ADVOKS GLOBAL · KENYA
The Banking (Credit Reference Bureau) Regulations
28. Responsibilities of a bureau
Edition: 2022-12-31 · In force
28. Responsibilities of a bureau
(1)A Bureau shall —(a)utilize the information collected solely for the purposes set out in these Regulations;(b)take reasonable measures to ensure that customer information maintained by it is protected from unauthorized access, use, modification or disclosure;(c)ensure that customer information maintained by it is not charged or encumbered for any purpose;(d)ensure that customer information is obtained from reliable and credible sources which take responsibility for the accuracy, completeness and timeliness of the information;(e)observe, through its shareholders, directors, officers, employees or agents, a perpetual duty of confidentiality with regard to all customer information;(f)accept without charge the filing of customer credit information from the customer for the purpose of correcting or challenging information otherwise held by that bureau concerning that customer;(g)take reasonable measures to verify the accuracy of any customer credit information submitted to it;(h)retain customer credit information submitted to it for the prescribed period, irrespective of whether that information reflects positively or negatively on the consumer;(i)maintain records of customer credit information in accordance with the Act, these Regulations or any other relevant written law;(j)promptly expunge from its records any prescribed customer credit information that is not permitted to be entered in its records or is required to be removed from its records in accordance with the Act, the Microfinance Act (Cap. 493C) the Sacco Societies Act (Cap. 490B) these Regulations or any other relevant written law;(k)issue a report to any person who requires it for a prescribed purpose or a purpose contemplated in these Regulations, upon payment of the bureau's fee except where such a fee has been specified;(l)not knowingly, recklessly or negligently provide a report to any person containing inaccurate information;(m)establish and maintain a complaints' resolution mechanism including by establishing a dispute resolution unit to handle queries or complaints and a dedicated telephone line for contact purposes;(n)include in every report issued, the name of the institution or third-party credit information provider which has submitted a negative credit information on any person;(o)maintain a database which can be searched using either a natural person's national identity card number, passport number, Personal Identification Number issued under the Tax Procedures Act (Cap. 469B), or any other valid identification number and in the case of a corporate entity or any other unincorporated entity, the Personal Identification Number of the entity and the identity card numbers and Personal Identification Numbers of their respective directors or officials, as the case may be;(p)not keep in its database such customer information which ought not to be kept in the database;(q)not delete or remove from its database any credit information which ought to remain in its database;(r)not issue a credit report that erroneously represents the status of credit information of a customer; and(s)analyze information submitted to it and establish any existing relationships between corporate entities, unincorporated entities and natural persons whose data has been submitted to the bureau.(2)A bureau shall enter into a non-exclusive agreement or arrangement with a third-party credit information provider for credit information sharing and any other bureau may also enter into a similar agreement or arrangement with the same third-party credit information provider for credit information sharing.(3)A bureau shall only release customer information to a subscriber—(a)that requires the customer information to —(i)evaluate the customer's application for credit or other customer-initiated business transaction;(ii)for the recovery of any sum due to the institution;(iii)for customer account management, fraud detection and prevention, credit rating, employment evaluation, tracing owners of unclaimed assets, development of a scoring system, assessment of a debtor's books of business; and(iv)for any other purpose approved by the Central Bank;(b)that has certified to the bureau that it shall use the customer information for the purpose of making a lawful or permitted decision only; and(c)that has agreed to properly destroy customer information in such a manner that it cannot reasonably be read or reconstructed.(4)A bureau shall not, in the first instance, charge any fee in respect of a clearance certificate issued to a person for any purpose.(5)A bureau which fails or refuses to comply with the provisions of this regulation shall be liable to pay a penalty not exceeding five hundred thousand shillings and any other administrative sanction as the Central Bank may determine.