Skip to main content
Entire section Custom print Text Only Rich Text Print / Save as PDF
  Versions

 
Download Original PDF

  • Implementing Regulations of Credit Information Law

    No: أق/13709 Date(g): 21/8/2011 | Date(h): 22/9/1432Status: In-Force

    • Definitions

      • Article (1)

        The following words and expressions, wherever they occur in these Implementing Regulations, shall have the meanings given next to them unless otherwise required by the context.

        The Law: The Credit Information Law promulgated by Royal decree No. M/37, dated 5/7/1429H.

        Implementing Regulations: Implementing Regulations of the Credit Information Law.

        SAMA: Saudi Central Bank (SAMA)*.

        Governor: Governor of Saudi Central Bank.

        Credit Information: Consumer Information and data on his/her credit dealings.

        Companies: credit information companies licensed to collect and maintain credit information on consumers, as well as provide members with such information upon their request.

        Member: A government or private entity engaged in a contract to exchange credit information with at least one credit information company.

        Consumer: A natural or juridical person who has credit dealings.

        Credit Record: A report issued by companies containing credit information on a consumer.

        Public Records: Credit information records maintained by government entities, such as records of specialized funds and banks that offer government loans, as well as judicial authorities, government committees, bankruptcy and insolvency files and the like.

        Negative Decision: Any decision made by a member against a consumer based on his/her credit record.

        Negative Information: Any information given by a member that may adversely affect the assessment of a consumer's credit record.

        Committee: The Committee for Settlement of Credit Information Violations and Disputes.

        * The "Saudi Arabian Monetary Agency" was replaced By the "Saudi Central Bank" in accordance with The Saudi Central Bank Law No. (M/36), dated 11/04/1442H, corresponding to 26/11/2020G.

    • Licenses

      • Article (2)

        A natural or juridical person shall not provide credit information services before obtaining a license from SAMA pursuant to the provisions of Law and its Implementing Regulations.

      • Article (3)

        The company licensed to provide credit information services shall:

         1.be a joint stock company with its head office in Saudi Arabia; 
         2.have a paid up capital not be less than SR50 million;
         3.obtain SAMA approval on the Articles of Association and by-laws; 
         4.obtain SAMA approval on the computer system used in provision of the credit information services; 
         5.have competent human resources as well as sufficient financial and operational resources to provide services efficiently according to the Law and its Implementing Regulations; and 
         6.comply with the instructions and business rules issued by SAMA. 

      • Article (4)

        Founders of the company willing to offer credit information services must complete the licensing application form and submit it along with the following:

         1.a statement of the founders' names, addresses, and percentage in share capital of each founding shareholder;
         2.company's Articles of Incorporation and By-Laws;
         3.a bank certificate from a licensed bank in Saudi Arabia attesting that the paid-up capital has been placed in full;
         4.a copy of the national I.D. or commercial registration of the founding shareholders;
         5.description of the computer system that will be used to collect and store credit information of consumers, including system features and capabilities;
         6.an economic feasibility study;
         7.the company's business plan for the first 3 years since its incorporation, including the nature of works it intends to offer, future expansion plans, projected financial statements, estimated growth rates, annual costs based its expected growth rates, anticipated number of staff, corporate governance, internal controls to be implemented by the company, and any other information that may be required by SAMA;
         8.company's organization structure;
         9.a fee of SR 50,000 for reviewing the licensing application; and
         10.a declaration not to conduct any business other than those stated in the company's articles of association, unless after obtaining SAMA’s approval.

      • Article (5)

        The applicant shall complete all deficiencies in its application and furnish SAMA with any required information within a month from the date of notification of such requirements; otherwise, its application will be revoked. SAMA will only give its decision to approve or reject the application once the company has fulfilled all required information and documents.

      • Article (6)

        The applicant shall finalize the incorporation procedures according to the Companies Regulations, including commercial registration. The Governor's decision to grant the license will be issued thereafter. Nevertheless, the company must not in any case provide its services prior to issuance of the Governor's decision; otherwise the application procedures will be revoked.

