Ministerial Resolution No. 36 of 2019 Issuing the Executive Regulations of Law No. 9 of 2019 on Regulating the Exchange of Credit Information

Ministerial Resolution No. 36 of 2019
Issuing the Executive Regulations of Law No. 9 of 2019 on Regulating the Exchange of Credit Information

Article One

The provisions of the Executive Regulations of Law No. (9) of 2019 on Regulating the Exchange of Credit Information, the text of which is attached to this Resolution, shall be applied.

Article Two

This Resolution shall come into force from the date of its publication in the Official Gazette.

Executive Regulations of Law No. (9) of 2019 on Regulating the Exchange of Credit Information

Chapter One: Rules and Conditions for Licensing a Credit Information Company

Article 1

A register shall be established at the Central Bank of Kuwait for the registration of the credit information companies that are licensed. The Board of Directors of the Central Bank shall determine the particulars to be entered in this register.

Article 2

Applications for the incorporation of a credit information company shall be submitted to the Central Bank of Kuwait, including the following particulars and documents:
1- The applicant’s name and address.
2- A market and feasibility study for establishing the company, including its objects, its services, the mechanism for setting the prices of services, and the organisational structure of the company.
3- Copies of the proposed memorandum of association and articles of association of the company, and a statement of the names of the founders, their qualifications, their experience and the share of each of them.
4- The amount of the company’s capital.
5- The proposed name of the company.
6- Any other information, particulars or documents requested by the Central Bank.
The applications shall be referred to the Board of Directors of the Central Bank of Kuwait to decide on initial approval or rejection, taking into account the extent of the market’s need for the establishment of the company applied for.

Article 3

The incorporation procedures of the company shall be completed within a period not exceeding six months from the date on which the Central Bank issues its initial approval of the incorporation of the company. This period may be extended for a similar period or periods after obtaining the prior approval of the Central Bank of Kuwait, upon a written request setting out the justifications for the extension request.

Article 4

After the incorporation procedures of the company are completed, the company shall submit to the Central Bank an application for a licence to carry on the activity of credit reporting and credit rating services and for registration in the register kept by it for this purpose, after payment of the fees determined by a resolution of the Board of Directors of the Central Bank of Kuwait. The following documents shall be attached to the application:
1- The resolution of the Ministry of Commerce and Industry approving the incorporation of the company.
2- A copy of the articles of association and the memorandum of association after notarisation.
3- The opening balance sheet certified by the auditor.
4- A copy of the minutes of the General Meeting of the company appointing the Board of Directors, and the resolutions issued by the Board of Directors electing the Chairman of the Board and appointing the Chief Executive Officer of the company and his deputies and assistants, after the requirements of Article (9) of the Law have been fulfilled.
5- Submission of evidence of the availability of the systems, equipment and technical means necessary for the performance of the company’s work, including the following:
a- Advanced and secure means of communication for the exchange of data and information.
b- The availability of protection and security systems for all the company’s assets, in a manner that ensures full protection of data and information.
c- Work procedure manuals, and risk management policies and procedures, including procedures for mitigating operational risks and any legal risks that may be associated with its activity.
d- Plans for dealing with disasters and for the retrieval of information and data in emergencies.
6- Any other documents or particulars requested by the Central Bank.

Article 5

The Board of Directors of the Central Bank shall issue a resolution registering the company in the register and licensing it to provide credit reporting and credit rating services; the company shall be notified of the resolution, and it shall be published in the Official Gazette. The company is prohibited from carrying on the activity before its registration in the register.

Article 6

Companies registered in the register of credit information companies shall notify the Central Bank of any amendment they intend to make to the memorandum of association or the articles of association. If the Central Bank initially approves the making of that amendment, the procedures necessary for completing it shall be taken in accordance with the provisions of the Companies Law.
As for other particulars subject to registration in the register that do not involve an amendment to the memorandum of association and the articles of association, the approval of the Governor of the Central Bank of Kuwait shall suffice to amend the entries relating to them.
The amendment shall be made by a resolution of the Governor of the Central Bank of Kuwait, and the amendment may not take effect until an annotation of it has been made in the register at the Central Bank.

