Implementing Regulations of the Credit Information Law

Contents
Definitions
Licensing
Scope of Credit Information Services
Governance
Credit Register
Supervisory and Regulatory Requirements
Confidentiality of Credit Information
Obligations of Members
Consumer Rights
Objections and Complaints
Committee for Hearing Violations and Resolving Credit Information Disputes Publication and Entry into Force

Implementing Regulations of the Credit Information Law

Definitions
Article 1
The following words and expressions shall have the meanings indicated opposite them wherever they appear in these Regulations, unless the context requires otherwise:

• The System: The Credit Information Law issued by Royal Decree No. (M/37) dated 5/7/1429H.
• The Regulations: The Implementing Regulations of the Credit Information Law.
• The Institution: The Saudi Arabian Monetary Authority.
• The Governor: The Governor of the Saudi Arabian Monetary Authority.
• Credit Information: Any information or data relating to a consumer's credit transactions.
• Companies: Any credit information company licensed to collect and preserve credit information about consumers and to provide it to Members upon request.
• Member: A government entity or a company specifically linked to the Company through a contract for the exchange of credit information, provided there are at least two such companies.
• Consumer: Any natural or legal person having credit transactions.
• Credit Register: A report issued by the Company containing credit information about the Consumer.
• General Registers: Credit information registers held by government entities, such as registers of funds, specialized banks, and government committees, that provide loans, as well as bankruptcy and insolvency files and judicial authorities, regarding their rulings on insolvency and bankruptcy.
• Negative Decision: Any decision taken by a Member against the Consumer's credit register in his interest.
• Negative Information: Information in the Consumer's credit register that is against his interest.
• Information Provided by a Member: Any information provided by a Member based on which the Consumer's credit register contains negative information.
• The Committee: The Committee for Hearing Violations and Resolving Credit Information Disputes.

Licensing
Article 2
No natural or legal person is permitted to provide credit information services without obtaining a license from the Institution in accordance with the provisions of the System and these Regulations.

Article 3
The Company licensed to provide credit information services must meet the following conditions:

1. It is a shareholding company with its headquarters located within the Kingdom.
2. Its paid-up capital does not less than fifty million Saudi Riyals.
3. The Institution approves the Company's Articles of Association.
4. The Institution approves the Company's automated system for credit information.
5. It has qualified human resources and financial and operational resources to operate and work efficiently in accordance with the System and these Regulations.
6. It undertakes to comply with any rules or instructions issued by the Institution.

Article 4
Companies wishing to provide credit information services must submit their licensing application to the Institution accompanied by the following:

1. A statement of the names, addresses, shares, and percentages of the Company's founders.
2. The Company's Articles of Association.
3. A certificate from a licensed bank in the Kingdom indicating the deposit of its paid-up capital.
4. A copy of the Commercial Registration or National ID card for the founders.
5. A description of the user's automated system for collecting and preserving credit information for consumers, including its characteristics.
6. An economic feasibility study.
7. A business plan for the first three years from its establishment, including the nature of the work it intends to provide, estimated financial statements and projections, expected growth rates and costs, expected number of employees, and growth rates based on the principles of active management and corporate governance. Any additional information or data requested by the Institution, and the Company's organizational structure.
8. A financial fee of fifty thousand Saudi Riyals for reviewing the licensing application.
9. A commitment not to engage in any other activity other than those stated in the Company's Articles of Association, subject to the Institution's approval.

Article 5
The Institution shall decide on the licensing application, either approving or rejecting it, or cancelling it, within thirty working days from the date the applicant completes any data requested by the Institution. The application shall not be subject to rejection if the data is not completed.

Article 6
In the event of approval, the Governor's decision granting the license shall be issued after completing the establishment procedures, in accordance with the provisions of the Companies System. The Company is prohibited from obtaining a commercial register and is prevented from providing its services in all cases until the license is issued. The license is issued before the Governor's decision.

