CENTRAL BANK OF KENYA 1 CREDIT REFERENCE BUREAU ... · CENTRAL BANK OF KENYA CREDIT REFERENCE BUREAU REGULATIONS, 2019 5 “credit report” means an electronic, written or other

C E N T R A L B A N K O F K E N Y ACREDIT REFERENCE BUREAU REGULATIONS, 2019 1

C E N T R A L B A N K O F K E N Y ACREDIT REFERENCE BUREAU REGULATIONS, 20192

CREDIT REFERENCE BUREAU REGULATIONS, 2019ARRANGEMENT OF REGULATIONSRegulations

PART I – PRELIMINARY1 Citation.2 Interpretation.

PART II – ESTABLISHMENT AND LICENCING OF CREDIT REFERENCE BUREAUS3 Qualificationandprohibitiontooperatewithouta

licence.4 Applicationforlicence.5 Evaluationofapplication.6 Inspectionofpremisesandsystems.7 Issuanceoflicence.8 Bank Guarantee.9 Refusaltoissuealicence.10 Validityofthelicence.11 PublicationoflistofBureaus.12 Revocationorsuspensionoflicence.13 Annuallicencefee.14 Non-Transferabilityoflicences.

THE BANKING ACT(Cap. 488)

THE MICROFINANCE ACT(No. 19 of 2006)

THE SACCO SOCIETIES ACT(No. 14 of 2008)

PART III – OPERATIONS OF CREDIT REFERENCE BUREAUS15 ActivitiesoftheBureaus.16 UseofAgents.17 ActionsrequiringpriorapprovalofCentralBank.18 Natureofinformationtobeshared.19 Identificationdetails.20 Protectionfromliability.21 Prohibitedinformation.22 Formofconsent.23 Conditionsandformofdisclosuretocustomers.24 Othersourcesofinformation.25 UseofpublicdatabyBureau.26 Dutytoprovideaccurateinformation.27 Restrictionsontheuseofcustomerinformation.28 ResponsibilitiesofaBureau.29 Keyfactsdocumentontherighttoobtainand

disputecreditreport.30 Subscriber’sobligationinrespectofinformation

obtainedfromBureaus.31 Receiptofcreditreportsbythirdparties.32 Fees.33 Datamanagementandqualitycontrol.34 Updatingandmaintaininginformation.35 Securityandcontrolmeasures.36 Customers’rightsofaccessandcorrection.37 Accesstoowninformation38 Creditscores39 Useofcreditscores


PART IV – CROSS BORDER CREDIT INFORMATION SHARING40 Authoritytosharecross-bordercreditinformation.41 EstablishmentofplaceofbusinessoutsideKenya.

PART V – GOVERNANCE AND MANAGEMENT OF BUREAUS42 ManagementandcompositionofaBureau.43 Capital44 Criteriaforappointmentofdirectors.45 Disqualificationofofficers.46 Suitabilitytest.

PART VI – DISSOLUTION AND LIQUIDATION47 Dissolutionandwindingup.48 CentralBankapprovalforvoluntaryliquidation.49 NotificationtotheCentralBank.50 ForwardingofdatatoCentralBank.51 NotificationtoinstitutionsandBureaus.

PART VII—POWERS OF THE CENTRAL BANK52 PowersoftheCentralBank.53 InspectionofBureaus.54 Ownershipofinformation.55 Periodicreturns.56 Auditedreport

PART VIII – GENERAL PROVISIONS57 Mandatorystandards.58 Responsibilitiesofinstitutions.59 Centralhub60 Datasubmissiontemplates61 Notificationofamountowing.62 Modeofservice.63 Obtaininginformationunderfalsepretences.64 Publicationoflistofthirdpartycreditinformation

providers.65 Publiceducation.66 Compliancewithguidelines,rulesordirectives.67 Penalties.68 Repeals.69 Savings.

SCHEDULESFIRST SCHEDULE—ApplicationFormforaLicencetocarryouttheBureauBusiness.

SECOND SCHEDULE—PersonalDeclarationFormforindividualsproposedtobecomesignificantshareholders,directorsorseniorofficersofaBureau.

THIRD SCHEDULE —StatutoryDeclaration.

FOURTH SCHEDULE — Fees


THE BANKING ACT(Cap. 488)

THE MICROFINANCE ACT(No. 19 of 2006)

THE SACCO SOCIETIES ACT(No. 14 of 2008)

makesthefollowingRegulations–

THE CREDIT REFERENCE BUREAU REGULATIONS, 2019

PART I—PRELIMINARY

Citation and commencement1. These Regulations may be cited as the Credit

ReferenceBureauRegulations,2019.

Interpretation2. In these Regulations, unless the context otherwise

requires–

“Act”means the Banking Act, theMicrofinance Act,2006andtheSaccoSocietiesAct;

“adverse action notice” means a notice issued byan institution to a customer conveying denial orcancellation of, an increase in any charge for, or areductionorotheradverseorunfavourablechangeinthetermsofcoverageoramountof,anyloan,existingorapplied for,oranyotheractionordeterminationadverselyaffectingthecustomer,basedoncustomerinformationobtainedfromaBureau;

“agent”meansanentitycontractedbyaBureauandapprovedbytheCentralBanktoprovidetheservicesonbehalfof theBureau, insuchmannerasmaybe

INEXERCISEofthepowersconferredbysections31(3)and(4)and55(1)oftheBankingAct,sections34(4)and(5)and48(2)oftheMicrofinanceAct,2006,andsection54oftheSaccoSocietiesActtheCabinetSecretaryforTheNationalTreasury

prescribedbytheCentralBank;

“amendmentnotice”meansawrittennoticefromaninstitution advising a Bureau of an amendment tocredit informationpreviously incorrectlyreportedtoaBureaubythatinstitution;

“bank’meansabanklicensedundertheBankingAct;

“Bureau”means a credit reference bureau licensedundertheseRegulationstoprepareorprovidecreditreportstocreditinformationrecipientsbasedondatamaintainedbytheBureauandtocarryoutsuchotheractivitiesasareauthorisedundertheseRegulations;

“CabinetSecretary”meanstheCabinetSecretaryforthe time being responsible for matters relating tofinance;

“Central Bank” means Central Bank of Kenyaestablished under section 3 of the Central Bank ofKenyaAct;

“credit information”meansanypositiveornegativeinformation bearing on an individual’s or entity’screditworthiness,creditstanding,creditcapacity,tothe history or profile of an individual or entitywithregardtocredit,assets,andanyfinancialobligations;

“credit informationprovider”meansapersonotherthanasubscriberwhofurnishescreditinformationtoaBureau;


“credit report” means an electronic, written or othercommunicationofanyinformationbyacreditreferencebureau, relating to a person’s creditworthiness, creditstanding,creditcapacity,characterorgeneralreputationwhich is used or collected to serve as a factor inestablishing that person’s eligibility for credit or otherserviceorproductprovidedbyaninstitutionorforsuchotherpurposesasmaybepermittedorrequiredbylaworcontract;

“credit score” means a numerical expression of acustomer’screditworthinesscontainedinacreditreport;

“customer”meansanyconsumerofservicesorproductswho has a formal engagement to receive services orproducts on agreed terms and conditions from aninstitution licensed under the Act or a third party andincludesapersonwhoseekstoopenanaccountwithaninstitution;

“customer information” means credit information, oranyotherpositiveornegative informationprovidedbyacustomerorobtainedfromaninstitution,athirdparty,orpublic record information,whichmaybeexchangedpursuanttotheseRegulations;

“database” means a set of customer informationcollected,managedanddisseminatedbyaBureau;

“day”meansacalendarday;

“delinquentloan”meansanyloanwhichtheprincipalorinterestremainsunpaidaftertheduedateinaccordancewith the provisions of the Sacco Societies Act andthe Sacco Societies (Deposit-Taking Sacco Business)Regulations,2010;

“director”meansamemberoftheboardofdirectorsofaBureau;

“institution” for the purposes of these Regulations,meansaninstitutionwithinthemeaningofsection2oftheBankingAct,section2oftheMicrofinanceAct,2006andasaccosocietyasdefinedintheSaccoSocietiesAct;

“loan”meansdirect,indirectandcontingentobligationsincurredbyanindividualorentitywiththirdpartiesandincludesany,credit,discount,advance,overdraft,exportbills purchased, other bills receivable or purchased,import bills, customers’ liability on off balance sheetitemsoranyothercreditfacilityextendedtoacustomer

ofaninstitution;“microfinance bank” means a microfinance banklicensedundertheMicrofinanceAct,2006;

“negative information” means any adverse customerinformationrelatingtoacustomerwhichincludes-

(a) non-performing loan or credit default or latepaymentonalltypesoffacilitiesorclaims;

(b) dishonour of, other than for technical reasons,chequesmeantforsettlementofcreditsinfavourofinstitutions;

(c) accounts compulsorily closed other than foradministrativereasons;

(d) provencasesoffraudsandforgeries;

(e) provencasesofchequekiting;

(f) falsedeclarationsandstatements;

(g) receiverships,bankruptciesandliquidations;

(h) tenderingoffalsesecurities;and

(i) misapplicationofborrowedfunds.

“non-executive director” means a director who is notengagedinthedaytodaymanagementofaBureau;

“non-performingloan”means—

(a) pursuant to the Banking Act and PrudentialGuidelines,2013—

(i) in respect of, loan accounts and other creditextensions having pre-established repaymentprograms, when principal or interest is dueandunpaidforninetydaysormoreor interestpaymentsforninetydaysormorehavebeenre-financedorrolled-overintoanewloan;

(ii) in respect of, current accounts ,overdrafts,and other credit extensions not having pre-established repayment programs, when thebalanceexceedsthecustomersapprovedlimitfor more than ninety consecutive days, thecustomersborrowinglinehasexpiredformore


thanninetydaysor interest isdueandunpaidformorethanninetydays;or

(iii)in respect of, off balance sheet items, whenthe off balance sheet item crystallize and thecustomer’saccountisdebitedandtheprincipaland interest is subsequentlyunpaid forninetydaysormore.

(b) pursuant to the Microfinance Act, 2006 and theMicrofinance (Depositing Taking MicrofinanceInstitutions)Regulations,2008acreditfacilitythatisnotgeneratingincomeandtheprincipalorinterestis due and unpaid for, more than thirty days andincludesa loanorcredit facilityclassifiedeitherassubstandard,doubtfulorloss;

(c) Pursuant to the Sacco Societies Act and theSacco Societies (Deposit-Taking Sacco Business)Regulations,2010meansadelinquentloan;

“notice of change” means a written notice sent by aBureautoaninstitutionconcerningasignificantchangeto customer information that had previously beenobtainedbytheinstitutionfromtheBureauforaperiodnotexceedingtwelvemonthspriortothedateofthenoticeofchange;

“noticeofresolution”meansawrittennoticesent froman institution to a Bureau, advising the results of aninvestigation the institution has made into customerinformation previously reported to the Bureau by theinstitutionwherethecustomerhasdisputedtheaccuracyofinformationreported;

“officer”meansanypersonwhotakespartinthegeneralmanagement of a Bureau and includes a director,the secretary to the board, the chief executive officer,deputychiefexecutiveofficer,chieffinancialofficer,chiefinformationtechnologyofficer,chiefinternalauditor,ormanagerofasignificantunitoftheBureauorapersonwithasimilarlevelofseniority,positionorresponsibility;

“performing loan”meansany loanwhichhasnotbeenclassifiedas a non-performing loanunder theBankingActandtheMicrofinanceAct;

“place of business”means any premises including thehead office, branch, agency or such other premises asmaybeapprovedbytheCentralBank,atwhichaBureauconductsitsbusiness;

“positive information” means any information onperformingloanorothercredit;“positive information” means any information onperformingloanorothercredit;

“regulator or supervisory authority” means an agencyresponsible for supervising institutions or creditreferencebureaus;

“Saccosociety”meansasavingsandcreditco-operativesociety registeredunder theCo-operative Societies Actand licenced and regulated under the Sacco SocietiesAct;“significant shareholder” means a person other thantheGovernmentorapublicentity,whoholdsdirectlyorindirectlyorotherwisehasabeneficial interest inmorethantenpercentofthesharecapitalofaBureauorifitisproposedthatsuchapersonshallholdorhavesuchabeneficialinterest;

“subscriber” means an institution licensed under theBankingAct,theMicrofinanceActortheSaccoSocietiesAct and which has subscribed to receive customerinformationfromaBureau.

“summary of rights” means a key facts documentprepared by a Bureau pursuant to Regulation 29 andwhich sets out a customer’s rights relating to creditreport”.


PART II—ESTABLISHMENT AND LICENSING OF A BUREAU

Qualification and prohibition to operate without a licence3. (1)Apersonshallnotestablishoroperateabureau

business in Kenyaor otherwise hold himself out tothepublicasengaginginanyBureaubusinessforthebenefitof institutions licensedunder theActunlesssuchpersonis—

(a) established and incorporated as a limitedliability company under the Companies Act;and

(b) licensedundertheseRegulations;or(c) isanagentofaBureau.

(2) A person who contravenes the provisions ofthis regulation commits an offence and shall,on conviction, be liable to a fine of five hundredthousandshillingsor to imprisonment fora termoftwoyearsortoboth.

Application for a licence4. (1) A person seeking to obtain a licence to conduct

Bureaubusinessshallapply to theCentralBank forapprovalofthename.

(2)Theapprovalundersub-regulation(1)shalllapsewhere the person does not obtain a licence withintwelvemonthsofsuchapproval.

(3) An application for a licence to conduct Bureaubusiness shall bemade to the Central Bank in theformsetoutintheFirstSchedule.

(4) The applicant under sub-regulation (3), shallfurnish the following information and providesupporting documents and any such otherinformation that theBureauconsidersnecessaryorasmayberequiredbytheCentralBankfromtimetotime-

(a) certified copies of the applicant’s certificateof incorporation and its memorandum andarticlesofassociation;

(b) feasibility studyby theapplicant, showing thenatureoftheplannedbusiness,organizationalstructure and internal control systems andmonitoring procedures of the company,covering,thefollowingaspects—

(i) marketanalysis;(ii) ownershipstructure;(iii) governanceandmanagementstructure;(iv) businessplan;(v) businesscontinuityplan;and(vi) operation manuals that ensure the

accuracy of the information contained initsdatabaseaswellasthetimelyupdatingof the information, through signingof contracts with information sourceswhich must be known to and approvedby the Central Bank and the manualsmust include query module manualof the applicant, data loading modulemanual, source quality control manual,maintenance module manual, securitymodule manual, operating manual, usermanual,dataprivacymanualandmanualforproceduresforhandlingcomplaints;

(c) sworn declarations of proposed directors,officers and significant shareholders in theformssetoutintheSecondSchedule;

(d) managementprocesses,including—

(i) development schedule of the softwarerequiredforoperation;

(ii) characteristicsofproductsandservicestobeprovidedtosubscribers;

(iii) serviceprovisionpoliciesandproceduresmanuals;and

(iv) proposed security and control measuresaimed at preventing misuse or impropermanagementofinformation;

(e) overviewofoperationsincludingthedescriptionofsystemsandthedesignofthedatacollectionincluding the unique identification system forindividualsandenterprisesthatisadequatetoeasethecollectionofdataandhandlingofthedatabase;


(f) a description of the applicant’s premises andtheir suitability for customer service and thedescription of the security measures to beadopted;

(g) theproposedfeesandcoststructureofproductsandservices;

(h) auditedfinancial statements for the last threeyearswhereapplicable;

(i) a prototype of the final product thatdemonstrates the principal features andfunctionsofthesystem;and

(j) a banker’s cheque of ten thousand shillingspayable to the Central Bank, being a non-refundableapplicationprocessingfee.

