The Banking (Credit Reference Bureau) Regulations

Section 1. Citation Section These Regulations may be cited as the Banking (Credit Reference Bureau) Regulations.

Section 2. Interpretation Section non-performing loan or credit default or late payment on all types of facilities or claims;

Section 3. Licensing of bureau business Section 3(1)(a) established and incorporated as a limited liability company under the Companies Act (Cap. 486); Section 3(1)(b) licensed under these Regulations; or Section 3(1)(c) is an agent of a bureau. Section 3(2) A person who contravenes the provisions of this regulation commits an offence and shall, on conviction, be liable to a fine of five hundred thousand shillings or to imprisonment for a term of two years or to both.

Section 4. Application for a licence Section 4(1) A person seeking to conduct bureau business shall apply to the Central Bank for a licence in the form set out in the First Schedule. Section 4(2)(a) certified copies of the applicant's certificate of incorporation and memorandum and articles of association; Section 4(2)(b) market analysis; Section 4(2)(b)(i) market analysis; Section 4(2)(b)(ii) the ownership structure of the company; Section 4(2)(b)(iii) governance and management structure of the company; Section 4(2)(b)(iv) business plan; Section 4(2)(b)(v) business continuity plan; and Section 4(2)(b)(vi) operation manuals of the business; Section 4(2)(c) sworn declarations by proposed directors, officers and significant shareholders in the form set out in the Second Schedule; Section 4(2)(d) development schedule of the software required for operation; Section 4(2)(d)(i) development schedule of the software required for operation; Section 4(2)(d)(ii) characteristics of products and services to be provided to subscribers; Section 4(2)(d)(iii) service provision policies and procedures manuals; and Section 4(2)(d)(iv) proposed security and control measures aimed at preventing misuse...

Section 5. Review of application Section 5(1) On receipt of an application under regulation (4), the Central Bank shall, within fourteen days from the date of receipt of the application, review the application and notify the applicant, where necessary, of any missing information which the applicant ought to have provided. Section 5(2)(a) the background, reputation, integrity, experience and capacity of the proposed significant shareholders, directors and senior officers of the applicant; Section 5(2)(b) the business plan of the applicant, including plans to undertake national coverage, the applicant's roll-out plan and a mechanism to integrate, gather, input, update and validate data; Section 5(2)(c) the design of data collection for customer information and flexibility in structuring the information; Section 5(2)(d) the adequacy of the applicant's capital structure; Section 5(2)(e) the availability of human, financial and operational resources necessary for the effective and efficient conduct of bureau business; Section 5(2)(f) the existence of adequate infrastructure for the collection of information and preparation of credit reports; Section 5(2)(g) the ability of the applicant...

Section 6. Inspection of systems and premises Section the suitability of the premises for bureau operations;

Section 7. Issuance of licence Section 7(1) Where the Central Bank is satisfied that the applicant meets the requirements for licensing, it shall issue an interim license in the form of a letter of intent to the applicant. Section 7(2)(a) a banker's cheque for one hundred thousand shillings payable to the Central Bank being licence fee; Section 7(2)(b) a statutory declaration by the applicant's chief executive officer in the form set out in the Third Schedule. Section 7(3) Where the applicant complies with the requirements of paragraph (2), the Central Bank shall issue a licence to conduct bureau business to the applicant. Section 7(4) The Central Bank may impose conditions on a licence issued under this regulation as the Central Bank may consider necessary and may, at any time, add, vary or substitute such conditions. Section 7(5) The Central Bank shall determine an application for a licence within ninety days from the date of receipt of information required under these Regulations: Provided that a licence shall not be granted where the applicant has not fully established the physical structure necessary to conduct bureau business including management information system. Section 7...

