Promulgated by: People’s Bank of China.
Document No.: 中国人民银行令〔2021〕第4号 (PBOC Order [2021] No. 4).
Adopted at the 9th Executive Meeting of the People’s Bank of China of 2021 on September 17, 2021. Promulgated September 27, 2021. Effective January 1, 2022.
Translation note — DCC. Translated in full from the official Chinese text (PBOC Order [2021] No. 4, as published on the People’s Bank of China website). Terminology follows DCC’s bilingual glossary. The Measures implement the State Council’s Regulations on the Administration of the Credit Reporting Industry and cite the Personal Information Protection Law as a parent statute; the PBOC’s own data-security rule for the sectors it supervises is the PBOC Data Security Measures.
Promulgation Order
The Measures for the Administration of Credit Reporting Business, having been deliberated and adopted at the 9th Executive Meeting of the People’s Bank of China of 2021 on September 17, 2021, are hereby promulgated and shall come into force as of January 1, 2022.
Governor Yi Gang
September 27, 2021
Measures for the Administration of Credit Reporting Business
Chapter I General Provisions
Article 1. These Measures are formulated in accordance with the Law of the People’s Republic of China on the People’s Bank of China, the Personal Information Protection Law of the People’s Republic of China, the Regulations on the Administration of the Credit Reporting Industry and other laws and regulations, in order to regulate credit reporting business and related activities, protect the lawful rights and interests of information subjects, promote the sound development of the credit reporting industry, and advance the building of the social credit system.
Article 2. These Measures apply to the conduct, within the territory of the People’s Republic of China, of credit reporting business and related activities in respect of legal persons and unincorporated organizations (hereinafter collectively referred to as enterprises) and individuals.
Article 3. “Credit reporting business” (征信业务) as used in these Measures means the activities of collecting, organizing, retaining and processing the credit information of enterprises and individuals and providing such information to information users.
“Credit information” (信用信息) as used in these Measures means basic information, lending information and other relevant information that is collected in accordance with the law, serves financial and other activities, and is used to identify and judge the credit standing of enterprises and individuals, as well as analytical and evaluative information formed on the basis of the foregoing information.
Article 4. Whoever engages in individual credit reporting business shall obtain an individual credit reporting agency license from the People’s Bank of China in accordance with the law; whoever engages in enterprise credit reporting business shall complete enterprise credit reporting agency filing in accordance with the law; whoever engages in credit rating business shall complete credit rating agency filing in accordance with the law.
Article 5. Financial institutions shall not obtain credit reporting services through commercial cooperation with market institutions that have not obtained lawful credit reporting business qualifications.
“Financial institutions” as used in these Measures means institutions engaged in financial business that are supervised and administered by the financial regulatory departments of the State Council.
Local financial organizations supervised and administered by local financial regulatory departments are subject to the provisions of these Measures concerning financial institutions.
Article 6. Those engaging in credit reporting business and related activities shall protect the lawful rights and interests of information subjects, safeguard information security, guard against the leakage, loss, damage or abuse of credit information, and shall not endanger State secrets or infringe individual privacy or trade secrets.
Those engaging in credit reporting business and related activities shall follow the principles of independence, objectivity and impartiality, shall not violate the provisions of laws and regulations, and shall not violate public order and good morals.
Chapter II Collection of Credit Information
Article 7. The collection of individual credit information shall be carried out by lawful and legitimate means, shall follow the principle of minimum necessity, and shall not be excessive.
Article 8. Credit reporting agencies shall not collect credit information by any of the following means:
(I) deception, coercion or inducement;
(II) charging fees to information subjects;
(III) collection from unlawful channels;
(IV) other means that infringe the lawful rights and interests of information subjects.
Article 9. Where an information provider provides credit information to a credit reporting agency, the credit reporting agency shall formulate relevant systems and conduct necessary review of the information provider’s information sources, information quality, information security, authorization by information subjects and other matters.
Article 10. In establishing business and cooperating with each other, credit reporting agencies and information providers shall comply with the Personal Information Protection Law of the People’s Republic of China and other laws and regulations, and shall specify, by agreement or in another form, the principles of information collection and the respective rights, obligations and responsibilities of each party in obtaining customer consent, information collection, processing, information correction, objection handling, information security and other matters.
