The Small and Medium Sized Business (Credit Information) Regulations 2015

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations are made under Part 1 of the Small Business Enterprise and Employment Act 2015 (c.26) and impose a duty on designated banks to provide information about their small and medium sized business customers to designated credit reference agencies (‘CRAs’), and a duty, in turn, on designated CRAs to provide credit information about small and medium-sized businesses to finance providers.

Part 1 of the Regulations includes relevant definitions, and establishes what information is within scope of the Regulations (this is set out fully in the Schedule).

Part 2 of the Regulations provides that designated banks must provide credit information to designated CRAs where a designated CRA has requested it and where the customer has agreed. It specifies the manner in which the designated CRA must make such a request, the time within which the designated bank must respond and how the customer may indicate agreement. It provides generally for designated banks to provide updates to this information to designated CRAs, and sets out the circumstances in which such updates are not required. It also provides that designated CRAs must provide credit information to finance providers where the finance provider has requested it, where terms and conditions have been agreed and, where necessary, met, where the business to which the information relates has agreed to this and where the finance provider has confirmed such agreement to the credit reference agency. It specifies the purpose for which information provided in these circumstances is provided. Where a receiving finance provider is not itself a designated bank, the finance provider is required to agree reciprocally to provide credit information that the finance provider holds about its small or medium sized business customers to the designated CRA within 12 months. However, this obligation only relates to information relating to the period after which the designated CRA first provides credit information to the finance provider and the obligation does not arise at all where the customer to which the information relates has not agreed to provision of such information, or where it would be unlawful for the finance provider to provide it.

Additionally, Part 2 makes provision for designated CRAs to provide information received under these Regulations to the Bank of England on request and limits the circumstances and manner in which the Bank of England may itself disclose such information. Finally, it provides for a right of action for a person who suffers loss as the result of a failure by a designated bank or designated CRA to comply with these obligations.

Part 3 of the Regulations provides that the Treasury may designate a bank or a credit reference agency, and may revoke such a designation. It specifies criteria that the Treasury must have regard to when considering whether to make such a designation, and other factors the Treasury may consider when making a designation or revocation. It provides that the Treasury may consult other persons when considering a designation or revocation, and that the Treasury may exercise this power on its own initiative or at the request of another person. It also specifies that the Treasury must publish details of designations and revocations and maintain a publicly accessible record of current designations.

Part 4 of the Regulations applies provisions in the Data Protection Act 1998 (c.29) and the Consumer Credit Act 1974 (c.39) about access and correction of information about individuals and small firms to designated CRAs that are not authorised by the Financial Conduct Authority (‘FCA’) under the Financial Services and Markets Act 2000 (c.8) in the same way that those provisions apply to CRAs that are authorised, so that the same protections apply to information about individuals and small firms provided to a CRA under the Regulations, whatever the status of the CRA. It also provides small or medium sized businesses with a right to apply to a court for an order to rectify, block, erase or destroy data held about the business by a designated CRA. This mirrors an equivalent provision in section 14 of the Data Protection Act 1998 which applies only to personal data about individuals.

Part 5 of the Regulations applies provisions in the Financial Services and Markets Act 2000 to extend the remit of the Financial Ombudsman Service (‘FOS’) so that a complaint may be referred to the FOS about a designated CRA. This extends the remit of the FOS such that a person who would be able to seek a FOS decision when dealing with a CRA authorised by the FCA is also able to seek a FOS decision when dealing with a designated CRA which is not so authorised. It provides that the FCA must make compulsory jurisdiction rules relating to the activity of designated CRAs.

Part 6 of the Regulations makes provision in respect of the FCA. In particular, it confers on the FCA functions in relation to the monitoring of compliance with, and enforcement of, certain provisions of the Regulations (regulations 3, 5, 6 and 7 and any requirements on persons other than the FCA imposed under Part 5 or Part 6). In doing so, Part 6 applies certain provisions of primary and secondary legislation (with modifications) in respect of the FCA’s function under the Regulations.

Part 7 of the Regulations provides that the Treasury must review the Regulations from time to time, and publish a report of its conclusions. The first such report must be published within five years of the commencement date of the Regulations, and thereafter at least every five years.

An impact assessment of the effect of the Regulations has been prepared and is available on the Government’s website (https://www.gov.uk) or from HM Treasury, 1 Horse Guards Road, London, SW1A 2HQ and is annexed to the Explanatory Memorandum to these Regulations.