Evaluation of application5. (1) OnreceiptofanapplicationforaBureaulicence,

theCentralBankshallwithinfourteendaysfromthedateofreceiptoftheapplicationassesstheaccuracyoftheinformationsubmittedandshallacknowledgereceiptoftheapplicationandnotifytheapplicantofanymissing informationwhichought to havebeensubmittedbytheapplicant.

(2)When evaluating an application for a licence tooperateaBureaubusinessinKenya,theCentralBankshall take into consideration all relevant mattersincludingthefollowing-

(a) the background, reputation, integrity,experience and capacity of the proposedsignificant shareholders, directors and seniorofficers of the applicant as evidenced byamongst others, the curriculum vitae andprofessionalrecordsoftheproposedpersons;

(b) the business plan of the applicant, includingplans to undertake national coverage, the rolloutplanandamechanismtointegrate,gather,input,updateandvalidatedata;

(c) the design of data collection for customerinformation and flexibility in structuring theinformation in accordance with the Act andtheseRegulationsorotherguidelinesthatmaybeissuedbytheCentralBank;

(d) theadequacyoftheapplicant’scapitalstructureinrelationtothebusiness;

(e) availabilityofhuman,financialandoperationalresources necessary for effective and efficientconductofBureaubusiness;

(f) theexistenceofadequateinfrastructureforthecollectionofinformationanddeliveryofcreditreports;

(g) ability of the applicant to keep customerinformationconfidential;and

(h) abilityof theapplicant toconductproperandsufficientduediligenceandidentityverificationonanypersonrequestingforcreditinformation.

Inspection of premises and systems6. (1) An applicant shall submit to the Central Bank

an independent security audit report prepared bya registered audit firm giving expert opinion onthe suitability of the premises, adequacy of themanagement information systems, and any otheraspectsthatmaybeconsideredrelevantwithrespectto Bureau operations.

(2) The Central Bank shall carry out on-siteinspectionof theapplicant’spremises todeterminethe adequacy of the applicant’s safety and securitysystemandtoconfirm-

(a) suitabilityofthepremisesforBureauoperations;

(b) adequacy of the management informationsystem, administrative and operationalprocessesandtheinternalcontrolsystems;

(c) securityofinformation;and

(d) separation of the proposed Bureau businessfromotherbusinesscarriedoutbytheapplicantoritsassociates.

Issuance of licence7. (1) Where the Central Bank is satisfied that the

applicant meets the requirements; it shall issue aletterofintenttotheapplicant,whichshallactasaninterimapprovaloftheapplication.

(2)Whereanapplicantisissuedwithaletterofintent,theCentralBankshallnotifytheapplicanttosubmittotheCentralBank-


(a) a bankers cheque for one hundred thousandshillings payable to the Central Bank beinglicencefee;

(b) astatutorydeclarationintheformsetoutintheThirdSchedule swornunderoathby thechiefexecutive officer of the applicant confirmingthattheapplicantwilladheretotheprovisionsof these Regulations and in particular, theapplicant will not disclose to any personany information obtained pursuant to theapplicant’sobligationsundertheseRegulationsexceptasprovidedtherein.

(3) Where the Central Bank is satisfied that therequirements of sub-regulation (2) have been fullycompliedwith,theCentralBankshallissuealicenceto the applicant permitting it to carry out Bureaubusiness.

(4) Where the Central Bank is dissatisfied with theinformationsubmittedbytheapplicant, theCentralBankmayrequest foradditional informationbeforemakingafinaldetermination.

(5)TheCentralBankmayendorsealicencegrantedunder this regulation with such conditions as theCentralBankconsidersnecessaryandmayfromtimetotimeadd,varyorsubstitutesuchconditionsastheCentralBankconsidersappropriate.

(6)TheCentralBankshalldetermineanapplicationforalicencewithinninetydaysfromthedateofreceiptofinformationrequiredundertheseRegulationsorasmayberequestedbytheCentralBank:

Provided that a licence shall not be granted if theapplicant has not fully set up its physical structureincludingmanagementinformationsystem.

(7) Where the Central Bank declines to grant alicence,itshallstatethegroundsofrefusalandwhereapplicablemayadvisetheapplicantofthenecessaryaction which the applicant needs to take beforeresubmittingafreshapplicationforalicence.

Bank guarantee8. (1)WhereaBureauislicensedundertheseRegulations,

itshallwithinthirtydaysofbeinggrantedthelicence,submit to the Central Bank an irrevocable bankguarantee of one million shillings from a bank ora microfinance bank and in such form as may bespecifiedbytheCentralBank.

(2)WhereaBureauisrequiredtopayapenaltyundertheseRegulationsandfailstodosowithinthetimespecifiedbytheCentralBank,theCentralBankmayrecovertheamountdueonthepenaltyfromthebankguaranteeissuedundersub-regulation(1).

(3)Whereapenaltyhasbeenrecoveredfromthebankguarantee in accordance with sub-regulation (2),theBureaushallwithinthirtydaysofbeingnotified,furnishtheCentralBankwithanewirrevocablebankguaranteeofonemillionshillings,inaformspecifiedbytheCentralBank.

(4)WhereaBureaufailstocomplywithsub-regulation(1)and(3),itslicenceshallberevoked.

Refusal to issue a licence9. (1)TheCentralBankmay,wheretherequirementsof

issuanceofalicenceasprovidedintheseRegulationsarenotmet,declinetograntalicencetoanapplicant.

(2)ApersonaggrievedbythedecisionofCentralBanknottogranta licenceundersub-regulation(1)may,withintwenty-onedaysfromthedateoftheCentralBank decision, appeal to the Cabinet Secretary forreviewofthedecision.

(3) The Cabinet Secretary shall, while consideringan appeal under sub-regulation (2), consider thematerial in the administrative record developed bythe Central Bank and may invite the Central Bankor the applicant or both the Central Bank and theapplicanttomakeanypresentationswithrespecttotheappeal.


(4)TheCabinetSecretarymayreversethedecisionoftheCentralBankifitestablishesthat—

(a) theCentralBankfailedtofollowthelaiddownprocedure;

(b) theCentralBank’sdecisionwascontrarytolaw;(c) therewasnofactualbasisfortheCentralBank’s

decision;or(d) basedonareviewoftherecord,theCentralBank

committedamanifesterrorinitsassessmentoffacts,orabuseditsdiscretion.

(5)TheCentralBankshallbeboundbythedecisionoftheCabinetSecretary.

Validity of the licence10. A licence issued under these Regulations shall

remainvalidunlessitisrevoked.

Notification of licenced Bureaus11. The Central Bank shall, within thirty days from

thedatea licencehasbeen issuedtoaBureau,bynoticeintheKenyaGazette,notifymembersofthepublicofthenameoftheBureauandthedatethelicencewasissued.

Revocation or suspension of licence12. (1) The Central Bankmay suspend or revoke a

licenceissuedtoaBureauiftheBureau—

(a) doesnotcommencebusinesswithintwelvemonthsfromthedatethelicencewasissued;

(b) has ceased or suspended operations for aperiodofthreemonths;

(c) obtained the licence on the premise onwrong, false, misleading information orconcealmentofmaterialinformationwhich,if known at the time of evaluation of theapplicationforthelicence,theBureauwouldnothavebeengrantedalicence;

(d) appliestotheCentralBankfortherevocationor suspension of the licence where goodcausehasbeenshown;

(e) has ceased to meet the licensing andoperational requirements prescribed intheseRegulations;

(f) has failed to complywith any condition ofthelicence;

(g) hasviolatedtheprovisionsofanyapplicablelaw or these Regulations or is insolvent orunabletoeffectivelyconduct itsoperationsorthrough itsactivitiesthepublictrusthasbeencompromised;

(h) has failed to comply with any materialobligation imposedon itbyorunder theseRegulations;

(i) hasengagedinactivitieseitherrestrictedornotpermittedundertheseRegulations;

( j) isunableorhasconsistentlyfailedtoprotecttheconfidentialityofdataor information itcollects;

(k)has,withouttheconsentoftheCentralBank,amalgamatedwithanotherentityorsoldorotherwisetransferreditsbusiness,assetsorliabilitiestoanotherentity;

(l) awinding-uporderhasbeenmadeagainstitoraresolutionforvoluntarywindinguphasbeenpassed;

(m)hasbeenengaged inusingthe informationcollected, for any purpose which is notpermittedbytheseRegulations;or

(n) fails to pay the annual licence fee withinninetydaysaftertheanniversarydate.

(2)TheCentralBankshallnotrevokeorsuspendthelicenceofaBureauunlesstheBureauhasbeengivenanopportunitytomakerepresentationstotheCentralBankonwhythe licenceshouldnotbe revokedor suspendedand theCentralBankshalltakeintoconsiderationtherepresentationsmadebytheBureauinitsdecisiononthematter.

(3)TheCentralBankmay, in lieuof revokingorsuspending the licence, require the Bureau totake suchmeasures to regularise the breach orviolation within such time as the Central Bankmay specify and may in addition impose suchmonetary penalty or other sanctions as it mayconsidernecessary.

(4) The Central Bank shall, upon revoking orsuspending a licence under sub regulation (1),within seven days inform the licencee of therevocationorsuspension.

(5) The Central Bank shall, upon revocationof the licence of a Bureau, take over control ofthe business of the licencee to safeguard theinformation in its possession and facilitatewindingupofitsBureaubusiness.


(6) The Bureau shall hand over the entiredatabase in a readable format as the CentralBank may specify and shall thereafter erase tothesatisfactionoftheCentralBank,alldatainitsdatabase.

(7)Wherethelicenceisrevoked,theholderofthelicenceshall,withinsevendaysfromthedateofserviceofthenoticeofrevocation,surrenderthelicencetoCentralBankandshallforthwithceasetocarryoutBureaubusinessoranyotheractivityauthorizedundertheseRegulations.

(8) A person who fails to comply with sub-regulation (7) commitsanoffenceandshall,onconviction,beliabletoafinenotexceedingfivehundred thousand shillingsor to imprisonmentforatermnotexceedingtwoyearsortoboth.

(9) The Central Bank shall, by notice in theGazette,notifyallinstitutions,otherBureausandthepublicwheneveraBureau’slicencehasbeensuspendedorrevokedandfurtherdealingswiththe Bureau for purposes of these Regulationsshallcease.

Annual licence fee13. (1) In this regulation, “anniversary date”means

the end of a calendar year running from 1stJanuaryto31stDecemberofeachyear.

(2)ABureaushallberequiredtopaytotheCentralBank an annual licence fee of one hundredthousandshillings.

(3) The annual licence fee prescribed in sub-regulation(1)shallbepaidbeforetheanniversarydate.

(4)ABureauthat failstopaytheannual licencefeebeforetheanniversarydateshallpaydoublethelicencefee,ifpaymentismadewithinninetydaysaftertheanniversarydate.

(5) Where a Bureau fails to pay the fee withinninety days after the anniversary date asprescribed insub-regulation(3), its licenceshallberevoked.

(6) Where a Bureau is granted a licence by theCentral Bank—

(a) there shall be no refund of any licence feepaid to the Central Bank in the event thelicence iscancelledor revokedoraBureauceases to carry on business at any timebeforetheendoftheyear;

(b) there shall be no proration of the licencefee paid in the course of the year for thecommencementofBureaubusiness:

Provided that for Bureaus which were in existence atthe date of commencement of these Regulations, theannual licence fees already paid shall be prorated upto31stDecember2013and theBureaus shallonlypaythe balance of the annual licence fees for the periodcommencing from 1st January 2014 to 31st December2014.

Non-transferability of licences14. (1)Apersonshallnottransferalicencegrantedto

himbytheCentralBanktoanotherperson.

(2) A person who contravenes sub-regulation(1)commitsanoffenceandshallbeliableuponconvictiontoapenaltyoffivehundredthousandshillings.


PART III- OPERATIONS OF BUREAUS

Activities of the Bureau15. (1) A Bureau licensed under these Regulations

shallengageinthefollowingactivities-

(a) obtainandreceivecustomerinformation;(b) store, manage, evaluate, update and

disseminate the customer informationto subscribers in accordance with theseRegulations;

(c) compile and maintain database andgeneratereportsfromcustomerinformationdatabase;and

(d) develop a credit score for every person whose credit information has been submitted to a Bureau;

(2) A Bureau licensed under these Regulationsmay engage in the following additionalactivities—

(a) selltoinstitutionsspecializedliteratureandother information material related to itsactivities;

(b) carryoutonitsownorwithanotherpersonas may be approved by the Central Bank,market and statistical research relating tomatterssetoutundertheseRegulations;

(c) conduct Know Your Customer (KYC) duediligenceonbehalfofanotherpersonand

(d) carry out any other activity as may beapprovedbytheCentralBankfromtimetotimeinaccordancewiththeAct.

(3)ABureaushallnotengage inactivitiesotherthan those specified in these Regulations or asapprovedbytheCentralBankinaccordancewiththeAct.

(4) Where a Bureau fails to comply with sub-regulation (3) it shall be liable to pay a penaltyof five hundred thousand shillings and in thecaseofcontinuedfailure, itshallbe liabletoanadditional penalty of ten thousand shillings foreachdayonwhichsuchfailurecontinues.

Use of agents16. (1) A Bureau may contract an agent for the

followingpurposes—

(a) delivery of credit reports to requestingpersonsasmaybeauthorisedunder theseRegulations;

(b) public sensitization of customers,institutions, and other credit informationproviders;

(c) receivingandchannelingcomplaints;(d) otherpurposesasmaybeapprovedbythe

CentralBankuponapplicationbyaBureau.

(2) ABureau shallnot contractanagentunlessthe proposed agent has been approved by theCentral Bank.

(3) Anapplicationforapprovalofanagentshallbe accompanied by a report on the suitabilityassessmentof theproposedagent, theservicesto be rendered by the proposed agent andapplicationfeessetoutintheFourthSchedule.

(4) A Bureau shall, at least twomonths beforetheendofthecurrentyear,applytotheCentralBankfortherenewalofapprovalofitsagentsandshallsubmittotheCentralBankalistofitsagentswhose approvals should be renewed togetherwith annual renewal fees for each agent as setoutintheFourthSchedule.

(5)Apersonisnotqualifiedtobeappointedasanagentifthatperson-

(a) isaminororisofunsoundmind;(b) hasbeenconvictedof anoffence involving

theft,fraud,forgery,causingfinanciallossorperjury;

(c) hasnotbeenvettedinsuchmannerasmaybeprescribed;

(d) hasbeenremovedfromanofficeonaccountofmisconduct,abuseofoffice,corruptionorincompetenceintheprecedingtenyears;or

(e) forsuchotherreasonsasmaybeprescribedintheGuidelines.


