Sharing information from the Positive credit register

This document is a summary description of the information shared from the Positive credit register, of the information recipients and of the purposes of use of the information in the first rollout stage.

The Positive credit register will be rolled out in two stages. In the first stage starting from 1 February 2024, data on consumer credits and comparable loans will be reported to the register. The use of the first-stage information begins on 1 April 2024. In the second stage at the end of 2025, lenders will start reporting loans granted to natural persons other than consumers. The use of the second-stage information begins on 1 April 2026. The use of the second-stage information will be discussed in a separate document to be published closer to the second rollout.

The present document does not give detailed instructions on how organisations can request a data permission, transact with the Incomes Register Unit or technically retrieve a credit register extract. Further, the document does not discuss private individuals’ access to their own data or what rights data subjects have under the EU General Data Protection Regulation (GDPR).

You can find information about the above matters in the following instruction documents (some of which will be released at a later date):

• description of the API for requesting a credit register extract (pdf)
• general instructions for application developers (pdf)
• instructions for lenders on how to request a data permission
• our data protection procedure
• e-service instructions for private individuals

It is not within the competence of the Incomes Register Unit to give instructions on how organisations should use credit register extract data when granting loans. Instructions on the lending process are provided by supervisory authorities.

1 Terminology of the document

Consumer credit refers to a consumer credit or comparable loan to which the provisions of chapter 7 or 7 a of the Consumer Protection Act are applied.

Lender refers to a business under the Consumer Protection Act that, by agreement, grants or promises to grant a credit to a borrower as a loan, a deferred payment or another corresponding financial arrangement. ‘Lender’ also refers to a business that brokers a credit granted by another operator (peer-to-peer loan broker) to a borrower.

For the purposes of this document, ‘lender’ also refers to an operator that is obliged, in a situation other than loan granting, to assess the borrower’s creditworthiness or check that the information on the borrower is up to date. Lenders that are entitled to use data shared from the Positive credit register are defined in section 21 of the act on the Positive credit register (Laki positiivisesta luottotietorekisteristä 739/2022).

Credit register extract refers to a credit information report under the act on the Positive credit register.

2 Confidentiality and disclosure of registered data

2.1 Confidential information and personal data

Pursuant to section 3 of the act on the Positive credit register, the information recorded in the register is confidential, with the exception of the name, Finnish Business ID or foreign business ID of a party with the reporting obligation. Information recorded in the Positive credit register may be disclosed only for purposes laid down in the act on the Positive credit register.

In addition, information may be shared from the register for the following purposes under the Act on the Openness of Government Activities (621/1999, hereafter: Act on Openness):

• party’s right of access (section 11)
• right of access to a document pertaining to oneself (section 12)
• provision of executive assistance, for example (section 26, subsection 3)
• processing of advance information, a preliminary ruling or a complaint, for example (section 29, subsection 1, paragraphs 3 and 4).

The information in the Positive credit register is personal data whose processing must comply with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, and of the Data Protection Act (1050/2018).

When data recorded in the register is processed, the privacy protection and data security requirements, as well as good data processing and data management practices, must be complied with. Data received from the register is subject to the obligation of secrecy and confidentiality, i.e. the data may not be disclosed or used for personal benefit or for the benefit of another (sections 22 and 23 of the Act on Openness).

2.2 Public information

The name, Finnish Business ID and foreign business ID of a party with reporting obligation recorded in the Positive credit register are public information. Information on lenders that have been approved as notifiers and that have received positive decisions on the establishment of connections is available on the Positive credit register’s website.

Data notifiers

3 Users of the Positive credit register data

Users of the Positive credit register data refer to lenders and authorities that have a legal right to receive information from the register. Data users also includecredit information companies. They can be provided with information on a voluntary ban on credits if the person who set the ban gives their consent.

Credit register extracts provided for lenders are subject to a charge. However, authorities andcredit information companiesare not charged for the information shared with them. Chargeability is based on the Act and the Decree on Criteria for Charges Payable to the State (150/1992 and 211/1992, respectively), and on the Ministry of Finance's decree on charges payable for data shared from the Positive credit register(1108/2023). The Ministry of Finance's decree defines the charge for a credit register extract. The decree is in force for a fixed term, and it will be renewed annually. 

