CTOS vs CCRIS vs CBM: What's the Difference and Which One Matters?

Most Malaysians use "CCRIS" and "CTOS" interchangeably — as if they are two names for the same thing. They are not. CCRIS is a government database. CTOS is a private company listed on Bursa Malaysia. They hold different data, serve different purposes, and report on you in different ways.

And then there is CBM — Credit Bureau Malaysia — which most people have never heard of at all. CBM is a third credit information provider, jointly owned by Sunway Holdings and Credit Guarantee Corporation (CGC), and it generates its own risk score that a growing number of organisations use to make decisions about you.

If you have ever been rejected for a loan and could not figure out why, part of the answer may sit in one of these three systems — possibly one you have never checked.

This guide breaks down all three: what each one is, what data it holds, how it scores you, and which ones you should actually be monitoring.

The Three Credit Information Providers at a Glance

Malaysia has three main sources of credit information on individuals:

CCRIS — the government's central credit database, run by Bank Negara Malaysia. It records factual borrowing data from every licensed lender in the country. No score, no interpretation — just the raw numbers.

CTOS — a private company (CTOS Digital Bhd, listed on Bursa Malaysia since 2021). CTOS pulls data from multiple sources — BNM, courts, trade creditors, utilities — and generates a credit score between 300 and 850.

CBM — Credit Bureau Malaysia Sdn Bhd, jointly owned by Sunway Holdings and Credit Guarantee Corporation (CGC). CBM produces a statistical risk score between 0 and 100, where a higher score means lower risk. It is less well-known than CTOS but increasingly used by fintechs, ride-hailing platforms, and digital lenders.

Each one pulls from partially overlapping but distinct data sources. That means your profile can look different across all three — and a clean record in one does not guarantee a clean record in another.

Side-by-Side Comparison

The key takeaway from this table: CCRIS is the narrowest dataset (banks only, no score), CTOS is the broadest (banks + courts + trade + utilities + a score), and CBM sits in between with its own scoring model that emphasises statistical risk prediction.

CCRIS: The Government's Credit Transcript

CCRIS — the Central Credit Reference Information System — has been operated by Bank Negara Malaysia since 2001. Every commercial bank, Islamic bank, development financial institution, and licensed non-bank lender in Malaysia is required to report borrower data to CCRIS every month.

What CCRIS Records

Your CCRIS report contains three sections:

Outstanding Credit — every active credit facility under your name. This includes housing loans, personal loans, credit cards, hire purchase, overdraft, and trade financing. For each facility, CCRIS shows the lender name, facility type, approved limit, outstanding balance, and a 12-month repayment conduct history.

The repayment conduct is the part that matters most. BNM labels the column "Instalment in Arrears for Last 12 Months", and the figure in each month is a count of instalments you are behind — not a capped code:

• 0 — paid on time (or no payment due)
• 1 — one instalment in arrears
• 2 — two instalments in arrears
• 4, 5 and higher — the count keeps going; BNM's own explanatory notes give the series as "0 (no arrears), 1 (1 instalment in arrears), 2 (2 instalments in arrears) etc.", and its sample report shows a facility running 5, 4, 3, 2, 1, 0 across consecutive months

So a "3" means three instalments behind, not "three or more". A clean row of zeros tells a lender you are reliable. Even a single "1" can raise questions, and anything from "2" upwards will significantly weaken your application.

Special Attention Accounts — facilities BNM describes as "impaired loans that the participating financial institution has placed under special monitoring", typically 90 or more days overdue. This is the most damaging section. Once an account lands here, it stays until the arrears are fully settled and the lender updates BNM.

Credit Applications (Last 12 Months) — every time a lender pulls your CCRIS to assess an application, the application is logged here with the date, institution name, facility type, and status. Bank Negara's own explanatory notes describe this section as "approved credit applications or applications pending for decisions, made over the last 12 months period" — so the two statuses you will see are approved and pending. A declined application does not sit here marked "rejected"; it simply stops appearing. Multiple applications in a short period can signal desperation to lenders, even though CCRIS itself assigns no judgment.

