The short version
They are two separate records, kept by two separate kinds of organisation, under two separate laws.
Bank Negara Malaysia puts it directly: CCRIS is owned and managed by BNM, while CTOS, Credit Bureau Malaysia and Experian are credit reporting agencies registered by the Ministry of Finance under the Credit Reporting Agencies Act 2010.
That single sentence explains most of the confusion. One is a central bank system. The others are companies operating under a licence regime. They are not interchangeable, and neither of them is the thing that approves or rejects your application.
What CCRIS is
CCRIS stands for the Central Credit Reference Information System. Participating financial institutions report their borrowers' credit information into it, and BNM compiles that into a report you can pull about yourself.
When BNM introduced online access, it described the report as showing a borrower's financing and repayment history with participating financial institutions over the past 12 months, and stated that it does not provide an assessment of a borrower's credit standing — it is a factual report and not a blacklist.
The blacklist myth, settled. BNM addresses this head-on: CCRIS only stores a borrower's financing details and repayment history, and it is not a list of names of borrowers with poor repayment history. There is no CCRIS blacklist to be on or removed from. Anyone offering to "clear your name from CCRIS" for a fee is describing a service that cannot exist.
What CTOS is
CTOS is a private company, not a government body. By its own description it has operated since 1990 as a credit reporting agency under the purview of the Registrar Office of Credit Reporting Agencies at the Ministry of Finance, regulated under the Credit Reporting Agencies Act 2010.
A credit reporting agency compiles information from a range of sources into its own report, and typically presents a score alongside it. That is the practical difference in how the two feel to read: CCRIS gives you the facts as reported by financial institutions; a CRA report packages information and adds its own summary view.
CTOS is not the only registered agency. The Ministry of Finance's own material on the Registrar's role names several registered credit reporting agencies operating in Malaysia, so "CTOS" is often used loosely as shorthand for a whole category.
Why neither of them approves your loan
This is the part worth reading twice, because it changes what you should be doing.
The Ministry of Finance states the position plainly in its guidance on credit reporting agencies: CRAs are not involved in the credit decision-making of financial institutions. Credit reports provide the facts as reported, without a view on the creditworthiness of an individual, and the financial institution makes its own decision based on all the information available to it.
BNM says something similar about its own system — the CCRIS report does not assess your credit standing.
So the lender decides. The reports are inputs. Your income, your existing commitments, the product you applied for, and that particular bank's internal policy all sit alongside the report in the decision. Which is why no page anywhere — including this one — can tell you that a given report means approval. Anyone who promises you that is guessing, or selling.
Our guide to personal loan eligibility covers the other factors that go into the decision.
How to get your own reports
Your CCRIS report
BNM states that borrowers can access their credit reports online via eCCRIS for free. Start from BNM's own CCRIS page at bnm.gov.my/ccris and follow the link from there rather than typing a portal address you found elsewhere — this is an area where lookalike sites are worth avoiding.
On registration, BNM's position is that online registration applies to new Malaysian individual users who hold a MyKad and have an internet banking facility. For everyone else, the existing arrangements apply: registration via kiosk at AKPK premises, or online through BNMTELELINK.
For those registering online, BNM announced in February 2022 that identity is confirmed digitally through a one-off RM1 transfer to a designated BNM account, automatically refunded within two working days.
Your CTOS or other CRA report
The Ministry of Finance's guidance is that an individual may apply to a credit reporting agency to access their own credit report and verify the accuracy of what is reported — and that you have to deal directly with the registered agency to obtain it. There is no central government counter that hands out CRA reports on their behalf.
Check the current fees, free tiers and access methods with the agency itself. These are commercial products and their terms change; we won't quote figures here that might be out of date by the time you read this.
What to check before you apply
- Accounts you don't recognise. A facility you never opened is the first sign of identity misuse, and it is the single most important thing to catch early.
- Settled debts still showing as outstanding. Closure does not always get reported promptly.
- Your own details. Name spelling, IC number, addresses. Mixed-up files happen, particularly with common names.
- Applications you didn't make. Another identity-misuse signal.
- Repayment markers. Understand what is actually recorded against each facility before a lender asks you about it.
Doing this well before you apply, rather than the week of, gives you time to sort out anything wrong.
If something looks wrong
You have a right to raise it. CTOS summarises the position under the CRA Act 2010 as giving individuals the right to access, correct and dispute information held about them.
For a CCRIS entry
BNM's design routes this back to whoever reported the data. When it launched eCCRIS, BNM stated that users can lodge data verification requests directly through eCCRIS to the participating financial institutions, to verify and correct any inaccuracies identified in the report. The bank that reported it is the party that has to fix it.
For a CRA entry
Raise it with the agency directly, through whatever dispute channel it operates.
Be realistic about what a dispute can achieve. CTOS is candid about this on its own disputes page: you cannot remove every negative notation from your file, because agencies are obliged to report credit information as long as it is accurate and timely. What can be addressed is information that is wrong — an account you never opened, someone else's name, a judgment in a case you were not party to — or negative information that has become outdated.
A dispute is a mechanism for correcting errors. It is not a mechanism for deleting an accurate record of a missed payment.
On how long information stays
We are not going to give you a number. CTOS refers to "outdated" negative information as something that can be addressed, but we could not find a stated retention period from either BNM or the agencies in their published consumer material — and this is not a figure worth guessing at, because people make real decisions on it. Ask the agency directly about your specific entry, and treat any confident number you read elsewhere with suspicion unless it cites the source.
If the reports show more debt than you can manage
Pulling your reports sometimes confirms what you already suspected. If the total picture is heavier than your income can carry, the report is not the problem to solve — the debt is. Our guide to debt consolidation covers one route, and our loans overview explains how to compare what any of it actually costs.
AKPK, the agency set up under BNM, also provides credit counselling and debt management assistance, and appears in BNM's own material as one of the places you can obtain your CCRIS report in person.
Your checklist
- Pull your CCRIS report free via eCCRIS, starting from bnm.gov.my/ccris.
- If you cannot register online, use an AKPK kiosk or BNMTELELINK instead.
- Request your report from any credit reporting agency directly — check their current terms first.
- Read both for accounts, applications and personal details you do not recognise.
- Confirm that settled facilities show as settled.
- Dispute anything factually wrong: CCRIS entries through eCCRIS to the reporting institution, CRA entries with the agency.
- Accept that accurate negative entries will stay; plan around them rather than chasing removal.
- Do this months before a major application, not days before.
- Ignore anyone offering to clear your name from a CCRIS blacklist. There is no such list.
- Bank Negara Malaysia, CCRIS Report. Accessed 29 July 2026.
- Bank Negara Malaysia, Bank Negara Malaysia Introduces eCCRIS. Accessed 29 July 2026.
- Bank Negara Malaysia, eCCRIS Registration is Now Digital, 18 February 2022. Accessed 29 July 2026.
- Ministry of Finance Malaysia, FAQ — Registrar of Credit Reporting Agencies. Accessed 29 July 2026.
- CTOS, About CTOS. Accessed 29 July 2026.
- CTOS, Summary of Rights. Accessed 29 July 2026.
- CTOS, Disputes. Accessed 29 July 2026.