CCRIS Consent Form (Malaysia)
CCRIS CREDIT DATA CONSENT FORM
Central Bank of Malaysia Act 2009 | Financial Services Act 2013 | Personal Data Protection Act 2010
Date: [Consent Date]
SUBJECT DETAILS
Full Name: [Subject Full Name]
NRIC / Passport / SSM No.: [Subject ID Number]
Date of Birth: [Subject Date Of Birth]
Address: [Subject Address]
FINANCIAL INSTITUTION
Institution: [Institution Name]
Licence Type: [Institution Licence]
Purpose of Access: [Purpose Of Access]
Facility Applied For: [Facility Type]
CONSENT AND AUTHORISATION
I/We, [Subject Full Name] (NRIC / Passport / SSM No.: [Subject ID Number]), hereby consent to [Institution Name] (a financial institution licensed under [Institution Licence]) accessing my/our credit information from the Central Credit Reference Information System (CCRIS) maintained by Bank Negara Malaysia (BNM) under the Central Bank of Malaysia Act 2009.
The purpose of this access is: [Purpose Of Access] in relation to [Facility Type].
I/We understand that CCRIS contains information on my/our outstanding credit facilities, repayment performance, and recent credit applications submitted by financial institutions licensed under the Financial Services Act 2013 (FSA 2013), the Islamic Financial Services Act 2013 (IFSA 2013), and development financial institutions under the Development Financial Institutions Act 2002 (DFIA 2002).
I/We consent to [Institution Name] collecting, processing, and retaining this CCRIS data in accordance with the Personal Data Protection Act 2010 (PDPA 2010), solely for the stated purpose. I/We acknowledge my/our right to access my/our own CCRIS data through BNM's eCCRIS portal at ecredex.bnm.gov.my, free of charge.
Subject Signature: _______________________________
Name: _______________________________
NRIC / SSM No.: _______________________________
Date: _______________________________
FOR INSTITUTION USE ONLY
CCRIS Access Date: _______________________________
Accessed by (Staff Name & ID): _______________________________
Branch / Department: _______________________________
Subject (Consenting Party)
________________
Signature
What Is a CCRIS Consent Form (Malaysia)?
A CCRIS Consent Form in Malaysia records the consent or release given and the scope of what the party agrees to.
CCRIS aggregates credit information submitted monthly by all BNM-licensed financial institutions — including banks and investment banks licensed under the Financial Services Act 2013 (FSA 2013), Islamic banks and takaful operators licensed under the Islamic Financial Services Act 2013 (IFSA 2013), development financial institutions prescribed under the Development Financial Institutions Act 2002 (DFIA 2002), and housing credit institutions. CCRIS stores outstanding credit facilities (loans, overdrafts, credit cards, hire purchase, mortgage), repayment history showing arrears for up to 12 months, and applications for new credit facilities for the past 12 months.
Access to CCRIS is restricted by BNM to licensed financial institutions — non-bank entities such as employers, trade creditors, and landlords cannot access CCRIS directly. A financial institution may access a customer's CCRIS data for purposes including: credit assessment for a new loan, overdraft, or credit card application; periodic review of existing credit facilities; and enforcement proceedings where the borrower is in default. The Personal Data Protection Act 2010 (PDPA 2010) applies to CCRIS data processed by financial institutions, requiring that data be used only for the purposes for which consent was given under Section 6 of PDPA 2010.
A CCRIS Consent Form differs from a CTOS consent in that CCRIS access is restricted to BNM-licensed institutions, while CTOS (operated by CTOS Data Systems Sdn Bhd, licensed under the Credit Reporting Agencies Act 2010 (CRAA 2010)) is accessible to a wider range of subscribing organisations. CCRIS data focuses on banking credit facilities, while CTOS aggregates court judgments, bankruptcy records, and trade references in addition to selected banking data.
BNM's My Data Rights initiative, launched under the Financial Services Act 2013, allows customers to consent to sharing their CCRIS data across BNM-licensed institutions to support refinancing and competitive credit pricing, enhancing consumer financial mobility in Malaysia's banking sector.
The legal framework governing the CCRIS Consent Form (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a CCRIS Consent Form (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Financial Services Act 2013 (Act 758) sets the foundational requirements.
When Do You Need a CCRIS Consent Form (Malaysia)?
A CCRIS Consent Form in Malaysia is needed whenever a BNM-licensed financial institution requires the subject's credit data from the CCRIS system to make or review a credit decision.
