Information Utilities Regulations, 2017

INSOLVENCY AND BANKRUPTCY BOARD OF INDIA
NOTIFICATION
New Delhi, the 31st March, 2017

Insolvency and Bankruptcy Board of India (Information Utilities) Regulations, 2017

[Amended upto date ¹]

No. IBBI/2016-17/GN/REG009.—In exercise of the powers conferred by sections 196, 209, 210, 211, 212, 213, 214, 215, 216 read with section 240 of the Insolvency and Bankruptcy Code, 2016 (31 of 2016), the Board hereby makes the following Regulations to provide a framework for registration and regulation of information utilities in terms hereof, namely

CHAPTER I-PRELIMINARY

1. Short title and commencement.

1. (1) These Regulations may be called the Insolvency and Bankruptcy Board of India (Information Utilities) Regulations, 2017.

(2) These Regulations shall come into force on 1st April, 2017.

2. Definitions.

2. (1) In these Regulations, unless the context otherwise requires-

(a) “Application Programming Interface” means a mechanism that allows a system or service to access data or functionality provided by another system or service;

²[(aa) “Board” means the Insolvency and Bankruptcy Board of India established under section 188 of the Code;]

(b) “certificate of registration” means a certificate of registration granted or renewed by the Board under section 210 read with these Regulations and the terms “registration” and “renewal” shall be construed accordingly;

(c) “Code” means the Insolvency and Bankruptcy Code, 2016 (31 of 2016) and includes the rules, regulations, guidelines and directions issued thereunder;

(d) “control” shall have the meaning assigned to it under section 2(27) of the Companies Act, 2013 (18 of 2013);

³[(da) “financial information” means any public announcement made under the Code, for the purposes of sub-clause (f) of clause (13) of section 3;]

(e) “Governing Board” means the Board of Directors, as defined under section 2(10) of the Companies Act, 2013 (18 of 2013), of the company registered as an information utility;

(f) “host bank” means the financial institution hosting the repayment account;

(g) “independent director” shall have the meaning assigned to it under section 149(6) of the Companies Act, 2013 (18 of 2013);

(h) “information” means financial information as defined in section 3(13);

(i) “key managerial personnel” shall have the meaning assigned to it under section 2(51) of the Companies Act, 2013 (18 of 2013);

(j) “net worth” shall have the meaning assigned to it under section 2(57) of the Companies Act, 2013 (18 of 2013);

(k) “outsourcing” means contracting out services to a third party;

(l) “public company” shall have the meaning assigned to it under section 2(71) of the Companies Act, 2013 (18 of 2013);

⁴[(la) “record of default” means the status of authentication of default issued in Form D of the Schedule.]

(m) “repayment account” means the bank account to which a debtor is obliged to repay its debt, as recorded in an information utility;

(n) “section” means a section of the Code;

(o) “secure systems” shall have the meaning assigned to it in section 2(1)(ze) of the Information Technology Act, 2000 (21 of 2000);

(p) “Schedule” means schedule attached to these Regulations;

(q) “submission of information” includes updating of information, as the context may require;

(r) “Technical Standards” means the standards laid down by the Board through guidelines issued under Regulation 13, from time to time; and

(s) “user” means a person who avails of the services of an information utility.

(2) Unless the context otherwise requires, words and expressions used and not defined in these Regulations, shall have the meanings assigned to them in the Code.

CHAPTER II-REGISTRATION

3. Eligibility for registration.

3. No person shall be eligible to be registered as an information utility unless it is a public company and –

(a) its sole object is to provide core services and other services under these Regulations, and discharge such functions as may be necessary for providing these services;

(b) its shareholding and governance is in accordance with Chapter III;

(c) its bye-laws are in accordance with Chapter IV;

(d) it has a minimum net worth of fifty crore rupees;

⁵[(e)***]

⁶[(f)***]

(g) the person itself, its promoters, its directors, its key managerial personnel, and persons holding more than 5%, directly or indirectly, of its paid-up equity share capital or its total voting power, are fit and proper persons:

Explanation: For determining whether a person is fit and proper under these Regulations, the Board may take account of relevant considerations, including-

(i) integrity, reputation and character,

(ii) absence of conviction by a court for an offence:

Provided that a person may be considered ‘fit and proper’ if he has been sentenced to imprisonment for a period of less than six months;

Provided that a person shall not be considered ‘fit and proper’ if he has been sentenced to imprisonment for a period (a) of not less than six months, but less than seven years and a period of five years has not elapsed from the date of expiry of the sentence, or (b) of seven years or more.

