Code of Conduct for Subscribers

WHEREAS:

The Bureau is in the business, amongst others, of producing credit reports
Subject always to Credit Reporting Agencies Act 2010 and any other applicable legislation, information received by the Bureau includes information supplied by the Subscribers of the Bureau relating to the Companies/Business/Individuals who are the Customers of the Subscribers;
Subject always to the Credit Reporting Agencies Act 2010 and any applicable legislation, the Bureau shall provide Credit Reports on Companies/Business/Individuals to the Subscribers;
The Bureau and the Subscribers desire to maintain the confidentiality of
Information received by and from the Bureau subject only to such disclosure as may be authorized or permitted by the Credit Reporting Agencies Act 2010 and any applicable legislation;
The Bureau and the Subscribers desire to address concerns relating to the protection of rights to information, privacy rights of Companies/Business/Individuals and use of Credit Reports and ensure transparency and accountability in the operations of the Bureau by observing the terms appearing or referred to herein;
The Subscribers agree to request and use the information received from the Bureau subject to terms appearing or referred to herein;
The Bureau and the Subscribers agree to regulate the operations of the Bureau subject to the terms appearing or referred to herein; and
The Bureau and the Subscribers agree to ensure compliance with this Code

This Code of Conduct is established by the Bureau for and on behalf of itself and the Subscribers and is subjected to the Credit Reporting Agencies Act 2010 and in the event of any conflict or discrepancy between any of the provisions of this Code and the Credit Reporting Agencies Act 2010, such conflict or discrepancy shall for the purpose of interpretation and enforcement of this Code be resolved by giving the provisions contained in the Credit Reporting Agencies Act 2010 priority and precedence over the provisions contained in this Code of Conduct.

