) The summary of the rights prepared under paragraph (1) shall include a description of - (a) the right of a customer to obtain a free copy of a credit report from the bureau; (b) the frequency and circumstances under which a customer is entitled to receive a credit report from the bureau, with or without charge; (c) the right of a customer to dispute information about the customer held by the bureau; (d) the right of a customer to obtain a credit score from the bureau and a description of how the credit score was arrived at; (e) the method by which a customer can contact and obtain a credit report from the bureau without charge; and (f) the right of a customer to refer a dispute to an alternative dispute resolution mechanism, a court of law or the Central Bank where the customer feels that a dispute has not been resolved to the customer's satisfaction.

(3) A bureau may publish any other information which may be useful to its customers.

(a) that requires the customer information to - Customer rights.

(4) A bureau shall -
(a) publicise the availability of the summary of rights;

Subscribers'
obligations in
respect of
information
obtained from
bureaus.

(b) conspicuously post on its website and business premises the summary of rights; and (c) provide the summary of rights to its customers on request or as may be necessary to bring to the attention of as many of the bureau's customers as possible.

30. (1) A subscriber of information from a bureau shall not use such information for any purpose other than for reaching decisions on transactions concerning a customer and on matters concerning an employee or a potential employee of the subscriber or for any other purpose as may be authorised under these Regulations.

(2) A subscriber shall not release information obtained from a bureau to any third party except as may be required under the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations or any other relevant written law, or to a subscriber's appointed agent for the purpose of assisting the subscriber in the recovery of any of subscriber's debts.

(3) A subscriber shall not request a credit report from a bureau unless the request is for a specified purpose and in respect of a person who is - (a) the subscriber's customer or has applied for credit facilities from the subscriber; or (b) the subscriber's employee or has applied for employment by the subscriber.

(4) A subscriber shall take all necessary precautions to ensure that the information provided to it by a bureau is - (a) properly and accurately recorded and maintained; (b) protected against loss; and (c) protected against unauthorised access, use, modification or disclosure.

(5) A subscriber shall take measures to safeguard the security of information provided to it by a Bureau or by it to a Bureau including measures for - (a) the establishment of controls and procedures to be applied when accessing a credit report in order to prevent unauthorised requests for credit reports; (b) keeping audit trails of information supplied by it to a bureau or received from a bureau; and (c) regularly reviewing passwords and other controls over all personnel with access to the subscriber's database of information provided to it by a bureau in order to prevent unauthorised access or use.

(6) A subscriber shall ensure that information that is requested from a Bureau or, if received by the subscriber from a bureau, is not used by, or on behalf of, the subscriber for marketing, data-mining or similar purposes.

(7) Any subscriber which fails or refuses to comply with any provision of this regulation shall be liable to penalty not exceeding five hundred thousand shillings.

31. (1) A customer may, in writing, authorise a third party to obtain directly from a bureau a credit report in respect of that customer for the following purposes -
    (a) the assessment of a credit facility;
    (b) employment; (c) underwriting insurance;
    (d) the determination of the customer's eligibility for a licence or benefit issued or granted by the Government; (e) the assessment of the credit or prepayment risks associated with an existing credit obligation; or (f) a legitimate need for information in connection with a business transaction initiated by the customer or other lawful transaction or matter concerning the customer.

(2) A bureau shall verify the authenticity of the authority granted under paragraph (1) by the customer and may, that purpose, use such means as the bureau may find appropriate and reliable.

32. (1) A bureau may, with the written approval of the Central Bank, charge fees for its services.

(2) Each bureau intending to increase its fees or to introduce a new fee shall apply in writing to the Central Bank for approval before such increase or introduction.

(3) An application under paragraph (2) shall state the reasons for the increase of the fee or the imposition of the new fee, the impact of the increase or introduction on consumers and comparative rates in the market.

(4) The Central Bank may review downwards any approved fees or charges if, in its opinion, the circumstances render it necessary.

(5) A bureau shall publish its charges and fees in a conspicuous place within its business premises and its website.

33. (1) A bureau shall—
    (a) implement quality control procedures in order to ensure the accuracy of its database and continuity of its services; (b) take all such necessary steps to ensure that customer information maintained by it is current, authentic, legitimate, reliable, accurate, truthful and reflects the existing situation of the subject at any given time; Data management and quality control.

Receipt of credit reports by third parties.

Restrictions on fees charged by bureaus.

Retention of information.

(c) where customer information is found to be inaccurate or no longer valid, take the necessary corrective measures to remedy the inaccuracy or address the invalidity; (d) ensure that its services are reasonably available and accessible; (e) develop mechanisms for easy request for and accessibility of credit reports in physical or electronic form or any other convenient and cost-effective way and may include fax, telephone, mail, email, interne or in person; (f) establish controls and procedures on accessing credit reports by subscribers; (g) maintain logs of all accesses, amendments and audit trails to information database including historical enquiry records and logs of all incidents involving proven or suspected breaches of security; (h) regularly review password controls of all bureau personnel and subscribers; (i) develop operational guidelines and procedures to address any improper use of access authorities by bureau personnel, authorised agents or subscribers or persons authorised by them; and (j) develop operational guidelines to minimise risks of unauthorized access to its database or interception of communications made to and from its database.

(2) A bureau which contravenes the provisions of this Regulation shall be liable to a penalty not exceeding five hundred thousand shillings.

