Decree No. 58/2021/ND-CP the provision of credit information services

DECREE

On the provision of credit information services^[1]

Pursuant to the June 19, 2015 Law on Organization of the Government; and the November 22, 2019 Law Amending and Supplementing a Number of Articles of the Law on Organization of the Government and the Law on Organization of Local Administration;

Pursuant to the June 16, 2010 Law on the State Bank of Vietnam;

Pursuant to the June 16, 2010 Law on Credit Institutions; and the November 20, 2017 Law Amending and Supplementing a Number of Articles of the Law on Credit Institutions;

Pursuant to the June 17, 2020 Law on Enterprises;

Pursuant to the June 17, 2020 Law on Investment;

At the proposal of the Governor of the State Bank of Vietnam;

The Government promulgates the Decree on the provision of credit information services.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

1. This Decree provides conditions and procedures for grant, re-grant, modification and revocation of certificates of eligibility for provision of credit information services (below referred to as certificates); provision of credit information services by credit information companies, and rights and obligations of related organizations and individuals.

2. Credit information activities of the State Bank of Vietnam (below referred to as the State Bank) are not regulated by this Decree.

Article 2. Subjects of application

1. Credit information companies.

2. Participating organizations.

3. Borrowers.

4. Other related organizations and individuals.

Article 3. Interpretation of terms

In this Decree, the terms below are construed as follows:

1. Credit information means relevant data, statistics and facts of borrowers at participating organizations of credit information companies.

2. Provision of credit information services means provision by a credit information company of credit information products to users on the basis of its activities of collecting, processing and storing credit information in accordance with this Decree.

3. Participating organization of a credit information company (below referred to as participating organization) means an organization that willingly commits to providing credit information to latter. Participating organizations include credit institutions, foreign bank branches; and organizations other than credit institutions or foreign bank branches that provide services of asset lease, purchase of goods with deferred payment or instalment payment, or pawning accompanied with conditions on interest rate, term, rental and obligation security measure in accordance with law (below referred to as other participating organizations).

4. Borrower means an organization or individual to which/whom a credit institution or foreign bank branch extends credit or to which/whom another participating organization provides services of asset lease, purchase of goods with deferred payment or instalment payment, or pawning accompanied with conditions on interest rate, term, rental and obligation security measure in accordance with law.

5. Credit information company means an enterprise established and operating in accordance with the Law on Enterprises to provide credit information services in accordance with this Decree. The name of a credit information company must have the phrase “thong tin tin dung” (credit information).

6. Information infrastructure means a combination of hardware, software, databases, network systems and security systems for creating, transmitting, collecting, processing, storing and exchanging digital information to serve one or more technical activity(ies) and credit information service provision activity(ies) of a credit information company.

7. Know-your-customer information means identification information of a borrower according to the Government’s regulations on confidentiality and provision of customer information by credit institutions and foreign bank branches.

8. Negative information on a borrower means credit information on non-performing loans, breach of payment obligation, violations of law, or state of being sued or prosecuted, or other negative information of a borrower that affect the evaluation of such borrower.

9. Credit information products means reports, publications or other credit information carriers created by a credit information company on the basis of collected credit information for provision to users.

10. User means an organization or individual that is entitled to be provided with credit information products and reaches an agreement with a credit information company on provision of credit information products.

Article 4. Principles of provision of credit information services

1. Credit information companies may only provide credit information services after obtaining certificates from the State Bank.

2. The provision of credit information services must comply with law, ensure truthfulness and objectivity, and not affect lawful rights and interests of related organizations and individuals.

3. Agreements and commitments in provision of credit information services referred to in this Decree shall be made in writing or in other forms of equivalent validity in accordance with law.

4. Credit information companies may only collect credit information of borrowers from participating organizations when the borrowers permit such participating organizations to provide credit information companies with the credit information contents specified in Appendix I to this Decree.

