The Central Bank of Kenya (CBK) plays a critical role in overseeing how Credit Reference Bureaus (CRBs) manage credit information through the Banking (Credit Reference Bureau) Regulations, 2020. These regulations, which were reinstated by the High Court in February 2024 after a brief nullification, standardize how financial data is collected, shared, and stored. The framework seeks to create a transparent credit information system, protect consumer rights, and reduce lending risks across Kenya’s banking sector.
Currently, only three licensed CRBs operate in the country, TransUnion, Metropol, and Creditinfo, and they are authorized to operate under CBK’s supervision. These institutions are required to process and share data consistently, ensuring fairness in how borrowers are listed or delisted from the CRB database.
CRB Listing
CRB listing is the process through which a lender submits negative or positive credit information about a borrower to a Credit Reference Bureau. CBK regulations control this process closely to prevent unfair blacklisting and ensure accuracy.
Under the current rules, negative credit information, such as non-performing loans (NPLs), defaults, fraud, or bounced cheques, can only be reported to CRBs if the outstanding amount exceeds KSh 1,000. This limit protects borrowers with minor arrears from being unnecessarily listed and facing long-term exclusion from formal credit.
CBK defines non-performing loans (NPLs) based on the type of financial institution:
- For commercial banks, a loan is considered non-performing if principal or interest remains unpaid for 90 days or more.
- For microfinance institutions, the period is 30 days.
- For SACCOs, a delinquent loan is determined as per the Sacco Societies Act.
To protect borrower privacy, the regulations prohibit sharing sensitive personal information such as religion, political affiliation, or health status. Additionally, before a lender submits a borrower’s data to a CRB, they must obtain explicit consent through the loan agreement or digital authorization.
Before any negative CRB listing is made, lenders are required to notify borrowers in advance, with one month for long-term credit facilities or two weeks for short-term loans. This notice period gives borrowers time to clear arrears or raise disputes before their names are forwarded to CRBs. Once a listing occurs, lenders must send a confirmation notice within 30 days, along with details on how borrowers can challenge inaccurate entries.
Any errors or incomplete data submissions attract penalties of up to KSh 2 million per instance under Regulation 63(10). Furthermore, all submitted credit data must be distributed to every licensed CRB or a CBK-approved central data hub, with updates processed within two working days (Regulations 35(3) and 63(6)).
CBK also retains the authority to suspend or restrict listings during periods of economic hardship. For example, in 2021, during the COVID-19 pandemic, the CBK temporarily suspended CRB listings for loans below KSh 5 million for 12 months to ease financial pressure on borrowers. Any institution found violating these rules risks fines or even license revocation.
These measures have curbed over-listing and improved fairness in Kenya’s lending ecosystem. Borrowers can now better understand the criteria for listing and are protected from arbitrary or premature blacklisting.
CRB Delisting
CRB delisting refers to the removal of negative credit information from a borrower’s record. CBK has detailed rules that govern how and when this happens, providing both automatic and corrective delisting processes.
Under Regulation 34, the Central Bank of Kenya’s Credit Reference Bureau (CRB) regulations specify how negative and positive credit information is to be handled. Negative credit information, such as records of non-performing loans or defaults, is retained for five years after the final settlement of the debt. In cases of bankruptcy, this data is kept for seven years from the date of discharge. The regulations also require CRBs to maintain records of all amendments or deletions made to customer information, though the 2020 regulations do not specify a seven-day window for notifying customers after a deletion.
Failure to comply with these requirements attracts financial penalties. A CRB that fails to correct inaccurate information after notification may be fined up to KSh 500,000. However, the higher penalty, KSh 500,000 plus KSh 10,000 for each additional day of delay, applies to CRBs engaging in unapproved activities, not to notification delays. In contrast, positive credit information, including timely loan repayment records, may be shared and retained without any time limit.
Borrowers also have the right to dispute any inaccurate or outdated listings. Each individual is entitled to one free credit report per year, or an additional one after receiving an adverse action notice from a lender. If a borrower believes their listing is incorrect, they can file a written dispute with the CRB.
Once a dispute is received, the CRB must flag the account immediately and investigate the claim within seven days, notifying the lender or credit provider. The provider then has 21 days to verify and respond. If the issue is not resolved within that time, the disputed information is automatically deleted as per Regulation 37(10).
When an error is confirmed, lenders must correct it within five days, and CRBs must update their systems within two days of receiving the correction. If a borrower remains dissatisfied with the resolution, they can append a 100-word statement explaining their side of the issue or escalate the complaint to the CBK, alternative dispute resolution channels, or the courts.
CBK’s supervisory role extends to auditing CRB operations, ensuring compliance, and maintaining ownership of all CRB data under Regulation 59. In cases of serious breaches, CBK can order mass deletions or impose penalties of up to KSh 500,000 for wrongful data retention or disclosure.
Jefferson Wachira is a writer at Africa Digest News, specializing in banking and finance trends, and their impact on African economies.