How Long Does Bad Credit Stay on Your Record in Malaysia? CCRIS, CTOS, AKPK and Bankruptcy

Most readers arrive at this question after a shock — a loan rejection, a card declined at the counter, a property purchase that stalled at the bank. The instinct is to reach for the simplest answer: "how long until this goes away?" And the answer they want is twelve months.

That answer is wrong, but the truth isn't a sentence either. Malaysian credit reporting is two separate systems with two separate retention rules — CCRIS CCRIS at Bank Negara, and CTOS CTOS as a private bureau — each storing different categories of data for different lengths of time. AKPK enrolment, bankruptcy, and court records are each their own special case.

The fair reading is that some things fade quickly, some things take years, and lenders weigh recent conduct far more heavily than old conduct even when both are technically visible. The harder reading is that timelines are usually longer than people hope, particularly for anything that touched the courts or the Insolvency Department.

CCRIS — How Long Each Record Type Stays

CCRIS is the Bank Negara database. Every BNM-regulated lender reports into it monthly. Within CCRIS, different sections of your file have different retention rules — which is where most of the confusion comes from.

Outstanding credit and repayment conduct

Active facilities — your current home loan, car loan, credit cards, personal loans — stay visible as long as they are open. The payment conduct grid shows the last 12 months of monthly conduct codes (0 for on-time, 1 for one month overdue, 2 for two months, 3 for three or more). Older months drop off the grid.

This is where the "12-month" myth comes from, and it's only true for this one section. If you missed a payment 14 months ago and have been clean since, that specific code is no longer in the visible grid. But the facility itself is still there, and so is everything else in your CCRIS file that has a different retention rule.

Closed facilities

When a loan is fully paid and the lender reports it closed, the facility moves into a separate section. Closed accounts typically remain visible on CCRIS for around 12 months after closure, then drop off entirely. This is one of the cleaner retention rules in the system — settle, close, and within a year the facility is no longer on the file.

Special Attention Accounts

This is the section most readers worry about. A Special Attention Account flag is triggered when a facility becomes non-performing — typically 90+ days overdue, though the exact trigger varies by product and lender. The flag stays as long as the lender reports the account as non-performing. It is not on a calendar timer.

Once the arrears are cleared and the lender updates BNM, the status changes — usually to "regularised" or, if the facility is closed, to "settled." The historical flag itself may still appear in conduct history within the 12-month rolling window, but the active flag is removed. Some lenders are slow to submit the regularisation update; this is one of the most common CCRIS dispute scenarios. If the flag persists after you've settled, contact the lender's credit administration department in writing.

Settled defaults

A facility that was previously in default but is now settled remains visible in the file but is coded as settled rather than active. Lenders interpret a settled default very differently from an open one — but it is still visible, and the historical conduct codes that preceded the settlement still sit in the 12-month grid until they roll off.

Credit application inquiries

Every time a lender pulls your CCRIS for an application, the inquiry is recorded. This section shows the last 12 months of inquiries — institution, facility type, status (approved, pending, rejected). Older inquiries drop off automatically. A flurry of recent inquiries — five or more applications in the last few months — is read by most lenders as a signal of financial stress, regardless of whether each one was approved.

CTOS — Court Records, Civil Cases and Defaults

CTOS is a different animal. It is operated by CTOS Data Systems Sdn Bhd, a private Bursa-listed company, and it sources data from a much wider field than just BNM-regulated lenders. CTOS adds:

• Court records (writs, summonses, judgments)
• Civil case filings
• Bankruptcy orders and discharges
• Trade references (commercial defaults reported by businesses)
• Directorships and corporate roles
• A proprietary credit score in the 300–850 range

CTOS retention is governed by the Credit Reporting Agencies Act 2010 (CRAA) framework. Under CRAA, credit reporting agencies in Malaysia generally retain negative data for periods of up to several years — and the specific retention rule depends on the category of data.

Court records and judgments

Civil judgments — bank suits, debt recovery actions, possession orders — are sourced from public court records and can remain visible on CTOS for up to 7 years from the date of action, even after the judgment is satisfied. A satisfied judgment is coded differently from an open one, but visibility persists. This is materially longer than anything in CCRIS, and it is the reason that court action against a borrower has compounding consequences long after the underlying debt is cleared.