Article 7
The license is valid for five years and may be renewed in accordance with the prescribed conditions and fees. A one-time fee of one percent of the Company's paid-up capital is paid at the time of license issuance. The renewal request must be submitted at least six months before the expiration date, and a fee of half a percent of the Company's paid-up capital is paid at the time of renewal.

Article 8
The license expires in any of the following cases:

1. Expiration of its term without renewal.
2. Dissolution of the Company for any reason stipulated in the Companies System.
3. Issuance of a decision to cancel the license.
4. The Company's inability to practice its activity within fifteen months from the date of license issuance, without convincing justifications to the Institution.

Article 9
The Company must obtain prior written approval from the Institution before:

1. Establishing subsidiaries, branches, or offices inside or outside the Kingdom.
2. Merging with other companies or acquiring them.
3. Amending the Company's Articles of Association.

Article 10
The Institution may conduct investigations to detect any violation of the System or these Regulations, and may:

1. Notify the Company in writing of any negligence or deficiency, and require it to provide a plan to rectify the situation within thirty working days from the date of notification.
2. If the Company fails to comply with the aforementioned paragraph, the Institution may request the Committee to temporarily suspend or cancel the license, and notify the Company in writing thereof.
3. The Institution shall instruct the Company to notify all parties involved in the relationship of the decision to suspend or cancel the license, and notify the Committee of such notification immediately.

Article 11
The Company must notify the Institution in writing of any changes or modifications to the data mentioned in these Regulations within three working days from the date of the change or modification, or before obtaining the license, whichever is later.

Scope of Credit Information Services
Article 12
The Company may, with the Institution's prior written approval, provide some or all of the following services:

1. Collecting, preserving, and exchanging consumer credit information with Members and Companies.
2. Inquiring about credit registers for individuals, businesses, and companies.
3. Credit evaluation for consumers.
4. Consulting services to support credit information.
5. Reports on statistical information and credit information.
6. Market research and studies on statistical issues related to credit information.
   The Company must obtain the Institution's prior written approval to provide any other services not specified in this Article.

Governance
Article 13
The Company's Board of Directors must possess appropriate expertise and qualifications to perform their duties.

Article 14
The Institution shall issue suitable criteria for the Company's founders, Board of Directors, and President, including questionnaires on suitability and requirements for positions and functions. They must fill out the suitability questionnaire issued by the Institution and obtain the necessary approvals to prevent their appointment.

Article 15
A person must meet the following conditions to be eligible for membership on the Company's Board of Directors:

1. Not be a member of the Board of Directors of another credit information company inside or outside the Kingdom.
2. Not have been convicted of a crime involving dishonor or breach of trust.
3. Not have been declared bankrupt or insolvent.
4. Not have worked as a general partner in another credit information company or be liable for its accounts.
5. Not have been disciplined from their position.
6. Not have a conflict of interest arising from membership on the Company's Board of Directors or in another company exercising a different activity.
7. Not have negative information in their credit record.

Credit Register
Article 16
The Credit Register includes the following information regarding the Consumer's creditworthiness:

1. For a natural person: The Consumer's name, ID number, place of residence, current and previous employment, and social status, qualifications, and personal data.
2. For a legal person: The Consumer's name, commercial registration number or activity license, and other information about it.
3. Information about any existing or past credit under dispute or subject to it, regardless of whether it is immediate or deferred, whether there was delay or difficulty in repayment, whether it was settled or the debt was erased, and any guarantees granted to the Consumer.
4. Any lawsuit of a credit nature brought against the Consumer, including the rulings issued therein.
5. Any lawsuit for liquidation, bankruptcy, or insolvency brought against the Consumer, including the name of the liquidator or trustee, the value of assets and debts, dates of settlement and liquidation expenses.
6. Any checks issued by the Consumer without funds for payment, including their value and date, and any actions taken against them.
7. Any claim issued by an official authority that was not paid.
8. The number and names of Members who submitted requests to obtain the Consumer's credit register in the two years preceding the date of the register's issuance, and the number of credit registers issued to them, ending with the date of the request.
9. Any other information of a credit nature that affects the Consumer's creditworthiness.
   The Institution shall determine the required information to be included in the Credit Register as appropriate.

