Review of Australia’s Credit Reporting Framework

NATIONAL AUSTRALIA BANK
SUBMISSION
Review of Australia’s Credit Reporting Framework

7 June 2024

National Australia Bank Limited ABN 12 004 044 937 AFSL and Australian Credit Licence 230686
Introduction

National Australia Bank (NAB) welcomes the opportunity to provide a submission to the Review of
Australia’s Credit Reporting Framework.

Credit reporting plays an important role for credit providers when assessing consumer credit and managing consumer credit accounts, as it provides visibility of a customer’s activity on accounts held with other credit providers.

NAB’s submission focuses on parts of the consultation paper most relevant to NAB, namely the ways that the credit reporting regulatory framework can be improved and simplified to achieve better consumer understanding of the credit reporting industry and more informed, fair, and efficient credit application decisioning and other customer benefits. As a member of the Australian Banking
Association (ABA) NAB has also contributed to their submission.

Background

Credit providers (CPs) in Australia historically were only permitted to share ‘negative’ information about their customers with credit reporting bodies (for example, when customers defaulted on their credit obligations). Comprehensive credit reporting (CCR) was legislated through changes to the
Privacy Act in March 2014, and enables credit providers to share ‘positive’ information about their customers. This includes details of credit accounts held with credit providers, credit limits, as well as payments made, and payments missed on those accounts.

NAB was the first major bank to commence CCR under the voluntary regime. NAB commenced reporting unsecured accounts in February 2018 and commenced reporting secured accounts in
February 2019.

Executive Summary

To ensure credit data best represents a customer's position, NAB believes that mandatory credit reporting should be extended to more credit providers, and that all consumer loans, including 'Buy
Now Pay Later' (BNPL) loans, should be included in financial hardship reporting. NAB also considers there is an opportunity to improve the way data is shared between CPs and credit reporting bodies
(CRBs) to ensure completeness and consistency of information held by each CRB. Greater consistency in data held across CRBs would not only ensure CPs can easily access a complete picture of a customer’s financial position, but also ensure a customer’s credit application is not delayed in the event a CRB experiences a problem or outage.

NAB supports consumers having access to clear guidance on the credit reporting framework and supports simplifying the Privacy (Credit Reporting) Code 2014 (CR Code) to achieve this. NAB also supports ongoing consumer education initiatives and notes the importance of clear and standard definitions to ensure consumers can more easily understand credit reports.

In addition to the simplification of the CR Code, NAB also sees opportunity for greater alignment of legislation governing the credit reporting framework, in particular the standardisation of definitions, concepts and obligations including in relation to hardship.
Part Three: Australia’s credit reporting framework

What are the main harms that the regulatory framework should seek to address today?

NAB strongly supports the credit reporting regulatory framework and the consumer protections included in the National Consumer Credit Protection Act (NCCP Act), the underlying National Credit
Code (NCC), Part IIIA of the Privacy Act (Part IIIA) and the underlying Privacy (Credit Reporting) Code
(CR Code).

NAB considers that this framework could be improved by taking steps to align obligations, definitions, and concepts across the NCCP Act and Part IIIA (and the respective underlying Codes), particularly in relation to hardship. This will help to simplify credit reporting and allow consumers to better understand it.

The introduction of mandatory credit reporting for ‘Large ADIs’1 has increased the volume of credit information available for credit application decisioning and early intervention geared towards reducing the incidence of credit default. Because mandatory credit reporting is limited to Australia’s
‘Large ADIs’ and participation in the Principles of Reciprocity & Data Exchange (PRDE) remains voluntary, consumer credit reports are often not a reflection of the individual’s complete financial position. NAB supports appropriately expanding the mandatory credit reporting regime to most credit providers (if not all of them) including providers of BNPL and vehicle loans.

Given the importance of the data currency, NAB supports the 45-day reporting requirement but notes that differing data validations / requirements at each CRB means that credit reporting can be complex and time-consuming. If CPs could instead report to a single secure third-party portal accessible to all CRBs, this would improve reporting efficiency.

NAB is aware that CPs may calculate and report some categories of credit information (such as repayment history information (RHI) using different methodologies. Consideration could be given to requiring CPs (under the mandatory credit reporting regime and/or the PRDE, as applicable) to report raw data to the CRBs (e.g. days past due) and for all CRBs to use a uniform and consistent approach to calculating RHI and other suitable categories of credit information.

