3.—(1) A designated bank must provide credit information that it holds about each customer of the bank which is a small or medium sized business to a designated credit reference agency if—
(a)the credit reference agency has requested that the bank provide the information;
(b)the request meets the requirements set out in regulation 4;
(2) But paragraph (1) does not require a bank to provide information about a customer who has not agreed to information being provided about it to the credit reference agency (see regulation 5).
(3) The bank must provide the information within a period of 30 days starting with the day on which the bank received the request.
(4) The bank must provide an update to the information in each month following the month in which the information was first provided, unless the credit reference agency has informed the bank in writing that it no longer requires such updates.
(5) Such update—
(a)need not include updated information relating to—
(i)a customer of the bank which has ceased to be a small or medium sized business; or
(ii)a former customer of the bank;
(b)must identify any customer or former customer in respect of which updated information is not provided reliant upon sub-paragraph (a), and in each case state whether such reliance is placed upon sub-paragraph (a)(i) or (a)(ii);
(c)must include information about any customer of the bank which is a small or medium sized business about which information has not previously been provided, if the customer has agreed to the information being provided to the credit reference agency (see regulation 5).
(6) The bank must provide the information and updates to the information—
(a)in a form agreed between the bank and the credit reference agency; or
(b)if there is no such agreement, electronically in a format which may be accessed using software commonly used to access financial information about businesses.
(7) When first providing information to each designated credit reference agency the bank must provide such information falling within paragraph 3 of the Schedule as it holds in relation to a period of six months ending on the date on which the bank provides the information.
4.—(1) A request under regulation 3(1)(a) must be made—
(a)in writing; and
(b)to the person identified by the bank to the credit reference agency, or identified by the bank to credit reference agencies generally, as the person to whom such requests should be made or, if no such person has been identified, to the head office of the bank.
(2) A request under regulation 3(1)(a)—
(a)may seek information falling within one or more of paragraphs 1 to 3 of the Schedule;
(b)must not seek only part of the information falling within one of those paragraphs which is held by a bank about its small and medium sized business customers.
5.—(1) For the purposes of regulation 3(2) and (5)(c)—
(a)agreement may be indicated by inclusion in the terms on which a designated bank provides services to a customer of a term under which the customer agrees to the provision of information about the customer to credit reference agencies (including such a term included by way of a variation);
(b)agreement may relate to the provision of information about the customer to credit reference agencies generally; and
(c)agreement may be indicated by a term in a contract between the bank and its customer which predates the date of any request made under regulation 3(1)(a).
(2) Where a designated bank starts to provide a service referred to in the Schedule to a customer on or after the date on which these Regulations come into force, the bank must include in the standard terms on which it provides the service a term indicating the customer’s agreement to the provision of information relating to that service under regulation 3(1).
6.—(1) A designated credit reference agency must provide credit information that it holds about a small or medium sized business to a finance provider for the purposes specified in paragraph (3) if—
(a)the finance provider has requested that the credit reference agency provide the information;
(b)the business to which the information relates has agreed to the information being provided to the finance provider and the finance provider has confirmed such agreement to the credit reference agency;
(c)the finance provider has agreed to the standard terms on which the credit reference agency provides credit information relating to small and medium sized businesses, including the payment of any fees for the provision of such information;
(d)the finance provider has met any conditions which are required by those terms to be met before the information is provided;
(e)in the case of a finance provider which is not a designated bank, the finance provider has agreed with the credit reference agency that it will, by the end of a period of 12 months starting on the day on which the credit reference agency first provides credit information to the finance provider and at other such time as it agrees with the credit reference agency, provide to the credit reference agency all credit information—
(i)that it holds about each customer of the finance provider which is a small or medium sized business (but see paragraph (2)); and
(ii)which relates to the period starting on the day on which the credit reference agency first provides credit information to the finance provider;
(f)the finance provider has confirmed that, in respect of any service referred to in the Schedule which it offers to provide to small or medium sized business customers in the future, the standard terms provide for agreement by the customer that the finance provider may provide credit information to credit reference agencies.
(2) A finance provider is not required to provide information pursuant to an agreement under paragraph (1)(e) if—
(a)the customer to which the information relates has not agreed to the provision of such information; or
(b)the provision of such information would be unlawful.
(3) Any information provided under paragraph (1) is provided for the purpose of assisting a finance provider to decide whether to offer a business any kind of finance, lending or credit having in particular regard to—
(a)the ability of the business to repay any debts resulting from the provision of such finance, lending or credit;
(b)the ability of the finance provider to verify the identity of persons related to the business and to take steps to prevent fraud;
(c)the ability of the finance provider or another party to recover debts resulting from the provision of such finance, lending or credit; or
(d)the need for the finance provider to comply with its statutory or other legal obligations relating generally to the provision of finance, lending or credit.
7.—(1) A designated credit reference agency must provide information received under regulation 3 or by virtue of regulation 6 to the Bank of England on request.
(2) The Bank of England must provide information received from a designated credit reference agency pursuant to paragraph (1) to the Treasury on request, but such information must be so framed that it is not possible to ascertain from it information relating to a particular small or medium sized business.
(3) The Bank of England may otherwise provide information received from a designated credit reference agency pursuant to paragraph (1) only where such disclosure is—
(a)to the PRA for the purpose of enabling or assisting the PRA to discharge any of the PRA’s public functions; or
(b)to any other person where—
(i)such information has already lawfully been made available to the public;
(ii)such information is in the form of a summary or collection of information so framed that it is not possible to ascertain from it information relating to a particular person;
(iii)the person to whom the information relates has provided consent for such disclosure;
(iv)such disclosure is for the purposes of any criminal investigation or criminal proceedings whether in the United Kingdom or elsewhere;
(v)such disclosure is for the institution of, or otherwise for the purposes of, any proceedings arising by virtue of these Regulations or under the 2000 Act or any proceedings to which the Bank of England is, or is proposed to be, a party; or
(vi)such disclosure is in pursuance of an EU obligation.
(4) Where the Bank of England has provided information under sub-paragraph (3)(a) the PRA may only disclose the same information to any other person—
(a)if the Bank of England consents; and
(b)where any of the circumstances in sub-paragraph (3)(b) apply.
(5) For the purposes of paragraph (4)(b), the reference to the Bank of England in sub-paragraph (3)(b) is to be read as reference to the PRA.
8. A failure by a designated bank to comply with an obligation arising under regulation 3, or by a designated credit reference agency to comply with regulation 6, is actionable at the suit of a person who suffers loss as a result of such failure, subject to the defences and other incidents applying to actions for breach of statutory duty.