CCRIS vs CTOS: the difference, how to check for free, and whether they're blacklists

Short answer. CCRIS is Bank Negara Malaysia's (BNM) credit information system. CTOS is a private credit reporting agency registered with the Ministry of Finance. Neither is a blacklist: the lender decides whether to lend, not BNM or CTOS. Your CCRIS report is free on eCCRIS, and the MyCTOS Basic report is free twice a year. Don't pay anyone for a "CTOS check" before a loan.

The difference between CCRIS and CTOS

Sources: BNM's CCRIS FAQ, BNM's CCRIS page, MOF's agency list, October 2026, MyCTOS sign-up page, the Registrar's FAQ.

Is either one a blacklist?

No, and both regulators say so plainly. BNM says CCRIS is not a blacklist system and that BNM doesn't blacklist anyone. Rejected applications aren't shown in a CCRIS report either (BNM FAQ, questions 1 and 37).

The Registrar of Credit Reporting Agencies says agencies like CTOS have no power to blacklist anyone, and calls the idea a wrong notion. A credit report is only lead information, and the final decision rests with the credit provider (Registrar's FAQ).

What about a "KPKT blacklist"?

KPKT's moneylender FAQ (in Malay) doesn't mention a borrower blacklist, CCRIS or CTOS, and we found no KPKT publication describing such a list. The i-KrediKom app checks companies, not borrowers: see how to check a licensed moneylender. What KPKT does mention is that licensed companies must send it annual transaction records (question 17). If someone claims your name is on a "KPKT blacklist" and asks for money to remove it, treat that as a warning sign and verify with KPKT on 03-8000 8000.

How to check your own report

CCRIS, through eCCRIS

1. If you have a MyKad and internet banking, register at eccris.bnm.gov.my. Verification uses an RM1 transfer, refunded automatically within two working days.
2. Without internet banking, register at a CCRIS kiosk at an Agensi Kaunseling dan Pengurusan Kredit (AKPK) office.
3. Log in and retrieve your report. It's free, with no limit on how often.

A report is only given to its owner. Your bank can't give it to you, and BNM won't give it over the phone (BNM FAQ).

CTOS, through MyCTOS

1. Open an account on the MyCTOS sign-up page with your name as on your MyKad, your IC number, email and phone number. You'll need to upload images of your IC.
2. Get the Basic report, free twice a year. It isn't the same as the MyCTOS Score report, which is the more detailed product.

Your rights as a licensed moneylender's borrower

The Credit Reporting Agencies Act 2010 lists moneylenders licensed under Act 400 as "credit providers" (Second Schedule, item 6). So if you apply to or borrow from a licensed company, you're a "customer" under this Act (Section 2), with rights against credit reporting agencies:

• Consent. An agency can't disclose your credit information without your consent, except to prevent or detect crime, for investigations, or where required by law or a court (Section 24).
• Knowing the source. If a credit provider takes unfavourable action against you based on a credit report, it must tell you, on request, which agency's report it used (Section 28).
• Access. An agency must respond to an access request within 21 days. A copy of the report may carry a prescribed fee (Section 30).
• Time limits. A repayment default can't be included two years after the date of final settlement, nor a bankruptcy two years after discharge (Section 25).

Whether a company checks credit reports is that company's own policy. Ask before you consent, and read what you sign. The Registrar says that if you withhold consent, an application at a financial institution may not be processed further. Approved agencies can also access your CCRIS report with your consent (BNM).

Fixing a wrong record

In CCRIS

BNM doesn't update records. The institution that reported them is responsible.

• Personal details (name spelling, date of birth): use the "Verify" button in eCCRIS with supporting documents. Feedback usually comes within 14 days.
• Account or application details: contact the institution directly. BNM says the eCCRIS channel for these disputes is temporarily unavailable because of a system upgrade.
• A loan you've settled: the institution updates the record by its next reporting date, no later than the 10th of the following month.

For help: BNMLINK on 1-300-88-5465 (BNM FAQ).

In CTOS or another agency

1. Send the agency a written correction request if the information is inaccurate, out of date, incomplete, irrelevant or misleading (Section 31). For CTOS: 03-2722 8833 or ctosid@ctos.com.my (CTOS Summary of Rights).
2. If a loan is settled, include the settlement letter from the lender. You can't have your record deleted simply on request (Registrar's FAQ).
3. An agency satisfied that the information is wrong must suppress it or mark it as disputed while correcting it, and tell you what it did within 21 days (Section 31(3) and (4)).
4. If that doesn't resolve it, complain in writing to the Registrar (Section 35) through the PPK complaint form (in Malay), or call 03-8890 6559 / 6560.

Don't pay for a "CTOS check"

A KPKT official has warned borrowers not to pay any deposit or advance on the pretext of a check at CTOS or Bank Negara, because it may be a scammer posing as a licensed company (Kosmo, July 2023, in Malay). KPKT lists only stamp duty and legal costs connected with the loan as charges a borrower can be asked to pay (question 8). See how to spot a licensed moneylender scam.

If your report shows arrears

BNM says your record will reflect the improved position once the account is regularised, though the number of instalments in arrears over the last 12 months still appears. Discuss a repayment plan with the institution. For help restructuring debt, BNM refers people to AKPK on 03-2616 7766.

Each lender decides for itself, so no report guarantees an approval or a rejection. This page explains the law, not any company's policy. Our own requirements are on the personal loan page.

FAQ

Am I blacklisted if I have a bad record in CCRIS or CTOS?

No. BNM says it doesn't blacklist anyone, and the Registrar of Credit Reporting Agencies says agencies like CTOS have no power to do so. A report is only information. Each lender makes its own decision.

Does KPKT keep a blacklist of borrowers?

KPKT's moneylender FAQ doesn't mention a borrower blacklist, and we found no KPKT publication describing one. The i-KrediKom app checks moneylending companies, not borrowers.

How long do records stay on a report?

A CCRIS report shows outstanding or active accounts, and the number of instalments in arrears over the last 12 months. For agencies like CTOS, Act 710 bars including a repayment default two years after the date of final settlement.

Does a licensed moneylender loan show up in CCRIS?

The list of participating institutions in BNM's FAQ doesn't name moneylenders, and KPKT's FAQ doesn't mention CCRIS. The surest way to know is to check your own report on eCCRIS and ask the company concerned.

Should I pay a loan company for a CTOS check?

No. A KPKT official has warned borrowers not to pay any deposit or advance on the pretext of a check at CTOS or Bank Negara, because it may be a scammer in disguise. You can get your own report directly from the source.