NAB also supports an amendment to the definition of ‘Financial Hardship Arrangement’ under Part
IIIA to include consumer credit accounts, that are not subject to the NCC, but for which a hardship arrangement is agreed. This will ensure that the protections offered through the reporting of financial hardship information (FHI) – and reporting RHI against the agreed arrangement (rather than the credit contract) in the relevant period – will not be limited to credit products governed by the NCC.

How could the legislative framework for credit reporting be improved or simplified?

NAB strongly supports protecting a customer’s credit score in instances of financial hardship to ensure that the customer’s ability to access credit in the future is not unfairly impacted by an event outside of their control (such as a natural disaster, illness or family breakdown).

1
‘Large ADIs’ are defined in National Consumer Credit Protection (Large ADI) Determination 2023 as having a total asset size over $124 billion.
However, hardship reporting is complex, and can be difficult to explain to customers. The government should consider all avenues available to simplify hardship reporting requirements including by aligning obligations, definitions and concepts relating to hardship between the NCCP
Act and Part IIIA of the Privacy Act (and the respective underlying Codes).

Furthermore, as the law currently stands, some industry participants consider that a credit provider that has validly and appropriately declined to change a credit contract in response to a hardship notice under the NCCP Act may, in certain circumstances (say, where an alternative solution has been reached) be required to report that a financial hardship arrangement is in place (given the very broad definition of financial hardship arrangement under Part IIIA). Aligning credit provider and hardship-related definitions, concepts, and obligations across the NCCP Act and Part IIIA of the
Privacy Act (and the respective underlying Codes) and with Part 9 of the Banking Code of Practice will help to remove this potential ambiguity.

Should credit reporting legislation be more aligned with financial services regulation, including the regulation of consumer credit, and the Consumer Data Right?

NAB agrees that there should be alignment between Part IIIA of the Privacy Act and the CR Code with the NCCP Act and NCC. This would help to simplify credit reporting and will reduce the current ambiguity regarding how an arrangement that is not a financial hardship arrangement for NCC purposes should be reported.

NAB does not believe that the Consumer Data Right (CDR) needs to be directly aligned with credit reporting regulation. From a credit decisioning point of view, it is a separate source of information that may be relevant within the broader credit decisioning eco-system. With the appropriate consent, it can provide access to relevant data categories not contained in a credit report – e.g.
account balances. The CDR is an enabling function that can work alongside the credit reporting legislation without needing to be aligned.

Is the purpose and scope of CR Code appropriate? What provisions in the Privacy Act should be referred to the CR Code, and vice versa?

NAB understands that a primary purpose of the CR Code was to provide a simple, digestible summary of:

(i) when a CP can access a credit report and what it is permitted to do with the information
therein;
(ii) what is permissible credit reporting activity; and
(iii) an individual’s access and correction rights in relation to their credit information.

The complexity of the current CR Code means it can be difficult for consumers to understand, especially with respect to how financial hardship is reported.

If the CR Code is retained in its current form, additional guidance for consumers should be developed. NAB acknowledges that ARCA is working collaboratively with CPs in this space and will continue to do so.
NAB believes that the CR Code should not expand the rights and obligations created by Part IIIA; rather it should clarify or explain these rights and obligations in an accessible way.

Do the regulators have sufficient powers, resources, and expertise to regulate credit reporting effectively?

NAB considers that regulators have sufficient powers against the industry participants and credit products that are currently regulated.

Part Four: Impact of the credit reporting framework

What evidence is available to demonstrate whether comprehensive credit reporting has met its policy objectives, such as: o improved lending decisions, including loan performance and suitability, risk-based pricing
and access to credit.
o improved financial inclusion and access to finance in Australia.
o improved competition and efficiency in the lending market; and o reduced the cost of consumer credit?

CCR data is very useful in credit application assessment and in relation to the ongoing assessment of a customer’s financial position. The availability of CCR data helps to improve both the quality and the speed of lending decisions and allows CPs to better support customers with respect to their existing loans. Since the introduction of mandatory credit reporting, NAB has seen a 52% reduction in median time to unconditional approval for applications via the Simple Home Loan platform used by NAB staff to originate home loans between FY21 and FY23.2

CCR data assists CPs to identify existing credit facilities that may otherwise be missing from an application. It also enables CPs to verify payment history on a customer’s existing loans thereby reducing the need for customers to submit evidence of this (where hardship indicators are not present). CCR data provides a better picture of an applicant’s credit position and can lead to the appropriate approval of some applications that would otherwise have been declined relying solely on negative credit information. The expansion of mandatory credit reporting to more CPs would further support customers to access credit.

