When Credit Scores Gatekeep, India Must Regulate Bureaus As Utilities

For much of India’s post-liberalisation history, credit bureaus were treated as background plumbing—technical repositories that reduced information asymmetry between borrowers and lenders. They were meant to lubricate credit markets, not govern them. That description no longer holds.

Today, institutions such as CIBIL, Experian, Equifax and CRIF sit at the heart of economic access. A three-digit score generated by proprietary algorithms increasingly determines whether an individual can buy a home, finance education, start a business, or even rent a house. Yet this power is exercised without a public mandate, without meaningful transparency, and with limited accountability. This is no longer a narrow consumer-protection issue; it is a question of financial governance.

Credit bureaus were conceived as information utilities: neutral aggregators enabling lenders to distinguish risk. In India, that role has quietly expanded. Credit scores now feed directly into automated underwriting systems, fintech lending engines and platform-based credit decisions, often with minimal human discretion.

In effect, credit bureaus have become gatekeepers of economic citizenship. They no longer merely inform lending decisions; they shape them. Yet unlike banks, exchanges or even credit rating agencies, they operate largely outside public scrutiny, shielded by proprietary algorithms and the defence of technical complexity. This institutional drift has occurred without serious policy debate, a silence regulators should find troubling.

Credit bureaus are often compared to credit rating agencies, and the analogy is instructive. Rating agencies suffer from the familiar “issuer-pays” conflict. Credit bureaus face a subtler but equally consequential tension: borrowers bear the consequences of credit scores, but they are not the customers.

Revenue flows primarily from lenders and from analytics and monitoring products sold across the financial ecosystem. Incentives therefore align with lender preferences—predictability, standardisation and risk minimisation—not with explainability, contestability or inclusion. The outcome is predictable: opaque models that cannot be meaningfully challenged; conservative scoring that penalises thin-file or informal borrowers; mechanical punishment of volatility; and weak incentives to correct errors swiftly unless regulators intervene. The problem is not intent, but institutional design.

Credit scores today function as quasi-regulatory instruments. They discipline behaviour, define norms of “financial responsibility” and impose penalties, often without context or recourse. Borrowers have limited rights to understand how scores are constructed, how sensitive they are to particular actions, or how long adverse signals persist.

Grievance mechanisms exist, but remain slow and asymmetric. In any other domain where private institutions wield comparable influence over life outcomes, public oversight would be unavoidable. In credit scoring, it has been normalised as a technical matter.

Public Backbone
This is where the shelved Public Credit Registry becomes central.

Recommended by an RBI-appointed committee after repeated banking stress episodes, the PCR was envisioned as a centralised, regulator-governed credit data backbone. Its purpose was not to assign scores or crowd out private bureaus, but to provide a comprehensive view of credit exposures across the economy—retail, MSME and corporate.

Crucially, the PCR would have separated data custody from analytics. Raw credit data would reside in a neutral public registry, while private players competed on scoring models and value-added insights. By shelving the PCR, India implicitly chose a different equilibrium, one in which private credit bureaus became both custodians and interpreters of credit data, accumulating power through network effects and proprietary dominance.

Privacy and implementation challenges were cited, yet these did not prevent large-scale private aggregation of the same data—only its public stewardship. The result is an institutional imbalance: regulators lack a unified, real-time view of credit build-ups, while borrowers remain dependent on fragmented, opaque private systems. Abandoning the PCR did not eliminate risk; it privatised and obscured it.

Recent regulatory steps such as tighter reporting timelines, penalties for inaccuracies and grievance-redress norms are necessary but insufficient. They address operational deficiencies, not structural power.

The deeper issue is that credit bureaus today combine three roles: custodians of raw credit data, curators of individual credit histories, and vendors of proprietary scores and analytics. This vertical integration concentrates influence and embeds conflicts that disclosure norms alone cannot neutralise.

The first reform must be conceptual. Credit bureaus should be explicitly recognised as systemically important financial infrastructure, akin to payment systems or market utilities. This would justify higher governance standards, periodic public-interest and model-risk assessments, fit-and-proper norms for senior management and deeper supervisory engagement by the RBI.

This is not nationalisation. It is recognition that institutions shaping credit allocation at scale cannot be governed as ordinary data vendors.

If credit scores determine access to finance, borrowers must have a legal right to meaningful explanations—clear articulation of key drivers and directional impacts. This need not compromise proprietary models. Without such rights, credit scores remain effectively unchallengeable.

The urgency of reform is magnified by AI-driven and alternative-data underwriting. As machine-learning models ingest bureau scores, transaction data and behavioural signals, opacity compounds. An opaque score feeding an opaque model creates a black box squared—powerful, scalable and largely ungoverned.

Without a public credit data backbone, strong explainability norms and institutional accountability, India risks hard-coding exclusion into its digital credit architecture. Fintech innovation cannot substitute for governance; it only raises the stakes.

Unchecked private power rarely announces itself dramatically. It accumulates quietly through data concentration, network effects and institutional inertia. Credit bureaus are approaching that threshold. They are too important to remain lightly governed, too influential to remain opaque, and too central to inclusion to remain accountable only to lenders.

Regulating them like public utilities is not anti-market. It is an acknowledgment that markets function best when power is visible, contestable and accountable.