What CCRIS Does Not Do

CCRIS does not score you. It does not say you are "good" or "bad." It is a factual transcript — the financial equivalent of a university transcript that lists your grades without calculating a GPA. The lender interprets the data and makes its own decision.

CCRIS also does not include non-bank debts. If you owe money to a telco, a utility company, or a friend who sued you in court, none of that appears in CCRIS.

How to Check

Visit eccris.bnm.gov.my. You will need your MyKad number and a TAC sent to your registered mobile number. The report is free, available 24/7, and you can check it as often as you like.

For a full walkthrough, see our guide: What Is CCRIS in Malaysia?

CTOS: The Private Bureau with the Broadest Reach

CTOS Data Systems Sdn Bhd has been operating since 1990 and listed on Bursa Malaysia in 2021. It is the most widely recognised credit reporting agency in Malaysia, and when most people say "check my credit score," they mean their CTOS Score.

What CTOS Records

CTOS casts a much wider net than CCRIS. Its reports include:

• BNM/CCRIS data — the same borrowing data that sits in CCRIS, pulled from Bank Negara
• Court records — bankruptcy proceedings, litigation, court judgments (civil suits, winding-up petitions)
• Trade references — defaults reported by non-bank creditors such as telcos, internet providers, and utility companies
• Address and identity records — historical addresses, directorships, business interests
• CTOS Score — a proprietary credit score between 300 and 850

This broader scope is why your CTOS report can show problems that do not appear in CCRIS. An unpaid phone bill that went to collections, a court judgment from a landlord dispute, or a directorship in a company with bad debts — none of these show up in CCRIS, but they all land in CTOS.

CTOS Score Ranges

Score Factors

CTOS calculates its score based on five weighted components:

• Payment history (45%) — whether you pay on time, drawn primarily from CCRIS data
• Amounts owed (20%) — total outstanding debt relative to your approved limits (credit utilisation)
• Credit history length (7%) — how long you have held a credit facility (longer is better)
• Credit mix (14%) — types of credit you hold, secured (home, car) versus unsecured (cards, personal loans)
• New credit (14%) — recent applications and newly opened accounts (too many in a short period lowers the score)

Note the last three: CTOS weights credit mix and new credit at double the weight of history length. That is a genuine difference from the US FICO model, where the same three sit at roughly 15/10/10 — a set of numbers widely and wrongly quoted as Malaysian.

Payment history dominates. If you do nothing else, paying every bill on time — even just the minimum — protects the single largest component of your score.

How to Check

Visit ctoscredit.com.my and register for an account using your MyKad, email, and mobile number. Identity verification uses e-KYC (photo of MyKad + selfie).

• MyCTOS Basic (free) — CTOS gives you two free Basic reports a year. Important: Basic is the "without CCRIS and score" product. It covers your personal information, directorships and business interests, litigation and bankruptcy records, and trade referee listings — but not your CCRIS data and not the numeric score. If you are trying to check your repayment conduct, the free report will not show it.
• MyCTOS Score (RM27.90) — one-time purchase, includes the 300–850 score, score factors, and score simulation tools.

For the full step-by-step, see: How to Check Your CTOS Score for Free

CBM: The Third Bureau Most Malaysians Miss

Credit Bureau Malaysia Sdn Bhd (CBM) has operated since 2008, when it was founded by Credit Guarantee Corporation Malaysia (CGC) and Dun & Bradstreet (D&B) as the country's first SME credit bureau. In 2020, Sunway Holdings acquired a 51% stake, so CBM is now jointly owned by Sunway Holdings and CGC. It remains far less well-known than CTOS among consumers.

What Makes CBM Different

While CCRIS is a factual data repository and CTOS is a data-plus-score reporting agency, CBM focuses on statistical risk scoring. Its primary product is a credit risk score between 0 and 100, where a higher number indicates lower risk — the opposite direction to what most people expect if they are used to thinking about CTOS (where higher is also better, but the scale is 300–850).

