Credit information: FCA-led remedies proposals published

The FCA has published consultation paper CP26/7, containing proposals on FCA-led remedies from its December 2023 CIMS final report which set out measures to improve the credit information market to help deliver better lending decisions for borrowers and improve competition and innovation for market participants.

For more on the full CIMS remedies package, take a look at our previous article ‘Credit information: UK FCA publishes final report with remedies package for improving the market.'

Details of the FCA's proposals are provided below; however, by way of summary:

• Mandatory reporting: In-scope consumer credit and mortgage (and some wider home finance) firms – including ‘first-time providers’ of information - will need to review and/or set up the necessary systems, processes and contractual arrangements for sharing consumer credit information with all DCCRAs where they share information with one such DCCRA, at least once a month
• High-quality credit reporting requirements: New requirements are being introduced to improve data accuracy, governance and corrections. Requirements relating to data disputes under s159 of the Consumer Credit Act 1974 and to reporting satisfied county court judgments and decrees would apply to a broader scope of consumer credit and mortgage/home finance firms, than those within scope of the mandatory reporting requirement.
• Permitted use of consumer credit information: Firms and DCCRAs subject to the mandatory reporting framework must only use consumer credit information shared between them to promote responsible lending. The FCA has proposed a non-exhaustive list of what is included within the meaning of ‘promoting responsible lending’ for both DCCRAs and in-scope firms

The consultation closes on 1 May 2026.

While the FCA emphasises that it considers ‘only incremental changes’ will be required in light of its proposals, a careful gap analysis will still be needed to ensure nothing slips through the net.

It’s clear from the FCA’s comments in the CP that, once in force, the proposed new requirements – and firms’ credit information practices more generally - would be subject to ongoing monitoring and potential further regulatory intervention, so firms should be aiming to get their implementation right first time.

We have significant experience in supporting financial institutions with all aspects of their business journey, including systems, processes and procedures changes. The combination of our legal and consulting teams provides you with a full range of services and clear guidance on how the solutions can be applied within the business. If you would like to discuss how we can help you, please reach out to any of the people listed in this article or your usual Hogan Lovells contact.

Firms that share consumer credit information on any in-scope agreement with at least one DCCRA would have to share all available consumer credit information on that agreement with all DCCRAs.

• Designation of CRAs
  • The FCA proposes to designate Equifax Ltd, Experian Ltd, and TransUnion International UK Ltd because they are ‘the primary sources of credit information and related products used in retail lending markets for most lenders.’ It asks stakeholders whether there are any other CRAs they think it should designate.
  • To mitigate any ‘halo effect’ from introduction of the DCCRAs regime, the proposed rules specify that DCCRAs (and any person acting on their behalf) must not use the designation status as a basis for marketing or promoting the DCCRA or its services.
  • The FCA expects DCCRAs and firms to work together to resolve any quality issues so that consumer credit information received by DCCRAs from firms can be accepted. It proposes that if a DCCRA prevents a firm from providing consumer credit information on grounds other than accuracy and completeness, it should notify the FCA of its reasons for doing so.
  • The FCA does not currently consider it necessary to prohibit DCCRAs from levying charges on firms in relation to the receipt of consumer credit information but will keep this under review.
• Scope
  • The framework specifies the regulated activities, agreements and types of information that fall within scope of the new mandatory reporting requirement, with new chapters of the CONC (Consumer Credit) and MCOB (Mortgages and Home Finance) Sourcebooks.
  • The new reporting requirement applies to firms carrying out lending and servicing activities in respect of regulated credit agreements and regulated mortgages (and other home finance products), debt collecting and administration activities (as well as operators of Peer-to-peer (P2P)platforms) where the customer is a consumer (as defined in the Handbook).
  • As per the existing regulatory scope, consumer credit lending to High Net Worth (HNW) individuals would not be captured but mortgage lending to HNW individuals for primary residence would be within scope.
• Consumer credit information to be shared
  • Rather than prescribing particular data formats, the FCA proposes setting clear, high level expectations for the types of consumer credit information that must be shared with illustrative and non-exhaustive examples of related data points, namely: identification information, account information; credit obligations; full repayment history; default information; and forbearance information. There would be a ‘full data’ expectation, meaning that firms would be required to share ‘all’ of the types of consumer credit information that they hold for a reportable agreement (ie both ‘positive’ and ‘negative’ data).
• Frequency of information sharing
  • Firms would have to share all consumer credit information they hold for reportable agreements with all DCCRAs at least once a month, reflecting current market practice (but subject to potential amendment in light of future innovation or other changes).
  • Firms needing or choosing to stop sharing consumer credit information with DCCRAs would have to notify the FCA at least 2 months in advance of the earliest date on which they intend to stop sharing with any of the DCCRAs. This is unless the decision relates to avoiding a breach of the data protection principles, where no notice would be required and the firm would be free to later resume sharing.
• Transfer of reportable agreements
  • Firms transferring reportable agreements out of their business (whether by sale, insolvency, or other transaction) and stopping the sharing of consumer credit information would not be required to notify the FCA, although they would continue to be subject to the mandatory reporting requirement up until the point of transfer and would have to take all reasonable steps to minimise any related adverse impacts on consumers (eg marking accounts as closed or settled or resolving any data disputes).
  • Firms acquiring reportable agreements would not be required to start sharing consumer credit information with DCCRAs. However, where firms continued reporting consumer credit information on transferred agreements with DCCRAs, they would have to take all reasonable steps to minimise any adverse impacts on consumers caused by any interruption in the sharing of consumer credit information with DCCRAs during the transfer.