5. Principles of provision of credit information products:

a/ Credit information companies shall provide credit information products in accordance with Article 21 of this Decree;

b/ Credit information companies may only provide credit information products with know-your-customer information of borrowers to other participating organizations when the borrowers permit such organizations to use credit information products provided by credit information companies with the contents specified in Appendix II to this Decree, unless such organizations obtain permission of borrowers under Clause 4 of this Article;

c/ Credit information companies may not provide credit information products with know-your-customer information of borrowers to other organizations and individuals specified at Point dd, Clause 1, Article 21 of this Decree.

Article 5. Principles of use of credit information products

1. Credit information products shall be used for the purposes specified in Clause 1, Article 21 of this Decree. Users may not alter credit information products and shall take accountability for their decisions when using credit information products.

2.  Users may not provide credit information products to third parties, except those specified at Point b, Clause 1, Article 21 of this Decree.

3. The copying or use of credit information within institutional users must comply with agreements reached with credit information companies.

Article 6. Prohibited acts in provision of credit information services

1. Illegally collecting or providing information classified as or included in the list of state secrets.

2. Intentionally falsifying credit information contents, thus adversely affecting lawful rights and interests of related organizations and individuals.

3. Exchanging credit information with or providing credit information products to ineligible subjects, for use for improper purposes, or in an illegal manner.

4. Abusing the provision of credit information services for self-seeking purposes or to infringe upon interests of the State or lawful rights and interests of organizations and individuals.

5. Obstructing the lawful collection and use of credit information by organizations and individuals.

Article 7. Reports on provision of credit information services

1. A credit information company shall hand-deliver or send by post in paper documents or by electronic means the following statements/reports to the State Bank:

a/ Financial statements as specified by law;

b/ Reports on operation of the company, made according to the form provided in Appendix III to this Decree;

c/ Reports upon occurrence of serious technical incidents to information infrastructure (such as breakdown of hardware or software; attacks to databases, network systems or security systems, or other incidents causing abnormal operation of information infrastructure of the company), made according to the form provided in Appendix IV to this Decree;

d/ Reports on a change of the manager of the company or a member of the Supervisory Board; a change in the number of participating organizations; change in the agreement on the process of collecting, processing, storing and providing credit information between the company and participating organizations; or a change in information infrastructure of the company, made according to the form provided in Appendix IV to this Decree.

2. Deadlines/time limits for sending reports:

a/ The financial statements specified at Point a, Clause 1 of this Article shall be made on a monthly, quarterly and annual basis, of which monthly financial statements shall be sent before the 10^th of the month following the reporting month; quarterly financial statements, before the 20^th of the month following the reporting quarter; unaudited annual financial statements, within 30 days from the end of a fiscal year; and audited annual financial statements, within 90 days from the end of a fiscal year;

b/ The reports specified at Point b, Clause 1 of this Article shall be made on a quarterly and annual basis, of which quarterly reports shall be sent before the 20^th of the month following the reporting quarter; and annual reports, within 30 days from the end of the reporting year;

c/ The reports specified at Point c, Clause 1 of this Article shall be sent right on the date of occurrence of an incident. If an incident occurs on a weekend or a public holiday, a report thereon shall be sent on the first working day following such weekend or public holiday;

d/ The reports specified at Point d, Clause 1 of this Article shall be sent within 7 working days after a change occurs.

3. Data cut-off dates for reports:

a/ For the financial statements and reports specified at Points a and b, Clause 1 of this Article, data cut-off dates shall be determined for each reporting period corresponding to the accounting period specified in the Accounting Law;

b/ For the reports specified at Points c and d, Clause 1 of this Article, data cut-off dates shall be determined for each content required to be reported upon occurrence of an incident or a change.

Article 8. Competence of state management agencies

1. The State Bank shall perform the state management of provision of credit information services in accordance with the Law on the State Bank of Vietnam, covering:

a/ Drafting and submitting to competent state agencies for promulgation or promulgating according to its competence legal documents on provision of credit information services;

b/ Granting, re-granting, modifying and revoking certificates of credit information companies;

c/ Inspecting and supervising the provision of credit information services by credit information companies.

2. Ministries, ministerial-level agencies and provincial-level People’s Committees shall perform the state management of credit information companies in accordance with the Law on Enterprises and relevant laws.

