Choosing a credit bureau in Costa Rica
In Costa Rica, credit information sits with SUGEF and private bureaus, in separate sources rather than one complete register. SUGEF's record covers debts with supervised entities, while retailer and other non-supervised obligations sit with private bureaus. The register route changes with your status: a supervised entity uses CIC, and a non-supervised entity uses CICOC, with applicant authorisation for either. Since CICOC does not show those retail and non-supervised debts, you must decide which bureau to use for visibility beyond the register.
CICOC registration gives access to supervised obligations
CICOC shows applicants’ current obligations with entities supervised by SUGEF, the Superintendencia General de Entidades Financieras. Debts with retailers and other non-supervised lenders sit outside that record, and private bureaus are where data from those lenders is held.
Assess what information a private credit bureau could add to the decision flow for your new product.
Private bureaus add data from non-supervised lenders
Names reported in Costa Rica in 2019 included Datum (Equifax), Teletec, TransUnion, Protectora de Crédito Comercial and Cero Riesgo. PRODHAB is Costa Rica’s data-protection agency, and databases run for distribution or sale must be registered with it.
The 2019 bill’s text reported that 74% of the population had active products with non-regulated entities. The register of supervised entities alone can therefore leave a coverage gap.
| Source | Run by | What it carries | Access |
|---|---|---|---|
| CIC | SUGEF | Supervised entities' reporting and the historical payment level | Supervised lenders, with the person's prior authorisation |
| CICOC | SUGEF | Current obligations with supervised entities | Non-supervised lenders registered as oferentes, with authorisation |
| Datum, Teletec | Equifax (EFX de Costa Rica) | Credit data from private lenders | Contract |
| TransUnion | TransUnion Costa Rica TUCR | Credit data from private lenders | Contract |
| SICRE | Protectora de Crédito Comercial | Credit data from private lenders | Contract |
Assess a private bureau for the additional applicant information it can return. Ask which retailers and non-supervised lenders report to it, then check what that means for your decisions.
SUGEF supervision determines which register you use
If SUGEF supervises you, use the CIC, SUGEF’s Centro de Información Crediticia. It is built from reporting by supervised entities and calculates a person’s historical payment behaviour. If SUGEF does not supervise you, register as an oferente, a credit grantor, and use CICOC to request an applicant’s current obligations with supervised entities. The registration uses a firma digital, or digital-signature card.
Access to the CIC is tied to the inscription duty under Ley 7786. The CICOC check was first compulsory for non-supervised lenders and is now optional.
Authorisation is part of either query. For the CIC, the applicant’s prior authorisation must be signed, physically or with firma digital, and registered in the CIC. For CICOC, use SUGEF’s authorisation forms. Keep these register-specific requirements distinct from the express written consent required when you collect personal data.
Consent and retention shape applicant data use
Before a query, the TSE offers a free name-and-cédula lookup to help confirm an applicant’s identity. Its VID biometric service was reported as used mainly by banks and notaries.
Make consent a control in the application flow. Before collecting personal data, explain the database, purposes, recipients, consequences of refusal and the applicant’s rights. Then obtain express written consent, in physical or electronic form, and retain proof because you may need to demonstrate that it was given. “Condición socioeconómica” is sensitive data under Ley 8968 art. 3(e).
Set retention rules for data that may affect the applicant, and prepare to answer questions about how you used it.
| Step | The duty | Where |
|---|---|---|
| Before the CIC query | Prior authorisation, signed and registered | SUGEF 7-06 art. 7 |
| Before collecting data | Express written consent, informed, provable | Ley 8968 art. 5, Reglamento art. 6 |
| Keeping data | At most 10 years after the facts | Ley 8968 art. 6 |
| On request | Access, correction and the method used, within 5 business days | Ley 8968 art. 7 |
Data that may affect a person can be kept for no more than 10 years after the facts, unless a special rule says otherwise. Access, correction and deletion requests must be answered free of charge within 5 business days. An applicant can also ask which system, programme, method or process you used to process their data.
Test a second bureau against your applicants
Ask each bureau which non-supervised lenders and retailers report to it, then measure its coverage against your applicants. A bureau’s value depends on its hit rate on your book, the price of a call and whether its information changes a decision.
Compare the register and first bureau with a second source under different calling rules. For each applicant, record whether the first source has a file, whether the second returns additional information, whether that information changes the decision, and what the call costs. Compare calling the first source only, the second only, both, and the second only when the first has no file. A data source waterfall lays out these options against hit rates, the good and bad applicants flagged, the price per call, the loss per bad loan and the profit per good one.
Decisimo’s public data source documentation describes how a data source connects to any REST API or SOAP web service in decision logic, and how a failed call routes to a fallback branch like any other data source error.
Use applicant results to choose your bureau mix
CICOC registration gives you access to applicants’ current obligations with supervised entities, but it does not show debts with retailers and other non-supervised lenders. Private bureaus hold data from those lenders, so assess the additional coverage and cost of a bureau contract against your applicants.
- Identify whether SUGEF supervises you. For SUGEF-supervised lenders, use the CIC. If SUGEF does not supervise you, use CICOC.
- Before a CIC query, obtain the applicant’s prior authorisation, signed and registered in the CIC. For CICOC, use SUGEF’s authorisation forms.
- Before collecting personal data, provide the required information, obtain express written consent and keep proof.
- Ask each private bureau which non-supervised lenders and retailers report to it.
- Keep data that may affect the applicant for no longer than 10 years after the facts, unless a special rule says otherwise.
- Be ready to tell an applicant within 5 business days which system, method or process you used, and to answer access, correction or deletion requests.
- Before signing with a second bureau, compare it with the register and the first source on your own applicants. Test calling the second only after a first-source no-hit against the alternatives, then use that rule only if your results support it.
Questions about credit bureaus in Costa Rica
How many credit bureaus are there in Costa Rica?
Reporting in 2019 named Datum (Equifax), Teletec, TransUnion, Protectora de Crédito Comercial and Cero Riesgo.
Who runs Datum and TransUnion in Costa Rica?
Datum is run by EFX de Costa Rica S.A., and TransUnion by TransUnion Costa Rica TUCR S.A. Both were reported as registered with PRODHAB in 2015.
What is the SUGEF CIC?
The CIC is SUGEF’s Centro de Información Crediticia, built from reporting by supervised entities and used to calculate a person’s historical payment behaviour.
Can a lender that SUGEF does not supervise check the CIC?
No, not through the CIC as a supervised lender. You can register as an oferente and request through CICOC an applicant’s current obligations with supervised entities, using SUGEF’s authorisation forms.
Does a lender that SUGEF does not supervise have to check CICOC?
No. The CICOC check was first compulsory for non-supervised lenders and is now optional.
Do I need consent to check an applicant’s credit in Costa Rica?
A CIC query requires prior authorisation signed and registered in the CIC, and a CICOC query uses SUGEF’s authorisation forms. Express written consent is required when you collect personal data.
Do credit bureaus in Costa Rica have to register with PRODHAB?
Yes, when their databases are operated for distribution or sale. Credit-behaviour data follows the financial system’s rules, which do not remove the right to informational self-determination.
Are income and affordability data sensitive?
Ley 8968 lists “condición socioeconómica” as sensitive data, and its processing is prohibited subject to exceptions. Whether PRODHAB applies that rule to income data was not established.
How long can credit data be kept in Costa Rica?
Data that may affect a person can be kept for no more than 10 years after the facts, unless a special rule says otherwise.
What can an applicant ask me about my decision?
An applicant can ask which system, programme, method or process you used to process their data. Access, correction and deletion requests must be answered free of charge within 5 business days.
