Guide

CCRIS vs CTOS: the two files a Malaysian bank opens before it says yes

Written by the Loankira editorial desk — Malaysian finance writers, every figure checked against BNM, LHDN, KWSP or PERKESO · Last reviewed: 3 October 2026

CCRIS is Bank Negara's central credit register of how you have serviced every loan month by month; CTOS is a private credit bureau that scores you from public and lender-supplied data.

Before any bank in Malaysia approves a loan, it looks at who you have been with money. Two reports tell that story: CCRIS, the central credit register run by Bank Negara Malaysia, and CTOS, a privately run credit bureau that adds what the courts know to what the banks know. Knowing what each one contains — and how a credit officer reads them — is the difference between a rejection you cannot explain and a plan you can execute.

What CCRIS and CTOS actually are

CCRIS (the Central Credit Reference Information System) is operated by Bank Negara Malaysia. Every bank and many licensed non-bank lenders report their borrowers' repayment data to it, and BNM compiles the results into a report on you. Because virtually every formal lender feeds CCRIS, it is the most complete picture of your borrowing from the banking system. It contains your personal details, every credit facility you have (loans, hire purchase, credit cards, overdrafts), the outstanding balance, the committed monthly payment, and a month-by-month record of how you paid over the past 12 months.

CTOS is a private credit bureau operated by CTOS Data Systems Sdn Bhd, licensed under Malaysian law. It draws on CCRIS data but also pulls in court records — bankruptcy, civil suits and recovery notices — plus company registry information. That means CTOS can show a civil judgment against you even if it came from a lender who never reported to CCRIS, and it can show your directorships and any bankruptcies.

The 12-month conduct table, line by line

The heart of the CCRIS report is a grid. Each row is one of your credit accounts; each column is a month; the cell is a single digit called the payment status. Zero means you paid on time. A 1 means you were one payment late that month, a 2 means two payments in arrears, and so on — larger digits and special codes mark deeper trouble such as legal action or a write-off (Bank Negara's eCCRIS explanatory note defines the digits as the number of instalments in arrears, and reports legal action and Special Attention Accounts in their own sections). Banks also flag restructured or rescheduled accounts with a special-service indicator, which is visible even when the current payment status is zero.

Read your own report the way a credit officer does: scan every column for anything that is not 0. A clean report is a wall of zeros. One stray "1" from a missed car instalment is a conversation; a run of "2"s, "3"s or worse is a rejection. Also check the account list from top to bottom for facilities you do not recognise — a forgotten card or an account opened in your name is worth finding here rather than at the bank counter.

How banks read it: the "2CP" rule of thumb

Bank credit policies are internal, but the market convention is remarkably consistent: many Malaysian banks treat "2CP" — two consecutive months in arrears on any account — as an automatic or near-automatic decline, and some apply a "3 in 6" variant (three late months in the last six). These cut-offs are each bank's internal policy, not a published rule, so ask the specific bank how it reads your report. That is why a single late month usually costs you nothing if the surrounding months are clean, while one missed PTPTN payment that quietly ran to three months can kill a home loan application even with a perfect salary. Restructured accounts raise a different flag: the bank sees you could not service the original terms, which matters even after you start paying the restructured amount on time.

Get your own report — it is free

CCRIS: individuals can obtain their own report free of charge through Bank Negara Malaysia's eCCRIS online portal, which returns a PDF, typically instantly. Register once with your MyKad details and you can pull a report anytime. Bank Negara's CCRIS FAQ states that the CCRIS report is currently free of charge, whether requested from Bank Negara or obtained through eCCRIS. CTOS: register for a basic self-report through CTOS's own channels; the free tier shows your core profile, while richer reports (scores, monitoring) are paid products. Check both before any major application — a loan officer sees both, and a surprise on CTOS you never knew about is the most common "why was I rejected" story. Checking your own reports does not hurt your credit standing in any way; banks do not treat your own enquiries against you.

Fixing a bad record: what works and what does not

First, the hard truth: nobody can delete accurate CCRIS data, not the bank, not BNM, not a "credit repair" agency that promises to. Any company charging to "scrub CCRIS" is running a scam. What you can do depends on what is wrong.