Chapter II

CONDITIONS, ORDER AND PROCEDURES FOR GRANT, RE-GRANT, MODIFICATION AND REVOCATION OF CERTIFICATES

Article 9. Conditions for a credit information company to be granted a certificate

1. The company has information infrastructure systems satisfying at least the following requirements:

a/ There are at least 2 data transmission lines, each of which is of 1 service provider;

b/ There are information infrastructure facilities capable of being integrated into and connected with information systems of participating organizations;

c/ There are server systems in Vietnam, and informatics software systems and technical solutions capable of providing credit information services to at least 5 million borrowers;

d/ There are information confidentiality and security plans;

dd/ There are catastrophe contingency plans, ensuring that provision of credit information services is not interrupted for more than 4 working hours.

2. The company has the charter capital of at least VND 30 billion.

3. The company has managers and members of the Supervisory Board satisfying the following requirements:

a/ The managers and members of the Supervisory Board are not persons who have been convicted for a serious crime or more serious crime or for the crime of infringing upon ownership with criminal records not yet expunged; or are not the managers and members of the Supervisory Board of a credit information company which has its certificate revoked (except the case of certificate revocation specified at Point d, dd or e, Clause 1, Article 14 of this Decree);

b/ The Chairperson of the Board of Directors or Chairperson of the Members’ Council or Company President possesses a university or higher degree and has at least 3 years’ working experience in the field of finance, banking, accounting, audit or information technology;

c/ Members of the Board of Directors, members of the Members’ Council or general partners possess a university or higher degree, of whom at least 50% have at least 3 years’ working experience in the field of finance, banking, accounting, audit or information technology;

d/ The Chief Executive Officer and Chief Operations Officers possess a university or higher degree and have at least 2 years’ experience of holding the position of managing or administering enterprises in the field of finance, banking, accounting, audit or information technology;

dd/ Members of the Supervisory Board possess a university or higher degree and have at least 2 years’ working experience in the field of finance, banking, accounting, audit or information technology.

4. The company has business plans, ensuring that it is not engaged in business lines other than provision of credit information services.

5. The company has at least 15 participating organizations being credit institutions or foreign bank branches (except policy banks, cooperative banks, people’s credit funds and microfinance institutions). Participating organizations have no commitment with other credit information companies on provision of credit information.

6. The company has an agreement on provision of credit information and credit information products with participating organizations. Such agreement must have at least the following contents:

a/ Contents and scope of credit information to be provided;

b/ Time, place and mode of provision and transmission of information, data and credit information products;

c/ Principles, scope and purposes of use of credit information products;

d/ Obligations to notify and reach agreement with borrowers of/on use of credit information of borrowers;

dd/ Responsibilities of related parties for adjusting or correcting deviations in the course of updating, transmitting, processing, storing, exploiting and using credit information;

e/ Responsibilities of related parties for reviewing, collating, checking the quality of, and storing, credit information;

g/ Responsibilities of and coordination among related parties in adjusting deviations in credit information of borrowers;

h/ Handling of violations and settlement of disputes;

i/ Effect and unilateral termination of the agreement;

k/ Other rights and obligations of related parties in the course of collecting, processing, storing and providing credit information.

Article 10. Principles of making and sending dossiers

1. A dossier shall be made in 1 set in Vietnamese. Foreign-language documents in a dossier shall be consularly legalized in accordance with Vietnam’s law (unless they are exempt from consular legalization under regulations on consular legalization) and translated into Vietnamese. Vietnamese translations of foreign-language documents shall be notarized or have signatures of translators certified in accordance with law.

2. For copies of documents in a dossier that are neither certified nor issued from the master register, the concerned credit information company shall produce their originals for collation; the person carrying out the collation shall put his/her signatures on copies and take responsibility for the truthfulness of the copies to the originals.