Section 8. Bank guarantees Section 8(1) Where a bureau is licensed under these Regulations, it shall, within thirty days of being granted the licence, submit to the Central Bank an irrevocable bank guarantee of one million shillings from a bank or a microfinance bank and such form as may be specified by the Central Bank. Section 8(2) Where a bureau is required to pay a penalty under these Regulations and fails to do so within the time specified by the Central Bank, the Central Bank may recover the amount due on the penalty from the bank guarantee issued under paragraph (1). Section 8(3) Where a penalty has been recovered from a bank guarantee in accordance with paragraph (2), the bureau shall, within thirty days of being notified, furnish the Central Bank with a new irrevocable bank guarantee of one million shillings in such form as may be specified by the Central Bank. Section 8(4) Where a bureau fails to comply with the provisions of this regulation, its licence shall be revoked.

Section 9. Refusal to issue a licence Section 9(1) A person aggrieved by the refusal of the Central Bank to issue a licence under these regulations may, within twenty-one days from the date of the refusal, apply to the Cabinet Secretary in writing for a review of the Central Bank's decision. Section 9(2) The Cabinet Secretary shall, while considering an application under paragraph (2), consider the material in the administrative record relating to the application for a license and may invite the Central Bank or the applicant or both to make presentations with respect to the application for review. Section 9(3)(a) the Central Bank failed to follow the laid down procedure; Section 9(3)(b) the decision was contrary to law; Section 9(3)(c) there was no factual basis for the decision; or Section 9(3)(d) based on a review of the record, there was a manifest error in the assessment of facts relating to the application for registration; or Section 9(3)(e) based on a review of the record, the Central Bank abused its discretion. Section 9(4) A person dissatisfied by the decision of the Cabinet Secretary may appeal to the High Court against the decision and the decision of the High Court shal...

Section 10. Notification of licensed bureaus Section The Central Bank shall, within thirty days from the date a licence has been issued to a bureau, by notice in the Gazette , notify members of the public of the name of the bureau and the date the licence was issued.

Section 11. Revocation or suspension of licenses Section 11(1)(a) does not commence business within twelve months from the date it was issued with a license; Section 11(1)(b) has ceased or suspended operations for a period exceeding three months; Section 11(1)(c) obtained the licence by providing wrong, false or misleading information or the concealment of material information which, if known at the time of evaluating the application for a licence, the bureau would not have been granted a licence; Section 11(1)(d) applies to the Central Bank for the revocation or suspension of the licence; Section 11(1)(e) has ceased to meet the requirements prescribed in these Regulations; Section 11(1)(f) has failed to comply with any conditions imposed on the licence; Section 11(1)(g) is insolvent or unable to effectively conduct its operations; Section 11(1)(h) has contravened the provisions of the Act, the Microfinance Act (Cap. 493C) the Sacco Societies Act (Cap. 490B) these Regulations or any other relevant written law; Section 11(1)(i) has engaged in activities which are restricted or not permitted under these Regulations; Section 11(1)(j) is unable or has consistently failed to protect the...

Section 12. Annual license fee Section 12(1) In this regulation, "anniversary date" means the period ending on the 31st December of each year. Section 12(2) A bureau shall be required to pay to the Central Bank an annual licence fee of one hundred thousand shillings. Section 12(3) The annual licence fee shall be paid on or before the anniversary date. Section 12(4) Where a bureau fails to pay the annual license fee by the end of the anniversary date, it shall pay a fee of two hundred thousand shillings within ninety days from the end of the anniversary date. Section 12(5) The Central Bank shall revoke the license of a bureau that fails to pay the annual license fee and, in the case of such failure, the fee prescribed by paragraph (4).

Section 13. Fees not refundable or payable pro rata Section refundable where the licence is cancelled or revoked or a Bureau ceases to carry on business at any time before the end of the year;

Section 14. License non-transferable Section 14(1) A person shall not transfer a licence granted to him by the Central Bank to another person. Section 14(2) A person who contravenes paragraph (1) commits an offence and shall be liable, on conviction, to a fine not exceeding five hundred thousand shillings.