(6) A Bureau shall ensure that no agent hasunlimitedaccesstothecreditinformationinthedatabase of the Bureau and shall only permitaccess in respect of a customer whose creditinformationhasbeenrequestedoristhesubjectofalawfultransactionundertheseRegulations.

(7) A Bureau shall carry out a suitabilityassessment on the capability of an agent andshallsatisfyitselfastothe—

(a) existenceofadequate infrastructure for thecollection of information and delivery ofcreditreports;

(b) ability of the agent to keep customerinformationconfidential;and

(c) abilitytoconductproperandsufficientduediligence and identity verification on anypersonrequestingforcreditinformation.

(8) An agent shall be contracted on a non-exclusivebasis.

(9)TheCentralBankmayprescribeguidelinesforthecontractingandoperationsofagents.

Actions requiring prior approval of Central Bank17. (1) A Bureau shall seek and obtain prior written

approval of the Central Bank for the followingactivities-

(a) appointmentofdirectorsandofficersoftheBureau;

(b) acquisition of ten per cent or more of theshares of a Bureau by any person exceptasmaybeprovidedotherwiseunder theseRegulations;

(c) opening, relocation or closure of a placeof business in or outside Kenya and shallnotify theCentral Bank threemonths priortopermanentlyclosingitsplaceofbusiness.Temporaryclosuresshallbenotified to theCentralBankwithinsevendayspriortothedate of closure or on such short notice asthe circumstances of the case may rendernecessary;

(d) appointmentofagents;(e) changesinthememorandumandarticlesof

association;

(f) passing of a shareholders resolution tovoluntarilywinduptheBureau;

(g) introductionofnewproductsorservices;(h) feespayablebycustomers;and

(i) arrangementoragreement—(i) for the sale, transferordisposalof the

shares or business of the Bureau; ora merger, amalgamation, acquisition,takeoverorassignment;or

(ii) affectingthevotingpower,managementorothermatterswhichmay result inachange in the control ormanagementoftheBureau.

Nature of information to be shared18. (1)Customerinformationwhichshallbeshared

or exchanged pursuant to these Regulationsshall include both positive and negative creditinformationandmayincludedetailsspecifiedinsub-regulation(2).

(2) The nature of customer information to beshared pursuant to sub regulation (1) shallinclude-

(a) thecustomer’sidentity,including-(i) in the case of a natural person his

name, date of birth, national identitycard number, personal identificationnumber, passport number, drivinglicence number, past and currentaddressesandothercontactdetailsandrelatedmatters;

(ii) in the case of a customer who isnot a natural person, the entity’sname, registration number, personalidentification number, names ofdirectors, shareholders holding morethan ten per cent of its shares orpartners, trustees or officials, past andcurrent addresses and other contactdetailsandrelatedmatters;

(b) the customer’s credit status including thenature and amounts of loans or advancesandothercredit facilitiesgranted,amountsoutstanding thereof, credit applicationandrelatedmatters;


(c) the nature and details of security orsecurities taken or proposed to be takenby an institution as security for the loans,advancesandothercreditfacilities;

(d) details of payment of credit facilities ordefault in payment by the customer, debtrestructuring and actions taken by theinstitution to recover unpaid amountsincluding realization of securities, legalproceedingsandrelatedmatters;

(e) identitydetailsoftheshareholders,directors,partnersorofficialsofacorporateentityorunincorporated entity which has defaultedinrepayingitscreditfacility.

(3) A Bureau shall include a customer’s creditscoreineverycreditreport.

(4)Customerinformationshallbefurnishedusinga standard format established by agreementof the institutions furnishing information andlicenced Bureaus, or otherwise issued by theCentral Bank.

(5) Aninstitutionorthirdpartycreditinformationprovider submitting credit information toa Bureau shall at all times ensure that theinformationiscompleteandaccurate.

(6) Aninstitutionorthirdpartycreditinformationproviderwhichsubmitsincompleteorinaccurateinformation to a Bureau shall be liable to suchpenaltyastheCentralBankmayimpose.

Identification details19. Creditinformationofapersonshallbesubmitted

toBureauswithallsuchidentificationdetailsaswouldenableaBureautolinkacustomertoallitstransactionswithanyotherperson.

Protection from liability20. (1)Asuit,prosecutionorotherlegalproceedings

shall not lie against the Central Bank, Bureau,an institutionor chairperson, director,member,auditor, adviser, officer or other employee oragentofsuchBureauor institutionoranyotherperson authorised under these Regulations tosubmit, receive,useorsharecredit information,

forany lossordamagecausedor is likely tobecaused by anything which is done or intendedto be done in good faith in pursuance of theseRegulationsorguidelinesissuedhereunder.

(2)Nothingcontainedinsub-regulation(1)shallaffect the right of any person to make a claimagainst a Bureau, an institution or chairperson,director, member, auditor, adviser, officer orother employee or agent of such Bureau orinstitution,asthecasemaybe,inrespectoflossordamagecausedtohimonaccountofanysuchdisclosuremadeby anyoneof themandwhichis unauthorised or fraudulent or contrary toprovisionsoftheseRegulations,guidelinesoranyotherlawtowhichtheseRegulationsrelate.

(3) A personwhohas beenmade liable for theacts or omissions of another person may seekindemnityfromthepersonwhowasatfault.

Prohibited information21. (1)ABureaushallnotincludeinitsdatabaseora

creditreportpersonalinformationofacustomerrelating to race, belief, colour, ethnic origin,religion, political affiliation, sexual orientation,physicalandmentalhandicaps,stateofhealthormedicalinformation.

(2) Despite sub regulation (1), any informationrelating to Sharia compliant products shall notbeconsideredtocontravenethisRegulation.

Form of consent22. (1)Wheretheconsentofacustomerisrequired

under these Regulations for the submission orsharingofcreditinformation,suchconsentmaybeobtainedbythecustomersigninganydocumentgiving express consent or authorisation for thesharingofcreditinformation.

(2) The documents under sub-regulation (1)may include,accountopeningdocuments, loanapplicationforms,loanagreementsoranyotheragreement document between an institutionandacustomeroracustomerandathirdpartycredit information provider or by any otherdocumentary means as may be convenient oragreeabletotheparties.


(3) A customer may give consent throughoral, print or electronic means, subject to thesatisfactionoftheBureauorinstitutionastotheauthenticityoftheelectronicconsent.

Conditions and form of disclosure to customers23. (1) A Bureau or agent shall before making a

disclosurerequireacustomertoidentifyhimself.

(2)AdisclosurebyaBureauoragentmaybemadein writing, in person, during normal businesshours, andon reasonablenotice, by telephone,e-mailorbyotherelectronicmeans, ifavailabletotheBureauoragent,astherequestingpersonmaychoose.

(3) The customer may be permitted to beaccompaniedbyoneotherpersonofhischoice,whoshallfurnishreasonableidentificationbeforeheisallowedontheinstructionsofthecustomertohaveaccesstothecustomerinformation.

(4)ABureauoragentshallrequirethecustomerto furnish a written or oral authority grantingpermissiontotheBureauoragenttodiscussthecustomer’sinformationwheneverathirdpartyispresentandwhere the thirdparty is authorisedtoactonbehalfofthecustomerinrespectofthecustomer’sinformation.

(5) A Bureau shall provide trained personnelto explain to the customer any informationfurnished to him where such explanation isneededbythecustomer.

Other sources of information24. (1) A Bureau may, with the approval of the

Central Bank, collect, receive, collate, compileand disseminate information relating to acustomer which is obtained from a third partyor isordinarilyavailabletothepublic, includinginformationfromthefollowingpublicsources—

(a) companiesregistry;(b) registrarofbusinessentities;(c) businessandtradelicensingauthorities;(d) landregistries;(e) taxauthorities;(f) countygovernmententities;

(g) court registries in respect of informationon judgments on debts, insolvency orbankruptcy proceedings or winding uporders;

(h) registrarofnames;(i) registrarofpersons;(j) otherrelevantpublicbodies.

(2)Anapplicationfortheapprovalofathirdpartycreditinformationprovidershallbeaccompaniedwith application fees set out in the FourthSchedule togetherwitha suitabilityassessmentreport detailing the information set out in sub-regulation(4)ofthisRegulation.

(3) A government agency, public entities andother credit information providers may enterinto contractswithBureaus for theprovisionofinformationandsuchcontractshallspecify—

(a) the conditions for the provision ofinformation;

(b) the obligation to furnish accurate andupdatedinformation;

(c) the obligation to promptly correct anyinformationsubmittedtotheBureauwhichhas been established to be inaccurate,overtaken by events, false, misleading orerroneousinanyform;

(d) detailsondatatobeprovided;(e) the manner and acceptable form through

whichtheinformationmaybesubmittedtotheBureaus.

(4) A Bureau shall before engaging a thirdparty credit information provider carry out duediligenceandsuitabilityassessmentof thethirdparty credit information provider and shallestablish-

(a) the nature and character of its ownershipandmanagement;

(b) thenatureof itsbusinessandwhether it issubjecttoanylegalorregulatoryframework;

(c) the soundness of its informationmanagement system in relation togeneration, storage and transmission ofcustomerinformation;

(d) theaccuracyandintegrityofitsrecords;(e) thecredibilityofcreditinformationofevery

personitdealswith;


(f) whether its customers have willingly andconsciouslyconsentedtothesharingoftheircreditinformation;

(g) whetheritscustomersarefullyawareoftheterms and conditions of their relationshipswith the third party credit informationproviders especially on credit informationsharing;and

(h) suchothermatterastheCentralBankmayspecify.

(5)ABureaushallnotcontractathirdpartycreditinformationproviderwhosecustomer’sfinancialor credit information is occasionally based onestimates or is subject to assessment beforeascertainingthetrueamount.

(6)Athirdpartycreditinformationprovidershallnotfurnishanycreditinformationofacustomerto a Bureau or its agent except with the priorwrittenconsentofthecustomer.

(7) Where a third party credit informationproviderisapprovedbytheCentralBanktosharecreditinformationofitscustomerswithaBureau,the credit information shall be shared with alllicensed Bureaus and may be submitted to acentralhubwhereacentralhubisinuse.

(8) The Central Bank may, if it considers itnecessary,prohibitaBureaufromreceivingcreditinformationordisseminatingcredit informationfromany thirdpartycredit informationproviderorapublicsource.

(9)Athirdpartycreditinformationprovidershallbesubject tosuch industryCodeofConductasmaybeapprovedbytheCentralBank.

Use of public data by Bureaus25. (1)ABureaumayconsultpublicandnon-public

sources of information and include suchpublicinformation in any report issued under theseRegulationsprovidedthatbeforeincludingsuchinformation—

(a) the Bureau shall follow reasonableprocedures to obtain confirmation of theaccuracyandauthenticityoftheinformationfrom a source that has independent anddirectknowledgeoftheinformation;and

(b) the Bureau shall, where such informationrelates to any court proceeding of a civilor criminal nature or any public record,verify the accuracy and authenticity of theinformationnotmorethantwenty-onedaysbeforethedateonwhichtheinformationisincludedinanyreport.

(2) A Bureau shall periodically report to the

CentralBankthesourceanddetailsofthepublicdata included in its reports together with theprocessofverificationcarriedouttoauthenticatetheveracityandtruthfulnessofsuchdata.

(3) Where a Bureau has included in any reportinformation from public domain data, and theCentral Bank is satisfied that a Bureau did nottakeallreasonablemeasurestoverifytheveracity,authenticity,truthfulnessoraccuracyofthedata,theCentralBankshalldirecttheBureautodeletethe information from its database and may inaddition impose a penalty not exceeding fivehundredthousandshillingsforeachviolation.

Duty to provide accurate information26. (1) A credit information provider furnishing

negative information to a Bureau regardingcreditextended toacustomerorarising fromaproductorservicerenderedtoacustomershall,in writing or through electronic means, issueto thecustomeranoticeof intention to submitthe negative information within thirty daysbefore submitting of the negative informationtoaBureauorwithinsuchshorterperiodasthecontractbetweenthecreditinformationproviderandthecustomermayprovide.

(2) A credit information provider need not givea customer a pre-listing notice of his positiveinformation.

(3)Acreditinformationprovidershallnotfurnishany information relating to a customer to anyBureau if thecredit informationproviderknowsor has reasonable cause to believe that theinformationisinaccurate.

(4)Acreditinformationprovidershallnotfurnish


informationrelatingtoacustomertoanyBureauifthecreditinformationproviderhasbeennotifiedbythecustomer,attheaddressspecifiedbythecreditinformationproviderforsuchnotices,thatthespecificinformationisinaccurate.

(5) Despite sub-regulation (4), the creditinformation provider may submit the creditinformation to a Bureau once it has addressedthe customer’s concern on the inaccuracy ofthecredit informationeitherby re-affirming theaccuracy of the information to the customer orrectifyingtheinaccuracy.

(6) A notice issued under sub-regulation (4)shall explain the basis of the inaccuracy of theinformation and shall be in writing and wherethenoticeisoral,thecreditinformationprovidershallreduceitintowriting.

(7) Where the credit information provider hasbeen notified of any inaccuracy in the creditinformation and where there is reasonablecause to believe that the information may notbeaccurate,thecreditinformationprovidershallinformall theBureaustowhichthe informationhasalreadybeensubmittedofthisfactwithinfivedaysofthenotificationandshallwithinfourteendays carry out investigations and inform theBureausoftheoutcomeoftheinvestigation.

(8)Acreditinformationproviderhasadutyto-

(a) correct any inaccurate or erroneousinformation when the fact of inaccurateor erroneous information comes to theirknowledgeorattention;and

(b) inform the Bureaus within five days fromthe date of learning of the inaccurate orerroneous information and on receipt ofsuchinformationtheBureaushallupdateitsdatabasewithintwodaysofreceipt.

(9) A credit information provider who hasfurnished credit information to a Bureau shall,withinthirtydaysfromthedatetheinformationwas furnished to a Bureau, notify the customerthathiscreditinformationhasbeenforwardedtotheBureau.

(10) A credit information provider which intentionally,

recklessly or negligently submits inaccurateinformation to a Bureau or which does notadequately address customers’ complaints onthe inaccuracy of information submitted or tobe submitted to a Bureau shall be barred bytheCentralBankor theconcernedBureau fromsubmitting information to the Bureau or anyotherBureauasthecasemaybe.

Restrictions on the use of customer information27. (1) A Bureau shall protect the confidentiality of

customerinformationreceivedintermsoftheseRegulationsandshallonlyreportorreleasesuchcustomerinformation-

(a) tothecustomerconcerned;(b) totheCentralBank;(c) toarequestingsubscriber;(d) toathirdpartyasauthorizedbythecustomer

concerned;or(e) asrequiredbylaw.

(2)Exceptasisotherwiseprovidedforundersub-regulation(1),adirector,member,officerorotheremployeeoragentemployed inthebusinessofa Bureau or a subscriber shall not disclose anyinformation to any person and this obligationshall continue to apply even after terminationof tenure, employment or relationshipwith theBureauorsubscriber.

