UK Credit Reference Agencies Explained: Experian, Equifax, TransUnion

Overview

Credit reference agencies (CRAs) in the UK hold the shared credit file that lenders both contribute to and query when making credit decisions. The three operators are Experian, Equifax and TransUnion (formerly Callcredit). Lenders report to one or more of them; the data overlaps but is not identical, so the three files can differ. Each agency provides consumers with their own file, score and dispute service.

How the three agencies differ

Experian is the largest and tends to be the agency queried by most mainstream lenders. Equifax has a strong presence in motor finance and some specialist lending. TransUnion (the rebranded Callcredit) is widely used in telecoms and utilities. A consumer with three otherwise identical files at the three agencies might see meaningfully different scores because the algorithms differ; one missing data point can shift the calculation.

What the file contains

Each file contains: personal details (name, date of birth, current and previous addresses, electoral roll status), credit accounts (current and historic, with monthly payment status), public information (CCJs, IVAs, bankruptcies), financial associations (linked individuals), short-term high-cost credit history, and lender searches in the last twelve months. Open Banking data is being added incrementally where the consumer has shared it.

Free statutory access and paid services

All three agencies are required to provide a statutory credit report on request, free of charge under the Data Protection Act. The free report shows the data lenders see. Paid 'enhanced' services from each agency add the consumer-facing credit score, identity-theft alerts, comparison tools and trend analysis. The underlying data is the same; the value-add is the presentation layer.

Disputes and corrections

If an item on the file is wrong, the consumer raises a dispute with the agency. The agency must investigate within twenty-eight days and either correct the data, mark it as disputed, or explain why it stands. If the consumer disagrees with the outcome, they can add a notice of correction (a personal statement of up to two hundred characters) to the file that lenders see during searches.

Soft and hard searches

A soft search is a lender or consumer enquiry that does not appear to other lenders; eligibility checkers, pre-approval tools and consumer self-checks are soft searches. A hard search records on the file and is visible to other lenders for twelve months. Multiple hard searches in short succession suggest credit difficulty and reduce the score. Searches alone do not decline applications; lenders use the full file.

How institutions verify UK address

Address verification at UK institutions combines documentary evidence with database checks. Banks under FCA and JMLSG guidance typically require documents from a recognised list (utility bills, council tax, bank statements, government letters) plus an address validation against the Royal Mail Postcode Address File (PAF). Address-not-found in PAF can stall account opening even where the documents are genuine; new-build properties are a common case.

Credit reference agencies build address history from multiple sources: electoral roll (the strongest signal), credit account address records reported by lenders, public records including court judgments, and (increasingly) Open Banking data shared with the agency. Each address on file has a verification status; unverified addresses produce thin-file scoring and trigger manual review at lenders.

Updating address across the system is manual: HMRC, DVLA, GP, council, bank, electoral roll and utilities each need separate notification. The gov.uk Tell-Once service exists for births and deaths only; address changes use individual channels. Setting aside an afternoon when moving to do all the notifications systematically is the standard advice.

Key GOV.UK resources for new UK residents

The gov.uk website is the single front door for UK government services. Key services for newcomers include: gov.uk/apply-national-insurance-number for the NI number application; gov.uk/register-to-vote for the electoral roll; gov.uk/view-prove-immigration-status for the eVisa account and share codes; gov.uk/apply-renew-passport for British passport applications after citizenship; gov.uk/exchange-foreign-driving-licence for DVLA exchange.

Cross-cutting services include gov.uk/personal-tax-account for HMRC self-service (tax codes, employment history, NI record, state pension forecast), gov.uk/help-with-childcare-costs for the Tax-Free Childcare and free hours schemes, and gov.uk/sign-in-childcare-account for the parent-facing TFC portal. The NHS App at nhs.uk/nhs-app provides the parallel front door for health services.

For up-to-date practical guidance, the citizensadvice.org.uk and moneyhelper.org.uk websites cover the major newcomer scenarios. Citizens Advice operates free in-person and telephone advice across the UK; Money Helper is the consumer-facing site of the Money and Pensions Service offering free financial guidance.

Troubleshooting common identity and address verification failures

The most common verification failures involve: address not on PAF (new-build), name spelling variants (middle initial vs full middle name, accents in names), date-of-birth format mismatch (different conventions in different countries), and recent moves where the new address has not yet propagated to credit agencies.

