[By Siddhi Bhosale and Saloni]
The authors are students of Maharashtra National Law University, Mumbai and Rajiv Gandhi National University of Law respectively.
ABSTRACT
Amidst the complex landscape of credit agencies and subsequent ratings derived from the agencies, an individual’s borrowings are highly dependent. The approval from financial institutions and banks is directly proportional to the CIBIL score of an individual. Thereby, CIBIL score plays a pivotal role in determining an individual’s prospect vis-à-vis loan approvals and disbursement. However, the integral sector of CIBIL score is not immune from the bottlenecks of the regulatory framework governing the score. There is lack of transparency, accountability, delay in updation, lack of uniformity, no effective redressal mechanisms addressing the grievances of the consumers, etc. All these challenges draw the attention towards the creditworthiness of the scores provided by the credit rating agencies in India. Adding to this, several concerns regarding privacy further aggravate such fragmented sector’s effective implementation, despite legislations and statutes in place. This paper highlights the grave challenges faced by the consumer base and provides effective measures that can be undertaken to ameliorate the situation, thereby providing assistance to the individuals who actively take actions to improve their CIBIL score.
INTRODUCTION
An individual’s credit score is important in deciding access to financial resources because it directly determines loan eligibility, relevant interest rates, credit card issuance, and other financial goods. From one’s eligibility of availing a loan to the rate of interest at which such loan is to be issued, one’s credit cards and more is governed by one’s credit score. It is a statistical method used to predict an individual’s or small business’s ability to repay debt. The credit score is a three-digit number, generally ranging from 300 to 900. It provides a numerical measure of creditworthiness, derived from an individual’s repayment history and financial behaviour across various credit accounts and institutions. It is a way for credit institutions to gauge an individual’s financial reliability.
TransUnion CIBIL Limited (formerly known as Credit Information Bureau India Limited, or “CIBIL”), Experian, Equifax, and CIRF High mark are the four foremost credit information companies in India that are licensed by the Reserve Bank of India for the management of credit information, as per Statement on Developmental and Regulatory Policies, Reserve Bank of India. Among the, four, CIBIL, a Chicago-based company, arguably is the most recognised and prevalent one among the Indian Credit Institutions. It was incorporated in 2000 based on the recommendations made by the RBI Siddiqui Committee.
A person’s reputation with lenders and credit card companies rises in direct proportion to how close their credit score is to 900. Because it indicates dependability and reduced credit risk, financial institutions typically favour candidates who maintain a credit score of 700 or above. If your CIBIL score is 700 or higher, your loan and credit card applications will be processed more quickly than those with lower credit scores may already be approved for some of the cards.
Through the means of this article, the authors delve into the regulatory structure that governs Credit Information Companies in India. It emphasizes the operational and systemic challenges that result from a lack of transparency, over-reliance on a single institution, and loopholes in legal oversight. The article concludes with a comparison to worldwide methods and ideas for improving the fairness, accountability, and dependability of credit reporting in India.
REGULATORY FRAMEWORK AND EMERGING CONCERNS
These Credit Information Companies (CICs), are regulated by the Credit Information Companies (Regulation) Act, 2005 (CICRA) and Credit Information Company Rules, 2006. These companies are registered with and governed by RBI. RBI issues directions in exercise of the powers conferred under Section 11 of the CICRA, 2005 on credit information reporting. While the existing framework also extends access to the RBI’s Integrated Ombudsman Scheme for grievance redressal, this mechanism has often been regarded as insufficient.
CIC possess considerable power as barriers to financial opportunity, yet many struggle to understand the complex factors that contribute to calculation of CIBIL Score. Congress MP Karti P Chidambaram recently raised the issue in Parliament. “If you want to take a car loan, if the Finance Minister of this country wants to take a house loan, everything depends on the CIBIL score, but nobody knows how the CIBIL organisation works” “It is a private company. It is called TransUnion. This is the company which is rating every one of us,” Chidambaram said in Lok Sabha, voicing concern over the opaque methodology of credit scoring.