34. (1) Each bureau shall retain customer information on nonperforming loans -
    (a) until the expiry of five years from the date of final settlement of the amount in default including the settlement of the amounts payable under a scheme of arrangement; or (b) until the expiry of seven years from the date of the customer's discharge from bankruptcy as notified to the bureau by the customer:
    Provided that where a customer notifies the bureau of the customer's discharge from bankruptcy, the customer shall provide the relevant certificate of discharge issued by the High Court or by a written notice from the Official Receiver stating that the Official Receiver has no objection to a certificate of discharge being issued to the person, irrespective of any write-off by the institution of the amount in default in full or in part at any time.

(2) Each bureau may, with respect to information not specified in paragraph (1), retain such information for a period not exceeding five years from the date of submission of the information or receipt of the information by the bureau.

(3) A bureau shall, on the expiry of the periods specified in paragraphs (1) and (2), expunge from its database the relevant customer information .

(4) A bureau shall, within seven days from the date of expunging customer information under paragraph (3), notify the relevant customer that the information is no longer held by the bureau.

(5) Any Bureau that fails to expunge customer information which ought to be expunged from its database or fails to notify a person pursuant to paragraph (4) shall be liable to pay a penalty of five hundred thousand shillings and in the case of continued failure, it shall be liable to an additional penalty of ten thousand shillings for each day on which such failure continues.

updating customer information held or controlled by the bureau.

35. (1) Each bureau shall establish procedures for regularly customer Updating information.

(2) An institution or a third-party credit information provider that furnishes customer information to a bureau shall update the relevant customer information immediately here is a change in the information.

(3) Each bureau shall update its database as and when information is provided by the institutions responsible for the timely updating of the information in accordance with the nature of the information and in any case, within two days from the date of receipt of the updated information.

(4) A bureau or institution that violates any provision of this Regulation shall be liable to a penalty not exceeding five hundred thousand shillings in addition to any other sanction that the Central Bank may impose.

36. (1) Fach bureau shall take the necessary security and Security and control measures to prevent unauthorized access to, or improper use or control measures.

mismanagement of information.

(2) For the purposes of paragraph (1), improper use or mismanagement of information means any act or omission that is not authorized by these Regulations.

(3) Each bureau shall record and make available to the customer the name and date each subscriber accesses customer information about the customer.

(4) Each bureau shall -
(a) develop written policies and procedures for its officers, employees, agents and contractors, or any other person providing services to the bureau; (b) impose access authentication controls including the use of passwords, digital signatures or other mechanisms as may be necessary for security controls; (c) provide information and training to its employees to ensure compliance with the policies, procedures and controls;

(d) systematically review, and where necessary, remedy the effectiveness of the policies, procedures and controls; and (e) establish and maintain an access log.

37. (1) A customer has a right to know what information the institution has submitted to the Bureau regarding that customer.

(2) A customer shall be entitled to access credit reports relating to the customer that are kept in a database administered by a bureau.

(3) A customer shall be entitled to a copy of his credit report from each bureau, or its agents, at no charge, in the following cases - (a) at least once per year; (b) within thirty days of receiving an adverse action notice issued under regulation 63 (1) (c); and (c) once in every six months after making a request to a bureau to have inaccurate information corrected.

(4) Where a customer requests a credit report under paragraph (2), the bureau shall, within five working days after receiving the request and such particulars as the bureau may reasonably require to enable it identify the customer, provide to the customer a copy of all customer information relating to the customer held by the bureau.

(5) Where the customer knows or has reason to believe that the information contained in the database is inaccurate, erroneous or outdated, the customer may notify the bureau in writing of the information disputed.

(6) Within five working days of being informed that the information in a customer's credit report is disputed under paragraph (5), the bureau shall - (a) attach a note to the credit information report, warning that the disputed information is under investigation, and the note shall remain attached to the information until resolution of the dispute; and (b) notify the institution or credit information provider that supplied the information of the dispute and request confirmation from the institution or credit information provider as to the accuracy of the information.

(7) The bureau shall, within seven days of being informed that credit information is disputed, conduct investigation based on the relevant information provided by the customer, and may contact any person who has furnished information.

(8) Where an institution or credit information provider receives a notice of dispute from the bureau it shall, within twenty-one days of receiving the notice, complete all necessary investigations into the disputed information and give all bureaus a notice of resolution, advising whether the disputed information is to be deleted, corrected, or shall remain unchanged.

Customers' rights of access and correction.

(9) Where the investigation reveals an error, all the bureaus shall remedy the error and inform all persons who may be affected by the information including the customer.

(10) If the bureau, an institution or credit information provider does not complete its investigation within twenty-one days, it shall delete the disputed information as requested by the customer.

(11) A bureau shall not receive or act on any updated information affected by paragraph (1), unless the customer confirms in writing the accuracy of the updated information.

(12) Upon receipt of a notice of resolution or an amendment notice from an institution the bureau shall, within five working days of such receipt, send a notice of change to any subscriber that has in the previous twelve months obtained a credit information report from the bureau containing the incorrect information.

(13) Where the customer disagrees with the resolution of the disputed information, the customer may request the bureau to attach a statement of not more than one hundred words to the customer's credit report, setting out the customer's claim that the information is not accurate and the bureau shall take reasonable steps to comply with the customer's request.

(14) A bureau may charge the customer for the cost of its services in conducting an investigation of disputed customer information where the information disputed by the customer turns out to be false.