3.1 Lenders, and purposes of use of the credit register extract

Section 21 of the act on the Positive credit register lays down provisions on lenders to which the credit register extract data referred to in section 22 can be disclosed, notwithstanding the confidentiality provisions. Further, section 21 of the act also lays down the purposes of use for which the Incomes Register Unit can disclose credit register extract data to lenders. The data may be used only for the purposes laid down in the act. The lender is responsible for seeing that the information obtained from the Positive credit register is used according to law.

3.1.1 Use of data in lending

Lenders may use registered data to test a person’s creditworthiness during the lending process. The information shared from the register is information that must be used even today when a natural person’s creditworthiness is assessed.

The Incomes Register Unit does not take a position on testing of creditworthiness or, for example, when a lender must order a credit register extract or how old an extract can be used in lending. The use of a credit register extract in the assessment of creditworthiness is supervised by the Consumer Ombudsman and the Financial Supervisory Authority. The legality of the processing of personal data is supervised by the Data Protection Ombudsman.

Additional information about the use of credit register extract data and its purposes of use:

Consumer Protection Act (38/1978) (finlex.fi) (link to Finnish)
Act on Credit Institutions (610/2014) (finlex.fi) (link to Finnish)

Consumer Ombudsman's statement on the provision of consumer credits (kkv.fi) (link to Finnish)

Regulations and guidelines of the Financial Supervisory Authority 4/2018: Management of credit risk and assessment of creditworthiness by supervised entities in the financial sector
Register no. FIVA 10/01.11/2020, Issued 5 March 2018, amended 20 October 2020, valid from 30 June 2021

3.1.2 Lenders’ right of access to data

In the first stage of the register rollout, the following lenders under section 21 of the Act on the Positive Credit Register have the right of access to data:

A lender under the supervision of the Financial Supervisory Authority or a lender or peer-to-peer loan broker entered in the register of lenders and peer-to-peer loan brokers that grants or brokers consumer credits reportable to the Positive credit register (‘obliged entity’ referred to in section 16, subsection 1 of the act). The right of access to data exists in the following situations:

• • Under the Consumer Protection Act, the lender is obliged to test the consumer's creditworthiness before a loan contract is concluded or after the conclusion of the loan contract when the loan principal or credit limit is significantly increased.
  • Under the Consumer Protection Act, the lender is obliged to make sure the information on the consumer is up to date when the consumer and the lender agree on increasing the loan principal or credit limit after the loan contract has been concluded.
  • A consumer requests a change to the terms of the loan that does not concern an increase of the loan principal or credit limit, and the change requires that the consumer’s creditworthiness should be tested.
  • The guarantee or third-party security provided or accepted is deposited as collateral for the payment of a loan recorded in the register.

Item A also covers Finnish branches of foreign EEA-supervised entities and foreign supervised entities that provide services in Finland but do not have a Finnish branch. A branch of a foreign EEA-supervised entity may be a branch of a credit institution located in an EEA country or a branch of a credit institution established in an EEA country by a third country. Services can be provided without a branch only by such EEA-supervised entities that have an operating licence in another EEA country.

B. Lenders other than those referred to above have the right to receive data in the following situations:

• • Under the Consumer Protection Act, the lender is obliged to test the consumer's creditworthiness before a loan contract is concluded.
  • Under the Consumer Protection Act, the lender is obliged to assess the consumer's creditworthiness or verify that the data on the consumer is up to date when the consumer and the lender agree on increasing the loan principal or credit limit after the loan contract has been concluded.
  • Under the Consumer Protection Act, the lender is obliged to make sure the information on the consumer is up to date when the consumer and the lender agree on increasing the loan principal or credit limit after the loan contract has been concluded.

3.1.3 Credit register extract’s purposes of use

A lender ordering a credit register extract must specify the purpose of use of the extract. Allowed purposed of use include

• new consumer credit contract
• increase of consumer credit principal or credit limit
• change to terms of consumer credit
• guarantee or third-party security for consumer credit
• new loan contract
• increase of the loan principal or credit limit
• change in loan contract terms
• guarantee or third-party security.

The first four purposes of use are available in the first stage of the register rollout, i.e. they apply to consumer credits and loans comparable to them. The latter four purposes of use will be introduced in the second rollout in spring 2026. If several purposes of use are relevant to the same request, they must all be reported.

New consumer credit contract is reported as the purpose of use when the lender is obliged to test the consumer's creditworthiness before concluding a new loan contract with the consumer.

Increase of consumer credit principal or credit limit is reported as the purpose of use when the loan principal or credit limit is raised in proportion to the original loan principal, i.e. the lender needs to reassess the consumer's financial standing or check that the information on the consumer is up to date.