3. Dossiers shall be submitted at the single-window division of the State Bank or sent by post to the State Bank.

Article 11. Order and procedures for grant of certificates

1. A credit information company shall make and send to the State Bank a dossier of application for a certificate, which must comprise:

a/ An application for a certificate, made according to the form provided in Appendix V to this Decree;

b/ The charter of the company (copy);

c/ A contract signed with the network service provider (copy);

d/ A document on the charter capital level (copy), which may be a proving document corresponding to the form of capital contribution, such as certification by a commercial bank or foreign bank branch of the account balance, for cash; or results of price appraisal by a professional price appraisal organization, for other assets used for capital contribution in accordance with the Law on Price, Law on Enterprises and relevant laws; or the latest audited financial statement by the date of dossier submission;

dd/ A list and resumes of individuals acting as managers of the company and members of the Supervisory Board, made according to the form provided in Appendix VI to this Decree;

e/ Criminal record certificates (copies) of individuals acting as managers of the company and members of the Supervisory Board:

For individuals holding Vietnamese citizenship, their criminal record certificates shall be issued by the agency managing judicial record databases, which must contain sufficient information on the status of criminal records (including criminal records already expunged and those not yet expunged) and information on ban on holding positions or establishing or managing enterprises or cooperatives;

For individuals not holding Vietnamese citizenship: their criminal record certificates or documents of equivalent validity (containing sufficient information on status of criminal records and information on ban on holding positions or establishing or managing enterprises or cooperatives) shall be issued by a Vietnamese or foreign competent authority in accordance with regulations. In case criminal record certificates or documents of equivalent validity issued by a foreign competent authority have no information on ban on holding positions or establishing or managing enterprises or cooperatives, the credit information company shall issue a document explaining that there is no competent authority of the country issuing criminal records or documents of equivalent validity providing such information, and commit to take responsibility before law for the fact that such individuals are not persons banned from holding positions in accordance with Vietnam’s law;

Criminal records or documents of equivalent validity must be those issued by competent authorities within 6 months before the date of dossier submission;

g/ A business plan, made according to the form provided in Appendix VII to this Decree;

h/ A commitment on provision of credit information, made by participating organizations according to the form provided in Appendix VIII to this Decree;

i/ An agreement on provision of credit information and credit information products signed with participating organizations (copy).

2. Within 5 working days after receiving the dossier of application for a certificate from the credit information company, the State Bank shall send to the company a request for supplementation of the dossier in case the dossier is not complete or valid as specified in Clause 1 of this Article.

3. Within 30 working days after receiving a complete and valid dossier, the State Bank shall grant a certificate, made according to the form provided in Appendix IX to this Decree, to the credit information company. In case of refusal to grant such certificate, the State Bank shall issue a written reply clearly stating the reason.

Article 12. Order and procedures for re-grant of certificates

1. A credit information company shall request the State Bank to re-grant a certificate in the following cases:

a/ The certificate is lost;

b/ The certificate is torn or otherwise damaged.

2. A dossier of request for re-grant of a certificate must comprise:

a/ A request for re-grant of a certificate, made according to the form provided in Appendix X to this Decree;

b/ The torn or damaged certificate (unless the certificate is lost).

3. Within 3 working days after receiving the dossier of request for re-grant of a certificate from the credit information company, the State Bank shall send to the company a request for supplementation of the dossier, in case the dossier is not complete or valid as specified in Clause 2 of this Article.

4. Within 10 working days after receiving a complete and valid dossier from the credit information company, the State Bank shall consider and re-grant a certificate, made according to the form provided in Appendix IX to this Decree.

Article 13. Order and procedures for modification of certificates

1. A credit information company shall request the State Bank to modify a certificate in case of occurrence of a change in:

a/ Its name;

b/ Its enterprise registration certificate;

c/ Its charter capital;

d/ Its head office location; or,

dd/ Its at-law representative.

2. A credit information company shall send a dossier of request for modification of a certificate to the State Bank when it wishes to change one or several of information item(s) in the certificate. Such dossier must comprise:

a/ A request for modification of a certificate, made according to the form provided in Appendix X to this Decree;

b/ The original of the Resolution of the Shareholders’ General Meeting, Board of Directors, Members’ Council or Company President on the modification of the certificate;

c/ Copies of documents and papers proving the company’s maintenance of a relevant operation condition specified in this Decree, in case the to-be-changed content of the certificate is related to operation conditions of the company.

3. Within 5 working days after receiving a credit information company’s dossier of request for modification of its certificate, the State Bank shall send to the company a request for supplementation of the dossier, in case the dossier is not complete or valid as specified in Clause 2 of this Article.