(3)Adirector,member,officerorotheremployeeoragentofaBureauorsubscriberwhounlawfullyorwithouttheauthorityoftheBureaudisclosesany credit information to an unauthorisedperson commits an offence and shall be liable,uponconviction, to imprisonment fora termoftwoyearsor toafineoffivehundred thousandshillings,ortoboth.

(4) The Central Bank may, instead of criminalprosecution under sub-regulation (3), imposesuch sanctions against the Bureau, subscriber,director, member, officer, other employee oragentastheCentralBankmaydeemfitincludingterminatingthetenureorservicesofthedirector,member,officer,otheremployeeoragentoftheBureau.


Responsibilities of a Bureau28. (1)ABureaushall—

(a) utilize the information collected solely forthepurposessetoutintheseRegulations;

(b) ensure that customer information in itsdatabase isprotectedagainstany lossandshallhaveinplacesufficientandtestedbackupanddisasterrecoverysites.

(c) take all such steps as are reasonablynecessary to ensure that the customerinformation maintained by it is dulyprotected against any unauthorizedaccess, use, modification or unauthorizeddisclosure;

(d) ensure that the customer informationmaintained by it is not charged orencumberedforanypurpose;

(e) ensure customer information is obtainedfrom reliable and credible sources whichtake responsibility for the accuracy,completeness and timeliness of theinformationthatisprovidedtoaBureau;

(f) observe,throughitsshareholders,directors,officers, employees or agents, a perpetualduty of confidentiality with regard to theinformation divulged to them in terms oftheseRegulations;

(g) acceptwithoutchargethefilingofcustomercredit information from the customerconcerned for thepurposeof correctingorchallenging information otherwise held bythatBureauconcerningthatcustomer;

(h) takereasonablestepstoverifytheaccuracyofanycustomercreditinformationreportedtoit;

(i) retain any customer credit informationreported to it for the prescribed period,irrespective of whether that informationreflects positively or negatively on theconsumer;

(j) maintain its records of customer creditinformation in a manner that satisfies theprescribedstandardsasprovidedforundertheseRegulations;

(k) promptly expunge from its records anyprescribedcustomercreditinformationthat,intermsoftheRegulations,isnotpermittedtobeenteredinitsrecordsorisrequiredtoberemovedfromitsrecords;

(l) issue a report to any person who requiresit for a prescribed purpose or a purposecontemplated in these Regulations, uponpayment of the Bureau’s fee except wherethe Regulation provides that no fee becharged;

(m)not knowingly, recklessly or negligentlyprovide a report to any person containinginaccurateinformation;

(n) maintain a complaints resolutionmechanism including having in place adisputeresolutionunittohandlequeriesorcomplaintsandadedicated telephone lineforcontactpurposes;

(o) include in every report issued the nameof the institution or third party creditinformationproviderwhichhassubmittedanegativecreditinformationonanyperson;

(p) maintainadatabasewhichcanbesearchedusing either a natural person’s nationalidentity card number, passport numberor Personal Identification Number andin the case of a corporate entity or anyother unincorporated entity, the PersonalIdentification Number of the entity andthe identity card numbers and PersonalIdentification Numbers of their respectivedirectorsorofficials,asthecasemaybe;

(q) not keep in its database, customerinformation which ought not to be in thedatabase;

(r) notdeleteorremovefromitsdatabaseanycreditinformationwhichoughttoremaininitsdatabase;

(s) not issue a credit report that erroneouslyrepresentsthestatusofcreditinformationofacustomer;and

(t) analyzeinformationsubmittedtoitandshallestablishanyexistingrelationshipsbetweencorporate entities, unincorporated entitiesand natural persons whose data has beensubmittedtoaBureau.


(2) ABureaushallonlyreleasecustomerinformationtoasubscriber-

(a) thatrequirescustomerinformationto—(i) evaluate a customer’s application

for credit or other customer-initiatedbusinesstransaction;

(ii) for the recoveryofanysumdueto theinstitution;

(iii) for customer account management,fraud detection and prevention,credit rating, employment evaluation,tracing owners of unclaimed assets,development of a scoring system,assessment of a debtor’s books ofbusiness;and

(iv) for other purposes that may beapprovedbytheCentralBank;

(b) thathascertifiedtotheBureauthatitwillusethecustomerinformationforthepurposeofmaking a lawful or permitteddecision andfornootherpurpose;and

(c) that has agreed to properly dispose ofcustomer information so that it cannotreasonablybereadorreconstructed.

(3)ABureauwhichfailsorrefusestocomplywithanyprovisionofthisRegulationshallbeliabletoapenaltyoffivehundredthousandshillings.

Key facts document on the right to obtain and dispute credit report29. (1) A Bureau shall prepare a summary of the

rightsofcustomers.

(2) The summary of the rights prepared undersub-regulation(1)shallincludeadescriptionof:-

(a) therightofacustomertoobtainafreecopyofacreditreportfromeachBureau;

(b) the frequency and circumstances underwhich a customer is entitled to receive acreditreportwithorwithoutcharge;

(c) therightofacustomertodisputeinformationinthefileofthecustomer;

(d) the right of a customer to obtain a creditscore from a Bureau, and a description ofhowthecreditscorewasarrivedat;

(e) the method by which a customer cancontact, and obtain a credit report from, aBureauwithoutcharge;and

(f) therightofacustomertoreferadisputetoanalternativedisputeresolutionmechanism,acourt of law or the Central Bankwhere hefeelsthathisdisputehasnotbeenresolvedtohissatisfaction.

(3)ABureaumaypublishanyotherinformationwhichmaybeusefultocustomers.

(4)ABureaushall–

(a) publicizetheavailabilityofthesummaryofrights;

(b) conspicuously post on its website and itsbusiness premises the summary of rights;and

(c) make such summary of rights available tocustomers,onrequestorastheBureaumayfindnecessarytobringtotheattentionofasmanycustomersaspossible.

Subscriber’s obligations in respect of information obtained from Bureaus30. (1) A subscriber of information from a Bureau

shall not use such information for any purposeotherthanforreachingdecisionsontransactionsconcerning a customer and on mattersconcerninganemployeeorapotentialemployeeofthesubscriberorforanyotherpurposeasmaybeauthorisedundertheseRegulations.

(2)Asubscribershallnotreleasesuchinformationto any third party except as may be requiredunder any law or to a subscriber’s appointedagentforthepurposeofassistingthesubscriberintherecoveryofanyofitsdebts.

(3) A subscriber shall ensure that it does notmake an enquiry requesting for a credit reportfromaBureauunlesssuchenquiryismadeforaspecifiedpurposeandinrespectofapersonwhois—

(a) acustomerorhasappliedforcreditfacilitiesfromsuchsubscriber;or

(b) anemployeeoranapplicantforemploymentbythesubscriber.


4) A subscriber shall ensure that all necessaryprecautions are taken to ensure that allinformationprovidedtoitbyaBureauis—

(a) properly and accurately recorded andmaintained;

(b) protectedagainstloss;and(c) protectedagainstunauthorisedaccess,use,

modificationordisclosure.

(5) A subscriber shall take measures, includingthe following, to safeguard the security ofinformationprovidedtoitbyaBureauorbyittoaBureauthrough—

(a) establishmentofcontrolsandprocedurestobeappliedwhenaccessissoughttoobtaina credit report to ensure that there are nounauthorisedrequestsforsuchreports;

(b) keepingaudittrailsof informationsuppliedbyittoabureauorreceivedfromaBureau;

(c) review, on a regular basis, password andothercontrolsoverallpersonnelauthorizedto access the database of informationprovidedto itbyaBureausoastopreventunauthorisedaccessoruse.

(6)Asubscribershallensurethatnoinformationis requested fromaBureauor if receivedbythesubscriberfromaBureauisusedbyoronbehalfof the subscriber formarketing, datamining orsimilarpurposes.

(7) Any subscriber which fails or refuses tocomplywithanyprovisionofthisRegulationshallbe liable to penalty of five hundred thousandshillings.

Receipt of credit reports by third parties31. (1)Acustomermay,inwriting,authoriseorgive

consenttoathirdpartytoobtaindirectlyfromaBureau,acreditreportinrespectofthatcustomerforpurposesof—

(a) assessmentofcreditfacility;(b) employment;(c) underwritinginsurance;

(d) determination of the customer’s eligibilityfor a licence or benefit granted by theGovernment;

(e) assessmentofthecreditorprepaymentrisksassociatedwithanexistingcreditobligation;or

(f) legitimate need for information, inconnection with business transactioninitiated by the customer or other lawfultransaction or matter concerning thecustomer;

(2) A Bureau shall verify the authenticity of thewritten consent of the customer and may usesuchverificationmeansas theBureaumayfindappropriateandreliable.

Fees32. (1)ABureaumay,withtheapprovaloftheCentral

Bankchargefeesfortheservicesitprovides.

(2)EveryBureauseekingto increase itschargesortointroduceanewchargeorfeeonaproductorserviceshallseekpriorapprovaloftheCentralBank.

(3) An application made under sub-regulation(2)shallstatereasonswhytheincreaseofchargeor fees or the imposition of new charges orfees is necessary, its impact on consumers andcomparativeratesinthemarket.

(4)Abureaushallpublishitschargesandfeesinaconspicuousplacewithinitsbusinesspremisesandonitswebsite.

Data management and quality control33. (1)ABureaushall-

(a) implement quality control procedures inorder to ensure the maximum possibleaccuracyof itsdatabaseandthecontinuityofitsservices;

(b) take all such steps as are reasonablynecessary to ensure that customerinformation maintained by it is current,authentic, legitimate, reliable, accurate,truthful and that it reflects the existingsituationofthesubjectatanygiventimeandif the information is foundtobe inaccurate


ornolongervalid,theBureaushallpromptlytake the corrective measures necessary toremedythedeficiencies;

(c) ensure that its services are reasonablyavailableandaccessible;

(d) develop mechanisms for easy request forandaccessibilityofcreditreportsinphysicalor electronic formor any other convenientand cost effective way and may includefax, telephone, mail, e-mail, internet or inperson;

(e) establish controls and procedures to beapplied when subscribers seek access tocreditreports;

(f) maintain logsofallaccesses,amendmentsand audit trails to information databaseincludingpreviousenquiryrecordsandlogsofallincidentsinvolvingprovenorsuspectedbreachofsecurity;

(g) review,onaregularbasis,passwordcontrolsofallBureaupersonnelandsubscribers;

(h) develop operational guidelines andprocedures to be applied in relation toimproperuseofaccessauthoritiesbyBureaupersonnel,authorisedagentsorsubscribersorpersonsauthorisedbythem;and

(i) develop operational guidelines to ensureadequate protection to minimise the riskof unauthorizedentry into thedatabaseorinterception of communications made toandfromthedatabase.

(2)ABureauwhichfailsorrefusestocomplywithanyprovisionofthisRegulationshallbeliabletopenaltyoffivehundredthousandshillings.

Updating and maintaining information34. (1)ABureaushallretaincustomerinformationon

nonperformingloans—

(a) until the expiryof four years from thedateoffinalsettlementoftheamountindefaultincludingsettlementoftheamountspayablepursuant toa schemeofarrangementwiththeinstitution;or

(b) upontheexpiryofsevenyearsfromthedateof theperson’s discharge frombankruptcy,as notified to the Bureau by such personand evidenced by the relevant certificate

ofdischargeissuedbytheHighCourtorbya written notice from the Official Receiverstating that the Official Receiver has noobjectiontoacertificateofdischargebeingissued to the person, irrespective of anywrite-offbytheinstitutionoftheamountindefaultinfullorinpartatanytime.

(2)Anyotherinformationnotcoveredundersub-regulation (1)may be retained for a period notexceedingfiveyearsfromthedateofsubmissionof the informationor receiptof the informationbyaBureau.

(3) A Bureau shall implement procedures thatensure that the information registered in itsdatabaseisregularlyupdated.

(4)Aninstitutionorathirdpartycreditinformationprovider that furnishescustomer information toaBureaushall,onadailybasisupdatecustomerinformationwheneveranupdateisnecessary.

(5) A Bureau shall update its database as andwheninformationisprovidedbytheinstitutionsresponsible for the timely updating of theinformation submitted to the Bureau and theinformation shall be updated on an on-goingbasis, or as often as necessary, in accordancewith the nature of the information and in anyeventwithintwodaysfromdateofreceiptofnewinformation.

(6) A Bureau or institution which violates anyprovision of this Regulation, shall be liable toa penalty of five hundred thousand shillings inaddition to any other penalty that the CentralBankmayimpose.

Security and control measures35. (1)ABureaushalltakethenecessarysecurityand

controlmeasuresinordertoavoidunauthorizedaccess to, improper use or mismanagement ofinformation.

(2) For the purposes of sub-regulation (1),improperuseormismanagementofinformationmeans any act or omission not authorized bytheseRegulations.


(3)ABureaushall recordandmakeavailabletothecustomerthenameanddateeachsubscriberobtains access to customer information aboutthecustomer.

(4)ABureaushall—

(a) develop written policies and proceduresto be followed by its officers, employees,agentsandcontractors,oranyotherpersonprovidingservicestoit;

(b) imposeaccessauthenticationcontrolssuchastheuseofpasswords,digitalsignaturesorothermechanismsasmaybenecessaryforsecuritycontrols;

(c) provide information and training to itsemployees to ensure compliance with thepolicies,proceduresandcontrols;

(d) systematically review the effectiveness ofthe policies, procedures and controls andpromptlyremedyanydeficiencies;and

(e) maintainanaccesslog.

Customers’ rights of access and correction36. (1) A customer has a right to know what

informationtheinstitutionhassubmittedtotheBureauregardingthatcustomer.

(2)AcustomershallbeentitledtoaccesscreditreportsrelatingtothecustomerthatarekeptinadatabaseadministeredbyaBureau.

(3)AcustomershallbeentitledtoafreecopyofhiscreditreportfromeachBureau,oritsagents,inthefollowinginstances;

(a) atleastonceperyear;(b) within thirty days of receiving an adverse

actionnoticeissuedunderregulation50(iii);and

(c) oncepersixmonthsaftermakingarequesttoaBureautohave inaccurate informationcorrectedinthedatabase.

(4) Where a customer requests a Bureau for acredit reportpursuant to sub-regulation (2), theBureaushall,withinfiveworkingdaysofreceivinga request inwritingand suchparticulars as theBureau may reasonably require to enable itidentifythecustomer,providetothecustomeracopyofallcustomer information relating to thecustomerheldbytheBureau.

(5) Where the customer believes that theinformation contained in the database isinaccurate,erroneousoroutdated,thecustomermaynotifytheBureauinwritingoftheinformationdisputed.

(6) Within five working days of being informedthattheinformationinacustomer’screditreportisdisputed,theBureaushall–

(a) attachanotetothecreditinformationreport,warning that the disputed information isunder investigation, which notice shallremain on the file until resolution of thedispute;and

(b) give the institution or credit informationprovider that supplied the information anotice of dispute requesting confirmationfrom the institution or credit informationprovider as to the accuracy of theinformation.