Change to terms of consumer credit is reported as the purpose of use when the debtor requests a change to the terms of the loan that does not concern an increase of the loan principal or credit limit but requires that the debtor’s creditworthiness should be tested. Such changes include deferments of amortizations, extension of the loan period, changes to instalments and other similar changes to a payment plan, change of collateral, and changes to the reference rate, interest type or margin interest rate.

The change to the terms of the loan must be relevant to the assessment of the consumer's ability to manage their loans. The lender is not entitled to use the Positive credit register’s data when the change is irrelevant or insignificant to the debtor's ability to manage the loan, for example if the due date of a regular instalment is changed. Another precondition is that the debtor themselves must apply for a change to the terms of the loan. The lender is thus not allowed to use the Positive credit register’s data on its own initiative: the debtor must have informed the lender that they will seek changes to the loan contract.

Guarantee or third-party security for consumer credit is reported as the purpose of use when a guarantee or third-party security is provided or accepted as collateral for the payment of a loan recorded in the register. The lender is thus allowed to use the credit register extract data on the guarantor and the provider of a third-party security (pledger) when assessing the acceptability of the proposed collateral and the position of the collateral provider. Lenders may not use the credit register extract data if a guarantee or a third-party security is deposited as collateral for a loan granted to a borrower other than a natural person, such as a limited liability company.

3.1.4 Other allowed purposes of use of the credit register extract

Data received from the Positive credit register may be used only for the purpose for which it was shared from the register. In addition, however, data disclosed from the register at an earlier date may also be used for the following purposes:

• Sharing data with the State Treasury

The lender may share data it has received from the Positive credit register with the State Treasury when applying for compensation under the Act on State Guarantees for Owner-Occupied Housing Loans (204/1996) (section 21, subsection 3 of the act on the Positive credit register).

• Sharing data with the guarantor and the third-party security provider

The lender may share data it has received from the Positive credit register with the guarantor and the pledger when carrying out its duty to inform under sections 12 and 14 of the Act on Guaranties and Third-Party Pledges (361/1999, hereafter: Act on Guaranties) or if the person concerned has given their consent that the data may be shared with the guarantor or the pledger.

According to section 12 of the Act on Guaranties, the lender must inform the guarantor, before the guarantee is provided, of such issues relating to the principal debt covered by the guarantee that have a material impact on the guarantor's position, as well as the debtor's obligations and other circumstances relating to the debtor's ability to pay that can be deemed to be of interest to the guarantor.

According to section 14 of the Act on Guaranties, the guarantor has the right, during the period of validity of the guarantee, to ask the lender for information on the debtor's obligations and other circumstances relating to their ability to pay that can be deemed to be of interest to the guarantor. On the guarantor’s request, the lender can thus also share data obtained from the Positive credit register. However, the duty to inform under section 14 of the Act on Guaranties applies only to information that the lender knows of and that the lender can share with the guarantor without taking any separate action.

The guarantor can ask the lender to share only such information obtained from the Positive credit register that the lender is entitled to receive from the register. The lender may share with the guarantor information it has obtained from the register during the credit relationship in situations related to the issuing of a loan or changing of a loan contract. The lender does not have the right to acquire information from the Positive credit register separately on the guarantor’s request, because such a purpose of use is not laid down in law.

According to section 41 of the Act on Guaranties, the lender’s duty to inform mentioned above also concerns providers of third-party security, so the lender has similar obligations towards security providers.

• Meeting the obligations related to credit risk management

The lender may use the information on loan applicants that it has received from the Positive credit register for purposes of testing creditworthiness to meet its obligations. These obligations are laid down in law and they relate to credit risk management. However, such use of data concerns only lenders that are subject to credit risk management obligations laid down elsewhere in law.

Further information on other purposes of use

Act on State Guarantees for Owner-Occupied Housing Loans (204/1996) (finlex.fi) (link to Finnish)
Act on Guaranties and Third-Party Pledges (361/1999) (finlex.fi) (link to Finnish)

3.1.5 Lender’s obligation to provide information

A lender using the Positive credit register’s data must ensure that the loan applicant can receive information in advance on the use of their personal data and on the register from which the data is obtained.

If the lender rejects the applicant's credit application on account of the information received from the Positive credit register, it must inform the applicant immediately after the decision that the applicant’s loan information was used in decision-making and also specify the register from which the information was obtained.

