Civil Liability of Credit Information Companies under Law No. 9 of 2019 on the Exchange of Credit Information

Many economists and legal scholars who analyzed the financial crisis concluded that one of its main causes during the period 2007–2009 was the failure of credit institutions to manage risk properly and the use of imprudent lending practices, as a result of poor credit assessment and management by credit rating agencies.

In the State of Kuwait, the phenomenon of credit has expanded significantly in recent years. The number of borrowers in Kuwait reached 739,450 in 2018. Nevertheless, certain segments of society still face practical difficulties in obtaining credit due to their inability to provide the data and information required to demonstrate their financial position to credit-granting institutions. This, in turn, prevents such institutions from adequately managing credit risk. The absence of a unified customer database leads many financial institutions to refrain from granting credit to a large number of individuals, as they are unable to assess the creditworthiness of credit applicants.

To address this issue, the Kuwaiti legislator took a serious step toward ensuring credit quality by enacting Law No. 9 of 2019 on the Exchange of Credit Information. The law provides for the establishment of a specialized entity responsible for collecting and analyzing credit information, known as a Credit Information Company. This company prepares credit records and issues reports to credit providers regarding customers seeking credit and financial facilities. These reports have a significant impact on the decision to grant credit, as they enable financial institutions to assess the customer’s financial capacity and evaluate the level of risk associated with each applicant.

However, the core problem lies in the fact that the Kuwaiti legislator, in the new law, did not address the civil liability of credit information companies, whether contractual or tortious. Instead, this matter was left to the general rules of liability under the Commercial Companies Law and the Civil Code, which, in our view, are not well suited to the specific nature of credit information companies.

From the perspective of contractual liability, the Kuwaiti Law on the Exchange of Credit Information did not address manifestations of contractual liability for credit information companies, except for the general obligations set out in Article 10, without regulating specific obligations dictated by the nature of their activity. To illustrate this point, one of the key issues that may give rise to such liability, yet was not addressed by Kuwaiti law, is the conflict of interest between credit rating agencies and financial institutions that pay substantial fees to obtain credit ratings. A rating agency may issue an inflated rating lacking accuracy and objectivity to investors and contracting entities due to the significant fees paid by debt issuers. Alternatively, it may issue an unjustifiably low or unfair rating to pressure the subject entity into paying high fees upon contracting. In such cases, the agency prioritizes its financial interest over the client’s interest, which should be governed by accuracy and objectivity to enable sound investment decisions.

To avoid contractual liability, credit information companies sometimes include clauses in their contracts that expressly exempt them from liability. Comparative legislation has addressed the limitation of liability in whole or in part. Article 35 of the EU Regulation on Credit Rating Agencies allows the limitation of liability of a credit rating agency where such limitation is reasonable and proportionate, provided that the national law of the Member State permits it. It is noteworthy that the draft law submitted by the European Commission prohibited advance agreements on limitation or exemption from liability in order to provide greater protection to investors, who often lack bargaining power when contracting with credit rating agencies.

In the United Kingdom, a special law regulating the civil liability of credit rating agencies was enacted in 2013, namely the Credit Rating Agencies (Civil Liability) Regulations 2013. Article 9 expressly permits agreements to limit the liability of credit rating agencies. What distinguishes the UK legislation is that it provides detailed criteria governing the limitation of liability, requiring that it be reasonable and appropriate. Pursuant to Article 12, the law sets out several conditions, including that the limitation of liability must result from negotiations between the agency and the investor; that it relate to losses which no credit rating agency could reasonably insure against on a sound commercial basis; and that it concern losses which the agency could not reasonably have foreseen, based on available information at the time the rating was issued.

By contrast, unlike contractual liability, which is based on a valid contract, tortious liability of a credit information company arises when the wrongful act is non-contractual. The general principle is that there is no choice or accumulation between contractual and tortious liability. Where damage arises from a fault and the elements of both forms of liability are present, the injured party must rely on contractual liability rather than tortious liability.

Among the wrongful acts committed by credit information companies, which were not addressed by the new Kuwaiti law, is the issuance of misleading conduct contrary to the truth and the actual credit position when publishing credit ratings to credit providers. Instead of accurately reflecting the client’s true financial position, the company may issue a credit report containing false or misleading information without reasonable or logical basis. It may also issue a defective or erroneous credit rating that does not accurately reflect the credit risks associated with a particular debt or loan, due to a lack of due care and prudence in preparing the report.

With regard to the standard of fault required to establish the liability of credit rating agencies, EU law has defined a specific threshold. Article 35/A provides that if a credit rating agency intentionally or through gross negligence commits any of the infringements listed in Annex III, which affect the credit rating, the investor or claimant is entitled to bring a compensation claim against the agency for damages suffered as a result of the agency’s fault.

While comparative legislation has moved toward adopting special rules governing tortious liability for credit rating agencies, the Kuwaiti Law on the Exchange of Credit Information does not provide clear, specific rules governing tortious liability for credit information companies. In our view, although applying Article 227 of the Kuwaiti Civil Code may, in many cases, assist in establishing liability, it remains insufficient given the operational nature of credit information companies. Such companies rely on data and information provided by data suppliers pursuant to Article 5 of the law. If inaccurate, incomplete, or misleading information is supplied and relied upon by the company in issuing a credit report or rating, fault on the part of the company may be negated.

In the United States, Congress introduced several amendments in 2006 to the rules governing credit rating agencies under the Securities Exchange Act of 1934, known as the Credit Rating Agency Reform Act of 2006. However, these amendments did not alter the requirements imposed on claimants seeking compensation under Rule 10b-5, which requires proof that the credit rating agency intentionally engaged in fraud or manipulation, or deliberately failed to disclose material information when rating securities. This made it difficult to establish liability for agency errors.

Following the 2008 global financial crisis, the U.S. legislator enacted the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010. This law amended several provisions of the Securities Exchange Act of 1934 relating to credit rating agencies, most notably Rule 10b-5. Under the amended framework, the claimant is now only required to establish a causal link between the agency’s fault—namely, its failure, intentionally or negligently, to conduct reasonable verification of the securities being rated—and the damage suffered.

In conclusion, we recommend that the Kuwaiti legislator introduce amendments to the Law on the Exchange of Credit Information. Most importantly, the law should expressly require the conclusion of a credit inquiry contract between the credit provider and the credit information company, rather than relying solely on a request. The law should also explicitly define, on an exhaustive basis, the specific faults that may give rise to tortious liability of credit information companies. Furthermore, the law should include a mechanism enabling credit information companies to verify the accuracy and validity of data provided to them by clients.

Dr. Fahad Naama Al-Shuraifi Al-Shammari
Professor of Commercial Law, Kuwait University