No.4
The Measures for the Administration of Credit Information Business was deliberated and adopted at the 9th executive meeting of the People's Bank of China on September 7th, 20021year, and is hereby promulgated and shall come into force on October 6th, 2022.
President Yi Gang
202127 September
Credit business management law
Chapter I General Provisions
Article 1 These Measures are formulated in accordance with the Law of the People's Republic of China on the People's Bank of China, the Law of People's Republic of China (PRC) on the Protection of Personal Information, the Regulations on the Administration of Credit Information Industry and other laws and regulations in order to standardize credit information business and related activities, protect the legitimate rights and interests of information subjects, promote the healthy development of credit information industry and promote the construction of social credit system.
Article 2 These Measures shall apply to legal persons, unincorporated organizations (hereinafter referred to as enterprises) and individuals engaged in credit investigation business and related activities within the territory of People's Republic of China (PRC).
Article 3 The term "credit investigation business" as mentioned in these Measures refers to the activities of collecting, sorting, storing and processing the credit information of enterprises and individuals and providing it to information users.
The term "credit information" as mentioned in these Measures refers to the basic information, loan information and other relevant information collected according to law to provide services for financial activities and to identify and judge the credit status of enterprises and individuals, as well as the analysis and evaluation information formed based on the above information.
Article 4 To engage in personal credit reporting business, it shall obtain the permission of the personal credit reporting agency of the People's Bank of China according to law; Engaged in enterprise credit information business, shall handle the enterprise credit information institutions for the record according to law; Engaged in credit rating business, it should be handled by credit rating agencies for the record according to law.
Article 5 Financial institutions shall not engage in commercial cooperation with market institutions that have not obtained the legal qualification of credit reporting business to obtain credit reporting services.
The term "financial institutions" as mentioned in these Measures refers to institutions engaged in financial business under the supervision and management of the financial management department of the State Council.
The provisions of these Measures on financial institutions shall apply to local financial organizations that are supervised and managed by local financial supervision departments.
Article 6 To engage in credit investigation business and related activities, the legitimate rights and interests of information subjects shall be protected, information security shall be guaranteed, and credit information shall be prevented from being leaked, lost, damaged and abused, and state secrets shall not be endangered, and personal privacy and business secrets shall not be infringed.
Engaged in credit business and related activities, should follow the principles of independence, objectivity and impartiality, and shall not violate the provisions of laws and regulations, and shall not violate social public order and good customs.
Chapter II Collection of Credit Information
Article 7 Personal credit information shall be collected in a lawful and proper way, following the principles of minimization and necessity, and shall not be excessively collected.
Article 8 Credit reporting institutions shall not collect credit information in the following ways:
(1) Deception, coercion or inducement;
(2) charging the information subject;
(three) collected from illegal channels;
(4) Infringe upon the legitimate rights and interests of the information subject by other means.
Article 9 Where an information provider provides credit information to a credit reporting agency, the credit reporting agency shall formulate relevant systems to conduct necessary examination on the information source, information quality, information security and information subject authorization of the information provider.
Article 10 Credit institutions and information providers shall abide by the Law of People's Republic of China (PRC) on the Protection of Personal Information and other laws and regulations in their business and cooperation, and clarify the principles of information collection and their respective rights, obligations and responsibilities in obtaining customer consent, information collection, processing, information correction, objection handling and information security through agreements and other forms.
Article 11 When conducting personal credit investigation, a credit investigation agency shall formulate a personal credit information collection plan, and report the collected data items, information sources, collection methods, information subject's legal rights and interests protection system and their changes to the People's Bank of China.
Article 12 When collecting personal credit information, a credit reporting agency shall obtain the consent of the information subject, and clearly inform the information subject of the purpose of collecting credit information. Except for the information disclosed by laws and regulations.
Article 13 Where a credit reporting agency obtains personal consent through an information provider, the information provider shall fulfill the obligation of informing the information subject.
Article 14 A personal credit reporting institution shall report to the People's Bank of China the information providers who cooperate with it in collecting, sorting, processing and analyzing personal credit information.
Personal credit reporting institutions shall standardize the contents of cooperation agreements with information providers. Information providers shall accept the risk assessment of personal credit information processing institutions and the verification of the People's Bank of China.
Fifteenth collection of enterprise credit information, should be based on legitimate purposes, and shall not infringe on business secrets.
Chapter III Arrangement, Preservation and Handling of Credit Information
Article 16 Credit reporting agencies shall follow the objective principle in sorting out, storing and processing credit information, and shall not tamper with the original information.
Seventeenth credit institutions should take measures to improve the accuracy of information in the credit information system and ensure the quality of information.
Eighteenth credit institutions in the process of sorting, saving and processing credit information, found that the information error, which belongs to the error submitted by the information provider, should promptly notify the information provider to correct; If it is an internal processing error, it should be corrected in time and the internal processing flow of credit information should be optimized.