3.2 Authorities

The Positive credit register can share information with the following authorities for purposes of the authorities’ statutory tasks: the Bank of Finland, the Financial Stability Authority, the Financial Supervisory Authority, the Consumer Ombudsman, the Finnish Competition and Consumer Authority, and Statistics Finland. The authorities use the data, for example, to supervise and monitor the stability of the financial markets, to support and monitor the credit markets, and to support decision-making and compile statistics.

The information that the register shares with authorities differs from the data shared with lenders in credit register extracts. The information that the Positive credit register shares with authorities has been defined is accordance with each authority’s needs and purposes of use such that only information that is necessary for the statutory tasks of the authority in question is shared.

3.3 Sharing information on voluntary ban on credits with credit information companies

The register can share a voluntary ban on credits set by a private individual with credit information companies. A natural person can set a voluntary ban on credits for themselves in the Positive credit register’s e-service. The credit ban can be set for a fixed term or for an indefinite period. The person must also select a reason for the credit ban: a risk of identity theft, control of personal finances or other reason. If the loan applicant has a voluntary ban on credits, the lender knows to consider the lending with special caution and care.

The person can give their voluntary and specific consent that information about their voluntary ban on credits can be shared with credit information companies. If the person gives their consent, information about the credit ban can be shared with all credit reference agencies. Currently, there are two companies in Finland that conduct credit information business and process people's credit information: Dun & Bradstreet Finland Oy  Suomen Asiakastieto Oy. The Positive credit register calls these companies ‘credit information companies’.

Information on a voluntary ban on credits is not automatically transmitted from the Positive credit register to credit information registers referred to in the act on credit information (Luottotietolaki 527/2007): in order that the information could be shared, the natural person must take active action. The person can withdraw their consent at any time. Credit information companies can record the information in a register referred to in the act on credit information (527/2007) and pass it on for purposes provided for in section 19 of the said act. Such purposes include, for example, lending of property, apartment rental, debtor's payment behaviour survey, inquiry for purposes of recovery, employment, and company assessment.

Further information about credit information companies:

Act on credit information (Luottotietolaki 527/2007) (finlex.fi) (link to Finnish)
Dun & Bradstreet Finland Oy (dnb.com)
Suomen Asiakastieto Oy (asiakastieto.fi)

4 Credit register extract data

Data included in a credit information report according to section 22 of the act on the Positive credit register is shared from the register with lenders. The Positive credit register uses the term ‘credit register extract’ for the credit information report referred to in the act.

The credit register extract is a summary of the information on a private individual saved in the Positive credit register. The information to be included in the credit register extract is defined in section 22 of the act on the Positive credit register. Information not defined in the act cannot be included in the credit register extract. The information content of the extract is the same for all lenders that have the right to obtain information from the register. The extract sent to a lender contains the most recent information on the individual’s loans that has been submitted to the register.

The credit register extract contains information on a private individual’s loans and income. If the person has set a voluntary ban on credits, this is also indicated in the extract. The income data, i.e. information about the wages, pensions and benefits paid to the individual, is obtained from the Incomes Register. The income data is separated into wage data and benefit data in the extract. The income data is shown as monthly income for the past full 12 months.

If the person has denied the accuracy of the loan information on the basis of Article 18 (1)(a) of the EU General Data Protection Regulation and requested that the processing of their information should be limited, this is indicated in the credit register extract. Despite the limitation request, the information is included in the extract. However, the lender will be notified that some data included in the extract should be treated with extra caution and care and be compared with information from other sources, such as the person themselves. This indication is shown in the extract until the Incomes Register Unit has verified the accuracy of the data.

The credit register extract contains the following information:

Identifying data

• personal identity code of the individual whose data the register extract contains
• identifier of the organisation that requested the extract.

Voluntary ban on credits

• If the person has a voluntary ban on credits in effect, the ban and the reason for it are indicated in the extract.

Summary of loan information

• number of lenders and peer-to-peer loan brokers that have issued or brokered loans to the person
• number of loan contracts that the person has
• most recent loan-related payments in total (each loan’s most recent amortization, interest payment or expense amount added together)
• total monthly payments related to leasing contracts (including interest and expenses)
• number of loans where the person is a guarantor.

Loan information – lump-sum loan, running-account loan, guarantee receivable for a student loan, and leasing

• date of conclusion
• number of debtors
• loan currency
• due dates of instalments that are at least 60 days late, and unpaid instalment amounts
• information about loan foreclosure
• information that the borrower has denied the accuracy of loan information
• information that the loan issued to the borrower is included in a payment plan in a debt arrangement
• information that the loan issued to the borrower is included in a business restructuring program.

