Your Credit Report in Malawi (2026): Who Holds It, How to See It, and How to Fix It

Somewhere in Malawi there is a file about you that decides whether your next loan is approved, and you have almost certainly never read it. Since the Credit Reference Bureau Act was amended in 2016, a Malawian lender is not merely permitted to look at that file — it is required to. Section 14A(1) is unambiguous: a financial institution shall consult credit reports of a credit reference bureau before entering into a credit agreement or insurance contract with a customer.

So the file is not a background detail. It is the first thing a lender sees about you, often before a human does. The good news is that Malawian law gives you the right to read it, and two independent routes to force an error out of it. Almost nobody uses either.

What a credit reference bureau is, and who watches it

A credit reference bureau collects information about how you have borrowed and repaid, and sells that picture back to lenders. In Malawi it is a licensed, supervised business, not a private database.

Section 4(1) of the Credit Reference Bureau Act (Chapter 46:09) provides that no person shall conduct credit reference bureau business unless licensed as a credit reference bureau under the Financial Services Act, and section 4(2) restricts licensing to limited liability companies. The Registrar of Financial Institutions at the Reserve Bank of Malawi supervises the sector, may inspect a bureau's premises and systems at its discretion under section 20, and under section 28 can impose monetary penalties, issue written warnings or revoke a licence.

The industry is young. The Registrar's own account is that Malawi had no credit reference bureaux until 2010, and that the first bureau was established and licensed in 2011, with a second licensed the same year.

Who is allowed to look at your file

Not everyone. Section 14(1) confines a bureau's information services to regulated financial institutions. Anyone else — an employer, a landlord, a business checking out a counterparty — falls under section 14(2), which requires that your authorisation be submitted in writing to the bureau by the person asking.

That is a right worth knowing you have. If a party who is not a regulated financial institution produces information about your borrowing history, the lawful route to it ran through your written permission.

Meanwhile, section 13B obliges a financial institution to keep the credit information it furnishes to bureaux updated on a monthly basis, or sooner where an update is necessary. A settled debt still showing as outstanding after several months is not how the system is meant to work.

Your right to see it — and the myth about "once a year"

Section 23(1) gives an account holder access to any credit information relating to them that is held in a bureau's database. Section 23(2) then sets out two routes to it: free of charge, by viewing the data on a screen, or by paying a fee for a document copy.

Read that carefully, because it is widely misreported. The statute does not ration you to one free report every twelve months. It gives you free viewing, with no annual cap written into the Act, and charges only for the paper. An individual bureau may choose to offer you something more generous as a matter of its own practice — but the floor set by Malawian law is free screen access, and that floor does not expire in December.

Fees for the copy are not fixed by statute either. Section 22 allows a bureau to charge for its services on the Registrar's approval, with the amount agreed between the user and the bureau and denominated in Malawi Kwacha. Ask what the copy costs before you order it.

Seven years, not forever

Section 21 requires a bureau to maintain a historical database covering a seven year period for the purpose of providing detailed credit information.

That is the horizon a bad patch sits inside. It also means a default from a decade ago has no business shaping a decision today — and if it appears on your file, that is precisely the kind of entry section 24 exists for.

Two ways to get an error corrected

Malawi gives you two overlapping remedies here, from two different statutes. Use whichever fits, or both.

Route one — the Credit Reference Bureau Act. Under section 24(1), where you believe information held about you is illegal, inaccurate, erroneous or outdated, you may request a review by the bureau, and any deficiency identified is to be promptly remedied. Section 26 puts teeth on it: a bureau must run a customer claims and inquiry service section, staffed sufficiently, and must remedy the corresponding errors in its database within ten working days. Where the error originated with the institution that supplied the data rather than the bureau, section 25 governs claims against information providers.

Route two — the Data Protection Act, 2024. Malawi's Data Protection Act (No. 3 of 2024), brought into force by Government Notice 40 of 2024, treats your credit file as personal data like any other, and a bureau as a data controller. Under section 19 you may demand confirmation that your data is being processed and a copy of it — in a commonly used electronic format, within thirty days of your request, and where practicable at no expense to you. Under section 21 you have the right to rectify any error and to have incomplete data completed, and the controller must act within fourteen days of receiving the request. Section 23(1) lets you demand that processing be restricted while you are contesting the data's accuracy — useful if you are mid-application and a wrong entry is actively costing you.

The designated Data Protection Authority is the Malawi Communications Regulatory Authority.

The automated-decision right, and its honest limit

Section 25(1) of the Data Protection Act gives you the right not to be subject to a decision based solely on automated processing, including profiling, which produces a legal or similarly significant effect concerning you. A loan decision made entirely by a scoring engine is squarely the kind of thing that describes.

Be clear-eyed about the limit, though. Section 25(2)(a) disapplies that right where the decision is necessary for entering into, or the performance of, a contract between you and the data controller — which is exactly the posture of a loan application you initiated. Section 26 adds further derogations, including where processing pursues a national economic or financial interest. Treat section 25 as a lever for demanding human review of an odd outcome, not as a veto on automated lending.

