Credit Reference Bureau Licence: The BoT Capital and Data File

This page is the credit bureau licensing file: who may hold the licence, what the Bank prescribes as capital, and what the Regulations demand of the data system.

• Which activities need the Bank’s approval — BoT licensing classes
• The licence most of a bureau’s users hold — the microfinance licence
• What a holder of personal data owes — data protection registration
• Which role a bureau’s vendors occupy — controller versus processor
• The identity work behind each record — due diligence and the bank registry

As at 21 September 2026. Confirm the live position on bot.go.tz and pdpc.go.tz; this file rests on the Credit Reference Bureau and Credit Reference Databank Regulations of 2012, the Banking and Financial Institutions Act, 2006 and the Personal Data Protection Act, Cap. 44.

Who may hold the licence, and the capital that gates it

Regulation 6 settles it in a line: any incorporated limited liability company is eligible to apply. That excludes a sole trader, a partnership, a trust and a foreign branch trading on a parent’s registration. However good the software, a natural person does not hold this licence.

Capital removes most enquiries. Regulation 13 leaves the figure to the Bank, whose published procedure sets it: a bureau commences operations with, and maintains at all times, paid-up capital of not less than TZS 600,000,000, or such higher amount as the Bank may prescribe. Paid-up, not authorised. Governance is the third bar — regulation 15 requires not less than five board members, a majority non-executive under a non-executive chair, and regulation 16(1) bars any board or senior appointment without prior approval.

Nothing reserves this class for citizens and nothing caps foreign shareholding. Scrutiny of the register replaces a nationality rule: regulation 14 subjects any change in significant shareholding to prior approval, a significant shareholder holding five percent or more of the voting shares, and regulation 12 makes the licence non-transferable — a bureau is not acquired by acquiring its licence.

Two instruments of 2012, and the secrecy section beneath them

Two Government Notices of 28 December 2012 carry the regime, both made under section 70(1) of the Bank of Tanzania Act, Cap. 197. GN No. 416 licenses the bureau; GN No. 417, the Credit Reference Databank Regulations, builds the Bank’s own database.

Beneath them sits the Banking and Financial Institutions Act, 2006. Secrecy is a bank’s default posture towards its customer’s affairs; section 48(3) carves out the exceptions permitting a bank to release information to a licensed bureau, and a bureau to furnish a report on a legitimate business request with a copy to the customer, in accordance with the Bank’s regulations. Section 3 defines the bureau; section 24(1)(l) makes credit reference services permissible for a bank. The data supply is a statutory exception, not a commercial achievement.

The Bank’s Databank is the feed, and it closes on the tenth

A bureau does not assemble its file by signing lenders one at a time. The Bank establishes and administers the Credit Reference Databank, and every reporting institution submits credit information in the prescribed format, on all existing and new credit facilities, monthly — the deadline for a reference month being the tenth of the month following.

Access runs the other way and is not negotiated: bureaux, authorised Bank staff and reporting institutions take it in a non-discriminatory and timely manner. No licensee is starved of the core feed, and none obtains one a rival cannot have, so differentiation is built above it — scoring, alternative data, fraud products.

The pre-filing meeting, the fee and the pack

The Bank’s published procedure requires an applicant to apply for a pre-filing meeting before submitting an application. It is the cheapest stage and the most often skipped, where a capital structure, a board and a systems design are read before money is spent drafting around them. The fee is TZS 1,000,000, non-refundable, by banker’s cheque payable to the Bank of Tanzania, cash deposit or transfer. What follows is a supervisory file, not an investment memorandum:

• Certified certificate of incorporation, memorandum and articles.
• Documents supporting the value of the capital base and the sources of funds.
• A feasibility study carrying internal monitoring procedures, governance structure, three years of projected financial statements and a business continuity plan.
• Declarations from significant shareholders and directors as to any conviction, any civil case connected with credit reporting, and any licence ever refused — other than a driving licence.
• An operations overview: systems design, data collection and dissemination, the software schedule, security against improper access, and the fee structure.

Ninety days, and the reasons that come back

Regulation 7(3) is exact: the Bank shall, within ninety days after the day of receipt of an application, grant or refuse to grant the licence and communicate the reasons for its refusal. The clock runs from receipt, so material delivered in instalments never starts it, and a reasoned refusal is a re-application, not an appeal.

A granted licence does not expire on a calendar. Regulation 8 keeps it valid unless revoked, so there is no renewal to diarise. Supervision takes that place: written notice and reasons before revocation, periodic reports in the format the Bank prescribes, and the bureau’s own fee structure carried into those returns. Regulation 40 attaches a fine of not less than TZS 500,000 for every day non-compliance continues.