APPLICATION OF THE CODE
1. This Code applies to the following:
  1. the Bureau;
  2. all Subscribers; and
  3. other Companies(s)/Business/Individual that are permitted to have any access to Information by the Bureau or a Subscriber subject to the terms of this code.
SUBSCRIBER’S SUPPLY OF DATA TO THE BUREAU
1. Each Subscriber shall supply to the Bureau information and data relating to Company/Business/Individual who are their Customers and in the data formats and frequency as specified in such other form as the Bureau may reasonably require, subject always to the Credit Reporting Agencies Act 2010 and any applicable legislation.
2. The Subscriber shall supply to the Bureau data relating to Company/Business/Individual who are their Customers and/or any updates to the data on a regular timeframe and unless otherwise prescribed by the Bureau.
3. Data relating to Company/Business/Individual who are their Customers can be supplied to the Bureau either directly or via BNM’s Central Credit Reference Information System (CCRIS).
4. The Subscriber acknowledges that they have received and/or shall obtain or procure written permission and/or consent from each and every Customer to disclose or supply such Information/Data relating to such Customer to the Subscriber or the Bureau whether directly or indirectly supplied or furnished to the Credit Bureau;
  1. That if requested by the Credit Bureau, the Subscriber shall provide to the Credit Bureau the written permission and/or consent obtained from the Customers by way of evidence or verification that such written permission and/or consent has been obtained.
  2. The Subscriber acknowledges in the event they fail to provide the requested proof of consent and if they fail to supply or update the data every month the Credit Bureau reserves the right to:
    1. Suspend all credit bureau services with immediate effect as the Subscriber will be deemed to have breached the terms of agreement without any prejudice to any other rights of the credit bureau to exercise in the event of a breach as stipulated in the respective subscription agreement.
BUREAU’S OBLIGATIONS IN RESPECT OF DATA
1. The Bureau shall ensure that all necessary precautions are taken to ensure that all Information received or collected by the Bureau is:
  1. Properly and accurately recorded, maintained, collated, synthesized and/or processed;
  2. Protected against loss;
  3. Protected against unauthorized access, use, modification, or disclosure; (except for data provided by Subscribers or any data obtained from public records from reputable sources responsible for the accuracy, completeness, and update of the Information provided to the Bureau); and
  4. In respect of all updates of Information and Data received or collected on each Company/Business/Individual, updated in all Credit Reports issued from the next Business Day after the date of receipt or collection by the Bureau (unless the Bureau has reasonable grounds for doubting the accuracy of such updates and is in the process of verifying the same and provided always that all Credit Reports generated in respect of the relevant Company/Business/Individual during such period of verification shall contain a cautionary note to the effect that the Information on the relevant Company/Business/Individual is under investigation and shall indicate the disputed item(s) under investigation.
2. The Bureau shall ensure that it does not disclose any information to any person or entity except that it may:
  1. Provide a Credit Report on a Company/Business/Individual to any Subscriber who so inquires provided always that such inquiry shall be made by a Subscriber who asserts that it is made for a Relevant Purpose and in respect of a Company/Business/Individual which is: –
    1. A Customer of (or has applied for credit facilities from) such Subscriber; or
    2. A surety of a Customer of (or a surety of a party who has applied for credit facilities from) such Subscriber, regardless of whether such Customer or party be a natural party, an unincorporated entity, a corporate entity, or any other entity;
3. Without prejudice to the generality of Clauses 3.1 and 3.2, the Bureau shall take measures, including the following, to safeguard the security of Information:
  1. Development of operational guidelines to ensure adequate protection to minimize the risk of unauthorized entry into the database or interception of communications made to and from the database.
4. The Bureau takes no responsibility for any errors or inaccuracies in the data arising from the data being obtained by the Bureau containing the same errors or inaccuracies.
5. Without prejudice to the generality of Clauses 3.1 and 3.2, the Bureau may collect, assess, collate, synthesize, process, edit, re-sort, and/or combine data (or any part thereof) in such a manner as it deems fit so as to generate Credit Reports, and the Bureau shall issue notice to each Subscriber’s customer as prescribed under section 23 of the Credit Reporting Agencies Act 2010 upon the processing of credit information of the customer.
6. Without prejudice to the generality of Clauses 3.1 and 3.2, Information held by the Bureau may be retained by it and used for the development of derivative products for Subscribers such as scorecards, behavioral predictive models, and similar products provided that it shall not thereby reveal the identity of any Customer and/or Subscriber.
7. Data obtained by the Bureau shall be retained and displayed by the Bureau as long as required under the law, and the Bureau shall ensure that any part of such data shall be deleted if so required without the ability to be retrieved within the first Business Day when the data is required to be deleted.
SUBSCRIBER’S OBLIGATIONS IN RESPECT OF INFORMATION OBTAINED FROM BUREAU
1. Each Subscriber shall ensure that it does not make an inquiry requesting for a Credit Report or Monitoring Services from the Bureau unless such inquiry is made for relevant purposes, and in respect of a party who is –
  1. A Customer of (or has applied for credit facilities from) such Subscriber; or
  2. A surety of a Customer of (or a surety of a party who has applied for credit facilities from) such Subscriber, regardless of whether such Customer or party be a natural person, an unincorporated entity, a corporate entity, or any other entity.
