“Brutus is an honorable man.” – Mark Antony, Julius Ceaser Act III Scene II, William Shakespeare
In January
2015, the Reserve Bank of India (RBI) made it mandatory for all
Credit Institutions (CIs) of India to become members of all Credit
Information Companies (CICs).
A Credit Institution is any
entity in the business of lending money to customers. This ranges from large
banks like HDFC Bank to village-level formal peer-lending systems. This article
focuses on Non-Banking Financial Companies (NBFCs), particularly, small
NBFCs.
An NBFC is
any company that is engaged in the business of lending money, acquisition of
securities, hire-purchase insurance business, or chit-fund business which, as
the name suggests, does not have a banking license. Hence, an NBFC
cannot borrow from the RBI at low rates of interest. Most NBFCs are not allowed
to accept public deposits either. This leads to scaling issues and hence NBFCs
do not grow as big as banks. Of course, being an NBFC is the route of becoming
a bank for most companies. This also means a less-strict regulatory regime on
NBFCs compared to banks. As of April
2026, there were 9075 NBFCs in India. Due to their higher cost
structure, NBFCs operate in a riskier segment of the market – small
businessmen, household women, gold loans, small corporates, farmers etc.
A CIC is a company registered
with the RBI that is in the business of collecting and disseminating credit
information. There are four CICs in India. The most famous CIC is TransUnion
CIBIL having a 70%
market share in the Indian market. Others are Experian India (16%),
CRIF High Mark (10%),
and Equifax India (4%).
Together with the RBI, the four CICs create the credit information
infrastructure for India.
It is logical that lenders
regulated under the RBI should report their lending activities on a periodic
basis, so that other lenders interacting with a potential borrowers have
knowledge of the credit behaviour of the customer. Put simply, whenever a customer
walks into a bank for availing a loan, the first thing the bank does is check
the CIBIL score of the customer. This is the first step in any lending process.
And to increase transparency among lenders, the RBI in January 2015 mandated
that all lenders make mandatory reporting to all four CICs in the country.
Which is where the problem
begins.
1.
Why not a central repository?
This is the simplest, most
obvious, and overlooked solution to the problem. Instead of 9k NBFCs reporting
their credit information to all 4 CICs, they could simply report it to one. And
the 4 CICs could work with the RBI to create a central repository of such
credit data. This would release some unnecessary compliance burden and the
corporate could focus on being a corporate.
This has been suggested to the
RBI several times who have taken the idea in consideration and rejected it for
reasons unknown.
2.
Unequal relationship with NBFCs
By mandating that every NBFC in
the country be registered with every CIC, this gave CICs a semi-regulatory
power. Now any CIC could threaten any NBFC with mandatory registration. A
registration is a contract where terms must be met by both parties. But the
terms of registration with a CIC are set by the CIC with NBFCs having no say.
This creates an unequal relationship between two private entities mandated by
state decree.
For example, the NBFC must set
one nodal officer for all communications with the CIC. However, the CIC
is allowed to create bureaucratic red tapes for the NBFC to struggle through
various functional teams of the CIC. Any lapse that occurs out of this system
can be easily blamed on the NBFC while the CIC was just following procedures.
3.
Private for-profit nature of CICs
Contrary to popular belief, CICs
are not government bodies. In fact, they aren’t even Indian. 92%
of CIBIL is owned by TransUnion, an American multinational group with
headquarters in Chicago. Experian India is owned by Experian plc, Ireland; CRIF
High Mark is owned by CRIF S.p.A., Italy; and Equifax India is owned by Equifax
Inc, USA.
As per RBI mandates, every
credit transaction in the country needs to be reported to all four of these
CICs. So the next time you apply to a bank for a loan and they check your
credit history on CIBIL, do not be surprised if you start getting calls from all
kinds of spam
callers offering you loans. Your private data is being sold on a
real-time basis, not by Indian banks, but by entities far outside the control
of the Indian regulatory regime. As per the RBI, this is a necessary cost to
promote credit transparency in the country.
4.
Regulatory Powers to CICs
Under the CIC
Regulations, 2006, CICs can report members who do not submit the credit
information on time. With the January 2015 circular, CICs can now mandate every
NBFC in the country to mandatorily report their credit information. This
effectively makes NBFCs a hostage to the CICs. Given that CICs are private entities,
their concern is not the well-being of the NBFCs, but the pursuit of profits. CICs
have cumbersome systems which cannot be navigated by small companies who lack a
dedicated reporting department. This allows CICs to sell software and
compliance services through third-party agencies to ease the compliance burden
on the NBFCs. The classic case of making money by solving a problem that didn’t
exist in the first place. All under the garb of RBI regulations. Contrary to
Uncle Ben’s wisdom, RBI’s decree of compulsory registration has given CICs
inordinate power, but very little responsibility.
5.
Double profiteering
It is the duty of a CIC to
collect and disseminate information. It collects information from its members,
and it disseminates information to anyone who is willing to pay for such
information. The RBI has made it mandatory for banks to check for CIC scores of
potential borrowers before proceeding with any credit transaction. The RBI has
also made it mandatory for all credit institutions to submit such credit
information to the CICs. CICs charge money at both ends of the information
stream, for receiving as well as disseminating information. If it is the duty
of the CIC to collect information, then why are NBFCs paying money to the CICs
to submit information?
This goes back to the unequal
relationship where NBFCs must adhere to the terms specified by the CICs to be
registered where the CIC mandates NBFCs to pay up to be registered.
6.
Use of Spam Bots
If you’ve ever had the
(mis?)fortune of interacting with CIBIL, you would know that they do not use
normal Indian numbers. The call would typically come from a foreign number and
would be marked spam by whatever CallerID service you use.
If you do pick up the call, you
will be told that CIBIL is recording the call. But if you were to ask for that
recording in case of a dispute, then CIBIL would somehow lose that recording.
If you do manage to make it
through a call, you would realize its always to sell something. Either it is
your own credit score, or a credit score management software, or some
third-party who got your number from CIBIL and want to sell you services that will
improve your credit score. Ultimately, the data and attention of Indians is for
grabs to the highest bidder.
---
To conclude, the RBI is
overlooking a very pertinent problem having an obvious solution. One can only
assume incompetence or corruption to allow such issues to persist. The RBI has
already mandated data preservation laws for credit
card transactions and central
repository laws for large borrowers. The same can be implemented for
CICs. It is also strange that such a critical infrastructure which forms a
cornerstone of modern Indian banking is left to the regulation of four foreign
entities who have been given quasi-regulatory powers by the RBI.
