Reserve Bank of India (Credit Information Companies) Directions, 2025 (Updated as on July 01, 2026)
UR
- Applies toCredit information companies
- StatusIn force
- RBI text changedRBI's text for this document has changed since BankPulse last read it. BankPulse is re-reading it.
- IssuedNov 28, 2025
- Last amendedDec 04, 2025 · 1 incorporated
- Length54 points in 3 sections · 5 min read
The four dates on this rule
- PublishedNov 28, 2025The day RBI put this document out. This is the same day as the Issued date on this rule.
- Starts to applyNov 28, 2025The day this rule starts to apply, as RBI's own text states it.
- Time to get readyNoneIt starts to apply on the day it was published.
- Last date to actNot statedNo date to act by was found in this document. Other dates may sit inside single paragraphs.
Kept in your browser only. Your desk
Show me the points for
Nothing is removed from the page.
Show me the points about
52 of the 54 points name no product and bind every product. All products.
Numbers to remember
| Rs.10,000, | A credit bureau may charge a new member at most Rs.10,000, one time only. RBI Para 14 |
| Rs.5,000 | Yearly membership fees a credit bureau charges its members may not exceed Rs.5,000. RBI Para 14 |
| Rs.2 crore | A company applying to become a member needs a net worth of at least Rs.2 crore. RBI Para 14 |
| six months | A member's own stored credit data must be deleted after six months. RBI Para 14 |
| Rs.1,00,000 | Individual SHG-member data is collected only once a group's own loan tops Rs.1,00,000. RBI Para 17 |
| Rs.100 | A delayed complaint earns the customer Rs.100 for every day beyond 30 days. RBI Para 41 |
| 21 days | Lenders get 21 days to answer; the credit bureau gets the remaining nine. RBI Para 41 |
| five working days | Compensation must reach the customer's account within five working days of resolution. RBI Para 41 |
What it says
How firm is each point
Stated by RBI — RBI’s own paragraph says this. We have only made it plainer.
Our reading — BankPulse read RBI’s paragraph and shortened it. The paragraph is the authority, not this line.
Needs judgement — RBI leaves this to the bank to settle, so nobody can give you a fixed number here.
Chapter I. Preliminary
1. Who this rulebook covers
These Directions apply only to India's four Credit Information Companies, or CICs.
2. Lenders count as CIs
Credit institutions include commercial banks, co-operative banks, NABARD, SIDBI and most NBFCs.
Chapter II. Role of the Board
1. Board reviews match logic yearly
The board must check the matching algorithm at least once every half year.
2. Board reviews partner audits
The board must review information-security audit reports of the bureau's data-sharing partners.
3. Board reviews complaints quarterly
The board must look at complaint numbers on a quarterly basis.
Chapter IV. Investment in CICs
1. Investment capped at 10%
Nobody may hold more than 10% of a CIC's equity, directly or indirectly.
2. Track record lifts FDI cap
A proven investor may hold 49% if ownership isn't diversified, 100% if it is.
3. FPI stake stays under 10%
A single foreign portfolio investor may hold below 10% equity in a CIC.
4. 1% stake must be reported
Any FPI buying more than 1% of a CIC must report it to RBI.
Chapter V. Credit Information Reporting and Dissemination
Must know
1. Membership fee capped at Rs.10,000
A credit bureau may charge a new member at most Rs.10,000, one time only.
2. Annual fee capped at Rs.5,000
Yearly membership fees a credit bureau charges its members may not exceed Rs.5,000.
3. Net worth: Rs.2 crore
A company applying to become a member needs a net worth of at least Rs.2 crore.
4. Ownership caps: 26% and 10%
A well-diversified applicant limits its promoter group to 26% and any other holder to 10%.
5. Member data stays inside India
A member must process and store the credit data only within India.
6. Member storage: 6-month cap
A member's own stored credit data must be deleted after six months.
7. SHG threshold: Rs.1 lakh
Individual SHG-member data is collected only once a group's own loan tops Rs.1,00,000.
8. One report per borrower
The credit bureau issues a single report per borrower, even with more than one address.
9. Rejections stay off record
The credit bureau never reports a loan application that was declined before.
10. Score runs 300 to 900
Credit scores are calibrated on one common scale, from 300 to 900.
11. Free report, once a year
Every individual can get one free full credit report, with score, once a year.