2. Each Subscriber shall ensure that it retains adequate evidence to establish the existence of a Relevant Purpose in respect of each inquiry for a period of not less than seven (7) years from the date of the relevant inquiry and each Subscriber shall ensure that all necessary precautions are taken to ensure that all Information provided to it by the Bureau is:
  1. Properly and accurately recorded and maintained;
  2. Protected against loss;
  3. Protected against unauthorized access, use, modification, or disclosure; and
  4. Does not disclose Company/Business/Individual information provided to it by the Bureau to any person or entity except that it may make such disclosure of the same as authorized by the Credit Reporting Agencies Act 2010 and any other applicable legislation.
3. The Subscriber shall ensure that it acquires consent from the Company/Business/Individual who are their Customers before making an inquiry requesting for their Credit Report/Monitoring Services from the Bureau.
  1. The Subscriber shall ensure that it provides the Bureau with copies of the consent obtained from their customers whose Credit Report/Monitoring Services have been requested from the Bureau as and when it is requested by the Bureau.
  2. The copies of consent will need to be provided to the Bureau by the Subscriber within 5 Business days of the request made by the Bureau.
4. The Subscriber acknowledges that it is a mandatory requirement for them to obtain written consent from each and every of their customer who’s Credit Report/Monitoring Service they have obtained via the Credit Bureau.
  1. If the Subscriber fails to provide the requested proof of consent the Credit Bureau reserves the right to:
    1. Suspend all Credit Bureau services with immediate effect as the Subscriber will be deemed to have breached the terms of agreement.
    2. Forfeit all remaining balance in the Subscribers prepaid package.
    3. Report to the relevant authority such as Bank Negara Malaysia and the Registrar of the Credit Reporting Agencies Act 2010 to enable further action to be taken on the Subscriber with regards to the breach of the Central Banking Act, Credit Reporting Agencies Act 2010, or any other applicable legislation.
INVESTIGATION INTO DISPUTED INFORMATION
1. A Company/Business/Individual and/or a Subscriber (in respect of any of its Customers) may notify the Bureau in writing that the completeness or accuracy of any item of Information is disputed, by specifying the particulars of the same. Upon receipt of such notification (hereinafter referred to as the (“Disputed Information Notice”), the Bureau shall investigate the completeness or accuracy of the disputed Information in consultation with the Subscriber or Subscribers and/or other sources who or which provided the same.
2. The disputed Information shall remain part of the Credit File on the relevant Company/Business/Individual:
  1. Until such time the investigation is completed and a determination is made as to whether the disputed Information should be rectified, updated or re-affirmed all Credit Reports generated in respect of the relevant Company/Business/Individual during such period shall contain a cautionary note to the effect that Information on the relevant Company/Business/Individual is under investigation and the credit report shall indicate the disputed item(s) under investigation.
3. The Bureau shall complete its investigation into the completeness or accuracy of the disputed item(s) specified as expeditiously as practicable and:
  1. The disputed Information shall be rectified or updated (if found by the Bureau to be incomplete or inaccurate) or re-affirmed (if found by the Bureau to be complete and accurate) and the Bureau shall compile a report containing the results of its investigations and all measures and actions taken arising therefrom and such report shall forthwith be entered into the Bureau’s operations log;
  2. If the investigation cannot be completed within three (3) Business Days from the date of receipt of the Disputed Information Notice due to lack of resources or cooperation/coordination of the Subscriber or Subscribers and/or other causes the Bureau shall inform the relevant Company/Business/Individual and the Subscriber or Subscribers and/or other sources in question that it requires more time to complete its investigation.
RECTIFICATION AND UPDATING OF INFORMATION BY THE BUREAU
1. The Bureau shall take all reasonable efforts to ensure that Information regarding a Company/Business/Individual is updated as soon as practicable and in any event within one Business Day after the date of receipt by the Bureau of any updated Information, update Information regarding a Company/Business/Individual:
  1. When it receives Information from a Subscriber that any overdue account previously notified to the Bureau has been repaid in whole or in part;
  2. When it determines that any Information is materially incomplete or inaccurate, whether or not there has been an investigation arising from a Disputed Information Notice;
  3. If so required under the Credit Reporting Agencies Act 2010 and/or any other applicable legislation.
2. Without prejudice to Clause 6.1, the Bureau shall rectify Information regarding a Company/Business/Individual when it becomes aware that any Information regarding a Company/Business/Individual was inaccurate at the time when the same was received by the Bureau.
  In particular, the Bureau shall:
  1. Rectify data when such rectification is requested or confirmed by the Subscriber who, or source(s) which, supplied the same; and
  2. Rectify Information obtained by the Bureau from any public record(s) when there is an amendment or correction made to the public record data by the party responsible for maintaining the accuracy of such data.
COMPANY/BUSINESS/INDIVIDUAL ACCESS TO OWN INFORMATION
1. A Company/Business/Individual which establishes its identity to the reasonable satisfaction of the Bureau is entitled to request a Credit Report or Monitoring on his Company/Business(s)/Self
2. The Bureau may impose conditions for the release of a Credit Report or data to a Company/Business/Individual pursuant to Clause 7.1 and may require that the Company/Business/Individual acknowledge acceptance of such conditions in such manner as the Bureau thinks fit.

Legal

CBM+ App