(15) A customer who is dissatisfied with a resolution of a disputed credit information may refer the dispute to the Central Bank, without prejudice to his right to pursue any other available remedy.

38. Each institution or third-party credit information provider may access the information it has submitted to bureaus and bureau shall avail the information to that institution or third-party credit information upon request and only if it can be extracted from the database in its original form or content.

39. (1) Each bureau shall develop a credit score for every person whose credit information has been submitted to the bureau.

(2) A credit score may be computed in such manner and may have such details as the Central Bank may specify.

(3) Every credit report shall contain a credit score of the person to whom the report relates:
Provided that this paragraph shall not apply to a person whose credit information has not been submitted to a bureau.

(4) Each bureau shall retain for a period of at least five years the credit scores of any person in its possession or control.

40. (1) A customer's credit score shall not be used solely to deny the customer a loan, credit facility or any other financial service but shall be used as one of the factors to inform the decision-making Access to own information.

Credit scores.

Use of credit scores.

process when determining the customer's application for a loan, credit facility or any other financial service.

(2) Each institution shall consider a customer's credit score in appraising a customer's credit application and in the pricing of a credit facility to that customer.

(3) A credit appraisal integrating a customer's credit score shall be in writing and provided to the customer as part of its notification to the customer on the customer's credit application.

(4) Where a customer's credit application has been declined, the institution shall immediately and in writing notify the customer of the decision and shall specify the reasons for the decision.

(5) An institution that denies a customer a credit facility or any other financial service solely on the basis of a credit score shall be liable to a monetary penalty of two million shillings or such other sanctions under the Act, the Microfinance Act, 2006, or the Sacco Societies Act, 2008, as the Central Bank may impose.

PART IV—CROSS-BORDER CREDIT INFORMATION SHARING
41. (1) The following persons may share cross-border credit information of another person -
(a) regulators or supervisory authorities and credit reference bureaus or entities performing regulatory or supervisory roles; and (b) institutions and credit reference bureaus or entities performing similar roles (2) The sharing of information under paragraph (1) shall only apply where there is a reciprocal arrangement between the persons sharing cross-border information.

(3) The Central Bank shall publish in its website or in any other manner and maintain an up-to-date a list of reciprocal arrangements under paragraph (2).

(4) Where an authorised person seeks to obtain credit information of a person from another authorised person located in another country, the following requirements shall apply - (a) the request shall be made in writing and shall set out - (i) the complete identity details of the requesting person including details of its principal place of business; (ii) the nature of its business or functions; (iii) the identity details of the person whose information is sought; (iv) the nature of credit information that is being sought; (v) the purpose for which the information sought will be used and how it will assist in discharging a function, performing a duty or the rendering of a service; Authority to share cross-border credit information.

(vi) documentary evidence with respect to a matter that would require the credit information sought; (vii) the grounds on which the requesting person reasonably believes that the credit information is in possession of the other person; (viii) evidence establishing that the legal framework of the country in which the requesting person is located permits cross-border sharing of credit information; (ix) an irrevocable undertaking that the information shall be used solely for the stated purpose and shall be kept confidential at all times even after the information has been used; (x) an irrevocable undertaking that the confidentiality of the information shall be maintained at all times even after the information has been used for the purposes for which it was sought; (b) upon receipt of the request, the receiving person shall analyse the request and establish that the request meets the requirements of these Regulations and may, if it does not, request for additional information; (c) where the credit information sought is in the possession of the requested person, the person may furnish the requesting person with the information; and (d) where the information sought is not in the possession of the requested person or where the information is in the possession of another person or, for whatever reason, the requested person does not wish to share the information with the requesting person, the requested person shall notify the requesting person in writing of its decision.

(5) Any person who violates the provisions of this regulation commits an offence shall, on conviction, be liable to a fine not exceeding ten million shillings in addition to any other sanctions as the Central Bank may impose.

42. A bureau licensed in Kenya may, with the approval of the Central Bank, establish a subsidiary, branch, agency or marketing unit in outside Kenya for the purposes of cross-border credit bureau business.

PART V —GOVERNANCE AND MANAGEMENT OF BUREAUS
43. (1) The management of a Bureau shall vest in a board of directors consisting of at least five directors, two-thirds of whom shall be non-executive directors.

(2) A person shall be qualified for appointment as a director of a bureau if that person - (a) has been approved by the Central Bank for that purpose; and Establishment of places of business outside Kenya.

Management and composition of a bureau.

(b) is not otherwise disqualified from holding office as a director of a bureau under these Regulations.

(3) The directors of a bureau shall elect from among themselves a non-executive chairperson.

(3) In determining the suitability of a person to become a director of a bureau, the Central Bank may consider - (a) that person's possession of adequate professional credentials or experience or both for the position for which he is proposed; (b) that person's ability to provide dispassionate advice; (c) that person's ability to recommend sound business practices; (d) that person's ability to avoid conflicts of interest; (e) that person's ability to safeguard confidential information; (f) any other material information which in the opinion of the Central Bank has a bearing on the suitability of the person.

