Instruction No. 03/2009 on the Establishment of a Credit Registry Information System

GBR N. o 07/2009 - CRIS Page 1 of 14
Autoridade Bancária e de Pagamentos de Timor-Leste Banking and Payments Authority of Timor-Leste Av a Bispo Medeiros, PO Box 59, Dili, Timor-Leste Tel. № (670) 3 313 718, Fax. № (670) 3 313 716 GOVERNING BOARD RESOLUTION №. 07/2009 Concerning the Approval of Instruction №. 03/2009 On the Establishment of a Credit Registry Information System THE GOVERNING BOARD Pursuant to:

1. Article 17 point (b) of UNTAET Regulation 2001/30 that gives the Governing Board of the
   Banking and Payments Authority of the Timor-Leste (BPA) power to adopt Rules, Instructions and Guidelines;
2. Article 41 of the same Regulation states that the BPA may establish and maintain an information
   network for the financial system of Timor-Leste;
3. Article 165 of the Constitution of the Democratic Republic of Timor-Leste concerning the
   continued applicability of laws in force at the date of the adoption of the Constitution. Taking into Account:
4. The need to deepen and extend the banking services in Timor-Leste by strengthening the credit
   culture;
5. The need to create a credit information system that provide timely, accurate and reliable
   information regarding individual, small medium enterprises and corporate credit payment behavior;
6. The need to provide sufficient means of information for the BPA to exercise its functions as
   supervisory authority;
7. The benefit of having clearly defined characteristics and conditions for the operation of the Credit
   Registry Information System
8. The need to determine the procedures for accessing information in the Credit Registry Information
   System
   For the Purpose of:
   Establishing the legal framework for the functioning of a Credit Registry Information System. HEREBY RESOLVES TO ADOPT THE FOLLOWING

GBR N. o 07/2009 - CRIS Page 2 of 14
Instruction №. 03/2009
On the Establishment of the Credit Registry Information System
CHAPTER I
GENERAL PROVISIONS
Article 1
Scope and purpose

1. The present Instruction defines the legal regime for the establishment and functioning of a Credit
   Registry Information System in Timor-Leste for Participating Entities that need to assess risk when granting credit.
2. The purpose of the Credit Registry Information System shall be to provide Participating Entities
   with information relating to existing and prospective Borrowers’ credit at other Participating Entities with the overall objective of improving the general quality of credit in Timor-Leste.
   Article 2
   Applicability
3. This Instruction shall be applicable to all commercial banks and other lending entities approved by
   the BPA, collectively referred to as Participating Entities.
4. The BPA may exempt part of requirements under the present Instruction upon request by the
   participating entities subject to a favorable analysis by the BPA.
   Article 3
   Definitions
   For the purposes of this Instruction, the following terms are defined:
   a) “Consent clause” means a written authorization given by a Borrower to a Participating Entity for the submission of his/her Credit Data to the Credit Registry Information System, in accordance with the manner laid down in this Instruction; b) “Credit Agreement” means a contractual agreement between a Participating Entity and a Borrower that sets out the rights and obligations of the parties on the granting of credit; c) “Credit” means any direct or indirect commitment to disburse, or disbursement of, a sum of money in exchange for a right to repayment of the amount disbursed and outstanding and to payment of interest or other charges on such amount, any extension of the due date of a debt, any debt payment guarantee issued, and any commitment to acquire a right to payment of a sum of money; the term “credit” shall not include bank deposits and the purchase of debt securities in the secondary market; d) “Credit Data” means the Credit Information and the Demographic Data relating to a Borrower; e) “Demographic Data” means personal data relating to a Borrower; f) “Participating Entity” means an entity required to participate in the Credit Registry or otherwise approved to participate by the BPA in accordance with the provisions in Article 5 of this Instruction. g) “Adverse Information” means information relating to delays in payment of scheduled interest, installments or of the total amount of Credit, insolvency or bankruptcy of the Borrower, and any

