Most Malaysians meet their credit report for the first time in the worst possible way: a bank officer glances at a screen and says the application did not go through. By then it is too late to ask what was on it.
You can read the same file yourself, for free, before you apply. Here is exactly where it lives, what it costs, and what the rules actually say about correcting it.
The free report is the one the banks read
CCRIS, the Central Credit Reference Information System, is run by Bank Negara Malaysia. It is the file the participating financial institutions report into, and the one they pull when they assess you.
BNM's own page lists three ways to obtain it. The eCCRIS portal at eccris.bnm.gov.my is free for registered Malaysian citizens with internet banking. AKPK kiosks around the country are the walk-in route. The third route is through an approved credit reporting agency, and BNM notes plainly that those agencies may charge a fee for their services.
Registration used to mean turning up at a BNM or AKPK counter. Since BNM's announcement of 18 February 2022, a Malaysian individual can do the whole thing online at eccris.bnm.gov.my. Identity is confirmed by transferring RM1 to a designated BNM account through internet banking, and BNM states that the RM1 is automatically refunded within two working days of registration. Companies and non-Malaysian individuals still register through eLINK at telelink.bnm.gov.my.
Two things about that flow are worth knowing before you start it. The six-digit OTP that activates the account is valid for seven days, and if it expires you cannot regenerate it online — BNM's own guide sends you to an AKPK kiosk or to eLINK, which is exactly the counter trip the digital route was meant to save. And you get five OTP attempts per login session before the account locks, after which you reactivate it by answering your security questions. BNMTELELINK handles both, on 1-300-88-5465, or +603-2174 1717 from overseas, or by live chat at bnm.gov.my/livechat, 9am to 5pm Monday to Friday excluding public holidays.
What is actually in the file
BNM collects three categories of information from participating financial institutions.
- Your borrower profile: name, identity card or business registration number, date of birth or registration, address.
- Your credit applications: the amount applied for, the date of the application, the type of facility.
- Your credit accounts: the type of facility, the credit limit, the outstanding balance, the instalment amount, the conduct of the account and the legal action status.
The report shows financing and repayment history over the past 12 months as reported by those institutions. That window matters. A missed payment from three years ago is not in the current report; a missed payment from last quarter is.
One more limit BNM spells out on its own CCRIS page: only loans and financing from participating financial institutions, which include those regulated by BNM, are reported into CCRIS, and BNM adds that some credit institutions do not participate at all. So a clean CCRIS is not proof of a clean record everywhere. Lenders and the private agencies can, in BNM's words, collect more information about borrowers from sources other than CCRIS — which is exactly why the CTOS Basic Report below is worth claiming alongside it.
The three sections, and the one that stings
BNM's CCRIS FAQ names what you will actually see on the page. The report is split into Outstanding Credit, Special Attention Account, and Application for Credit — the last covering pending and approved applications from the past 12 months.
Outstanding Credit is the ordinary list: each active facility, with its limit, its balance, and what BNM describes as the number of instalments in arrears for the last 12 months. That arrears line, not the balance, is what a credit officer reads first.
Special Attention Account is the one worth understanding before you panic at the name. BNM defines it as impaired loans that the participating financial institution has placed under special monitoring, in view of recovering the loan or in the midst of collection. It is a lender's internal flag, not a regulator's verdict, and an account being handled under an AKPK arrangement can sit there too.
Here is the part most people get wrong. Clearing the arrears does not wipe the months that recorded them. BNM states that when an account is regularised, the regularised status appears in the current month of settlement — the earlier arrears months stay in the 12-month window and drop off one at a time as they age out. Settle in March and February's arrears are still on the report until the following February.
That is the strongest argument there is for reading your file early rather than at the counter. If you are planning a mortgage for June, you want to know in January what will still be visible by then.
It is not a blacklist, and there is no BNM score
Two beliefs cost Malaysians a lot of anxiety, and both regulators contradict them in writing.
BNM states that CCRIS only stores a borrower's financing details and repayment history and is not a list of names of borrowers with poor repayment history. It also produces no score. CCRIS is a record of transactions, not a verdict on you.