Article 17
The Company may retain negative information in the Consumer's credit register for a period not exceeding five years, except for cases of bankruptcy, insolvency, tax and Zakat obligations, and dispute resolution or debt settlement. Litigation cases in the register shall remain for ten years until they are settled.

Article 18
The Company may include in the Credit Register any partner in a joint liability company, upon the written consent of the other partners.

Supervisory and Regulatory Requirements
Article 19
The Institution may conduct routine or surprise inspections of the Company's records, accounts, and employees, and require them to cooperate and provide any data or information requested by the inspectors.

Article 20
The Company must provide the Institution with:

1. (a) Quarterly financial statements, including audited accounts, within one month of the end of each quarter, and within two months of the end of the financial year.
   (b) A report evaluating the efficiency and effectiveness of the computer systems used by the Company, including the accounting system, which shall be prepared at least annually by an approved consultant and preserved.
2. Any other information or data requested by the Institution in the form it specifies.

Article 21
Companies must adhere to membership agreements approved by the Institution for exchanging credit information with any party wishing to do so. These agreements must clarify the rights and obligations of both parties, the name of the party, and the relationship to the Consumer's credit register, making the party a Member.

Article 22
The exchange of credit information between Companies subject to the System occurs based on bilateral or collective contracts or agreements between them, which must include documents specifying the exchanged data, rights and obligations, the duration, and how to renew or extend these contracts or agreements, as well as the financial consideration due. The Institution must be presented with these contracts or agreements and cannot refuse to accept them.

Article 23
Companies must maintain regular records of Consumers, whether natural or legal persons, including their activities, nature of work, names, addresses, descriptions, and credit information.

Article 24
Companies must maintain regular records of Members, whether natural or legal persons, including companies subject to the System and these Regulations, and other companies, specifying all details of each, including contracts and agreements, terms, and conditions.

Article 25
Companies must take the necessary precautions and measures to ensure the integrity, accuracy, and completeness of credit information in accordance with the System and these Regulations, including:

1. Not obtaining any credit information from any source or entity unless it has signed a membership agreement.
2. Obtaining credit information from Members in accordance with standards approved by the Company, and administrative, technical, and regulatory requirements approved by the Institution.
3. Taking the necessary procedures to verify the reason for the Member's request for credit information.
4. Notifying the Member of the obligations incurred by it in accordance with the System and these Regulations.
   Companies shall be responsible towards those they deal with, including government entities and companies, and must provide accurate and correct data. They must compensate for any damages incurred by the Member due to incorrect or misleading data, or fraud proven against them, without preventing the Member from seeking recourse.

Article 26
Companies must establish controls to protect credit information and data obtained or held by them, including:

1. Recording credit information by collecting, matching, processing, classifying, and preserving it in a correct and appropriate manner for easy reference.
2. Adopting systems for preserving backup copies and a recovery plan to protect against loss, including contingency plans and business continuity plans for credit information in emergency situations.
3. Protecting credit information from unauthorized access, modification, or use, in violation of the System and these Regulations.
4. Establishing controls and procedures for Members to access credit registers upon request.
5. Regularly reviewing the Company's employees' confidentiality controls.
6. Regularly reviewing patterns of use of information systems to detect any non-standard usage.
7. Preserving records of all access, modification, and audit of the database of all credit information, including previous inquiries and records of facts involving violations or suspicious activities.
8. Providing adequate knowledge to the representatives of Member Institutions about best international security practices.

Article 27
The Company must, before providing a Member with the Consumer's credit register:

1. Verify the identity of the requester from the Credit Register and the purpose of the request.
2. Ensure the Member undertakes not to use this information except for the specified purposes in the request.
3. Verify the accuracy and currency of the provided credit information.