(iii) absence of restraint order, in force, issued by a financial sector regulator or the Adjudicating Authority, and

(iv) financial solvency.

4. Application for registration or renewal thereof.

4. (1) A person eligible for registration as an information utility may make an application to the Board in Form A of the Schedule, along with a non-refundable application fee of ⁷[ten lakh] rupees.

(2) An information utility seeking renewal of registration shall, at least six months before the expiry of its registration, make an application for renewal in Form A of the Schedule, along with a non-refundable application fee of ⁸[ten lakh] rupees.

(3) The Board shall acknowledge an application made under this Regulation within seven days of its receipt.

5. Disposal of application.

5. (1) The Board shall examine the application, and give an opportunity to the applicant to remove the deficiencies, if any, in the application.

(2) The Board may require the applicant to submit, within reasonable time, additional documents or clarification that it deems fit.

(3) The Board may require the applicant to appear, within reasonable time, before the Board in person, or through its authorised representative for clarifications required for processing the application.

(4) If the Board is satisfied, after such inspection or inquiry as it deems necessary, that the applicant-

(a) is eligible under Regulation 3;

(b) has the technical competence and financial capacity required to function as an information utility;

(c) has adequate infrastructure to provide services in accordance with the Code;

(d) has in its employment, persons having adequate professional and other relevant experience, to provide services in accordance with the Code; and

(e) has complied with the conditions of the certificate of registration, if he has submitted an application for renewal under Regulation 4(2)

it may grant or renew a certificate of registration to the applicant as an information utility in Form B of the Schedule, within sixty days of receipt of the application, excluding the time given by the Board for removing the deficiencies, or presenting additional documents or clarifications, or appearing in person, as the case may be.

(5) If, after considering an application made under Regulation 4, the Board is of the prima facie opinion that the registration ought not to be granted or ought not to be renewed, or be granted or renewed with additional conditions, it shall communicate the reasons for forming such an opinion within forty-five days of receipt of the application, excluding the time given by the Board for removing the deficiencies, presenting additional documents or clarifications, or appearing in person, as the case may be.

(6) The applicant shall submit an explanation as to why its application should be accepted within fifteen days of the receipt of the communication under sub-regulation (5), to enable the Board to form a final opinion.

(7) After considering the explanation, if any, given by the applicant under sub-regulation (6), the Board shall communicate its decision to-

(a) accept the application, along with the certificate of registration; or

(b) reject the application by an order, giving reasons thereof

within thirty days of receipt of explanation.

(8) The order rejecting an application for renewal of registration shall require the information utility to-

(a) discharge any pending obligations;

(b) continue its functions till such time as may be directed, to enable its users to transfer information stored with it to another information utility; and

(c) comply with any other directions as considered appropriate.

6. Conditions of registration.

6. (1) The certificate of registration shall be valid for a period of five years from the date of issue.

(2) The certificate of registration shall be subject to the conditions that the information utility shall–

(a) abide by the Code;

(b) abide by its bye-laws;

(c) at all times after the grant of the certificate continue to satisfy the requirements under Regulation 5(4);

(d) pay a fee of ⁹[one crore] rupees to the Board, within fifteen days of receipt of intimation of registration or renewal from the Board, as applicable;

¹⁰[¹¹[(e) pay to the Board, a fee calculated at the rate of ten per cent. of the turnover from the services as an information utility rendered in the preceding financial year, on or before 30th April every year:

Provided that without prejudice to any other action which the Board may take as it deems fit, any delay in payment of fee by an information utility shall attract simple interest at the rate of twelve percent per annum.

Illustration

Where an information utility generates turnover amounting to Rs. 75 crore in the financial year 2022-23, it is liable to pay fee of Rs. 7.50 crore to the Board on or before 30th April 2023.]]

(f) seek prior approval of the Board for-

(i) the acquisition of shares or voting power by a person, which taken together with paid-up equity shares or voting power, if any, held by such person, entitles him to hold more than five per cent, directly or indirectly, of the paid-up equity share capital or total voting power;

(ii) a change of control;

(iii) a merger, amalgamation or restructuring;

(iv) sale, disposal, or acquisition of the whole, or substantially the whole, of its undertaking;

(v) voluntary liquidation, dissolution, or any similar action involving the discontinuation of its business.