The FCA believes the Consumer Duty alone is not sufficient to make sure information shared under the mandatory reporting framework is of high quality and is therefore also proposing a broader framework of rules to support high-quality credit reporting. Some aspects of the proposals apply to the same firms as the mandatory reporting requirement (accuracy of data and error correction), while others have a broader scope (data disputes under s159 Consumer Credit Act and County Court Judgments (CCJs)/decrees).

• Information accuracy, governance and error correction under mandatory reporting requirement
  • As some outcomes in relation to error correction and disputes rely on the timing of information exchanges between CRAs and firms, a deadline of 14 days for firms to respond to CRAs would be imposed.
  • In support of the industry-led remedy on providing a streamlined disputes process, firms:
    • Must take all reasonable steps to ensure that the information shared is accurate. This means having systems and processes in place to ensure the information is as accurate as possible and is tested for accuracy before being submitted. As each firm’s processes will differ, the FCA is not proposing to introduce specific rules;
    • Should monitor systems and processes for sharing information, to identify systemic errors or issues which affect the accuracy of shared information. Where inaccuracies are identified (through any method) in information already shared with DCCRAs and other CRAs, they must take prompt action to correct any error across all DCCRAs/CRAs. This should ideally be done before, or if not then no later than, the next regular sharing event. There should be an aim to move to ‘real time correction of errors in most cases, delivered through industry-led remedies’;
    • Where they are aware that any delay to correction is likely to have a material adverse impact on a consumer’s financial situation (eg where an error is preventing the progress of a mortgage application), should correct information as soon as reasonably practicable.
• Data disputes under s159 Consumer Credit Act 1974 (CCA)
  • Building on the statutory mechanism under s159 CCA for consumers to challenge and correct inaccurate information held by CRAs, all FSMA mortgage and credit firms (not just those subject to the mandatory reporting framework) would be required to:
    • take all reasonable steps to investigate the dispute;
    • respond to the CRA within 14 days setting out the results of its investigation (unless exceptional circumstances apply, when a holding response with a new timescale for a full response can be provided instead); and
    • take prompt action to correct information across all CRAs with whom inaccurate information was shared and identify and correct any systemic causes.
• Reporting satisfied CCJs and decrees
  • A requirement for firms to report satisfied CCJs/decrees to the courts (including county courts, the High Court, the sheriff court and the Court of Session) /Registry Trust (RT) as soon as reasonably practicable would be introduced. It would not override existing processes that enable either the debtor or claimant to contact the relevant court/RT with proof of payment.
  • The new requirement would apply to all firms undertaking the following regulated activity in relation to a debt for which a CCJ or decree has been obtained (regardless of whether they are caught by the mandatory reporting requirement): consumer credit lending; administering a home finance transaction; debt collecting, in relation to regulated credit agreements; debt administration, in relation to regulated credit agreements; operating an electronic system for lending in relation to a borrower under a P2P agreement; facilitating a home finance transaction as a P2P platform operator.
  • The provisions would extend to some business lending where it is in scope of the above regulated activities, for cases where a natural person may take out a mortgage or credit agreement in their own name but which is used wholly or partly for business purposes (such as sole traders or unincorporated partnerships). The proposed rules would not apply to unregulated agreements (i.e. exempt agreements) for the regulated activities of debt collecting and administration.

• The FCA is taking this opportunity to codify (rather than materially change) how consumer credit information shared under the proposed requirements may be used by firms and DCCRAs in retail lending markets.
• Firms and DCCRAs subject to the mandatory reporting framework would be subject to a high-level requirement to only use consumer credit information shared between them for activities related to the general purpose of promoting responsible lending.
• The FCA has proposed a non-exhaustive list of what is included within the meaning of ‘promoting responsible lending’ for both DCCRAs and firms carrying out regulated credit activity or in-scope home finance activity (eg informing and/or carrying out affordability/creditworthiness assessments). This is designed to reflect the different business models and existing regulatory requirements across these sectors.

• Mandatory reporting framework: The new regime would enter into force 12 months after publication of the FCA’s policy statement. The FCA proposes a 6-month lead in time for ‘first time providers’ of consumer credit information who begin sharing once the regime is in force.
• Information accuracy and governance and permitted use requirements: These provisions would also come into force 12 months after publication of the policy statement is published, regardless of how many DCCRAs firms are sharing consumer credit information with. Therefore, these proposed provisions would apply to first-time provider firms from the date on which they start sharing.
• Provisions on notices under s159 CCA and reporting CCJs/decrees: These would also come into force, for all firms to which they apply, 12 months after publication of the policy statement.

• DCCRA reporting to the FCA: The CIMS final report outlined potential Handbook rules requiring DCCRAs to report to the FCA every 12 months. The FCA now proposes to first gather relevant information from DCCRAs through a section 165 FSMA request, issued around 12 months after the mandatory reporting requirements enter into force. This will help to ensure that any future reporting framework is proportionate and minimises burdens (which also supports the FCA’s 2025–2030 Strategy commitment to collect only data it needs and will use). Any future requirements would be subject to consultation.
• Signposting to statutory credit reports (SCR): This remedy provided that CRAs and CISPs should prominently signpost consumers to their free SCRs. However, as relevant firms should already be considering how best to signpost consumers to SCRs under the Consumer Duty consumer understanding and support outcomes as set out in the FCA’s January 2025 portfolio letter to CRAs/CISPs, it does not currently propose to introduce a signposting requirement but will continue to monitor the situation.