Trade references and commercial defaults

A trade default reported by a supplier or commercial creditor — distinct from a bank facility — can also stay on CTOS for years under the CRAA framework. These typically affect business owners and directors more than salaried employees, but anyone who has acted as a guarantor for a commercial debt may find a trade reference attached to their file.

CTOS Score

The CTOS Score itself is a computed value, not a stored event, so it doesn't have a retention period in the same sense. It moves as the underlying data moves — clear a default, settle a judgment, build clean conduct, and the score improves over months and years. There is no manual "reset."

For the underlying mechanics of CCRIS versus CTOS, see What Is CCRIS in Malaysia. For the very common "I'm blacklisted" confusion, bank blacklist Malaysia — the truth is worth a few minutes.

AKPK Enrolment — How It Appears and How Long

AKPK's Debt Management Programme (DMP) is the most common formal restructuring path for over-indebted Malaysians, and the way it appears on CCRIS is widely misunderstood.

During the programme

Once you enrol in a DMP, AKPK negotiates a restructured repayment plan with your participating creditors. The facilities included in the DMP are flagged on CCRIS as being under AKPK management for the duration of the programme. This flag is visible to lenders and most major banks will not approve new credit while it is active — a reality you should plan around if you're enrolling.

A typical DMP runs 3 to 5 years, though longer programmes exist for larger debt loads. The flag stays for the whole period, and the conduct codes during the DMP reflect the restructured payment schedule, not the original one.

After graduation

When you complete all scheduled payments and graduate from the programme, AKPK closes the file with each creditor. The AKPK flag is removed from CCRIS once the lenders submit the closure update. The facilities themselves either become closed (if fully settled through the DMP) or revert to normal active reporting.

This is the moment many readers expect their credit to be "back to normal." It isn't, quite. The conduct history during the DMP remains visible in the 12-month rolling grid until those months roll off. The Special Attention history that preceded enrolment may also still be visible. Most major banks will not lend in the first 6 to 12 months after graduation; the realistic window for unsecured product approval is 12 to 24 months post-graduation, with secured products (home loans, hire purchase) often achievable earlier given supporting collateral and income.

For the full mechanics of how AKPK works and what enrolment actually involves, see the AKPK debt management programme guide. For what comes next, what happens after AKPK DMP covers the post-graduation rebuild in depth.

Bankruptcy — Pre and Post 2017 Amendments

Personal bankruptcy in Malaysia is governed by the Insolvency Act 1967, significantly reformed by the Insolvency (Amendment) Act 2017. The 2017 amendments meaningfully changed the timelines, so the answer to "how long does bankruptcy stay on my record" depends on when the bankruptcy order was made.

Bankruptcy orders after the 2017 amendments

Under the 2017 reforms, most personal bankrupts are eligible for automatic discharge after 5 years from the date of the bankruptcy order, provided they have cooperated with the Director General of Insolvency (DGI), submitted required statements of affairs, and met basic conditions. The automatic discharge mechanism was a deliberate response to the previous regime, under which discharge could take a decade or more and required either DGI consent or court application.

Discharge means you are no longer legally a bankrupt. Most restrictions lift — you can hold directorships again (with limits), travel without DGI permission, and so on.

What stays visible after discharge

This is where readers are often surprised: discharge is not deletion.

• MdI deregistration: The Malaysian Department of Insolvency removes your name from the active bankrupt list after discharge. The MdI bankruptcy search at search.mdi.gov.my no longer returns you as a current bankrupt.
• CTOS retention: The bankruptcy record itself remains visible on CTOS for several years after discharge — typically in line with the CRAA framework for negative records, up to roughly 7 years from the bankruptcy order date depending on how the discharge is coded. The record is updated to show the discharge, but the historical event remains on the file.
• CCRIS: Historical facilities that contributed to the bankruptcy — defaulted loans, settled-via-DMP facilities, Special Attention history — follow their own CCRIS retention rules. Many of these facilities are closed by the time of bankruptcy, so they tend to drop off CCRIS faster than the bankruptcy record drops off CTOS.