(g) intimate the Board if a person holding more than five per cent, directly or indirectly, of its paid-up equity share capital or total voting power ceases to hold at least five per cent, directly or indirectly, of its paid-up equity share capital or total voting power, within fifteen days from such cessation;

(h) take adequate steps for redressal of grievances;

(i) take over information stored with other information utilities on the directions of and in the manner directed by the Board, and provide core services to their users; and

(j) abide by such other conditions as may be stipulated by the Board.

7. In-principle approval.

7. (1) Any person who seeks to establish an information utility may make an application for an in-principle approval, demonstrating that the conditions in sub-regulation (2) are satisfied, along with a non-refundable application fee of five lakh rupees.

(2) If the Board is satisfied, after such inspection or inquiry as it deems necessary, that-

(a) the applicant is a fit and proper person; and

(b) the proposed or existing company which may receive registration would be able to meet the eligibility criteria under Regulation 3,

it may grant in-principle approval which shall be valid for a period not exceeding one year and be subject to such conditions as it deems fit.

(3) During the validity of in-principle approval, the company referred to in sub-regulation 2(b) may make an application for a certificate of registration as an information utility to the Board in accordance with Regulation 4, but shall not be required to pay the application fee for registration.

CHAPTER III-SHAREHOLDING AND GOVERNANCE

8. Shareholding.

8. (1) No person shall at any time, directly or indirectly, either by itself or together with persons acting in concert, acquire or hold more than ten per cent of the paid-up equity share capital or total voting power of an information utility:

Provided that the following persons may, directly or indirectly, either by themselves or together in concert, acquire or hold up to twenty-five percent of the paid-up equity share capital or total voting power of an information utility :-

(a) government company;

(b) stock exchange;

(c) depository;

(d) bank;

(e) insurance company; and

(f) public financial institution.

¹²[(2) Notwithstanding anything to the contrary contained in sub-regulation (1) –

(a) a person may, directly or indirectly, either by itself or together with persons acting in concert, hold up to fifty-one percent of the paid-up equity share capital or total voting power of an information utility up to three years from the date of its registration; or

(b) an Indian company, (i) which is listed on a recognised Stock Exchange in India, or (ii) where no individual, directly or indirectly, either by himself or together with persons acting in concert, holds more than ten percent of the paid-up equity share capital, may hold up to hundred percent of the paid-up equity share capital or total voting power of an information utility up to three years from the date of its registration.

Provided that the information utility is registered before 30th September, 2018.]

(3) The provisions of this Regulation shall not apply to the holding of shares or voting power by the Central Government or a State Government.

9. Composition of the Governing Board.

¹³[9. (1) The Governing Board shall consist of –

(a) managing director;

(b) independent directors; and

(c) shareholder directors:

Provided that more than half of the directors shall be citizens of India and shall be residents in India.

(2) The managing director shall not be considered either an independent director or a shareholder director.

(3) Any employee of an information utility may be appointed as a director on its Governing Board in addition to the managing director, but such director shall be deemed to be a shareholder director.

(4) The number of independent directors shall not be less than the number of shareholder directors:

Provided that no meeting of the Governing Board shall be held without the presence of at least one independent director.

(5) An independent director shall be an individual-

(a) who is a person of ability and integrity;

(b) who has expertise in the field of finance, law, management or insolvency;

(c) who is not a relative of the directors of the Governing Board;

(d) who has or had no pecuniary relationship with the information utility, or any of its directors, or any of its shareholders holding more than ten per cent. of its share capital, during the immediately preceding two financial years or during the current financial year;

(e) who is not a shareholder of the information utility; and

(f) who is not a member of the Board of Directors of any of the shareholders holding more than ten per cent. of the share capital of the information utility.

(6) An independent director shall be nominated by the Board from amongst the list of names proposed by the information utility.

(7) An individual may serve as an independent director for a maximum of two terms of three years each or part thereof, or up to the age of ¹⁴[seventy-five years], whichever is earlier.

(8) The second term referred to in sub-regulation (7) may be subject to a satisfactory performance review of the first term by the Governing Board.

(9) A cooling off period of three years shall be applicable for an independent director to become a shareholder director in the same or another information utility.

(10) The directors shall elect an independent director as the Chairperson of the Governing Board.

