Frequently Asked Questions (FAQs)

General Questions

A1. The introduction of “Credit Data Smart” aims to promote competition in the consumer credit reference industry to enhance the service quality of CRAs, and to reduce the operational risk of having only one CRA in the market, particularly the risk of single point of failure.

A2. “Credit Data Smart” is developed by the Hong Kong Association of Banks (HKAB), the DTC Association (The Hong Kong Association of Restricted Licence Banks and Deposit-taking Companies) (DTCA), and the Hong Kong S.A.R. Licensed Money Lenders Association Limited (LMLA) (collectively, “Industry Associations”), with the support of the Hong Kong Monetary Authority (HKMA). It is owned by the Industry Associations.

A3. The CRP is a financial infrastructure to facilitate the transmission of consumer credit information in encrypted form between the participating credit providers and the CRAs using the latest technologies (i.e. distributed ledger technology, big data architecture and API). The CRP is under the ownership of the Industry Associations and operated by the Credit Reference Platform Limited which is a wholly owned subsidiary of Hong Kong Interbank Clearing Limited as the Platform Operator.

For more details, please see the Overview page here.

A4. One of the key objectives of “Credit Data Smart” is to strengthen the protection for consumers’ interest in respect of consumer credit reference service. Specific benefits to consumers include the following:

  • enhanced protection of consumer credit data
  • strengthened regulation on data access and usage by CRAs
  • more choices of consumer credit reference service providers
  • a free copy of credit report from each Selected CRA every 12 months

A5. A consumer is entitled to request a credit report from each Selected CRA without charge in any 12-month period respective to each Selected CRA to validate his/her own credibility and data accuracy. Consumers can inquire about the application procedures, methods of obtaining reports and daily application limits with individual Selected CRAs. You can click here to view the contact information of the Selected CRAs.

If a consumer has been refused credit (e.g. loan, credit card application) within the past 30 business days by a Subscribed Member, the consumer is also entitled to request for a free copy of a credit report from the Selected CRA(s) which has/have provided the Subscribed Member a credit report on the consumer by presenting the credit rejection notification from the Subscribed Member.

Please note that the credit report is for consumers’ personal reference only and should not be used for credit application from any credit providers. If a credit report is provided by a customer to credit providers instead of being provided directly by a CRA, such credit report may not be most up-to-date. It may not reflect the credit status of the customer when applying for a credit, and this will pose high credit risks to the credit providers.

A6. “Credit Data Smart” adopts a “user-pays” principle where the credit providers (including authorized institutions and money lenders) and Selected CRAs using the CRP are responsible for the platform development and operating costs. Customers of credit providers do not have to pay for the introduction of “Credit Data Smart”.

A7. Consumers can contact either the Selected CRAs or the relevant Subscribed Members (i.e. credit providers) to correct the data.

According to the “Code of Practice for Multiple Credit Reference Agencies Model”, consumers have the right to dispute and request for data correction to the information they found inaccurate with the Selected CRAs or the relevant Subscribed Members. The data correction request may be confirmed or rejected based on the verification result of the request.

A8. Various factors may contribute to a credit report not reflecting a consumer’s most up-to-date credit status or account information:

  • Credit providers regularly upload customer credit data to the Credit Reference Platform on a monthly basis, but recent updates may not have been uploaded yet.
  • After downloading updated data from the platform, the Selected CRAs may take time to process and incorporate the new information into credit reports.
  • Each Selected CRA has specific reporting cutoff dates. If a consumer’s data changes after the last cutoff date, those updates will appear in the next reporting cycle.
  • If consumers dispute certain information in their reports with the Selected CRAs or credit providers, during the verification process, disputed data may remain unchanged until resolved.
  • If a consumer has recently closed an account, relevant records may take one billing cycle or longer to be uploaded to the Credit Reference Platform and reflected in his/her credit report.
  • Consumers may not have provided their up-to-date information to credit providers.

These situations have also occurred in the pre-existing consumer credit reference service. Under Credit Data Smart, the process for correcting personal data will continue. Consumers should refer to the account's "reported date" or "account information report date" shown on their credit reports to understand how their account information has been updated. If consumers find inaccuracies or outdated information in their credit reports, they can contact the relevant Selected CRA to request corrections.