Section 15. Activities of bureaus Section 15(1)(a) obtain and receive customer information; Section 15(1)(b) store, manage, evaluate, update and disseminate customer information to subscribers in accordance with these Regulations; Section 15(1)(c) compile and maintain a database of customer information; Section 15(1)(d) generate reports from the customer information database; Section 15(1)(e) develop a credit score for every customer whose credit information has been submitted to the bureau. Section 15(1)(f) sell to institutions specialized literature and other information material related to its activities; Section 15(1)(g) carry out, on its own or with another person approved by the Central Bank, market and statistical research relating to matters set out under these Regulations; Section 15(1)(h) conduct Know Your Customer due diligence on behalf of another person; and Section 15(1)(i) carry out any other activity as may be approved by the Central Bank in accordance with the Act, the Microfinance Act (Cap. 493C), the Sacco Societies Act (Cap. 490B) these Regulations or any other relevant written law. Section 15(2) A bureau shall not engage in any activity that is not specified in...

Section 16. Use of agents Section 16(1)(a) delivery of credit reports to requesting persons in accordance with these Regulations; Section 16(1)(b) sensitization of customers, institutions and other credit information providers; Section 16(1)(c) receiving and channelling complaints; and Section 16(1)(d) any other purpose as may be approved by the Central Bank on application by the bureau. Section 16(2) A bureau shall not contract an agent unless the proposed agent has been approved by the Central Bank: Provided that a person who has been approved by the Central Bank as an agent under the Banking Act or the Microfinance Act shall not need to be approved by the Central Bank for the purposes of rendering services under these Regulations but a bureau shall be required to obtain a letter of no objection from the Central Bank in respect of such an agent. Section 16(3) An application for approval of an agent shall be accompanied by a report on the suitability assessment of the proposed agent, the services to be rendered by the proposed agent and the application fees set out in the Third Schedule. Section 16(4) A bureau shall, at least two months before the end of each year, apply to the Ce...

Section 17. Actions requiring prior approval Section 17(1)(a) the appointment of directors and officers of the bureau; Section 17(1)(b) the acquisition of at least five per cent of the shares of a bureau by any person except as may be authorised by the Central Bank under these Regulations; Section 17(1)(c) the opening, relocation or closure of a place of business in or outside Kenya; Section 17(1)(d) the temporary closure of a place of business; Section 17(1)(e) the appointment of agents; Section 17(1)(f) changes in the memorandum and articles of association of the bureau; Section 17(1)(g) the passing of a shareholders' resolution to voluntarily wind up the bureau; Section 17(1)(h) the introduction of new products or services; Section 17(1)(i) fees payable by customers and any increase of such fees; Section 17(1)(j) for the sale, transfer or disposal of the shares or business of the Bureau; or a merger, amalgamation, acquisition, take over or assignment; and Section 17(1)(j)(i) for the sale, transfer or disposal of the shares or business of the Bureau; or a merger, amalgamation, acquisition, take over or assignment; and Section 17(1)(j)(ii) affecting the voting power, management or...

Section 18. Nature of information to be shared Section 18(1)(a) in the case of a natural person, the person's name, date of birth, national identity card number, personal identification number issued under the Tax Procedures Act (Cap. 469B), passport number, driving licence number, previous and current addresses, and any other contact details; and Section 18(1)(a)(i) in the case of a natural person, the person's name, date of birth, national identity card number, personal identification number issued under the Tax Procedures Act (Cap. 469B), passport number, driving licence number, previous and current addresses, and any other contact details; and Section 18(1)(a)(ii) in the case of a customer who is not a natural person, the customer's name, registration number, personal identification number issued under the Tax Procedures Act (Cap. 469B), names of directors, shareholders holding more than five per cent of its shares or partners, trustees or officials, former and current addresses, and any other contact details; Section 18(1)(b) the customer's credit status including the nature and amounts of loans or advances and other credit facilities advanced or granted, amounts outstanding t...

Section 19. Identification details Section Any credit information of a person shall be submitted to a bureau with such identification details as would enable the bureau to link the customer to all the customer's transactions with any other person.

