One record, three bureaus
CCRIS stands for Central Credit Reference Information System. Bank Negara Malaysia owns and runs it. Banks and other participating institutions report to it, and it turns their data into a credit report. Borrowers can download their own for free through eCCRIS. It is not a blacklist, and it gives no score and no opinion.
CTOS, Experian (Experian Information Services (Malaysia)) and Credit Bureau Malaysia are credit reporting agencies registered under the Credit Reporting Agencies Act 2010. The Registrar Office of Credit Reporting Agencies at the Ministry of Finance oversees them. Bank Negara has approved these three to read CCRIS, with the borrower's prior consent, and to use it in their own reports.
Lenders report every month
Banks, development financial institutions, PTPTN, and some card and leasing companies.
CCRIS, run by Bank Negara Malaysia
Active loans and cards, approved and pending applications, 12 months of arrears. No score. Free to the customer through eCCRIS.
CTOS
The CCRIS records, plus: Personal details (NRD), directorships (SSM), courts, trade references, dishonoured cheques, ANGKASA deductions on some reports.
Score: CTOS Score, 300 to 850
Experian
The CCRIS records, plus: Directorships, courts, trade references, PTPTN, ANGKASA salary deductions.
Score: i-SCORE, 300 to 800
Credit Bureau Malaysia
The CCRIS records, plus: NRD, SSM, legal notices, trade references.
Score: Credit score and probability of default
What is in each one
| What to compare | CCRIS (Bank Negara) | CTOS | Experian |
|---|---|---|---|
| Run by | Bank Negara Malaysia | CTOS Data Systems, a registered credit reporting agency | Experian Information Services (Malaysia), a registered credit reporting agency |
| Repayment records | Active loans and cards, plus approved and pending applications, for the last 12 months | The CCRIS records, in the full report | The CCRIS banking information, plus banking and non-banking credit payment records |
| Beyond loans | Nothing else | Personal details from NRD, directorships from SSM, litigation and bankruptcy, trade referee listings, dishonoured cheques, and ANGKASA deductions on some reports | Directorships, litigation and bankruptcy, trade references, PTPTN, and ANGKASA salary deductions (SPGA) |
| Score | None | CTOS Score, 300 to 850 | i-SCORE, 300 to 800 |
| Cost to you | Free through eCCRIS | Basic report free, without CCRIS or score. Full report RM 27.90 as of October 2026 | Basic report free. Fuller report RM 23.90 as of October 2026 |
| Who can ask for it | You, for your own report only. Lenders. Approved bureaus, with your consent | You. Subscribers such as banks, with your consent | You. Subscribers such as banks, with your consent |
Credit Bureau Malaysia is the third bureau. Its personal report is called MySCoRE and carries a credit score and a probability of default. We do not compare it line by line here, but everything in this guide about consent and overlap applies to it too.
Why the reports do not match
- Different dates. Bank Negara says lenders update CCRIS by the 10th of the following month, so a report pulled on the 5th may not show last month's payment.
- Different coverage. CCRIS only holds what its reporting institutions send: banks, development financial institutions, some card and leasing companies and government bodies such as PTPTN. Cooperatives and licensed moneylenders are not on Bank Negara's published list. A bureau can add other sources, such as trade references and ANGKASA deductions.
- Different scores. A CTOS Score and an Experian i-SCORE use different scales and different models. A 700 on one is not a 700 on the other.
- Different rules on old records. The Credit Reporting Agencies Act stops a bureau reporting a default two years after final settlement, but CCRIS itself shows a rolling 12 months. Read the date range of whichever report you hold.
Who uses which
Lenders. Bank Negara says banks use CCRIS when they assess an application and when they review an existing customer. Banks that subscribe to a bureau can also ask it for a report directly. CTOS says banks check the CTOS Score before approving a loan. Each lender decides for itself which reports to use and how much weight to give them.
Businesses. CTOS and Experian also sell company reports and run trade reference listings, which is how a supplier can report an unpaid invoice.
Loan agents. You have no right to read someone's CCRIS. eCCRIS lets an individual get only their own report. It does not let them authorise another person to get it for them. A bureau must have the customer's consent before it discloses a report to a subscriber. In practice the customer downloads their own report and sends it to you, or gives written consent for a bureau report to be pulled for you.
What none of them show
- Income. No credit report states what a customer earns. That comes from payslips, bank statements and tax papers.
- Debts outside the reporting system. A loan from a lender that does not report, a private loan or money owed to family will not appear on any of them.
- Rejected applications. CCRIS leaves them out. A bureau can still show that a lender searched the customer.
- What the bank decided. The reports give facts. Bank Negara says it gives no opinion on creditworthiness, and the Registrar Office says the lender makes its own decision.
A report is also a snapshot. CTOS says CCRIS data in its report updates on the 10th of every month, so a copy pulled before the last 10th may be out of date. Ask for a fresh one when a file has sat for more than a month.
Which one to ask the customer for
If the question is what they owe and whether they pay on time, CCRIS answers it. It is free, and it is the source the bureaus copy. If the question is whether anything sits outside the banks, such as legal cases, trade debts or koperasi deductions, you need a CTOS or Experian report. If a lender asks for a score, ask which bureau's.
Most files are quicker to work from one report than from three. The CTOS analyzer on our homepage reads CTOS, eCCRIS and Experian PDFs in your browser, so you can use whichever the customer brings.
Questions people ask next
- Is CCRIS the same as CTOS?
- No. Bank Negara owns and manages CCRIS. CTOS, Experian and Credit Bureau Malaysia are credit reporting agencies registered by the Ministry of Finance. They may read CCRIS with the borrower's consent, and their reports can include more information than CCRIS holds.
- Does a rejected application show up on CCRIS?
- No. Bank Negara does not show rejected applications in CCRIS, so that one lender's decision does not prejudice another's. A bureau's search count can still show that lenders looked at you.
- Which report do banks use?
- It varies by bank. Bank Negara says lenders use CCRIS, and banks that subscribe to a bureau can ask for its report too. Each lender decides how to weigh them.
- Can a bureau blacklist me?
- No. Bank Negara and the Registrar Office of Credit Reporting Agencies both say no blacklist exists. A report is information for the lender, and the lender makes its own decision.
Sources
- Bank Negara Malaysia: CCRIS report (what it is, who can access, approved bureaus, myths)
- Bank Negara Malaysia: CCRIS FAQ
- Bank Negara Malaysia: eCCRIS user guide and FAQ (own report only, PDF password)
- Ministry of Finance: Registrar Office of Credit Reporting Agencies FAQ
- CTOS: CTOS credit report (contents, bands, price)
- CTOS: credit score report (basic and full report)
- CTOS: CTOS vs CCRIS
- CTOS: summary of rights under the Credit Reporting Agencies Act 2010
- Experian Malaysia: personal credit report and score
- Experian Malaysia: consumer products
- Credit Bureau Malaysia: FAQ
This guide is general information, not legal, tax or financial advice. Rules and bank policies change, so check the current position with the bank, the regulator or a professional before you act.