Article 11. A credit reporting agency engaging in individual credit reporting business shall formulate a plan for the collection of individual credit information, and shall report to the People’s Bank of China the data items collected, the information sources, the collection methods, the system for protecting the lawful rights and interests of information subjects and other matters, and any changes thereto.
Article 12. The collection of individual credit information by a credit reporting agency shall be subject to the consent of the information subject, and the agency shall explicitly inform the information subject of the purpose of collecting the credit information, except for information disclosed in accordance with laws and regulations.
Article 13. Where a credit reporting agency obtains the consent of an individual through an information provider, the information provider shall perform the obligation of notification to the information subject.
Article 14. Individual credit reporting agencies shall report to the People’s Bank of China the information providers that cooperate with them in the collection, organization, processing and analysis of individual credit information.
Individual credit reporting agencies shall standardize the content of their cooperation agreements with information providers. Information providers shall submit to risk assessment by the individual credit reporting agency, and verification of circumstances by the People’s Bank of China, in respect of matters concerning the handling of individual credit information.
Article 15. The collection of enterprise credit information shall be based on lawful purposes and shall not infringe trade secrets.
Chapter III Organization, Retention and Processing of Credit Information
Article 16. In organizing, retaining and processing credit information, credit reporting agencies shall follow the principle of objectivity and shall not tamper with original information.
Article 17. Credit reporting agencies shall take measures to improve the accuracy of information in the credit reporting system and ensure information quality.
Article 18. Where a credit reporting agency discovers an information error in the course of organizing, retaining or processing credit information, if the error lies in the submission by the information provider, it shall promptly notify the information provider to make a correction; if the error lies in its internal processing, it shall promptly correct the error and optimize its internal procedures for processing credit information.
Article 19. Credit reporting agencies shall compare information originating from different information providers, and where inconsistencies are found, shall verify and handle them in a timely manner.
Article 20. The period for which a credit reporting agency retains individual negative information (不良信息) it has collected shall be 5 years from the date on which the adverse act or event terminates.
Upon expiry of the retention period for individual negative information, the credit reporting agency shall delete the individual negative information from its external services and applications; where such information is used as sample data, it shall be anonymized.
Chapter IV Provision and Use of Credit Information
Article 21. In providing credit reporting products and services externally, credit reporting agencies shall follow the principle of fairness, shall not set unreasonable commercial conditions restricting use by different information users, and shall not use a dominant position to provide discriminatory or exclusive products and services.
Article 22. Credit reporting agencies shall take appropriate measures to conduct necessary review of the identity, business qualifications, purpose of use and other matters of information users.
Credit reporting agencies shall assess the network and system security and the compliance management measures of information users’ access to the credit reporting system, and shall monitor inquiry behavior. Where hidden security dangers or abnormal behavior are discovered, they shall be verified in a timely manner; where violations of laws or regulations are discovered, the provision of services shall cease.
Article 23. Information users shall take necessary measures to ensure that the consent of the information subject is obtained when inquiring about individual credit information, and shall use individual credit information in accordance with the agreed purpose.
Article 24. Information users’ use of credit information provided by credit reporting agencies shall be based on lawful and legitimate purposes, and credit information shall not be abused.
Article 25. Individual information subjects have the right to obtain their own credit report free of charge twice a year; credit reporting agencies may provide credit report inquiry services to individual information subjects through multiple channels such as Internet inquiry and inquiry at business premises.
Article 26. Where an information subject believes that information contains errors or omissions, it has the right to raise an objection with the credit reporting agency or the information provider; where it believes that its lawful rights and interests have been infringed, it may lodge a complaint with the local branch of the People’s Bank of China. Objections and complaints shall be handled in accordance with the Regulations on the Administration of the Credit Reporting Industry and relevant provisions.
Article 27. Credit reporting agencies shall not charge fees to information subjects on the grounds of deleting negative information or refraining from collecting negative information.
Article 28. Where a credit reporting agency provides credit information inquiry products and services such as credit reports, it shall objectively display the content of the credit information inquired, and shall explain the content of the credit information inquired and the technical terms used.