4. Within 15 working days after receiving a complete and valid dossier, the State Bank shall issue a decision on modification of a certificate, made according to the form provided in Appendix XI to this Decree (such decision is an integral part of the certificate). In case of refusal to issue such a decision, the State Bank shall issue a written reply clearly stating the reason.

Article 14. Order and procedures for revocation of certificates

1. A credit information company will have its certificate revoked by the State Bank if it:

a/ Commits a fraud or forges papers proving its eligibility in the dossier of application for a certificate in order to be granted a certificate;

b/ Seriously violates one of the provisions on prohibited acts of Article 6 of this Decree;

c/ Fails to maintain the conditions specified in Article 9 of this Decree after implementing the remediation plan as specified at Point b, Clause 2 of this Article;

d/ Fails to commence provision of credit information services within 12 months after being granted a certificate;

dd/ Is dissolved in accordance with law;

e/ Is divided, consolidated or merged under Clause 4, Article 15 of this Decree.

2. The State Bank shall revoke certificates as follows:

a/ In case a credit information company commits a violation specified at Point a or b, Clause 1 of this Article, the State Bank shall decide to revoke the company’s certificate based on inspection or supervision conclusions of the State Bank or at the request of another competent state agency;

b/ In case a credit information company commits a violation specified at Point c, Clause 1 of this Article, the State Bank shall send a request to the company for the latter to formulate a plan on remediation of the violation and send it to the State Bank and organize the implementation of such plan within 12 months after being requested to formulate the plan.

The State Bank shall decide to revoke the certificate of a credit information company when it finds through evaluation that the company has not yet remediated the violation within 1 month after the deadline for remediation under the remediation plan;

c/ In case a credit information company commits a violation specified at Point d, Clause 1 of this Article, the State Bank shall decide to revoke the company’s certificate within 15 working days from the deadline for commencement of operation of the company as specified in Clause 1, Article 16 of this Decree;

d/ In case a credit information company is dissolved under Point dd, Clause 1 of this Article, it shall send a notice of the dissolution together with relevant documents to the State Bank within 7 working days after the dissolution decision is approved or from the date of receipt of the decision on revocation of the enterprise registration certificate or dissolution ruling of the court in accordance with the Law on Enterprises.

The State Bank shall decide to revoke the certificate of the credit information company within 5 working days after receiving the notice and relevant documents from the company;

dd/ In case a credit information company is reorganized under Point e, Clause 1 of this Article, it shall send a notice of the reorganization together with relevant documents to the State Bank within 7 working days after the resolution on division of the company is approved or the consolidation contract or merger contract is signed in accordance with the Law on Enterprises.

The State Bank shall decide to revoke the certificate of the credit information company within 7 working days after receiving the notice and relevant documents from the company.

3. The State Bank shall issue a decision on revocation of the certificate of a credit information company, made according to the form provided in Appendix XII to this Decree. The credit information company shall immediately terminate provision of credit information services and return its certificate within 7 working days from the effective date of the decision on revocation of the certificate.

4. Within 10 working days from the effective date of the decision on revocation of the certificate, the credit information company having its certificate revoked shall formulate a plan on processing of credit information it currently stores in one of the following forms:

a/ Transferring credit information to another credit information company if such transfer is agreed upon by participating organizations and does not breach agreements with borrowers having such information. The credit information company shall send a notice of transfer results to the State Bank within 5 working days after the transfer is completed;

b/ Transferring credit information to the State Bank if such transfer is agreed upon by participating organizations and does not breach agreements with borrowers having such information. The management and use of transferred credit information must comply with the State Bank’s regulations on credit information activities;

c/ Organizing the destruction of credit information. The credit information company shall take responsibility before law for the adequacy, security and confidentiality of the destroyed credit information and send a notice of destruction results to the State Bank within 5 working days after the destruction is completed.

Article 15. Reorganization of credit information companies

1. Credit information companies shall be reorganized in accordance with the Law on Enterprises and relevant laws.

2. Credit information companies established after the division of enterprises; and credit information companies formed as a result of splitting or consolidation shall request the State Bank to grant certificates according to Article 11 of this Decree.

