(1) A designated bank must provide credit information that it holds about each customer of the bank which is a small or medium sized business to a designated credit reference agency if -

(a) the credit reference agency has requested that the bank provide the information;

(b) the request meets the requirements set out in regulation 4;

(2) But paragraph (1) does not require a bank to provide information about a customer who has not agreed to information being provided about it to the credit reference agency (see regulation 5).

(3) The bank must provide the information within a period of 30 days starting with the day on which the bank received the request.

(4) The bank must provide an update to the information in each month following the month in which the information was first provided, unless the credit reference agency has informed the bank in writing that it no longer requires such updates.

(5) Such update -

(a) need not include updated information relating to -

(i) a customer of the bank which has ceased to be a small or medium sized business; or

(ii) a former customer of the bank;