The Banking (Credit Reference Bureau) Regulations

AI-assisted research summary: These Regulations may be cited as the Banking (Credit Reference Bureau) Regulations.

AI-assisted research summary: Defines or interprets the term "non-performing loan or credit default or late payment on all types of facilities or claims".

AI-assisted research summary: The Central Bank must, within thirty days of a bureau's licence being issued, notify the public in the Gazette of the bureau's name and the licence issue date.

AI-assisted research summary: Section 11 sets out grounds and procedures for revocation or suspension of a bureau's licence, including notice, opportunity to make representations, remedial measures, takeover of business by the Central Bank, data handover and erasure, surrender of licence within seven days, and penalties for non-compliance.

AI-assisted research summary: Bureaus must pay an annual licence fee of one hundred thousand shillings to the Central Bank on or before the anniversary date; late payment by the anniversary date requires payment of two hundred thousand shillings within ninety days, and the Central Bank shall revoke the licence if fees remain unpaid.

AI-assisted research summary: Fees are not refundable or payable pro rata; fees are refundable where the licence is cancelled or revoked or where a Bureau ceases to carry on business at any time before the end of the year.

AI-assisted research summary: A person must not transfer a licence granted to him by the Central Bank to another person.

AI-assisted research summary: Persons who contravene this regulation commit an offence and on conviction face a fine of five hundred thousand shillings or imprisonment for two years or both.

AI-assisted research summary: People who want to run bureau business must apply to the Central Bank for a licence and submit the listed documents, pay a non-refundable processing fee of ten thousand shillings, and maintain and update their database and manuals as specified.

AI-assisted research summary: On receiving an application under regulation (4), the Central Bank must, within fourteen days of receipt, review the application and notify the applicant of any missing information.

AI-assisted research summary: Inspection of systems and premises: the suitability of the premises for bureau operations.

AI-assisted research summary: The Central Bank must issue an interim licence (letter of intent) to an applicant who meets licensing requirements; applicants must provide a banker's cheque of one hundred thousand shillings and a statutory declaration; the Central Bank must issue a full licence when the applicant complies with those requirements, may impose and vary licence conditions, must determine applications within ninety days, and must state grounds in writing if it declines.

AI-assisted research summary: Licensed bureaux must submit an irrevocable bank guarantee of one million shillings to the Central Bank within thirty days of licence grant; the Central Bank may recover penalties from that guarantee, and if it is used the bureau must replace it within thirty days of notification.

AI-assisted research summary: Allows an aggrieved person to apply in writing to the Cabinet Secretary for review within twenty-one days of a Central Bank refusal; the Cabinet Secretary must consider the administrative record and may invite presentations; a dissatisfied person may appeal to the High Court.

AI-assisted research summary: Section 15 lists permitted activities for bureaus (obtain, store, compile, generate reports, develop credit scores, sell materials, conduct research, perform KYC, and other Central Bank‑approved activities); it prohibits bureaus from engaging in unapproved activities and sets penalties for non‑compliance.

AI-assisted research summary: Rules for bureaus using agents: approval required from the Central Bank before contracting agents; specific application, renewal, access, contracting and operational requirements.

AI-assisted research summary: A bureau must notify the Central Bank three months before permanently closing a place of business, and must notify the Central Bank at least seven days (or a shorter period approved by the Central Bank) before temporarily closing a place of business.

AI-assisted research summary: Specifies what customer information must be shared with credit bureaus, prohibits submitting negative credit information for amounts not exceeding one thousand shillings, requires bureaus to include credit scores and use Central Bank–approved formats, requires providers to ensure accuracy, permits Cabinet Secretary to suspend negative-information exchange on recommendation of the Central Bank, and makes providers liable to Central Bank penalties for inaccurate submissions.

AI-assisted research summary: Credit information about a person must be submitted to a bureau with identification details enabling the bureau to link the customer to all the customer's transactions with others.

AI-assisted research summary: Certain listed persons and entities are protected from suit or prosecution for acts done in good faith under these Regulations.

AI-assisted research summary: A credit bureau must not include a customer's personal information about race, belief, colour, ethnic origin, religion, political affiliation, sexual orientation, physical or mental handicaps, or medical information in its database or credit reports.

AI-assisted research summary: Customers may give consent to share credit information by signing documents or by oral, print or electronic means (subject to authenticity of electronic consent).

AI-assisted research summary: Before making a disclosure, a bureau or agent must identify the customer; disclosures may be made by various means; customers may be accompanied and accompanying persons must show ID; bureaus must appoint trained staff to explain information when needed.

AI-assisted research summary: Requires third-party credit information providers to follow approved industry codes and prohibits them from providing customer credit information to bureaus or agents without the customer's prior written consent; allows the Central Bank to prohibit bureaus receiving or disseminating credit information and forbids bureaus from contracting providers whose customer data is based on estimates or assessments before completeness is ascertained.

