Specified users under CICRA herald changing nature of lending

By Anu Tiwari and Anindita Bhowmik, Cyril Amarchand Mangaldas

The Reserve Bank of India (RBI) has amended the Credit Information Companies Regulations, 2006 on 10 November 2021, through the Credit Information Companies (Amendment) Regulations, 2021. This is the first amendment to the regulations since 2017, and has expanded the scope of entities within the definition of specified users under regulation 3 to include, “an entity engaged in the processing of information for the support or benefit of credit institutions, and satisfying the criteria laid down by the Reserve Bank from time to time”.

Specified users

Anindita Bhowmik
Cyril Amarchand Mangaldas

Within the meaning of the Credit Information Companies (Regulation) Act, 2005 (CICRA), specified users include credit institutions or credit information companies as well as other entities specifically allowed by the RBI to obtain credit information from a credit information company.

Prior to the amendment, only insurance companies, telecom service providers, credit rating agencies, stockbrokers registered with the Securities and Exchange Board of India (SEBI), commodities exchange trading members, the SEBI, the Insurance Regulatory and Development Authority, an information utility under the Insolvency and Bankruptcy Code, 2016 (IBC), and a resolution professional appointed under the IBC were considered specified users.

The RBI had, in 2019, issued letters to banks and non-banking financial companies to desist from providing credit information access to unregulated entities. This had the effect of prohibiting and/or restricting fintech platforms, particularly those offering lending services, from obtaining credit information through credit information bureaus. Therefore, the amendment represents a softening of the earlier RBI position at a time when fintechs actively engage in the lending space, either in microfinancing or offering buy-now-pay-later services.

More criteria for specified users

The RBI has, through its press release dated 5 January 2022, laid down the criteria to be met by entities seeking recognition as specified users:

(1) Incorporation must be in India or under an Indian statute;

(2) The activity of processing information for credit institutions must be provided in the governing statute or memorandum of association of the entity, as the case may be;

(3) The entity should have a net worth of not less than INR20 million (USD265,000) as per the latest audited balance sheet, on a continual basis;

(4) The entity shall be owned and controlled by either resident Indian citizens or by an Indian company owned and controlled by resident Indian citizens;

(5) Ownership shall be well-diversified;

(6) The entity should have not less than three years of experience in running a business of processing information for the support and benefit of credit institutions;

(7) The entity or its promoters/directors shall not have been convicted of any offence involving moral turpitude or economic offence; and

(8) The entity shall have certification from a Certified Information Systems Auditor-certified auditor to confirm its ability to comply with the regulations relating to the preservation of credit information under the CICRA.

Scope for clarification

While the RBI made a concerted effort to provide comprehensive guidelines for eligibility, two unclear criteria may raise concerns for fintechs looking to fall within the scope of specified users:

Anu Tiwari
Cyril Amarchand Mangaldas

(1) “Control” in the context of ownership. The specified user must be owned and controlled by a resident Indian or resident Indian citizens. This appears to ensure data localisation and exclude entities controlled by foreign companies, or those with downstream investments from any foreign entities. This may prove to be a roadblock for many fintechs with substantial foreign investment and overseas holding structures.

(2) Diversification of ownership. The criteria for “well-diversified” ownership mentioned in the press release has not been defined in the amendment, and therefore raises the question of what constitutes ownership that is well-diversified enough to be acceptable to the RBI for the purposes of the regulations.

The amendment represents a welcome acknowledgement from the RBI of the changing nature of lending and credit activities, and the intrinsic role of fintechs in this space. It will provide a boost to fintechs to refine their technology and processes with access to credit information. However, while the RBI has attempted to specify objective criteria for entities eligible to be considered within the expanded scope of the definition of specified users, some criteria leave scope for debate.

Anu Tiwari and Anindita Bhowmik are partners at Cyril Amarchand Mangaldas. Principal associate PALLAVI RAO and associate SOUMYA DASGUPTA also contributed to this article

Cyril amarchand

Cyril Amarchand Mangaldas
Peninsula Chambers, Peninsula Corporate Park
Lower Parel
Mumbai 400 013, India



Contact details:
Tel: +91 22 2496 4455
Email: cam.mumbai@cyrilshroff.com