(4) A person is not qualified to hold office as a director if that person— (a) has been convicted of an offence under the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, or these Regulations; (b) has been convicted of a criminal offence and sentenced to imprisonment for a term exceeding six months or to a fine exceeding fifty thousand shillings; (c) has been convicted of an offence involving dishonesty or fraud, or an offence under the Anti-Corruption and Economic Crimes Act, 2003; (d) is adjudged bankrupt or enters into a composition scheme or arrangement with his or her creditors; (e) has contravened the provisions of any law designed for the protection of members of the public against financial loss due to the dishonesty or incompetence of or malpractices by persons engaged in the provision of banking, insurance, investment, capital markets, pensions or retirement benefits, or other financial services; (f) has been a director of, or directly concerned in the management of, any institution which is being or has been wound up or placed under statutory management by a court; (g) has defaulted in the repayment of any advance or loan made to him or her by any institution; (h) is a minor or of unsound mind; or No. 3 of 2003.

0. is an auditor of the bureau or associated companies of the

bureau.

Functions of the

Board.

44. The functions of the Board shall be to—

(a) establish the operations and information technology

systems of the bureau;

(b) ensure that the activities conducted by the bureau conform

with the Act, the Microfinance Act, 2006, the Sacco

Societies Act, 2008, these Regulations and any other

relevant written law;

(c) facilitate the appointment of a Chief Executive Officer and

Chief Information Technology Officer for the bureau;

(d) ensure that the bureau maintains an effective system of

internal controls;

(e) ensure that the bureau maintains customer complaints and

inquiry service mechanisms to attend to customers who

may be affected by the information contained in the

database and who allege that the information is incomplete,

inaccurate, erroneous or outdated;

(f) ensure that the bureau has adequate staff to undertake its

functions of and meet its customers' demands;

(g) ensure that credit reports and credit scores generated by the

bureau are accurate, complete and up to cate, and not

misleading; and

(h) protect the integrity and confidentiality of data kept by the

bureau.

45. (1) The Board shall hold its meetings at least once in every

three months but may hold such additional meetings as circumstances

may render necessary.

(2) The quorum for meetings of the Board shall be at least three

members, but where the Board is comprised of more than five directors,

the quorum shall be at least fifty per cent of all directors.

46. The decisions of the Board shall be by a majority vote of

the directors who shall be present and voting.

47. A director shall attend at least seventy-five per cent of the

meetings of the board.

48. (1) A Board may hold some of its meetings through video

conference but at least seventy-five percent of the quarterly meetings

referred to in paragraph (5) shall be held in person in one location.

(2) The Central Bank may prescribe the manner in which

meetings of the Board may be arranged and held through video

conferencing.

49. (1) Each bureau shall maintain sufficient capital to enable Capital.

it to run its operations efficiently and soundly.

0) is an auditor of the bureau or associated companies of the bureau.	Functions of the
44. The functions of the Board shall be to—	Board.
(a)	establish the operations and information technology systems of the bureau;
(b)	ensure that the activities conducted by the bureau conform with the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, these Regulations and any other relevant written law;
(c)	facilitate the appointment of a Chief Executive Officer and Chief Information Technology Officer for the bureau;
(d)	ensure that the bureau maintains an effective system of internal controls;
(e)	ensure that the bureau maintains customer complaints and inquiry service mechanisms to attend to customers who may be affected by the information contained in the database and who allege that the information is incomplete, inaccurate, erroneous or outdated;
(f)	ensure that the bureau has adequate staff to undertake its functions of and meet its customers' demands;
(g)	ensure that credit reports and credit scores generated by the bureau are accurate, complete and up to cate, and not misleading; and
(h)	protect the integrity and confidentiality of data kept by the bureau.
45.	(1) The Board shall hold its meetings at least once in every
three months but may hold such additional meetings as circumstances	Meetings of the Board.

Decisions of the Board.

Attendance of meetings.

Videoconference.

Disqualification of officers and employees.

(2) Each bureau shall, at least once in every three months, submit to the Central Bank information on its capital adequacy status.

(3) Where a bureau is facing capital adequacy challenges, the Central Bank may require the bureau to - (a) submit a capital restoration plan; (b) restrict its activities; or (c) take such other action or to refrain from such action as the Central Bank may specify.

(4) The Central Bank may specify the minimum capital which every bureau shall maintain.

50. (1) Each bureau shall ensure that a person shall not be an officer or employee of a bureau, or, if already in office or employment, shall be disqualified and shall not be eligible to hold office or be in the employment of any Bureau for a period of ten years, if such person is -
    (a) an undischarged bankrupt or enters into a composition or scheme of arrangement with his creditors; (b) convicted of an offence involving fraud or dishonesty; or (c) removed from office in accordance with the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, or these Regulations.

(2) Where a bureau allows a disqualified person to continue acting as an officer or being in employment, or is otherwise in breach of this regulation, it shall be liable to a penalty not exceeding five hundred thousand shillings and the disqualified person acting as an officer or employee shall be liable to pay a fine not exceeding one hundred thousand shillings.

51. (1) The Central Bank shall, where it is satisfied as to the professional and moral suitability of a significant shareholder, director or senior officer of the bureau, certify the person as fit and proper to be a significant shareholder, director or senior officer.

(2) While determining the professional and moral suitability of a significant shareholder, director or senior officer of a bureau under paragraph (1), the Central Bank shall consider the following qualities, in so far as they are reasonably determinable, of the person concerned— (a) that person's integrity; (b) that person's competence and soundness of judgment for the fulfilment of the responsibilities of the office in question; and (c) the diligence with which that person is likely to fulfil the responsibilities of office.