3. Transformed credit information companies; and split or merging credit information companies shall request the State Bank to modify their certificates according to Article 13 of this Decree.

4. Divided, consolidated or merged credit information companies will have their certificates revoked by the State Bank according to Article 14 of this Decree.

Article 16. Commencement of operation and disclosure of information on grant, modification or revocation of certificates

1. Within 12 months from the date of grant of its certificate, a credit information company shall commence provision of credit information services and send a notice of such commencement to the State Bank within 5 working days from the date of commencement.

2. A credit information company shall disclose information related to grant or modification of its certificate in the media of the State Bank and the company and on a central or local newspaper in the locality where the company’s head office is located for at least 3 consecutive issues or on an e-newspaper of Vietnam for at least 7 working days from the date the State Bank grants, or approves modification of, the certificate.

3. The State Bank shall notify in writing the business registration agency of the locality where the concerned credit information company’s head office is located in case it refuses to grant a certificate according to Clause 3, Article 11 of this Decree.

4. The State Bank shall announce its decision on revocation of the certificate of a credit information company in its media and send such decision to the business registration agency of the locality where the company’s head office is located.

Chapter III

PROVISION OF CREDIT INFORMATION SERVICES

Article 17. Internal regulations

1. In pursuance to this Decree and relevant regulations, a credit information company shall formulate and issue its internal regulations applicable to provision of credit information services of the company so that it can have mechanisms for control of each process and plans on dealing with emergency circumstances.

2. Internal regulations on provision of credit information services of a credit information company must have at least the following contents:

a/ Regulations on provision of credit information services, including also measures to check the reasonableness of collected credit information specified at Point d, Clause 1, Article 18, and regulations on the right to refuse to provide credit information products to users as specified in Clause 2, Article 21, of this Decree;

b/ Regulations on information confidentiality and information technology security in provision of credit information services, which must have at least contents on assurance of physical and installation environment safety; operation management and information exchange; access management; management of use of information technology services by third parties (if any); management of information security-related incidents; assurance of uninterrupted operation of information systems; and internal inspection and reporting regime;

c/ Regulations on delegation of powers and assignment of responsibilities for management and supervision to individuals acting as managers of the company and members of the Supervisory Board as well as related divisions and individuals in provision of credit information services, particularly regulations on management and supervision related to credit information security and confidentiality;

d/ Regulations on adjustment of deviations in credit information, which must have at least the contents on process of and responsibilities of each individual and division in the adjustment of deviations and retention of dossiers and documents related to such adjustment;

dd/ Regulations on processing of credit information in case the credit information company has its certificate revoked under Clause 4, Article 14 of this Decree, which must have at least the contents on forms of information processing; process of information processing (including also modes of informing and obtaining the permission of participating organizations); responsibilities of related divisions and individuals in organization and implementation of information processing; and supervision and confidentiality of credit information in the course of information processing.

3. Internal regulations shall be reviewed and evaluated once every 6 months or on an unscheduled basis in terms of their compliance with law, and revised when necessary.

Article 18. Collection of credit information

1. Credit information companies shall collect credit information from:

a/ Participating organizations under commitments or agreements on provision of credit information;

b/ Other credit information companies under agreements with them;

c/ State agencies in accordance with law;

d/ Other lawful sources of information in accordance with law.

2. To-be-collected credit information includes:

a/ Know-your-customer information of borrowers and related persons of borrowers as provided by current law;

b/ Information on history of credit extension, asset hiring, purchase of goods on deferred payment or installment payment, or pawning;

c/ Information on history of debt payment, due or undue loans, maturity date, credit limit, group of debts, sale of debts, implementation of off-balance-sheet commitments, and rank of borrowers;

d/ Information on security for performance of debt payment obligation of borrowers;

dd/ Other relevant information, ensuring no infringement of lawful rights of borrowers, not inclusive of borrowers’ information classified as state secrets.

3. The credit information specified in Clause 2 of this Article is not inclusive of information on use of risk provisions for handling risks with regard to credit facilities extended by credit institutions and foreign bank branches.

