4.1 Credit bureaus

The four bureaus

Bureau	URL	Coverage strengths
TransUnion CIBIL	cibil.com	Largest consumer file; strongest brand; consumer + commercial bureau
Experian Credit Information Co. of India	experian.in	Strong consumer; growing commercial
Equifax Credit Information Services	equifax.co.in	Consumer + commercial; strong inquiry / fraud feeds
CRIF High Mark	crifhighmark.com	Strongest MFI / MSME coverage; commercial bureau

All four are RBI-licensed under CICRA. Lenders must be members of all four and submit monthly data to each (per CICRA + RBI directions).

What each bureau report contains

Consumer bureau (for individuals — proprietor, director)

• Borrower demographic — PAN, name, DoB, gender, mobile, email, addresses.
• Score (300 – 900 range typically; CIBIL TransUnion score widely used; other bureaus have similar scales).
• Account summary — total accounts, active, overdue, closed.
• Per-account detail — lender, type, sanction date, sanction amount, current balance, DPD history (24–36 months), status (active / closed / settled / written off).
• Enquiry history — every enquiry by every lender in the past 24 months.

Commercial bureau (for entities)

• Entity demographic — name, PAN, GSTIN where available, addresses, directors.
• Score / risk indicator (vendor-specific).
• Total credit facilities — sanctioned + outstanding by lender.
• Per-facility details with DPD history.
• Director linkages — common across entities.
• Enquiries.

MSME / commercial reports (CRIF, CIBIL MSME, etc.)

• Same as commercial but with deeper MSME segment cuts, GST-derived turnover estimates (where bureau ingests GST), and MSME-specific risk indicators.

API flow (pull)

1. Lender submits enquiry with borrower’s identifiers (PAN minimum; mobile, DoB, address recommended).
2. Bureau performs match (PAN is strongest; demographic fields supplement).
3. Bureau returns report (usually XML or JSON).
4. Lender parses, stores, uses for decision.
5. Bureau records enquiry against borrower’s file.

API flow (submission)

1. Lender generates monthly file per CIC’s standard format from its loan book.
2. Submits via SFTP / API.
3. CIC processes; returns ack file with errors flagged.
4. Lender corrects errors and re-submits where needed.

Pricing proxy

Action	Approximate cost (orientation; verify with vendor)
Consumer report pull	₹15 – ₹50 per report (volume tiers)
Commercial report pull	₹100 – ₹500 per report
MSME report pull	₹100 – ₹500 per report
Soft pull / pre-eligibility	Lower; vendor-specific
Monthly submission	Usually no per-submission fee (cost is in membership)
Membership fee	Annual, varies

Aggregators (Karza, Perfios) typically wrap all four bureaus behind a single API with consolidated billing.

Consent requirement

• Explicit borrower consent at application — language to specify each bureau and purpose.
• For soft pulls (pre-eligibility), some bureaus allow soft-pull APIs that don’t show as full enquiries on the borrower’s report.

Implementation complexity

• Direct integration with one CIC: ~3 – 6 weeks engineering for pull + submission + parsing.
• Via aggregator: ~1 – 2 weeks for pulls; submission still on lender side.
• All four CICs in parallel: cumulative effort if direct; near-zero incremental via aggregator.

Failure cases

• No-hit — PAN doesn’t match any record (could be new-to-credit or PAN mismatch).
• Partial-hit — bureau matches but with low confidence; report quality lower.
• API timeout — bureau slow; queue + retry with idempotency.
• Submission file reject — schema / field-format errors; fix and resubmit.
• Score discrepancy between bureaus — common; policy must specify which to use or how to combine.

Fallback

• No-hit borrower — route to manual underwriting; use AA / GST / Tally as primary signals.
• API down — sandbox copy with cached version for in-flight applications.
• Multiple bureaus disagree — policy decision; document.

Compliance implications

• CICRA — mandatory membership and submission.
• Digital Lending Guidelines — explicit consent for bureau pull recorded.
• DPDP — bureau pull is processing personal data; basis is consent.
• Borrower dispute resolution — 30-day SLA.

Build vs buy

• Pull: Buy. Use one CIC direct + aggregator for the others, or aggregator-only.
• Submission: Build. The format is stable, the data is yours, and submission file generation rarely changes.
• Parsing: Buy (via vendor / aggregator’s structured output) or build (slower).