For those wanting to convince a credit institution that they are in a position to manage a home loan, a good credit score can be the key to their own four walls, whereas a bad score (see info box “Credit scores and credit reference agencies”) can ensure they are left out in the cold. Many landlords and providers of mobile phone contracts also take a detailed look at the credit scores issued by credit reference agencies before concluding a contract with a potential customer or tenant.

Recently, BaFin has received numerous enquiries from consumers asking about the extent to which it monitors such credit scoring and its usage by credit institutions.

Credit scores are used more frequently in the private customer segment than with commercial customers

Before credit institutions issue a loan, they need to calculate the risk that the borrower will default. Credit institutions do not base such decisions on gut feeling, rather they make use of internal risk classification procedures. These analyse a range of data in order to calculate the risk of default. For credit agreements with private customers, credit scores are often included in the risk classification procedure.

Although credit reference agencies also analyse commercial enterprises, credit scores are used less frequently in business to business relationships. Credit institutions tend to make use of such scores when they want to review the results of their own risk classification procedures, which generally do not include credit reference agency scores. Where there are significant inconsistencies, credit institutions can at least check again whether to follow their initial evaluation in the assessment of creditworthiness.

BaFin's expectations regarding the assessment of creditworthiness

Whether private individual or commercial enterprise, BaFin expects credit institutions to not rely solely on external credit scores, but to take their own findings and information into consideration. Institutions now tend to base their assessments of creditworthiness less on scores issued by credit reference agencies than they did a few years ago.

BaFin regularly reviews lending processes, either in full or in part. The frequency of these reviews is determined on the basis of the credit institution’s risks rather than being set at fixed intervals.

Credit scores are included in the calculation of capital using internal rating procedures

In Germany, 40 credit institutions use an Internal Ratings Based Approach (IRBA) in accordance with section 10 of the Banking Act (Kreditwesengesetz – KWG) in the determination of their regulatory capital requirements. Particularly in retail banking, credit scores are included in internal ratings. In such cases, BaFin treats credit scores the same as all other external input data. Which means that they are indirectly reviewed as a component of the IRBA.

Under Article 143(2) of the Capital Requirements Regulation (CRR), credit institutions require prior permission to use the IRB Approach. The European Central Bank is responsible for granting permission in the case of significant institutions (SIs), whereas for less significant institutions this responsibility falls to BaFin. Together with the Bundesbank, BaFin reviews the quality and the performance of the model. The formal decision is reached by BaFin on the basis of section 7 (1) of the Solvency Regulation (Solvabilitätsverordnung – SolvV) in conjunction with section 44 (1) sentence 2 of the KWG.

Initial permission to use an IRBA is followed by continuous monitoring. Article 185 of the CRR requires credit institutions to review their models at least annually with regard to their suitability and their results. The internal validation results form the basis for the regular review of model quality by the supervisory authority.

What BaFin does not do

BaFin does not supervise credit reference agencies. Likewise, BaFin does not approve or certify individual scoring systems since credit reference agencies are not required to disclose their algorithms to supervisory authorities. The competent data protection authorities, such as the commissioners for data protection of the German states, are responsible for monitoring whether credit reference agencies meet the relevant data protection provisions.