CTOS vs CCRIS vs CBM: What's the Difference and Which One Matters?

Most Malaysians use "CCRIS" and "CTOS" interchangeably — as if they are two names for the same thing. They are not. CCRIS is a government database. CTOS is a private company listed on Bursa Malaysia. They hold different data, serve different purposes, and report on you in different ways.

And then there is CBM — Credit Bureau Malaysia — which most people have never heard of at all. CBM is a third credit information provider, jointly owned by Bank Negara Malaysia and Dun & Bradstreet, and it generates its own risk score that a growing number of organisations use to make decisions about you.

If you have ever been rejected for a loan and could not figure out why, part of the answer may sit in one of these three systems — possibly one you have never checked.

This guide breaks down all three: what each one is, what data it holds, how it scores you, and which ones you should actually be monitoring.

The Three Credit Information Providers at a Glance

Malaysia has three main sources of credit information on individuals:

CCRIS — the government's central credit database, run by Bank Negara Malaysia. It records factual borrowing data from every licensed lender in the country. No score, no interpretation — just the raw numbers.

CTOS — a private company (CTOS Digital Bhd, listed on Bursa Malaysia since 2021). CTOS pulls data from multiple sources — BNM, courts, trade creditors, utilities — and generates a credit score between 300 and 850.

CBM — Credit Bureau Malaysia Sdn Bhd, a joint venture between Bank Negara Malaysia and Dun & Bradstreet. CBM produces a statistical risk score between 0 and 100, where a higher score means lower risk. It is less well-known than CTOS but increasingly used by fintechs, ride-hailing platforms, and digital lenders.

Each one pulls from partially overlapping but distinct data sources. That means your profile can look different across all three — and a clean record in one does not guarantee a clean record in another.

Side-by-Side Comparison

Feature	CCRIS	CTOS	CBM
Operated by	Bank Negara Malaysia	CTOS Digital Bhd (Bursa-listed, private)	Credit Bureau Malaysia Sdn Bhd (BNM + D&B joint venture)
Type	Government central database	Private credit reporting agency	Semi-private credit bureau
Score range	No score — factual record only	300–850	0–100 (higher = lower risk)
Data sources	Licensed banks and financial institutions regulated by BNM	BNM data + court records + trade references + utilities + telcos + directorship records	BNM data + participating financial institutions + alternative data
Cost to check	Free via eCCRIS portal	MyCTOS Basic: free once/year. MyCTOS Score: RM27.90	RM19.44 via creditbureau.com.my
How to check	eccris.bnm.gov.my (MyKad + TAC verification)	ctosasiaonline.com (e-KYC registration)	creditbureau.com.my (online application)
Update frequency	Monthly (around the 15th)	Varies by data source — BNM data monthly, court records as filed	Varies — depends on reporting institution
What lenders see	Outstanding credit, payment conduct (0/1/2/3), special attention accounts, 12-month application history	Full credit report + CTOS Score + litigation + trade defaults + directorship	CBM Risk Score + credit summary + statistical risk assessment

The key takeaway from this table: CCRIS is the narrowest dataset (banks only, no score), CTOS is the broadest (banks + courts + trade + utilities + a score), and CBM sits in between with its own scoring model that emphasises statistical risk prediction.

CCRIS: The Government's Credit Transcript

CCRIS — the Central Credit Reference Information System — has been operated by Bank Negara Malaysia since 2001. Every commercial bank, Islamic bank, development financial institution, and licensed non-bank lender in Malaysia is required to report borrower data to CCRIS every month.

What CCRIS Records

Your CCRIS report contains three sections:

Outstanding Credit — every active credit facility under your name. This includes housing loans, personal loans, credit cards, hire purchase, overdraft, and trade financing. For each facility, CCRIS shows the lender name, facility type, approved limit, outstanding balance, and a 12-month repayment conduct history.

The repayment conduct is the part that matters most. Each month is marked:

• 0 — paid on time (or no payment due)
• 1 — one month overdue
• 2 — two months overdue
• 3 — three or more months overdue

A clean row of zeros tells a lender you are reliable. Even a single "1" can raise questions, and "2" or "3" entries will significantly weaken your application.