Article 28
The Company may not issue a credit register about a Consumer, except in the following cases, while observing the provisions of these Regulations:

1. Upon request from a Member with the Consumer's consent.
2. Upon request from a competent local official authority for dispute resolution.
3. Upon request from the Institution.
4. Upon request from the Consumer himself.

Article 29
The Company must obtain sufficient insurance coverage from a licensed insurance service provider in the Kingdom to cover any liability arising from error, negligence, or omission in providing credit information services.

Article 30
The Company may not assign, lease, or sell the rules regarding the data it holds to another credit information company, except after obtaining prior written approval from the Institution, after which the rules shall revert to the Institution or any other entity specified by the Institution.

Article 31
The Company must obtain the Institution's prior written approval for its pricing policy for the services it provides, except for those mentioned in Article 43 of these Regulations, which are subject to the System and these Regulations.

Article 32
The Company may collect credit information about Consumers from available sources, such as General Registers, financing and lending institutions, Chambers of Commerce and Industry, and previous and current employers of Consumers, and other relevant entities, in accordance with Article 12 of these Regulations.

Article 33
Companies must establish a complaints handling department and develop an operational manual for handling complaints. After presenting the manual to the Institution for approval, it must include procedures to ensure:

1. Full understanding of these procedures by the concerned employee contacted by Consumers.
2. Immediate and full investigation of any complaint.
3. Maintaining a written record of complaints and the actions taken.

Article 34
Companies must prepare an operational manual to educate Consumers about credit information and present it to the Institution for approval.

Confidentiality of Credit Information
Article 35
Subject to compliance with the systems and rules regarding the confidentiality of credit information and the banking rules in force in the Kingdom, no Company may provide any data or credit information about Consumers to any of the entities mentioned in Articles 12 and 32 of these Regulations, except for the purposes of the System and these Regulations.

Article 36
Companies and Members must maintain the confidentiality of credit information and data in their possession. They must not use, exchange, or share it with other persons or Companies, except among Members and Companies in accordance with the System and these Regulations. Members and Companies are fully responsible for any breach by their employees and are responsible for any violations of the System or these Regulations.

Article 37
It is prohibited for employees in entities subject to the provisions of these Regulations to disclose any credit information that comes to them by virtue of their functions, even after leaving their service.

Article 38
The provisions referred to in these Articles regarding the confidentiality of credit information do not apply to:

1. Public information, which becomes public when announced or published in media outlets.
2. Any other information or cases specified by the Institution.

Article 39
Companies may not create a credit register for a Consumer or exchange it with a Company or Member without the Consumer's prior written consent.

Obligations of Members
Article 40
The Member must:

1. Obtain the Consumer's written consent before inquiring about him from Companies and providing him with credit information about him.
2. Not provide Companies with any credit information about the Consumer if it knows that it contains errors or may contain incorrect data.
3. Not provide Companies with incorrect credit information about the Consumer after receiving notice thereof.
4. Periodically update credit information about Consumers at least once a week.
5. Provide Companies with complete and accurate credit information about the Consumer.
6. Use credit information about Consumers from Companies only for permitted purposes.
7. Notify Companies of the closure of any credit accounts within one month.
8. Not disclose any credit information about the Consumer to Companies of its own accord.
9. Maintain records containing the names and addresses of Companies it deals with.
10. Not provide Members with negative information about the Consumer unless it includes a complaint or dispute, and notify them that such negative information is the subject of a complaint or dispute.
11. Verify and correct any errors contained in credit information about Consumers.

Article 41
The Member must notify the Consumer in writing of any existing credit transaction with him, and send the Companies a clear and explicit notice within thirty working days from the date of entry in the Member's records.

Article 42
Members bound by an agreement with Companies to provide required credit information may not delay providing it to Companies or Members according to the schedule agreed upon in the membership agreement.