(3) For the purposes of these Regulations and without prejudice to the generality of the provisions of paragraph (2), the Central Bank Suitability test.

may have regard to the previous conduct and activities of the person concerned in the bureau business, and in particular, to any evidence that such person - (a) has been convicted of an offence of fraud or any other offence of which dishonesty is an element; (b) has contravened the provisions of any law designed for the protection of members of the public against financial loss due to the dishonesty or incompetence of, or malpractices by, persons engaged in the provision of banking, insurance, investment or other financial services; (c) was an officer or director of an institution that has been liquidated or is under liquidation or statutory management under the relevant law; (d) has taken part in any business practices that in the opinion of the Central Bank were fraudulent, prejudicial or otherwise improper, whether unlawful or not unlawful or which otherwise discredited his methods of conducting business; or (e) has taken part in or been associated with any other business practices as would, or has otherwise conducted himself in such manner as to cast doubt on his competence and soundness of judgment.

(4) The Central Bank may request any person to furnish additional information, as may be necessary, in determining the professional or moral suitability of that person as prescribed in these Regulations.

PART VI—DISSOLUTION AND LIQUIDATION
52. A bureau licensed under these Regulations may be compulsorily or voluntarily liquidated in accordance with the provisions of the laws relating to dissolution and winding up of companies in Kenya.

53. (1) Where shareholders of a bureau pass a resolution to voluntarily wind up the bureau, the bureau shall apply to the Central Bank for approval to voluntarily wind up the bureau.

(2) A bureau's application under paragraph (1) shall be accompanied by the following documents - (a) a copy of the minutes of the meeting of shareholders which passed the resolution for voluntary dissolution of the company; (b) the financial statements of the bureau on the date of the resolution, with a report from a credible external auditor; (c) a sworn statement from the Chief Executive Officer of the bureau confirming that there are no workers', corporate or tax obligations pending against the bureau and that the Dissolution and winding up of a bureau.

Central Bank approval for voluntary liquidation.

bureau is able to meet the obligations of all its creditors; and (d) the names and professional record of the person proposed for appointment as the liquidator of the bureau.

(3) Where the Central Bank is fully satisfied with the merits of the application, it may approve the voluntary liquidation of the bureau on such conditions it may consider appropriate.

(4) Where the Central Bank is not satisfied with the application, it may give such directions as it may consider appropriate.

54. Where a petition has been lodged for the winding up of a bureau, the bureau shall, within seven days of such petition, notify the Central Bank of the petition and shall cease from conducting bureau business immediately a winding up order is made.

Notification to the Central Bank.

55. (1) Where a notice has been given to the Central Bank under this Part or where the Central Bank has given its approval for the voluntary dissolution of a bureau under this Part, the bureau shall, within seven days from the date of the notice, forward to the Central Bank in such manner as the Central Bank may direct, all records, documents, data and other information in its possession in relation to the bureau business.

Forwarding data to the Central Bank.

(2) Where the Central Bank is satisfied that all the records, documents, data or other information in relation to the bureau business have been submitted to it, the Central Bank shall direct the bureau to erase all records, documents, data and other information in its database or in its possession and the Central Bank shall, in such manner as it may deem fit, verify that the erasure has been fully carried out.

(3) The Central Bank may take such measures and give such directions as may be necessary to protect the information held by or in control of the bureau or take over the information in possession of a bureau which is being wound up or liquidated.

56. Where a bureau is wound up under this Part, the Central Bank shall, by notice in the Gazette, notify all institutions and other bureaus of such winding up.

Notification to institutions and bureaus.

PART VII—POWER OF THE CENTRAL BANK
57. The Central Bank shall have the power to -
Powers of the Central Bank.

(a) issue, suspend or revoke a licence to conduct credit reference bureau business; (b) supervise the activities •of a bureau;

(c) establish, maintain and enforce standards of conduct and credit information reporting practices; (d) protect the integrity of the credit reference system against abuse and misuse; (e) require bureaus to correct or remedy any violation under the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, or these Regulations; (1) take measures to protect the interests of customers, subscribers or bureaus; (g) impose penalties or sanctions for violation of these Regulations; (h) review the adequacy of a bureau's operations including the periodic inspection of bureaus to ensure compliance with these Regulations; (i) access the premises, systems, documents and any other information of, or held by, a bureau or its agents; and (j) perform such other functions or exercise such other powers as may be necessary for the proper supervision and regulation of bureaus and the bureau business.

58. (1) The Central Bank may cause an inspection to be conducted by any person authorized by it of any bureau, agent or a bureau's operating management information system, premises, data, books, accounts, records, document or other activity.

Inspection of bureaus.

(2) When an inspection is conducted under paragraph (1), the bureau or agent and every officer or employee of the bureau shall produce and make available to the person carrying out the inspection any information, data, record, document or material that may be required by the person for purposes of the inspection.

(3) The person conducting the inspection may make a copy of any document, data, record or material in possession of the bureau or agent.

(4) The person conducting the inspection under paragraph (1) shall prepare and submit to the Central Bank a report on the inspection highlighting that person's findings including any contravention of the provisions of the Act, the Microfmance Act, 2006, the Sacco Societies Act, 2008, or these Regulations, any mismanagement of the bureau or information by users of credit information obtained from the bureau.

(5) Any person who refuses or neglects to provide any record or data as the Central Bank may request under this regulation or obstructs or prevents the Central Bank from supervising a bureau or an agent commits an offence and shall, on conviction, be liable to a fine not

Ownership of information in possession of a bureau.

exceeding two hundred thousand shillings or to imprisonment for a term not exceeding two years, or to both.

