The Reserve Bank of India announced on 4 September 2026 that it had imposed monetary penalties on three credit information companies for failing to pay customer compensation on time. By separate orders dated 31 August 2026, RBI penalised TransUnion CIBIL Limited Rs 26,82,800, CRIF High Mark Credit Information Services Private Limited Rs 6,89,600 and Equifax Credit Information Services Private Limited Rs 1,19,400 — Rs 34,91,800 in aggregate — under section 25(1)(iii) read with section 23(4) of the Credit Information Companies (Regulation) Act, 2005 (CICRA).
Background
India's credit-information compensation framework was announced in paragraph 4 of the Statement on Developmental and Regulatory Policies released with the Bi-monthly Monetary Policy Statement 2023-24 on 6 April 2023, and issued as RBI circular DoR.FIN.REC.48/20.16.003/2023-24 on 26 October 2023 in exercise of the power under sub-section (1) of section 11 of CICRA. That circular took effect six months from its date. It has since been repealed and consolidated, as paragraph 17 of the Master Direction — Reserve Bank of India (Credit Information Reporting) Directions, 2025 (RBI/DoR/2024-25/125, DoR.FIN.REC.No.55/20.16.056/2024-25, dated 6 January 2025), which is the operative instrument today.
The framework converts two pre-existing statutory timelines into a paid entitlement. Section 21(3) of CICRA gives a credit institution or credit information company thirty days to act on a request to correct credit information. Rule 20(3)(c) of the Credit Information Companies Rules, 2006 gives the credit institution twenty-one days to forward the corrected particulars. Read together, as paragraph 17(1) of the Master Direction expressly explains, the credit institution gets twenty-one days and the credit information company the remaining nine — thirty days in total to dispose of the complaint.
Miss that, and the complainant becomes entitled to Rs 100 for every calendar day of delay. Where more than one entity is at fault, paragraph 17(5) apportions the compensation among them proportionately.
The charge sustained
The three press releases follow an identical structure, and the substance of the charge is the same in each.
The trigger was supervision, not complaint. Each release records that RBI's statutory inspection of the company was conducted with reference to its financial position as on 31 March 2025, and that the show-cause notice followed supervisory findings of non-compliance and related correspondence.
The charge is about payment, not correction. In each case RBI found sustained the charge that "the company failed to credit the compensation amount to the bank accounts of certain eligible complainants, within the prescribed period." That maps to paragraph 17(11) of the Master Direction, which requires the compensation amount to be credited to the complainant's bank account within five working days of resolution of the complaint. The finding is not that the credit records went uncorrected; it is that the money owed for the delay did not reach the customer on time.
Process before penalty. RBI recorded that it considered each company's reply to the notice and oral submissions made during a personal hearing; for TransUnion CIBIL and CRIF High Mark, additional written submissions were also considered.
The statutory route. Section 25(1)(iii) of CICRA read with section 23(4) is the penalty power invoked in all three orders — the same provision, and therefore the same maximum, for each company regardless of the amount finally imposed.
A standard caveat. Each release states that the action is based on deficiencies in regulatory compliance and "is not intended to pronounce upon the validity of any transaction or agreement entered into by the company with its customers," and that the penalty is without prejudice to any other action RBI may initiate.
RBI has not disclosed the number of complainants affected, the period over which the failures occurred, or the compensation sums involved at any of the three companies. The spread between the highest and lowest penalty is roughly twenty-two to one, but the press releases do not explain what drives it.
Implications for compliance teams
The most useful thing about this trio of orders is where in the process the failure sits. A credit bureau can build a perfectly compliant dispute-resolution workflow — intake, coordination with the lender, corrected Credit Information Report despatched inside thirty days — and still be penalised, because the framework does not end at resolution. Paragraph 17(9) fixes the date of resolution as the date the rectified report is sent to the complainant's postal address or email; paragraph 17(11) then starts a separate five-working-day clock for the money. Grievance-redress systems that treat despatch of the corrected report as case closure will not surface a breach of that second clock at all.
Three practical consequences follow for regulated entities on both sides of the framework.
First, the payout leg needs its own instrumentation. Compensation crediting is a treasury and payments operation, not a grievance operation, and it will usually sit in a different system from the dispute record. Boards should expect a control that reconciles resolved complaints against credited compensation, dated and ageing, rather than a report that counts complaints closed.
Second, the data-quality dependency is real. Paragraph 17(10) obliges credit information companies and credit institutions to build fields into their complaint formats — online and offline — for the complainant's contact details, email, and bank account or UPI ID for crediting compensation, and places the onus of accuracy on the complainant. Where those fields are optional or poorly validated at intake, a five-working-day payout obligation becomes structurally difficult to meet. Firms should look at intake design, not only at payment operations.
Third, this exposure is not confined to bureaus. The framework binds credit institutions as well: paragraph 17(2) makes a credit institution liable to compensate where it fails to send updated credit information within twenty-one calendar days. Banks, NBFCs, housing finance companies, asset reconstruction companies and All-India Financial Institutions are all addressees of the 2025 Master Direction. The three orders of 31 August 2026 concern the bureau side; nothing in them suggests the lender side is outside supervisory attention.
For consumers, the route where compensation is wrongfully denied remains the RBI Ombudsman under the Reserve Bank — Integrated Ombudsman Scheme, 2021, under paragraph 17(12), or the Consumer Education and Protection Cell at an RBI Regional Office where the credit institution is not yet covered by that Scheme, under paragraph 17(13).
Frequently Asked Questions
Does a penalty on a credit bureau mean my own credit report is wrong?
No. Each of the three RBI press releases of 4 September 2026 expressly states that the action is based on deficiencies in regulatory compliance and is not intended to pronounce upon the validity of any transaction or agreement entered into by the company with its customers. The charge sustained concerned late crediting of compensation, not the accuracy of any particular credit report.
How long does a lender have to correct credit information before compensation starts running?
Twenty-one calendar days. Under paragraph 17(2) of the Master Direction — Reserve Bank of India (Credit Information Reporting) Directions, 2025, a credit institution must pay compensation if it fails to send updated credit information to the credit information companies within twenty-one calendar days of being informed by the complainant or a bureau. The bureau then has the remainder of the overall thirty-day limit.
Are these penalties the maximum RBI could impose?
The press releases do not say. They record only that the penalties were imposed in exercise of powers conferred under section 25(1)(iii) read with section 23(4) of the Credit Information Companies (Regulation) Act, 2005, and that each is without prejudice to any other action that may be initiated by RBI against the company.