NAB believes in principle that the CCR has met its policy objective of improving the quality of responsible credit application decisioning, particularly with respect to credit risk assessment and identifying undisclosed liabilities. Less manual verification is required where liabilities from credit reports can be viewed upfront in the application process, compared to where liabilities cannot be viewed upfront. This is a good example of how CCR data increases credit application efficiency.

For home loan refinance applications, NAB also leverages RHI data to automatically verify a customer’s payment behaviour on their existing home loan, without requiring the customer to produce evidence from their other credit provider.

2
NAB Full Year Results, Investor Presentation, 2023, pg. 48
For unsecured lending, CCR data is used to identify undisclosed liabilities where other CPs provide data to the CRBs. NAB notes however that there are still gaps regarding certain types of lending (e.g.
BNPL, as discussed above) and that the inclusion of these credit liabilities will further improve the quality and efficiency of credit application decisions.

While there are still gaps in CCR data provision, other methods, such as examining transaction listings, need to be used to check for any further evidence of non-disclosure of liabilities. It would be preferable to have CCR as the single source of truth for liability checks. Improved access to additional data, such as repayment amount, would help the verification process further, by ensuring that CPs know the customer’s actual repayment amount and need to make fewer assumptions.

For the ongoing management of existing credit facilities, CCR data also helps a CP to identify customers that may be experiencing financial difficulty leading to early intervention and better customer outcomes.

Better outcomes for customers in hardship

Specifically tailored credit assessment strategies for customers in hardship allows NAB to examine the suitability of lending without excluding customers from further credit.

When home loan applicants have FHI on their credit file, additional manual credit assessments may be performed to ensure appropriate and responsible lending.

For customers with hardship appearing on their credit file, but who otherwise had no historic adverse RHI or negative credit information (e.g. defaults), the majority were approved for home loans. For customers whose credit reports contained both FHI as well as historic adverse RHI or other negative credit information, a proportion of these customers were still approved after additional manual credit assessment. The performance of these loans is in line with the performance of the rest of NAB’s home loan portfolio.

Hardship on a credit file can demonstrate to lenders that the customer actively worked with another lender to 'get back on track' after a period of hardship.

How do lenders mitigate against inappropriate bias in automated and algorithmic lending decisions using credit scores or other credit reporting information?

NAB has been using advanced data analytics techniques to assess credit risk for retail customers since 1997 (e.g. Home Loan Application Model) and continues to evolve and invest in such techniques. NAB has mature risk frameworks and governance controls along with a process for reviewing all data analytic and artificial intelligence (AI) projects from an ethical viewpoint before implementation. Addressing inherent bias is one of our keys focuses when reviewing AI projects, as well as ensuring customers can challenge AI-enabled decisions. When deployed and governed ethically, NAB believes AI has the power to reduce human bias in lending.

What has been the impact of Australia's concentrated credit reporting industry on the price of credit enquiries, reliability of service, and innovation?
NAB recognises the importance of competition and considers that greater consistency of data across CRBs (e.g. by requiring credit reporting data sharing between existing CRBs) would increase competition in a more effective way than introducing additional (and likely small) CRB competitors. Additional CRBs would potentially require CPs to conduct more credit enquiries to ensure credit decisions are based on all available data. Mandatory data sharing between existing
CRBs would potentially drive innovation, increase incentives for CRBs to ensure service reliability and may potentially reduce credit report enquiry costs.

Should CRBs be required to share some or all their data sets with the other CRBs to promote competition?

NAB supports the principle of data consistency across CRBs, which both promotes competition in relation to the cost of credit enquiries and ensures a customer’s full financial position is always considered. This is because CPs would not have to obtain a credit report from all CRBs to get a complete picture of a customer’s financial position. This would benefit customers and CPs as a single CRB ‘outage’ or delay would not prevent a credit application from proceeding, as an alternative CRB could be used to obtain the same credit assessment outcome.

As the question suggests, greater data consistency could be achieved by mandatory data sharing between CRBs. Alternatively, introducing reporting via a single secure third-party portal or government body could produce the same outcome. A third option would be extending mandatory credit reporting obligations under the NCCP Act to all credit providers, thereby ensuring credit information from a greater number of CPs is provided to all three CRBs. NAB acknowledges the significant costs this last option would impose on smaller CPs, and that it may increase barriers to entry for nascent entities.

Considering the above options, NAB suggests reporting to a single secure third-party portal could best achieve data consistency across CRBs, without increasing the burden on either CPs or CRBs.

Part 5: Credit data

What other types of credit-related information should be reported, or excluded, as part of
Australia’s credit reporting framework?