A9. Under the current legal framework in Hong Kong, personal data is protected by the Personal Data (Privacy) Ordinance (PDPO); and consumer CRAs must comply with the PDPO. The Code of Practice on Consumer Credit Data issued by the Privacy Commissioner for Personal Data (PCPD) also governs the handling of consumer credit data.

In addition, the Industry Associations established the Code of Practice for the MCRA Model setting out the standards and requirements for Selected CRAs and Subscribed Members to comply on various aspects including corporate governance, internal control, use and protection of consumer credit data. The Code of Practice for the MCRA Model is endorsed by the HKMA and enforced by the MCRAUG. 

All consumer credit data is encrypted before being transmitted through or stored in the CRP in accordance with international encryption standard. Only Selected CRAs and Subscribed Members will have the keys to decrypt the data. Neither the Platform Operator nor any unauthorised parties can decrypt the data.

For more details, please see the “Code of Practice for Multiple Credit Reference Agencies Model” document here.

A10. The introduction of “Credit Data Smart” will not affect the credit services you are using, your existing credit lines and terms already approved by your credit provider(s). Under “Credit Data Smart”, your credit provider(s) may take into consideration the different credit scores provided by multiple CRAs which may adopt different credit scoring models when assessing your future credit facility applications. Consumers should note that credit score is only one of the many factors considered by credit providers when assessing credit applications.

A11. All Selected CRAs use the data on the CRP as a basis for analysis and preparing credit reports, but they may adopt different credit scoring models and have access to other data sources, and the credit scores they provide may vary. Credit providers will only obtain credit reference reports and credit scores from the Selected CRA(s) they have engaged when assessing credit applications. When making credit decision, Credit providers will take into consideration not only the credit scores provided by the Selected CRA(s) they have engaged, but also other relevant factors.

A12. Under Credit Data Smart, all Selected CRAs use the data on the CRP as a basis for analysis and preparing credit reports, but they may adopt different credit scoring models and have access to other data sources, and the credit scores they provide may vary.

When evaluating a customer’s credit application, credit providers will take into consideration the credit reports and credit scores from the Selected CRA (one or multiple) they engage with and other relevant factors.

A13. The credit scores provided by the Selected CRAs may be different. For any questions relating to credit scores, please contact the relevant Selected CRA.

A14. Credit providers will only obtain credit reference reports from the Selected CRA(s) they have engaged when assessing credit applications.

Under the Credit Data Smart, a credit provider should notify its customers in the credit facility document of the Selected CRA(s) that have been engaged for the assessment of the credit facility application and the contact details of the Selected CRA(s).

A15. Credit reports provided to consumers by Selected CRAs are for personal reference only and should not be used for credit application from any credit providers.

Credit providers should not rely on the credit reports from credit reference agencies provided by customers. Since the credit report provided by a customer may not be most up-to-date, it may not reflect the credit status of the customer when applying for a credit, and this will pose high credit risks to the credit providers.

A16. Credit providers (including authorized institutions and money lenders) will provide their customer data to all Selected CRAs operating under Credit Data Smart in accordance with the purposes set out in the Personal Information Collection Statement provided to the customers. Sharing consumer credit data with all Selected CRAs can enable them to conduct analysis and prepare credit reports based on a same set of credit data, therefore minimizing data inconsistencies.

A17. Consumer credit data under the Credit Data Smart will not be transferred outside Hong Kong. The facilities of the CRP are located in Hong Kong; and Selected CRAs are not allowed to transfer the consumer credit data outside Hong Kong for storage and processing.

A18. For questions relating to Credit Data Smart/CRP, please send an e-mail to the Business Operator at mcra.application@hkab.hk.

For questions relating to the provision or amendment of credit reports, please contact the relevant Selected CRA(s) and/or Subscribed Member(s).

Questions on CRP Membership for Credit Providers

A19. The HKMA expects all AIs that are involved in the provision of consumer credit to participate as fully as possible in the sharing and use of consumer credit data (including positive mortgage data) through CRAs within the framework laid down by the Code.

Licensed money lenders are strongly recommended to participate in “Credit Data Smart” since a fully-fledged consumer credit database will be beneficial to both consumers and Subscribed Members.