The Registrar Office of Credit Reporting Agencies, known as PPK, goes further about the private agencies. Its own FAQ says credit reporting agencies do not have the power to blacklist any individual on the basis of the reports they issue, and calls the notion of a credit reporting agency blacklisting a customer a wrong notion. Everything in a credit report, it says, serves only as lead information. The decision on your loan lies entirely with the financial institution.
The paid layer, and what you are actually buying
CTOS is the best known of the private agencies. Its own pricing page, read on 20 September 2026, splits into three products.
The Basic Report is free, two a year, and refreshes when you sign in. It carries personal information from the National Registration Department, directorship and business interest from SSM, litigation and bankruptcy records, and trade referee listings. It does not carry CCRIS records and it does not carry the CTOS Score.
The Full Credit Report with CCRIS and Score is RM27.90 per report, inclusive of SST. Everything in the Basic Report, plus the CTOS Score, plus CCRIS records from BNM.
SecureID is a subscription at RM9.90 a month with a three-month lock-in period, or RM99 a year. It bundles four credit reports a year with fraud alerts covering leaked personal information and dark web data breaches, new credit applications and account closures, and changes of address or contact details, plus missed payment alerts.
Read that list against the free one and the arithmetic is clear. The headline feature of the RM27.90 report is CCRIS, which BNM gives you at no charge. What you are genuinely paying for is the CTOS Score, which BNM does not produce, and the convenience of having both in one view.
The free Basic Report is still worth claiming, because it holds a layer CCRIS does not: litigation records, bankruptcy status and your SSM directorships. A bank sees both files. So should you.
Other registered agencies exist, and the older lists that still circulate are out of date. PPK's live register, read on 27 October 2026, names ten: CTOS Data Systems, Experian Information Services (Malaysia), Credit Bureau Malaysia, Dun & Bradstreet (D&B) Malaysia, FIS Data Reference, Omesti BI, CTOS Basis, MARC Data, MyData Infomatica and One Future Solutions, every one with a registration certificate valid until 14 September 2027. Each sets its own fees.
Only three of those ten can see your CCRIS file. BNM's CCRIS page lists Credit Bureau Malaysia, CTOS Data Systems and Experian Information Services (Malaysia) as the agencies approved to access CCRIS, and only with your consent. If another agency's report shows no CCRIS section, that is why — it is not a gap in your record.
What the CTOS Score actually means
If the score is the thing you are paying RM27.90 for, it is worth knowing what the number says. CTOS publishes the scale itself. It runs from 300 to 850, in six bands.
- Poor: 300 to 528
- Low: 529 to 650
- Fair: 651 to 696
- Good: 697 to 717
- Very Good: 718 to 743
- Excellent: 744 to 850
Notice the shape. The bands are wide at the bottom and narrow at the top, so a fifty-point move means very different things depending on where you start. Climbing from 560 to 610 keeps you inside Low. Climbing from 660 to 710 crosses two bands.
CTOS also publishes the distribution, and it is more reassuring than most people expect. Among credit-active Malaysians in 2025 the average score was 622 and the median 637 — both sitting inside the Low band. If your number comes back in the 600s you are not an outlier. You are the middle of the country.
CTOS lists six things that move the score, and ranks payment history first, calling it the most significant factor in your credit report. The other five are credit utilisation, length of credit history, legal and litigation and bankruptcy records, new credit applications, and the mix of credit you hold. Nothing on that list is a quick fix, which is the honest answer to every advertisement promising to lift a score in a month.
What the score is not is a cut-off. No lender publishes a threshold and CTOS does not set one. The number is an input to someone else's decision — the same thing PPK says about the report as a whole.
And the question everyone actually wants answered: no, checking your own report does not damage it. CTOS states that checking your own credit report through CTOS is a personal inquiry and has no impact on your CTOS Score. Only an application submitted to a lender triggers the kind of enquiry other lenders can see. Read your own file as often as you like.
Fixing an error, and who you have to talk to
This is where people waste months by writing to the wrong body. You do not have to guess, because eCCRIS has a dispute channel built into the report itself.
In the portal you click Verify on the report, select the disputed items, and submit a Data Verification request with your supporting documents attached. BNM's own user guide is specific about where each kind of dispute goes, and the split is not the one most people assume.
- A dispute about your borrower profile — name spelling, date of birth, pending verification status — is submitted to BNM. Attach a copy of your MyKad, or the relevant letter from Jabatan Pendaftaran Negara.
