Malaysia Company Data Suppliers: An Editorial Buyer's Guide

The buyer market in Malaysia

Anyone running compliance, lending, or M&A work in Malaysia eventually hits the same question: which supplier should I source company data from? The buyers vary widely. Licensed banks and Islamic banks need bank-grade credit signals plus the official register. Anti-money-laundering (AML) platforms and fund administrators want consistent KYC inputs across portfolios. Law firms and in-house counsel need clean SSM extracts for litigation, transactions, or board work. Foreign companies running due diligence on a Malaysian target want a one-stop view that ties the company register to credit, court, and beneficial-ownership data.

The regulatory drivers are concrete. The Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA) sits behind every reporting institution’s obligations. Bank Negara Malaysia’s AML/CFT/CPF policy document, reissued on 5 February 2024, sets the customer due diligence standard for financial institutions and for designated non-financial businesses and professions (DNFBPs). The Companies Act 2016 (with the beneficial-ownership amendments that came into force in April 2024) extended the duty to maintain a register of beneficial owners to all incorporated entities. The Personal Data Protection Act 2010, as amended by Act A1727 in 2024, governs how supplier data on natural persons (directors, beneficial owners, signatories) can be processed and shared.

Supplier choice matters because not all data is the same. A name-search hit on the public register tells you a company exists. A CCRIS view tells you whether it has bank lines. A CTOS or RAM extract may add court and bankruptcy signals. An Experian global graph stitches in cross-border ownership. The freshness, the API, the pricing model, and the regulatory licensing all differ. This guide walks the six categories a buyer typically chooses from.

The 6 supplier categories

The Malaysian market is not a flat list of competitors. It is a stack: an official source, two domestic credit bureaus, a global brand local arm, a restricted central system, and a long tail of resellers. Each has a defined role.

1. SSM Direct (MyDATA SSM)

Suruhanjaya Syarikat Malaysia (SSM) is the official Companies Commission. Every locally incorporated entity, every registered business, and every beneficial-ownership filing under Section 60B of the Companies Act 2016.pdf) sits in SSM’s books. There is no upstream source.

Buyers reach SSM data through two main routes. The first is the MyDATA SSM portal, launched in 2016 as the consumer-facing electronic counter. Registration is free. Payments run through FPX (Malaysian online banking). A statutory company extract is typically priced around MYR 10 (USD 2.30) to SSM, with a service fee of around MYR 5 (USD 1.15) to the technology provider, with additional fees for richer products like financial-history comparisons or digitally certified true copies of Form D. The second route is e-Info and the e-CBID corporate-information channel for higher-volume buyers.

Coverage is by definition complete: 100% of registered Malaysian entities. UBO data flows from the Section 60B register, with required fields including full name, address, nationality, and dates of assuming and relinquishing the role. Freshness is real-time as filed; if a director changed yesterday and the filing is in, today’s extract reflects it. The portal is the primary delivery channel; no broad public REST API is published for general business-to-business consumption. Best-fit buyers are anyone who needs the official source-of-truth document: regulators, courts, auditors, and any KYC file where a derived view from a reseller is not enough.

2. CTOS Data Systems

CTOS Data Systems is the largest Malaysian credit reporting agency. It has been operating since 1990, was listed on Bursa Malaysia in 2021 (KLSE: CTOS), and is licensed under the Credit Reporting Agencies Act 2010 by the Ministry of Finance’s Registrar Office of Credit Reporting Agencies (PPK).

CTOS aggregates SSM company filings with its own bureau data, a licensed CCRIS feed (where the buyer is an authorised user), court records, bankruptcy filings, litigation, and a Trade Referee (eTR) network. Its product line ranges from the classic CTOS Report (consumer or company), the Company/Business Profile Report Plus (which lists up to five directors, with each additional director priced around MYR 51 (USD 11.70) plus SST), CTOS SME Score for evaluating smaller borrowers, CTOS Credit Manager for portfolio workflow, and CTOS eKYC for onboarding. There is an enterprise REST API tier through CTOS Basis for higher-volume integrations. UBO depth comes from SSM filings plus CTOS’s own enrichment.

Pricing follows a subscription-plus-per-search model for enterprise buyers, with volume tiers, and a portal pay-per-report option for one-offs. Public per-report figures vary, but a single business credit report generally falls in the MYR 30 to MYR 200 (USD 7 to USD 46) band depending on the report tier and whether litigation, bankruptcy, and CCRIS sections are included. Best-fit buyers are SME-heavy lenders, ongoing KYC operations, and any buyer that wants ongoing monitoring on a customer book rather than one-off lookups.