(7) The Bureau shall, within fourteen days,conduct investigation, based on the relevantinformation provided by the customer, andmay contact any person who has furnishedinformation.

(8) Where an institution or credit informationprovider receives a notice of dispute from theBureauitshall,withinfourteendaysofreceivingthenotice,completeallnecessaryinvestigationsintothedisputedinformationandgivetheBureaua notice of resolution, advising whether thedisputedinformationistobedeleted,corrected,orremainunchanged.

(9)Where the investigation revealsanerror, theBureau shall remedy the error and inform allpersonswhomaybeaffectedbytheinformationincludingthecustomer.

(10) If the Bureau does not complete itsinvestigation within twenty-one days, it shalldeletethedisputedinformationasrequestedbythecustomer.

(11)IftheBureaulatercompletesitsinvestigation,itmayreinsertorrevisethedisputedinformationbased on the results of such investigation andshallinformthecustomeroftheactiontaken.


(12) Upon receipt of a notice of resolution oran amendment notice from an institution theBureau shall, within five working days of suchreceipt,sendanoticeofchangetoanysubscriberthathasintheprevioustwelvemonthsobtaineda credit information report from the Bureaucontainingtheincorrectinformation.

(13) Where the customer disagrees with theresolution of the disputed information, thecustomer may request the Bureau to attach astatementofnotmorethanonehundredwordsto the customer’s credit report, setting out thecustomer’s claim that the information is notaccurate and the Bureau shall take reasonablestepstocomplywiththecustomer’srequest.

(14) ABureaumaycharge thecustomer for thecostofitsservicesinconductinganinvestigationof disputed customer information where theinformationdisputedbythecustomerturnsouttobefalse.

(15) A customer who is dissatisfied with aresolutionofadisputedcredit informationmayrefer the dispute to the Central Bank, withoutprejudicetohisrighttopursueanyotheravailableremedy.

Access to own information37. Aninstitutionorathirdpartycredit information

providershallhaveaccesstoitsowninformationsubmittedtoBureausandaBureaumayavailtheinformationtoaninstitutionorthirdpartycreditinformation upon request and only if it can beextractedfromthedatabaseinitsoriginalformorcontent.

Credit scores38. (1)EveryBureaushalldevelopacreditscorefor

everypersonwhosecreditinformationhasbeensubmittedtoit.

(2) A credit score may be computed in suchmannerandmayhavesuchdetailsastheCentralBankmayprescribeinguidelines.

(3)Everycreditreportshallcontainacreditscoreofthepersontowhomthereportrelates.

(4)ABureaushallkeep forat leastsevenyears,pastcreditscoresofanyperson.

Use of credit scores39. (1) For the avoidance of doubt, a customer’s

credit score shall not be used solely to denythe customera loan, credit facilityor anyotherfinancialservicebutshallbeusedasoneofthefactorstoinformthedecisionmakingprocess.

(2) An institution shall consider a customer’scredit score in appraising a customer’s creditapplication and in pricing a credit facility to acustomer.

(3)Thecreditappraisalintegratingacustomer’scredit score shallbedocumentedandprovidedto the customer as part of its feedback on thecustomer’screditapplication.

(4) Where a customer’s credit application isdeclined,aninstitutionshallimmediatelyandinwritingfurnishthecustomerwithfullreasonsonwhichthedecisionwasbased.

(5)Anyinstitutionthatdeniesacustomeracreditfacility or any other financial service solely onthebasisofacreditscoreshallbeliabletosuchpenaltyastheCentralBankmaydetermine.


PART IV – CROSS-BORDER CREDIT INFORMATION SHARING

Authority to share cross-border credit information40. (1) Thefollowingpersonsmaysharecross-border

creditinformationofanotherperson-

(a) regulators or supervisory authoritiesand credit reference bureaus or entitiesperformingsimilarroles;

(b) institutionsandcreditreferencebureausorentitiesperformingsimilarroles;

(c) institutionsandcreditreferencebureausorentitiesperformingsimilarroles;

(d) institutions:

(2) The sharing of information under sub-regulation (1) shall only apply where there is areciprocalarrangement.

(3) Whereanauthorizedpersonseekstoobtaincredit information of a person from anotherauthorized person located in another country,thefollowingrequirementsshallapply:

(a) The request shall be made in writing andshallsetout:

(i) Thefullidentitydetailsoftherequestingperson includingdetailsof itsprincipalplaceofbusiness;

(ii) Thenatureofitsbusinessorfunctions;

(iii) Theidentitydetailsofthepersonwhoseinformationissought;

(iv) Thenatureofcreditinformationsought;

(v) Thepurpose forwhich the informationsoughtwillbeusedandhowitwillassistindischarginga function,performingadutyorrenderingaservice;

(vi) Documentaryevidenceinamatterthatwould require the credit informationsought;

(vii) The grounds on which the requestingperson reasonably believes that thecreditinformationisinpossessionoftheotherperson.

(viii)Evidence establishing that the legalframework of the country in whichthe requesting person is locatedpermits cross-border sharing of creditinformation;

(ix) An irrevocable undertaking that theinformation will be used solely forthe stated purpose and shall be keptconfidential at all times even after theinformationhasbeenused.

(b) Upon receipt of the request, the receivingperson shall analyse the request and shallestablish that the request fully meets therequirementsoftheseRegulationsandmayrequest for additional information if needbe.

(c) Where the credit information sought is inthepossessionoftherequestedperson,theperson may furnish the requesting personwiththeinformation.

(d) Where the information sought is not inthe possession of the requested person orwhere the information is in the possessionof another person or for any reason therequestedpersondoesnotwishtosharetheinformationwiththerequestingperson,therequestedpersonshallnotifytherequestingpersoninwriting,ofitsdecision.

(4) Any person who violates any provision of thisRegulationshallcommitanoffenceshallbeliableuponprosecutiontoafineoftenmillionshillingsinaddition tosuchotherpenaltyas theCentralBankmayimpose.

Establishment of places of business outside Kenya41. A Bureau licensed in Kenya may establish,

with the prior approval of the Central Bank, asubsidiary, branch, agency ormarketing unit inanothercountryforpurposesofitscross-bordercreditbureaubusiness.


PART V - GOVERNANCE AND MANAGEMENT OF BUREAUS

Management and composition of a Bureau42. (1)ThemanagementofaBureaushallvestona

Board consisting of not less than five directors,two thirds of whom shall be non-executivedirectors.

(2) A person is qualified for appointment as adirector,ifthatpersonis-

(a) approved by the Central Bank for thatpurpose;and

(b) is not disqualified from holding office assuchundertheseRegulations.

(3)Thedirectorsappointedundersub-regulation(1),shallelectanon-executivechairpersonfromamongsttheirmembers.

(4) Thefunctionsoftheboardshallbeto—

(a) establish the operations and informationtechnologysystemsoftheBureau;

(b) ensure that the activities conducted by aBureauconformwiththeseRegulationsandguidelines;

(c) facilitate the appointment of a ChiefExecutive Officer and Chief InformationTechnologyOfficer;

(d) ensure that the Bureau maintains, atall times, an effective system of internalcontrols;

(e) ensurethattheBureaumaintainsacustomercomplaints and inquiry service section toattendtocustomerswhomaybeaffectedbythe information contained in the databaseandwhoallegethattheinformationisillegal,inaccurate,erroneousoroutdated;

(f) ensurethattheBureauhasadequatestafftoundertakethefunctionsoftheBureauandtomeetitscustomers’demands;

(g) ensure that the credit reports and creditscores generatedby aBureauare accurateandnotmisleading;and

(h) protect the integrity and confidentiality ofdatakeptbyaBureau.

(5)TheBoardshallholditsmeetingsatleastona quarterly basis butmay hold such additionalmeetingsascircumstancesmayrendernecessary.

(6) A quorum for a meeting of the Board shallbe three members and where the number ofdirectors ismorethanfive, thequorumshallbeatleastfiftypercentofalldirectorsoftheBureauand the decisions of the board shall be by amajorityvote

(7) A director shall attend at least seventy-fivepercentoftheboardmeetingsprescribedinsub-regulation(5).

(8) A board may hold some of its meetingsvia video conference but at least seventy fivepercent of the quarterlymeetings referred to insub-regulation(5)shallbeheldphysicallyinonelocation.

(9)TheCentralBankmayprescribeguidelinesonhowboardmeetingsamybearrangedandheldviavideoconferencing.

Capital43. (1) ABureaushallatalltimesmaintainsufficient

capital toenable it run itsoperationsefficientlyandsoundly.

(2) A Bureau shall on a quarterly basis submitto the Central Bank information on its capitaladequacystatus.

(3) Where a Bureau is facing capital adequacychallenges, the Central Bank may require theBureauto:

(a) Submitacapitalrestorationplan;

(b) Restrictitsactivities;or

(c) Take such other action or to refrain fromsuchactionastheCentralBankmayspecify.


Qualification for appointment as director44. (1) Apersonisqualifiedtoholdofficeasadirector

ifthatperson—

(a) is approved by the Central Bank for thatpurpose;and

(b) is not disqualified from holding office assuchunderthisAct.

(2) In determining the suitability of a person tobecomeadirectorofaBureau,theCentralBankmayconsider-

(a) his possession of adequate professionalcredentials or experience or both for thepositionforwhichheisproposed;

(b) his ability to recommend sound practicesgleanedfromothersituations;

(c) hisabilitytoprovidedispassionateadvice;(d) his ability to avoid conflicts of interest in

his activities and commitments with otherorganizations;

(e) his ability to safeguard confidentialinformation;

(f) hisability toabsenthimself fromdecisionswhenheisincapableofprovidingobjectiveadvice;and

(g) anyothermaterialinformationwhichintheopinionoftheCentralBankhasabearingonthesuitabilityoftheperson.

(3) A person is not qualified to hold office as adirectorifthatperson—

(a) hasbeenconvictedofanoffenceundertheAct;

(b) has been convicted of a criminal offenceand sentenced to imprisonment for a termexceedingsixmonthsortoafineexceedingfiftythousandshillings;

(c) hasbeenconvictedof anoffence involvingdishonestyorfraud,oranoffenceundertheAnti-Corruption and Economic Crimes Act,2003;

(d) is adjudged bankrupt or enters into acomposition scheme or arrangement withhisorhercreditors;

(e) has contravened the provisions of any lawdesigned for the protection of membersof the public against financial loss dueto the dishonesty or incompetence of ormalpractices by persons engaged in theprovisionofbanking,insurance,investment,capital markets, pensions or retirementbenefits,orotherfinancialservices;

(f) hasbeenadirectorof,ordirectlyconcernedinthemanagementof,anyinstitutionwhichis being or has been wound up or placedunderstatutorymanagementbyacourt;

(g) has defaulted in the repayment of anyadvanceorloanmadetohimorherbyanyinstitutionlicensedundertheAct;

(h) isaminororisofunsoundmind;or

(i) is an auditor of the Bureau licensed undertheseRegulationsorassociatedcompanies.

Disqualification of officers and employees45. (1) A Bureau shall ensure that a person shall

not be an officer or an employee of a Bureau,or, if already in office or employment, shall bedisqualified and shall not be eligible to holdofficeorbeintheemploymentofanyBureauforaperiodoftenyears,ifsuchpersonis-

(a) an undischarged bankrupt or enters into acompositionorschemeofarrangementwithhiscreditors;

(b) convicted of an offence involving fraud ordishonesty;or

(c) removedfromofficeundertheprovisionsoftheseRegulations.

(2)WhereaBureauallowsadisqualifiedpersonto continue acting as an officer or being inemployment, or is otherwise in breach of thisregulation, it shall be liable to a penalty of fivehundredthousandshillingsandthedisqualifiedperson acting as an officer or employee shallbeliabletopayafineofonehundredthousandshillings.


Suitability test46. (1) The Central Bank shall, where it is satisfied

as to theprofessionalandmoral suitabilityofasignificantshareholder,directororseniorofficeroftheBureau,certifythepersonasfitandpropertobeasignificantshareholder,directororseniorofficer.

(2) While determining, for the purposes ofthis Regulation, the professional and moralsuitability of a significant shareholder, directoror senior officer of a Bureau the Central Bankshallconsiderthefollowingqualities,insofarastheyarereasonablydeterminable,ofthepersonconcerned-

(a) hisintegrity;

(b) hiscompetenceandsoundnessofjudgmentfor the fulfilment of the responsibilities oftheofficeinquestion;and

(c) the diligence with which the personconcerned is likely to fulfil thoseresponsibilities.

(3) For the purposes of these Regulationsand without prejudice to the generality of theprovisionsofsub-regulation(2),theCentralBankmay have regard to the previous conduct andactivitiesofthepersonconcernedintheBureaubusiness,andinparticular,toanyevidencethatsuchperson-

(a) hasbeenconvictedofanoffenceoffraudoranyotheroffenceofwhichdishonestyisanelement;

(b) has contravened the provisions of any lawdesigned for the protection of membersof the public against financial loss dueto the dishonesty or incompetence of, ormalpractices by, persons engaged in theprovisionofbanking,insurance,investmentorotherfinancialservices;

(c) wasanofficerordirectorofaninstitutionthathasbeen liquidatedor isunder liquidationorstatutorymanagementundertherelevantlaw;

(d) has taken part in any business practicesthat in the opinion of the Central Bankwere fraudulent, prejudicial or otherwiseimproper,whetherunlawfulornotunlawfulorwhichotherwisediscreditedhismethodsofconductingbusiness;or

(e) has taken part in or been associated withany other business practices as would, orhas otherwise conducted himself in suchmannerastocastdoubtonhiscompetenceandsoundnessofjudgment.

(4)The Central Bank may request any personto furnish additional information, as may benecessary, in determining the professional ormoral suitabilityof thatpersonasprescribed intheseRegulationsorasdeemednecessary.


PART VI - DISSOLUTION AND LIQUIDATION

Dissolution and winding up of a Bureau47. A Bureau licensed under these Regulations

may be compulsorily or voluntarily liquidatedin accordance with the provisions of the lawsrelating to dissolution and winding up ofcompaniesinKenya.

Central Bank approval for voluntary liquidation48. (1) Where shareholders of a Bureau pass a

resolution to voluntarily wind up the Bureau,the Bureau shall apply to the Central Bank forapprovaltovoluntarilywinduptheBureau.

(2) A Bureau’s application to the Central Bankfor approval under sub-regulation (1) shall beaccompaniedbythefollowingdocuments—

(a) a copy of the minutes of the meeting ofshareholders which passed the resolutionforvoluntarydissolutionofthecompany;

(b) financial statements as of the date of theresolution, with a report from a credibleexternalauditor;

(c) aswornstatementfromtheChiefExecutiveOfficerconfirmingthattherearenoworkers’,corporate or tax obligations pending theresolutionand that thecompany isable tomeettheobligationsofallitscreditors;and

(d) names and curriculum vitae of the personproposedforappointmentasliquidator.

(3)WheretheCentralBankisfullysatisfiedwiththemerits of the application, the Central Bankmay grant approval for a voluntary liquidationon such terms and conditions as it may deemappropriate.

(4)Where theCentralBank isnot satisfiedwiththeapplication itmaygive suchdirectionsas itmaydeemappropriate.