59. (1) The information held by a bureau shall be the property of the Central Bank and where a bureau winds up, the information shall revert to the Central Bank.

(2) Despite any agreements to the contrary, the Central Bank shall be the owner of all information and data held by bureaus and any information or data vesting in any work authored by any person licensed under these Regulations, where such work incorporates any information obtained under the licence or pursuant to the provisions of these Regulations shall be the property of the Central Bank despite that information or data having been processed by that person in any way.

(3) The Central Bank shall retain the right of access to data even after revocation or expiry of any licence issued under the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, or these Regulations.

60. (1) The bureau shall furnish the Central Bank with periodic reports of their business operations, including systems report, in such form and within such period as the Central Bank may specify.

(2) A bureau which fails or refuses to comply with this regulation, or which furnishes the Central Bank with incomplete, inadequate, inaccurate or late returns, shall be liable to a penalty not exceeding five hundred thousand shillings.

61. A bureau shall submit to the Central Bank not later than the 31"March of each year, the bureau's audited financial statements for the previous year.

Part Viii—General Provisions

62. (1) A person collecting, storing, submitting or processing any data or information obtained under the provisions of these Regulations shall -
    (a) ensure that the information or data it holds is up to date and accurate; (b) ensure that the information or data it holds shall be used only for the specified purpose for which it was obtained or submitted and which purpose shall be consistent with these Regulations; and (c) ensure that the information or data it holds shall be adequate and relevant in relation to the purpose for which it was obtained or submitted.

(2) A person shall not use the information obtained under these Regulations for any purpose which is not consistent with the provisions of these Regulations.

(3) A person who contravenes the provisions of paragraph (2) commits an offence and shall, on conviction, be liable to imprisonment Periodic returns.

Audited report.

Mandatory
standards for data
collection, storage
and use.

for a term not exceeding two years or to a fine not exceeding one million shillings, or to both.

(4) Without prejudice to paragraph (3), the Central Bank may impose such sanctions as it may consider fit and just including imposing a penalty not exceeding five hundred thousand shillings against any person who contravenes the provisions of paragraph (2).

63. (1) Each institution or third-party credit information provider shall—
    (a) notify the customer at least one month before a loan becomes non-performing that the institution shall submit to a bureau the information on the loan immediately it becomes non-performing:
    Provided that for loans whose repayment interval or period is less than one month, the notice shall be served two weeks before the loan becomes non-performing; (b) notify each customer, within thirty days of the first listing, that the customer's credit information has been submitted to all licensed Bureaus; and (c) issue an adverse action notice to a customer against whom a decision has been taken or determination made, in whole or in part, that may be adverse to the interests of the customer based on the information obtained from a bureau.

(2) An adverse action notice issued under paragraph (1) (c) shall be provided at the time the adverse decision or determination is communicated to the customer and shall notify the customer - (a) that customer information played a role in the decision; (b) the name, address and telephone number of the bureau that provided the customer information; (c) the customer's right to a copy of the information provided by the bureau at no cost to the customer; and (d) the customer's right to dispute such information with the bureau and, if the information is erroneous or outdated, to have it corrected.

(3) An institution or third-party credit information provider shall be considered to have notified the customer if the institution or thirdparty credit information provider sends the notification issued under paragraph (1) to the customer's last known address or contact details by any of the print and electronic communication mediums provided for under these Regulations and the evidence of the notification shall be retained by the institution or third-party credit information provider.

(4) An institution or third-party credit information provider shall submit and update all customer information to the bureau in accordance with these Regulations.

(5) Where an institution or a third-party credit information provider has provided customer information to the bureau and subsequently becomes aware that the information was inaccurate at the Responsibilities of institutions and credit information providers.

time it was provided, the institution or third-party credit information provider shall, within five working days from the date the institution or the third-party credit information provider becomes aware of the inaccuracy, give the bureau an amendment notice instructing it to delete the inaccurate information and replace it with the correct information.

(6) An institution and a third-party credit information provider shall ensure that the customer information furnished pursuant to this regulation is provided to all licensed bureaus or to a centralized point or location or through an industry tool that facilitates centralized submission of credit information from which all bureaus can access the information.

(7) An institution and a third-party credit information provider shall establish and maintain functional units or dedicate competent staff to receive and resolve complaints or disputes arising from credit information sharing activities.

(8) An institution and a third-party credit information provider shall resolve complaints within thirty days from the date of receipt of a complaint.

(9) An institution or a third-party credit information provider which fails to comply with this Regulation may be liable to such penalty not exceeding one million shillings or such administrative sanction as the Central Bank may consider appropriate.

(10) An institution which fails or neglects to submit to the bureaus credit information of a person whose credit information ought to be submitted to the bureaus shall be liable to such penalty not exceeding two million shillings for each failure or to such administrative action as the Central Bank may consider appropriate.

64. (1) Where bureaus, institutions and third-party credit information providers intend to jointly develop a central hub or industry tool for the submission of credit information by institutions and third-party credit information providers to the bureaus, the bureaus shall—
    (a) seek approval of the Central Bank to establish the central hub or industry tool; (b) comply with any framework that may be issued by the Central Bank on the establishment and use of a central hub or industry tool; and (c) where a third party is to be contracted to develop the system for the bureaus, the Central Bank shall approve the proposed third-party service provider and the system.

(2) The Central Bank may prescribe a framework for the establishment and operation of a central hub or a centralized location for purposes of submission of credit information and access to the information by bureaus.