GBR N. o 07/2009 - CRIS Page 3 of 14 other form of adverse credit information, including a failure to comply with the terms of a Credit Agreement; h) “Credit Information” means information regarding the creditworthiness and credit performance of a Borrower, including all Adverse Information; i) “Borrower” means a natural or legal person on whom credit information is being collected who has entered into a Credit Agreement; j) “Aggregate Credit Obligation” means the total obligation of any Borrower to a Participating Entity; k) “Borrower Report” means information taken from the Credit Registry Information System which contains Credit Data; l) “Credit Registry Information System” means the database in which Credit Data is maintained in accordance with this Instruction; m) “Authorized User” means a user of the Credit Registry Information System as defined in Article 14 of this Instruction;
Article 4
Responsible authority
The BPA shall be the responsible authority for managing and maintaining the Credit Registry Information System.
CHAPTER II
REPORTING OF INFORMATION
Article 5
Participating Entity

1. Each of the following entities shall be a Participating Entity for the purpose of this Instruction:
   a) All banks licensed by the Banking and Payments Authority to operate in Timor-Leste; b) Other financial institutions required to participate by the Banking and Payments Authority; c) Financial institutions that have made application and have been approved by the Banking and Payments Authority.
2. Each Participating Entity shall enter into a Credit Information Sharing Agreement in the form set
   out in Annex 2 to this Instruction.
   Article 6
   Content of the credit registry
3. The database of the Credit Registry Information System shall hold Credit Data relating to any
   Borrower as follows:
   a) For a natural person:
   i. Borrower’s full name;
   ii. Date of birth;
   iii. Identification document;
   iv. Residence and mailing address;
   v. Telephone number;

GBR N. o 07/2009 - CRIS Page 4 of 14
vi. Marital status;
vii. Spouse’s name;
viii. Employment history;
ix. Date of the credit disbursed;
x. Total amount of credit disbursed;
xi. Monthly payment;
xii. Current outstanding balance;
xiii. Credit classification;
xiv. Date of last payment;
xv. Type of collateral; and
xvi. Type of credit.
b) For other legal entities:
i. Borrower’s legal name;
ii. Tax Identification Number;
iii. Office address;
iv. Telephone number;
v. Date of the credit disbursed;
vi. Total amount of credit disbursed;
vii. Monthly payment;
viii. Current outstanding balance;
ix. Credit classification;
x. Date of the last payment;
xi. Type of collateral; and
xii. Type of credit.
2. The database of the Credit Registry Information System shall also contain the name of the credit
grantor.
Article 7
Obligation to provide information

1. All Participating Entities shall submit Credit Data to the Credit Registry Information System in
   electronic format that shall include at least the information set out in Article 6 of this Instruction on natural persons subject to the following provisions:
   a) Identification documentation shall the reference number of electoral card (for citizens) or passport (foreigners); b) Telephone number is only required if borrower has a telephone; c) Spouse’s name is only required for married Borrowers; d) Employment history is only required for Borrowers in employment or previously holding an employed position; e) Credit classification must be consistent with the BPA Instruction CPO/B-2001/4 on Asset Classifications; f) Type of Credit shall define the economic sector of the Borrower.

GBR N. o 07/2009 - CRIS Page 5 of 14
Article 8
Consent to report

1. The Participating Entity shall ensure that a written Consent Clause has been obtained from each
   Borrower or potential Borrower before obtaining Credit Data about the Borrower or submitting Credit Data about the Borrower to the Credit Registry Information System.
2. The Consent Clause shall be included as a component of each form of application for credit and
   highlighted to ensure that the Borrower is aware of and consents to the Participating Entity’s and the Borrower’s rights and obligations under this Instruction.
3. The Consent Clause referred to in the previous paragraph shall contain either the wording in Annex
   1 of this Instruction or such alternative wording either in form or in language as has been submitted to the BPA in writing and approved in advance.
   Article 9
   Periodicity of reporting
   Each Participating Entity shall submit to the Credit Registry Information System Credit Data as required by Article 6 of this Instruction within the following times:
   a) New loans shall be submitted to the BPA within five days of disbursing the credit, and b) Within fifteen days of the end of each calendar month, each Participating Entity shall submit a statement summarizing the overall credit disbursed by the Participating Entity together with a reconciliation of the total Aggregate Credit Obligations recorded in the Credit Registry Information System.
   Article 10
   Responsibility for information and data accuracy
4. Each Participating Entity shall be responsible for the accuracy and adequateness of its Credit Data
   recorded in the Credit Registry Information System, and shall take all necessary measures to verify the accuracy and adequateness of the information reported.
5. Should a Participating Entity discover that any Credit Data inaccurate or inadequate, it shall
   immediately submit to the BPA the correct Credit Data as required in this Instruction.
6. The BPA may review the Credit Data from time to time and may instruct a Participating Entity to
   investigate and correct information that appears to be inconsistent or inaccurate.
7. The BPA shall not be responsible for any inaccuracies in the information provided by Participating
   Entities.
   Article 11
   Obligations of the Participating Entities
8. Each Participating Entity shall establish appropriate internal procedures to regulate the reporting
   and retrieving of Credit Data on any Borrower together with procedures for reviewing and correcting inaccurate or inadequate data.
9. Each Participating Entity shall take all the necessary measures to secure and protect the Credit Data
   reported to the Credit Registry Information System from damage or unauthorized usage.

