India – FIG Paper (No. 9) – RBI Press Release On ‘Specified Users’ – New Year Relief For Fintech Companies.

The end of 2021 and the beginning of 2022 has come bearing gifts for the financial technology (“Fintech”) sector particularly for the lending space. The Reserve Bank of India (“RBI”) had amended the Credit Information Companies Regulations, 2006 (“Regulations”) on November 10, 2021 vide the Credit Information Companies (Amendment) Regulations, 2021  (“Amendment”)[1] – the first amendment since 2017 – expanding the scope of entities falling within the definition of ‘specified users’ under Regulation 3 to include “an entity engaged in the processing of information, for the support or benefit of credit institutions, and satisfying the criteria laid down by the Reserve Bank from time to time.”

 

Within the meaning of the Credit Information Companies (Regulation) Act, 2005 (“CICRA”) ‘Specified Users’ are credit institutions or credit information companies and also includes such other entities which are specifically allowed by the RBI to obtain credit information from a credit information company. Regulation 3 of the Regulations, as it stood prior to the Amendment, permitted only insurance companies, telecom service providers, credit rating agency, SEBI-registered stock brokers, commodities exchange trading member, the Securities and Exchange Board of India, Insurance Regulatory and Development Authority, an ‘information utility’ under the Insolvency and Bankruptcy Code, 2016 (“IBC”), and a resolution professional appointed under the IBC[2] to be considered ‘specified users’.
 

On the face of it, the amendment is broad in its ambit. However, vide Press Release dated January 05, 2022 (“Press Release”)[3], the RBI has clarified the eligibility criteria for entities seeking to be brought within the scope of Specified Users. This represents a softening of RBI’s earlier stand. In 2019, the RBI had issued letters to banks and Non-Banking Financial Companies (“NBFC”) to desist from providing credit information access to unregulated entities.[4] The 2019 letters had the effect of prohibiting and/ or restricting Fintech platforms, particularly those offering lending services, from obtaining credit information from credit information bureaus since the threat of penalties loomed in case of non-compliance.
 

The Amendment and Press Release are a welcome step at a time when Fintech companies are actively engaged in the lending space for either micro-financing or, in the case of a number of e-commerce platforms, their buy now pay later (“BNPL”) services.
 

The Press Release has laid down 8 (eight) criteria to be met by entities seeking recognition as Specified Users (i) incorporation must be in India or under an Indian statute; (ii) the activity of processing information for credit institutions must be provided in the governing statute or memorandum of association of the entity, as the case may be; (iii) the entity should have a net worth of not less than INR 2 crore as per the latest audited balance sheet on a continuing basis; (iv) the entity shall be owned and controlled by either resident Indian citizens or by an Indian company owned and controlled by resident Indian citizens; (v) ownership shall be well-diversified; (vi) the entity should have not less than 3 (three) years of experience in running a business of processing information for the support and benefit of credit institutions; (vii) the entity or its promoters/ directors shall not have been convicted of any offence involving moral turpitude or any economic offence; and (viii) the entity shall have certification from a CISA certified auditor confirming its ability to comply with the regulations relating to preservation of credit information under CICRA.
 

Two eligibility requirements which are unclear and might raise concerns for Fintech companies looking to fall within the scope of Specified Users are:
 

(a) The requirement of being an Indian company owned and ‘controlled’ by a resident Indian or resident Indian citizens set out in criteria (i) and (iv) has evidently been put in place to ensure data localisation as well as to exclude entities controlled by foreign companies or those that have downstream investments from any foreign entities. However, there is still scope for judicial and/ or regulatory interpretation on the question of ‘control’, which if forthcoming may come as a relief for a number of Fintech companies with substantial foreign investment.
 

(b) The requirement of ‘well-diversified’ ownership has not been elaborated upon, and therefore raises the question of what constitutes ownership that is well-diversified. Additionally, in the absence of a defined position on diversification, this criterion also opens up the Press Release to judicial scrutiny or further clarifications from the RBI.
 

While the RBI has indeed taken a much-needed step towards a more liberalised regulatory environment for Fintech companies, it is clear that there will be clarifications and interpretations required from regulators as well as the courts to bring about greater certainty in the eligibility criteria.
 

Anu Tiwari – Partner (Co-Head – Fintech)

anu.tiwari@cyrilshroff.com
 

[1] Regulation No. DOR. SIG. FIN. No. 52140/20/16/050/2021-22 dated November 10, 2021.

[2] Inclusions under the IBC were inserted vide the Credit Information Companies (Amendment) Regulations, 2017 issued vide Notification No. BBR.CID. No. 786/20.16.050/2017-18 dated August 11, 2017.

[3] https://rbidocs.rbi.org.in/rdocs/content/pdfs/Eligibility05012022.pdf, released vide Press Release 2021-2022/1500 of the Reserve Bank of India titled “RBI Releases “Eligibility criteria for entities to be categorised as Specified User under clause (j) of Regulation 3 of the Credit Information Companies (Amendment) Regulations, 2021””

[4] Bhakta, Pratik, and Ashwin Manikandan. “RBI: RBI Restricts Access to Credit Data of Consumers.” The Economic Times, https://economictimes.indiatimes.com/small-biz/startups/newsbuzz/apex-bank-restricts-access-to-credit-data-of-consumers/articleshow/71194383.cms.