Law No. 9 of 2019 Regulating the Exchange of Credit Information

Council of Ministers
The Law No. 9 of 2019 Regulating the Exchange of Credit Information1 Having perused:

• The Constitution,
• The Criminal Law promulgated by Law No. 16 of 1960 and laws in amendment
  thereof,
• Criminal Procedures and Trials Law promulgated by Law No. 17 of 1960 and laws
  in amendment thereof,
• Law No. 32 of 1968 on Currency, the Central Bank of Kuwait, and Regulation of
  Banking and amendments thereto,
• Civil and Commercial Procedural Law promulgated by Law No. 38 of 1980 and
  laws in amendment thereof,
• Civil Law promulgated by Law No. 67 of 1980, amended by Law No. 15 of 1996,
• Commercial Law promulgated by Law No. 68 of 1980 and laws in amendment
  thereof,
• Law No. 19 of 2000 concerning supporting national labor and encouraging
  Kuwaitis to work in the non-government sector, amended by Law No. 32 of 2003,
• Law No. 2 of 2001 concerning creation of a system for the gathering of
  information and data on consumer loans and credit facilities connected to installment-based sales,
• Law No. 30 of 2008 concerning guaranteeing deposits with local banks in the State
  of Kuwait,
• Law No. 6 of 2010 concerning employment in the private sector and laws in
  amendment thereof,

1 Published in the Official Gazette “Al-Kuwait Al-Youm”, Edition No. 1431, 56th Year on Sunday Jumada Al-Akhira 05, 1440 H coinciding with 10/02/2019.

• Law No. 7 of 2010 concerning creation of the Capital Markets Authority and
  regulating trading in securities and laws in amendment thereof, and
• Law of Companies promulgated by Law No. 1 of 2016 and laws in amendment
  thereof,
  The National Assembly has approved this law, text of which is provided below, and we have authorized and promulgated it accordingly:
  Definition
  Article (1)
  For purposes of implementing provisions of this law, the following terms and words shall be interpreted as indicated below:
  The Ministry: Ministry of Commerce and Industry.
  The Central Bank: The Central Bank of Kuwait.
  The Customer: Any natural or legal person regarding whom the credit information is provided. Credit Information: Information concerning customer credit status, commitments, and facilities. Credit Information Company (the company): companies formed by virtue of provisions of this law to operate in the business of requesting, gathering, saving, analyzing, categorizing, using and exchanging credit information, as well as compiling customer credit record and credit rating and issuing credit record and credit rating reports, along with preparing and developing risk instruments and criteria and relevant matter. Data and Information Providers: banks, investment companies, financing companies, companies regulated by the Ministry of Commerce & Industry, which provide credit facilities through sale of goods and services in any form of transfer of ownership on installment basis, where the credit information company provides customers' credit and personal information. This also includes any authority that has credit information or data regarding customers' history of meeting their commitments. Data and Information Users (Inquirers): Natural or legal persons allowed to inquire about and obtain credit information and reports provided by the company,

and customers regarding whom information is gathered/obtained and who have credit records with the company, as well as any other local or foreign authorities/ parties the Central Bank approves. Positive Information: Information indicative of customers meeting commitments in timely manner. Negative Information: Information indicative of customers’ default and failure to meet commitments, which includes delay and irregularity of payment, return of negotiable instruments unpaid, halt or default in payment, or a court of law ruling/finding of lien or insolvency or bankruptcy, as well as repeated rejection of applications for credit. Credit Record: A record of all customers' credit information obtained from information and data providers in chronological order, based on which the credit information report is prepared. Credit Information Report: an electronic or digital report issued by the company upon the inquirers' request, which contains correct, actual, accurate, and updated information and indicates the description and status of customers' credit capacity. Credit Rating: numerical evaluation based on statistical criteria that applies to all customers for the purposes of assessing the level of risk connected to the customer's payment/meeting of his/her future commitments. The credit information and data on the customer is to be used by the company. Scope of the Law
Article (2)
This law applies to the company, information and data providers, licensed users, customers, and all those in connection with credit and credit information reporting systems, in line with measures indicated in the bylaws and in the guidelines and regulations laid out by the Central Bank. Setting up a System for Exchange of Credit Information
Article (3)
In line with provisions of Article (83) of Law No. 32 of 1968 mentioned, a license may be given through a decision by the Central Bank's board for the provision of credit information and credit rating reporting services in the State of Kuwait to Kuwaiti public shareholding companies established for that purpose.