- Absence of Regulatory Oversight
The present state of affairs raises two primary concerns. Firstly, there is a glaring absence of regulatory oversight and transparency in the manner in which credit scores are calculated. As per the latest RBI Master Guidelines, the Credit Institutions (CIs) are now needed to update credit bureau records every 15 days, instead of the existing monthly cycle. With the introduction of a 15- day reporting cycle, borrowers’ financial conduct, is expected to be captured and reflected more promptly in their credit history. In principle, this should enhance accuracy and ensure that borrower behaviour is duly reported.
However, the ground reality reveals a stark gap between regulatory intent and practical implementation. CIBIL scores often remain depressed even after repayments are made, leaving borrowers uncertain whether their updated information has been transmitted by the CI or incorporated by the CIC. In a writ petition praying to direct Trans Union CIBIL Limited (‘TUCL’) to restore the credit rating of the petitioner to the levels entitled, since the petitioner had paid off his loan amount, Justice Devan Ramachandran gave necessary directions for such restoration. In this case, despite the petitioner paying off the loan, the TUCL continued to show his credit rating as low which led to closure of loan account and banned him from availing subsisting loan.
In cases of non-compliance, complaints can be raised before the concerned CI or CIC, which must be resolved within 30 days. However, even with the RBI’s Integrated Ombudsman Scheme, 2021
the mechanism remains inadequate as the Ombudsman have the power to provide a compensation only upto Rs.20 Lakhs as laid under Para 8 of the Scheme.
- Data Privacy Concerns
Secondly, data as sensitive as the bank details including PAN card number, salary, spending habits in this time of UPI transaction, as well as Aadhar Card details can easily be used or sold without the consent of the consumer. For instance, as of 2019, TransUnion CIBIL had access to important non-credit data sources including tax records, property registries, and the national voter registry, which had around 790 million records. While credit ratings are generated on the basis of this data, CIBIL’s control over such sensitive information raises serious concerns relating to privacy, security, and data sovereignty.
In India, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (hereinafter referred to as “IT Rules”) require explicit consent for the collection and processing of sensitive financial data. The Digital Personal Data Protection Act, 2023 (hereinafter referred to as “DPDPA”) further emphasises the protection of data subject’s rights, aligning with global standards while recognising credit scoring as a permissible data processing activity. On May 6, 2024 in Surya Prakash v. Union of India and Others, the Supreme Court issued notice on a petition alleging violations of the right to privacy by four foreign credit information companies operating in India.
In Trams Union Cibil Ltd. v. Sajeed V.M.1, the Kerala HC court held that TransUnion CIBIL must update credit ratings on time. The failure to do so would infringe the borrower’s fundamental right, specifically Right to Dignity and Privacy under Article 21 of the Constitution. The court also noted that CIBIL, whose actions have the propensity to affect the fundamental rights of a citizen, has to act in a manner that demonstrates fairness and offers justification for such actions as may be adverse to the interest of the citizen.
Beyond delays in updation or rectification, the problem deepens into systemic opacity and misinformation, individuals have reported credit records showing unpaid loans that were never availed, errors which gravely undermine their creditworthiness. Such practices jeopardise individual financial autonomy and cast serious doubt on the reliability, accountability, and institutional integrity of the credit information framework in India.
LEGISLATIONS IN OTHER JURISDICTIONS
The framework governing CICs and CIBIL score in different countries is instrumental in understanding the objective to be achieved by enacting the legislations. In the U.S.A, Fair Credit Reporting Act, 1970 (hereinafter as ‘FCRA’) regulates the consumer reporting and credit information companies. Under the FCRA, if credit is denied to a consumer, he must be communicated the reasons as to why the credit was not offered to him via a mandatory notice. However, under the CICRA, when credit is not given, the CICs do not provide specifications vis- à-vis the rejection of the credit asked by the borrower.
As a result, under CICRA detailed adverse action disclosure is not provided to the borrower. This further underlines the non-transparent nature of the credit institutions in India, lacking stringent laws to alleviate the hurdles faced by borrowers. Furthermore, under FCRA all the credit reporting agencies (‘CRA’) curate a free annual report, however, in India one free report is provided from each CIC highlighting the fragmented approach adopted in Indian market domain concerning CIBIL score.