If a loan is included in a payment plan in a debt arrangement or in a business restructuring program, it will affect the information shown in the credit register extract. The loan amounts, number of lenders and amounts of guaranteed loans are included in the summary, but amortizations are not included in the sum total of the most recent payments. Other loan data is not shown in the register extract. The above, more limited information is also shown in the extract if the loan has several co-debtors and one of them is in a payment plan in a debt arrangement or in a business restructuring program. The extract also shows if the borrower has denied the accuracy of the loan data.

Loan information – lump-sum loan and guarantee receivable for a student loan

• loan’s purpose of use
  • home loan, home loan for first home, home loan for leisure house, home loan for investment purposes, student loan, consumer credit for the purchase of a vehicle or craft, other consumer credit, other loan, loan for operation of business, or guarantee receivable for a student loan
• indication of whether a collateral is included in the loan contract; if yes, the type of collateral
  • residential property, other immovable property, hire-purchased item, other movable property, other collateral, personal guarantee, government guarantee or other guarantee
• final due date of the payment plan
• payment method if the loan is paid as a lump sum (bullet) or if the last instalment is much larger than the other instalments (balloon)
• amortization frequency (given in months, e.g. 1, 3 or 6)
• the start and end dates of the deferments of amortizations, current and future periods
• amount issued
• amount paid
• current balance of the loan.

Loan information – running-account loan

• credit limit
• amount of loan balance, and value date
• the start and end dates of the deferments of amortizations, current and future periods

Loan information – leasing

• start date of leasing contract
• final price of the leased asset if redemption is required by the contract.

Income information

• The credit register extract shows the person’s income information for the past 12 calendar months. Only information on full calendar months is shown. The income is separated into wages and benefits and further into gross and net income by month. The income or benefit payer is not shown. The bases of the benefits are not itemised: all benefits are included in the same total amount.
• Wages are considered to include other income types reported to the Incomes Register except tax-exempt kilometre allowances, meal allowances and daily allowances. Benefits are considered to include almost all benefits reported to the Incomes Register. The formula for calculating income data is available on this website.

Calculation of income data

If a person is added to the loan as a borrower after the loan has been reported to the register, it will affect what information is shown in the credit register extract: only the loan information valid when the person is a party to the loan is shown in the extract.

The following information is not shown in the extract at all:

• The deferments of amortization that are no longer valid or that end on the same day as the person is added to the loan
• The start date of a deferment period if the person has been added to the loan after that date
• The date of conclusion if the person has been added to the loan after that date
• The amount issued and the amount paid if they did not change when the person was added to the loan and have not changed after that, either
• The amount drawn against a running account and the value date if they did not change when the person was added to the loan and have not changed after that, either
• The start date of a leasing contract if the person was added to the loan after that date.

Payment transactions are also not included in the sum total of the latest payments if their date of payment is earlier than or the same as the date when the person was added to the loan.

If a person does not have any active loans, i.e. loans reported to the Positive credit register but not reported as ended, the number of loans and the number of lenders that have issued loans are 0. In addition, the extract shows the number of loans guaranteed by the person, the person's income data and any voluntary ban on credits.

If the person has died, the lender that requested the credit register extract will only be notified that the person had died and given the date of death.

5 Data permission needed to access data

As regards lenders, section 27 a of the act on the Positive credit register prescribes that a precondition for sharing data from the Positive credit register is a decision issued based on the lender’s application. Based on the lender’s application, the Incomes Register Unit makes a data permission decision entitling the lender to access information if the preconditions laid down in law for the right of access to data are met and if the lender has provided a sufficient account of the company and its operations, the purpose of use of the data, data protection and control of data usage. Being the authority responsible for sharing data, the Incomes Register Unit must see, before sharing data, that the party requesting data has ensured secure processing of confidential information and personal data shared from the register.

The data permission decision is an administrative decision, to which the provisions of chapter 7 of the Administrative Procedure Act (434/2003) are applied and which can be appealed against under the Administrative Judicial Procedure Act (808/2019). The Incomes Register Unit is entitled to deny access to data or cancel the data permission decision if the preconditions for the sharing of data laid down in the Act on the Positive Credit Register or in other relevant legislation are not met.

The Act on the Positive Credit Register does not separately provide for the data permission procedure of authorities and credit information companies. However, the register’s data permission procedure also applies to these users of registered data.