AI-assisted research summary: Bureaus must take reasonable measures to confirm public data accuracy and authenticity, verify court/public-record information within twenty-one days before including it in a report, periodically report sources and measures to the Central Bank, and the Central Bank may direct deletion and impose a penalty up to five hundred thousand shillings if the bureau failed to take reasonable measures.

AI-assisted research summary: Credit information providers must notify customers before sending negative information to a bureau, must not submit inaccurate information, must investigate notified inaccuracies and inform bureaus, and bureaus must update their databases when notified.

AI-assisted research summary: Directors, members, officers, employees and agents of a bureau or subscriber must not disclose customer information except as provided; the obligation continues after termination; contravention is an offence punishable by up to two years' imprisonment or a fine up to 500,000 shillings, and the Central Bank may instead impose sanctions.

AI-assisted research summary: Section 28 lists responsibilities for a bureau including how it must collect, protect, verify, retain and share customer credit information, establish complaints handling, and restrictions on fees; failure to comply may lead to a penalty of up to five hundred thousand shillings and other administrative sanctions by the Central Bank.

AI-assisted research summary: Each bureau must prepare a summary of customer rights including rights to obtain credit reports and scores, dispute information, contact the bureau for a free report, and refer unresolved disputes to ADR, court or the Central Bank.

AI-assisted research summary: Subscribers may only use bureau information to decide on customer transactions or employment and must not release or use it for other purposes; subscribers must ensure bureau information is not used for marketing or data-mining.

AI-assisted research summary: A bureau must verify the authenticity of the authority granted under paragraph (1) and may, for that purpose, use means it finds appropriate and reliable.

AI-assisted research summary: Bureaus may charge fees with the written approval of the Central Bank; they must apply for approval before increasing or introducing fees; the Central Bank may reduce approved fees; bureaus must publish charges and fees visibly and online.

AI-assisted research summary: Section 33 requires bureaus to implement quality control, keep customer information current and accurate, correct inaccurate information, ensure services are available and accessible, provide mechanisms for requesting credit reports, control access, maintain access and audit logs, review password controls, and develop operational guidelines to prevent improper or unauthorized access.

AI-assisted research summary: Bureaus must expunge customer information after specified retention periods and must notify customers within seven days of expunging; bureaus may retain certain information for up to five years; failure to expunge or notify attracts specified penalties.

AI-assisted research summary: Bureaus must establish procedures to regularly update customer information; institutions or third-party providers must update information immediately when it changes; bureaus must update their databases when provided updated information and in any case within two days of receipt; violating entities face a penalty not exceeding five hundred thousand shillings plus possible Central Bank sanctions.

AI-assisted research summary: Each bureau must take security and control measures to prevent unauthorized access or improper use of information, record subscriber access details and implement related policies, controls, training, reviews and an access log.

AI-assisted research summary: Customers may access and dispute credit information; bureaus and providers must investigate disputes within set timeframes and correct or delete errors, and bureaus must notify affected subscribers.

AI-assisted research summary: Institutions or third-party credit information providers may access the information they submitted to bureaus; the bureau must provide that information to the institution or provider on request, but only if it can be extracted from the database in its original form or content.

AI-assisted research summary: Bureaus must create credit scores for every person whose credit information they receive and must retain those scores for at least five years; the Central Bank may specify how scores are computed.

AI-assisted research summary: Institutions must consider customers' credit scores when appraising credit applications and pricing facilities; credit appraisals that use credit scores must be in writing and given to the customer; if an application is declined the institution must immediately notify the customer in writing with reasons; denying credit solely because of a credit score attracts a monetary penalty of two million shillings or other sanctions.

AI-assisted research summary: The Central Bank must publish and maintain a list of reciprocal arrangements for cross-border credit information sharing; requests must include specified information; receiving persons must analyse requests and may ask for more information; requested persons may furnish information or must notify if they will not share; violations are offences punishable by a fine up to ten million shillings and other sanctions.

AI-assisted research summary: A bureau licensed in Kenya may, with the approval of the Central Bank, establish a subsidiary, branch, agency or marketing unit outside Kenya for cross-border credit bureau business.

AI-assisted research summary: A bureau's management must vest in a board of directors of at least five directors (two-thirds non-executive); the directors must elect a non-executive chairperson; various convictions, insolvency, conflicts and related facts disqualify a person from holding office; the Central Bank may consider material information bearing on suitability.

AI-assisted research summary: The Board establishes the operations and information technology systems of the bureau.

AI-assisted research summary: The Board must hold meetings at least once every three months and may hold additional meetings as necessary; the quorum is at least three members unless there are more than five directors, in which case quorum is fifty per cent of all directors.

AI-assisted research summary: Board decisions are made by a majority vote of the directors who are present and voting.

AI-assisted research summary: A director must attend at least seventy-five per cent of the board meetings.

AI-assisted research summary: Boards may hold some meetings by video conference, but at least seventy-five percent of the quarterly meetings must be held in person in one location; the Central Bank may prescribe how board meetings may be arranged and held through video conferencing.