Consent, permissible purpose and the enquiry log

Regulation 24(1) sets the access rule most system designs get wrong: an authorised user may only access a bureau database with the written consent of the borrower on whom the search inquiry is to be conducted. Consent attaches to the search, not the relationship, and must be producible rather than inferred from an account-opening form.

The purposes are closed — verifying accuracy or resolving disputes; credit investigation, affordability assessment and scoring on new applications and renewals; executing credit agreements; fraud detection and prevention. Regulation 23(5) forbids selling, transferring or otherwise using the information outside that list. A marketing list distilled from bureau data is not a grey area.

Regulation 19 requires a record of every search inquiry, carrying its date and the authorised user’s name and location. Regulation 21 requires protection against loss — continuity plans, back-up, disaster recovery — and against unauthorised access or disclosure. Regulation 36 holds credit information six years from final repayment, bankruptcy, assignment or write-off. Two clocks run on a challenge: two working days to note a report as disputed, fifteen to investigate and correct. Regulation 28(1) adds one free copy of one’s own report a year.

Where the data may go: the Bank first, then the Commission

Regulation 4(2) is one sentence and it decides the architecture: credit information maintained by the bureau shall not be transferred outside the United Republic except in such cases as the Bank may determine. A group data centre, a parent’s analytics platform, an offshore recovery site — each is a transfer needing that determination before provisioning.

A second gate applies independently, because a bureau is also a data controller under the Personal Data Protection Act, Cap. 44. Regulation 4(1) of the Personal Data Protection (Personal Data Collection and Processing) Regulations, GN No. 449C of 2023, made under section 64 of that Act, bars anyone from collecting or processing personal data without being registered with the Commission. Registration lasts five years, and a permit is required before personal data leaves the country.

The gates are cumulative: neither determination nor permit satisfies the other regulator. Which role each vendor occupies is a distinct question — controller versus processor in Tanzania.

What each instrument demands of the file

The sequence a bureau file runs

1. Settle the shareholding before incorporation. Every holder of five percent or more is declared, and later changes need approval.
2. Fund the capital and evidence it. TZS 600,000,000 paid up, with a source-of-funds trail that survives a question about each tranche.
3. Request the pre-filing meeting and treat the Bank’s comments as the specification for what follows.
4. Specify the system to the Regulations, not a vendor demo. Per-search consent, the enquiry log, two dispute clocks, six-year retention, back-up onshore.
5. Lodge with the fee — TZS 1,000,000, proof attached — complete on the day of receipt, so the ninety days begins.
6. Register with the Commission before processing starts, with a transfer permit if any part of the stack sits abroad.

What the licence file costs to assemble

The application fee is TZS 1,000,000, not returned whatever the outcome. Registration with the Commission runs on the Second Schedule to GN No. 449C of 2023: TZS 100,000 at small scale, TZS 200,000 at medium, TZS 1,000,000 at large, renewing at TZS 50,000, TZS 150,000 and TZS 500,000 on a five-year certificate.

Zatra’s work on this class is charged at TZS 300,000 per hour against a scoped estimate of 20 to 40 hours — TZS 6,000,000 at the lower end, TZS 12,000,000 at the upper. The spread separates a file where capital is already paid up from one where the shareholding must be restructured and the data-governance framework built from nothing.

Totals: TZS 7,100,000 at the lower end and TZS 13,100,000 at the upper, against the TZS 600,000,000 that must sit paid up — a little over one percent of the capital, rising to a little over two. Applications are lost not on that spend but because capital was authorised rather than paid, or because the data-governance answer ran to a paragraph where a system was expected.

Where a bureau application stalls

• Authorised capital presented as paid-up, a funding commitment standing in for bank statements.
• Offshore hosting chosen at architecture stage, needing the Bank’s determination and a Commission permit.
• Consent treated as a single sign-up rather than written consent per search inquiry.
• One dispute service level, where the Regulations run two clocks at different speeds.

Mandate-holders this file does not replace

The Bank of Tanzania licenses and supervises credit reference bureaux and administers the Credit Reference Databank; the licence, the capital prescription, the approvals on directors and shareholders and any determination letting data leave the country are its own. The Personal Data Protection Commission registers the controller and issues the outbound permit; BRELA owns incorporation and beneficial ownership. Reporting institutions own the accuracy of what they submit, yet a bureau republishing a lender’s error still answers the data subject for it. An investor also seeking an investment certificate deals with TISEZA. Zatra prepares and coordinates the pack, grants no licence and does not practise law or audit.