Article 19. Processing of credit information

1. On the basis of collected and stored credit information sources, credit information companies shall analyze, evaluate and synthesize information for creating credit information products.

2. The inspection, classification and updating of credit information must not falsify the nature and contents of credit information.

3. Negative information on borrowers may only be used to create credit information products for up to 5 years from the date such negative information no longer exists, unless otherwise provided by law.

Article 20. Storage of credit information

1. Credit information shall be stored in a safe and confidential manner to prevent possible incidents and catastrophes as well as illegal penetration and access from outside.

2. Credit information shall be stored for at least 5 years from the date it is collected by credit information companies.

Article 21. Provision of credit information products

1. Credit information companies shall provide credit information products for the following users:

a/ Participating organizations to serve their demands for seeking and evaluation of borrowers and other lawful purposes in accordance with law;

b/ Borrowers that will be provided with credit information on themselves for use for their lawful purposes;

c/ Other credit information companies for collecting credit information according to Article 18 of this Decree for provision of credit information services;

d/ Competent state management agencies to serve state management work in accordance with law;

dd/ Other organizations and individuals to serve lawful purposes in accordance with law.

2. After reaching agreement with the users specified in Clause 1 of this Article, credit information companies may refuse to provide credit information products and send a notice stating the reason for the refusal (together with relevant documents, if any) to users at least 20 working days before ceasing the provision of credit information products if detecting that the users violate the signed agreements, this Decree and relevant regulations.

Article 22. Adjustment of deviations in credit information of borrowers

1. A credit information company shall adjust deviations in the following cases:

a/ The credit information company detects deviations in credit information and adjusts such deviations by itself according to its internal regulations;

b/ A participating organization detects deviations in credit information and sends to the credit information company a request for adjustment of deviations together with relevant documents. Within 5 working days after receiving the request from the participating organization, the credit information company shall hand-deliver, or send by post or other electronic means a notice of results of adjustment of deviations to the participating organization;

c/ A borrower detects deviations in credit information and sends to the credit information company or a participating organization a request for adjustment of deviations together with relevant documents. Within 5 working days after completing the adjustment as specified in Clause 2 of this Article, the credit information company or participating organization shall hand-deliver, or send by post or other electronic means a notice of the process and results of adjustment of deviations to the borrower.

2. A credit information company shall adjust deviations at the request of a borrower as follows:

a/ In case deviations arise as a result of information processing by the credit information company, the company shall adjust deviations within 5 working days after receiving the borrower’s request for adjustment of deviations;

b/ In case the credit information company identifies that deviations arise from information collected at a participating organization, it shall notify the borrower of the process of information processing (clearly stating the source of information from which the deviations arise) within 5 working days, and coordinate with such participating organization in adjusting deviations within 10 working days, after receiving the borrower’s request for adjustment of deviations;

3. In case the borrower does not receive a written reply within the time limit specified in Clause 2 of this Article or disagrees with the reply of the credit information company, it/he/she may request conciliation or carry out procedures for initiating a lawsuit at an arbitration or a court in accordance with law.

Chapter IV

RIGHTS AND OBLIGATIONS OF ORGANIZATIONS AND INDIVIDUALS

Article 23. Rights and obligations of users

Users shall exercise the rights and perform the obligations according to agreements with credit information companies, this Decree and relevant regulations.

Article 24. Rights and obligations of credit information companies

1. Rights of credit information companies

a/ To exchange credit information with other credit information companies in accordance with this Decree and relevant regulations;

b/ To sign contracts with organizations and individuals on collection and provision of credit information and collect charges for provision of credit information products in accordance with this Decree and relevant regulations.

2. Obligations of credit information companies

a/ To comply with the principles, conditions and contents of provision of credit information services throughout their operation duration;

b/ To provide users with recommendations on principles of use of credit information products;

c/ To coordinate with participating organizations in detecting and dealing with deviations in credit information; to issue documents on adjustment of deviations in credit information at the request of borrowers;

d/ To publicly post up charge rates for provision of credit information products in accordance with the Law on Price and relevant laws;

dd/ To disclose information in accordance with the Law on Enterprises, this Decree and relevant regulations.