A CCRIS Consent Form is required when an individual or business applies for a housing loan, personal loan, car loan, business term loan, or credit card from a bank licensed under the Financial Services Act 2013 or a finance company. CCRIS access allows the lender to assess existing debt obligations and repayment conduct before approving new facilities.
A CCRIS Consent Form is needed when a licensed bank reviews an existing borrower's credit facility — for example, during annual credit review, facility renewal, or when the borrower requests a credit limit increase. The bank requires CCRIS consent to check whether the borrower's credit profile has changed since the original facility was granted.
A CCRIS Consent Form is required when an Islamic bank licensed under the Islamic Financial Services Act 2013 processes an application for Islamic financing products — such as Murabahah term financing, Ijarah, or Musharakah Mutanaqisah home financing — as CCRIS data is equally applicable to Islamic and conventional credit assessments.
A CCRIS Consent Form is needed when a development financial institution (DFI) prescribed under the Development Financial Institutions Act 2002 — such as SME Bank, Agro Bank, or Bank Rakyat — processes an SME loan application or agricultural financing application, as DFIs are CCRIS reporting and accessing institutions.
A CCRIS Consent Form is required when a financial institution supports the transfer of a customer's credit data to another institution under BNM's My Data Rights framework under the Financial Services Act 2013, enabling the customer to obtain competing loan offers.
Parties in Malaysia should prepare a CCRIS Consent Form (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.
What to Include in Your CCRIS Consent Form (Malaysia)
A valid CCRIS Consent Form in Malaysia must contain the following essential elements to comply with the Central Bank of Malaysia Act 2009, the Financial Services Act 2013, and the Personal Data Protection Act 2010.
Subject Identification: Full name of the individual or authorised representative of the corporate entity, as per MyKad (NRIC) or passport; NRIC number or passport number; date of birth (for individuals); and current address. For corporate entities, include SSM registration number, registered address, and the name and NRIC of the authorised representative providing consent.
BNM-Licensed Institution Details: Full legal name and BNM licence number of the financial institution accessing CCRIS. Only BNM-licensed institutions under the FSA 2013, IFSA 2013, or DFIA 2002 may access CCRIS — the consent form should clearly identify the specific institution.
Purpose of CCRIS Access: A clear statement of the purpose for which CCRIS data is being accessed — for example, 'assessment of application for a housing loan of RM 450,000,' 'annual credit review of existing overdraft facility,' or 'processing of Islamic Murabahah financing application.' Under PDPA 2010, Section 6, data may only be used for the stated purpose.
Scope of Data Accessed: A statement that the CCRIS data accessed includes outstanding credit facilities, repayment conduct, and applications for new credit as maintained by BNM, covering all credit facilities reported to CCRIS.
PDPA 2010 Consent Clause: Explicit consent for the financial institution to collect, process, retain, and use the CCRIS data in accordance with the PDPA 2010. The consent clause must state the data subject's rights under PDPA 2010, including the right to access their own CCRIS data through BNM's eCCRIS portal and the right to withdraw consent.
Signature and Date: The Subject's signature and the date of consent. The consent is typically valid for the duration of the credit application process or the specific purpose stated.
Additional compliance elements for a CCRIS Consent Form (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). CCRIS Consent Form (Malaysia) (Malaysia) [Legal document template]. Forms Legal. https://forms-legal.com/malaysia/financial/forms/ccris-consent-form-malaysia
"CCRIS Consent Form (Malaysia) (Malaysia)." Forms Legal, 2026, https://forms-legal.com/malaysia/financial/forms/ccris-consent-form-malaysia.
@misc{formslegal-ccris-consent-form-malaysia,
author = {{Forms Legal}},
title = {CCRIS Consent Form (Malaysia) (Malaysia)},
year = {2026},
howpublished = {\url{https://forms-legal.com/malaysia/financial/forms/ccris-consent-form-malaysia}},
note = {Free legal document template. Based on Financial Services Act 2013 (Act 758)}
}Frequently Asked Questions
CCRIS (Central Credit Reference Information System) is a centralised credit information system managed by Bank Negara Malaysia (BNM) under the Central Bank of Malaysia Act 2009 (CBA 2009). CCRIS collects and stores credit information submitted monthly by all BNM-licensed financial institutions — banks licensed under the Financial Services Act 2013, Islamic banks under the Islamic Financial Services Act 2013, and development financial institutions under the Development Financial Institutions Act 2002. Information maintained in CCRIS includes outstanding credit facilities (loans, mortgages, overdrafts, credit cards, hire purchase), repayment performance showing arrears of 1 to 12 months, and applications for new credit facilities within the past 12 months. CCRIS is accessible to BNM-licensed institutions for credit assessment purposes. Individuals can access their own CCRIS report free of charge through BNM's eCCRIS online portal at ecredex.bnm.gov.my.