No such company may operate except after registration with the Central Bank. No other company may engage in the activities of exchange of credit information, or have anything in its address, publications, or adverts that could mislead the public into belief it has such activity. This law's executive bylaws organize the regulations and procedures and the requirements, as well as the fees, for licensing such companies. Regulations for Exchange of Credit Information
Article (4)
Obtaining customer authorization is mandatory wherein he/she agrees to inquiries regarding his/her information being made in line with the procedures and regulations laid out in the executive bylaws.
Article (5)
Information and data providers commit to providing the company with the customers' credit information and data according to the regulations laid out in the executive bylaws and the regulations and guidelines indicated by the Central Bank.
Article (6)
It is prohibited to gather or exchange information and data pertaining to a natural person's private life, opinions, beliefs, or health condition.
Article (7)
Credit information, credit records, and credit reports are considered confidential in nature, and may only be used for company activity purposes among parties indicated in this law and in line with its provisions and may not be accessed or revealed directly or indirectly without the consent of the customer or his/her heirs, legal representative, or authorized agent or upon request of the competent judicial authorities. Credit Information Companies
Article (8)
Credit Information Companies shall be shareholding companies with a minimum capital of KD 25 million. The Central Bank issues the regulations governing companies' operation and their relationship with those dealing with them, be they information and data providers,

inquirers, customers, or other credit information companies, and also decides fees for their services.
Article (9)
The person, who is a board member or holds the position of chief executive officer or his/her deputy/assistant, or shall continue to hold any of such positions in a credit information company must fulfill the following conditions:

1. Has not been sentenced for a felony or a crime against honor or integrity in the
   past.

2. Has no history of declared bankruptcy.

3. Has good conduct and reputation.

4. Has sufficient experience in the fields of company activity in line with
   regulations and controls stated in resolutions of the Central Bank’s Board of Directors. The company’s chairman must notify the Central Bank of names of candidates for board membership at least thirty days prior to the date set for the company's General Assembly to elect the board members, and also notify the bank of names of candidates for the positions aforementioned. The Central Bank's Board of Directors may, within 21 days of the notification, object to any of the candidates through a justified decision indicating non-fulfillment of conditions for said position. This objection results in exclusion from candidacy for board membership or any of these posts, whatever the case may be. No candidacy may be discussed at the General Assembly where the Central Bank has not been notified of the candidate's name or where the Bank had expressed its objection in line with provisions of this article. The Central Bank's Board of Directors may instruct the company’s Board of Directors to remove any of those indicated in the first paragraph from their positions if any of the requirements indicated in this article are compromised/lost while serving, and if such removal is not implemented, the Central Bank's Board of Directors may issue a justified decision to remove the individual concerned.
   Article (10)
   Credit Information Companies are required:

5. To provide data and information to users who are licensed as inquirers as well as
   to the concerned customers themselves.

6. To refrain from disclosing and/or revealing credit information they have to other
   parties.

7. To set up modern and updated systems and to create a database for storage of all
   that relates to credit information, credit record, and credit information reports and to update these regularly.

8. To protect and secure the information against loss, damage, and unlicensed or
   unsecure access or use or alteration. This includes maintaining means to support data and information retrieval in cases of emergencies.

9. To prepare documented and accurate credit records and to handle and process
   them in a timely, correct, and secure manner.

