CRIF record removal: timing, when the periods start and how it really works

In brief: a negative report in CRIF removes itself: 12 months after regularisation if the delay was one or two instalments, 24 months if it was longer, up to 36 months (never more than 60) if the debt was not settled. This is set by Annex 2 of the Code of Conduct approved by the Italian Data Protection Authority (Garante privacy) in 2019. Paid early removal does not exist.

After how long do you get out of the “bad payers” lists?

It depends on what was reported: 12 months for a delay of one or two instalments later paid, 24 months for a longer delay later paid, up to 36 months for a debt never regularised. The periods are in Annex 2 of the Code of Conduct for credit information systems, and they apply to all SICs (credit information systems), not only to CRIF.

“Bad payer” is not a legal category: in the SICs (EURISC by CRIF, Experian, CTC) there is “negative-type information”, that is delays and defaults, and “positive-type information”, that is regularly paid credit relationships, each with a maximum retention period. As of October 2026 the table in force is this:

Type of information	Maximum retention period	From when it runs
Loan application under review	180 days	From submission of the application
Application rejected or withdrawn	90 days	From the update with the outcome of the application
Delay of up to two instalments or months, then regularised	12 months	From the recording of the regularisation
Delay of more than two instalments or months, then regularised	24 months	From the recording of the regularisation
Default never regularised	36 months, and in any case not beyond 60 months from the contract expiry	From the contractual expiry of the relationship or from the last necessary update
Relationship closed with full payment (positive data)	60 months	From the termination of the relationship or the contract expiry

Source: Annex 2 of the Code of Conduct for information systems managed by private entities on consumer credit, creditworthiness and punctuality of payments (Garante privacy, decision no. 163 of 12 September 2019); the same table is on CRIF's official page.

From when do the periods run: from the delay or from the payment?

For delays later settled, the 12 or 24 months start from the date on which the regularisation is recorded in the SIC, not from the day of the delay. For debts never settled, the period starts from the contractual expiry of the relationship or from the last update, with the absolute limit of 60 months from the contract expiry.

This is the point that causes the most disappointment: someone who paid three instalments with a six-month delay sees the report disappear 24 months after the payment is recorded. For the Code (art. 2), “regularisation” means extinguishing the debt, interest and costs included, or a settlement or agreement, even out of court: even a reduced settlement (saldo e stralcio) starts the countdown, without shortening it. And the record is deleted at expiry only if in the meantime no other delays have been recorded (Annex 2, paragraph 3).

Delay in paying an instalment: after how long are you reported?

Before the first negative report, the bank or finance company must send you a prior notice, and data on the first delay can be made visible to other participants only after at least fifteen days from the dispatch of that notice (art. 5, paragraph 6, of the Code of Conduct). A delay of a few days, later settled, normally does not reach the SIC.

Annex 2, paragraph 7, adds the timing of visibility for the first delay:

• Positive and negative SICs (EURISC included): accessible to other participants after 60 days from the monthly update, or with at least two consecutive unpaid monthly instalments, or if the delay concerns one of the last two due dates of the loan.
• Negative-only SICs: after at least 120 days from the payment due date, or with at least four unpaid monthly instalments.

Does early CRIF removal exist?

No, if the record is correct. Removal takes place automatically at the expiry of the periods, without any request and without costs; CRIF states on its official page that early removal is possible only if the data is incorrect or not up to date, or in cases of credit fraud, and that it has no relationship with those who offer, for a fee, the removal of negative data.

“Guaranteed CRIF removal” offers play on a misunderstanding: correcting an inaccurate record is your free right; making a real delay disappear before the deadline is not provided for by any rule. CRIF reports receiving requests from people who paid these intermediaries and obtained nothing. A regularised delay remains visible, with an indication that it has been settled, until expiry.

How to have an incorrect record corrected or deleted?

With a written, free request to the bank that reported the data or to the SIC manager: the right to rectification (art. 16 GDPR) and the right to erasure (art. 17 GDPR) require inaccurate data to be corrected and unlawfully processed data to be deleted, without undue delay. The reply must arrive within one month, extendable by two in complex cases (art. 12 GDPR, taken up by art. 9 of the Code of Conduct).

In practice, according to CRIF's official page on rectification:

• CRIF does not change the data on its own: it verifies it with the reporting body and meanwhile notes the dispute in the database;
• if the body does not reply within 30 days, CRIF suspends the visibility of the relationship; in any case it replies to you within 30 days;
• in the case of identity theft, the request must be accompanied by the police report and the communication to the bank.

How to see what is recorded in your name in CRIF, before applying for a loan?

With a request for access to your data (art. 15 GDPR), free of charge for natural persons, through CRIF's online form with an identity document: the reply arrives by post or email within 30 days of receiving complete documentation. The same right applies with Experian, CTC and the bank that reported the data.

No third-party service can query CRIF on your behalf: SIC data is confidential (art. 12 of the Code). The steps for each archive: how to know whether you are reported as a bad payer; for the Bank of Italy archive, Centrale dei Rischi: how to consult your data.

While you wait for removal, what can anyone checking you see?

The CRIF report is seen only by you and by the intermediaries of the SIC. Protests, adverse entries and insolvency proceedings in your name, however, are public data: a supplier, a landlord, a partner or a customer can consult them without your consent, and the bank looks at them together with the SICs (see what the bank looks at before granting a loan, mortgage or credit line).

• Protests: they remain for five years in the computerised protests register of the Chambers of Commerce. After one year, if you have paid and have not suffered others, you can request rehabilitation (art. 17 law 108/1996): the protests office deletes the record within twenty days of the application.
• Adverse entries (pregiudizievoli): judicial mortgages, seizures and other formalities of the Conservatoria (Land Registry); they exist only if you have real estate in your name.
• Insolvency proceedings: in your name, if you have or had a business.

With Veryfy, in the person funnel, you declare the purpose “Check myself” and the Verifica Persona report (€29) shows you this data with source and date: protests, presence of adverse entries (and, where available, how many) and insolvency proceedings. The Estesa tier (€49) adds offices held in other companies, shareholdings and real estate in the Land Registry (Catasto). Veryfy does not access CRIF, Experian, CTC or the Centrale dei Rischi: you request the confidential data for free yourself, you see the public data immediately, and that is what anyone checking you sees. The full map is in what they see of you before you apply for credit.