CCRIS data in Malaysia is accessible only to BNM-licensed financial institutions — banks and investment banks licensed under the Financial Services Act 2013, Islamic banks and takaful operators licensed under the Islamic Financial Services Act 2013, and development financial institutions (DFIs) prescribed under the Development Financial Institutions Act 2002 such as SME Bank, Agro Bank, Bank Rakyat, and Bank Simpanan Nasional. Non-bank entities — employers, trade creditors, landlords, and private individuals — cannot access CCRIS. These parties must use credit reporting agencies licensed under the Credit Reporting Agencies Act 2010 (CRAA 2010), such as CTOS Data Systems Sdn Bhd or Experian Credit Services Malaysia Sdn Bhd, which provide similar credit information for non-bank credit assessment purposes. BNM's My Data Rights framework allows customers to voluntarily share their CCRIS data with competing institutions.
CCRIS maintains credit information for specific periods under BNM's data retention guidelines. Outstanding credit facilities remain on record as long as the facilities are active. Repayment history — including records of arrears — is maintained for 12 months of payment conduct. Applications for new credit facilities are retained for 12 months from the application date. Fully settled or closed facilities are retained for a period determined by BNM's policies, typically several years after settlement. A borrower who has settled all arrears and maintained clean repayment records for 12 months will see their CCRIS report reflect this improvement, as monthly updates from financial institutions are submitted to CCRIS within the first 10 working days of each month. BNM's eCCRIS portal allows individuals to access and verify their own CCRIS data at any time.
An individual in Malaysia who discovers inaccurate information in their CCRIS record can raise a dispute through Bank Negara Malaysia's eCCRIS portal or through the financial institution that reported the inaccurate data. Under BNM's credit reporting framework, financial institutions are responsible for the accuracy of data they submit to CCRIS and must correct errors within prescribed timelines upon notification. Where the dispute cannot be resolved directly with the financial institution, the customer may escalate to BNM's Financial Consumer Alert or submit a complaint through BNM's BNMTELELINK (1-300-88-5465). For systemic inaccuracies or where the financial institution is unresponsive, the Ombudsman for Financial Services (OFS) established under the Financial Services Act 2013 provides an independent dispute resolution channel for retail banking customers.
The legal requirement for CCRIS consent arises from the Personal Data Protection Act 2010 (PDPA 2010), which governs the collection and processing of personal data by commercial data processors. Under Section 6 of PDPA 2010, personal data — including credit information — may only be collected and processed with the data subject's consent for a specified purpose. Financial institutions licensed under the Financial Services Act 2013 must obtain the customer's consent before accessing CCRIS data for credit assessment. Practically, CCRIS consent is embedded in the credit application form or account opening form of all BNM-licensed financial institutions. BNM's supervisory examinations assess whether institutions obtain proper consent for CCRIS access as part of PDPA 2010 compliance reviews. The right to access one's own CCRIS data does not require consent — any individual may access their own report through BNM's eCCRIS portal.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
CTOS Consent Form (Malaysia)
A CTOS Consent Form for Malaysia that authorises a creditor, employer, or financial institution to access the subject's CTOS credit report from CTOS Data Systems Sdn Bhd, a licensed Credit Reporting Agency under the Credit Reporting Agencies Act 2010 (CRAA 2010) and the Personal Data Protection Act 2010 (PDPA 2010).
BNM KYC Form (Malaysia)
A Know Your Customer (KYC) form for Malaysia aligned with Bank Negara Malaysia (BNM) Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA) requirements. Collects identity, beneficial ownership, source of funds, and risk classification information required by financial institutions, money service businesses, and designated non-financial businesses under AMLA 2001.
Credit Application Form (Malaysia)
A Credit Application Form for Malaysia that enables businesses to assess a customer's creditworthiness before extending trade credit. Collects company details, financial information, trade references, and authorisation for CCRIS and CTOS credit checks under the Credit Reporting Agencies Act 2010 (CRAA 2010) and Personal Data Protection Act 2010.