Credit Data Smart readiness for Hong Kong money lenders

What CDS actually is

Credit Data Smart is the infrastructure behind Hong Kong’s move from a single consumer credit reference agency to a multiple-agency model. Rather than one company holding consumer credit data, several credit reference agencies operate against a shared framework, with the stated aims of competition, service quality and operational resilience.

For a money lender the practical consequence is narrower than the policy debate. Consumer credit data the business already holds becomes something it is expected to produce on a schedule, in a defined shape, and to stand behind when it is wrong.

Who it applies to

The Financial Services and the Treasury Bureau’s 2026 consultation conclusions draw two separate lines, and they catch different lenders.

Submitting data. Money lenders engaged in unsecured personal lending would submit relevant borrowers’ personal credit data every 30 days, with the first six months operating as a trial period for data submission.

Joining and enquiring. A lender would additionally be required to join CDS and use it when assessing applications if its total unsecured personal loans reach HK$50 million, or if its business involves borrowers with monthly income below HK$12,000 — regardless of scale.

A lender can therefore fall inside the submission requirement without being inside the joining requirement. Which line applies changes how much work is ahead, so it is worth establishing before anything else.

What the data has to contain

The conclusions describe application and approved-loan data for unsecured personal lending, including credit amount, outstanding amount and repayment records. That reads narrowly until someone tries to produce it from a real ledger.

A submission is only as good as the record behind it. In practice, for every covered loan, a lender needs the application as it was actually made — including declines and withdrawals, not only approvals; the approved terms as they stood at approval rather than after later restructuring; the outstanding balance on the reporting date, reconciled to the ledger; the full repayment history including reversals, refunds, adjustments and write-offs; a borrower identity stable enough to survive name variations, duplicate records and corrections; and a reason and a named owner for every correction made after the fact.

Most lenders find the gap here rather than at the interface. Duplicate customers, missing identity fields, balances that do not reconcile and statuses that contradict one another are ordinary in a book that has never been asked to report on itself.

How to prepare before a specification exists

Waiting for the interface specification spends the one genuinely scarce resource, which is time. The work that pays off is the work any specification would require.

Scope first: which products, which lending companies, which borrower segments are covered. Then write a data dictionary naming, for every field, its source system, its format and the person who owns it. Fix identity matching before anything else, because data attributed to the wrong borrower is worse than data not submitted at all. Then rehearse: export a test batch, have business, operations, technology and compliance review it together, and keep the evidence that the review happened.

The six steps below set that out in order.

The legal constraints to hold in mind

Three things sit alongside CDS, and none of them are optional.

These are proposals, not final rules. The requirements above come from consultation conclusions. Phase-two detail should be confirmed against the licence conditions attached to the lender’s own money lenders licence, the platform specifications once published, and the latest official guidance. No lender should build to a summary — including this one.

Consumer credit data is personal data. The Personal Data (Privacy) Ordinance applies throughout, and the lender is the data user. That governs the purpose for which the data was collected, whether submission falls inside that purpose or needs fresh notification, how long it is kept, how accurate it is kept, and how the lender answers a borrower asking to access or correct their record. Changing what is done with data already held is a privacy question before it is a technical one.

Responsibility does not transfer. Software can organise, validate and export the data. The lender remains responsible for its accuracy, for the submission itself, and for interpreting how the requirements apply to its own business.

This page is general information about published proposals, not legal advice. Lenders should take their own legal and compliance advice on how the requirements apply to their licence and their loan book.

Get a consultation

A working session on your data and your ledger, not on your licence — legal and compliance advice should come from your own advisers.