Treating the credit file as market infrastructure

Key Takeaways:

• The FCA is due to publish their final rules on Consultation Paper 26/7 at the end of this year, following the Credit Information Market Study (MS19/1). The regime is pushing to improve the quality of consumer credit information that is shared between lenders and Designated Consumer Credit Reference Agencies (DCCRAs).
• At a glance, firms that currently share credit information with at least one of the DCCRAs, must now share with all three agencies (designated as Experian, Equifax and TransUnion), on at least a monthly sharing cycle.
• Furthermore, the rules state that firms must take all reasonable steps to ensure information shared to DCCRAs is accurate. For customer disputes, a 14-day SLA response period is also required, along with mandatory correction of data performed before the next sharing cycle. There are also new rules regarding reporting of satisfied County Court Judgement (CCJ) outcomes to courts.
• Firms are given a 12-month window to ensure compliance with the regime if they already reciprocate data and 18 months if they are new subscribers, following the publishing of the final rules.
• This is the biggest change to the credit information market since the Consumer Credit Act in 1974. Even for banks which already report to all three DCCRA’s, the impact for a firm’s bureau reporting capability are still significant, particularly where existing processes are archaic and where governance may not be as robust. Failure to adhere in time may result in regulatory scrutiny.
• However, there is an opportunity to convert untapped potential to utilise more accurate and complete credit information. This can lead to better credit decisioning and more accurate pricing.

Overview

The FCA’s CP26/7 regime will require lenders to share consumer credit data consistently across designated agencies, meet tighter accuracy and 14-day dispute standards and consider downstream impacts to models and credit decisioning. For firms, this is not simply a reporting change: it could influence customer approvals, pricing, credit losses, market share and regulatory exposure. Firms should now confirm product-level reporting coverage, strengthen data quality and dispute controls, assess model impacts and incorporate the required investment into FY27 plans. Given the implications for growth, risk appetite, execution capacity and the limited 12 (or 18) -month implementation window after final rules, timely senior executive and board oversight is paramount.

Reforming The Credit Information Market

Three CRAs lead the UK credit bureau market. Based on FCA analysis using 2024 market data, of the current 219.7 million regulated agreements, 81 per cent¹ are shared with Equifax, Experian and TransUnion. However, this still leaves over 19 per cent - some 42 million accounts that are not shared across all three. Of this gap, over 11% includes so called “thin-files”, in which customer credit history is not readily available to firms. Broadly, this 19 percent is the coverage gap the Financial Conduct Authority has concluded the market will not close on its own.

Consultation Paper 26/7, published in February, is how the FCA intends to close that gap. For a high-street bank already reporting to all three agencies on its mainstream products, it is tempting to treat this as a modest technology change focused on monitoring data accuracy. In our view, that understates both the operating model and the credit-risk implications.

The paper introduces two distinct changes:

1. Converts a voluntary industry arrangement - the Steering Committee on Reciprocity’s principle of “give data to get data” - into Handbook rules (specifically Remedy 2A) while attaching quality, dispute and county court judgment/decree reporting duties to every FSMA credit and mortgage firm, regardless of how many agencies they share data with (Remedy 2D).
2. Modifies how firms consume richer and more consistent credit market information, enhancing risk segmentation, affordability assessments and sharpening credit decisions.

The two changes require coordinated workstreams: one for compliance and readiness, the other for credit-risk opportunities from richer data.

CP26/7 also envisages additional, industry-led remediations beyond Remedies 2A and 2D, which gives the Credit Information Governing Body (CIGB) a central role. Previously known as the Credit Reporting Governance Body, the CIGB was established to support industry self-governance of the credit information market and to develop the industry-led remedies proposed in CP26/7. Its membership spans established banks, Buy-Now Pay-Later (BNPL) firms, credit reference agencies, consumer representatives and trade unions, alongside the FCA. In its recent response to CP26/7, the CIGB welcomed the proposed rules but noted that many detailed data standards, operational processes and implementation approaches are not prescribed and instead need to be developed collaboratively with industry. It therefore sees itself as central to setting guidance, standards and frameworks made for industry, by industry.