Section 20. Protection from liability Section 20(1) A suit, prosecution or other legal proceedings shall not lie against the Central Bank, bureau, an institution or chairperson, director, member, auditor, adviser, officer or other employee or agent of the Central Bank, such bureau or institution or any other person authorised under these Regulations to submit, receive, use or share credit information, for any loss or damage caused or is likely to be caused by anything which is done or intended to be done in good faith in pursuance of these Regulations or guidelines issued hereunder. Section 20(2) Nothing contained in paragraph (1) shall affect the right of any person to make a claim against the Central Bank, a bureau, an institution or chairperson, director, member, auditor, adviser, officer or other employee or agent of the Central Bank, such bureau or institution, as the case may be, in respect of loss or damage caused to him on account of any such disclosure made by anyone of them and which is unauthorised or fraudulent or contrary to provisions of these Regulations, guidelines or any other law to which these Regulations relate. Section 20(3) A person who has been made liable fo...

Section 21. Prohibited information Section 21(1) A bureau shall not include in its database or a credit report personal information of a customer relating to race, belief, colour, ethnic origin, religion, political affiliation, sexual orientation, physical and mental handicaps, state of health or medical information. Section 21(2) Despite paragraph (1), any information relating to Sharia-compliant products shall not be considered to contravene this regulation.

Section 22. Form of consent Section 22(1) Where the consent of a customer is required under these Regulations for the submission or sharing of credit information, such consent may be obtained by the customer signing any document giving express consent or authorisation for the sharing of credit information. Section 22(2) The documents under paragraph (1) may include account-opening documents, loan application forms, loan agreements or any other agreement document between an institution and the customer or the customer and a third-party credit information provider or by any other documentary means as may be convenient or agreeable between the parties. Section 22(3) A customer may give consent through oral, print or electronic means, subject to the satisfaction of the Bureau or institution as to the authenticity of the electronic consent.

Section 23. Disclosures Section 23(1) A bureau or agent shall, before making a disclosure under these Regulations, require a customer to identify himself or herself. Section 23(2) A disclosure by a bureau or agent may be made in writing, in person, during normal business hours, and, on reasonable notice, by telephone, email or any other electronic means, if available to the Bureau or agent, as the requesting person may choose. Section 23(3) The customer may be accompanied by one other person of his or her choice, who shall furnish reasonable identification before he or she is allowed, on the instructions of the customer, to have access to the customer information. Section 23(4) A bureau or agent shall require the customer to grant written or oral permission to discuss the customer's information whenever a third party is present and where the third party is authorised to act on behalf of the customer in respect of the customer's information. Section 23(5) A bureau shall appoint trained personnel to explain to the customer any information furnished to the customer where such explanation is needed by the customer.

Section 24. Other sources of information Section 24(1)(a) the Business Registration Service established under the Business Registration Service Act (Cap. 499B); Section 24(1)(b) registrar of business entities; Section 24(1)(c) business and trade licensing authorities; Section 24(1)(d) Land Registrars appointed under section 12 of the Land Registration Act (Cap. 300); Section 24(1)(e) the Kenya Revenue Authority established under the Kenya Revenue Authority Act (Cap. 469); Section 24(1)(f) county governments and county government entities; Section 24(1)(g) court registries in respect of information on judgments on debts, insolvency or bankruptcy proceedings or winding up orders; Section 24(1)(h) registration officers appointed under the Registration of Persons Act (Cap. 107); Section 24(1)(i) other relevant public bodies. Section 24(2) An application for the approval of a third-party credit information provider shall be accompanied by the application fees specified in the Fourth Schedule and a suitability assessment report detailing the information set out in paragraph (4). Section 24(3)(a) the conditions for the provision of information; Section 24(3)(b) the obligation to furnish a...

Section 25. Use of public data by bureaus Section 25(1)(a) the bureau shall take such reasonable measures to confirm the accuracy and authenticity of the information from a source that has independent and direct knowledge of the information; and Section 25(1)(b) the bureau shall, where such information relates to any court proceeding of a civil or criminal nature or any public record, verify the accuracy and authenticity of the information not more than twenty-one days before the date on which the information is included in any report. Section 25(2) Each bureau shall periodically report to the Central Bank the sources and details of the public data included in its reports and the measures or process undertaken confirm the accuracy and authenticity of the data. Section 25(3) Where a bureau has included in any report information from public sources, and the Central Bank is satisfied that a bureau did not take all reasonable measures to confirm the accuracy and authenticity of the data, the Central Bank shall direct the Bureau to delete the information from its database and, in addition, impose a penalty not exceeding five hundred thousand shillings.