65. An institution or third-party credit information provider shall submit to a bureau credit information using such format or Central hub and industry tool.

Data submission templates.

Notification of the amount owing template as may be agreed between institutions furnishing information and approved by the Central Bank.

66. (1) A notice issued by an institution or third party credit information provider to a customer under regulation 63 (1) (a) shall contain the particulars of the loan or credit including the principal amount, the interest rate and amount outstanding to date and any other information that the institution or third-party credit information provider may desire to bring to the attention of the customer.

(2) Where a customer notifies the institution or third party credit information provider which has served a notice under paragraph (1) that the amount allegedly owing is disputed, the institution or the thirdparty credit information provider shall investigate the matter and inform the customer accordingly of its decision within fourteen days from the date the customer contacted the institution or third-party credit information provider on the disputed loan.

67. (1) An institution or the third-party credit information provider shall serve a notice under regulation 63 on a customer by any of the following modes -
    (a) registered mail or certificate of posting; (b) email; (c) short message service through the customer's registered telephone number; or (d) physical delivery of the letter evidenced by acknowledgement of receipt by the customer or his nominee, where the physical address of the customer is known.

(2) A record shall be kept of all notices served by any means permissible under this Regulation for a period of at least seven years.

68. A person who knowingly or wilfully obtains information from a bureau under false pretence commits an offence and shall, on conviction be liable to imprisonment for a term not exceeding two years or to a fine of two hundred thousand shillings, or to both.

69. Every bureau which has entered into a credit information sharing arrangement with a third-party credit information provider shall publish in a prominent and conspicuous place within its business premises and on its website and keep an up to date list of all third-party credit information providers that have been approved by the Central Bank to submit credit information to the bureau.

70. Bureaus and institutions either alone or in partnership with each other or other persons shall conduct public education programmes on credit information sharing, benefits, risks to mitigate, availability of services, how to access the services and any other useful or material information which would be beneficial to the public.

71. (1) For the purposes of performing the activities and obligations under these Regulations, each bureau, its agents, Mode of service.

Obtaining information under false pretences Publication of list of third-party credit information providers Public education.

Compliance with guidelines, rules or directives

subscribers and other persons or entities subject to these Regulations shall comply with any guidelines or directives issued by the Central Bank.

(2) A bureau or a person who fails or refuses to comply with these Regulations or any guidelines or directives issued by the Central Bank shall be liable to a penalty not exceeding five hundred thousand shillings in the case of a bureau or one hundred thousand shillings in the case of a natural person.

(3) For the purposes of paragraph (1), the Central Bank may request any information it may require in order to evaluate any matter arising from these Regulations or from the operations of the bureau, its agents, subscribers and other persons or entities subject to these Regulations.

72. (1) Where a Bureau— Penalties.

(a) is in breach of or fails to observe or adhere to the security and control measures outlined in regulation 36; (b) wrongfully alters, modifies or deletes records from its database; (c) fails to adopt security and control measures that are necessary to prevent the unauthorized access to, or wrongful use and management of information; (d) delays in providing information and documents to the Central Bank; (e) fails to comply with an order or directive of the Central Bank on data and information management; (f) discloses customer information to a person who is not authorised by these Regulations or by a customer to receive such information; or (g) breaches or fails to comply with any provision of these Regulations for which no penalty is expressly provided for, it shall be liable to pay a monetary penalty of five hundred thousand shillings and in the case of continued failure, it shall be liable for an additional penalty of ten thousand shillings for each day on which such failure continues.

(2) Where an institution contravenes any of the provisions of these Regulations, the Central Bank may pursue any or all of the remedial actions provided for under the Act, the Microfinance Act, 2006 or the Sacco Societies Act, 2008.

(3) In addition to the remedial measures under paragraph (2), the Central Bank may impose the following sanctions against an institution— (a) prohibition from obtaining credit reports from Bureaus; (b) termination of employment services of an officer or employee of the institution;

(c) prohibition from establishing new branches, subsidiaries, agents or introduction of new products; (d) prohibition from engaging in new activities or from expanding existing activities; (e) suspension of lending, investment, and credit granting operations; (f) prohibition from accepting further deposits or other lines of credit; (g) prohibition from declaring or paying bonuses, salary incentives, severance packages, management fees or other discretionary compensation to directors, officers or employees; (h) limit the range of activities and the locations in which such activities can be conducted; (i) prohibition from declaring or paying dividends; or (j) prohibition or suspension from any other activity that Central Bank perceives to be contributing to violation of these Regulations.

(4) Where a credit information provider violates or breaches any provision of these Regulations, the Central Bank may take any of the following actions - (a) direct the bureau to which a credit information provider has submitted credit information to terminate any subsisting information sharing agreement with the credit information provider; (b) direct the bureau in possession of credit information provided by a credit information provider to delete from the database any inaccurate, erroneous or misleading information submitted by the credit information provider and to notify all subscribers who have received the inaccurate, erroneous or misleading information; (c) direct all bureaus to delete all credit information which may have been received by the bureaus from the concerned credit information provider; or (d) direct the bureau to compensate or take remedial measures in respect of any loss or damage suffered by a customer as a result of the use of any inaccurate, erroneous or misleading credit information supplied by a credit information provider.

(5) In assessing the penalty to impose, the Central Bank may take into account the nature of the violation, the severity of the violation and any other relevant factor.