The increasing complexity and prescriptive nature of the CR Code and industry data standards requires lenders to process raw data in order derive a number of required credit reporting categories, including RHI, FHI and, in some cases, credit account closure dates. Different interpretations and processing methodologies have given rise to inconsistencies in credit reporting data.

Instead of driving for perceived consistency in reporting by providing more prescription, NAB believes that the credit reporting framework should allow for flexibility in credit reporting to account for the variety of different credit product features available (i.e. there is not a one size fits all approach to cover all types of lending and all customer situations).
If CPs were required to report raw data related to a customer’s ‘statement of position’ (i.e. by reporting payment amount due, payment amount made, days past due) and having CRBs process the data in a consistent way, this would go some way to address concerns regarding credit reporting consistency.

The consistency of data required across CRBs is an important consideration, in addition to the parameters for what data is included. In NAB’s view the following data points should be included:

Data Point Rationale
Balance Knowing a customer’s balance on a loan helps to determine the current
indebtedness of a customer, their ability to service future debt and their
credit worthiness.
Payment Due The payment amounts due in the month.
Amount
Payment Made The payment amount made in the month.
Loan End Date To replace ‘term’, which may differ between CPs as some report original
loan term and some report amortising loan term.
Brand (White To address confusion where the customer may not readily associate a
label partner) branded credit product with the underlying credit provider, particularly in
the credit card space.

What are the potential implications of the proposed BNPL regulations on the credit reporting framework?

NAB views regulation for BNPL as important and to ensure customer safety, a competitive and fair market, and safe growth of the sector. NAB supports the inclusion of all credit accounts in CCR, including BNPL and pay day loans. This will provide a clearer picture of the customer’s credit liabilities and credit worthiness.

NAB notes that under the legislative approach for BNPL, mandatory comprehensive credit reporting will not extend to all BNPL providers. This continues to present a challenge for providers seeking to accurately verify other BNPL loans a customer may have, should the customer fail to disclose these, as BNPLs may not necessarily appear on a customer’s credit report. NAB believes the expansion of
CCR to all BNPL products would assist in reducing the risk of customer harm across the financial system, by providing clearer and more complete picture of a customer’s financial position.

How should the credit reporting framework be adjusted in light of other financial data sharing arrangements such as the CDR?

NAB does not believe it is currently practical to use the CDR as a sole or primary information source in credit assessments.

Customers need to consent to each of the accounts that they agree will be shared. A customer could choose not to share one or more of their accounts and – outside of getting a credit check – a lender would not know that they have not shared details of one of their accounts.
Customers can share information about closed accounts but only if they still have at least one active product with the relevant financial institution. This is because account information can only be shared from financial institutions with whom the customer has at least one active online account.

The limitations on how CDR data can be used potentially limits its ability to be readily used by banks in connection with credit application assessment decisions.

CDR is not something that needs to be directly aligned with credit reporting regulation. While CDR should or will not replace CCR, the two frameworks can be used better in combination, and NAB believes there is an opportunity to further explore how ‘real time’ CDR data offers could be leveraged to support credit decision processes.

Part 6: Consumer protection and awareness

How can consumer understanding about credit reporting be improved?

NAB supports greater education for consumers to assist them in understanding the credit framework and their credit reports. In their current form, credit reports can be difficult for most consumers to understand. This is further complicated due to the different credit scores a consumer may receive from different CRBs.
How can credit reports be made more user friendly, accessible and easy to understand for the typical consumer?

In NAB’s view, simplifying credit reports to reflect facts, as opposed to complex credit reporting rules (e.g. grace period, derived FHI indicators), would make them more accessible to consumers.
NAB also suggests presenting information and using terminology that a layperson without expert credit knowledge can understand.
Can the following arrangements be improved to better protect consumers at reasonable cost: placing a ban on accessing a credit report?

Currently, consumers can request a ban on their credit report in the instance of suspected fraud or identity theft. The law prescribes that a credit file ban is for 21 days and that an extension may be granted if there is 'reasonable' evidence to do so. NAB supports exploring the use of multi-factor authentication (MFA), where a consumer authenticates the use of their credit report for a credit assessment, should be considered in these specific circumstances. This additional step would add a layer of protection for consumers against identity theft and protect customers from having fraudulent accounts opened under their profile.
NAB believes that, if introduced, MFA should not be extended to CPs accessing credit reports for credit management and corrections purposes. This may introduce confusion for customers and prevent CPs from actively managing accounts if customer consent/authentication was explicitly required for these purposes.
Part 7: Access to and use of credit reports
Should non-financial participants such as telecommunications and utility providers be able to contribute repayment history and other positive reporting data?