A20. As a credit provider, “Credit Data Smart” and the CRP can provide the following key benefits:

  • More effective governance on CRAs
  • More choices of CRAs
  • Enhanced protection of consumer credit data

A21. Credit providers can apply as a Subscribed Member, either Type One Member or Type Two Member depending on your business nature, to participate in “Credit Data Smart”.

Please see the page “Application Information” here for more details.

A22. “Credit Data Smart” does not lead to changes to the scope of consumer credit data to be collected or shared by credit providers. The relevant guidelines are the “Code of Practice on Consumer Credit Data” issued by the Privacy Commissioner for Personal Data and “Supervisory Policy Manual Module: IC-6” (“SPM IC-6”) issued by the Hong Kong Monetary Authority.

A23. Type One Member is a Subscribed Member which is an authorized institution or a subsidiary of an authorized institution within the meaning of section 2 of the Banking Ordinance (Cap. 155 of the Laws of Hong Kong);

Type Two Member is a Subscribed Member which is a money lender under Money Lenders Ordinance (Cap. 163 of the Laws of Hong Kong), or a person whose business (whether or not the person carries on any other business) is that of providing finance for the acquisition of goods by way of leasing or hire purchase.

A24. All authorized institutions that are involved in the provision of consumer credit are expected by the Hong Kong Monetary Authority to participate in the CRP. It is advised that authorized institutions should take timely actions to prepare for their participation in the CRP in order to meet the timeline.

Application is continuously open to licensed money lenders.

However, a Selected CRA shall not provide any consumer credit reference service involving the use of the consumer credit data on the CRP to any credit provider other than the Subscribed Members under “Credit Data Smart”. Therefore, if money lenders wish to have a seamless transition to the CRP and continue to use the consumer credit reference service from any Selected CRAs, they should be onboarded to the CRP as soon as practicable.

A25. With the user-pays principle, the key components of the fees to be paid by Subscribed Members (i.e. Type One Members, Type Two Members) are as follows:

(i)    Onboarding Fee
Onboarding Fee is the one-time fee charged to both credit providers and Selected CRAs at onboarding.

(ii)   Annual Subscription Fee
Annual Subscription Fee is charged on an annual basis (at year start) to both credit providers and Selected CRAs.

(iii)  Usage-based Fees
Usage-based Fee is charged on a monthly basis per Subscribed Members’ actual platform usage in the month (at month end). Platform usage refers to Enquiry Credit Reports requested by the Subscribed Members and provided by the Selected CRAs through all applicable channels in relation to “Credit Data Smart”.

CRP is not-for-profit, and fees collected from the Subscribed Members and Selected CRAs are used to recover various costs for the development and operation of CRP. For questions relating to the fees, please send an e-mail to the Business Operator at mcra.application@hkab.hk.

    A26. For general questions relating to Credit Data Smart/CRP, please send an e-mail to the Business Operator at mcra.application@hkab.hk.

    Questions on CRP services for credit providers

    A27. The CRP provides the functionalities of data transmission, message, and encryption key exchange supporting Subscribed Members and Selected CRA in credit operations along the consumer credit data lifecycle. 

    Communication between Subscribed Members and Selected CRAs regarding service offerings and relevant information is out of the scope of Credit Data Smart.

    A28. For Subscribed Members, data submission and credit report enquiry must go through API/Common Module.

    Specifically, for data submission, Subscribed Members can submit consumer credit data to the CRP using CRP API via the Host-to-Host connection method (Direct Channel)/ Common Module web portal.

    For credit report enquiry, Subscribed Members can submit their enquiry request on the CRP by either batch using the CRP API through the Direct Channel/Common Module web portal, or single record using the Selected CRA’s API through the Real-time Channel.

    For data correction, Subscribed Members can either submit corrections using the direct channel/Common module web portal or use the web UI/terminal under contingency scenario.

    A29. All Selected CRAs will use the data on the CRP as a basis for analysis and preparing credit reports, but they may adopt different credit scoring models and have access to other data sources, and the credit scores they provide may vary.

    Please consult the respective Selected CRA on its scoring model and service offerings.

    Questions on onboarding for credit providers

    A30. A Type Two Membership applicant should submit an independent assessment report to demonstrate its fulfilment of the onboarding criteria.