(11) A director, who has any interest, direct or indirect, pecuniary or otherwise, in any matter coming up for consideration at a meeting of the Governing Board or any of its Committees, shall as soon as possible after relevant circumstances have come to his knowledge, disclose the nature of his interest at such meeting and such disclosure shall be recorded in the proceedings of the Governing Board or the Committee, as the case may be, and the director shall not take part in any deliberation or decision of the Governing Board or the Committee with respect to that matter.]

9A. Managing director.

¹⁵[9A. (1) An information utility shall, subject to the guidelines issued by the Board from time to time, determine the qualification and experience, manner of appointment, terms and conditions of appointment and other procedural formalities associated with the selection and appointment of the managing director, subject to the condition that-

(a) an individual shall be selected as managing director through an open advertisement in all editions of at least one national daily newspaper;

(b) an individual at the time joining as managing director shall not be above the age of fifty-five years, which may be relaxed by the Governing Board up to sixty years, after recording reasons therefor; and

(c) an individual shall not serve as managing director after he has attained the age of sixty-five years.

(2) The appointment of an individual as the managing director shall be for a tenure of not less than three years but not exceeding five years.

(3) An individual may serve as managing director for a maximum of two terms.

(4) The process of appointment for the second term as managing director shall be conducted afresh.

(5) The appointment and remuneration payable to the managing director shall be approved by a compensation committee constituted by the Governing Board.

(6) The appointment, renewal of appointment and termination of service of the managing director shall be subject to prior approval of the Board.

(7) The managing director shall be liable for removal or termination of services by the Governing Board, with the prior approval of the Board, for failure to give effect to the directions, guidelines and other orders issued by the Governing Board or the Board, or the rules, the articles of association or bye-laws of the information utility or on the ground of misconduct or incapacity to continue in office.

(8) The Board may suo motu remove or terminate the services of the managing director, if it deems fit, in the interest of stakeholders of the insolvency resolution process or in the public interest, after giving a reasonable opportunity of being heard.]

9B. Compliance.

¹⁶[9B. Every information utility registered as on the date of commencement of the Insolvency and Bankruptcy Board of India (Information Utilities) (Second Amendment) Regulations, 2018, shall comply with regulations 9 and 9A, within one year from the date of such commencement.]

10. Regulatory Committee.

10. (1) An information utility may constitute a Regulatory Committee from amongst the independent directors.

(2) The Regulatory Committee, if constituted, shall oversee the information utility’s compliance with the Code.

(3) The compliance officer shall report to the Regulatory Committee, wherever constituted.

11. Compliance officer.

11. (1) An information utility shall designate or appoint a compliance officer who shall be responsible for ensuring compliance with the provisions of the Code applicable to the information utility, in letter and spirit.

(2) The compliance officer shall, immediately and independently, report to the Board any non-compliance of any provision of the Code observed by him.

(3) The compliance officer shall submit a compliance certificate to the Board annually, verifying that the information utility has complied with the requirements of the Code, and has redressed customer grievances.

(4) The Governing Board shall appoint or remove a compliance officer only by means of a resolution passed at its meeting.

12. Grievance Redressal Policy.

12. (1) An information utility shall have a Grievance Redressal Policy to deal with any grievance from –

(a) any user; or

(b) any other person or class of persons as may be provided by the Governing Board in respect  of its services.

(2) The Grievance Redressal Policy shall provide for-

(a) the constitution of a Grievance Redressal Committee;

(b) the functions of the Grievance Redressal Committee;

(c) the format and manner for filing grievances;

(d) maximum time and format for acknowledging receipt of a grievance;

(e) maximum time for the disposal of the grievance by way of dismissal, resolution or the initiation of mediation;

(f) details of the mediation mechanism;

(g) provision of a report of the grievance and mediation proceedings to the parties to the grievance upon dismissal or resolution of the grievance;

(h) action to be taken in case of malicious or false complaints;

(i) maintenance of a register of grievances received and resolutions arrived at;

(j) disclosure of receipt and disposal of grievances to the public in the form and manner directed by the Board;

(k) periodic reporting of the receipt and disposal of grievances to the Governing Board; and

(l) periodic review of the Grievance Redressal Mechanism by the Governing Board.

CHAPTER IV-TECHNICAL STANDARDS AND BYE-LAWS

13. Technical Standards.

13. (1) The Board may lay down Technical Standards, through guidelines, for the performance of core services and other services under these Regulations.