Notification to the Central Bank49. Whereapetitionhasbeenlodgedforthewinding

up of a Bureau, the Bureau shall, within sevendays of such petition, notify the Central Bankof thepetitionandshall cease fromconductingBureaubusinessimmediatelyawindinguporderismade.

Forwarding of data to the Central Bank50. (1)WhereanoticehasbeengiventotheCentral

Bankunder Regulation 42 orwhere theCentralBank has given its approval for the voluntarydissolutionofaBureauunderregulation42,theBureaushallwithinsevendaysfromthedateofthe notice forward to the Central Bank in suchmanner as the Central Bank may direct, allrecords,documents,dataandotherinformationin its possession in relation to the Bureaubusiness.

(2) Upon satisfaction by the Central Bankthat all the records, documents, data or otherinformation in relation to the Bureau businesshavebeensubmittedtoit,theCentralBankshalldirecttheBureautoeraseallrecords,documents,dataandother informationin itsdatabaseor initspossessionandtheCentralBankshallinsuchmannerasitmaydeemfit,verifythattheerasurehasbeenfullycarriedout.

(3)TheCentralBankmaytakesuchmeasuresandgivesuchdirectionsasarenecessary toprotectthe information in possession of the Bureauor take over the information in possession of aBureauwhichisbeingwounduporliquidated.

Notification to institutions and Bureaus51. WhereaBureauiswoundupunderregulation40,

theCentralBankshall,bynotice in theGazette,notify all institutions and other Bureau of suchwindingup.


PART VII - POWER OF THE CENTRAL BANK

Powers of the Central Bank52. (1) The Central Bank shall have the powers to

regulate and supervise all Bureaus licensedundertheseRegulations.

(2)TheCentralBankshallhavethepowerto—

(a) issue,suspendorrevokealicencetoconductcreditreferencebureaubusiness;

(b) supervisetheactivitiesofaBureau;

(c) maintain proper standards of conduct andacceptable credit information reportingpractices;

(d) protect the integrity of the credit referencesystemagainstabuseandmisuse;

(e) require a Bureau to correct or remedyany violation under these Regulations ordirections,guidelinesorrulesissuedbytheCentralBank;

(f) takemeasures to protect the interests of acustomer,subscriberorBureau;

(g) imposepenalties or sanctions for violationoftheseRegulationsordirections,guidelinesorrulesissuedbytheCentralBank;

(h) review the adequacy of a credit referencebureau’s operations, including periodicinspection of credit reference bureaus, toensure compliance with these regulations,establishedstandardsandapplicablelaw;

(i) perform such other functions or exercisesuchotherpowersasmaybenecessaryforthe proper supervision and regulation ofBureausandBureaubusiness;and

(j) access the premises, systems, documentsandanyotherinformationofaBureauoritsagents.

(3) The Central Bank may issue directions,guidelines or rules generally for the bettercarrying out of its supervisory functions undertheseRegulations;

Inspection of Bureaus53. (1)TheCentralBankmay,atanytime,causean

inspectiontobemadebyanypersonauthorizedby it of any Bureau, agent and its operatingmanagement information system, premises,data, books, accounts, records, document orotheractivity.

(2) When an inspection is made under sub-regulation (1), the Bureau or agent concernedand every officer or employee of the Bureaushallproduceandmakeavailabletothepersoncarrying out the inspection any information,data, record, document or material that maybe required by the person for purposes of theinspection.

(3) Thepersoncarryingout the inspectionmaymake a copy of any document, data, recordor material in possession of the Bureau andshall prepare and submit to theCentralBankareport pursuant to the inspection highlightinghis findings including any violation of the law,theseRegulations,directives,guidelinesorrulesissuedbytheCentralBank,anymismanagementof the Bureau or information or users of creditinformationobtainedfromtheBureau.

(4)Anypersonwhorefusesorneglectstoprovideany record or data as the Central Bank mayrequestpursuanttothisRegulationorobstructsor prevents the Central Bank from supervisinga Bureau or an agent commits an offence andshall, on conviction, be liable to a fine notexceedingtwohundredthousandshillingsor toimprisonmentforatermnotexceedingtwoyearsortoboth.


Ownership of information in possession of a Bureau54. (1) The information held by the Bureau shall

remain the property of the Central Bank andwhereaBureauwindsup, the informationshallreverttotheCentralBank.

(2)Despiteanyagreements to thecontrary, theCentral Bank as licensor of Bureaus shall bethe owner of all information and data held byBureausandany informationordata vesting inanyworkauthoredbyanypersonlicensedundertheseRegulations,wheresuchworkincorporatesany information obtained under the licence orpursuant to theprovisionsof theseRegulationsdespite that the information or data has beenprocessedbythatpersoninanyway.

(3) The Central Bank shall retain the right ofaccesstodataevenafterrevocationorexpiryofthelicence.

Periodic returns55. (1)TheBureaushallfurnishtheCentralBankwith

periodic reports of their business operations,including systems report, in such form as theCentralBankmayfromtimetotimerequire.

(2)ABureauwhichfailsorrefusestocomplywiththis Regulation or which furnishes the CentralBankwithanincomplete,inadequate,inaccurateorlatereturnsshallbeliabletoapenaltyoffivehundredthousandshillings.

Audited report56. A Bureau shall submit to the Central Bank not

later than 31st March of each year, auditedfinancialstatementsforthepreviousyear.

PART VIII -GENERAL PROVISIONS

Mandatory standards for data collection, storage, processing and use

57. (1) A person collecting, storing, submitting orprocessing any data or information obtainedunder the provisions of these Regulationsshall comply with the following mandatoryrequirements—

(a) theinformationordatashallatalltimesbekeptuptodateandaccurate;

(b) the information or data shall be used onlyfor the specified purpose for which it wasobtained or submitted andwhich purposeshall be consistent with the provisions oftheseRegulations;

(c) the information or data shall be adequateand relevant in relation to the purpose forwhichitwasobtainedorsubmitted.

(2) A person shall not use the informationobtainedundertheseRegulationsforanypurposewhich is not consistent with the provisions oftheseregulations.

(3)Apersonwhocontravenessub-regulation(2)commitsanoffenceandshall,onconviction,beliabletoimprisonmentforatermnotexceedingtwoyearsortoafinenotexceedingtwohundredthousandshillings,ortoboth.

(4) Without prejudice to sub-regulation (3), theCentral Bankmay, impose such sanctions as itmay consider fit and just including imposing apenaltyoffivehundredthousandshillingsagainstanypersonwhocontravenessub-regulation(2).

Responsibilities of institutions and credit information providers

58. (1) An institution and a third party creditinformationprovidershall–

(a) notify the customer within one monthbefore a loan becomes non-performingthattheinstitutionshallsubmittoaBureauthe informationon the loan immediately itbecomesnon-performing:

Provided that for loans whose repaymentintervalorperiodislessthanonemonth,thenoticeshallbeservedtwoweeksbeforetheloanbecomesnon-performing;


(b) notify each customer, within thirty days ofthe first listing, that his credit informationhasbeensubmittedtoalllicensedBureaus;

(c) issueanadverseactionnoticetoacustomeragainst whom a decision has been takenor determination made, in whole or inpart, that is adverse to the interests of thecustomer based on information obtainedfromaBureau;

(2) The adverse action notice issued undersub-regulation (1) (c), shall be provided at thetime the adverse decision or determination iscommunicatedtothecustomerandshallnotifythecustomer-

(a) that customer informationplayeda role inthedecision;

(b) the name, address and telephone numberof the Bureau that provided the customerinformation;

(c) the customer’s right to a free copy of theinformationprovidedbytheBureau,and

(d) the customer’s right to dispute suchinformation with the Bureau and, iferroneousoroutdated,haveitcorrected.

(3)Aninstitutionorathirdpartycreditinformationprovidershallbeconsideredtohavenotifiedthecustomer if they send the notification issuedpursuanttosub-regulation(1)tothecustomer’slastknownaddressorcontactdetailsbyanyoftheprint and electronic communicationmodesprovided for under these Regulations and theevidenceofthenotificationshallberetainedbytheinstitutionfortherecord.

(4) An institution and a third party creditinformation provider shall be responsible andunder an obligation to submit and updateall customer information to the Bureau inaccordancewiththeseRegulations.

(5) Where an institution or a third party creditinformation provider has provided customerinformation to the Bureau and subsequentlybecomes aware that the information wasinaccurate at the time it was provided, theinstitution or the third party credit informationproviderwillwithinfiveworkingdaysfromtheday

theinstitutionorthethirdpartycreditinformationproviderbecomesawareof the inaccuracy,givetheBureauanamendmentnoticeinstructingittodeletethe inaccurate informationandreplace itwiththecorrectinformation.

(6) An institution and a third party creditinformation provider shall ensure that thecustomerinformationfurnishedpursuanttothisregulationisprovidedtoall licensedBureausortoacentralizedpointorlocationfromwhichtheinformationcanbeaccessedbyallBureaus.

(7) An institution and a third party creditinformationprovidershallestablishandmaintainfunctional units or dedicate competent staffto receive and resolve complaints or disputesarisingfromcreditinformationsharingactivities.

(8) An institution and a third party creditinformation provider shall resolve complaintswithin thirty days from the date of receipt of acomplaint.

(9) An institution or a third party creditinformationproviderwhich fails to complywiththis Regulation may be liable to such penaltynot exceeding one million shillings or suchadministrativesanctionastheCentralBankmayconsiderappropriate.

(10) An institution which fails or neglects tosubmit to the Bureaus credit information of aperson whose credit information ought to besubmittedtotheBureausshallbeliabletosuchpenaltynotexceedingtwomillionshillingsortosuch administrative action as the Central Bankmayconsiderappropriate.

Central Hub59. (1) Where Bureaus agree to develop a central

hub for thesubmissionofcredit informationbyinstitutions and third party credit informationproviders, the Bureas shall comply with thefollowingrequirements:

(a) Seek approval of the Central Bank toestablishthecentralhub.

(b) Comply with any guidelines that maybe issued by the Central Bank on theestablishmentanduseofacentralhub.


(c) Where a third party is to be outsourced toprovide the system, the Central Bank shallapprove the proposed third party serviceproviderandthesystem.

(d) The Central Bank shall approve anyguidelines that may be developed by theBureausforpurposesofthecentralhub.

(2) The Central Bank may prescribe guidelinesfortheestablishmentandoperationofacentralhub or a centralized location for purposes ofsubmission of credit information and access totheinformationbyBureaus.

Data submission templates60. An institution or third party credit information

provider shall submit to a Bureau creditinformation using such format or template asmaybe prescribedor approvedby theCentralBank.

Notification of the amount owing61. (1) A notice issued by an institution or a third

party credit informationprovider toa customerunder regulation 50 (1) (a) shall contain theparticulars of the loan or credit including theprincipal amount, the interest rate and theamount outstanding to date and any otherinformationthattheinstitutionorthethirdpartycreditinformationprovidermaydesiretobringtotheattentionofthecustomer.

(2)Where a customer notifies the institutionorthethirdpartycreditinformationproviderwhichhas served a notice under sub-regulation (1)thattheamountallegedlyowingisdisputed,theinstitution or the third party credit informationprovidershall investigatethematterandinformthe customer accordingly of its decision withinfourteen days from the date the customercontactedtheinstitutionorthethirdpartycreditinformationprovideronthedisputedloan.

Mode of service62. (1) An institution or the third party credit

information provider shall serve a notice underregulation 49 on a customer by any of thefollowingmodes—

(a) registeredmailorcertificateofposting;(b) e-mail;(c) short message service through the

customer’sregisteredtelephonenumber;or(d) physical delivery of the letter evidenced

by acknowledgement of receipt by thecustomerorhisnominee,wherethephysicaladdressofthecustomerisknown.

(2)ArecordshallbekeptofallnoticesservedbyanymeanspermissibleunderthisRegulationforaperiodofatleastsevenyears.

Obtaining information under false pretences63. A person who knowingly or wilfully obtains

information fromaBureauunder falsepretencecommitsanoffenceandshall,onconvictionbeliabletoimprisonmentforatermnotexceedingtwoyearsor toafineof twohundredthousandshillings,ortoboth.

Publication of list of third party credit information providers64. Every Bureau which has entered into a credit

information sharing arrangement with a thirdparty credit information provider shall publishin a prominent and conspicuous place withinits business premises and on its website andshallkeepupdated,alistofallthirdpartycreditinformationproviders thathavebeenapprovedbytheCentralBanktosubmitcreditinformationtotheBureau.

Public education65. Bureaus and institutions either alone or in

partnership with each other or others shallconductpubliceducationprogrammesoncreditinformation sharing, benefits, risks to mitigate,availabilityofservices,howtoaccesstheservicesand any other useful or material informationwhichwouldbebeneficialtothepublic.

Compliance with guidelines, rules or directives66. (1)Forpurposesofperformingtheactivitiesand

obligationsundertheseRegulations,aBureau,itsagents,subscribersandotherpersonsorentitiessubject to these Regulations shall comply withanyguidelines, rulesordirectives issuedby theCentral Bank.


(2)ABureauorapersonwho failsor refuses tocomplywiththeseRegulationsoranyguidelines,rules or directives issued by the Central BankshallbeliabletoafineoffivehundredthousandshillingsinthecaseofaBureauor,onehundredthousandshillingsinthecaseofanaturalperson.

(3) For the purposes of sub-regulation (1), theCentral Bank may, at any time, request anyinformation itmay require in order to evaluateany matter arising from these Regulations orfrom the operations of the Bureau, its agents,subscribersandotherpersonsorentitiessubjecttotheseRegulations.

Penalties67. (1)WhereaBureau-

(a) isinbreachof,orfailstoadoptorimplementthe data management and quality controlmeasuresoutlinedinregulation49;

(b) isinbreachoforfailstoupdateandmaintaininformationasrequiredinregulation33;

(c) isinbreachoforfailstoobserveoradheretothesecurityandcontrolmeasuresoutlinedinregulation34;or

(d) wrongfullyalters,modifiesordeletesrecordsfromitsdatabase;

(e) fails to adopt security and controlmeasuresthatarenecessarytopreventtheunauthorizedaccessto,orwrongfuluseandmanagementofinformation;

(f) delays in providing information anddocumentstotheCentralBank;

(g) failstocomplywithanorderordirectiveofthe Central Bank on data and informationmanagement;or

(h) disclosescustomerinformationtoapersonwhoisnotauthorisedbytheseRegulationsorbyacustomertoreceivesuchinformation;

it shall be liable to pay a fine of five hundredthousandshillingsand in thecaseofcontinuedfailure,itshallbeliableforanadditionalpenaltyof ten thousandshillings foreachdayonwhichsuchfailurecontinues.

(2)Wherean institution contravenesanyof theprovisionsoftheseRegulations,theCentralBankmay pursue any or all of the remedial actionsprovidedforundertheAct.