Practical credit rebuild after discharge

Most major banks will not lend to a recently discharged bankrupt. The realistic rebuild window starts after discharge, not at discharge — and it typically involves small secured products (a secured credit card, a small hire purchase with substantial deposit) before larger unsecured facilities become accessible. A clean 24-month conduct history post-discharge is roughly the minimum threshold for serious lender reconsideration on unsecured products.

For step-by-step rebuild tactics that work in this window, see rebuilding credit after default.

Pre-2017 bankruptcies

If the bankruptcy order pre-dates the 2017 amendments, the older discharge framework may apply — discharge by DGI certificate, by court order, or by lapse of time without automatic eligibility. The CTOS retention rules apply similarly, but the route to discharge itself is different. Anyone in this position should consult MdI directly or a licensed insolvency practitioner; this is not territory for self-help reading.

What Lenders Actually Look At (vs What's Visible)

Here is the gap that most credit-anxiety conversations miss: what's on your file and what a lender weighs are not the same thing.

A modern Malaysian bank's underwriting model heavily weights recent conduct — typically the last 6 to 24 months — and progressively discounts older events. A four-year-old default that's been settled, followed by four years of clean repayment on a small secured card, is a very different application from a six-month-old default settled last week. Both may be visible on CTOS. The underwriting weight is dramatically different.

This is why timelines like "5 years" or "7 years" can sound discouraging but aren't quite the whole story. The visibility period and the practical-impact period are different things:

The right read is not "I have to wait the full visibility window." The right read is "the older the event, the lighter the weight — provided what I'm doing now is clean."

This cuts both ways. If you have a clean 5-year history and one missed payment three months ago, the recent miss carries disproportionate weight in the assessment because it's recent. Recency works for you and against you with the same logic.

How to Plan a Realistic Rebuild

If you're starting from a damaged file, here is the rough trajectory based on how lenders actually weigh recent conduct:

Months 0–6. Stabilise. Every active facility paid on time, every month. Auto-debits from a buffered account. No new credit applications in this window — new inquiries on top of existing damage make the file look worse.

Months 6–12. First signs of differentiation in the 12-month conduct grid. Some lenders may consider small secured products in this window — a secured credit card, a small hire purchase with substantial deposit.

Months 12–24. Conduct grid is now majority clean if you've held the line. Unsecured products start becoming accessible, particularly with lenders you already have a relationship with. AKPK graduates often see meaningful options open in the back half of this window.

Months 24–36. Clean 24-month grid plus the natural roll-off of older events means the file is materially different from where it started. Most lenders are willing to engage seriously on most product categories, provided income and DSR support the application. Post-bankruptcy applicants typically need to be in this window before serious unsecured options reappear.

None of this is automatic. A single missed payment at month 14 doesn't reset the whole rebuild, but it does cost ground on that specific facility's conduct code.

Use the debt service ratio calculator before applying for anything — applying for credit your DSR can't support generates a rejection that adds an inquiry to the file without producing the credit. And if your current situation isn't stable enough to even start the rebuild, talk to AKPK first — counselling is free, and they will tell you honestly whether a DMP or a different path makes more sense.

Key Takeaways

• CCRIS retention is mostly 12 months for the conduct grid and inquiries, around 12 months post-closure for closed facilities, and until the lender updates for Special Attention flags.
• CTOS retention is much longer — typically up to 7 years for court records, judgments, defaults and bankruptcy under the CRAA framework — but settled events are coded as settled, which carries materially less weight than open ones.
• AKPK enrolment is flagged for the duration of the DMP (3–5 years typical), then the flag is removed on graduation. Practical rebuild window is 12–24 months post-graduation.
• Bankruptcy is eligible for automatic discharge after 5 years under the 2017 amendments, but the record stays visible on CTOS for years afterwards. Practical credit rebuild starts after discharge, not at discharge.
• Lenders weight recent conduct heavily and discount older events progressively. A 4-year-old settled default with 4 years of clean repayment behind it reads very differently from a 6-month-old one.
• A realistic rebuild trajectory is 12 months for early signs, 24 months for unsecured-product re-access, 36+ months for materially diminished weight of older events.
• Nothing on CCRIS or CTOS is permanently sealed against time — but nothing is gone in twelve months either.