- A dispute about account details — anything under Outstanding Credit, Special Attention Account or Application for Credit — is submitted to the financial institution that reported it. Attach the release letter, or a letter from the institution.
So the familiar advice that BNM cannot fix it and only your bank can is right about your accounts and wrong about your profile. Incomplete attachments, BNM warns in both cases, simply delay the response.
Two separate clocks then run, and it is worth keeping them apart. Feedback on the dispute takes up to 14 days — BNM's eCCRIS user guide says 14 days while its CCRIS FAQ says 14 working days, so plan for the longer one. Separately, corrected data only appears in CCRIS on the 10th of the subsequent month, subject to public holidays. A correction agreed in early October will not show until 10 November. Plan a loan application around both, not one.
Track the case under MY REQUEST in the portal. When feedback arrives you can ask for more in the Remarks field or close the request yourself — and if you do nothing at all, the system closes it automatically after 30 days. That is the quiet way a dispute dies, so put the date in your calendar.
For a loan you have already settled that is still showing, PPK's guidance is specific: obtain a settlement letter from the financial institution that gave you the facility, then bring a copy of that letter to the relevant credit reporting agency for verification, and they will update the information.
For a bankruptcy that has been discharged, the Act does not allow a credit reporting agency to disclose an individual's bankruptcy status after two years from the date of discharge. If it is still showing past that point, bring the documentation to the agency to have the record updated.
What you cannot do is delete your record. PPK says so directly, and advises regular checks at each agency instead, to make sure what is there is accurate, complete and current.
Your rights, and the regulator nobody has heard of
PPK is an agency under the Ministry of Finance, established under the Credit Reporting Agencies Act 2010 — Act 710. It regulates the private credit reporting agencies. It does not supervise CCRIS, which sits with the central bank under the Central Bank of Malaysia Act 2009. That split is why complaints get sent to the wrong place.
Finding it is its own small obstacle. The Ministry of Finance portal lists it among its divisions as the Registrar Office of Credit Reporting Agencies, and that page is the dependable route. Its own site is at ppapk.treasury.gov.my — note the extra letters, because the ppk.treasury.gov.my that people guess at does not exist as a domain at all, The ppapk address was refusing connections on 20 September 2026 but was back up on 27 October, with the full agency register and FAQ. If it is down when you need it, go through the ministry portal. The office itself is at the Ministry of Finance Complex, No. 7 Persiaran Perdana, Precinct 2, Putrajaya, on 03-8890 6559 or 03-8890 6560.
Anyone carrying on a credit reporting business must register. Section 11 of the Act makes it an offence not to, and on conviction the penalty is a fine of up to one million ringgit, imprisonment of up to three years, or both.
You have the right to apply to a credit reporting agency to access your own report and verify that what is in it is accurate. PPK cannot get the report for you; you deal with the agency directly. PPK also has no power to direct a financial institution to approve your application, so no complaint to it will unlock a loan.
Two complaints PPK does investigate are worth knowing. If an agency discloses your credit report to a third party without your prior consent, you can complain and submit supporting evidence. If an agency misuses your credit information for marketing or cross-selling without your consent, and you have evidence, the same route applies.
One more thing to weigh before you refuse consent on a loan form. PPK states that if you do not give a credit reporting agency permission to disclose your report, there is a possibility the bank will not process your application further, because that information is an essential element of its creditworthiness assessment.
What to do, in order
Start with eCCRIS. Register online, download the report, and read the conduct of account column rather than the balances.
Then claim the free CTOS Basic Report for the litigation, bankruptcy and SSM layer that CCRIS does not hold. Two a year is enough for most people.
Only buy the RM27.90 Full Credit Report if you specifically want the score, or want both files side by side before a mortgage application.
If you find an error, raise it inside eCCRIS itself rather than by letter. Profile errors route to BNM, account errors route to the reporting bank, feedback comes back in about two weeks, and the corrected entry appears on the 10th of the following month. Close the loop before the system auto-closes it at 30 days.
And if a loan has genuinely gone bad, PPK's own advice is the unglamorous one: talk to the financial institution about a repayment scheme. The report improves when the account is back in order and payments are recorded on time, because the file only ever reflects what the institutions report.