Specific fixes by problem type. Address not on PAF: provide alternative documentary evidence including completion statement, mortgage offer, council tax registration letter and Royal Mail redirection confirmation. Wait for PAF update which typically takes four to twelve weeks for new-builds. Name spelling: provide alternative ID documents showing both spellings; bring deed poll if there has been a formal change.

Where verification fails repeatedly, request enhanced underwriting at the institution (most have a manual review path), or try a different institution that uses different verification systems. Open Banking sharing can sometimes work where standard document verification fails. Specialist identity-verification services including Onfido, Yoti and GBG offer a fallback that some institutions accept where their own verification is inconclusive.

Address change cascade: who to notify when you move

Moving home triggers a cascade of address updates. There is no single notification that updates all UK records. Priority notifications include: HMRC (via the personal tax account at gov.uk), the GP surgery (which transfers your registration to the new surgery or updates the existing one), the local council (for council tax registration), the DVLA (within fourteen days for the driving licence), and the electoral roll (re-register at the new address at gov.uk).

Financial updates include each bank, credit card and insurance provider, the pension provider, and Tax-Free Childcare or Universal Credit account where relevant. Utility updates include energy, water, broadband, mobile and TV licence. Subscriptions including streaming services, magazines and delivery services need separate updates. Royal Mail's address redirection service forwards post for a fee, buying time to update individually.

Setting aside an afternoon when moving to systematically work through the notifications is the standard advice. Most have online forms; many can be updated via the institution's mobile app. The gov.uk Tell-Once service is only for births and deaths; routine moves require individual notifications.

Identity fraud prevention and what to do if compromised

Identity fraud is one of the most common types of fraud in the UK. Action Fraud (actionfraud.police.uk) is the national reporting centre for cyber crime and fraud. Cases involving identity fraud are also reportable to the Cifas national fraud prevention service, which can flag the affected identity with multiple financial institutions to reduce subsequent harm.

Protective steps include: regularly checking credit files at each of the three agencies (free statutory reports under the Data Protection Act); enabling two-factor authentication on all financial accounts; using unique strong passwords (a password manager makes this manageable); being alert to phishing emails and SMS; never sharing OTP codes or full bank security details by phone.

If identity fraud is suspected: contact the bank and credit reference agencies immediately to flag the affected accounts; report to Action Fraud; obtain a Cifas protective registration (Cifas Protective Registration is paid; Cifas Member Protection is free for victims). The credit reference agencies can add a notice of correction or fraud marker to the file that lenders see at credit applications.

Specific routes for compromised passports (HMPO at gov.uk), driving licences (DVLA), eVisas (UKVI account) and NI numbers (HMRC) exist. Each replaces the compromised credential with a new one. The Information Commissioner's Office (ICO) is the regulator for data protection breaches; ICO complaints can support broader investigation where an organisation's data has been compromised.

Work, employment rights and the UK labour market

Once UK-resident with the right to work, employment in the UK is governed by the Employment Rights Act 1996, the Equality Act 2010 and a comprehensive framework of further legislation. Right-to-work checks are mandatory for employers; the share-code system through the UKVI account is the standard route for non-British nationals. The check provides the employer with a statutory excuse against illegal-working penalties.

Statutory employment rights include: the National Minimum Wage (different rates by age, set by HMRC); statutory holiday entitlement of 5.6 weeks per year (28 days for someone working a five-day week, including bank holidays at the employer's discretion); statutory sick pay; statutory maternity, paternity, adoption and shared parental leave; the right not to be unfairly dismissed (after two years' service in most cases); protections against discrimination on the nine protected characteristics under the Equality Act.

Workplace pensions are auto-enrolled for most employees aged twenty-two or over earning above the auto-enrolment threshold (currently around 10,000 pounds per year). The employee can opt out within the opt-out window. Auto-enrolment contributions are a minimum of eight percent of qualifying earnings (three percent employer, five percent employee). Many employers offer better than minimum.

HMRC personal tax account at gov.uk/personal-tax-account is the self-service portal for tax matters: viewing tax code, employment history, state pension forecast, marriage allowance claim and many other functions. The personal tax account works across employers and replaces previous paper-based interactions for most matters.