Nineteenth credit institutions should compare the information from different information providers, and if they find that the information is inconsistent, they should check and deal with it in time.
Twentieth personal bad information collected by credit reporting agencies shall be kept for five years from the date of termination of bad behavior or incident.
When the retention period of personal bad information expires, the credit reporting agency shall delete personal bad information in its external services and applications; As sample data, it should be anonymous.
Chapter IV Provision and Use of Credit Information
Twenty-first credit reporting institutions shall follow the principle of fairness in providing credit reporting products and services to the outside world, and shall not set unreasonable commercial conditions to restrict the use of different information users, and shall not use their dominant position to provide discriminatory or exclusive products and services.
Twenty-second credit institutions shall take appropriate measures to conduct necessary examination of the identity, business qualifications and purposes of information users.
Credit institutions shall evaluate the management measures such as network and system security and compliance of information users accessing the credit information system, and monitor the inquiry behavior. Find potential safety hazards or abnormal behaviors, and check them in time; Found illegal behavior, stop providing services.
Twenty-third information users should take necessary measures to ensure that the consent of the information subject is obtained when inquiring about personal credit information, and use personal credit information according to the agreed purposes.
Twenty-fourth information users should legally and justly use the credit information provided by credit reporting agencies, and shall not abuse the credit information.
Twenty-fifth personal information subjects have the right to obtain their own credit reports twice a year for free, and credit reporting agencies can provide credit report inquiry services for personal information subjects through Internet inquiry and business premises inquiry.
Twenty-sixth information subject thinks that there is an error or omission in the information, and has the right to raise an objection to the credit information agency or the information provider; If you think that your legitimate rights and interests have been infringed, you can complain to the local branch of the People's Bank of China. Objections and complaints shall be handled in accordance with the Regulations on the Administration of Credit Information Industry and relevant regulations.
Twenty-seventh credit institutions shall not charge fees to the information subject on the grounds of deleting bad information or not collecting bad information.
Article 28 Where a credit reporting agency provides credit information inquiry products and services such as credit reports, it shall objectively display the contents of the inquired credit information and explain the contents and technical terms of the inquired credit information.
The information subject has the right to request the credit reporting agency to add objection marks and statements in the credit report.
Twenty-ninth credit rating agencies provide credit evaluation products and services such as portraits, scores and ratings. , evaluation criteria should be established, and factors unrelated to the credit of the information subject should not be used as evaluation criteria.
Before formally providing credit evaluation products and services to the outside world, credit reporting agencies should perform necessary internal testing and evaluation verification procedures in order to explain the evaluation rules and trace the sources of information.
Credit institutions that provide credit rating products and services for economic entities or debt financing instruments shall conduct business in accordance with the Interim Measures for the Administration of Credit Rating Industry (Order No.5 of the Securities Regulatory Commission of the Ministry of Finance of the Development and Reform Commission of the People's Bank of China [20 19]) and other relevant provisions.
Article 30 Where a credit investigation agency provides credit anti-fraud products and services, it shall establish standards for identifying fraudulent credit information.
Article 31 When providing credit information inquiry, credit evaluation and credit anti-fraud products and services, a credit reporting institution shall report the following matters to the People's Bank of China or its branches above the central branch of the provincial capital city:
(a) the template and content of the credit report;
(2) Evaluation methods, models and main dimensions of credit evaluation products and services;
(3) Data sources of credit anti-fraud products and services, and standards for identifying fraudulent credit information.
Article 32 Credit institutions shall not engage in the following activities:
(1) Commitment to the credit evaluation results;
(2) Propagandizing products and services that imply the results of credit evaluation;
(3) Marketing in its name without the consent of government departments or trade associations;
(4) Providing credit information products and services to information subjects or information users by means of coercion, deception or inducement;
(5) making false propaganda on credit products and services;
(six) to provide other credit products and services that affect the objectivity and fairness of credit business.
Chapter V Credit Information Security
Thirty-third credit institutions should implement the network security level protection system, formulate a safety management system involving business activities and equipment and facilities, and take effective protection measures to ensure the safety of the credit information system.
Article 34 Individual credit reporting institutions and enterprise credit reporting institutions that store or process enterprise credit information of 1 10,000 or more shall meet the following requirements:
(1) The network security protection level of the core business information system has three or more security protection capabilities;
(2) Establishing the person in charge of information security and the person in charge of personal information protection, which shall be held by the senior management specified in the articles of association;
(three) set up a full-time department to be responsible for information security and personal information protection, and regularly check the implementation of credit business, system security and personal information protection system measures.
Article 35 A credit reporting institution shall ensure the safety of operating facilities, safety control facilities and Internet applications of the credit reporting system, do a good job in the daily operation and maintenance management of the credit reporting system, ensure the physical safety of the system, the safety of communication networks, the safety of regional boundaries, the safety of computing environment and the safety of management centers, and prevent the credit reporting system from being illegally invaded and destroyed.