If the record is simply wrong — an account you never opened, a payment marked late that was actually on time — dispute it. Raise the dispute with the bank that reported it, and in parallel with CTOS if it shows there. Credit bureaux are legally obliged to investigate disputes and correct inaccurate data; banks must also correct what they reported. Keep proof (payment receipts, statements). Resolution typically takes days to a few weeks (CTOS says updates usually take three to five days once supporting documents are verified, and up to two weeks for complex cases; The Edge reports that under the Credit Reporting Agencies Act 2010 an agency must act on a correction request within 21 days).

If the record is accurate, you cannot erase the past — you outlive it. Settle or bring the arrears up to date immediately (settle in full where possible; "settled for less than the full amount" is itself a visible flag). Then keep every account current. The conduct window a bank judges you on is the most recent 12 months, so twelve consecutive clean months effectively resets how the table looks — the old arrears stop being part of the picture the credit officer scans. Court-related items take longer: a bankruptcy shows while undischarged and typically persists on records for a period after discharge (CTOS states that a bankruptcy record is removed two years after the date of full settlement, on receipt of a settlement or release letter, and that it updates the record within 14 working days of receiving that letter). If the arrears are too big to clear alone, go to AKPK — their debt counselling and debt management programmes are free, and a restructured plan repaid on time looks far better to a future lender than untreated arrears.

A worked example: clearing the way for a house

Ahmad earns RM5,000 net a month. His CCRIS shows three facilities: a car loan at RM650 a month, a credit card on a payment plan at RM450 a month, and a personal loan at RM300 a month. His card conduct shows a "2" in two months ago and a "1" in the month before — he lost track of one bill that snowballed into two missed payments, about RM1,600 in arrears on a RM6,200 balance.

1. Current commitments: 650 + 450 + 300 = RM1,400 a month. His DSR today: 1,400 ÷ 5,000 × 100 = 28%.
2. Action: he uses savings to settle the RM6,200 card balance in full and closes the card and its payment plan, so the arrears stop growing and the conduct digits start returning to 0 from this month.
3. New commitments: 650 + 300 = RM950 a month. New DSR: 950 ÷ 5,000 × 100 = 19% — comfortably inside the range most banks accept, per the DSR guide.
4. Timing: the "2" sits in the conduct table for 12 months. If every month from settlement onward is clean, by roughly this time next year the 12-month window a bank scans shows only zeros for that card.

Ahmad's sensible move is to apply for his home loan when the window is clean, not now — everything about his finances is fine except a two-month blemish that time itself will heal. If his PTPTN is also in arrears, the PTPTN repayment guide covers the repayment options, including automatic deduction that stops arrears recurring.

Common mistakes

Never checking your own report until a bank rejects you, then wasting months guessing why. Assuming CTOS and CCRIS show the same thing — the civil suit from an old tenancy dispute only shows on CTOS. Paying a "credit repair agent" instead of disputing free through the bank and bureau. Settling a debt and assuming the record updates overnight — the reporting cycle is monthly. Ignoring PTPTN because "it's not a bank" — PTPTN reports to CCRIS and is one of the most common sources of surprise arrears flags. And treating a restructured account as fully healed: it shows as restructured even while you pay on time, and some banks price that differently.

FAQ

Which one do banks look at — CCRIS or CTOS?

Most banks pull CCRIS as the primary record and increasingly also buy a CTOS report for the court and company data. You should assume both are read, and check both yourself before applying.

I paid off my arrears. When does the bad conduct disappear?

The arrears stop accruing immediately and payment status returns to 0 from the next reporting cycle. The late months stay visible in the conduct history until they roll out of the recent 12-month window — roughly a year of clean payments, counted from your last late month.

Does checking my own CCRIS or CTOS lower my score?

No. Self-enquiries are not treated like a bank's loan enquiry. Pull a report before any big application so nothing surprises you.

A bank confirmed my record is wrong but hasn't fixed it. What now?

Escalate in writing to the bank's customer service unit and, if it drags on, lodge a complaint with Bank Negara Malaysia's consumer complaints channel, keeping all reference numbers. If the item shows on CTOS, file the dispute with CTOS as well so both sources are corrected.

This guide is general information, not financial advice. Bank credit criteria vary and change, and record-retention rules differ between CCRIS and CTOS. Obtain your own reports through official channels (CCRIS free via BNM's eCCRIS; CTOS directly) and confirm details with the reporting institution.