(2) Without prejudice to the generality of sub-regulation (1), the Board may lay down Technical Standards for all or any of the following matters, namely :-

(a) the Application Programming Interface;

(b) standard terms of service;

(c) registration of users;

(d) unique identifier for each record and each user;

(e) submission of information;

(f) identification and verification of persons;

(g) authentication of information;

(h) verification of information;

(i) data integrity;

(j) consent framework for providing access to information to third parties;

(k) security of the system;

(l) security of information;

(m) risk management framework;

(n) porting of information;

(o) exchange or transfer of information between information utilities;

(p) inter-operability among information utilities;

(q) preservation of information; and

(r) purging of information.

14. Technical Committee.

14. The Board shall lay down the Technical Standards based on the recommendations of a Technical Committee constituted by it.

(1) The Technical Committee shall comprise of at least three members who have special knowledge and experience in the field of law, finance, economics, information technology or data management.

(2) The Board may invite the Chief Executive Officers or managing directors of information utilities to attend the meetings of the Technical Committee.

15. Bye-laws of information utilities.

15. (1) An information utility, for the conduct of its operations, shall have bye-laws consistent with the Code.

(2) The bye-laws shall be consistent with, and provide for all matters contained in the Technical Standards, if any.

(3) Without prejudice to the generality of sub-regulation (1), the bye-laws shall provide for-

(a) the manner and process of providing core services and other services under these Regulations;

(b) risk management;

¹⁷[(ba) minimum service quality standards, including timelines for –

(i) registration of users,

(ii) issuance of record of default, and

(iii) issuance of annual statement to registered users.

(bb) adoption of quality standards and quality standards certifications.]

(c) rights of users; and

(d) grievance redressal.

(4) The bye-laws of the information utility, as amended from time to time, shall be published on its website.

16. Amendment to bye-laws.

16. (1) The Governing Board may amend the bye-laws of the information utility by a resolution passed by votes in favour being not less than three times the number of the votes, if any, cast against the resolution, by the directors.

(2) A resolution passed in accordance with sub-regulation (1) shall be filed with the Board within seven days from the date of its passing, for its approval.

(3) The amendments to the bye-laws shall come into effect on the seventh day of the receipt of the approval under sub-regulation (2), unless otherwise directed by the Board.

(4) The information utility shall file a printed copy of the amended bye-laws with the Board within fifteen days from the date when such amendment is made effective.

(5) Notwithstanding anything to the contrary contained in this Regulation, the Board may direct an information utility to amend any provision in its bye-laws.

CHAPTER V-CORE SERVICES

17. Provision of services.

17. (1) An information utility shall provide-

(a) core services;

(b) other services under these Regulations; in accordance with the Code.

(2) An information utility may provide services incidental to the services under sub-regulation (1), with the permission of the Board.

(3) An information utility shall comply with the applicable Technical Standards, while providing services.

18. Registration of users.

18. (1) A person shall register itself with an information utility for-

(a) submitting information to; or

(b) accessing information stored with

any of the information utilities.

(2) The information utility shall verify the identity of the person under sub-regulation (1) and grant registration.

(3) Upon registration of a person under sub-regulation (2), the information utility shall intimate it of its unique identifier.

(4) A person registered once with an information utility shall not register itself with any information utility again.

(5) An information utility shall provide a registered user a functionality to enable its authorised representatives to carry on the activities in sub-regulation (1) on its behalf.

(6) An information utility shall-

(a) maintain a list of the

(i) registered users;

(ii) the unique identifiers of the registered users; and

(iii) the unique identifiers assigned to the debts under Regulation 20.

(b) make the list under clause (a) available to all information utilities and the Board.

19. Use of different information utilities.

19. (1) A registered user may submit information to any information utility.

(2) Different parties to the same transaction may use different information utilities to submit, or access information in respect of the same transaction:

Illustration: A debt transaction has creditor A and debtor B. A may submit information about the debt to information utility X, while B may submit information about the same debt to information utility Y.

(3) A user may access information stored with an information utility through any information utility.

20. Acceptance and receipt of information.

20. (1) An information utility shall accept information submitted by a user in Form C of the Schedule.

¹⁸[(1A) Before filing an application to initiate corporate insolvency resolution process under section 7 or 9, as the case may be, the creditor shall file the information of default, with the information utility and the information utility shall process the information for the purpose of issuing record of default in accordance with regulation 21.]

(2) On receipt of the information submitted under sub-regulation (1) ¹⁹[or sub-regulation (1A), as the case may be], the information utility shall-

(a) assign a unique identifier to the information, including records of debt;

(b) acknowledge its receipt, and notify the user of-

(i) the unique identifier of the information;

(ii) the terms and conditions of authentication and verification of information; and

(iii) the manner in which the information may be accessed by other parties.