GBR N. o 07/2009 - CRIS Page 6 of 14
Article 12
The right to request information from the Credit Registry Information System

1. All persons shall have the right to request, in respect of their own self, information from the Credit
   Registry Information System.
2. All persons shall have the right to request the correction of any inaccurate or inadequate data
   submitted to the Credit Registry Information System in respect of such a person.
3. Any person requesting the correction of inaccurate or inadequate Credit Data may submit the
   request in writing to the relevant Participating Entity or to the BPA.
4. Corrections of inaccurate or inadequate shall only be made on the basis of the facts at the time of
   entry of the Credit Data into the Credit Registry Information System.
5. Adverse Information at a defined point in time shall not be permitted to be subsequently changed on
   the basis of later performance of the credit or the circumstances of the Borrower.
6. The BPA may request a Participating Entity to make a correction to the Credit Data in the Credit
   Registry Information System.
7. The Participating Entity shall without delay correct the Credit Data and resend the corrected Credit
   Data to the Credit Registry Information System and shall without delay notify the Borrower that the corrections have been made, with a copy of the notification to the BPA if the request for the change has been forwarded or initiated by the BPA.
8. A Participating Entity may decline a Borrower’s request to amend Credit Data by setting out its
   reasons for reaching this decision and forwarding a copy of the refusal to the BPA.
   Article 13
   Reporting requirements
9. All financial amounts reported to the Credit Registry Information System shall be expressed in
   United States Dollars.
10. If the credit is denominated in a foreign currency, the financial data shall be reported and updated
    monthly in the United States Dollars equivalent using exchange rates from a source published or approved by the BPA.
11. All credit regardless of amount must be reported to the Credit Registry Information System.
    CHAPTER III
    THE MANNER AND CONDITIONS OF USING THE INFORMATION AND DATA OF THE CREDIT REGISTRY INFORMATION SYSTEM
    Article 14
    Authorized users of credit information
    An Authorized User of Credit Information in the Credit Registry Information System shall be:
    a) A Participating Entity of the Credit Registry Information System; b) The Banking and Payments Authority; c) Any other person authorized by law or who has acquired the right by means of a judicial decision; and

GBR N. o 07/2009 - CRIS Page 7 of 14 d) The natural or legal person to whom the Credit Information relates.
Article 15
Prohibited use of credit information