12. Consent data: 6-month cap
Credit data a credit bureau shares on consent is stored for six months at most.
13. Shared data stays in India
Credit data the credit bureau shares with an outside entity stays inside India.
14. Fix errors at the source
Every data error is corrected at the lender that first submitted it, not at the bureau.
Do it
15. Ownership change: 30-day report
A member must report any change in its own ownership within 30 days.
16. Members audit their own systems
A member must audit its own IT systems at least every half year.
17. Four reporting dates a month
Lenders send credit data on the 9th, 16th, 23rd and the month's last day.
18. Full file due by 5th
Lenders must send the complete monthly file by the 5th of next month.
19. Changes due within 4 days
Mid-month account changes must reach the credit bureau within four calendar days.
20. Commercial paper reported fortnightly
Commercial paper details reach the credit bureau every fortnight.
21. Currency exposure reported fortnightly
Unhedged foreign currency exposure data reaches the credit bureau every fortnight.
22. Relationship data mandatory since 2018
Relationship-segment reporting became mandatory for accounts opened on or after July 01, 2018.
23. Bad-data checks run quarterly
The credit bureau must check its records for errors at least once a quarter.
24. Correct data before resubmitting
A lender must fix rejected records before or alongside its next submission.
25. File score: 3-day deadline
Each file's own data-quality score reaches the lender within three calendar days.
26. Lender score due by 10th
A lender's overall data-quality score arrives every month by the 10th.
27. Partner IS audits run yearly
The credit bureau's data-sharing partners face an information-security audit every year.
28. Six months buys free copy
A corrected report is free if it was issued within the last six months.
Chapter VI. Technical Working Group
1. TWG meets at least yearly
RBI's Technical Working Group must meet at least once every calendar year.
2. Sub-group meets every half year
The Technical Working Group's own sub-group must meet at least every half year.
3. Agenda goes out 15 days
Meeting papers must reach members at least 15 days before the meeting.
4. Four bureaus share the chair
The four CICs take turns each year chairing RBI's Technical Working Group.
Chapter VII. Customer Service and Grievance Redressal
Must know
1. Compensation runs Rs.100 a day
A delayed complaint earns the customer Rs.100 for every day beyond 30 days.
2. 21 plus 9 equals 30
Lenders get 21 days to answer; the credit bureau gets the remaining nine.
3. Payout lands within 5 days
Compensation must reach the customer's account within five working days of resolution.
4. Wrongful denial? Use Ombudsman
A customer wrongly refused compensation can complain to RBI's own Ombudsman.
5. Some disputes go to arbitration
Disputes with no other remedy under CICRA go to conciliation or arbitration instead.
6. Internal Ombudsman still required
A covered credit bureau must keep an Internal Ombudsman under RBI's own framework.
7. Integrated Ombudsman Scheme applies too
A covered credit bureau must also follow RBI's Integrated Ombudsman Scheme, 2021.
Do it
8. Alerts follow every CIR pull
Customers get an SMS or email alert whenever their report is checked.
9. Root cause fixes match logic
Root-cause analysis of complaints must sharpen the credit bureau's own matching logic.
10. Rejections flagged within 3 days
The credit bureau must flag rejected records within three calendar days of receipt.
11. Complaint counts go online
The credit bureau must publish its own complaint numbers, and its members', online.
Chapter VIII. Best Practices
1. Multiple pulls trigger alerts
Lenders get an alert when more than one of them pulls the same report within a month.
2. ISO 27001 is best practice
RBI expects every credit bureau to hold ISO 27001 certification for information security.
How this rule has changed
The points above are the rule as it stands today, after every change listed here.
Issued on Nov 28, 2025. This is the date RBI put the rule out.
Changed on Dec 04, 2025. Takes effect From July 01, 2026..
- Start date. These changes apply from July 01, 2026.
- Incremental reporting dates. Credit institutions must report data as on 9th, 16th, 23rd and month end to credit information companies.
- Full file reporting. Credit institutions must send full credit data as on month end by 5th of next month.
- Full file coverage. Full file must cover all live accounts and accounts closed since the last reporting date.
Other RBI rules for credit information companies
RBI cyber security rules for credit information companies 2026
RBI internal ombudsman rules for credit information companies 2026
RBI miscellaneous rules for credit information companies 2026
Every rule page on BankPulse · Questions bankers ask, answered