Section 26. Duty to notify customer of furnishing of negative information to bureau Section 26(1) A credit information provider who furnishes negative information to a bureau with respect to a customer shall, in writing or through electronic means, notify the customer of the intention to submit the negative information at least thirty days before submitting the negative information to the bureau or within such shorter period as the contract between the credit information provider and the customer may provide. Section 26(2) The provisions of paragraph (1) shall not be mandatory with respect to the furnishing of positive information of a customer to a bureau by a credit information provider. Section 26(3) A credit information provider shall not furnish any information relating to a customer to any bureau if the credit information provider knows or has reasonable cause to believe that the information is inaccurate. Section 26(4) A credit information provider shall not furnish information relating to a customer to any bureau if the credit information provider has been notified by the customer, in writing or verbally, at the address specified by the credit information provider for such...

Section 27. Confidentiality of customer information Section 27(1)(a) to the customer; Section 27(1)(b) to the Central Bank; Section 27(1)(c) to a requesting subscriber; Section 27(1)(d) to a third party as authorised by the customer concerned; or Section 27(1)(e) as required by the Act, Microfinance Act (Cap. 493C) the Sacco Societies Act (Cap. 469B) these Regulations or any other relevant written law. Section 27(2) Except as otherwise provided under paragraph (1), a director, member, officer or other employee or agent employed in the business of a bureau or a subscriber shall not disclose any information to any person and this obligation shall continue to apply even after termination of tenure, employment or relationship with the bureau or subscriber. Section 27(3) A director, member, officer or other employee or agent of a bureau or subscriber who contravenes the provisions of paragraph (2) commits an offence and shall be liable, upon conviction, to imprisonment for a term not exceeding two years or to a fine not exceeding five hundred thousand shillings, or to both. Section 27(4) The Central Bank may, in lieu of prosecution under paragraph (3), impose such sanctions against the...

Section 28. Responsibilities of a bureau Section 28(1)(a) utilize the information collected solely for the purposes set out in these Regulations; Section 28(1)(b) take reasonable measures to ensure that customer information maintained by it is protected from unauthorized access, use, modification or disclosure; Section 28(1)(c) ensure that customer information maintained by it is not charged or encumbered for any purpose; Section 28(1)(d) ensure that customer information is obtained from reliable and credible sources which take responsibility for the accuracy, completeness and timeliness of the information; Section 28(1)(e) observe, through its shareholders, directors, officers, employees or agents, a perpetual duty of confidentiality with regard to all customer information; Section 28(1)(f) accept without charge the filing of customer credit information from the customer for the purpose of correcting or challenging information otherwise held by that bureau concerning that customer; Section 28(1)(g) take reasonable measures to verify the accuracy of any customer credit information submitted to it; Section 28(1)(h) retain customer credit information submitted to it for the prescribe...

Section 29. Customer rights Section 29(1) Each bureau shall prepare a summary of the rights of customers. Section 29(2)(a) the right of a customer to obtain a free copy of a credit report from the bureau; Section 29(2)(b) the frequency and circumstances under which a customer is entitled to receive a credit report from the bureau, with or without charge; Section 29(2)(c) the right of a customer to dispute information about the customer held by the bureau; Section 29(2)(d) the right of a customer to obtain a credit score from the bureau and a description of how the credit score was arrived at; Section 29(2)(e) the method by which a customer can contact and obtain a credit report from the bureau without charge; and Section 29(2)(f) the right of a customer to refer a dispute to an alternative dispute resolution mechanism, a court of law or the Central Bank where the customer feels that a dispute has not been resolved to the customer's satisfaction. Section 29(3) A bureau may publish any other information which may be useful to its customers. Section 29(4)(a) publicise the availability of the summary of rights; Section 29(4)(b) conspicuously post on its website and business premises th...