Special Attention Accounts — facilities classified as non-performing, typically 90 or more days overdue. This is the most damaging section. Once an account lands here, it stays until the arrears are fully settled and the lender updates BNM.

Credit Applications (Last 12 Months) — every time a lender pulls your CCRIS to assess an application, the inquiry is logged here with the date, institution name, facility type, and status (approved, pending, or rejected). Multiple applications in a short period can signal desperation to lenders, even though CCRIS itself assigns no judgment.

What CCRIS Does Not Do

CCRIS does not score you. It does not say you are "good" or "bad." It is a factual transcript — the financial equivalent of a university transcript that lists your grades without calculating a GPA. The lender interprets the data and makes its own decision.

CCRIS also does not include non-bank debts. If you owe money to a telco, a utility company, or a friend who sued you in court, none of that appears in CCRIS.

How to Check

Visit eccris.bnm.gov.my. You will need your MyKad number and a TAC sent to your registered mobile number. The report is free, available 24/7, and you can check it as often as you like.

For a full walkthrough, see our guide: What Is CCRIS in Malaysia?

CTOS: The Private Bureau with the Broadest Reach

CTOS Data Systems Sdn Bhd has been operating since 1990 and listed on Bursa Malaysia in 2021. It is the most widely recognised credit reporting agency in Malaysia, and when most people say "check my credit score," they mean their CTOS Score.

What CTOS Records

CTOS casts a much wider net than CCRIS. Its reports include:

• BNM/CCRIS data — the same borrowing data that sits in CCRIS, pulled from Bank Negara
• Court records — bankruptcy proceedings, litigation, court judgments (civil suits, winding-up petitions)
• Trade references — defaults reported by non-bank creditors such as telcos, internet providers, and utility companies
• Address and identity records — historical addresses, directorships, business interests
• CTOS Score — a proprietary credit score between 300 and 850

This broader scope is why your CTOS report can show problems that do not appear in CCRIS. An unpaid phone bill that went to collections, a court judgment from a landlord dispute, or a directorship in a company with bad debts — none of these show up in CCRIS, but they all land in CTOS.

CTOS Score Ranges

Score Range	Rating	What it means
697–850	Good to Excellent	Strong approval odds for most credit products
651–696	Fair	Approval possible, but may face higher interest rates or lower limits
529–650	Below Average	Approval difficult — lenders see elevated risk
300–528	Poor	Most mainstream lenders will decline the application

Score Factors

CTOS calculates its score based on five weighted components:

• Payment history (45%) — whether you pay on time, drawn primarily from CCRIS data
• Amounts owed (20%) — total outstanding debt relative to your approved limits (credit utilisation)
• Credit history length (15%) — how long you have been borrowing (longer is better)
• Credit mix (10%) — diversity of credit types (a healthy mix of revolving credit and instalment loans is preferred)
• New credit (10%) — recent applications and newly opened accounts (too many in a short period lowers the score)

Payment history dominates. If you do nothing else, paying every bill on time — even just the minimum — protects the single largest component of your score.

How to Check

Visit ctosasiaonline.com and register for an account using your MyKad, email, and mobile number. Identity verification uses e-KYC (photo of MyKad + selfie).

• MyCTOS Basic (free) — available once per calendar year under the Credit Reporting Agencies Act 2010. Includes your full report but not the numeric score.
• MyCTOS Score (RM27.90) — one-time purchase, includes the 300–850 score, score factors, and score simulation tools.

For the full step-by-step, see: How to Check Your CTOS Score for Free

CBM: The Third Bureau Most Malaysians Miss

Credit Bureau Malaysia Sdn Bhd (CBM) is a joint venture between Bank Negara Malaysia and Dun & Bradstreet (D&B), a global commercial data and analytics company. CBM has operated since 2008 but remains far less well-known than CTOS among consumers.