Information subjects have the right to require a credit reporting agency to add objection marks and statements in the credit report.
Article 29. Where a credit reporting agency provides credit evaluation products and services such as profiling, scoring and rating, it shall establish evaluation standards, and shall not use factors unrelated to the credit of the information subject as evaluation standards.
Before formally providing credit evaluation products and services externally, a credit reporting agency shall perform necessary internal testing and evaluation and validation procedures, so that the evaluation rules are explainable and the information sources are traceable.
Where a credit reporting agency provides credit rating products and services for economic entities or debt financing instruments, it shall conduct such business in accordance with the Interim Measures for the Administration of the Credit Rating Industry (promulgated as Order [2019] No. 5 of the People’s Bank of China, the National Development and Reform Commission, the Ministry of Finance and the China Securities Regulatory Commission) and other relevant provisions.
Article 30. Where a credit reporting agency provides credit anti-fraud products and services, it shall establish standards for the determination of fraudulent credit information.
Article 31. Where a credit reporting agency provides credit information inquiry, credit evaluation or credit anti-fraud products and services, it shall report the following matters to the People’s Bank of China or its branch at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city:
(I) the template and content of credit reports;
(II) the evaluation methods, models and main dimensions and factors of credit evaluation products and services;
(III) the data sources and the standards for the determination of fraudulent credit information of credit anti-fraud products and services.
Article 32. Credit reporting agencies shall not engage in the following activities:
(I) making commitments regarding credit evaluation results;
(II) promoting products and services using content that is suggestive of credit evaluation results;
(III) conducting marketing in the name of a government department or industry association without its consent;
(IV) providing credit reporting products and services to information subjects or information users by means of coercion, deception or inducement;
(V) making false publicity about credit reporting products and services;
(VI) providing other credit reporting products and services that affect the objectivity and impartiality of credit reporting business.
Chapter V Security of Credit Information
Article 33. Credit reporting agencies shall implement the Multi-Level Protection Scheme (MLPS, 网络安全等级保护制度) for cybersecurity, formulate security management systems covering business activities and equipment and facilities, and adopt effective protective measures to safeguard the security of the credit reporting system.
Article 34. Individual credit reporting agencies, and enterprise credit reporting agencies that retain or handle the credit information of 1 million or more enterprises, shall satisfy the following requirements:
(I) the cybersecurity protection level of their core business information systems possesses security protection capability at Level 3 or above;
(II) a person in charge of information security and a person in charge of personal information protection are established, to be held by senior management personnel provided for in the company’s articles of association;
(III) a dedicated department is established to be responsible for information security and personal information protection work and to regularly inspect the implementation of the systems and measures for credit reporting business, system security and personal information protection.
Article 35. Credit reporting agencies shall safeguard the security of the operating facilities and equipment of the credit reporting system, the security control facilities and equipment, and Internet applications; carry out day-to-day operation and maintenance management of the credit reporting system; safeguard the physical security, communication network security, regional boundary security, computing environment security and management center security of the system; and guard against unlawful intrusion into and damage to the credit reporting system.
Article 36. Credit reporting agencies shall carry out personnel security management in respect of personnel recruitment, departure, appraisal, security education and training, and the management of access by external personnel.
Article 37. Credit reporting agencies shall strictly limit the authority and scope of staff within the company who inquire about and obtain credit information.
Credit reporting agencies shall retain operation records of staff inquiring about and obtaining credit information, clearly recording the time, method, content and purpose of each inquiry or acquisition of credit information by staff.
Article 38. Credit reporting agencies shall establish an emergency response system and, where an incident such as a leak of credit information occurs or may occur, shall immediately take necessary measures to reduce the harm and promptly report to the People’s Bank of China and its branch at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city.
Article 39. Where a credit reporting agency conducts credit reporting business and related activities within the territory of the People’s Republic of China, the enterprise credit information and individual credit information it collects shall be stored within the territory of the People’s Republic of China.
Article 40. Where a credit reporting agency provides individual credit information abroad, it shall comply with the provisions of laws and regulations.
