Choosing a credit bureau in El Salvador
El Salvador's credit data is held by three licensed bureaus, Equifax, TransUnion and INFORED, and the same law applies to every lender, whether supervised or not. Under that law, the applicant's authorisation must name the bureau you will consult and sit on a separate document. Each consultation sends the applicant an alert, so looking at a report is visible to the person whose data is being checked. If you may need another bureau later, you must decide whether to request authorisation for it by name.
Name the bureau on a separate authorisation
Tie the authorisation to the applicant’s DUI, issued by the RNPN. No commercial route for lenders to verify a DUI against the RNPN was found.
An authorisation that allows a check with “any credit bureau” leaves the bureau unnamed. El Salvador’s LHC, the credit history information law, covers every lender handling credit history data, supervised and unsupervised alike. It requires written, express authorisation on a separate document, and that document must name the credit bureau you will consult. The applicant receives a signed copy.
The SSF list names three bureaus. The Central de Riesgos is the SSF’s own register, a separate source with different access rules.
| Source | Run by | Access |
|---|---|---|
| Equifax | Equifax Centroamérica, S.A. de C.V. | Contract, authorisation naming the bureau |
| TransUnion | TransUnion El Salvador, S.A. de C.V. | Contract, authorisation naming the bureau |
| INFORED | Información de Referencias Crediticias en Red, S.A. de C.V. | Contract, authorisation naming the bureau |
| Central de Riesgos | SSF | Financial system members, negative data of the last three years |
Bureaus must be domiciled in El Salvador and keep their database there. The data protection law in force since November 2024 requires a data protection officer and gives people the right to object to profiling for marketing. No rule on automated credit decisions was found.
So choosing a bureau is both a procurement decision and part of the authorisation your team gives the applicant. To consult another bureau later, obtain authorisation naming it.
Treat each consultation as visible to the applicant
Every consultation triggers an alert to the applicant by instant message or email. The applicant’s free report shows inquiries from the last three years and the bureau’s score.
Refusing authorisation cannot be the reason you deny the service.
| Step | The duty | Where |
|---|---|---|
| Before the pull | Written authorisation on its own document, the bureau named, signed copy to the applicant | LHC arts. 14(d), 15 |
| A refusal | Not a reason to deny the service | LHC art. 15 |
| Full payment | Tell the bureau within 3 business days, finiquito within 7 | LHC arts. 17(j), 14(j) |
| Negative data | Deleted after three years at most | LHC art. 17(j) |
| A decline | Written reasons on request, within 10 days | LPC art. 19(l) |
A bureau may include negative data only for a debt that is certain, overdue, enforceable and unpaid.
A bureau may not hold account balances or movements, deposits, consumption habits, health data or other such information. Utility payment history requires separate express consent on its own form.
If you are a member of the financial system, you can also consult the SSF Central de Riesgos for negative data from the last three years. Other lenders cannot query it directly and rely on the private bureaus. Your decision process should record whether a bureau was consulted, whether the call failed, or whether the result showed no file.
The Ley contra la Usura covers every creditor. The BCR sets the maximum rate by credit segment, so set the segment before the price. Its segmentation separates consumer credit with a payroll-deduction order from consumer credit without one. For microcredit, use the applicable methodology and in-field information on the borrower’s ability to pay.
Document a policy for assigning each credit to a segment. If the amount or purpose is missing, the lowest maximum rate applies. If the SSF does not supervise you, register with the BCR’s Registro de Acreedores.
Compare a second bureau on your own applicants
Compare bureau sources using your own applicants: its hit rate, which good and bad applicants it flags, the price per call, the loss per bad loan and the profit per good applicant. A source that identifies additional bad loans may also turn away good applicants, and both effects belong in the economics.
Test the second bureau as a no-file fallback: call it only when the first bureau has no file. Record a failed call separately from a no-file result. The data source waterfall tool compares source options using hit rates, good and bad applicants, call prices, losses and profit. If you call multiple sources within one decision flow, Decisimo’s data-source documentation describes connecting a data source to any REST API or SOAP web service and routing a failed call to a fallback branch like any other data source error.
Replace “any credit bureau” with the procedure your team will actually follow:
- Take written, express authorisation on its own document. Name each bureau you will consult and give the applicant a signed copy.
- A refusal is not a reason to deny the service.
- If you are a financial system member, include the SSF Central de Riesgos for negative data from the last three years.
- Expect the applicant to receive an alert for every consultation. Negative data is deleted on full payment or no later than three years after it was entered.
- When a borrower pays in full, tell the bureau within three business days and issue the finiquito, the settlement certificate, within seven business days.
- If an applicant asks why you declined the credit, give the reasons in writing within ten days.
- Compare a second bureau with the first using your own applicants, and call it only when the first has no file.
Questions about credit bureaus in El Salvador
How many credit bureaus are there in El Salvador?
The SSF list names three: Equifax, TransUnion and INFORED.
Can the credit check consent be part of the loan contract?
No, it may not be part of general contract clauses.
Can I decline an applicant who refuses the credit check?
No. Refusing authorisation is not a reason to deny the service.
Will the applicant know I checked their credit?
Yes. Each consultation triggers an alert by instant message or email.
How long does negative data stay on a credit report in El Salvador?
It is deleted when the debt is paid in full, or no later than three years after it was entered.
Does the usury law apply if the SSF does not supervise me?
Yes. The Ley contra la Usura covers every creditor, including creditors not supervised by the SSF.
What data may an El Salvador credit bureau not hold?
A bureau may not hold account balances or movements, deposits, consumption habits, health data or other such information.
Who can query the SSF Central de Riesgos?
Financial system members can query it.
Can I use a bureau’s score in El Salvador?
Yes. Lenders may contract the bureau’s risk scoring service, and the free report shows its score under the bureau’s methodology.
Where must a Salvadoran credit bureau keep its data?
In a database in El Salvador.
Can I use a credit report to decide on hiring?
No. Credit history data may not be used to evaluate applicants for employment.
Does El Salvador have a data protection law?
Yes. The data protection law has been in force since November 2024.
Can I use an applicant's utility bills in a bureau report?
Only with separate express consent on its own form.
How long does the credit check authorisation last?
It lasts while the contract exists, or for 3 months if no contract follows.
What is a finiquito?
It is the settlement certificate due within 7 business days of full payment, with notice to the bureau.
How do I check an applicant's identity in El Salvador?
Tie the authorisation to the applicant’s DUI, issued by the RNPN. No commercial route for lenders to verify a DUI against the RNPN was found.
Do I report my loans to the central bank if the SSF does not supervise me?
If the SSF does not supervise you, register with the BCR’s Registro de Acreedores.
Does the bureau have to tell an applicant who checked their report?
Yes. The bureau must tell the applicant which lender consulted their report.
What must I tell an applicant I decline?
If the applicant asks, give the reasons for the decline in writing within ten days.
Must the authorisation name the credit bureau?
Yes. It must name the bureau you will consult.
