RBI Consolidates Regulatory Framework for Credit Information Companies Through 2025 Directions
The Reserve Bank of India has unveiled comprehensive directions governing Credit Information Companies (CICs), fundamentally restructuring the supervisory architecture for credit bureaus operating within India. These directions, issued under Sections 11 and 37 of the Credit Information Companies (Regulation) Act, 2005, came into immediate effect on November 28, 2025, replacing all prior circulars and instructions on the subject.
Transformative Regulatory Architecture
The Reserve Bank of India (Credit Information Companies) Directions, 2025 represents a landmark consolidation that enhances governance standards, fortifies data protection mechanisms, and elevates consumer rights in the credit information ecosystem. The regulatory framework introduces uniform reporting templates across three distinct segments—consumer, commercial, and microfinance—while mandating stringent timelines for data submission and validation.
Scope and Application
These directions apply uniformly to all Credit Information Companies holding valid certificates of registration issued under Section 5 of the Credit Information Companies (Regulation) Act, 2005. Currently, four entities operate as registered CICs in India:
- TransUnion CIBIL Limited (registered March 5, 2012)
- CRIF High Mark Credit Information Services Private Limited (registered November 25, 2010)
- Equifax Credit Information Services Private Limited (registered March 26, 2010)
- Experian Credit Information Company of India Private Limited (registered February 17, 2010)
Definitions and Key Terms
Credit Institutions (CIs) encompass a broad spectrum including all commercial banks (excluding payment banks but including small finance banks, local area banks, and regional rural banks), primary urban cooperative banks, state and central cooperative banks, All India Financial Institutions such as EXIM Bank, NABARD, National Housing Bank, SIDBI, and NaBFID, all Non-Banking Financial Companies including housing finance companies (except pure investment NBFCs without customer interface), and Asset Reconstruction Companies.
Specified Users (SUs) maintain the meaning prescribed under clause (l) of Section 2 of CICRA and those entities notified under Regulation 3 of the Credit Information Companies Regulations, 2006.
Enhanced Board Governance
Mandatory Board-Approved Policies
The directions mandate that every CIC's Board of Directors establish and approve comprehensive policies covering:
- Free Full Credit Report (FFCR) Provision: Frameworks ensuring individuals receive one complimentary comprehensive credit report annually, including credit scoring
- Algorithm Review Protocol: Half-yearly examination of 'Search & Match' logic algorithms to ensure accuracy in borrower identification
- SHG Data Sharing Framework: Guidelines for aggregate-level sharing of Self-Help Group member credit information with government agencies, NABARD, financial institutions, and microfinance institutions for credit planning and research purposes
- Grievance Redressal Mechanism: Consumer complaint resolution procedures aligned with best practices, prominently displayed on the CIC's website
Quarterly Board Review Requirements
Boards must review:
- Information Security audit reports from entities receiving consent-based credit information
- Root Cause Analysis outcomes and subsequent modifications to search-and-match algorithms
- Complaint volumes, patterns, and resolution effectiveness
Investment Framework and Foreign Participation
General Investment Caps
The directions establish a baseline investment ceiling of ten percent of equity capital for any single investor, whether resident or non-resident. However, recognizing the need for technology transfer and expertise, the framework permits elevated foreign direct investment limits for entities demonstrating proven track records in operating credit bureaus within well-regulated jurisdictions:
- Up to 49% FDI: Permitted where ownership lacks diversification (one or more shareholders holding above 10% voting rights)
- Up to 100% FDI: Allowed under two scenarios:
- When ownership demonstrates clear diversification, or
- When ownership concentration exists but at least 50% of directors are Indian nationals/Non-Resident Indians/Persons of Indian Origin, with one-third being Indian national residents
Foreign Institutional Investment Conditions
FII/FPI participation requires:
- No single entity holding ten percent or more equity, directly or indirectly
- Mandatory reporting to RBI for any acquisition exceeding one percent equity
- Prohibition on seeking Board representation based solely on shareholding
Special Provisions for Holding Companies
When a wholly-owned subsidiary (direct or indirect) of an investment holding company invests in an Indian CIC, the eligibility criteria apply to the operational group entity engaged in credit information business that provides technical expertise to the Indian entity.
Membership and Fee Structure
Standardized Fee Caps
To promote affordable access to credit information infrastructure, the directions impose strict fee limitations:
- One-time membership fee: Capped at ₹10,000 per Credit Institution
- Annual subscription fee: Limited to ₹5,000 per Credit Institution
Rigorous Eligibility Standards for Specified Users
Entities seeking categorization as Specified Users must satisfy comprehensive criteria established through RBI's press release dated January 5, 2022:
Corporate Structure Requirements:
- Incorporation as an Indian company or establishment as a Statutory Corporation in India
- Governing statute or Memorandum of Association explicitly permitting information processing activities supporting credit institutions
Technical and Security Standards:
- CISA-certified auditor certification confirming robust and secure IT systems for data preservation and protection
- Compliance with Credit Information Companies (Regulation) Act, 2005 and all subordinate rules and regulations
Integrity Standards:
- Neither the company nor its promoters or directors should have any conviction involving moral turpitude or economic offences
Financial and Operational Criteria (for company entities):
- Minimum net worth of ₹2 crore per latest audited balance sheet, maintained continuously
- Ownership and control by resident Indian citizens or Indian companies owned and controlled by resident Indians
- Well-diversified ownership structure
- Minimum three years' experience in information processing for credit institution support with unblemished track record
Exemptions: TReDS platform operators receive exemptions from resident ownership and control requirements.
Ownership Diversification Standards
"Well diversified" status requires:
- Promoter group and relatives' aggregate shareholding not exceeding 26% of paid-up voting equity
- Non-promoter individual shareholding capped at 10%
- Compliance within five years from January 5, 2022, though CICs may prescribe shorter timelines
Specified User Due Diligence
CICs must implement rigorous controls including:
- Appropriate due diligence mechanisms during membership enrollment
- Formal agreements incorporating operational guidelines
- Half-yearly Information Systems audits by CISA-certified auditors
- Data localization—all processing and storage within India
- Limited retention periods: six months maximum or purpose fulfillment, whichever is earlier
- Prominent grievance redressal systems displayed on websites in vernacular and English
- Quarterly undertakings confirming continued compliance
- Annual compliance monitoring by CICs
Uniform Credit Reporting Framework
Standardized Data Formats
A transformative element of the directions is the introduction of the Uniform Credit Reporting Format (UCRF), comprising three non-proprietary templates:
- Form 1: UCRF (Consumer) – for retail lending segments
- Form 2: UCRF (Commercial) – for corporate and business lending
- Form 3: UCRF (Microfinance) – for microfinance sector