Memuatkan...
Memuatkan...
Malaysia debt & credit
They are two different systems, run by two different bodies, under two different Acts. Treating them as one name for the same thing is why most people misunderstand what a lender can actually see — and why almost nobody knows the rights they have over either.
Prefer Bahasa Malaysia? CCRIS vs CTOS
The distinction is not a technicality — it decides who holds your data, under which law, and what you can require of them.
| CCRIS | CTOS / CBM / Experian | |
|---|---|---|
| What it is | A credit bureau | Credit reporting agencies |
| Run by | Bank Negara Malaysia | Private companies |
| Legal basis | s.47, Central Bank of Malaysia Act 2009 | Registered under s.14(2), Credit Reporting Agencies Act 2010 |
| Supervised by | Bank Negara Malaysia | Registrar of Credit Reporting Agencies, Ministry of Finance |
Both regulators confirm the split from opposite ends. The Ministry of Finance Registrar's own FAQ asks whether it supervises CCRIS and answers: “No. CCRIS… is under the supervision of the Central Bank.” BNM's own “CCRIS Myths” section names the belief that CCRIS and CTOS are the same as a myth, and notes that those agencies are registered by the Ministry of Finance under the 2010 Act — while adding that the three have approval to access CCRIS to produce private credit reports, which may include more information than CCRIS.
Participating financial institutions report three classes of information to BNM: your profile (name, identity card or registration number, date of birth, address); credit application details (amount applied for, date, type of facility); and credit account details (type of facility, credit limit, outstanding balance, instalment amount, conduct of account and legal action status, if any).
What the report shows is narrower. BNM states that the CCRIS report shows only outstanding or active accounts, pending credit applications, and approved credit applications for the last 12 months — and that information on rejected applications is not provided, so that one institution is not prejudiced by another's decision.
This is BNM's own point, and it is the one most often missed: “Only loans/financing from participating financial institutions are included in CCRIS… There are credit institutions that do not participate in CCRIS.”
The published participant list is broad — commercial and Islamic banks, investment banks, development financial institutions, a small number of credit and leasing companies, two payment-instrument issuers, a building society and, notably, PTPTN — but it is a floor, not a ceiling on where a person can owe money. Borrowings outside it simply are not there.
Two practical consequences. A clean CCRIS report is not proof that someone has no debt. And a lender assessing you may see a fuller picture through a credit reporting agency's report than CCRIS alone contains.
Act 710 constrains what a registered agency may do rather than listing a fixed dataset. Under section 22(1), collection must be for a specific and lawful purpose directly related to the agency's activity, must be necessary for or directly related to that purpose, and must be adequate but not excessive.
In practice an agency's report can carry material CCRIS does not — litigation records, trade references and, for the three with BNM approval, CCRIS data as well. That is why the same person can look different in two reports without either being inaccurate.
Collection needs no consent. Disclosure does. Those are two different sections of the same Act and the gap between them is the single most misunderstood thing about CTOS.
So what you control is whether the report reaches a lender. The Registrar states the practical consequence plainly: if you do not consent to disclosure, there is a possibility your loan application will not be processed further. Breaches of these sections carry a fine not exceeding RM500,000, imprisonment not exceeding two years, or both.
Section 25(1) bars a credit reporting agency from including certain things in a credit report. These are the most consumer-actionable rights in the whole regime, and they are rarely stated anywhere:
CCRIS records the status of individual credit facilities. It does not maintain a register of barred people and there is no borrower-level flag — not for arrears, and not for participating in a debt-assistance programme, which carries its own facility-level status value of its own.
What follows is worth holding on to: no one can “remove you from the blacklist”, because there is no list to be on. Anyone offering to clean your CCRIS record for a fee is selling something that does not exist. What genuinely changes a record is settling what is outstanding and then conducting accounts well — and, where a report contains something wrong, exercising your right to have it corrected.
No, and both regulators say so. CCRIS — the Central Credit Reference Information System — is owned and managed by Bank Negara Malaysia as a credit bureau under section 47 of the Central Bank of Malaysia Act 2009. CTOS, Credit Bureau Malaysia and Experian are credit reporting agencies registered by the Ministry of Finance under the Credit Reporting Agencies Act 2010 [Act 710]. The Registrar who administers that Act states plainly that he does not supervise CCRIS.
Bank Negara Malaysia states that the CCRIS report shows outstanding or active accounts, pending credit applications, and approved credit applications for the last 12 months. Rejected applications are not shown in the report — deliberately, so that one institution’s decision does not prejudice another’s. Note that what is collected and what is shown in the report are two different things.
No, and BNM says so in its own words: only loans and financing from participating financial institutions are included, and there are credit institutions that do not participate in CCRIS. The published list covers commercial and Islamic banks, investment banks, development financial institutions, a handful of credit and leasing companies, two payment-instrument issuers, one building society and one government agency, PTPTN. A clean CCRIS report is therefore not proof of no debt.
No — and this is the most misunderstood part of the regime. Under section 22(3) of Act 710, a credit reporting agency’s collection and use of credit information does not require your consent. What consent controls is disclosure: under section 24(1) an agency may not disclose your credit information unless you have consented, or the disclosure is for preventing or detecting crime or investigations, or it is required by law or a court order. Consent is also specific to the purpose and the recipient. The practical trade-off is that refusing consent may mean a loan application is not processed further.
Section 25 of Act 710 bars a credit reporting agency from including information about a default in repayment of credit two years after the date of final settlement of the amount in default. Read that carefully: the clock starts when the default is settled, not when it happened. An unsettled default has no time limit under section 25 — it can keep appearing indefinitely. Settling is what starts the two years.
Section 25 also bars information about a person’s bankruptcy two years after the date of discharge, and information about a pecuniary court action more than two years after proceedings commenced — unless the current status of the action has been ascertained and included in the report. As with defaults, each clock is tied to a specific event rather than simply to the passage of time.
There is no blacklist. CCRIS records the status of individual credit facilities; it does not maintain a list of barred people, and there is no borrower-level flag. Lenders read the record and apply their own credit policy — which is why two lenders can reach different decisions on the same report.