      • Article (7)

        The license term is five years, renewable according to the conditions and procedures applicable upon such a renewal. SAMA will charge a one-time off fee upon issuance of the license amounting to 1% of the company's paid up capital, and another fee amounting to 0.5% of the company's paid up capital upon renewal of the license. Renewal application shall be submitted at least 6 months prior to the license expiry date.

      • Article (8)

        The license shall be terminated in the following cases:

         1-automatically upon its expiry date, if not renewed;
         2-dissolution of the company for any cause stipulated in the Companies Law;
         3-issuance of a decision to revoke the license; and
         4-failure of the company to conduct business within 12 months from the issuance date of the license without reasonable justifications acceptable to SAMA.

      • Article (9)

        The Company shall obtain SAMA's written approval before:

         1.opening a branch or an office, or establishing a subsidiary inside or outside Saudi Arabia;
         2.entering into a merger or acquisition deal/transaction with another entity; and
         3.affecting any change on its articles of incorporation or by-laws.

      • Article (10)

        Having identified and investigated a violation, SAMA may take the following actions:

         1.notify the company in writing with any error, deficiency, or negligence from its side, and provides SAMA with an acceptable plan to remedy the situation within at least thirty (30) working days of the notification date;
         2.request from the committee a temporary suspension or termination of the license by a written notification to the company, in case the company fails to comply with the above paragraph; and
         3.instruct the company to inform all relevant parties of the committee’s decision.

      • Article (11)

        With due consideration to the Implementing Regulations, the company must inform SAMA of any change or modification to the information provided to SAMA before or after licensing, within three working days of effecting such a change or modification.

    • Scope of Credit Information Services

      • Article (12)

        Upon obtaining SAMA approval, the company may provide any or all of the following services:

         1.receive consumer’s information from all members, collate, store and exchange such information with members and companies;
         2.provide enquiry service on both individuals and businesses;
         3.provide consumers credit evaluation service;
         4.provide advisory services to support credit information;
         5.provide statistical reports and information regarding credit information; and
         6.provide market and statistical researches on credit information.
         

        Companies must obtain SAMA's prior approval on providing any services other than those stated in this Article.

    • Governance

      • Article (13)

        Board members and senior managements of companies must enjoy suitable competencies and experiences that qualify them for their jobs.

      • Article (14)

        SAMA's fit and proper standards and criteria shall apply to all company founders, chairman and members of the board of directors and executive management. They shall complete the fit and proper questionnaire issued by SAMA and provide all forms and requirements specified in the criteria to obtain SAMA "Non Objection" for their appointment.

      • Article (15)

        The nominee for membership in the company’s board of directors shall:

         1.not be a board member of any other credit information company inside or outside Saudi Arabia;
         2.not be convicted by any court with regard to any crime impinging on honor or integrity, unless rehabilitated;
         3.never declared bankruptcy or insolvency;
         4.not be an employee at any other credit information company or an auditor of its accounts;
         5.never been terminated from employment over a disciplinary action;
         6.not pose any conflict of interest due to membership in the company's board of directors or the board of any other company that conducts a different activity; and
         7.have a credit record that is free of any negative information.

    • Credit Record

      • Article (16)

        The credit record shall contain information relating to the consumer's credit worthiness, such as:

         1.consumer's name as a natural person, ID number, place of residence, current and previous workplace, marital status, educational qualifications, and personal details;
         2.consumer’s name as a legal person, commercial license or registration number, address, and any other relevant information;
         3.information on any existing or previous credit, acknowledged or disputed, whether its repayment was immediate or deferred, defaulted or delayed, and whether the debt was cancelled or settled, as well as any guarantees given to the consumer;
         4.any credit-related actions brought against the consumer and the judgments made;
         5.any case of insolvency, bankruptcy or liquidation brought against the consumer and the judgments made, name of liquidator or trustee of bankruptcy, assets and debt amounts, repayment dates and liquidation expenses;
         6.bounced checks issued by the consumer, their values and dates, and any actions taken towards these checks;
         7.any claim made by an official authority and has not been settled yet;
         8.number and names of members who requested a consumer credit record during the past two years preceding the issuance date of the credit record, in addition to the number of credit records issued and results reached; and
         9.any other information relating to credit and affecting the credit worthiness of the consumer.
         