Section 30. Subscribers' obligations in respect of information obtained from bureaus Section 30(1) A subscriber of information from a bureau shall not use such information for any purpose other than for reaching decisions on transactions concerning a customer and on matters concerning an employee or a potential employee of the subscriber or for any other purpose as may be authorised under these Regulations. Section 30(2) A subscriber shall not release information obtained from a bureau to any third party except as may be required under the Act, the Microfinance Act (Cap. 493C), the Sacco Societies Act (Cap. 490B), these Regulations or any other relevant written law, or to a subscriber's appointed agent for the purpose of assisting the subscriber in the recovery of any of subscriber's debts. Section 30(3)(a) the subscriber's customer or has applied for credit facilities from the subscriber; or Section 30(3)(b) the subscriber's employee or has applied for employment by the subscriber. Section 30(4)(a) properly and accurately recorded and maintained; Section 30(4)(b) protected against loss; and Section 30(4)(c) protected against unauthorised access, use, modification or disclosure. Se...

Section 31. Receipt of credit reports by third parties Section 31(1)(a) the assessment of a credit facility; Section 31(1)(b) employment; Section 31(1)(c) underwriting insurance; Section 31(1)(d) the determination of the customer's eligibility for a licence or benefit issued or granted by the Government; Section 31(1)(e) the assessment of the credit or prepayment risks associated with an existing credit obligation; or Section 31(1)(f) a legitimate need for information in connection with a business transaction initiated by the customer or other lawful transaction or matter concerning the customer. Section 31(2) A bureau shall verify the authenticity of the authority granted under paragraph (1) by the customer and may, that purpose, use such means as the bureau may find appropriate and reliable.

Section 32. Restrictions on fees charged by bureaus Section 32(1) A bureau may, with the written approval of the Central Bank, charge fees for its services. Section 32(2) Each bureau intending to increase its fees or to introduce a new fee shall apply in writing to the Central Bank for approval before such increase or introduction. Section 32(3) An application under paragraph (2) shall state the reasons for the increase of the fee or the imposition of the new fee, the impact of the increase or introduction on consumers and comparative rates in the market. Section 32(4) The Central Bank may review downwards any approved fees or charges if, in its opinion, the circumstances render it necessary. Section 32(5) A bureau shall publish its charges and fees in a conspicuous place within its business premises and its website.

Section 33. Data management and quality control Section 33(1)(a) implement quality control procedures in order to ensure the accuracy of its database and continuity of its services; Section 33(1)(b) take all such necessary steps to ensure that customer information maintained by it is current, authentic, legitimate, reliable, accurate, truthful and reflects the existing situation of the subject at any given time; Section 33(1)(c) where customer information is found to be inaccurate or no longer valid, take the necessary corrective measures to remedy the inaccuracy or address the invalidity; Section 33(1)(d) ensure that its services are reasonably available and accessible; Section 33(1)(e) develop mechanisms for easy request for and accessibility of credit reports in physical or electronic form or any other convenient and cost-effective way and may include fax, telephone, mail, email, internet or in person; Section 33(1)(f) establish controls and procedures on accessing credit reports by subscribers; Section 33(1)(g) maintain logs of all accesses, amendments and audit trails to information database including historical enquiry records and logs of all incidents involving proven or sus...

Section 34. Retention of information Section 34(1)(a) until the expiry of five years from the date of final settlement of the amount in default including the settlement of the amounts payable under a scheme of arrangement; or Section 34(1)(b) until the expiry of seven years from the date of the customer's discharge from bankruptcy as notified to the bureau by the customer: Section 34(2) Each bureau may, with respect to information not specified in paragraph (1), retain such information for a period not exceeding five years from the date of submission of the information or receipt of the information by the bureau. Section 34(3) A bureau shall, on the expiry of the periods specified in paragraphs (1) and (2), expunge from its database the relevant customer information. Section 34(4) A bureau shall, within seven days from the date of expunging customer information under paragraph (3), notify the relevant customer that the information is no longer held by the bureau. Section 34(5) Any Bureau that fails to expunge customer information which ought to be expunged from its database or fails to notify a person pursuant to paragraph (4) shall be liable to pay a penalty of five hundred thousa...