21. ²⁰[Authentication of default.]

²¹[21. (1) An information utility shall expeditiously undertake the process of authentication and verification of information of default as soon as it is received.

(2) For the purpose of sub-regulation (1), the information utility shall-

(a) deliver the information of default to the debtor seeking confirmation of the same within the time specified in the Technical Standards;

(b) remind the debtor at least three times for confirmation of information of default, in case the debtor does not respond, allow three days each time for the debtor to respond;

(c) deliver the information of default or the reminder, as the case may be, to the debtor either by hand, post or electronic means at the postal or e-mail address of the debtor-

(i) registered with the information utility by him, failing which,

²²[(ii) recorded with MCA 21 and the Central Registry of Securitisation Asset Reconstruction and Security Interest of India (CERSAI) registry as repositories or any other statutory repository as approved by the Board, failing which,]²³

(iii) submitted in Form C of the Schedule.

²⁴[(3) On completion of the process under sub-regulation (2), the information utility shall record the status of authentication of information of default as indicated in the following Tables:

TABLE-1

SI. No.	Response of the Debtor	Status of Authentication	Colour of the Status
(1)	(2)	(3)	(4)
1	Debtor confirms the information of default	Authenticated	Green
2	Debtor disputes the information of default	Disputed	Red
3	Debtor does not respond even after three reminders	Deemed to be Authenticated	Yellow

Provided that in case of financial creditors which are banks included in the second schedule of the Reserve Bank of India Act, 1934, the information utilities will record the status of authentication of information of default as indicated in the Table 2 below:

TABLE-2

SI. No.	Response of the Debtor	Status of Authentication	Colour of the Status
(1)	(2)	(3)	(4)
1	(a) Debtor confirms the information of default, or (b) Debtor does not respond even after three reminders	Authenticated	Green
2	Debtor disputes the information of default	Disputed	Red

(4) After recording the status of information of default under sub-regulation (3), the information utility shall communicate the status of authentication in physical or electronic form of the relevant colour, as indicated in column (4) of the Tables 1 or 2, as the case may be, by issuing a record of default in Form D of the Schedule, to the registered users who are-

(a) creditors of the debtor who has defaulted in payment of a debt;

(b) parties and sureties, if any, to the debt in respect of which the information of default has been received.]]

21A. Dissemination of public announcement.

²⁵[21A. An information utility shall disseminate every public announcement it receives or has access to, on the date of its receipt or access, as the case may be, to its registered users, who are creditors of the corporate debtor undergoing insolvency proceeding under the Code.]

22. Storage of information.

22. (1) An information utility shall store all information in a facility located in India.

(2) The facility under sub-regulation (1) shall be governed by the laws of India.

23. Access to information.

23. (1) An information utility shall allow the following persons to access information stored with it-

(a) the user which has submitted the information;

(b) all the parties to the debt and the host bank, if any, if the information is of the categories in section 3(13)(a), (c) and (d);

(c) the corporate person and its auditor, if the information is of the categories in section 3(13)(b) and (e);

(d) the insolvency professional, to the extent provided in the Code;

(e) the Adjudicating Authority;

(f) the Board;

(g) any person authorised to access the information under any other law; and

(h) any other person who the persons referred to in (a), (b) or (c) have consented to share the information with.

(2) An information utility shall in all cases enable the user to view-

(a) the date the information was last updated;

(b) the status of authentication; and

(c) the status of verification while providing access to the information.

(3) An information utility shall provide information to the Adjudicating Authority and Board free of charge.

24. Accessing information stored with other information utilities.

24. (1) An information utility shall provide a functionality to enable users to access information stored with any information utility, which they are entitled to access.

(2) The functionality under sub-regulation (1) shall enable other information utilities to provide access to information to the user directly.

(3) The functionality shall ensure privacy and confidentiality of information.

25. Annual statement.

25. (1) An information utility shall provide every user an annual statement of all information pertaining to the user, free of charge.

(2) An information utility shall provide the user a functionality to mark information as erroneous and correct it.

26. Porting information from registries.

26. (1) An information utility may import information from such registries as may be notified by the Board from time to time.

(2) An information utility shall render the core services under section 3 (9) (b), (c) and (d) in accordance with these Regulations for the information imported under sub-regulation (1).