CBM draws data from BNM and participating financial institutions but also incorporates alternative data sources and applies statistical modelling to predict the likelihood of default. This makes CBM particularly appealing to organisations that need to assess risk for individuals who may have thin credit files in the traditional banking system.

Who Uses CBM

CBM has gained traction in sectors outside traditional banking:

• Grab uses CBM data for driver partner screening and financial product eligibility
• MYEG integrates CBM checks into its online government services
• Fintech lenders — several digital lending platforms and BNPL providers use CBM risk scores alongside or instead of CTOS
• Insurers and telecoms — some use CBM for underwriting and credit assessment

If you work in the gig economy, drive for a ride-hailing platform, or apply for fintech lending products, there is a meaningful chance that CBM is part of the assessment — even if nobody told you so.

CBM Score Ranges

CBM uses a 0–100 scale where a higher score means lower risk. Its individual score (MySCoRE) shows a rating word alongside your number — an 85, for example, is marked "Very Good" — but CBM does not publish a full public table of band thresholds the way CTOS does. So we will not put exact cut-off numbers on the scale; treat it as a relative signal, with higher meaning lower risk. See the CBM score guide for the detail.

How to Check

Visit creditbureau.com.my and apply for an individual credit report. The cost is RM19.44 (inclusive of SST). You will need your MyKad number and supporting identification.

The process is less streamlined than CTOS — there is no mobile app or instant e-KYC — so expect it to take longer. CBM publishes no turnaround commitment, so we do not quote one.

Which One Do Lenders Check?

The short answer: it depends on the lender.

Most banks check CCRIS + CTOS. When you apply for a housing loan, car financing, personal loan, or credit card at any of the major banks (Maybank, CIMB, Public Bank, RHB, Hong Leong, etc.), the loan officer or automated system will pull both your CCRIS record and your CTOS report. CCRIS gives them the raw payment data. CTOS gives them the broader picture including court records and a score.

Some lenders also check CBM. This is more common among digital banks (like GXBank, Boost Bank, AEON Bank), fintech lenders, and BNPL platforms. CBM's statistical risk model is designed for faster, more automated decision-making — which suits digital-first platforms that process high volumes of smaller-value applications.

Non-bank organisations check selectively. A landlord running a tenant check might only use CTOS. A ride-hailing company might only use CBM. A telco offering a postpaid plan might check CTOS trade references.

Here is what this means for you: getting rejected at one institution does not necessarily mean your credit is universally bad. Different lenders weight different factors, check different systems, and apply different internal risk thresholds. A borrower who is declined at Bank A might be approved at Bank B — not because the data changed, but because Bank B interprets it differently or uses a different bureau.

That said, if your CCRIS shows late payments and your CTOS report includes court judgments, no amount of bureau-shopping will help. The fundamentals have to be sound.

What You Should Monitor — and How Often

Not every bureau needs equal attention. Here is a practical monitoring plan:

CCRIS — Check at Least Once a Year (Free)

CCRIS is the foundation. Every bank checks it. And it is completely free to access, with no limit on how often you can check.

At minimum, check your CCRIS once a year. If you are planning to apply for any form of financing in the next 3–6 months, check it before you apply. Look for:

• Payment conduct errors (a "1" that should be a "0")
• Facilities you do not recognise (possible fraud or reporting errors)
• Special Attention Account entries you thought were resolved

CTOS — Two Free Basic Reports a Year

Use your two free MyCTOS Basic reports each year — remembering they exclude your CCRIS data and your score. If you are preparing for a major loan application — a home purchase, a car, a business loan — upgrade to MyCTOS Score (RM27.90) so you can see your actual score and understand which factors are helping or hurting.