    A31. The Subscribed Members are responsible for contributing consumer credit data to the CRP for both initial data load and monthly contribution.

    The data can be submitted through API provided by the CRP/Common Module web portal.

    A32. For non-technical issues related to the initial data load, please send an e-mail to the Business Operator at mcra.application@hkab.hk.

    For technical issues encountered in the initial data load, please contact the Platform Operator via the Business Operator.  

    Questions on CRA services for credit providers

    A33. A Selected CRA shall not provide any consumer credit reference service involving the use of the consumer credit data on the CRP to any credit provider other than the Subscribed Members under “Credit Data Smart”. Therefore, if credit providers wish to have a seamless transition to the CRP and continue to use the consumer credit reference service from any Selected CRAs, they should be onboarded to the CRP as soon as practicable.

    A34. The list of Selected CRAs can be viewed at the Selected CRAs List here.

    Selected CRAs are selected by the MCRAUG based on a rigorous CRA selection regime (covering corporate governance, internal control, use and security of consumers' personal data etc.) via open tendering.

    A35. The CRP facilitates the exchange of consumer credit-related information between the Subscribed Members and the Selected CRAs. A Subscribed Member should enter into a subscription agreement with the Selected CRA(s) when subscribing to their services.

    A36. There is no requirement for Subscribed Members to subscribe to more than one Selected CRA.

    It is up to the Subscribed Member’s own business decision on whether to engage single or multiple Selected CRA(s). However, consumer credit data on the CRP will be shared with all Selected CRAs.

    A37. The CRP provides the functionalities of data transmission, message, and encryption key exchange supporting Subscribed Members and Selected CRA in credit operations along the consumer credit data lifecycle. Special features provided by individual Selected CRAs are not catered for under the current CRP design. 

    Please consult the respective Selected CRA on its service offerings.

    A38. Credit providers should not rely on credit reports from credit reference agencies obtained by customers. While the credit reports obtained by the customers may not be the most up-to-date, there are possibilities that customers might approach different credit providers using the same report at the same time, and this will pose high credit risks to the credit providers. This is not the proper operational mode to be followed by credit providers.

    Credit reports provided to consumers by Selected CRAs are for personal reference only and should not be used for any credit application from any credit providers. Any other use may bring legal risk and the Selected CRAs and their affiliates shall not be responsible for any consequences arising from such other use.

    Questions on technical setup for applicants / Subscribed Members

    A39. The “Credit Reference Platform System Participant Version Functional Specification” can be provided to potential applicants upon request and signing of a Non-Disclosure Agreement (NDA).

    Upon application approval by MCRAUG, an “ICLNet2 Access Guide” will be provided for connectivity setup and “Application Interface Development Guide” (AIDG) for technical specification required for subscribing to the CRP.

    A40. The scope of “Credit Data Smart” does not include the recommendation or provision of any system vendors or standard software packages to integrate with the CRP.

    While participants can engage service providers based on their business considerations and the CRP's technical requirements, participants can consider subscribing for the Common Module.  The Common Module was developed by the Platform Operator of  “Credit Data Smart” to facilitate onboarding of smaller credit providers to the CRP without the need to implement their own API via a user-friendly interface for credit providers to connect to the CRP.

    A41. Participants should acquire a certificate which is issued by any of the following Recognized Certificate Authorities:

    • Hong Kong Post
    • Digi-Sign Certification Services Limited

    The certificate can only be used for RSA encryption of symmetric key in the process of key exchange.

    The format of the certificate should be in x.509 format.

    A42. ICLNet2 is a new connection which requires a dedicated lease line to handle non-clearing related service.

    ICLNet2 segregates applications from the existing ICLNet to prevent potential impact to the critical payment centric applications. The security level of ICLNet and ICLNet2 are the same.

    A43. For technical support relating to the CRP, please contact the Platform Operator. The Business Operator will redirect the enquiry or complaint to the Platform Operator with relevant supporting documents.

    For applicants who are preparing to participate in the CRP, please send an e-mail to the Business Operator at mcra.application@hkab.hk

    For Subscribed Members, you may login to the Member Area through the login box from the upper right corner of our website to access contact information of the Platform Operator.