        SAMA may change the information required to be included in the credit record as it deems appropriate.

      • Article (17)

        Companies have the right to maintain the negative information in the consumer credit record for no more than five years from the debt or dispute settlement date. An exception is the cases of bankruptcy, insolvency and delayed Zakat or tax obligations which shall be maintained in the record for 10 years. Outstanding judicial cases shall be maintained in the credit record until settlement.

      • Article (18)

        At the request of the member, the company may include in the credit record of a partner in a partnership credit information relating to the other partners after obtaining their written consent.

    • Regulatory and Supervisory Requirements

      • Article (19)

        SAMA may conduct regular or unexpected inspection, through its inspectors or external auditors, to check the company’s accounts and records, and the company’s staff must cooperate and provide any information or data requested.

      • Article (20)

         1.The company shall provide SAMA with the following: 
          a.quarterly financial statements within a month from the end of the quarter, and the final audited statements within two months from the end of the fiscal year; and
          b.a report assessing the efficiency and effectiveness of computer systems used by the company, including the systems for collecting and keeping data. The report shall be provided annually and approved by a certified advisory office.
         2.SAMA may request any other data or information as required. 

      • Article (21)

        Companies shall sign membership agreements approved by SAMA with any party that wishes to obtain credit information about consumer credit records. Such agreements shall indicate rights and obligations of the parties. Each party after signing the agreement will be regarded as a "member".

      • Article (22)

        Credit information shall be shared among companies that are governed by the Law according to bi-lateral or multi-lateral agreements or contracts entered into between such companies. These agreements and contracts shall specify the parties' rights and obligations, documents to be provided concerning such information, validity, method of extension or renewal, and financial charges to be paid. They shall be submitted to SAMA to obtain its non-objection.

      • Article (23)

        Companies shall prepare regular records containing (natural and legal) consumers’ names, capacities, addresses, workplaces, nature of business and credit information.

      • Article (24)

        Companies shall regularly prepare records containing the names of members and companies they are transacting with, whether credit information companies or any other companies governed by the Law and its Implementing Regulations, as well as the agreements and contracts signed with each company, their durations and conditions.

      • Article (25)

        Companies shall take all measures and precautions necessary to ensure soundness, accuracy, integrity and completeness of information obtained according to the Law and its Implementing Regulations and shall:

         1.not collect credit information from any party prior to signing a membership agreement with that party;
         2.gather credit information from members in line with the criteria approved by the company and which include administrative, technical and legal requirements as well as the working rules approved by SAMA;
         3.take the necessary actions to ensure that there are reasons for the member’s request for credit information; and
         4.inform the member of his obligations according to the Law and its Implementing Regulations.
         

        A company shall be held responsible to the parties transacting with it, i.e. public and private institutions/ agencies, firms and consumers, for any invalid or false information and data it provides. However, this will not waive the company’s right of recourse against a member for any damages the company incurs once it proves the member's deception and misleading information.

      • Article (26)

        Companies shall establish data and information security protection controls for the information they have or obtain, and they shall:

         1.record, maintain, reconcile, collect, process and classify credit information in a proper and suitable manner to facilitate reference to such information;
         2.protect information from loss, which includes the adoption of backup systems and the development of contingency recovery plans as well as business continuity plans;
         3.protect credit information from unauthorized access, usage, modification, or disclosure in violation of the Law and its Implementing Regulations;
         4.establish controls and procedures to be applied upon members' request to check credit records;
         5.review the company’s staff confidentiality controls regularly;
         6.review usage patterns of information systems regularly to detect and investigate any unusual usage patterns;
         7.maintain records for all access, modification and audit cases of credit information database, including previous enquiry records as well as all incident records that imply confirmed or suspected violations; and
         8.provide sufficient knowledge to the authorized member representatives concerning the international best security practices relating to the working rules.

      • Article (27)

        Prior to providing a member with any credit record, the company shall:

         1.verify the identity of the applicant and purpose of such a request;
         2.obtain the member's undertaking that the information will not be used except for the reasons specified in the application; and
         3.ensure that the credit information provided is accurate and up to date.