10. To prepare a regular record of customers’ credit information inquiry consents.
    Supervising Credit Information Company
    Article (11)
    Activities of credit information companies are subject to the supervision of the Central Bank of Kuwait to follow up on their compliance with the law, its executive bylaws, and Central Bank guidelines and instructions. The Bank may, for that purpose, view, access, and inspect companies' business and information systems to verify the integrity of their function and the efficiency of companies' operating risk management.
    Article (12)
    The Central Bank has the right to obtain all credit data and information and credit information reports from the company’s database, and the company may obtain data and information available to the Central Bank within the Center of Risk System, in line with the guidelines set by the Central Bank in this regard. The credit data, information, records, and reports, once expired, shall become the property of the Central Bank.

Complaints
Article (13)
The Central Bank issues regulations for making complaints regarding credit reporting services and mechanisms for reaching a decision regarding them. Credit information companies shall reply in writing to customer/s' complaints and provide the grounds for its decision in this respect within a maximum period of 15 days, and the Central Bank shall also decide upon it within 15 days. Violation and Penalties
Article (14)
In cases of a company’s violation of this law, its executive bylaws, or resolutions and instructions issued in implementation thereof, or in case of providing the Central Bank or credit information users with false or inaccurate information, the Central Bank may, after considering the company’s justification, impose the following penalties in proportion to the severity of the violation:

1. Issue a warning.
2. Impose a financial penalty of a maximum KD 250,000.
3. Request the removal or change of the employee responsible for the violation.
4. Remove the board member responsible for the violation from his/her position.
5. Assign a temporary supervisor to follow up on the company’s operations, with
   competencies and powers decided by the Central Bank’s Board.
6. Dissolve the company’s Board of Directors and assign a deputized manager until
   the election of a new Board of Directors.
7. Revoke the company’s license.
   Penalties stated in item (1) are to be imposed by virtue of decision by the Governor of the Central Bank, while those stated in items (2,3,4,5,6,7) are to be imposed by virtue of a decision by the Central Bank’s Board of Directors.
   Article (15)
   In cases of violation of provisions of this law, its executive bylaws, and/or decisions and instructions issued in implementation thereof by data and information providers or by data and information users, or in cases where they fail to provide the required

information, or where they provide false or inaccurate information, the Central Bank, after considering the justifications presented by those concerned, may impose any of the penalties indicated in items (1,2,3,4) of the previous article. The penalty indicated in item (1) of the previous article is imposed on CBK-regulated parties virtue of a decision by the Central Bank Governor, while penalties indicated in the other items (2,3,4) of the same article are imposed virtue of a decision by the Central Bank’s Board of Directors. Where companies and institutions violating this law, its executive bylaws, and/or resolutions issued in implementation thereof are regulated by the Ministry of Commerce and Industry, the Minster of Commerce and Industry, upon the request of the Central Bank and after consideration of the justifications presented by those concerned, shall impose the following penalties, in proportion to the severity of the violation:

1. Ban installment-based sale of products and services for a specific period.
2. Revoke the license issued by the Ministry of Commerce and Industry for the
   company or institution for installment-based sale of products and services, in case of repeated offenses.
   Article (16)
   Without breach of any harsher penalty stated upon in another law, a penalty of no more than one-year imprisonment and a fine of no more than KD 5,000, or either of the two, shall be imposed along with a sentence of removal from office/position depending on circumstances in case of:
3. Violation of article (7) of this law.
4. Obtaining credit data and information or accessing customer credit record
   without license in view of the provisions of this law and its executive bylaws.
5. Altering data and information in bad faith, or providing false credit data and
   information to the company.
   General Provisions
   Article (17)
   The Ministry, after seeking the Central Bank's opinion on the matter, lays down the rules and guidelines concerning credit facilities resulting from installment-based sale

of products and services, in line with Central Bank instructions regarding guidelines for granting loans and consumer financing.
Article (18)
Credit information companies in business when this law comes into effect shall regularize their position and be listed in the register with the Central Bank in line with provisions of this law and its executive bylaws within a maximum period of six months from issue of the executive bylaws.
Article (19)
This law shall be published in the official gazette and its executive bylaws issued through a resolution by the Minister of Finance, upon the proposal of the Central Bank, within six months of its publication.
Article (20)
Law No. 2 of 2001 aforementioned is considered null as of date of this law entering effect.
Article (21)
The Prime Minister and the Ministers, each within their capacity, shall implement this law, which shall be imposed as of date of publication of its executive bylaws. Amir of Kuwait Sabah Al-Ahmad Al-Jaber Al-Sabah Issued at Seif Palace: Jumada Al-Oula 24, 1440 H Coinciding with January 30, 2019