What Makes CBM Different

While CCRIS is a factual data repository and CTOS is a data-plus-score reporting agency, CBM focuses on statistical risk scoring. Its primary product is a credit risk score between 0 and 100, where a higher number indicates lower risk — the opposite direction to what most people expect if they are used to thinking about CTOS (where higher is also better, but the scale is 300–850).

CBM draws data from BNM and participating financial institutions but also incorporates alternative data sources and applies statistical modelling to predict the likelihood of default. This makes CBM particularly appealing to organisations that need to assess risk for individuals who may have thin credit files in the traditional banking system.

Who Uses CBM

CBM has gained traction in sectors outside traditional banking:

• Grab uses CBM data for driver partner screening and financial product eligibility
• MYEG integrates CBM checks into its online government services
• Fintech lenders — several digital lending platforms and BNPL providers use CBM risk scores alongside or instead of CTOS
• Insurers and telecoms — some use CBM for underwriting and credit assessment

If you work in the gig economy, drive for a ride-hailing platform, or apply for fintech lending products, there is a meaningful chance that CBM is part of the assessment — even if nobody told you so.

CBM Score Ranges

CBM uses a 0–100 scale. The scoring bands are not as widely published as CTOS ranges, but the general interpretation is:

Score Range	Risk Level	Meaning
75–100	Low risk	Strong creditworthiness — likely to be approved
50–74	Moderate risk	Acceptable but may warrant additional checks
25–49	High risk	Elevated probability of default — approval unlikely without mitigation
0–24	Very high risk	Severe credit concerns — most applications declined

How to Check

Visit creditbureau.com.my and apply for an individual credit report. The cost is RM19.44 (inclusive of SST). You will need your MyKad number and supporting identification.

The process is less streamlined than CTOS — there is no mobile app or instant e-KYC — but the report is typically available within a few business days.

Which One Do Lenders Check?

The short answer: it depends on the lender.

Most banks check CCRIS + CTOS. When you apply for a housing loan, car financing, personal loan, or credit card at any of the major banks (Maybank, CIMB, Public Bank, RHB, Hong Leong, etc.), the loan officer or automated system will pull both your CCRIS record and your CTOS report. CCRIS gives them the raw payment data. CTOS gives them the broader picture including court records and a score.

Some lenders also check CBM. This is more common among digital banks (like GXBank, Boost Bank, AEON Bank), fintech lenders, and BNPL platforms. CBM's statistical risk model is designed for faster, more automated decision-making — which suits digital-first platforms that process high volumes of smaller-value applications.

Non-bank organisations check selectively. A landlord running a tenant check might only use CTOS. A ride-hailing company might only use CBM. A telco offering a postpaid plan might check CTOS trade references.

Here is what this means for you: getting rejected at one institution does not necessarily mean your credit is universally bad. Different lenders weight different factors, check different systems, and apply different internal risk thresholds. A borrower who is declined at Bank A might be approved at Bank B — not because the data changed, but because Bank B interprets it differently or uses a different bureau.

That said, if your CCRIS shows late payments and your CTOS report includes court judgments, no amount of bureau-shopping will help. The fundamentals have to be sound.

What You Should Monitor — and How Often

Not every bureau needs equal attention. Here is a practical monitoring plan:

CCRIS — Check at Least Once a Year (Free)

CCRIS is the foundation. Every bank checks it. And it is completely free to access, with no limit on how often you can check.

At minimum, check your CCRIS once a year. If you are planning to apply for any form of financing in the next 3–6 months, check it before you apply. Look for:

• Payment conduct errors (a "1" that should be a "0")
• Facilities you do not recognise (possible fraud or reporting errors)
• Special Attention Account entries you thought were resolved

CTOS — Check Once a Year (Free Basic)

Use your free MyCTOS Basic report once per calendar year. If you are preparing for a major loan application — a home purchase, a car, a business loan — upgrade to MyCTOS Score (RM27.90) so you can see your actual score and understand which factors are helping or hurting.