      • Article (28)

        With due consideration to these Implementing Regulations, the company may not issue any credit record on a consumer except based on:

         1.the member's request and consent of the consumer involved;
         2.a request from a local competent dispute settlement body;
         3.SAMA's request; or
         4.the consumer’s request.

      • Article (29)

        Companies shall procure an insurance policy from an authorized insurance provider in Saudi Arabia to cover its liabilities arising from failure, negligence or errors in the provision of credit information services.

      • Article (30)

        The company may not sell, rent or assign its databases except to another licensed credit information company, and after obtaining SAMA’s prior written approval. Upon dissolution of the company for any reason, its databases will go to SAMA or any other organization designated by SAMA.

      • Article (32)

        With due consideration to Article (12) of these Implementing Regulations, companies will collect credit information on consumers from all available sources such as public records and financial institutions whose nature of work involve providing credit in addition to consumers’ current and previous places of work, chambers of commerce and industry, and other related organizations and sources.

      • Article (33)

        Companies shall establish a complaints settlement department and develop a procedural manual for processing consumer complaints to be published after obtaining SAMA’s approval. The manual shall include procedures that ensure:

         1.full understanding of each employee who gets in touch with consumers about these procedures;
         2.complete and immediate investigation into any complaint; and
         3.maintenance of a record for written complaints and documentation of the actions taken.

      • Article (34)

        Companies shall prepare a procedural manual for consumer awareness of credit information and submit it to SAMA for its approval.

    • Confidentiality

      • Article (35)

        With due consideration to the provisions on confidentiality of credit information and the banking rules followed in Saudi Arabia, none of the entities referred to in Article (32) of these Implementing Regulations may refuse to provide the companies with the requested credit data and information on consumers for the purposes stipulated in the Law and its Implementing Regulations.

      • Article (36)

        Members and companies shall maintain confidentiality of credit information and data in their possession and limit the use and sharing of such information to the members, companies, and relevant persons and parties according to the Law and its Implementing Regulations. Without prejudice to the liability of their employees and workers for any violations they might commit, companies and members shall be held fully liable for any violations to the Law and its Implementing Regulations committed by their employees.

      • Article (37)

        Employees and workers of companies and organizations subject to the Law and its Implementing Regulations must not disclose, or keep, any information which they may come upon while performing their job duties, even after the end of their employment.

      • Article (38)

        Provisions on confidentiality of credit information will not apply to the following:

         1.public information as information becomes public once it is announced or published in media; and
         2.any other cases or information as specified by SAMA.

      • Article (39)

        Companies may not establish a credit record of any consumer for the first time, or exchange it with any member or company without the consumer's consent.

    • Members Obligations

      • Article (40)

        The member shall:

         1.obtain the written consent of the consumer upon inquiry, and his/her approval to provide licensed companies with his/her credit information;
         2.not provide companies with any credit information about the consumer if the member knows that such information contains errors or believes that such information may contain incorrect data;
         3.not provide companies with false credit information about the consumer after the member has been informed by the consumer;
         4.periodically update the consumer information, at least once a week;
         5.provide companies, in all circumstances, with correct and complete data about the consumer;
         6.use the consumer information received from the companies for lawful purposes;
         7.immediately inform the companies about any closed credit accounts based on the consumer's request;
         8.not disclose any information received from the companies about the consumer;
         9.develop records including the names and addresses of the companies transacted with as well as the information provided to such companies.
         10.not have the right to provide the companies with negative information about the consumer that includes dispute or complaint without notifying the companies that such negative information is subject of a dispute or complaint; and
         11.verify the consumer information and correct or delete any contained errors.

      • Article (41)

        The member shall inform the consumer about any negative information that will be sent to companies within 30 working days as of registering such information in the consumer’s record. This can be affected through sending a clear and explicit written notification to the consumer.

      • Article (42)

        Members who are committed by membership agreements with companies may not deny or delay the provision of the credit information required by them according to the defined schedules and agreed frequency stipulated in the membership agreements between companies and members.

