Consultation on the proposed Mandatory Comprehensive Credit Reporting Regime closing soon

After announcing on 2 November 2017 that it would legislate for a mandatory comprehensive credit reporting regime by 1 July 2018 on the four major Australian banks, the Government is seeking feedback on the draft legislation it recently released on 8 February 2018. If you would like to make a submission, you must do so by 23 February 2018.

Currently, under the Privacy Act, credit providers such as lenders are allowed, but are not required, to disclose information about the customer's credit history (that is, credit information) to credit reporting bodies which hold and generate a consumer's credit rating such as a credit score. This includes negative information such as overdue payments, defaults, bankruptcy or court judgments against an individual and positive information (also known as comprehensive credit information) such as the number of credit accounts held by an individual, credit limits and information about repayment history.

While credit providers have been allowed to report both negative and comprehensive credit information since March 2014, credit providers have primarily been disclosing only negative credit information.

As a result, the Government has proposed a regime which mandates the reporting of both negative and comprehensive credit information by large ADIs and their subsidiaries. Following the enactment of the Treasury Laws Amendment (Banking Executive Accountability Regime) Act 2018, the Government intends to introduce an instrument that defines a large ADI as an authorised deposit taking institution with greater than or equal to $100 billion on a three year average of total resident assets. Other credit providers will have access to information disclosed by large ADIs and their subsidiaries, but only if they also provided information (see below).

It is expected that the regime will give lenders greater access to a more holistic picture of the customer's credit history. This will assist lenders in assessing a borrower's financial situation and their ability to repay their credit contract. Lenders should consider reviewing their responsible lending processes and procedures, including how to deal with and analyse the additional information received as a result of the regime.

Details of the proposed regime

Obligations on large ADIs

In summary, the large ADIs and their subsidiaries will be required to:

• supply both negative and comprehensive credit information on 50% of their active and open credit accounts held on 1 July 2018 to credit reporting bodies (first tranche). This must be done by 28 September 2018. It must be given to a credit reporting body that the relevant bank or subsidiary had an agreement with to protect information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as at 2 November 2017;
• supply to those credit reporting bodies both negative and comprehensive credit information on the balance of the open and active credit accounts held on 1 July 2018 and on accounts opened after 1 July 2018 (and open and active on 1 July 2019) by 28 September 2019 (second tranche);
• supply minimum information about an individual's repayment history to credit reporting bodies (as part of the first and second tranches). Repayment history information does not need to be reported for more than 3 months before 1 July 2018;
• keep information reported under the mandatory comprehensive credit reporting regime up to date and accurate. This must occur within 20 days after the end of the calendar month where the credit licensee would reasonably be expected to be aware that the following has occurred:
  
  
• a need to change any information that was reported under the mandatory comprehensive credit reporting regime;
• the payment of an overdue payment in response to a default listed under the regime;
• the opening or reopening of a credit account; or
• the closing of a credit account;

• comply with technical standards prescribed by ASIC on how it must supply negative and comprehensive credit information to credit reporting bodies. Technical standards may include how data is to be described, recorded and transferred;
• if requested by ASIC, supply a written statement about its compliance with the mandatory comprehensive credit reporting regime. ASIC may also request from the relevant bank or its subsidiary an audit report on that statement before the bank/subsidiary gives the statement to ASIC;
• if requested by ASIC, supply information about its compliance with the mandatory comprehensive credit reporting regime;
• if reasonably requested by ASIC, assist ASIC in its inquiry about compliance with the mandatory comprehensive credit reporting regime; and
• provide the Treasurer with statements and an audit report of the statements that demonstrate its compliance with the mandatory comprehensive credit reporting. This must be done 6 months from 1 July 2018 for the first tranche, 6 months from 1 July 2019 for the second tranche and 3 months after the financial year for the ongoing supply of information as part of keeping information reported under the mandatory comprehensive credit reporting regime up to date and accurate.

Credit licensees that are not large ADIs before 1 July 2018 but become a large ADI after 1 July 2018 must also comply with the mandatory comprehensive credit reporting regime. Again, the information must be given to a credit reporting body that the credit licensee had an agreement with to protect information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as at 2 November 2017.

Impact of the proposed regime on credit reporting bodies and other credit providers

While the mandatory comprehensive credit reporting regime will enable credit providers other than large ADIs and their subsidiaries to access further information about individuals, this does not mean that other credit providers will be able to receive this information without participating themselves. Under the proposed regime:

• credit reporting bodies must not disclose information collected through the mandatory comprehensive credit reporting regime to credit providers who have only disclosed to credit reporting bodies credit information on less than 50% of open and active credit accounts with the credit provider;
• during the first 12 months after the credit provider has requested from a credit reporting body information collected under the mandatory comprehensive credit reporting regime, the credit reporting body must disclose this information if the credit provider has disclosed to the credit reporting body credit information that relates to at least 50% of open and active credit accounts with the credit provider; and
• after that, in order to continue receiving this information from the credit reporting body, the credit provider must supply information that relates to 100% of the open and active credit accounts with the credit provider.

The above requirements do not apply if the credit reporting body and credit provider are signatories to the "Principles of Data Reciprocity and Data Exchange" published by the Australian Retail Credit Association and a relevant service agreement under those principles is in force. Under these principles, there are similar provisions that allow a credit reporting body to share credit information (including a subset of it) only if a credit provider has shared that subset of data with the credit reporting body.

Expansion of ASIC's enforcement powers

ASIC is responsible for regulating the proposed regime which amends the National Consumer Credit Protection Act 2009 and the Office of the Australian Information Commissioner will continue to be responsible for ensuring compliance with the Privacy Act. There are new civil penalties and offence provisions in the proposed regime (with a maximum civil penalty of up to $2.1 million. There are also criminal offences under the proposed regime.

Next steps

The Government is seeking feedback on the proposed mandatory comprehensive credit reporting regime. If you would like to make a submission, you must do so by 23 February 2018.

It is anticipated lenders will have greater access to a more holistic picture of the customer's credit history. In addition, this will assist lenders in assessing a borrower's financial situation and their ability to repay their credit contract. Lenders should consider reviewing their responsible lending processes and procedures including how to consider the additional information arising from the regime.

Our Banking and Financial Services team can assist you to understand the impact of the proposed mandatory comprehensive credit reporting regime and make a submission.