CTOS Consent Form (Malaysia)

A CTOS Consent Form in Malaysia documents a party's authorisation or waiver and the limits that apply to it.

CTOS Data Systems Sdn Bhd operates one of Malaysia's two main private credit reporting systems — the other being Experian Credit Services Malaysia Sdn Bhd. A CTOS report aggregates publicly available credit information including: court judgments from the High Court of Malaya, Sessions Court, and Magistrates Court; winding-up petitions and bankruptcy proceedings filed under the Companies Act 2016 and the Insolvency Act 1967; Trade References contributed by subscribing businesses; company SSM information; and — for consenting individuals — information from CCRIS and financial institutions.

The Credit Reporting Agencies Act 2010 (CRAA 2010), Section 29, prohibits credit reporting agencies from disclosing a Subject's credit information to a third party without the Subject's written consent, except in specified circumstances including compliance with a court order or direction from BNM. A CTOS Consent Form is the instrument through which the Subject provides this consent, authorising the named requestor to obtain a full CTOS report or a specific CTOS product (such as a CTOS Score or CTOS Business Report).

The Personal Data Protection Act 2010 (PDPA 2010) applies to the personal data collected in the CTOS Consent Form — specifically the Subject's full name, NRIC number, and contact details. Under Section 6 of PDPA 2010, personal data may only be collected and processed for the purpose for which consent is given. The CTOS Consent Form must therefore state the specific purpose for which the credit report is being accessed — for example, credit assessment for a loan application, employment screening, or trade credit assessment.

A CTOS Consent Form differs from a CCRIS consent, as CCRIS (Central Credit Reference Information System) is maintained by BNM and accessible only to financial institutions licensed under the Financial Services Act 2013 and Islamic Financial Services Act 2013. Non-bank entities — employers, landlords, trade creditors — access credit information through CTOS or Experian rather than CCRIS.

The legal framework governing the CTOS Consent Form (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a CTOS Consent Form (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Financial Services Act 2013 (Act 758) sets the foundational requirements.

A CTOS Consent Form in Malaysia is needed whenever a creditor, employer, or other authorised party seeks to access an individual's or company's CTOS credit report under the CRAA 2010.

A CTOS Consent Form is required when a trade supplier assesses a new business customer before extending credit terms. Under the CRAA 2010, the supplier must obtain the customer's written consent before accessing their CTOS Business Report, which shows court judgments, winding-up petitions, and trade reference information.

A CTOS Consent Form is needed when a landlord evaluates a prospective tenant's creditworthiness before entering a tenancy agreement. Commercial landlords in Kuala Lumpur and other major centres routinely require CTOS consent as part of the tenancy application process.

A CTOS Consent Form is required when an employer conducts background screening of a job applicant — particularly for positions involving financial responsibility, access to company funds, or fiduciary duties. Section 29 of the CRAA 2010 requires consent for such disclosures.

A CTOS Consent Form is needed when a licensed moneylender under the Moneylenders Act 1951 or a cooperative under the Co-operative Societies Act 1993 assesses a loan application and does not have access to BNM's CCRIS system.

A CTOS Consent Form is required when a company seeking to enter a joint venture or partnership performs due diligence on the financial standing of the prospective partner's key individuals or directors, to assess whether there are undisclosed court judgments or bankruptcy proceedings under the Insolvency Act 1967.

Parties in Malaysia should prepare a CTOS Consent Form (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid CTOS Consent Form in Malaysia must contain the following essential elements to comply with the CRAA 2010 and PDPA 2010.

Subject Identification: Full name of the individual or company as per NRIC, passport, or SSM records; NRIC number (for individuals) or SSM registration number (for companies); and contact details including address and telephone number.

Requestor Identification: Full legal name, SSM registration number, and address of the entity authorised to access the CTOS report. The Requestor must be a CTOS subscriber or an entity accessing the report through a licensed channel.

Purpose of Access: A clear statement of the specific purpose for which the CTOS report is being accessed — for example, 'credit assessment for a trade credit application,' 'pre-employment screening,' or 'tenancy application assessment.' Under PDPA 2010, Section 6, the purpose must be stated and the data may only be used for that stated purpose.

Consent Statement: An unambiguous written consent by the Subject authorising the named Requestor to access the Subject's CTOS report, including CTOS Score, CTOS MyCTOS Score, CTOS Business Report, or other specified products. The consent must reference the CRAA 2010 and PDPA 2010.

Data Retention and Confidentiality: A statement that the Requestor will use the CTOS data solely for the stated purpose, will not disclose it to unauthorised third parties, and will retain it only as long as necessary — consistent with PDPA 2010, Section 10 (storage limitation principle).

Signature and Date: The Subject's signature and the date of consent. The consent date is material — CTOS consent is generally valid for a single access or for the duration of a specific transaction, not as a blanket ongoing authorisation. The Requestor should obtain fresh consent for each new access.

Additional compliance elements for a CTOS Consent Form (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.