Section 35. Updating customer information Section 35(1) Each bureau shall establish procedures for regularly updating customer information held or controlled by the bureau. Section 35(2) An institution or a third-party credit information provider that furnishes customer information to a bureau shall update the relevant customer information immediately there is a change in the information. Section 35(3) Each bureau shall update its database as and when information is provided by the institutions responsible for the timely updating of the information in accordance with the nature of the information and in any case, within two days from the date of receipt of the updated information. Section 35(4) A bureau or institution that violates any provision of this Regulation shall be liable to a penalty not exceeding five hundred thousand shillings in addition to any other sanction that the Central Bank may impose.

Section 36. Security and control measures Section 36(1) Each bureau shall take the necessary security and control measures to prevent unauthorized access to, or improper use or mismanagement of information. Section 36(2) For the purposes of paragraph (1), improper use or mismanagement of information means any act or omission that is not authorized by these Regulations. Section 36(3) Each bureau shall record and make available to the customer the name and date each subscriber accesses customer information about the customer. Section 36(4)(a) develop written policies and procedures for its officers, employees, agents and contractors, or any other person providing services to the bureau; Section 36(4)(b) impose access authentication controls including the use of passwords, digital signatures or other mechanisms as may be necessary for security controls; Section 36(4)(c) provide information and training to its employees to ensure compliance with the policies, procedures and controls; Section 36(4)(d) systematically review, and where necessary, remedy the effectiveness of the policies, procedures and controls; and Section 36(4)(e) establish and maintain an access log.

Section 37. Customers' rights of access and correction Section 37(1) A customer has a right to know what information the institution has submitted to the Bureau regarding that customer. Section 37(2) A customer shall be entitled to access credit reports relating to the customer that are kept in a database administered by a bureau. Section 37(3)(a) at least once per year; Section 37(3)(b) within thirty days of receiving an adverse action notice issued under regulation 63 (1) (c); and Section 37(3)(c) once in every six months after making a request to a bureau to have inaccurate information corrected. Section 37(4) Where a customer requests a credit report under paragraph (2), the bureau shall, within five working days after receiving the request and such particulars as the bureau may reasonably require to enable it identify the customer, provide to the customer a copy of all customer information relating to the customer held by the bureau. Section 37(5) Where the customer knows or has reason to believe that the information contained in the database is inaccurate, erroneous or outdated, the customer may notify the bureau in writing of the information disputed. Section 37(6)(a) attach...

Section 38. Access to own information Section Each institution or third-party credit information provider may access the information it has submitted to bureaus and bureau shall avail the information to that institution or third-party credit information upon request and only if it can be extracted from the database in its original form or content.

Section 39. Credit scores Section 39(1) Each bureau shall develop a credit score for every person whose credit information has been submitted to the bureau. Section 39(2) A credit score may be computed in such manner and may have such details as the Central Bank may specify. Section 39(3) Every credit report shall contain a credit score of the person to whom the report relates: Provided that this paragraph shall not apply to a person whose credit information has not been submitted to a bureau. Section 39(4) Each bureau shall retain for a period of at least five years the credit scores of any person in its possession or control.

Section 40. Use of credit scores Section 40(1) A customer's credit score shall not be used solely to deny the customer a loan, credit facility or any other financial service but shall be used as one of the factors to inform the decision-making process when determining the customer's application for a loan, credit facility or any other financial service. Section 40(2) Each institution shall consider a customer's credit score in appraising a customer's credit application and in the pricing of a credit facility to that customer. Section 40(3) A credit appraisal integrating a customer's credit score shall be in writing and provided to the customer as part of its notification to the customer on the customer's credit application. Section 40(4) Where a customer's credit application has been declined, the institution shall immediately and in writing notify the customer of the decision and shall specify the reasons for the decision. Section 40(5) An institution that denies a customer a credit facility or any other financial service solely on the basis of a credit score shall be liable to a monetary penalty of two million shillings or such other sanctions under the Act, the Microfinance Act...

