Electronic Credit Information Bureau (eCIB)
State Bank of Pakistan
Last reviewed October 2026
Send a correctionWhat it does
eCIB is the State Bank of Pakistan's credit bureau. Banks and other lenders report their borrowers and how they repay, and check the bureau before giving a loan.
Why it matters
What the bureau says about a borrower affects whether they can get a loan, and borrowers do not choose to be in it.
Legal basis: Banking Companies Ordinance, 1962, section 25A.
On the register because: it holds records on at least a million people or covers the whole country; enrolment is mandatory or cannot practically be avoided; it holds identity, biometric, health, financial, location or communications data; its records are used to decide something about an individual.
How it scores
43.7 out of 100
23.5 to 60.4 if the weights change
The nineteen questions
This record shows what the agency has published. Not found means nothing was found in the places searched on the date checked. It does not mean the safeguard does not exist.
System disclosure
TransparencyDoes the agency say what this system is for and what it is used to decide?
DisclosedShow evidence
In the agency's words:
The major purpose of this database is to enable the Financial Institutions(FIs) to know the credit history of their prospective customers thus enabling them to make informed and timely lending decisions.
Checked 9 October 2026. Saved copy.
Does the agency cite the law, rule or notification this system runs under?
DisclosedShow evidence
In the agency's words:
Established in 1992 under Section 25(A) of the Banking Companies Ordinance, 1962
Checked 9 October 2026. Saved copy.
Does the agency list the kinds of personal data this system holds?
Partly disclosedThe kind of information is described (credit exposure, overdues, write-offs). No list of the personal data fields held.
Show evidence
In the agency's words:
It provides factual position of the borrowers' credit exposure both negative as well as positive as of certain date.
Checked 9 October 2026. Saved copy.
Is there a named office or officer responsible for the data in this system, with contact details?
Partly disclosedA help desk and the Consumer Protection Department. No named officer for the bureau's data.
Show evidence
In the agency's words:
Help Desk: Consumer Protection Helpdesk; SUNWAI Customer Complaint Service; Focal Persons
Checked 9 October 2026. Saved copy.
Flows and sharing
TransparencyDoes the agency say which other public bodies receive or can query this data?
DisclosedThe page on consumer protection adds 'nearly 100 member institutions'. A class fixed by law whose members SBP lists as licensed institutions counts as named (reading rule R-3).
Show evidence
In the agency's words:
All Banks, Development Financial Institutions (DFIs), Non-Bank Financial Companies (NBFCs), and Micro Finance Banks operating in Pakistan are members of the eCIB database. ... No financial institution can access the eCIB database without obtaining membership
Checked 9 October 2026. Saved copy.
Does the agency name the companies or outside bodies that build or run this system?
Not foundWhere we looked
sbp.org.pk consumer protection page; eCIB FAQs; privacy statement. Checked 9 October 2026.
Does the agency say where the data is stored and whether any of it leaves Pakistan?
Not foundWhere we looked
sbp.org.pk consumer protection page (says 'eCIB servers', no location); eCIB FAQs; privacy statement. Checked 9 October 2026.
Accountability records
TransparencyHas the agency named an official who answers information requests, and said how to file one?
Not foundWhere we looked
sbp.org.pk privacy statement page and site menus (no Right of Access to Information link found); help desk page. Checked 9 October 2026.
Are audit, evaluation or performance reports that cover this system published?
Not foundWhere we looked
sbp.org.pk consumer protection page; eCIB FAQs. SBP's annual reports and Financial Stability Reviews were not opened. Checked 9 October 2026.
Has a privacy or data protection impact assessment of this system been published?
Not foundWhere we looked
sbp.org.pk consumer protection page; eCIB FAQs; privacy statement. Checked 9 October 2026.
Rules on use
SafeguardsIs there a privacy notice or data policy that covers this system?
Partly disclosedThe FAQ explains how borrower data is collected and used. SBP's Privacy Statement covers the website only. There is no privacy notice for borrowers. An FAQ is help text, not a policy or notice, so this is coded partly disclosed under reading rule R-2.
Show evidence
In the agency's words:
The eCIB is legally empowered to collect credit information from its member financial institutions. The financial institutions are required to report entire credit records irrespective of any limit to eCIB.
Checked 9 October 2026. Saved copy.
Does the agency say how long records in this system are kept?
DisclosedStated for individual borrowers. Nothing equivalent for corporate records.
Show evidence
In the agency's words:
In case of consumer borrower (individual), the CIB maintains the history of financial records of past twelve months.
Checked 9 October 2026. Saved copy.
Does the agency state limits on using this data for anything beyond its stated purpose?
DisclosedThe FAQ also says the report is for members' 'internal use'.
Show evidence
In the agency's words:
made available online on request to contributing member financial institutions for the purpose of credit assessment, credit scoring and credit risk management
Checked 9 October 2026. Saved copy.
Individual rights
SafeguardsDoes the agency explain how a person can see their own record?
Not foundSBP states the opposite: 'The CIR is a confidential document and cannot be provided to borrowers.' A borrower is pointed to private credit bureaus instead.
Where we looked
eCIB FAQs; consumer protection page. Checked 9 October 2026.
Does the agency explain how a person can get an error in their record corrected?
DisclosedShow evidence
In the agency's words:
Any correction in eCIB data can only be made through the reporting financial institution. ... Please approach your concerned FI and if the dispute/complaint is not resolved then you can approach eCIB through helpdesk
Checked 9 October 2026. Saved copy.
Is there a complaint route for misuse of this data, with a stated response time?
DisclosedThe route: the financial institution, then the Banking Mohtasib or SBP's help desk. Time limits are for banking complaints generally.
Show evidence
In the agency's words:
In any case the complaint must be disposed of within 15 days. However, in fraud-related cases, the final reply to the complainant must be issued within 30 days of lodging the complaint.
Checked 9 October 2026. Saved copy.
Can a person find out who has accessed their record?
Not foundWhere we looked
eCIB FAQs; consumer protection page; privacy statement. Checked 9 October 2026.
Security and oversight
SafeguardsHas the agency committed to telling people about data breaches, or published a record of past ones?
Not foundWhere we looked
sbp.org.pk privacy statement; eCIB FAQs; consumer protection page. Checked 9 October 2026.
Does the agency say who independently audits the security or data handling of this system, and how often?
Partly disclosedMeasures asserted. No auditor, standard or date.
Show evidence
In the agency's words:
The eCIB features include separate consumer and corporate reporting, credit history tracking, data correction, encryption, and validation to ensure data integrity.
Checked 9 October 2026. Saved copy.
Agency reply
Not yet sent to the agency.
Sources
Official pages and documents cited on this record.