Where a credit reporting agency provides enterprise credit information inquiry products and services to overseas information users, it shall conduct necessary review of the identity of the information user and the purpose of the credit information, ensure that the credit information is used for reasonable purposes such as cross-border trade, investment and financing, and shall not endanger national security.
Article 41. Where a credit reporting agency cooperates with an overseas credit reporting agency, it shall report the cooperation agreement to the People’s Bank of China after the cooperation agreement is signed and before the business commences.
Chapter VI Supervision and Administration
Article 42. Credit reporting agencies shall disclose the following matters to the public and accept public supervision:
(I) the categories of credit information collected;
(II) the basic format and content of credit reports;
(III) the objection handling process;
(IV) other matters that the People’s Bank of China considers necessary to disclose.
Article 43. Individual credit reporting agencies shall, each year, conduct a compliance audit of their own individual credit reporting business’s compliance with the Personal Information Protection Law of the People’s Republic of China and the Regulations on the Administration of the Credit Reporting Industry, and shall promptly report the compliance audit report to the People’s Bank of China.
Article 44. The People’s Bank of China and its branches at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city shall supervise and inspect the following matters of credit reporting agencies:
(I) the building of internal control systems for credit reporting, including the completeness, compliance and operability of the various systems and related procedures;
(II) the compliance of credit reporting business operations, including the collection of credit information, the external provision and use of credit information, objection and complaint handling, user management, and the compliance of other matters;
(III) the security of the credit reporting system, including information technology systems, security management and system development;
(IV) other matters related to credit reporting business activities.
Article 45. Where an information provider or information user violates the Regulations on the Administration of the Credit Reporting Industry and infringes the lawful rights and interests of an information subject, the People’s Bank of China and its branches at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city shall inspect and handle the matter in accordance with the law.
Chapter VII Legal Liability
Article 46. Whoever, in violation of Article 4 of these Measures, engages in individual credit reporting business without authorization shall be penalized by the People’s Bank of China in accordance with Article 36 of the Regulations on the Administration of the Credit Reporting Industry; whoever engages in enterprise credit reporting business without authorization shall be penalized by the branch of the People’s Bank of China at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city in accordance with Article 37 of the Regulations on the Administration of the Credit Reporting Industry.
Where a financial institution, in violation of Article 5 of these Measures, obtains credit reporting services through commercial cooperation with a market institution that has not obtained lawful credit reporting business qualifications, the People’s Bank of China and its branches shall order it to make corrections, impose a fine of not more than RMB 30,000 on the entity, and impose a fine of not more than RMB 1,000 on the directly responsible person in charge.
Article 47. Where a credit reporting agency violates Article 8, 16, 20, 27 or 32 of these Measures, the People’s Bank of China and its branches at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city shall penalize it in accordance with Article 38 of the Regulations on the Administration of the Credit Reporting Industry.
Article 48. Where a credit reporting agency violates Article 14, 21, 31, 34, 39 or 42 of these Measures, the People’s Bank of China and its branches at or above the level of central sub-branch in a provincial capital (or capital of an autonomous region) city shall order it to make corrections, confiscate its illegal gains, impose a fine of not more than RMB 30,000 on the entity, and impose a fine of not more than RMB 1,000 on the directly responsible person in charge. Where laws or administrative regulations provide otherwise, such provisions shall prevail.
Chapter VIII Supplementary Provisions
Article 49. The conduct of credit reporting business by the basic financial credit information database, and the submission of credit information to, or inquiry about credit information from, the basic financial credit information database by institutions engaged in lending business, shall be carried out by reference to these Measures.
Article 50. Whoever, in the name of “credit information services,” “credit services,” “credit scoring,” “credit rating,” “credit repair” or the like, in substance provides credit reporting services externally is subject to these Measures.
Article 51. Institutions that, before the implementation of these Measures, have not obtained an individual credit reporting business license or completed enterprise credit reporting agency filing but in substance engage in credit reporting business shall complete compliance rectification within 18 months from the date of implementation of these Measures.
Article 52. The People’s Bank of China shall be responsible for the interpretation of these Measures.
Article 53. These Measures shall come into force as of January 1, 2022.