(3) In addition to the remedialmeasuresundersub-regulation(2),theCentralBankmayimposethefollowingsanctionsagainstaninstitution-

(a) prohibition from obtaining credit reportsfromBureaus;

(b) termination of employment services of anofficeroremployeeoftheinstitution;

(c) prohibitionfromestablishingnewbranches,subsidiaries, agents or introductionof newproducts;

(d) prohibition fromengaging innewactivitiesorfromexpandingexistingactivities;

(e) suspension of lending, investment, andcreditgrantingoperations;

(f) prohibition fromaccepting furtherdepositsorotherlinesofcredit;

(g) prohibition from declaring or payingbonuses, salary incentives, severancepackages, management fees or otherdiscretionary compensation to directors,officersoremployees.

(h) limittherangeofactivitiesandthelocationsinwhichsuchactivitiescanbeconducted;

(i) prohibition from declaring or payingdividends;or

(j) prohibition or suspension from any otheractivity that Central Bank perceives tobe contributing to violation of theseRegulations.

(4)Whereacredit informationproviderviolatesorbreachesanyprovisionof theseRegulations,theCentralBankmay takeanyof the followingactions—

(a) direct the Bureau to which a creditinformation provider has submitted creditinformation to terminate any subsistinginformation sharing agreement with thecreditinformation;

(b) direct the Bureau in possession ofcredit information provided by a creditinformation provider to delete from thedatabase any inaccurate, erroneous ormisleading information submitted bythe credit information provider and tonotify all subscribers who have receivedthe inaccurate, erroneous or misleadinginformation;


(c) direct the Bureau to compensate or takeremedialmeasuresinrespectofanylossordamage sufferedbya customerasa resultof the use of any inaccurate, erroneous ormisleadingcreditinformationsuppliedbyacreditinformationprovider.

(5) In assessing the penalty to impose, theCentralBankmaytakeintoaccountthenatureoftheviolation,theseverityoftheviolationandanyotherrelevantfactor.

(6)BeforeimposingapenaltyonanyBureauoraninstitution under these Regulations, the CentralBankshallgivenot lessthansevendaysnotice,inwriting, requiring theBureauor institution toshow cause as to why the penalty prescribedshouldnotbeimposed.

(7)WhereamonetarypenaltyisprescribedundertheseRegulations,suchpenaltyshall-

(a) bepaidtotheCentralBank;(b) be paid within ten days, unless otherwise

stated;(c) inthefirstinstance,bepaidbytheBureau;(d) wheretheBureaufailstomakepayment,in

thesecondinstance,bepaidimmediatelybythe bank issuing the bank guarantee uponbeing called upon to do so by the CentralBank;

(e) whereaninstitutionfailstopaythepenalty,theCentralBankmaytakesuchotheractionormakesuchdecisionasispermittedundertheActortheseRegulation.

(8)Wherenopaymentismadeorreceivedundersub-regulation(7),thelicenceoftheBureaushallberevoked.

(9) Where any provision of these RegulationsimposesapenaltyonanyBureau,theamountofthepenaltyshallconstituteadebtduefromtheBureautotheCentralBank,andtheCentralBankmay—

(a) in addition to the provisions of thisRegulation,suetheBureaufortherecoveryofthepenalty;

(b) direct that any part of the penalty whichremains unpaid after a particular periodnotified to the Bureau and the officersconcerned, shall constitute a debt payablebytheBureauandtheparticularofficersoftheBureauspecifiedinthenotification;and,theCentralBankshallbeentitledtorecoverfrom that Bureau and officers jointly andseverally.

Repeal of L.N. No. 5 of 201468. The Credit Reference Bureau Regulations, 2013,

arerepealed.

Savings69. (1)ABureauwhichwaslicensedundertheCredit

ReferenceBureauRegulations,2013repealedbythis Regulations shall continue to operate as iftheywerelicensedundertheseRegulationsandshallberequiredcomplywiththeseRegulations.

(2)AnydatabaseestablishedbyaBureau,creditreport issuedbyaBureau,contract signedbyaBureauorothermatterdonebyaBureauunderthe authority of the Credit Reference BureauRegulations, 2013 (now repealed) shall remainvalid and shall be deemed to have been doneundertheseRegulations.

(3) Anything which was lawfully commenced,done or executed under the authority of theCreditReferenceBureauRegulations,2013(nowrepealed),bytheCentralBank,DepositProtectionFund Board, an institution, a subscriber or acustomer shall continue to be valid and shallbecontinuedwithundertheseRegulationsas ifitwasoriginally commenced,doneor executedundertheseRegulations.


FIRST SCHEDULE (r. 4 (3)

APPLICATION FORM FOR A LICENCE TO CARRY OUT BUREAU BUSINESS 1. Name:______________________________________________________________________________________ 2. Former name(s) (if any) by which the applicant has been known:

____________________________________________________________________________________________

____________________________________________________________________________________________

3. Head/mainoffice: _____________________________________________________________________________

(a) Address:_________________________________________________________________________________

(b) TelephoneNo:____________________________________________________________________________

(c) TelefaxNo:_______________________________________________________________________________

(d) Formofcorporation(e.g.publiclylisted/privatelyheld,etc.):________________________________________

(e) Dateandplaceofincorporation:______________________________________________________________

(f) Descriptionoftheapplicant’sbusinessorfunctions:______________________________________________

(g) Theapplicant’sauthorisedandpaid-upcapital,includingrelevantdetailsofsharesissuedortobeissued(e.g.types,numberandissueprice)andevidenceonthesame:_________________________________________

4. Branches (including physical location): ____________________________________________________________

____________________________________________________________________________________________ Subsidiaries&affiliates:

Nameandtypeofbusiness Amountofsharesheld %ofsharesheldintotal

______________________ __________________ ___________________

______________________ __________________ ___________________

______________________ __________________ ___________________ 5. Management: (1) BoardofDirectors:

Name Designation Presentterm No.ofyearsasboardmember (2) Boardcommittees:

Nameandpurposeofcommittee(s) Namesofmembers:

(3) Officers:

Name Position: No.ofyearsasofficer


6. Ownershipprofile:

Name Countryofcitizenship Residence Paidupcapital %

1. ______________|__________________________|______________________|_________________|________ 2. ______________|__________________________|______________________|_________________|________ 3. ______________|__________________________|______________________|_________________|________

Othershareholdersowinglessthan5%(Number_________)

TOTAL___________________________________________

7. (i)Organisationprofile—

(a) organisationchart-Attachoneindicatingmajordepartmentsordivisionswithnames,positionsandtitlesof officersheadingeachdepartmentordivision.

(b) attachanorganisationchartshowingtheapplicantanditsrelationshipswithitssubsidiaries,associatesand othermembersofthegroup.

(c) functions-Attachalistoffunctionsorresponsibilitiesforeachdepartmentordivisionlistedintheorganization chartindicatingthenumberofpersonnelorstaffforeach.

(d) qualificationsofsignificantshareholders,directorsandofficers.

(e) annexpersonaldeclarationformofeachsignificantshareholderandofficerandaninformationsheetforeach significantcorporateshareholder.

(f) powersandpurposes–AttachthelatestcopiesoftheMemorandumandArticlesofAssociationifnot previouslysubmittedtotheCentralBank.

(ii) Legal and regulatory compliance

Describeanddemonstrate,withsupportingdocumentsorinformation,howtheapplicantwill—

(a) complywiththerequirementsoftheBankingActandCBK’sPrudentialGuidelines;

(b) haveadequatemeansofsupervisingitsofficers,employeesandparticipants;and

(c) haveadequatemeanstodealwithanyconflictsofinterestthatmayarise.

Note:

Relevantsupportingdocumentsorinformationtobeprovidedcouldincludetheapplicant’s—

(a) informationonkeyofficersandemployees(includingnames,addresses,relevantexperience,qualifications,etc.);

(b) riskmanagementsystems,includingproceduresrelatingtointernalaudit,internalcontrols,security,andthe grantingofcredit;

(c) businesscontinuityplanandsystemcapacityplanningprocedures;and

(d) humanresources,includinginformationonthestaffinglevelsofkeyfunctions.


8. Shareholdinginanyotherfinancialinstitution—

NameofInstitution Financial Sharesowned-Number %ofcapital Institution Amount

1. _________________|_____________|_____________________|______________|____________|_____________

2. _________________|_____________|_____________________|______________|____________|_____________

3. _________________|_____________|_____________________|______________|____________|_____________

9. Name(s) and address(es) of the applicant’s bankers within the last 10 years. (please also indicate the

applicant’s principal bankers)___________________________________________________________________

____________________________________________________________________________________________

____________________________________________________________________________________________

10. Name and address of the applicant’s external auditors_______________________________________________

____________________________________________________________________________________________

____________________________________________________________________________________________

11. FitandProperCriteria—

Iftheanswertoanyofthefollowingquestionsisintheaffirmative,pleaseattachannexesandsupportingdocuments,whereappropriate,givingallrelevantparticulars.(Pleaseansweryesorno).

(1) Hastheapplicantoranyofitsindividualsignificantshareholders,corporatesignificantshareholders,anydirectoror

seniorofficeroftheapplicant—

(a) been licensed or registered under any law in Kenya or elsewherewhich requires licensing or registration inrelationtoanyregulatedfinancialbusiness?

(b) beenrefusedtherightorrestrictedinits/hisrighttocarryonanytrade,businessorprofessionforwhichaspecificlicence,registrationorotherauthorisationisrequiredbylawinanyjurisdiction?

(c) beenissuedaprohibitionorderunderanylaworhasbeenprohibitedfromoperatinginotherjurisdictionbyanyfinancialservicesregulatoryauthority?

(d) beencensured,disciplined,suspendedorrefusedmembershiporregistrationbytheCentralBankoranyotherregulatoryauthority,inKenyaorelsewhere?

(e) been thesubjectofanycomplaintmade reasonablyand ingood faith relating toactivities regulatedbyanyfinancialservicesregulatoryauthorityorhowsoeverunderanylawinanyjurisdiction?

(f) beenthesubjectofanyproceedingsofadisciplinaryorcriminalnatureorhasbeennotifiedofanypotentialproceedingsorofanyinvestigationwhichmightleadtothoseproceedings,underanylawinanyjurisdiction?

(g) been convicted of any offence, or is being subject to any pending proceedings which may lead to such aconviction,underanylawinanyjurisdiction?


(h) hadanyjudgment(includingafindingoffraud,misrepresentation,ordishonesty)enteredagainstit/himinanycivilproceedingsorisapartytoanypendingproceedingswhichmayleadtosuchajudgment,underanylawinanyjurisdiction?

(i) had any civil penalty enforcement action taken against it/him by the Central Bank or any other regulatoryauthorityunderanylawinanyjurisdiction?

( j) contravenedorabettedanotherpersoninbreachofanylawsorregulations,businessrulesorcodesofconduct,inKenyaorelsewhere?

(k) beenthesubjectofanyinvestigationsordisciplinaryproceedingsorbeenissuedawarningorreprimandbyanyregulatoryauthority,anoperatorofamarketorclearing facility,professionalbodyorgovernmentagency, inKenyaorelsewhere?

(l) beenrefusedafidelityorsuretybond,inKenyaorelsewhere?

(m)beenadirector,partnerorconcerned in themanagementofabusiness thathasbeencensured,disciplined,suspendedorrefusedmembershiporregistrationbyanyregulatoryauthority,professionalbodyorgovernmentagency,inKenyaorelsewhere?

(n) beenadirector,partnerorconcernedinthemanagementofabusinessthathasgoneintoinsolvency,liquidationoradministrationduringtheperiodwhen,orwithinaperiodofoneyearafter,hewasadirector,seniorofficer,partnerorconcernedinthemanagementofthebusiness,inKenyaorelsewhere?

(o) beendismissedoraskedtoresign,fromoffice,employment,apositionoftrust,orafiduciaryappointmentorsimilarposition,inKenyaorelsewhere?

(p) beensubjecttodisciplinaryproceedingsbyhiscurrentorformeremployer(s),inKenyaorelsewhere?

(q) beendisqualifiedfromactingasadirectorordisqualifiedfromactinginanymanagerialcapacity,inKenyaorelsewhere?

(r) beenanofficer found liable for anoffencecommittedbyabody corporateasa resultof theoffencehavingprovedtohavebeencommittedwiththeconsentorconnivanceof,orneglectattributableto,theofficer,inKenyaorelsewhere?

(s) carriedonbusinessunderanynameotherthanthenameornamesshowninthisapplication?

(t) beenengagedinthemanagementofanycorporationotherthanthosedisclosedtotheCentralBank?

(u) beenengaged,ordoesitorheexpecttobeengaged,inanybusinessrelationshipwithanyofthe(prospective)officersoftheapplicant?

(2) Has the applicant, any of its individual significant shareholders, or any director or chief executive officer of the

applicant—

(a) beenunabletofulfilanyofits/hisfinancialobligations,inKenyaorelsewhere?

(b) enteredintoacompromiseorschemeofarrangementwithits/hiscreditors,beingacompromiseorschemeofarrangementthatisstillinoperation,inKenyaorelsewhere?


(c) beensubjecttoajudgmentdebtwhichisunsatisfied,eitherinwholeorinpart,inKenyaorelsewhere?(d) beeninthecourseofbeingwound-uporotherwisedissolved,inKenyaorelsewhere?

(e) beenacorporationthathasareceiverorstatutorymanagerorsuchotherpersonhavingthepowersanddutiesofa receiver,managerappointed in relation to,or in respectofanypropertyof, thecorporation, inKenyaorelsewhere?

(f) hadadisputebetweenitorhimandtheKenyaRevenueAuthorityoranyequivalenttaxauthorityinanyotherjurisdiction?

12. Are there any additional information considered relevant or material which may assist the Central Bank in reaching a decision on the application?

DECLARATION Wecertifythatalltheinformationcontainedinandaccompanyingthisformisaccurateandcompletetothebestofourknowledge,informationandbeliefandthattherearenootherfactsrelevanttothisapplicationofwhichtheCentralBankshouldbeaware.WeundertaketoinformtheCentralBankofanymaterialchangestotheapplicationwhichmayarisewhiletheCentralBankisconsideringtheapplication.Wefurtherundertakethat,intheeventthattheinstitutionisgrantedalicenceundertheseRegulationswewillnotifytheCentralBankofanymaterialchangestooraffectingthecompletenessoraccuracyoftheanswerstothequestionsaboveassoonaspossible,butinanyeventnotlaterthantwentydaysafterthedatethatthechangescometoourattention. SwornatNairobithis__________________________dayof___________________________20__________________ 1. Name_______________________ Positionheld___________________________________ Signed______________________________ Date__________________________________________

2. Name_______________________ Positionheld___________________________________ Signed______________________________ Date__________________________________________

Deponentunderstandsthecontentsofthisaffidavitbeforeme, ______________________________________________________________________ COMMISSIONER FOR OATHS N.B. 1. Allsectionsofthisformmustbefilled2. Ifanyspaceprovidedisinadequate,therequiredinformationmaybesuppliedas anattachmentlabelledaccordinglyandreferenceshallbemadetotherelevantsectionofthe formbyplacingthewords“REFERTOANNEX…………….”3. InformationprovidedinthisformisconfidentialandcannotbemadeavailablewithouttheconsentoftheGovernor

oftheCentralBank.