Data protection rights and how to exercise them

The UK GDPR and Data Protection Act 2018 give individuals strong rights over their personal data. Key rights include the right to be informed about data processing, the right of access (subject access request), the right to rectification of inaccurate data, the right to erasure in defined circumstances, the right to restrict processing, the right to data portability, the right to object, and rights related to automated decision-making.

To exercise rights with a specific organisation, send a written request to the data protection officer or to a general data-protection inquiry address. Most organisations have a privacy notice (often called Privacy Policy) on their website setting out the contact details. The organisation has one month to respond, extendable to three months for complex requests.

The Information Commissioner's Office (ICO) regulates data protection in the UK. Complaints about an organisation's handling of personal data can be made to the ICO at ico.org.uk. The ICO investigates, can require remediation, and can issue fines for serious breaches (up to four percent of global turnover for the most serious GDPR breaches).

Identity verification organisations collect substantial personal data and are particularly tightly regulated. The Cifas national fraud database is a special-purpose data store with specific governance. Individuals can subject-access Cifas to see whether they appear on any fraud database and challenge incorrect entries.

Newcomer documentation checklist and next steps

A useful documentation checklist for newcomers covers: passport (current, valid); UK visa or eVisa share code; UK address evidence (tenancy or temporary address letter); NI number documentation (or application reference if pending); UK bank account confirmation; tax record (HMRC personal tax account at gov.uk/personal-tax-account); NHS number (issued at GP registration); driving licence (foreign or UK photocard).

Storage of these documents matters. Originals should be kept in a secure place (not all in one bag carried daily). Photocopies and digital copies (encrypted cloud storage) provide backup. Some institutions require originals for verification; others accept certified copies. Solicitors and notaries can certify copies for a fee.

Recovery of lost documents is straightforward through the relevant agency: HMPO for passport, DVLA for driving licence, HMRC for NI number documentation, UKVI for eVisa account. Each has online and phone routes. Identity fraud reports should go to Action Fraud immediately; Cifas protective registration adds an extra layer of protection.

Reviewing the document set every twelve to twenty-four months helps catch upcoming expiries: passports expiring within six months of an intended trip may not be accepted by some destination countries; driving licences need renewal every ten years; eVisas remain current as long as the underlying immigration status remains.

For sensitive documents (deed poll, marriage certificate, gender recognition certificate) keeping multiple certified copies avoids the need to use the original repeatedly. The General Register Office issues additional copies of birth, marriage and civil partnership certificates for a small fee.

Disclaimer

This article provides general information for UK residents and newcomers. It is not legal, tax, financial or medical advice. Rules, rates, eligibility criteria and processes change frequently; readers should verify details with the linked primary sources or consult an authorised professional before acting on anything described here. References to specific firms, products or services are illustrative and do not constitute endorsements.

Frequently asked questions

Which agency should I check?

All three. Lenders query different agencies for different products, so monitoring just one risks missing an issue on the others. Statutory reports from each are free. Some consumers subscribe to a single enhanced service and check the other two annually.

Why are my scores different at each agency?

Each agency receives slightly different data feeds from lenders, and each calculates its score with its own algorithm. The same person can have a 'good' Experian score and a 'fair' Equifax score, simply because of which lenders have reported and how each algorithm weights the data.

Are credit scores the same as credit ratings?

Credit scores are consumer-facing numbers calculated by each agency. Credit ratings are formal assessments by rating agencies (Moody's, S&P, Fitch) and apply to corporates, governments and securities, not consumers. The two are sometimes confused but operate in entirely different regulatory regimes.

Can the agencies sell my data?

Yes, in regulated ways. The agencies' core business is providing credit reference services to FCA-authorised lenders. They also offer marketing analytics, identity verification and other services. Consumers can opt out of marketing uses through preference centres at each agency.

How long do negative items stay on the file?

Most negative items (defaults, late payments, CCJs, IVAs, bankruptcies) stay on the file for six years from the date of the event. After six years the item drops off automatically. The score recovers progressively, especially with new positive activity replacing the negative weight.

What is a CCJ and how does it appear on my file?

A County Court Judgment (CCJ) is a court order requiring payment of a debt. The CCJ is recorded on all three CRA files for six years and significantly damages the score. CCJs paid within thirty days of the judgment can have the entry removed; CCJs paid later are marked as 'satisfied' but remain on the file.