1. An Authorized User shall only obtain or use Credit Information for purposes relating to ascertaining
   the creditworthiness of an existing or prospective Borrower who has signed a Consent Clause, and shall not use the Credit Information, in whole or in part, for the purposes of obtaining, preparing or verifying market statistics, soliciting or advertising to new customers, or any other business or commercial activity not directly related to the purposes of the Credit Registry Information System as set out in Article 1.
2. Non-compliance with the requirement of the previous paragraph by an Authorized User shall be a
   violation of this Instruction.
   Article 16
   Retention period
3. The Credit Data in respect of each Borrower shall be retained in the Credit Registry Information
   System for a period of not less than five years from the date of the full repayment of credit.
4. Adverse Information relating to debts written off by a Participating Entity due to a default by the
   Borrower shall be retained in the Credit Registry Information System for a period of not less than ten years.
5. Upon expiration of the terms in the previous paragraphs, Adverse Information and other Credit
   Data shall be deleted from the Credit Registry Information System.
   Article 17
   Infractions, remedial measures and penalties
6. In case of an infringement of the provisions of this Instruction by a Participating Entity, the BPA
   may take actions or impose penalties as established in Article 36 of Regulation n o 2000/8, on Bank Licensing and Supervision.
7. The following shall be considered as infringements of this Instruction:
   a) Failure to submit Credit Data within the deadlines set out in Article 9 of this Instruction; b) Incorrect or inaccurate reporting of Credit Data; c) Unauthorized usage, access, or mistreatment of Credit Data; d) Unauthorized disclosure of confidential Credit Data; and e) Failure to comply with the requirements set out in Article 9 of this Instruction.
8. The imposition of penalties on a Participating Entity by the BPA for non compliance with this
   Instruction shall not prejudice or mitigate any civil or penal responsibility if the above infringements are prohibited by other legal acts.
   Article 18
   Fees for using credit information
   The BPA may charge administrative fees to Participating Entities for access to Credit Information.

GBR N. o 07/2009 - CRIS Page 8 of 14
Article 19
Requests for credit data

1. The BPA shall provide Credit Data to Borrowers making application under Article 12 of this
   Instruction.
2. The Credit Data referred to in the previous paragraph shall be provided in written form.
3. A Borrower making an application in person shall present the identification document referred to in
   Article 7.1(a)) to the officer in the BPA responsible for management of the Credit Registry
   Information System.
4. If the request is made by the individual representative of a natural person the following documents
   shall be submitted to the BPA:
   a) The consent of the Borrower, through power of attorney or on a simple document, but in either case stating that the representative has legitimate authority; b) The representative’s identity card, passport or other identification document; c) Legible photocopies of the Borrower’s identity card, passport or other identification document.
5. A request made by or on behalf of a Borrower that is a legal entity must be accompanied by:
   a) A request on headed notepaper, stamped and signed by a person with the authority to represent the institution; b) The Borrower’s Registration Certificate (which shall be inspected and returned) and a photocopy thereof; c) Legible photocopies of the company manager or director’s identity card, passport or other identification document; d) In the case of a person not being an officer of the Borrower, a power of attorney or simple document providing proof that the representative has legitimate authority.
6. The BPA shall provide a copy of the information and data requested within ten days of receipt of
   the request.
7. Each Borrower may submit a request for Credit Data once in each calendar year without charge,
   and at any other time on payment of an administration fee.
   CHAPTER IV
   TRANSITIONAL PROVISIONS
   Article 20
   Information on existing borrowers
8. Each Participating Entity shall obtain written consent from its clients prior to submitting Credit
   Data to the Credit Registry Information System.
9. For the credits granted before the enter in force of this Instruction, the Participating Entities are
   obliged to obtain consents of borrowers within the terms of ninety days of the date of the present Instruction becoming effective.
10. In the event that a Consent Clause is not signed by a Borrower at the expiration date of the period
    specified in the previous clause, the Participating Entity shall provide a separate schedule of Credit

GBR N. o 07/2009 - CRIS Page 9 of 14
Data relating to Borrowers who have not signed Consent Clauses to the BPA in a written or electronic format to be determined by the BPA.
4. The information submitted under the previous clause shall not be available to other Participating
Entities through the Credit Registry Information System, but may be provided to a Borrower making application under Article 19 of this Instruction.
5. The BPA may impose an administrative fee of US$ 1 per non-consenting Borrower per month on a
Participating Entity that in its opinion fails to make significant progress on obtaining the consents of existing Borrowers within the required time.
Article 21
Right to request credit data
Article 19 of the present Instruction shall not enter into force until one year after the date of entry into
force of the present Instruction.
CHAPTER V
FINAL PROVISIONS
Article 22
Implementation of the Credit Registry Information System The manner and format of the Credit Data, data reporting and other technical and security arrangements concerning the establishment, implementation and operating procedures of the Credit Registry Information System shall be determined from time to time by written notification from the BPA to Participating Entities.
Article 23
Disclosure for statistical purposes
The BPA may disclose the Credit Data on a consolidated basis for statistical purposes, without specifying providers of data or details of individual borrowers.
Article 24
List of Participating Entities
The BPA shall publish the names of Participating Entities on its website www.bancocentral.tl.
Article 25
Effective date
This Instruction shall enter into force on the following day of its publication. Signed at Dili this 15 th day of May 2009 Abraão de Vasconselos Chairman