27. Duties of the user.

²⁶[27. (1) A user, who has submitted information in Form C of the Schedule to an information utility, shall submit the information updated as on the last day of every month, in the first week of following month:

Provided that information of default shall be updated within seven days of occurrence of default.]

(2) A user shall expeditiously correct information as soon as it finds it erroneous, stating the reasons, if any.

CHAPTER VI-DUTIES OF INFORMATION UTILITIES

28. General duties.

28. (1) An information utility shall provide services with due and reasonable care, skill and diligence.

(2) An information utility shall hold the information as a custodian.

29. Non-discrimination.

29. An information utility shall provide services without discrimination in any manner.

Explanation: An information utility shall not deny its services to any person on the basis of-

(a) place of residence or business; or

(b) type of personality, whether natural or artificial.

30. Other duties.

30. (1) An information utility shall-

(a) provide services to a user based on its explicit consent;

(b) guarantee protection of the rights of users;

(c) establish adequate procedures and facilities to ensure that its records are protected against loss or destruction;

(d) adopt secure systems for information flows;

(e) protect its data processing systems against unauthorised access, alteration, destruction, disclosure or dissemination of information; and

(f) transfer all the information submitted by a user, and stored with it to another information utility on the request of the user.

(2) An information utility shall not-

(a) outsource the provision of core services to a third-party service provider;

(b) use the information stored with it for any purpose other than providing services under these Regulations, without the prior approval of the Board;

(c) seek data or details of users except as required for the provision of the services under these Regulations.

31. Insurance.

31. An information utility shall make adequate arrangements, including insurance, for indemnifying the users for losses that may be caused to them by any wrongful act, negligence or default of the information utility, its employees or any other person whose services are used for the provision of services under these Regulations.

32. Fee.

32. (1) The information utility shall-

(a) charge uniform fee for providing the same service to different users;

(b) disclose the fee structure for provision of services on its website; and

(c) disclose any proposed increase in the fees for the provision of services on its website at least three months before the increase in fees is effected.

(2) The fee charged for –

(a) providing services shall be a reasonable reflection of the service provided; and

(b) providing access to information shall not exceed the fee charged for submission of information to the information utility.

33. Risk management.

33. An information utility shall establish an appropriate risk management framework in accordance with the Technical Standards, if any, which provides for matters, including-

(a) reliable, recoverable and secure systems;

(b) provision of core services during disasters and emergencies; and

(c) business continuity plans which shall include disaster recovery sites.

34. Audit of information technology framework.

34. (1) An information utility shall appoint an external auditor having relevant qualifications to audit its information technology framework, interface and data processing systems every year.

(2) The auditor appointed under sub-regulation (1) shall submit are port to the Governing Board.

(3) The information utility shall submit the report received under sub-regulation (2), along with the comments of the Governing Board, if any, to the Board within one month from the receipt of the report from the external auditor.

35. Preservation Policy.

35. (1) An information utility shall have a Preservation Policy providing for the form, manner and duration of preservation of–

(a) information stored with it; and

(b) details of the transactions of the information utility with each user in respect of the information stored with it.

(2) The Preservation Policy shall be consistent with the Technical Standards, if any.

36. Provision of information to the Board.

36. (1) An information utility shall provide such information as may be required by the Board.

(2) Without prejudice to the provisions of sub-regulation (1), an information utility shall provide a report to the Board annually, in the manner directed by the Board, stating the-

(a) number and types of records collected;

(b) number and types of users registered;

(c) number and types of unique debts recorded;

(d) number and types of security interests recorded;

(e) volume of debts recorded;

(f) volume of secured debts recorded;

(g) number of instances and types of defaults recorded;

(h) number and types of disputes recorded;

(i) number of times information was accessed by the Adjudicating Authority and Board; and

(j) any other information as may be directed by the Board.

36A. Publication of statistical information.

²⁷[36A. (1) An information utility shall publish statistics relating to debt related information in its possession, quarterly.

(2) The statistics in sub-regulation (1) shall provide distribution of debts in terms of currency, geography, sector, size, tenor, type, lending arrangement, and incidence of default.]

37. Inspection.

37. (1) Without prejudice to the provisions of sections 217–220, the Board shall inspect an information utility with such periodicity as may be considered necessary.

(2) An information utility shall extend all assistance and co-operation to the Board to carry out an inspection under sub-regulation (1).

