Choosing a credit bureau in Ecuador
In Ecuador, financial entities report credit data to the Superintendencia de Bancos, and two authorised private bureaus, Equifax and Aval Buró, receive that shared base. Their files differ in what they add, including social security contributions. LOPDP article 20 covers decisions based wholly or partly on automated processing, and applicants may ask for the criteria and data source. You must tell the applicant in the first communication of the decision. You decide which bureau’s additions merit selection and how its explanation and notice fit your decision flow.
Compare the data each Ecuador bureau adds
Cooperatives are among the financial entities that report credit data to the SB. The SB provides a credit reference service, as do authorised bureaus. The SB has said Equifax Ecuador and Aval Buró are the two authorised private bureaus. Compare what each provider adds.
Other sources may contribute commercial and services information. Since October 2025, reported changes also allow social security contributions from the IESS, ISSFA and ISSPOL, and securities market defaults, to be included. Ask each provider which additional information it offers and how it appears in the report your team will use.
| Source | Run by | What it carries |
|---|---|---|
| Registro de datos crediticios | Superintendencia de Bancos | Credit data reported by financial entities, cooperatives included |
| Equifax Ecuador | Equifax | SB data, other sources, scores (150 to 999) |
| Aval Buró | Aval Buró | SB data, other sources, scores (150 to 999) |
Scorecards can still make automated decisions
An analyst review does not take the decision outside the rule, because it covers decisions based wholly or partly on automated processing. Ecuador’s LOPDP, the Ley Orgánica de Protección de Datos Personales, covers decisions with legal effects based wholly or partly on automated processing.
For a decision within that rule, the applicant can ask for a reasoned explanation, the program’s valuation criteria, the types and source of data used, and can challenge the decision. You must tell the applicant about this right no later than the first communication reporting the decision. The law provides exceptions, including where the decision is necessary to enter into a contract or the person has given explicit consent. The right cannot be waived in advance through a mass adhesion contract, so a clause in the loan terms does not remove it. The LOPDP also sets the limits on what you can do with bureau information.
| Step | The duty | Where |
|---|---|---|
| Before the pull | Authorisation to access bureau information in the credit file | Codificación Libro I |
| The use | Credit analysis only | LOPDP art. 28 |
| Old records | Not communicated after 5 years from due date | LOPDP art. 28 |
| An automated decision | Explanation, criteria, data and source, challenge, told in the first communication | LOPDP art. 20 |
| A correction request | Answered by the source within 15 days | LOPDP art. 29 |
For an identity check before the bureau pull, the Registro Civil (DIGERCIC) offers private companies web services to check citizen data, using demographic data or biometrics, as reported.
Put authorisation to access bureau information in the credit file before the pull. The codified credit file requirements list this authorisation. Whether this list applies to cooperatives’ files was not confirmed. If you are a cooperative, determine whether this requirement applies to your file. Use bureau information for credit analysis only. Credit data may not be communicated more than five years after the obligation became due. The source of the data has 15 days to answer a correction request.
Check SPDP coverage of your scorecard
A separate recordkeeping requirement may apply if your scorecard falls within Ecuador’s AI rule. The SPDP, Ecuador’s personal data protection authority, requires automated decisions with legal effects to be logged in the record of processing activities for systems covered by the rule. Whether a rules-based scorecard counts as an AI system under the SPDP norm is not settled. Determine whether the norm covers your scorecard.
The SPDP has been working since April 2024. Fines for private entities range from 0.1% to 1% of the previous year’s volume of business.
If the system is covered, log the automated decisions with legal effects in the record of processing activities. Classify the scorecard separately from the analyst review of declined applications.
Test bureau value on your own applicants
A proposal tells you what a bureau offers. Your own applicants show whether that information changes your decisions enough to justify the calls. Test the options on your own applicants: use the first bureau alone, the second alone, both, and the second only when the first has no file. Compare how often each returns a file, which good and bad applicants each flags, how often the added information changes the decision, and the cost of the calls against the lending outcomes.
The data source waterfall tool compares those four sourcing approaches using hit rates, flagged applicants, call prices, losses per bad loan and profit per good one. Choose the second source when your applicants show that its added value justifies the call cost.
Decisimo’s data source documentation describes how a data source connects to any REST API or SOAP web service, and how a failed call routes to a fallback branch like any other data source error.
Plan bureau selection and applicant communication
Include analyst review in the operating plan, and specify the actions that come before and after it. The bureau choice changes the information available to the scorecard. The scorecard can partly determine the outcome, so the applicant communication and the records supporting an explanation belong in the same launch plan.
- Put authorisation to access bureau information in the credit file before the pull. If you are a cooperative, determine whether this file requirement applies to your institution.
- Ask Equifax and Aval Buró what each carries beyond SB data, including social security contributions.
- Use bureau information for credit analysis only.
- Apply the five-year limit by stopping communication of credit data once five years have passed since the obligation became due.
- Tell applicants about the automated-decision right in the first communication reporting the decision. Keep the criteria, data types and data source ready to explain, and provide a way to receive a challenge.
- Whether a rules-based scorecard counts as an AI system under the SPDP norm is not settled. Determine whether your scorecard is covered. If it is, log automated decisions with legal effects in the record of processing activities.
- Compare the first bureau alone, the second alone, both together and the second only on a no-file from the first using your own applicants. Sign with a second bureau when the measured value of its added information justifies its call cost.
Questions about credit bureaus in Ecuador
How many credit bureaus are there in Ecuador?
Equifax Ecuador and Aval Buró are the two authorised private bureaus. The SB also provides a credit reference service.
Do social security contributions appear on Ecuadorian credit reports?
As reported, IESS, ISSFA and ISSPOL contributions have been reportable to bureaus since October 2025.
Can an applicant correct their credit report in Ecuador?
Applicants have free access to their credit report, and the data source has 15 days to answer a correction request.
What data do Ecuadorian credit bureaus hold?
They receive credit data reported by financial entities to the SB and may carry additional information from other sources. This can include commercial and services data, securities market defaults, and social security contributions reported by the IESS, ISSFA and ISSPOL.
How long does a debt stay on a credit report in Ecuador?
Credit data may not be communicated more than five years after the obligation became due.
Can I use bureau data for marketing in Ecuador?
No. Bureau information may be used for credit analysis only, not for a secondary purpose.
Does an analyst review take a decision outside the automated decision rule?
No. If the scorecard partly determines the outcome, the decision remains within the rule even when an analyst reviews it. The right cannot be waived in advance through a mass adhesion contract.
What changes when the applicant is a minor?
A legal representative’s consent is required to process a child’s data, while adolescents aged 15 or older may give their own consent.
What must I tell an applicant about an automated decision?
For a decision with legal effects based wholly or partly on automated processing, tell the applicant about the right no later than the first communication reporting the decision. Be ready to explain the decision, its criteria, and the types and source of data used, and to receive a challenge.
What fines can private entities face?
The SPDP sets fines for private entities. They range from 0.1% to 1% of the previous year’s volume of business.