Article 7

Subject to the provisions of the Companies Law, the company may not cease its activity or enter into a merger with another company except after obtaining the prior approval of the Central Bank. The Central Bank shall determine the mechanism for transferring to the Central Bank the data, information, records and credit information reports held by the company upon its dissolution.

Chapter Two: Rules for the Exchange of Information and Data

Article 8

To obtain a credit information report, the purpose of the inquiry shall be legitimate, such as the following:
1- The issuance of a court judgment or a judicial order.
2- The granting, renewal or rescheduling of loans, financing operations and credit facilities.
3- The acceptance of a surety or a guarantee.
4- Assessing creditworthiness, determining the credit rating and reviewing the credit position of the credit applicant for the purpose of assessing the credit risk relating to him.

Article 9

The inquirer shall follow the work systems and procedures prescribed by the company to obtain the data requested in the inquiry and the credit information report, as follows:
a- Submitting the application in accordance with the approved mechanisms.
b- Complying with the method and manner specified by the company for obtaining credit information reports.
c- Paying the fees prescribed for that.
d- Using the credit information report for the purpose for which it was requested, without disclosing the information and data contained in it to any other party.

Article 10

Providers of information and data shall:
a- Provide the company with the credit data and information of clients in accordance with the procedures and rules followed by the company and approved by the Central Bank of Kuwait.
b- Set up the systems in use at their end in a manner that ensures the submission of their clients’ data and credit information to the company, and bear responsibility for its accuracy, completeness and updating, in accordance with the forms and the mechanism consistent with the work systems in use at the company.
c- Notify the company of any legal proceedings taken in respect of clients within a period not exceeding ten working days from the date the proceeding was taken, in accordance with the systems and the mechanism in use at the company.
d- Notify clients of the credit information relating to them in accordance with what is contained in the credit information report.

Chapter Three: Complaints

Article 11

The client has the right to submit a complaint to the company on the form prepared for this purpose and in accordance with the procedures followed by the company, to object to the accuracy of the information and data contained in the credit information report relating to him, within fifteen days from the date on which he was notified of the report.
The company shall enter the complaint in the automated system for recording complaints within three working days from the date of receiving the complaint.

Article 12

The company shall examine the complaint within fifteen days from the date of its receipt, make whatever correction is necessary to any of the information and data contained in the credit information report if it becomes apparent that there is an error in the operation and processing carried out by the company, and notify the client and the inquiring party accordingly.
If it becomes apparent to the company that there is an error in the information and data provided to it, the provider of the information and data shall be notified – within five days from the date of receiving the complaint – to examine the complaint, make whatever correction is necessary and inform the company accordingly within three days. In all cases, the company shall notify the client no later than fifteen days from the date of receiving the complaint.
If substantial amendments are made to the credit information report – as a result of the examination of the complaint by the company or by the provider of the information and data – all inquirers who have previously made an inquiry and obtained the credit information report during the three months preceding the making of the amendments shall be notified.

Article 13

Credit information reports issued while a complaint is being examined shall include an indication that a complaint has been submitted and is under examination.

Article 14

The client may file a grievance with the Central Bank within fifteen days from the date on which the company notified him of the result of the examination of the complaint he submitted. The Central Bank shall decide on this grievance within fifteen days.

Chapter Four: Rules Governing the Work of the Company, Operation and Data Processing

Article 15

The company shall:
a- Put in place advanced automated systems and take measures that ensure the preservation of the confidentiality of information and data, and that prevent their misuse or access to them by unlawful means or by unauthorised persons.
b- Not store or keep any of the information or data relating to clients with any party except after obtaining the prior approval of the Central Bank of Kuwait.
c- Put in place the authority matrix, policies and work procedures necessary for the proper conduct of work at the company, including the rules, standards and technical means that enable the exchange of information in accordance with the provisions of this Law, and review them periodically in a manner that ensures the integrity of the databases.
d- Prepare unified forms for inquiries and for the credit information reports issued by the company, and specify the procedures to be followed in this regard.
e- Prepare data and information forms for clients, to be complied with by the providers of credit data and information, in accordance with procedures that ensure their completeness and accuracy.
f- Adopt corrective measures for any error in data and information resulting from their collection and preparation, and put in place appropriate mechanisms for informing the persons concerned of those errors.
g- Draw up a list of the services provided by the company specifying the fees prescribed for each service, and publish the list approved by the Central Bank on the company’s website.
h- Publish the mechanism and the forms used by clients to submit complaints on the company’s website.