Explanatory Note on Law No. 9 of 2019 Regulating the Exchange of Credit Information1 This project aims to enhance and develop the legislative environment for credit transactions in the State of Kuwait. The law aims to lay out a framework for companies conducting credit ratings of natural and legal persons. Classifying these companies is a practical necessity that enables all members of society to receive the required credit based on objective scientific and numerical bases. The project, therefore, included careful phrasing of the definitions included in the law in its
Article (1), moving on to scope of implementation in Article (2) so that it covers the
companies that would be licensed to provide credit rating services in terms of requirements for their establishment, frameworks for their handling of credit information, and individuals licensed to use the information, all under the umbrella of the Central Bank of Kuwait, which is the competent authority to supervise these companies. The law then addressed the legal forms of companies that would be licensed to provide services such as reporting credit and credit rating in the third article. The legislator specified that such companies must be shareholding companies, and the law specified that organizing procedures and conditions for licensing and fees shall be determined in the executive bylaws, to ensure the required flexibility when it comes to conditions to license companies. To protect customer privacy and confidentiality of individuals’ information, Article (4) of the law specified the necessity of obtaining customer consent for inquiries into his/her data. The legislator set the rules to obtain such consent in the executive bylaws. To enable the licensed companies to be informed of their credit ratings, the law obligated the data/information providers to provide the licensed companies with such data according to article (5). Along the same lines and to protect individuals’ private life and privacy, Article (6) explicitly prohibited gathering of information pertaining to individuals’ beliefs and opinions. To prevent abuse of the data, Article (7) explicitly prohibited use of credit data and information or exchange for any purpose not indicated in this law. The same article stressed privacy by stating that credit information is confidential in nature and no one may have access to it without customer consent.

1 Published in the Official Gazette “Al-Kuwait Al-Youm”, Edition No. 1431, 56th Year on Sunday Jumada Al-Akhira 05, 1440 H coinciding with 10/02/2019.

Article (8) addressed the form of the company, indicating that it should be a
shareholding company with a capital of a minimum KD 25 million, and that the Central Bank shall issue guidelines to regulate the company’s activities.
Article (9) listed the conditions that must be fulfilled by a person in the position of a
board member or chief executive officer or his/her deputy/assistant. It pointed out the Central Bank’s authority regarding the selection of candidates and the supervision of their performance. The article also authorized the Central Bank to demand exclusion of those who lack or lose eligibility requirements.
Article (10) specified the commitments and functions of credit information
companies. The eleventh indicated that such companies are subject to Central Bank supervision and are required to comply with all regulations, guidelines, and instructions the Bank issues and grant it access and allow it to inspect all company business. In view of the special nature of the companies licensed in line with this law and how their operations are connected to the banking sector, the law made the Central Bank responsible for supervising credit information companies, in line with what is stated in articles 11, 12 and 13. Credit information companies are also required to provide a justified reply in writing to any/all customer complaints within 15 days. Articles 14, 15, and 16 of the law addressed the violations and penalties imposed on companies licensed by virtue of this law as well as data and information providers. To stress confidentiality of the information these companies would be dealing with, penal measures were stated to be imposed against those who obtain information without the necessary approvals and licenses and those who, in bad faith, alter data and information or violate the controls in article (7). In conclusion, the general provisions explicitly stated that the Law No. 2 of 2001 Concerning Creation of a System for the Gathering of Information and Data on Consumer Loans and Credit Facilities Connected to Installment-Based Sales, is revoked, and allows the existing credit information companies a time extension to regularize their positions, requiring them to be listed in the register with the Central Bank. This law comes into effect as of the date of publication of its executive bylaws, which must be issued within six months of its publication.