CHAPTER VII-SERVICES TO INSOLVENCY PROFESSIONALS

38. Storing information submitted by insolvency professionals.

38. (1) An insolvency professional may submit reports, registers and minutes in respect of any insolvency resolution, liquidation or bankruptcy proceedings to an information utility for storage.

(2) The information utility shall not provide access to the reports, registers and minutes submitted under sub-regulation (1) to any person other than the concerned insolvency professional, the Board or the Adjudicating Authority.

(3) The information utility shall discharge the duties specified in Chapter VI in respect of the reports, registers and minutes submitted under sub-regulation (1).

CHAPTER VIII-SURRENDER OR CANCELLATION OF REGISTRATION

39. Exit management plan.

39. (1) An information utility shall, at all times, have an exit management plan which shall include-

(a) mechanisms to enable users to transfer information to other information utilities expeditiously;

(b) mechanisms for preservation and transfer of information; and

(c) timelines and cost estimates of implementing the exit management plan.

(2) An information utility shall not amend its exit management plan without the prior approval of the Board.

40. Surrender of registration.

40. (1) An information utility may submit an application for surrender of its certificate of registration to the Board, providing –

(a) the reasons for such surrender;

(b) details of its pending and on-going activities; and

(c) details of how the exit management plan shall be implemented.

(2) The Board shall within seven days of receipt of the application, publish a notice of receipt of such application on its website and invite objections to the surrender of registration to be submitted within fourteen days of the publication of the notice.

(3) After considering the application and the objections received, if any, the Board may, within thirty days from the last date for submission of objections, approve the application for surrender of registration subject to such conditions as it deems fit.

(4) The approval under sub-regulation (3) may require the information utility to-

(a) discharge any pending obligations; or

(b) continue such functions till such time as may be directed.

(5) The Board, after being satisfied that the requirements of sub-regulation (4) have been complied with, shall publish a notice on its website stating that the surrender of registration by the information utility has taken effect.

41. Disciplinary proceedings.

41. (1) Based on the findings of an inspection or investigation, or on material otherwise available on record, if the Board is of the prima facie opinion that sufficient cause exists to take actions permissible under section 220, it shall issue a show-cause notice to the information utility.

(2) The show-cause notice shall be in writing and shall state-

(a) the provisions of the Code under which it has been issued;

(b) the details of the alleged facts;

(c) the details of the evidence in support of the alleged facts;

(d) the provisions of the Code allegedly violated, or the manner in which the public interest has allegedly been affected;

(e) the actions or directions that the Board proposes to take or issue if the allegations are established;

(f) the manner in which the information utility is required to respond to the show-cause notice;

(g) consequences of failure to respond to the show-cause notice within the given time; and

(h) procedure to be followed for disposal of the show-cause notice.

(3) The show-cause notice shall enclose copies of relevant documents and extracts of relevant portions from the report of investigation or inspection, or other records.

(4) A show-cause notice issued shall be served on the information utility in the following manner-

(a) by sending it to the information utility at its registered office, by registered post with acknowledgement due; and

(b) by an appropriate electronic means to the email address provided by the information utility to the Board.

(5) The Disciplinary Committee shall dispose of the show-cause notice by a reasoned order in adherence to principles of natural justice.

(6) The Disciplinary Committee shall endeavor to dispose of the show-cause notice within a period of six months of the issue of the show-cause notice.

(7) The order in disposal of a show-cause notice may provide for-

(a) no action;

(b) warning;

(c) any of the actions under section 220(2) to (4); or

(d) a reference to the Board to take any action under section 220(5).

²⁸[(8) The disciplinary proceedings shall be conducted in accordance with the provisions of the Insolvency and Bankruptcy Board of India (Inspection and Investigation) Regulations, 2017.]

(9) The order passed under sub-regulation (7) shall be issued to the information utility immediately, and be published on the website of the Board.

(10) If the order passed under sub-regulation (7) suspends or cancels the registration of the information utility, the Disciplinary Committee may require the information utility to-

(a) discharge pending obligations;

(b) continue its functions till such time as may be directed, only to enable users to transfer information stored with it to another information utility; and

(c) comply with any other directions.

42. Appeal.

42. An appeal may be preferred under section 211, within a period of thirty days of receipt of the order, in the manner prescribed in Part III of the ²⁹[National Company Law Appellate Tribunal Rules, 2016].

 

---

Act wise amended Rules and Regulations are available here: Click here for Rules & Regulation Dashboard.
For Notifications and Circulars, click here.
For bare acts, click here.