NAB supports including RHI from non-financial organisations. This will assist customers, such as young adults, vulnerable customers, and new Australian residents with limited credit history or a
‘thin file’ to establish credit worthiness through consistent and timely payments to telecommunication and utility providers.

Part 8: Privacy, information security and regulatory oversight

What improvements can be made to the privacy and security of all information in the credit reporting framework?

NAB suggests that permitting the use of unique customer identifiers by CRBs could avoid continually reporting personal identifiable information (PII) when providing credit information. Customer level reporting, instead of account level reporting, could help address problems such as where there are instances of domestic or family violence or bankruptcy for joint account holders. There would likely be significant cost associated for industry to implement changes to move to customer level reporting, and further evaluation should be undertaken.

Should CRBs be required to report data on their activity or compliance to the regulator?

Regarding CRBs requiring a license or reporting to a regulator, NAB notes greater oversight could uplift and standardise process which would benefit customers. NAB also supports the creation of obligations on CRBs to more promptly load data provided by CPs under the mandatory credit reporting regime to improve the timeliness and accuracy of data held on consumer credit reports.
Currently, CPs have 45 days to report events, however CRBs do not have SLAs or mandated timeframes in which to process the data. In these circumstances, there is nothing the CPs can do to ensure their data held on the bureau is complete, accurate and up to date. CPs may even be flagged as non-compliant due to CRB inaction.
If CRBs were accountable to a regulator or service level agreement, they would be incentivised to address issues such as slow response rates or other administrative issues more promptly.

Part 9: Mandatory Credit Reporting
What have been the costs to implement mandatory credit reporting?

NAB has made significant investments to enable mandatory credit reporting. This includes software across multiple account ledgers, customer master systems, collection systems, and the requirements for data warehouses, to ensure we can comply with our obligations.

A key driver of the ongoing cost has been the disparate data validations between CRBs. NAB believes that to make the cost of mandatory credit reporting accessible to smaller CPs, standard CRB data
validations and rejection reasons, a CRB data sharing agreement or a single secure third-party portal, would be required. NAB notes that further changes would require additional investment.

Have there been any unintended consequences of mandatory credit reporting?

NAB references the fact that the introduction of mandatory credit reporting has resulted in gaps between what is permitted to be reported under the Privacy Act and what is permitted to be reported under the NCCP Act and NCC.
One example is investment (non-housing) mortgages opened between 1 Nov 1996 and 30 Jun 2010.
Another example is mortgages for residential investment purposes (for multiple dwellings) which were opened after 26 November 2010, with a value greater than $5 million.
Mandatory credit reporting applies to these accounts. However, because these accounts are not
NCC regulated, credit providers are not permitted to report FHI on non-NCC-regulated consumer accounts where a hardship arrangement has been agreed. Customers of these products who experience hardship may therefore receive a different reporting outcome than those that are NCC regulated, including suppressed RHI. The lack of FHI for customers with these accounts means that other lenders do not have visibility of periods of financial hardship (as missing/suppressed RHI can be caused by other data validation reasons, not just hardship).
Determining whether a consumer mortgage is NCC regulated can be difficult, particularly when factoring in some of the more nuanced NCC exclusions such as the limit and original loan purpose.
NAB supports making credit and hardship reporting mandatory and uniform across CPs, to ensure consistency in reporting obligations and outcomes for customers.
Should the scope of mandatory credit reporting be expanded to include other credit providers or other types of information, and if so, how should this be done?

NAB sees benefit in expanding mandatory reporting to more CPs, to close gaps in customer financial positions held on credit reports. As noted in NAB’s response to the recent consultation on regulating
BNPL, NAB believes the expansion of CCR to all BNPL products would assist in reducing the risk of customer harm across the financial system, by providing a clearer and more complete picture of a customer’s financial position.
As discussed above, for smaller CPs to comply with mandatory reporting, changes to data sharing agreements between CRBs, a central body to report raw data to, and consistency in data requirements across CRBs would have to be considered to ensure this is viable.
This would also mean CPs would not have to obtain a credit report from each of CRBs to get a complete picture of a customer’s financial position (as data would be the same across all CRBs).
This would benefit customers and CPs as a single CRB outage would not prevent a credit application from proceeding as an alternative CRB could be used with the same credit assessment outcome obtained. Having to only use a single CRB would also increase innovation and competition from
CRBs including in relation to the cost of credit enquiries.

Conclusion
NAB welcomes the opportunity to provide this submission to the Review of Australia’s Credit
Reporting Framework and is happy to discuss any aspect of it with the Reviewer.