SECOND SCHEDULE

PERSONAL DECLARATION FORM FOR INDIVIDUALS PROPOSED TO BECOME SIGNIFICANT SHAREHOLDERS, DIRECTORS OR SENIOR OFFICERS OF A BUREAU Explanatory Notes 1. Pleasereadtheexplanatorynotesandquestionscarefullybeforecompletingtheapplicationform.2. Allquestionsmustbeanswered. Ifaquestionisnotapplicable,pleasemark“N.A.” inthespaceprovided.Should

therebeinsufficientspaceforyouranswers,pleaseattachannex(es)whichshouldbeidentifiedassuchandsignedbythesignatoriestothisapplication.

3. Wherethereisanasterisk(*),pleasedeletewhicheverisinapplicable.4. Pleasetick(√)intherelevantboxeswhereappropriate.5. Ifthereareanychangesintheinformationfurnishedintheapplicationpriortothecompletionofthereviewofthis

application,theCentralBankofKenyashouldbenotifiedimmediately.6. Theterm“seniorofficer”isasdefinedundertheBankingAct. I. NAME OF APPOINTEE (Full name of appointee, including any alias and other names used currently or in the past. Please underline surname.)

2. Applicationforappointmentas

Chairman_______________________________________________________________________________________ChiefExecutiveOfficer_____________________________________________________________________________Director_________________________________________________________________________________________SignificantShareholder____________________________________________________________________________SeniorOfficer(stateposition)________________________________________________________________________ 3. PleaseprovidethefullnameoftheCreditReferenceBureau. II. PERSONAL PARTICULARS 1. Setoutbelowthepersonalparticularsoftheappointee: a) residentialAddress(if foreign address is provided, please update the Central Bank with a local address when available):

_______________________________________________________________________________________________

b) telephoneandfacsimilenumber(s)(Home:Office:Facsimile:Mobile);

Home_________________Office____________________Facsimile______________Mobile___________________

c) dateofbirth(dd/mm/yy)_______/______/_____________

d) placeofBirth:__________________________________________________________________________________

e) sex:(Male/Female)_____________________________________________________________________________

f) Nationality:___________________________________________________________________________________

g) IdentityCardNumber:____________________________________________________________________________

h) PassportNumber:______________________________________________________________________________

i) Permanentresidentstatusinothercountries(ifapplicable):_______________________________________________


III. EDUCATIONAL AND PROFESSIONAL QUALIFICATIONS 1. Setout in the following format informationon theappointee’shighestacademicandprofessionalqualifications

attainedandanymaterialtrainingsattended. Name_____________________________________________location____________________________________

school/college/university/institutionofPeriod(mm/yy)Certificate/diploma/degreeawarded/professionalqualifications/trainingawards

____________________________________________________________________________________________

____________________________________________________________________________________________

IV. EMPLOYMENT HISTORY 1. Setoutinthefollowingformatinformationontheappointee’semploymenthistory(includingperiodsofpart-time

employmentor unemployment), business andother activitiesduring thepast 10 years. If appointee is currentlyemployed with a company other than the Bureau stated in this application, please state his/her last day ofemploymentwithcurrentemployer.

Nameandaddressofemployer(ifself-employed,pleaseindicate) ____________________________________________________________________________________________

Natureofbusinessofemployer___________________________________________________________________

DesignationandDepartment_____________________________________________________________________

Briefdescriptionofduties____________________________________________________________________

Period(mm/yy)______/_________/_____________ V. DIRECTORSHIPS AND SUBSTANTIAL SHAREHOLDINGS

1. Setoutinthefollowingformatinformationontheappointee’sdirectorshipsinanycorporation. Nameofcompanyandplaceofincorporation_______________________________________________________

Natureofbusiness_____________________________________________________________________________ Directorship(executive/nonexecutive)______________________________________________________________

Dateofappointment(mm/yy)_________________________________________________________________

Percentageshareholdingincorporation(ifany)______________________________________________________


2. Will therebeanychanges intheappointee’sdirectorshipsfollowinghis/herappointmentwiththeBureau? Ifyes,pleaseelaborate.

3. Setoutinthefollowingformatinformationontheappointee’ssignificantshareholding(5%ormoreoftheissuedsharecapital)inanycorporation.

Nameofcompanyandplaceofincorporation_______________________________________________________

Natureofbusiness_____________________________________________________________________________

Dateofacquisition(mm/yy)________/_______________

Percentageshareholdingincorporation_____________________________________________________________ 4. Arethereanypotentialareasofconflict(s)ofinterestarisingfromtheappointee’sproposeddutieswiththeBureau

andhis/herdirectorship(s)and/orshareholding(s)asstatedabove?Ifyes,pleaseelaborate. 5. Doestheappointee,oranycorporationinwhichtheappointeeisinapositionofcontrol,haveabeneficialinterest,

whetherdirectorindirect,inatleast5%oftheissuedsharesofanycorporationquotedonasecuritiesexchange,whetherinKenyaorelsewhere?Ifyes,pleaseelaborateandprovidealistofsuchcorporations.

VI. OUTSTANDING BORROWINGS

NameofBorrower_________________________________________________________________________________

NameofLendingInstitution_________________________________________________________________________

TypeofFacility____________________________________________________________________________________

AmountBorrowed(KES)____________________________________________________________________________

TermsofFacility___________________________________________________________________________________

SecurityOffered____________________________________________________________________________________

ValueofSecurity(KES)______________________________________________________________________________

CurrentOutstandingBalance(KES)____________________________________________________________________

Current Status____________________________________________________________________________________

VII. REFEREES

Indicatethenames,postalande-mailaddresses,telephonenumbersandpositionsofthreeindividualsofgoodstandingwhowouldbeabletoprovideareferenceonyourpersonalandfinancialintegrityandhonesty.Therefereesmustnotberelatedtoyou,andshouldhaveknownyouforatleastfiveyears. NameofReferee___________________________________________________________________________________

Tel(s)no.Mobile_____________________Office____________________PostalAddress__________________________

E-mailaddress___________________________Designation(whereapplicable)________________________________

Relationshipwithapplicant__________________________________________________________________________


VIII. FIT AND PROPER CRITERIA Iftheanswertoanyofthefollowingquestionsisintheaffirmative,pleaseattachannexesandsupportingdocuments,whereappropriate,givingallrelevantparticulars.(Pleaseansweryesorno).

1. Haveyoui.e.theindividualsignificantshareholder,corporatesignificantshareholder,directororseniorofficer-

(a) been licensedor registeredunder any law in Kenyaor elsewherewhich requires licensingor registration inrelationtoanyregulatedfinancialbusiness?

(b) beenrefusedtherightorrestrictedtocarryonanytrade,businessorprofessionforwhichaspecificlicence,registrationorotherauthorisationisrequiredbylawinanyjurisdiction?

(c) beenissuedaprohibitionorderunderanylaworhaveyoubeenprohibitedfromoperatinginotherjurisdictionbyanyfinancialservicesregulatoryauthority?

(d)beencensured,disciplined,suspendedorrefusedmembershiporregistrationbytheCentralBankoranyotherregulatoryauthority,inKenyaorelsewhere?

(e)been the subjectofanycomplaintmade reasonablyand ingood faith relating toactivities regulatedbyanyregulatoryauthorityorunderanylawinanyjurisdiction?

(f)beenthesubjectofanyproceedingsofadisciplinaryorcriminalnatureorhaveyoubeennotifiedofanypotentialproceedingsorofanyinvestigationwhichmightleadtothoseproceedings,underanylawinanyjurisdiction?

(g) been convicted of any offence, or are you subject to any pending proceedings whichmay lead to such aconviction,underanylawinanyjurisdiction?

(h) hadanyjudgment(includingafindingoffraud,misrepresentation,ordishonesty)enteredagainstyouinanycivilproceedingsorareyouapartytoanypendingproceedingswhichmayleadtosuchajudgment,underanylawinanyjurisdiction?

(i) hadanycivilpenaltyenforcementactiontakenagainstyoubytheCentralBankoranyotherregulatoryauthorityunderanylawinanyjurisdiction?

( j) contravenedorabettedanotherpersoninbreachofanylawsorregulations,businessrulesorcodesofconduct,inKenyaorelsewhere?

(l) beenthesubjectofanyinvestigationsordisciplinaryproceedingsorbeenissuedawarningorreprimandbyanyregulatoryauthority,anoperatorofamarketorclearingfacility,professionalbodyorgovernmentagency, inKenyaorelsewhere?

(m)beenrefusedafidelityorsuretybond,inKenyaorelsewhere?

(n) beenadirector,partnerorconcernedinthemanagementofabusinessthathasbeencensured,disciplined,suspendedorrefusedmembershiporregistrationbyanyregulatoryauthority,professionalbodyorgovernmentagency,inKenyaorelsewhere?

(o) beenadirector,partnerorconcernedinthemanagementofabusinessthathasgoneintoinsolvency,liquidationoradministrationduringtheperiodwhen,orwithinaperiodofoneyearafter,youwereadirector,partnerorconcernedinthemanagementofthebusiness,inKenyaorelsewhere?

(p) beendismissedoraskedtoresign,fromoffice,employment,apositionoftrust,orafiduciaryappointmentorsimilarposition,inKenyaorelsewhere?

(q) beensubjecttodisciplinaryproceedingsbyyourcurrentorformeremployer(s),inKenyaorelsewhere?


(r) beendisqualifiedfromactingasadirectorordisqualifiedfromactinginanymanagerialcapacity,inKenyaorelsewhere?

(s) beenanofficer found liable foranoffencecommittedbyabodycorporateasa resultof theoffencehavingprovedtohavebeencommittedwiththeconsentorconnivanceof,orneglectattributabletoyou,inKenyaorelsewhere?

(t) carriedonbusinessunderanynameotherthanthenameornamesshowninthisapplication;

(u) beenengagedinthemanagementofanycorporationotherthanthosedisclosedtotheCentralBank?

2. Haveyoui.e.individualsignificantshareholder,corporatesignificantshareholder,directororseniorofficer;

(a)beenunabletofulfilanyofyourfinancialobligations,inKenyaorelsewhere?

(b)enteredintoacompromiseorschemeofarrangementwithyourcreditors,beingacompromiseorschemeofarrangementthatisstillinoperation,inKenyaorelsewhere;

(c)beensubjecttoajudgmentdebtwhichisunsatisfied,eitherinwholeorinpart,inKenyaorelsewhere?

(d)beeninthecourseofbeingwound-uporotherwisedissolved,inKenyaorelsewhere?

(e)beenacorporationthathasareceiverorstatutorymanagerorsuchotherpersonhavingthepowersanddutiesofareceiver,managerappointedinrelationto,or inrespectofanypropertyof, thecorporation, inKenyaorelsewhere?

3. WhatproportionofthevotingpoweratanygeneralmeetingoftheBureau(oranotherbodycorporateofwhichitisasubsidiary)areyouoranyrelatedpartyentitledtoexerciseorcontroltheexerciseof?

4. Documentaryrequirements-

(a) certifiedstatementofassetsandliabilities;

(b) latesttaxcompliancecertificateorcertifiedtruecopyofincometaxreturns;

(c) two letters of character references from individuals other than relatives who have personally known theundersignedforatleasttenyears;

(d) two letters (where possible), duly certified from financial institutions with whom the undersigned has haddealingsforthelasttwoyearsontheperformanceofpastandpresentaccountssuchasunauthorisedoverdraftondepositaccounts,pastdueordelinquentaccounts;

(e) certifiedcopiesofeducationalandprofessionalcertificates,PIN,NationalIdentityCardandtwopassportsizephotographs;and(f)acreditreportfromaCreditReferenceBureau.

IX. OTHER INFORMATION Arethereanyadditional informationconsideredrelevantormaterialwhichmayassist theCentralBank inreachingadecisionontheapplication?


X. DECLARATION I am aware that it is an offence to knowingly or recklessly provide any information, which is false ormisleading inconnectionwithanapplicationforacreditreferencebureaulicense.IamalsoawarethatprovisionoffalseinformationinthisregardmayresultinrejectionofthisapplicationbytheCentralBank.Icertifythattheinformationgivenaboveiscompleteandaccuratetothebestofmyknowledge,andthattherearenootherfactsrelevanttothisapplicationofwhichthesupervisoryauthorityshouldbeaware.Iundertaketoinformthesupervisoryauthorityofanychangesmaterialtotheapplicationwhicharisewhiletheapplicationisunderconsideration. NAME:__________________________________________________________________________________________ DATEDAT:_______________________THIS__________________DAYOF________________________20__________ SIGNED_______________________________________________________________________________(Applicant) WITNESSED BEFORE ME: Name___________________________________________________________________________________________ Signature:_______________________________________________________________________________________

Address:________________________________________________________________________________________ COMMISSIONER FOR OATHS/MAGISTRATE

N.B. 1. Allsectionsofthisformmustbefilled2. Ifanyspaceprovidedisinadequate,therequiredinformationmaybesuppliedasanattachmentlabelledaccordingly

andreferenceshallbemadetotherelevantsectionoftheformbyplacingthewords“REFERTOANNEX…………….”3. InformationprovidedinthisformisconfidentialandcannotbemadeavailablewithouttheconsentoftheGovernor

oftheCentralBank.


THIRD SCHEDULE

REPUBLIC OF KENYA

IN THE MATTER OF OATHS AND STATUTORY DECLARATIONS ACT (Cap.15)

STATUTORY DECLARATION I,_____________________________________________________of______________________________________

(insertaddress)intheRepublicof____________________doherebymakeoathandsolemnlystateasfollows:

THATIamthedeponenthereinhencecompetenttoswearthisaffidavit.

THATIamtheChiefExecutiveOfficerof_____________________(insertnameofBureau)hereinafterreferredtoastheApplicant.

THATIamholderof____________________(insertNationalRegistrationCard/identificationdocumentationdetails.)

THATImakethisaffidavitandherebyundertakethattheapplicantshalladheretotheprovisionsoftheseRegulationsandinparticularthattheapplicantwillnotdisclosetoanypersonanyinformationobtainedpursuanttotheapplicant’sobligationsundertheseRegulationsexceptasprovidedherein.

THATthefactshereindeponedtoaretruetothebestofmyknowledge,informationandbelief. Swornby______________atNairobithis________dayof______________20____))_____________)DEPONENT)BeforeMe)))CommissionerforOaths) Dated………………………………...

HENRY K. ROTICH, CabinetSecretaryfortheNationalTreasury.


FOURTH SCHEDULE

NATURE OF FEES AMOUNTApplicationfeesforalicense Ksh5,000Licencefee Ksh150,000AnnualrenewalfeeforBureauLicence Ksh150,000Applicationfeeforagentapproval Ksh1,000Annualrenewalfeeforagentapproval Ksh1,000Applicationfeeforapprovalofathirdpartycreditinformationprovider Ksh1,000ApplicationforaBranchApproval Ksh5,000AnnualBranchfee Ksh20,000


Documents

CENTRAL BANK OF KENYA 1 CREDIT REFERENCE BUREAU ... · CENTRAL BANK OF KENYA CREDIT REFERENCE BUREAU REGULATIONS, 2019 5 “credit report” means an electronic, written or other