Thirty-sixth credit institutions should do a good job in personnel safety management in personnel recruitment, post-leaving, assessment, safety education, training and external personnel access management.
Article 37 A credit reporting agency shall strictly limit the authority and scope of the personnel who inquire and obtain credit information within the company.
Credit reporting agencies shall keep records of staff's operations in inquiring and obtaining credit information, and clearly record the time, manner, content and purpose of staff's inquiring and obtaining credit information.
Article 38 A credit reporting institution shall establish an emergency handling system, take necessary measures immediately to mitigate the harm when credit information leaks or may occur, and report to the People's Bank of China and its branches above the central branch of the provincial capital city in time.
Thirty-ninth credit institutions shall engage in credit business and related activities in People's Republic of China (PRC), and the collected enterprise credit information and personal credit information shall be kept in People's Republic of China (PRC).
Fortieth credit reporting agencies shall provide personal credit information to overseas countries in accordance with the provisions of laws and regulations.
When providing enterprise credit information inquiry products and services to overseas information users, credit reporting agencies shall conduct necessary examination on the identity of information users and the use of credit information to ensure that credit information is used for reasonable purposes such as cross-border trade, investment and financing, and shall not endanger national security.
Article 41 If a credit reporting agency cooperates with an overseas credit reporting agency, it shall report the cooperation agreement to the People's Bank of China after the signing of the cooperation agreement and before the start of business.
Chapter VI Supervision and Administration
Forty-second credit institutions shall disclose the following matters to the public and accept social supervision:
(a) the types of credit information collected;
(2) The basic format of the credit report;
(3) objection handling procedures;
(4) Other matters that the People's Bank of China deems necessary to be disclosed.
Article 43 A personal credit reporting institution shall, in accordance with the Law of People's Republic of China (PRC) on the Protection of Personal Information and the Regulations on the Administration of Credit Reporting, conduct compliance audit on its personal credit reporting business every year and submit the compliance audit report to the People's Bank of China in time.
Article 44 The People's Bank of China and its branches above the central branch of the provincial capital city shall supervise and inspect the following matters of credit reporting institutions:
(a) the construction of internal control system for credit reporting, including the completeness, compliance and operability of various systems and relevant regulations;
(2) Compliance of credit information business, including collection of credit information, external provision and use of credit information, handling of objections and complaints, user management and compliance of other matters;
(three) the security status of the credit information system, including information technology system, security management, system development, etc. ;
(4) Other matters related to credit business activities.
Forty-fifth information providers and information users who violate the provisions of the Regulations on the Administration of Credit Information Industry and infringe on the legitimate rights and interests of information subjects shall be investigated and dealt with by the People's Bank of China and its branches above the central branch of the provincial capital city according to law.
Chapter VII Legal Liability
Forty-sixth in violation of the provisions of article fourth of these measures, engaging in personal credit business without authorization, the people's Bank of China shall be punished in accordance with article thirty-sixth of the Regulations on Credit Management; Those who engage in enterprise credit information business without authorization shall be punished by the branches above the provincial capital city center branch of China People's Bank according to Article 37 of the Regulations on the Administration of Credit Information Industry.
Where a financial institution, in violation of the provisions of Article 5 of these Measures, engages in commercial cooperation with a market institution that has not obtained the qualification of legal credit reporting business to obtain credit reporting services, the People's Bank of China and its branches shall order it to make corrections, impose a fine of 30,000 yuan on the unit, and impose a fine of 1 10,000 yuan on the directly responsible person in charge.
Article 47 If a credit reporting agency violates the provisions of Articles 8, 16, 20, 27 and 32 of these Measures, it shall be punished by the People's Bank of China and its branches above the central branch of the provincial capital city according to Article 38 of the Regulations on Credit Management.
Article 48 If a credit reporting institution violates the provisions of Articles 14, 21, 31, 34, 39 and 42 of these Measures, the People's Bank of China and its branches above the central branch of the provincial capital (capital) shall order it to make corrections, confiscate its illegal income, impose a fine of less than 30,000 yuan on the unit, and impose a fine of less than 1 10,000 yuan on the directly responsible person in charge. Where laws and administrative regulations provide otherwise, such provisions shall prevail.
Chapter VIII Supplementary Provisions
Forty-ninth institutions engaged in credit business in the basic database of financial credit information shall refer to these measures for submitting or inquiring credit information to the basic database of financial credit information.
Article 50 These Measures shall apply to the provision of credit information services in the name of "credit service", "credit service", "credit score", "credit rating" and "credit repair".
Article 51 Before the implementation of these Measures, institutions that have not obtained the business license for personal credit reporting business or have not filed with enterprise credit reporting agencies but actually engaged in credit reporting business shall complete compliance rectification within 18 months from the date of implementation of these Measures.
Article 52 The People's Bank of China shall be responsible for the interpretation of these Measures.
Article 53 These Measures shall come into force from June+10 +2022 10.