Similarly, in the United Kingdoms, under the Consumer Credit Act, 1974 borrowers have the statutory right if the credit is refused and they can demand full disclosure if the incorrect entries are encountered. Thus, there is an obligation on part of the companies to disclose the information sought by the borrower, improving the transparency. In India similar provisions regarding the disclosure of critical information should be mandated for regaining the trust of the public and overall reliability of the reports provided by the CICs. This will also ensure streamlining of the fragmented approach in the current framework governing CIBIL score.
The FCRA also covers wide range of consumer protection mechanisms such as employment, insurance, tenancy along with credit information. However, in India the framework concerning CIC adopts a myopic approach as it only takes cognizance of credit reporting, unlike, other infirmities faced by consumers vis-à-vis tenancy, employment, etc. which are addressed in U.S.A. Adding to this, in U.K there are different regulators which resolves and oversees key aspects of credit reporting, thereby, mitigating the risk of daunting monopoly.
These regulators are Financial Conduct Authority (‘FCA’), Information Commissioner’s Office (‘ICO’). FCA primarily has the function of regulating consumer credit and ensuring that CRAs are providing credit to consumers fairly without any unambiguity. The role of ICO revolves around secure, transparent and lawful usage of data by credit agencies and they are directly accountable to the consumers concerned.
WAY FORWARD
In practice, financial institutions in India depend nearly entirely on TransUnion CIBIL scores, disregarding reports from other financial CICs. Borrowers are at risk as a result of their over dependence. Errors such as delayed updates, faulty rectifications, or even fake loan entries can unfairly lower a person’s score, limiting their access to credit. Worse, positive behaviours like timely repayments often go under the radar, trapping borrowers in a loop of low scores despite responsible financial behaviour.
The dominance of a single bureau is especially alarming given that CICRA stipulated equal treatment for all CICs. By reducing financial credibility to the calculations of one private entity, the system not only undermines individual autonomy but also raises serious concerns about fairness, accountability, and the concentration of power in the hands of a single credit bureau.
The unbalanced nature of the Indian framework gets highlighted in the global practice. To lower the possibility of bias or error, lenders in the US use a variety of agencies, including Equifax, Experian, and TransUnion. The GDPR’s stringent data privacy regulations in the EU hold credit agencies accountable and give people more control over their data. In contrast, India has permitted CIBIL to create a virtual monopoly, excluding other CICs and consolidating vast authority in a single private bureau. In addition to undermining competition and transparency, this unbridled dominance exposes borrowers to systemic injustice and provides them with little options for redress.
The FCRA in the United States, which requires credit reporting agencies to maintain accuracy and transparency while also requiring them to disclose reasons for any adverse action, such as delays in updating or lowering credit scores, is an example of a global best practice that India can learn from. In India, a comparable system would guarantee that borrowers are informed of any abrupt changes in their creditworthiness. These reforms would not only increase credit assessment accuracy, but also create a more robust and egalitarian credit environment that protects both financial autonomy and institutional integrity. By putting in place such safeguards, India’s credit reporting system would be more transparent and in line with international norms, eventually preserving the financial independence and dignity of the citizenry.
CONCLUSION
The credit scoring system remains opaque, inconsistent, and prone to errors, all of which contribute to growing concerns about fairness. The questions remain critical, why should a foreign private entity govern financial autonomy of millions of citizens of India? Additionally, the processing of such data is not clearly regulated and there is a distinct lack of transparency.
Recent judicial pronouncements have highlighted the pressing concerns with regard to data privacy and the lack of robust regulatory oversight, with several of these issues now before the Supreme Court in Surya Prakash v. Union of India, where the legality of credit information companies’ data practices has been challenged. Similarly, in TransUnion CIBIL Ltd. v. Sajeed V.M., the Court stated that delays and mistakes in updating credit score violate the borrower’s dignity and reputation under Article 21 of the Indian Constitution.
While such decisions demonstrate judicial acknowledgment of the problem, it is clear that the present gaps cannot be filled just through statutory interpretation or regulatory recommendations. A more comprehensive response requires proactive legislative intervention to establish a transparent, accountable, and enforceable framework that safeguards individual rights while ensuring systemic integrity in the functioning of credit information companies.