How to actually check your file

1. Confirm the bureau is licensed before handing over your identity documents. Section 11 requires the Registrar to keep a register of credit reference bureaux and to publish entries in, and cancellations from, that register in the Gazette or in at least two newspapers of national circulation. Ask the Registrar of Financial Institutions to confirm current licensing, and note the date you asked. The same instinct you would apply to a lender — see how to tell if a lender is licensed in Malawi — applies to a bureau.
2. Ask for the free screen view first, citing section 23(2). Order a paid copy only once you know what it costs.
3. Read every line against your own records. Accounts you do not recognise, an amount that does not match, a settled debt still open, a duplicate of the same loan, or an entry older than seven years.
4. Put any dispute in writing, dated, with copies of statements or settlement letters attached, and keep a copy. Cite section 24 of the Credit Reference Bureau Act and section 21 of the Data Protection Act together, and diarise both clocks — ten working days and fourteen days.
5. Check again before you apply for anything large, not after you are turned down.

If nobody fixes it

Escalate on the track that fits the failure.

For the lender or bureau's conduct, the Registrar of Financial Institutions asks you to report first to the institution's branch or service centre — in person, in writing or by telephone — and then, if it is not resolved, to lodge with the Registrar through its complaints handling portal (registrar@rbm.mw; P O Box 30063, Lilongwe 3). Section 27 empowers the Registrar to request any information needed to evaluate complaints, accusations or inconsistencies detected at a bureau. The Reserve Bank has also issued a Financial Services (Fair Treatment of Consumers) Directive, 2024 and a Financial Services (Complaints Handling) Directive, 2024, both gazetted on 12 July 2024 — ask your institution for the complaints procedure it is required to operate under them.

For the data itself, complain in writing to the Data Protection Authority (info@dpa.mw; 1st Floor, Green Heritage House, 2 Khonje Close, Lilongwe). Section 44(3)(a) is the trap to avoid: the Authority is obliged to investigate only where the complaint is lodged within ninety days of the action or inaction complained of. Do not sit on it. Under section 44(7) the Authority communicates the results within thirty days of completing its investigation, and under section 45 it may order the controller to comply, to cease and desist, to pay you compensation, or to pay an administrative penalty of up to K20,000,000.

Keeping the file clean in the first place

Nothing here substitutes for the boring part. Because section 14A makes the bureau check mandatory rather than optional, the file is now the gatekeeper for every regulated credit and insurance agreement you enter — so it is worth managing deliberately: know what you can actually service before you sign, using the affordability calculator; clear the most damaging arrears first with the debt payoff calculator; and read borrowing money safely in Malawi before taking on anything new.

One structural point worth naming. A bureau only knows what regulated institutions report to it. Repaying a village bank or informal group faithfully for years builds no record a lender can see, which is one reason a first formal loan is hard to get on merit alone. Choosing where you bank with that in mind — see how to choose a bank account in Malawi — is part of building a file, not just using one.

Frequently asked questions

Do I have to pay to see my own credit report in Malawi? No. Section 23(2) of the Credit Reference Bureau Act gives you access free of charge by viewing the data on a screen. A fee applies only if you want a document copy, and section 22 requires that fee to be Registrar-approved and denominated in Malawi Kwacha.

Is it true I only get one free report a year? That framing is common but it is not what the Act says. The statute grants free screen viewing without an annual limit. A particular bureau may describe its service in annual terms; the legal floor is not annual.

How long does bad information stay on my file? Section 21 requires a bureau to maintain a seven year historical database. Anything older than that being used against you is worth challenging under section 24.

Can my employer or landlord pull my credit report? Only with your written authorisation submitted to the bureau. Section 14(1) limits the bureau's information services to regulated financial institutions; section 14(2) requires your written authorisation for any other user.

How fast must an error be corrected? Section 26(2) of the Credit Reference Bureau Act gives the bureau ten working days to remedy errors in its database. Section 21(3) of the Data Protection Act, 2024 gives a data controller fourteen days from receipt of a rectification request. Cite both.

A machine declined my loan. Can I insist on a human? Section 25(1) of the Data Protection Act gives a right not to be subject to a decision based solely on automated processing with a legal or similarly significant effect — but section 25(2)(a) excludes decisions necessary for entering into a contract with that controller, which covers a loan you applied for. It is a strong basis for requesting human review, not a right to overturn the decision.

Sources

• Credit Reference Bureau Act, Chapter 46:09 of the Laws of Malawi [18 of 2010; 6 of 2016; G.N. 13/2010], commenced 1 October 2010, amended by Act 6 of 2016, consolidated to 31 December 2017, via MalawiLII — sections 4, 11, 13B, 14, 14A, 20, 21, 22, 23, 24, 25, 26, 27 and 28.
• Data Protection Act, No. 3 of 2024 (Malawi), assented 31 January 2024, published 2 February 2024, brought into operation by Government Notice 40 of 2024 — sections 2, 19, 21, 23, 24, 25, 26, 44 and 45.
• Registrar of Financial Institutions, rfi.mw — credit reference bureaux as a supervised sector, the 2010–2011 history of licensing in Malawi, and the consumer complaint-handling route. Accessed 4 September 2026.
• Reserve Bank of Malawi, Financial Sector Regulation — consumer directives, including the Financial Services (Fair Treatment of Consumers) Directive, 2024 (GN 45 of 2024) and the Financial Services (Complaints Handling) Directive, 2024 (GN 46 of 2024), both gazetted 12 July 2024. Accessed 4 September 2026.
• Malawi Data Protection Authority, dpa.mw — establishment under the Data Protection Act 2024, MACRA as the designated Authority, and how to lodge a complaint. Accessed 4 September 2026.

Last reviewed: September 2026. General information, not financial or legal advice. Credit reporting law, directives and bureau licensing may change — confirm the current position with the Registrar of Financial Institutions at the Reserve Bank of Malawi and the Malawi Data Protection Authority before relying on it.