Section 41. Authority to share cross-border credit information Section 41(1)(a) regulators or supervisory authorities and credit reference bureaus or entities performing regulatory or supervisory roles; and Section 41(1)(b) institutions and credit reference bureaus or entities performing similar roles. Section 41(2) The sharing of information under paragraph (1) shall only apply where there is a reciprocal arrangement between the persons sharing cross-border information. Section 41(3) The Central Bank shall publish in its website or in any other manner and maintain an up-to-date a list of reciprocal arrangements under paragraph (2). Section 41(4)(a) the complete identity details of the requesting person including details of its principal place of business; Section 41(4)(a)(i) the complete identity details of the requesting person including details of its principal place of business; Section 41(4)(a)(ii) the nature of its business or functions; Section 41(4)(a)(iii) the identity details of the person whose information is sought; Section 41(4)(a)(iv) the nature of credit information that is being sought; Section 41(4)(a)(v) the purpose for which the information sought will be used an...

Section 42. Establishment of places of business outside Kenya Section A bureau licensed in Kenya may, with the approval of the Central Bank, establish a subsidiary, branch, agency or marketing unit outside Kenya for the purposes of cross-border credit bureau business.

Section 43. Management and composition of a bureau Section 43(1) The management of a Bureau shall vest in a board of directors consisting of at least five directors, two-thirds of whom shall be non-executive directors. Section 43(2)(a) has been approved by the Central Bank for that purpose; and Section 43(2)(b) is not otherwise disqualified from holding office as a director of a bureau under these Regulations. Section 43(3) The directors of a bureau shall elect from among themselves a non-executive chairperson. Section 43(4)(a) that person's possession of adequate professional credentials or experience or both for the position for which he is proposed; Section 43(4)(b) that person's ability to provide dispassionate advice; Section 43(4)(c) that person's ability to recommend sound business practices; Section 43(4)(d) that person's ability to avoid conflicts of interest; Section 43(4)(e) that person's ability to safeguard confidential information; Section 43(4)(f) any other material information which in the opinion of the Central Bank has a bearing on the suitability of the person. Section 43(5)(a) has been convicted of an offence under the Act, the Microfinance Act (Cap. 493C) the S...

Section 44. Functions of the Board Section establish the operations and information technology systems of the bureau;

Section 45. Meetings of the Board Section 45(1) The Board shall hold its meetings at least once in every three months but may hold such additional meetings as circumstances may render necessary. Section 45(2) The quorum for meetings of the Board shall be at least three members, but where the Board is comprised of more than five directors, the quorum shall be at least fifty per cent of all directors.

Section 46. Decisions of the Board Section The decisions of the Board shall be by a majority vote of the directors who shall be present and voting.

Section 47. Attendance of meetings Section A director shall attend at least seventy-five per cent of the meetings of the board.

Section 48. Videoconference Section 48(1) A Board may hold some of its meetings through video conference but at least seventy-five percent of the quarterly meetings referred to in paragraph (5) shall be held in person in one location. Section 48(2) The Central Bank may prescribe the manner in which meetings of the Board may be arranged and held through video conferencing.

Section 49. Capital Section 49(1) Each bureau shall maintain sufficient capital to enable it to run its operations efficiently and soundly. Section 49(2) Each bureau shall, at least once in every three months, submit to the Central Bank information on its capital adequacy status. Section 49(3)(a) submit a capital restoration plan; Section 49(3)(b) restrict its activities; or Section 49(3)(c) take such other action or to refrain from such action as the Central Bank may specify. Section 49(4) The Central Bank may specify the minimum capital which every bureau shall maintain.

Section 50. Disqualification of officers and employees Section 50(1)(a) an undischarged bankrupt or enters into a composition or scheme of arrangement with his creditors; Section 50(1)(b) convicted of an offence involving fraud or dishonesty; or Section 50(1)(c) removed from office in accordance with the Act, the Microfinance Act (Cap. 493C), the Sacco Societies Act (Cap. 490B), or these Regulations. Section 50(2) Where a bureau allows a disqualified person to continue acting as an officer or being in employment, or is otherwise in breach of this regulation, it shall be liable to a penalty not exceeding five hundred thousand shillings and the disqualified person acting as an officer or employee shall be liable to pay a fine not exceeding one hundred thousand shillings.