For executives, CP26/7 creates three immediate priorities:

1. Establish product-level coverage across all designated agencies;
2. Redesign controls for accuracy and 14-day dispute response requirement; and
3. Treat more in-depth bureau data as an opportunity to make more accurate and robust credit risk models, based on a more complete market.

Shifting towards enhanced credit decisioning with accurate credit market information

For banks, the commercial implication is equally direct. Incomplete files produce two types of errors that are hard to see in isolation:

• Error 1: Access to credit – Customers, who would have been accepted with a fuller picture, being declined; and
• Error 2: Potentially unaffordable credit – Customers, who would have been declined with a fuller picture, being accepted.

CP26/7 is designed to reduce both of these errors.

Reducing both errors depends on making relevant consumer credit obligations consistently visible across the market. This is why CP26/7 proposes mandatory data sharing to the main DCCRA’s noted, within at least a monthly frequency, covering both positive and negative data. Products currently consolidated at a single agency, (such as for BNPL firms), would no longer remain just partly visible. A firm that chooses not to participate may remain outside the sharing obligation, but it would also lose access to peers’ credit data, potentially weakening its ability to compete on the accuracy of credit decisions.

Material gaps to emerge with maturity

For most large banks already reporting to multiple bureaus, implementation may largely involve tightening documentation and controls rather than building entirely new feeds. In contrast, for first-time providers², establishing new data feeds may represent a material incremental cost.

However, in both cases, the more consequential cost arises when a market-wide change in consumer data affects the inputs to credit, affordability and impairment models. This is because such models are trained on conditions in which a customer profile can look thin at one agency and complete at another. As that divergence narrows, population-stability indices can move and scorecards could drift. Customers previously declined due to lack of a sufficiently complete file may reappear as stronger prospects. Firms should therefore assess their model impacts sooner rather than later, ensuring that both models and their wider credit strategies are re-calibrated to new information. The FCA’s intended outcomes include more credit extended in aggregate and more affordable lending. Agencies will now compete primarily on their coverage of unregulated lenders and other providers of unregulated debt, including utilities and telecommunications firms. Coverage of regulated credit arrangements will no longer be a key differentiator, although coverage of telecommunications, utilities and other unregulated debt will remain an important competitive distinction.

Four operational rules lenders must develop

Four operational rules will apply:

Six questions for Chief Risk & Credit Officers

Conclusion: Readiness Starts Before the Final Rules

CP26/7 is more than a reporting update. It is intended to make consumer credit information more comprehensive, consistent and accurate across the market, while bringing data sharing and use within a clearer regulatory framework. For established banks, the central challenge is therefore not simply whether another bureau feed is required, but whether product coverage, data ownership, dispute handling, judgment notifications and permitted-use controls are ready to operate as one coherent system. This should be alongside end-to-end data- quality controls, testing framework design and implementation, as well as identification, investigation and correction of historic issues and remediation of systemic issues.

Firms should use the period before final rule publication to confirm product-level coverage, assign accountable data owners, establish a single 14-day dispute process, strengthen satisfied-judgment notifications and assess how a more complete credit file could affect credit, affordability and IFRS 9 models. Needless deferment will compress these activities into the year that should be reserved for implementation and testing. The strategic implication is equally important. As previously missing agreements become visible, credit models may behave differently. Go-live should consequently be treated as a model-validation and potential recalibration event, with credit-risk, data, operations, legal, collections and procurement teams working to a shared readiness plan.

Written for discussion among UK bank executives. Not regulatory advice.

______________________________________________________

References:

1. Source: Consultation Paper 26/7; Figure 2, FCA analysis of portfolio-level CRA data and data on lending volumes collected from regulated firms (Page 55)

2. Source: Consultation Paper 26/7; Para 136.

3. https://content.govdelivery.com/accounts/UKFCA/bulletins/40b7587