Consumer Rights
Article 43
The Consumer has the right to know the credit information contained in his register, in accordance with the cases stipulated in the System. He may request his credit register from one of the credit information companies for a financial fee in the following cases:

1. For the first time.
2. After taking a negative decision against him in accordance with what is stated in these Regulations.
3. If the Consumer was a victim of fraud, for example, using his personal information.
4. If the Consumer's credit register included incorrect information.

Article 44
The Consumer has the right to:

1. Know the name and address of the person who inquired about his credit register during the last two years.
2. File a complaint if his credit register contained incorrect or incomplete information.

Article 45
If a Member takes a negative decision against a Consumer based on information in whole or in part, he must notify the Consumer in writing within seven working days from the date of the negative decision, including:

1. The reasons for taking the negative decision.
2. The name, address, and phone number of the Company from which he obtained the information and a copy of the Consumer's credit register.

Objections and Complaints
Article 46
The Consumer has the right to object to any negative decision or any credit information in his register at any time, due to non-completeness, non-updating, or inaccuracy, in accordance with Article 17 of these Regulations. Upon the Company's investigation, the subject of the objection shall be removed from the Credit Register without a financial fee within thirty working days from the date of filing the objection.

Article 47
The investigation of objections and complaints shall be conducted according to the following procedures and timelines:

1. The Company must notify the Member who issued the notification of the objection within five working days from the date of its notification, in writing, mentioning all the negative information subject to the objection, along with the documents and information provided by the objector, and set a period for the Member not to exceed ten days. Failure to respond within the specified period shall be considered evidence of the truth of the information provided by the objector.
2. The Company must make a decision within a period not exceeding seven working days from the date of receiving the Member's response or its expiration.
3. If the investigation proves that the objection is wholly or partially valid, or if the information cannot be verified, the Company must, within two working days from the date of the decision, delete the negative information subject to the objection from the register or modify it according to the circumstances.
4. The Company may not modify or delete any negative information from the Consumer's credit register if it does not prove its inaccuracy.

Article 48
The Company must notify the objector of the procedures taken to investigate his objection within a period not exceeding ten days from the date of filing the objection. The Company must notify the objector in writing of the investigation results within a period not exceeding five days from the date of the decision, including:
(a) A copy of the Consumer's credit register after modification, if the objection's validity is proven.
(b) A summary of the objector's rights under the System and these Regulations, if the objection's validity is not proven.

Article 49
The Company must indicate in every credit register issued during the investigation of the submitted objection that the objection is pending. Upon the objector's request, the investigation shall be referred to settlement, and the register must include:

1. A reference to any credit right in the objector's register related to the objection.
2. A clear summary of the actual negative information viewed by the objector.
3. A written notification from any entity specified by the objector obtained on his credit register during the previous year, if the objection covers any negative information in the register.

Article 50
When the Company cancels any information in the objector's register or modifies it, it must notify the objector in writing within a period not exceeding one year from the date of filing the objection, and add this to all licensed credit information companies with which it is associated by contract or agreement.

Article 51
The Member may not reinstate any negative information modified or deleted from the Consumer's credit register except by a decision of the Committee.

Article 52
If the Consumer's objection is rejected, he may submit a complaint to the Committee for hearing and resolution in accordance with Article 14 of these Regulations.

Committee for Hearing Violations and Resolving Credit Information Disputes
Article 53
The Committee shall be formed of no less than three members, in accordance with what is stipulated in Article 14 of the System. A decision shall be issued to appoint them, determine their term of service, and select the Minister of Finance.

Article 54
The Committee shall be responsible for preparing its bylaws, determining its work procedures, and issuing advisory opinions before it. The Governor shall approve the Committee's bylaws and determine the remuneration of its members.

Publication and Entry into Force
Article 55
These Regulations shall enter into force one month after their publication in the Official Gazette and on the Institution's electronic website. The Institution shall review and amend them if necessary.