GBR N. o 07/2009 - CRIS Page 10 of 14
Annex 1 of Instruction №. 03/2009
On the Establishment of the Credit Registry Information System SAMPLE OF CONSENT CLAUSE The undersigned consent(s) to [name of Participating Entity] (“Lender”) obtaining from, exchanging with or disclosing to the Credit Registry Information System any and all information concerning the undersigned (“Borrower”) for the purposes of ensuring the accuracy of this information, conducting credit investigations and entering into and performing the loan or credit agreement. During the term of the loan or credit facility, the Borrower agrees not to withdraw his/her/its consent to the Lender’s ongoing collection, use or disclosure of the Borrower’s personal information in connection with the loan or other credit arrangement the Borrower has with the Lender or has guaranteed. The Lender may continue to disclose such to the Credit Registry Information System even after the Borrower’s loan or credit facility has been retired, and the Borrower may not withdraw his/her/its consent to the Lender’s doing so. The Lender is required do this to maintain the accuracy, completeness and integrity of the Timor-Leste credit reporting system. The Borrower further acknowledges that he/she/it has been informed by the Lender that he/she/it has a right of access to the Credit Registry Information System for the purposes of verifying the accuracy of the Borrower’s data therein.

GBR N. o 07/2009 - CRIS Page 11 of 14
Annex 2 of Instruction №. 03/2009
On the Establishment of the Credit Registry Information System CREDIT INFORMATION SHARING AGREEMENT Dated this day of , 20__ Between:
Banking and Payments Authority of Timor-Leste
(“BPA”), as the Agreement Administrator:
and:
____________________________________, (“Participant”) Whereas The commercial banks and other Participating Entities, approved or required to participate in the exchange of Credit Information under BPA Instruction No. 03/2009, and are required to enter into a form of Credit Information Sharing Agreement as defined in that Instruction, now wish to record the rights and obligations of the Parties relating to the provision and use of Credit Information in this Agreement, in addition to the rights and obligations contained that Instruction, agree as follows:

1. Purpose
   The purpose of this Agreement is to document the terms and conditions for the exchange of certain information by the Parties in connection with the establishment of a Credit Registry Information System (“CRIS”) by the BPA. The parties acknowledge that the BPA has established the CRIS to act as a depository of credit information submitted by Participating Entities in Timor-Leste for the purpose of sharing the credit information with other Participating Entities who have signed agreements in the same form as this document, and who have subjected themselves to provisions of the BPA Instruction No. 03/2009.
2. Interpretation
   The terms in this Agreement shall be given the same meanings as those defined in or by BPA Instruction No 03/2009 to the extent that the meaning is not inconsistent with the context in this agreement.
3. Provision of information
   Participant agrees to supply (originate) credit information to the BPA at such times and in such formats as shall be determined from time to time by the BPA. Participant shall ensure that the Credit Information supplied conforms to the requirements of the BPA (whether in electronic or paper form), that all information in verified for accuracy and conformity of Participant’s records prior to submission.
4. Disclosure of credit information
   Participant agrees that Credit Information supplied under this Agreement may be disclosed in whole or in part by the BPA to other Participating Entities.

GBR N. o 07/2009 - CRIS Page 12 of 14
Participant shall be entitled to request the BPA to provide Credit Information supplied by other Participating Entities and the BPA shall supply a report to the Member setting out extracts from the Credit Information records.
5. Use of credit information
Participant agrees that it shall be bound by an obligation of confidence with respect to any Credit Information received under this Agreement to the Participating Entity that supplied the Credit Information. Participant agrees that all Credit Information obtained under this agreement from the BPA and other Participating Entities shall be used only in connection with the evaluation of a Borrower for credit from the Participant, and the Participant may only disclose the Credit Information to employees who have made aware of the confidence obligation of Participant under this Agreement.
6. Accuracy
Each party will make all reasonable efforts to ensure the Credit Information in its custody is accurate, complete and up-to date with respect to all loans made to all Borrowers. The BPA shall provide Participant with periodic reports containing Credit Information submitted by the Participant, and Participant shall take reasonable steps to ensure that the Credit Information is accurate. Participant agrees to provide its customers (Borrowers) with reports on their own Credit Information for the purpose of allowing each Borrower to verify the accuracy of its Credit Information.
7. Security

