Getting a credit report while CTOS is unavailable

Your options at a glance

Part of CTOS's credit reporting services, including the CTOS Score and CCRIS-related reports, was reported unavailable after the incident announced on 23 September 2026. What CTOS has said, and what it has not is set out in a separate guide. While those reports are out of reach, a loan file can still be worked from another report. In every case the customer gets the report and sends you the PDF.

For a loan file, the banking section matters most. That is the part taken from CCRIS. Of the four reports above, eCCRIS is the CCRIS record itself, and MyScore and Experian Plus carry a banking section. Experian Basic does not.

How a customer gets a CCRIS report free from eCCRIS

eCCRIS is Bank Negara Malaysia's own service. The report can only be given to the person it is about, so the customer does the steps below and you receive the PDF. Registering comes first, and there are three routes:

• Malaysians with a MyKad and internet banking register online and transfer RM 1.00 for identity verification. It is refunded within 2 working days.
• Malaysians without internet banking register at an AKPK kiosk. AKPK has offices nationwide.
• Non-Malaysians and companies register through eLINK. A company appoints an authorised person to register. Bank Negara asks for a telco bill in the applicant's name.

After registering, the steps are the same for everyone.

1. 1

   Log in

   Log in with your user ID, password and the 6-digit authenticator code. Use MS Edge or Google Chrome for the first login. eCCRIS runs from 6:00 a.m. to 12:00 midnight, Monday to Friday, excluding public holidays.

2. 2

   Open ENQUIRY

   Choose 'Self Enquiry - Individual'.

3. 3

   Agree and request

   Tick 'I Agree', then click 'Report Enquiry'.

4. 4

   Download the PDF

   The PDF is protected by a password. The password is the enquiry date followed by the first 3 characters of the user ID. Bank Negara's example is 30Jan2018Ahm.

There is no limit on how often a customer can retrieve the report, so ask for a fresh one if the one you hold looks old.

Buying from Credit Bureau Malaysia or Experian

If the customer needs more than the CCRIS record, or cannot use eCCRIS, a paid report is the other route. Credit Bureau Malaysia (CBM) sells MyScore on creditbureau.com.my. It lists a sample PDF, so the customer can see the layout before paying. News reports said MyScore is also offered through partners: MyEG (July 2024) and Grab (February 2026). Check CBM's site for where to buy it today.

Experian Malaysia's page lists a free Basic report and a paid Plus report. The Basic report is free on sign-up but has no banking information. The Plus report adds it, and the Experian i-SCORE, for a fee. The page also lists a JagaMyID subscription, which includes Plus reports.

Two things help before the customer pays:

• Ask the customer to check that the report has a banking (CCRIS) section before they pay. The free Experian Basic report does not.
• Confirm the price on the provider's own page. The figures in the table are as we found them in October 2026.

The honest caveats

These options are real, but they are not a perfect substitute for a CTOS report. Three things to keep in mind.

• Availability can change. Whether the CCRIS sections at CBM and Experian are available today is not known. Check each provider's current notice first, so the customer does not pay for a report with a section missing. We have not seen a notice that eCCRIS is affected, but check that eccris.bnm.gov.my is working before you tell a customer to rely on it.
• A bank decides what it accepts. Whether a bank takes a given report is the bank's choice, and we cannot tell you what any bank will do. Ask before the customer pays for anything.
• Reports differ. Each one shows different things, as the table above shows. Read the date and the sections of the report you actually hold. CTOS, CCRIS and Experian: what each report is explains the overlap.

Handle the PDF as personal data

A credit report is personal data about the customer. What follows is general good practice, not a rule from a bureau. Keeping credit reports and IC copies safe has the full routine.

• Get the customer's consent first. Tell them which report you are asking for and that you will use it for this application only. Keep that in writing.
• Let the customer send it themselves. An eCCRIS report can only be given to the person it is about, so the customer should download it and send it to you.
• Send the password separately. If the PDF has a password, ask for it in a different message from the file.
• Keep one copy, in one place. Show it only to the people working on the case, and do not post it in a group chat.
• Delete it when you no longer need it. Remove copies from chat history and the downloads folder too.

Reading the report once you have it

Each report has its own layout. How to read a CTOS report walks through one section by section, and reading the CCRIS payment grid explains the month-by-month record in an eCCRIS report.

The NexFlows CTOS analyzer on our homepage reads a CTOS, eCCRIS or Experian PDF in your browser, and the PDF is never uploaded. It is not connected to CTOS or to any bureau, and it cannot fetch a report for you. It only reads the PDF the customer gives you.