Pay particular attention to:

• Court records or litigation you were not aware of
• Trade defaults from bills you may have forgotten about
• Directorship records for companies you are no longer involved with

CBM — Check If It Is Relevant to You

CBM is worth checking if you:

• Work in the gig economy (Grab, food delivery, freelance platforms)
• Are applying for fintech loans or BNPL services
• Have been declined by a digital bank and cannot figure out why
• Want a complete picture before a major financial decision

For most people with standard banking relationships, CCRIS and CTOS cover what matters. CBM becomes relevant when you are dealing with institutions that specifically use it — and the list of those institutions is growing.

Common Questions

Does checking my own score lower it?

No. When you check your own CCRIS, CTOS, or CBM report, it counts as a self-inquiry (also called a "soft inquiry"). Self-inquiries are not visible to lenders and do not affect your score in any way.

Only hard inquiries — when a lender checks your report as part of a credit application — are visible to other lenders. And even hard inquiries only stay on your CCRIS for 12 months.

Check your reports as often as you want. You are not hurting yourself.

Can I dispute errors on my report?

Yes, and you should — errors are more common than people think.

• CCRIS errors: Contact the bank or financial institution that reported the data. BNM does not correct data directly — the source institution must submit the correction. If the institution does not cooperate, you can escalate through BNM's BNMLINK channels.
• CTOS errors: Log in to your MyCTOS account and submit a dispute through the portal. You can also contact CTOS customer service directly. Under the CRA Act, CTOS must investigate and respond within a defined timeframe.
• CBM errors: Contact CBM directly through creditbureau.com.my. Provide supporting documentation for the correction you are requesting.

In all cases, keep records of your dispute — screenshots, reference numbers, emails. If the error affected a loan application, having a paper trail helps if you need to reapply.

My CTOS score dropped but my CCRIS is clean. How?

This happens more often than you would expect, and it confuses people because they assume CTOS and CCRIS contain the same data. They do not.

Your CTOS score can drop even with a clean CCRIS if:

• A court judgment was filed against you — even a small claims case or a civil suit you did not know about. This does not appear in CCRIS but lands directly in CTOS.
• A trade reference default was recorded — an unpaid telco bill, utility bill, or gym membership that was sent to collections and reported to CTOS by the creditor.
• You opened multiple new accounts recently — several credit card or loan applications in a short period can lower the "new credit" component of your score.
• Your credit utilisation jumped — if you maxed out a credit card, the "amounts owed" component takes a hit even if you are paying minimums on time.

The fix depends on the cause. Court judgments need to be resolved through the legal system. Trade defaults need to be settled with the reporting creditor. Utilisation issues resolve themselves once balances come down.

Is one bureau more "important" than the others?

For traditional bank lending (home loans, car loans, credit cards), CCRIS and CTOS are the two that matter most. No Malaysian bank will skip CCRIS — it is the central bank's own system. And CTOS has become so standard that most banks pull it automatically alongside CCRIS.

CBM is gaining ground, especially in digital banking and fintech. If this trend continues, CBM may become as routine as CTOS within a few years. For now, it is a must-check only if you are in the gig economy or fintech borrower segment.

None of the three is "better" or "more accurate" — they each serve a different purpose, use different methodologies, and draw from partially different data sources.

Key Takeaways

• CCRIS is BNM's factual credit database — no score, just raw data. Free to check at eccris.bnm.gov.my. Every bank uses it. Check at least once a year.
• CTOS is a private bureau that combines BNM data with court records, trade references, and utilities. It generates a score from 300–850. Free basic report once per year; full score costs RM27.90.
• CBM is a BNM/Dun & Bradstreet joint venture with a statistical risk score from 0–100. Used by fintechs, digital banks, and gig platforms. Costs RM19.44 to check.
• Most banks check CCRIS + CTOS. Digital banks and fintechs increasingly check CBM too.
• A clean record in one bureau does not guarantee a clean record in the others. Each pulls from different data sources. Check all three if you are preparing for a major financial decision.
• Self-inquiries do not affect your score. Check your reports freely and often — especially before applying for credit.
• Errors can and do happen. Dispute them promptly with the relevant bureau or source institution.