    • Consumer’s Rights

      • Article (43)

        With due consideration to the cases stipulated in the Law, the consumer shall have the right to know all information contained in his/her credit record. The consumer may request his/her record from any credit information company free of charge, if:

         1.the record is requested for the first time;
         2.a negative decision is made against him/her as stipulated in the Implementing Rules;
         3.the consumer is a victim of a fraudulent transaction, such as a proven manipulation of his/her personal information; and
         4.the consumer's credit record contains false information.

      • Article (44)

        The consumer has the right to:

         1.know the name and address of any party that has enquired about his/her credit record during the past 2 years; and
         2.file a complaint if his/her credit record contains false or incomplete information.

      • Article (45)

        In case the member has taken a negative decision against the consumer for a cause that is partially or entirely due to any information included in his/her credit record, they shall notify the consumer within 7 working days from the date of taking such decision with the negative information as well as the following information:

         1.causes for taking such a negative decision; and
         2.name, address and telephone number of the company from where the member obtained the credit record and a copy of it.

    • Objections and Complaints

      • Article (46)

        The consumer may object at any time against any negative decision or any information contained in his/her credit record if it was false, not updated, incomplete, or old and has already passed the stipulated period for keeping information in the credit record indicated in Article 19 thereof. The company, in this case, shall investigate the complaint free of charge within 30 days of the objection submission date.

      • Article (47)

        Investigation and review of complaints and objections shall be in accordance with the following procedures and timeframes:

         1.the company shall within 5 working days from the date of being informed with the complaint, inform the member who issued the objected negative information in a written form and mention all related information as well as all evidence and documents submitted by the consumer, and give the member no more than 10 working days to respond. If no response is received within 10 working days, this will be taken as valid evidence for supporting the consumer’s claim;
         2.the company shall take its decision within no more than 7 working days of receiving the member’s response or expiry of the period stipulated above;
         3.once the investigation proves partial or complete validity of the claim, or it is proven that the information cannot be verified, the company shall within 2 working days remove the objected information from the record or revise it, as the case may be; and
         4.the company shall not have the right to delete or revise any negative information in the consumer’s credit record once it is proven to be accurate.

      • Article (48)

         1.The company shall notify the objector with the actions taken to investigate his/her objection within at least 10 working days from the date of objection submission. 
         2.The company shall notify the objector in writing with the finding of the investigation within at least 5 working days from the date of taking the decision in this regard, including the following: 
          a.a copy of the revised consumer’s credit record if the objection has proven to be valid; and
          b.a Summary of the consumer’s rights according to the Law and its Implementing Regulations, if it is proven that the objection is invalid.

      • Article (49)

        The company shall refer to the objection raised on any information contained in every credit record it issues during the investigation period. If the investigation fails to settle the objection, the company may, on the request of the objector, undertake the following:

         1.refer to the objection in any subsequent credit record relating to the objector and including any objected negative information;
         2.include in the credit record a clear summary of the actual facts of the negative information objected as viewed by the objector; and
         3.notify, in writing, any party designated by the objector, which had obtained his/her credit record in the year preceding the objection regarding the submission of the objection if that record included any of the objected information.

      • Article (50)

        Once any information contained in the objector’s credit record has been deleted or modified, the company shall notify in writing such deletion or modification to any party defined by the objector that may have obtained his/her credit record during the year preceding the objection, and all licensed credit information companies that are contracted with the company.

      • Article (51)

        The member shall not have the right to re-include any negative information that has been deleted or modified in the consumer’s credit record unless decided by the Committee.

      • Article (52)

        The consumer may, if his/her objection is rejected, approach the Committee indicated in Article (14) of the Law to file a complaint for review and settlement.

    • Committee for Settlement of Credit Information Violations and Disputes

      • Article (53)

        A committee or more shall be instituted according to Article (14) of the Law, composed of at least 3 members, to be appointed, nominated and their tenure is defined through a resolution by the Minister of Finance.

      • Article (54)

        After formation, the Committee shall develop its own charter defining its work processes and arbitration procedures. The Governor shall endorse the Committee’s charter and determine the remunerations of its members.

    • Enforcement and Publication

      • Article (55)

        These Implementing Regulations shall come into effect one month after being published in the official gazette and SAMA’s Website. SAMA may review and recommend a modification of these Implementing Regulations if necessary.