1. Each Party will make reasonable arrangements to maintain the security of the Credit
   Information in its custody – whether in electronic or written form – by protecting it against such risk as unauthorized access, collection, use, disclosure or disposal.
2. Each Party will advise the other Party immediately of any circumstances, incidents or events
   which to its knowledge have jeopardized or may in future jeopardize:
    The privacy of individuals;
    The security of any computer system in its custody that is used to store or access the Credit Information.
3. Compliance monitoring and investigations
4. Each party will record and monitor access to the Credit Information in its custody.
5. Each party will investigate all reported cases of:
    Unauthorized access to or modification of the Credit Information in its custody;  Unauthorized use of the Credit Information in its custody;  Unauthorized disclosure of the Credit Information in its custody;  Breaches of privacy or security with respect to the Credit Information in its custody or with respect to any computer system in its custody that is used to access the Credit Information.
6. Each party will report to the other the result of any such investigation and the steps taken to
   address any remaining issues or concern about the security of the Credit Information or computer system, or the privacy of individuals to whom the Credit Information relates.

GBR N. o 07/2009 - CRIS Page 13 of 14
9. Fees
The BPA may charge reasonable fees to defray its costs for the operation of the CRIS as agreed between the parties from time to time.
10. Indemnity
The BPA shall disclose Credit Information to Member without making any warranty of claim with respect to its accuracy. Participant agrees that it shall not rely exclusively on the Credit Information disclosed to it in making its business judgments, and agrees that all Credit Information disclosed has been submitted by other Participant of the Credit Risk Bureau with reasonable care, but without any guarantee of accuracy concerning the names, address, collateral information, credit rating and other details submitted to the BPA.
11. Limitation of liability
In no event shall either party be liable for incidental, special or consequential damages relating to the use of Credit Information (including without limitation loss of profits) even if the party has been advised of the possibility of such damages.
12. Modification or termination of Agreement – General
This Agreement may be modified or terminated at any time by agreement, in writing, of both parties.
13. Termination for non-compliance with Agreement
This Agreement may be terminated at any time if the Participant fails to meet its obligations under this Agreement.
14. Terms of agreement
This Agreement will enter into force from [Date] and shall remain in force unless terminated in accordance with paragraph 12 or paragraph 13.
15. Force majeure
Neither party shall be held financially or otherwise responsible for any delay or failure in performance under this Agreement, caused by fires, strikes, embargoes, government requirements, civil or military authorities, acts of God, acts by terrorists or terrorist organizations or by the public enemy or other similar causes beyond the reasonable control and without the fault of negligence of such party.
16. Appendices
Any appendices to this Agreement are part of the Agreement. If there is a conflict between a provision in an appendix and any provision of this Agreement, the provision in the appendix shall be inoperative to the extent of the conflict unless it is expressly stated that it shall be operative despite a conflicting provision of this Agreement.

GBR N. o 07/2009 - CRIS Page 14 of 14
17. Survival
The confidentiality provisions shall survive the expiration or earlier termination of this Agreement or any part there of.
18. Governing Law
This Agreement has been made in Timor-Leste and shall be interpreted and construed in accordance with the laws of Timor-Leste, and the parties agree to submit to the jurisdiction of the Courts of Timor-Leste to resolve any actions, proceedings, controversy or claim of whatever nature arising out of or relating to this Agreement or breach thereof. In particular, the Participating Entity agrees to be bound by the provisions of the BPA Instruction No. 03/2009 on the Establishment of the Credit Registry Information System and subsequent amendments, Instructions, Rules and Guidelines issued by the BPA with general application to all Participating Entities on the management and operations of the CRIS. Agreed to on behalf of the BPA:

(Authorized representative) Date:
Agreed to on behalf of Participant:

(Authorized representative) Date: