Two different systems, run by two different bodies, showing two different things. Most people confuse them.
When you apply for business financing, the bank will pull credit reports on the company and on the directors personally. In Malaysia that means CCRIS, and usually CTOS as well. They are frequently spoken about as if they were the same thing. They are not, they are run by different bodies under different laws, and they show different information.
Knowing what is on each of them before the bank looks is one of the cheapest pieces of preparation available, and it is free.
The Central Credit Reference Information System is operated by Bank Negara Malaysia. It is assembled from data that financial institutions are required to submit, so it is a record of your borrowing from the regulated financial sector.
A CCRIS report covers three broad areas:
The month by month conduct is the part credit officers read most closely. It is shown as a sequence of figures indicating how many months in arrears the account was at each point. A clean run tells a story. A run with occasional ones in it tells a different one, and a pattern of escalating figures tells a third.
Note that CCRIS is a factual record, not a score. There is no CCRIS rating and nobody passes or fails it. It presents the data and the bank forms its own view.
A company application results in CCRIS reports on the company and on each director. Personal facilities you hold, a car loan, a mortgage, a credit card, all appear and all count toward the total commitment the bank is assessing. Directors are routinely surprised that a personal facility affected a company application. It is not a mistake, it is how the assessment works.
CTOS is a private credit reporting agency. It operates under the Credit Reporting Agencies Act 2010, which regulates credit reporting businesses in Malaysia, and it is a commercial company rather than a regulator.
Because it draws on different sources, it shows different things. A CTOS report typically includes:
The litigation records are what catch SMEs out. A commercial dispute with a supplier that went to court years ago and was settled can still show, and if the bank sees it without explanation it becomes a question in the file. Other credit reporting agencies operate in Malaysia too, and a bank may use more than one.
| CCRIS | CTOS | |
|---|---|---|
| Run by | Bank Negara Malaysia | A private company |
| Source | Financial institutions, by mandatory submission | Public records, SSM, subscribers |
| Shows | Your borrowing and repayment conduct | Legal actions, company records, trade behaviour |
| Score | None | Yes, a commercial score |
| Governed by | BNM | Credit Reporting Agencies Act 2010 |
In short: CCRIS tells the bank how you have handled borrowing. CTOS tells it what else is on the record about you.
An application that is still being processed is one of the things a CCRIS report shows, and so is an application that was approved in the last 12 months. That is worth understanding before you decide to apply to several banks at once, because applications running in parallel can be seen together.
A cluster of applications in a short period tends to read to a credit officer as a business hunting for money, which invites the question of who else is looking at the file and why. It is not fatal, and there are legitimate reasons for it, but it changes the tone of the assessment and it is entirely avoidable.
Sequencing applications rather than scattering them is almost always the better approach. Where speed genuinely requires parallel applications, it is better to say so upfront than to let the bank discover it. This is one of the more common self-inflicted problems covered in why banks decline SME applications.
You are entitled to see what is held about you, and you should look before you apply rather than after you are declined.
For CCRIS, Bank Negara provides access to your own report through its eCCRIS service, and it is free. Company reports are obtained by an authorised person on the company’s behalf. For CTOS, you can obtain your own report directly from the agency, and the Credit Reporting Agencies Act 2010 gives you a right of access to information held about you.
Do this before you start an application, not during one. It takes very little time and it occasionally surfaces something you did not know about.
Errors happen, most often a facility that was settled still showing as outstanding, a record belonging to someone with a similar name or identity number, or a legal action that was withdrawn or decided in your favour still appearing without that outcome.
The correction route depends on which report it is on.
The point of looking is not to achieve a perfect record, which most real businesses do not have. It is to make sure nothing in the file surprises the bank, because an unexplained blemish is far more damaging than an explained one.
If there is a late payment run from a period when a major customer collapsed, say so upfront and show what changed. If there is a settled legal action, include the settlement. If a director carries heavy personal commitments, address how that sits alongside the company’s request. A credit officer who has to work out for themselves what a record means will generally assume the least favourable explanation, and they are not being unreasonable in doing so.
Alongside these reports, the bank will read your bank statements, which are often more decisive than either report. If you want a view of how your records are likely to read before you apply, check where you stand or talk to an adviser.
No. CCRIS is a factual record of your borrowing and repayment conduct compiled by Bank Negara from financial institution submissions. It does not produce a score and there is no pass mark. CTOS, which is a private credit reporting agency, does publish a score, but that is its own commercial product and not a regulatory rating.
Usually not on its own. Credit officers read patterns rather than single entries, and an isolated late month in an otherwise clean run is rarely decisive. A run of them, or a deteriorating trend, is a different matter. The more useful question is what the pattern says about the business, and whether you can explain it.
Retention periods differ between CCRIS and credit reporting agencies, and they have changed over time, so check the current position with the relevant body rather than relying on what was true a few years ago. As a practical matter, recent conduct carries far more weight with a credit officer than something from several years back.
Obtaining your own report is not a credit application and does not appear as one. Applications made to financial institutions are what get recorded. Checking your own position before you apply is sensible and costs you nothing.
If you want to work out what this means for your own application rather than in general, that is what the first conversation is for. It costs nothing and we will tell you if the answer is that you are not ready.
Six months of statements usually decide the application. Here is what a credit officer reads in them, and what six clean months looks like.
The six reasons credit officers actually decline SME files, whether each one can be fixed, and roughly how long fixing it takes.
Every document a Malaysian bank asks for, the question each one answers, and the four failures that cost applications the most time.