Article 16

The company shall keep the credit information and data held by it on repaid loans and financing operations for a period of not less than ten years.

Article 17

The company shall provide the latest equipment and technical means necessary for establishing and operating systems and databases in accordance with international best practices in the field of information security and risk management.

Article 18

The company shall put in place the systems and procedures that ensure the collection, matching and recording of the credit information and data relating to clients, and their processing and analysis, in a manner that ensures the achievement of the company’s objects.

Article 19

The company shall put in place a credit rating system for clients – to be approved by the Central Bank – in order to provide a numerical assessment based on statistical foundations relying on the current and historical credit behaviour of the client, for the purpose of determining the degree of risk associated with the client’s repayment of his future obligations.
The company shall also obtain the prior approval of the Central Bank before offering any new service or product.

Article 20

The company shall take the measures necessary to ensure information security and data confidentiality, and shall review those measures periodically. They shall include, at a minimum, the following:
a- Putting in place a physical security system for the site of the databases and operating systems that covers all risks.
b- Establishing an alternative emergency centre for the company to deal with any potential risks or disasters, and completing the periodic tests necessary to ensure the readiness of the emergency centre.
c- Adopting backup systems and putting in place plans for the retrieval of information and data and for business continuity in emergencies in a secure manner.
d- Providing secure means of communication for the exchange of information and data.
e- Providing protection systems for software and databases, and putting in place an emergency plan to deal with breaches.
f- Putting in place effective operational controls to tighten oversight of the procedures for using the automated systems and databases and of the access rights to them.

Chapter Five: Provision of Information and Data

Article 21

Providers of information and data are responsible for the accuracy and correctness of the data and information provided to the company, and shall comply with the rules and procedures prescribed by the company in this regard.

Chapter Six: Supervision of the Company

Article 22

The activities of the company are subject to the supervision of the Central Bank of Kuwait – off-site and on-site – to monitor the extent of compliance with the Law and the rules issued in implementation of it. The Central Bank may request the information, data and reports that achieve supervision of the company’s activities, within the time limits it specifies.

Article 23

The Central Bank has the right of access – at any time – to the company’s credit reporting system for the purpose of obtaining credit data and information, and of auditing and examining the system to ascertain its efficiency and reliability and that it does not contravene the Law, the Executive Regulations and the instructions issued in this regard.

Article 24

The fees charged by the company for the services it provides shall be determined in proportion to the actual cost of each of them, provided that the prior approval of the Central Bank is obtained for these fees or upon amending them.

Article 25

The company shall submit to the Central Bank, within three months from the date of the end of its financial year, the final financial statements of the company.

Article 26

The company shall notify the Central Bank immediately of any breach of its systems, and of the measures the company takes to mitigate operational risks and any legal risks associated with its activity.

Article 27

The Governor of the Central Bank may, if the need arises, issue instructions to the company to suspend its business temporarily. The company shall resume its business by instructions issued by the Governor after verifying that the necessary measures have been taken.

Chapter Seven: General Provisions

Article 28

The Ministry shall issue instructions to the companies and establishments subject to its supervision on the rules and controls relating to credit facilities resulting from instalment sales of goods and services, in a manner consistent with the instructions issued by the Central Bank of Kuwait on the rules for granting consumer loans and financing operations, after taking the opinion of the Central Bank of Kuwait.

Article 29

Subject to the provisions of the Companies Law, a credit information company existing at the time this Law is issued shall take the procedures to regularise its status by registering with the Central Bank within a period not exceeding six months from the date of issuance of these Regulations, and shall submit to the Central Bank a status regularisation plan, attaching the resolutions of the General Meeting of the company and setting out the stages of implementation of the procedures that will be taken in this regard, according to a specified timetable.

Article 30

After completing the implementation of the status regularisation plan, the company shall apply for its registration in the register of credit information companies at the Central Bank.

Article 31

The Central Bank of Kuwait shall set the rules for transferring the data and information available to it in the credit risk centralisation system to the company, as well as the rules for the Central Bank’s obtaining of all the credit data and information in the company’s database.

Issued on 5 August 2019 and published in the Official Gazette Kuwait Al-Youm on 25 August 2019.