AI-assisted research summary: Each bureau must maintain sufficient capital and must submit capital adequacy information to the Central Bank at least once every three months; the Central Bank may specify minimum capital every bureau must maintain.

AI-assisted research summary: Lists grounds of disqualification for officers/employees and imposes penalties if a bureau allows a disqualified person to act or be employed: bureau liable up to 500,000 shillings; the disqualified person liable up to 100,000 shillings.

AI-assisted research summary: The Central Bank must certify a significant shareholder, director or senior officer as fit and proper when satisfied of their professional and moral suitability; it may request additional information to determine suitability.

AI-assisted research summary: A bureau licensed under these Regulations may be liquidated, either compulsorily or voluntarily, following the laws on company dissolution and winding up in Kenya.

AI-assisted research summary: If a bureau's shareholders resolve to wind up the bureau, the bureau must apply to the Central Bank for approval to voluntarily wind up and supply specified documents; the Central Bank may approve the liquidation subject to conditions or, if not satisfied, may give directions.

AI-assisted research summary: When a petition for winding up a bureau is lodged, the bureau must notify the Central Bank within seven days and must stop conducting bureau business immediately when a winding up order is made.

AI-assisted research summary: When a notice is given or voluntary dissolution is approved, the bureau must forward all bureau-business records, documents, data and other information to the Central Bank within seven days; the Central Bank may direct erasure and must verify erasure, and may take measures or take over information from a bureau being wound up or liquidated.

AI-assisted research summary: When a bureau is wound up under this Part, the Central Bank must notify all institutions and other bureaus of the winding up by notice in the Gazette.

AI-assisted research summary: The Central Bank has the power to issue, suspend or revoke a licence to conduct credit reference bureau business.

AI-assisted research summary: The Central Bank may order inspections of credit bureaus and their agents; those inspected must provide records and the inspector may copy materials; inspectors must report findings to the Central Bank; refusal or obstruction is an offence punishable by fine or imprisonment.

AI-assisted research summary: Information held by a bureau is the property of the Central Bank, ownership persists despite contrary agreements, and the Central Bank retains the right of access to data even after licence revocation or expiry.

AI-assisted research summary: Bureaux must provide the Central Bank with periodic reports of their business operations in the form and period the Central Bank specifies; failure (including incomplete, inadequate, inaccurate or late returns) makes a bureau liable to a penalty not exceeding five hundred thousand shillings.

AI-assisted research summary: A bureau must submit to the Central Bank its audited financial statements for the previous year by 31st March each year.

AI-assisted research summary: A person must not use information obtained under these Regulations for any purpose inconsistent with the Regulations; contravention is an offence with imprisonment up to two years or a fine up to one million shillings, and the Central Bank may impose penalties up to five hundred thousand shillings.

AI-assisted research summary: Institutions and third-party credit information providers must notify customers about listings and adverse actions, submit and update customer information to bureaus, correct inaccuracies promptly, provide centralized access to information, maintain complaint-handling units, and resolve complaints within specified times; non-compliance may attract penalties.

AI-assisted research summary: The Central Bank must approve any proposed third-party service provider and system for a central hub or industry tool, and the Central Bank may prescribe a framework for establishing and operating a central hub or centralized location for submission and access to credit information.

AI-assisted research summary: Institutions or third-party credit information providers must submit credit information to a bureau using a format or template agreed between information-furnishing institutions and approved by the Central Bank.

AI-assisted research summary: Notices to customers must include loan particulars; if the customer disputes the amount, the institution or credit information provider must investigate and inform the customer within fourteen days.

AI-assisted research summary: Lists permissible modes for serving notices (registered mail or certificate of posting; email; SMS to the customer’s registered phone number; or physical delivery with acknowledgement where the customer's physical address is known) and requires that a record of all notices be kept for at least seven years.

AI-assisted research summary: A person who knowingly or wilfully obtains information from a bureau under false pretence commits an offence and may be punished by up to two years' imprisonment or a fine of two hundred thousand shillings, or both.

AI-assisted research summary: Bureaus that have a credit information sharing arrangement with a third-party provider must publish and keep up-to-date a list of third-party credit information providers approved by the Central Bank, displayed prominently at their business premises and on their website.

AI-assisted research summary: Bureaus and institutions must run public education programmes about credit information sharing, including benefits, risks, service availability and how to access services.

AI-assisted research summary: Bureaux, their agents, subscribers and other persons or entities subject to the Regulations must comply with any guidelines or directives issued by the Central Bank.

AI-assisted research summary: Section 72 lets the Central Bank pursue remedial actions (including directing bureaus to delete or compensate, suspensions, prohibitions and payment recovery) where an institution contravenes the Regulations, requires at least seven days' written notice before imposing a penalty, and provides for payment mechanics including initial payment by the bureau and a ten-day payment period.

AI-assisted research summary: The Credit Reference Bureau Regulations, 2013, are repealed.

AI-assisted research summary: Continues validity and effect of prior licences, databases, reports, contracts and acts under the revoked 2013 Regulations by treating them as if done under the current Regulations.