(6) Before imposing a penalty on any bureau or an institution under these Regulations, the Central Bank shall give not less than seven days' notice, in writing, requiring the Bureau or institution to show

cause as to why the penalty prescribed should not be imposed.

(7) Where a monetary penalty is prescribed under these Regulations, such penalty shall - (a) be paid to the Central Bank; (b) be paid within ten days, unless otherwise specified; (c) in the first instance, be paid by the bureau; (d) where the Bureau fails to make payment, in the second instance, be paid immediately by the bank issuing the bank guarantee upon being called upon to do so by the Central Bank; and (e) where an institution fails to pay the penalty, the Central Bank may take such other action or make such decision as is permitted under the Act, the Microfinance Act, 2006, the Sacco Societies Act, 2008, or these Regulation.

(8) Where no payment is made or received under paragraph (7), the licence of the Bureau may be revoked.

(9) Where any provision of these Regulations imposes a penalty on any Bureau, the amount of the penalty shall constitute a debt due from the bureau to the Central Bank, and the Central Bank may - (a) in addition to the provisions of this Regulation, recover the penalty as a summary debt; (b) direct that any part of the penalty which remains unpaid after a particular period notified to the bureau and the officers concerned, shall constitute a debt payable by the bureau and the particular officers of the Bureau specified in the notification; and the Central Bank shall be entitled to recover from that bureau and officers jointly and severally.

73. The Credit Reference Bureau Regulations, 2013, are Revocation of repealed. L.N. 5/2014 74. (1) A Bureau which was licensed under the Credit Savings.

Reference Bureau Regulations, 2013 (now revoked) shall continue to operate as if it was licensed under these Regulations and shall comply with these Regulations.

(2) Any database established by a bureau, credit report issued by a bureau, contract signed by a bureau or other matter done by a Bureau under the authority of the Credit Reference Bureau Regulations, 2013 (now revoked) shall remain valid and shall be deemed to have been done under these Regulations.

(3) Anything which was lawfully commenced, done or executed under the authority of the Credit Reference Bureau Regulations, 2013 (now revoked), by the Central Bank, Kenya Deposit Insurance Corporation, a subscriber, approved third party credit information provider or a customer shall continue to be valid and shall be continued with under these Regulations as if it was originally commenced, done or executed under these Regulations.

715 First Schedule (R. 4 (1) Application Form For A Licence To Carry Out Bureau Business 1. 3. Head/Main Office: 5. Management:

Name	Present term	No .of years as
Designation	Board member

Name and type of business Amount of shares held	% of shares held in total

2. Former name(s) (if any) by which the applicant has been known:
   (b) Telephone No: (c) Telefax No:
   (d )Form of corporation (e.g. publicly listed/privately held, etc.); (e) Date and place of incorporation; (0 Description of the applicant's business or functions; (g) The applicant's authorised and paid-up capital, including relevant details of shares issued or to be issued (e.g. types, number and issue price) and evidence on the same; 4. Branches (including physical location) Subsidiaries & affiliates:
   (1) Board of Directors:
   Name:
   (a) Address:

716 (2) Board Committees: (3) Officers:

Name	Country of	Residence	Paid up capital	%
	citizenship
1. 2. 3.

Name	Position:	No. of years as officer

Name and purpose of committee(s)	Names of members:

6. Ownership profile:
   Other shareholders owing less than 5% (Number TOTAL
7. (i) Organisation profile—
   (a) organisation chart - Attach one indicating major departments or divisions with names, positions and titles of officers heading each department or division.

(b) attach an organisation chart showing the applicant and its relationships with its subsidiaries, associates and other members of the group.

(c) functions- Attach a list of functions or responsibilities for each department or division listed in the organization chart indicating the number of personnel or staff foreach.

(d) qualifications of significant shareholders, directors and officers.

(e) annex personal declaration form of each significant shareholder and officer and an information sheet for each significant corporate shareholder.

(f) powers and purposes - Attach the latest copies of the Memorandum and Articles of Association if not previously submitted to the Central Bank.

(i) Legal and regulatory compliance
)

Kenya Subsidiary Legislation, 2020 717

Describe and demonstrate, with supporting documents or information, how the applicant will— (a) comply with the requirements of the Banking Act, the Central Bank Prudential Guidelines, Microfinance Act, 2006, or Sacco Societies Act, 2008, as the case may be; (b) have adequate means of supervising its officers, employees and participants; and (c) have adequate means to deal with any conflicts of interest that may arise.

Note:
Relevant supporting documents or information to be provided could include the applicant's - (a) information on key officers and employees (including names, addresses, relevant experience, qualifications, etc.); (b) risk management systems, including procedures relating to internal audit, internal controls, security, and the granting of credit; (c) business continuity plan and system capacity planning procedures; and (d) human resources, including information on the staffing levels of key functions.

8. Shareholding in any other financial institution—

Name of Financial	% of capital	Institution	Amount
	Shares ownedNumber
Institution
1. 2. 3.

9. Name(s) and address(es) of the applicant's bankers within the last 10 years.

(please also indicate the applicant's principal bankers)
10. Name and address of the applicant's external auditors

11. Fit And Proper Criteria—

If the answer to any of the following questions is in the affirmative, please attach annexes and supporting documents, where appropriate, giving all relevant particulars. (Please answer yes or no).

.

.

• e and

and the successful and
·

• .

and the successful and the successful

---

and and and and our and the country of the country and the contribution and the comments of the comments of the many of the