Pay particular attention to:

• Court records or litigation you were not aware of
• Trade defaults from bills you may have forgotten about
• Directorship records for companies you are no longer involved with

CBM — Check If It Is Relevant to You

CBM is worth checking if you:

• Work in the gig economy (Grab, food delivery, freelance platforms)
• Are applying for fintech loans or BNPL services
• Have been declined by a digital bank and cannot figure out why
• Want a complete picture before a major financial decision

For most people with standard banking relationships, CCRIS and CTOS cover what matters. CBM becomes relevant when you are dealing with institutions that specifically use it — and the list of those institutions is growing.

Common Questions

Does checking my own score lower it?

No. Checking your own CCRIS, CTOS, or CBM report is a self-check, and a self-check is not an application for credit — so there is nothing for CCRIS's Application for Credit section to record. (Malaysia has no "hard" or "soft" inquiry; those are American terms our bureaux do not use.)

What other lenders do see is your credit applications — and those stay in the Application for Credit section of your CCRIS for 12 months before rolling off.

Check your reports as often as you want. You are not hurting yourself.

Can I dispute errors on my report?

Yes, and you should — errors are more common than people think.

• CCRIS errors: Contact the bank or financial institution that reported the data. BNM does not correct data directly — the source institution must submit the correction. If the institution does not cooperate, you can escalate through BNM's BNMLINK channels.
• CTOS errors: Log in to your MyCTOS account and submit a dispute through the portal. You can also contact CTOS customer service directly. Under the CRA Act, CTOS must investigate and respond within a defined timeframe.
• CBM errors: Contact CBM directly through creditbureau.com.my. Provide supporting documentation for the correction you are requesting.

In all cases, keep records of your dispute — screenshots, reference numbers, emails. If the error affected a loan application, having a paper trail helps if you need to reapply.

My CTOS score dropped but my CCRIS is clean. How?

This happens more often than you would expect, and it confuses people because they assume CTOS and CCRIS contain the same data. They do not.

Your CTOS score can drop even with a clean CCRIS if:

• A court judgment was filed against you — even a small claims case or a civil suit you did not know about. This does not appear in CCRIS but lands directly in CTOS.
• A trade reference default was recorded — an unpaid telco bill, utility bill, or gym membership that was sent to collections and reported to CTOS by the creditor.
• You opened multiple new accounts recently — several credit card or loan applications in a short period can lower the "new credit" component of your score.
• Your credit utilisation jumped — if you maxed out a credit card, the "amounts owed" component takes a hit even if you are paying minimums on time.

The fix depends on the cause. Court judgments need to be resolved through the legal system. Trade defaults need to be settled with the reporting creditor. Utilisation issues resolve themselves once balances come down.

Is one bureau more "important" than the others?

For traditional bank lending (home loans, car loans, credit cards), CCRIS and CTOS are the two that matter most. No Malaysian bank will skip CCRIS — it is the central bank's own system. And CTOS has become so standard that most banks pull it automatically alongside CCRIS.

CBM is gaining ground, especially in digital banking and fintech. If this trend continues, CBM may become as routine as CTOS within a few years. For now, it is a must-check only if you are in the gig economy or fintech borrower segment.

None of the three is "better" or "more accurate" — they each serve a different purpose, use different methodologies, and draw from partially different data sources.

Key Takeaways

• CCRIS is BNM's factual credit database — no score, just raw data. Free to check at eccris.bnm.gov.my. Every bank uses it. Check at least once a year.
• CTOS is a private bureau that combines BNM data with court records, trade references, and utilities. It generates a score from 300–850. Two free basic reports a year (no CCRIS, no score); full score costs RM27.90.
• CBM is jointly owned by Sunway Holdings and Credit Guarantee Corporation (CGC), with a statistical risk score from 0–100. Used by fintechs, digital banks, and gig platforms.
• Most banks check CCRIS + CTOS. Digital banks and fintechs increasingly check CBM too.
• A clean record in one bureau does not guarantee a clean record in the others. Each pulls from different data sources. Check all three if you are preparing for a major financial decision.
• Checking your own report is not an application. Check your reports freely and often — especially before applying for credit.
• Errors can and do happen. Dispute them promptly with the relevant bureau or source institution.