3. To exercise other rights and perform other obligations according to agreements with organizations and individuals, this Decree and relevant regulations.

Article 25. Rights and obligations of participating organizations

1. Participating organizations may use credit information products from credit information companies in accordance with this Decree and relevant regulations.

2. Obligations of participating organizations

a/ To provide adequate, accurate and prompt credit information to credit information companies as agreed upon with the latter;

b/ To coordinate with credit information companies in detecting and dealing with deviations in collected, stored and provided credit information; to issue documents on adjustment of deviations in credit information of borrowers.

3. To exercise other rights and perform other obligations according to agreements with credit information companies, this Decree and relevant regulations.

Article 26. Rights and obligations of borrowers

1. Rights of borrowers

a/ To be provided free of charge by credit information companies with credit information on the borrowers themselves (if they so request) at least once a year;

b/ To request credit information companies to consider and adjust contents of credit information on the borrowers themselves if detecting deviations and notify results of adjustment of deviations (if any) to participating organizations.

2. Borrowers are obliged to provide adequate and truthful credit information on themselves to related organizations and individuals in the course of handling requests for adjustment of deviations in credit information on borrowers.

3. To exercise other rights and perform other obligations according to this Decree and relevant regulations.

Chapter V

IMPLEMENTATION PROVISIONS

Article 27. Transitional provisions

1. From the effective date of this Decree, the provisions of Clause 4, and Point b, Clause 5, Article 4 of this Decree are not retrospectively effective for the collection of credit information and provision of credit information products by credit information companies.

2. Within 2 months from the effective date of this Decree, credit information companies established and operating before the effective date of this Decree shall send to the State Bank reports on their satisfaction of the conditions for grant of certificates specified in Article 9 of this Decree and commit to take responsibility before law for contents of such reports.

a/ In case a credit information company satisfies the law-specified conditions, it may continue to provide credit information services according to its certificate granted by the State Bank and this Decree.

b/ In case a credit information company fails to satisfy one or several of the law-specified conditions, it shall report on a plan for satisfaction of such conditions within 24 months from the effective date of this Decree.

A credit information company that satisfies the conditions specified in Article 9 of this Decree after the expiration of the planned time limit may continue to provide credit information services according to its certificate granted by the State Bank and this Decree.

For a credit information company that fails to satisfy the conditions specified in Article 9 of this Decree after the expiration of the planned time limit, the State Bank shall revoke its certificate according to Clause 3, Article 14 of this Decree.

3. Within 6 months from the effective date of this Decree, credit information companies established and commencing operation before the effective date of this Decree shall issue their internal regulations according to Article 17 of this Decree and send them to the State Bank.

4. For agreements and commitments signed before the effective date of this Decree, credit information companies may continue to implement them until they expire without any extension. The revision of such agreements and commitments may only be made if the to-be-revised contents comply with this Decree and relevant regulations.

Article 28. Effect

1. This Decree takes effect on August 15, 2021.

2. To annul Article 4 of the Government’s Decree No. 16/2019/ND-CP of February 1, 2019, amending and supplementing a number of articles of the decrees on business conditions falling within the scope of state management by the State Bank.

3. The Government’s Decree No. 10/2010/ND-CP of February 12, 2010, on credit information activities; and the Government’s Decree No. 57/2016/ND-CP of July 1, 2016, amending and supplementing Article 7 of the Government’s Decree No. 10/2010/ND-CP of February 12, 2010, on credit information activities, cease to be effective on the effective date of this Decree.

Article 29. Organization of implementation

Ministers, heads of ministerial-level agencies, and heads of government-attached agencies; chairpersons of provincial-level People’s Committees; chairpersons of Boards of Directors or chairpersons of Members’ Councils and Chief Executive Officers of credit institutions and foreign bank branches; chairpersons of Boards of Directors, chairpersons of Members’ Councils or Company Presidents and Chief Executive Officers of credit information companies, and related organizations and individuals shall implement this Decree.-

On behalf of the Government
For the Prime Minister
Deputy Prime Minister
LE MINH KHAI

* The appendices to this Decree are not translated.