Customer credit and financial information is a key data point for credit decision making. Licensed credit information bureaus governed by the Credit Information Companies (Regulation) Act, 2005 (CICRA), could be accessed only by regulated entities such as banks and NBFCs that were specified users under the CICRA. Otherwise, customers had to give explicit consent to access their credit data. The growth of digital lending products has led to innovation in credit analytical tools and several fintech platforms also access, with explicit consumer consent, the credit data of borrowers held by licensed credit bureaus.

The Reserve Bank of India (RBI) has not been comfortable with non-regulated entities accessing credit data and earlier issued notices to banks and NBFCs directing them not to grant fintech platforms access to the credit reports of customers. The report of the Working Group on Digital Lending recently recommended that, in order to prevent marketing by digital lenders based on credit reports, only regulated entities should be allowed to act as agents of customers to access credit reports from credit bureaus.

As digital lending models rely on data accessed by fintech technology platforms, a complete ban on access to borrower credit information by technology platforms will stifle innovation and severely restrict credit to several underserved segments, such as micro, small and medium-sized enterprises, new-to-credit and niche sectors including agriculture. These segments have, in particular, benefited from the extension of credit access created by digital lending products.

In January 2022, the RBI posted on its website the Eligibility criteria for Entities to be categorised as Specified Users under … The Credit Information Companies (Amendment) Regulations, 2021. These guidelines show that the RBI now permits entities other than regulated entities to access credit information from credit bureaus. Key eligibility requirements for companies other than banks and NBFCs to qualify as specified users include a net worth of not less than INR20 million (USD263,000) as shown in the latest audited balance sheet; ownership and control by resident Indian citizens; a well-diversified ownership; a minimum of three years’ experience in running a business of processing information for the support or benefit of credit institutions, and certification from a certified information security auditor that it has a robust and secure information technology system. Fintech platforms have to be members of a credit information or credit bureau acting as an eligible specified user.

This guideline is a progressive step that recognises the landscape of data flow in the digital lending sector. However, the requirement for a specified user to be owned and controlled by resident citizens will prevent some fintech platforms from being eligible users. Several technology platforms have attracted foreign growth capital and, despite being homegrown entities, are foreign-owned and controlled. The RBI has at times permitted up to 100% foreign direct investment in credit information companies. It is unclear whether the RBI, concerned over data privacy, will waive this requirement where entities with a well- diversified shareholding apply to be categorised as specified users.

This article was originally published in India Business Law Journal on 25 March 2022 Co-written by: Shilpa Mankar Ahluwalia, Partner; Akshita Agrawal, Principal Associate. Click here for original article

Read Less-