3. RAM Credit Information (RAMCI)

RAM Credit Information (RAMCI) was founded in 2002 within the RAM Holdings group, which also runs RAM Ratings (the credit-rating arm). Experian acquired a controlling interest in RAMCI in October 2019 and the consumer-facing portal now sits under MYCREDITINFO by Experian. RAMCI is licensed under the Credit Reporting Agencies Act 2010 by the Ministry of Finance.

RAMCI’s positioning has historically been bank-grade. Its data products combine SSM corporate registry information, the RAMCI Trade Bureau, credit scoring, and corporate monitoring. It serves licensed commercial banks, Islamic banks, investment banks, and non-bank financial institutions. UBO views are derived from SSM filings plus RAMCI enrichment. Freshness on the consumer-credit side is close to real-time once contributing institutions report; on the corporate side, daily refresh is typical. An enterprise REST API is available for institutional integrations.

Pricing is subscription-led for institutional buyers and contract-priced for API. The consumer credit report on the MYCREDITINFO portal is published at MYR 23.90 (USD 5.50). Corporate report pricing is not publicly listed and is typically negotiated at contract signing. Best-fit buyers are licensed lenders, larger NBFIs, and institutions where the bank-grade pedigree (RAM Ratings group) and Experian parentage matter for procurement. With Experian as parent, the cross-border data path is also more direct than on a pure-domestic bureau.

4. Experian Malaysia

Experian Malaysia operates as the local arm of the global Experian group. After the 2019 RAMCI acquisition, Experian’s local credit bureau footprint is delivered through Experian Credit & Information Services (formerly RAMCI). At a corporate level, Experian also surfaces global products: Experian Business (the international company graph), CrediTrack (monitoring), the Trade Bureau, eKYC, fraud and identity, and decisioning analytics.

For Malaysia buyers, the differentiator is the global graph. A foreign acquirer running due diligence on a Malaysian target with a Cayman or Singapore parent gets a stitched view rather than a sequence of disconnected national lookups. UBO depth on the global side is one of the better commercial options; locally, the depth tracks the underlying RAMCI/SSM data plus Experian enrichment. Freshness is daily for the corporate side, real-time on the consumer credit side. A global REST API is available; pricing is enterprise-contract only and is not listed publicly.

Best-fit buyers are multinationals, regional fund administrators with cross-border exposure, large law firms doing M&A on outbound or inbound transactions, and any institution that already has an Experian master service agreement at group level and wants to extend it into Malaysia. For a Malaysia-only book, the same data largely sits inside the RAMCI subsidiary, so the cost-benefit case for the full Experian wrap is strongest when the cross-border use case is real.

5. CCRIS (Bank Negara, via the Credit Bureau)

The Central Credit Reference Information System (CCRIS) is operated by Bank Negara Malaysia. Under the Central Bank of Malaysia Act 1958 (revised 2009), BNM has been collecting credit-related information from lending institutions since 1982. CCRIS aggregates outstanding facilities, repayment behaviour, and legal-action records contributed by licensed banks, Islamic banks, investment banks, development financial institutions, and selected non-bank lenders.

Access is restricted. CCRIS is not a commercial product. Reporting institutions access CCRIS for the customers they have a legitimate basis to view, and individual subjects can pull their own report through the eCCRIS consumer portal or the Credit Bureau counter. BNM has confirmed that credit reporting agencies can access CCRIS only with BNM approval, which is why CTOS and RAMCI surface CCRIS sections in their reports rather than expose CCRIS as a standalone subscription.

Coverage is broad on the credit dimension: both consumer and corporate credit obligations across the Malaysian banking system. There is no UBO module; that is not the system’s purpose. Freshness is real-time as institutions report. Access is via authorised member channels. Best-fit users are licensed financial institutions for their own credit decisions. External buyers cannot subscribe directly. If you need CCRIS-derived signals as a non-bank, you reach them through a licensed credit reporting agency that has been approved to redistribute.

6. Boutique resellers (iSearch, Bizinsight, CompaniesMy and similar)

The long tail consists of pay-per-search resellers built primarily on SSM data plus light enrichment. Brands include iSearch.com.my, Bizinsight, CompaniesMy, and a number of e-Info-authorised channels. They typically sit at MYR 10 to MYR 50 (USD 2.30 to USD 11.50) per search, sometimes lower for a basic profile. UBO depth is limited; many do not surface the Section 60B register at all. There is generally no enterprise API, no monitoring, and the data refresh is manual or scheduled rather than real-time.

What boutique resellers do well is convenience and price for occasional checks. A freelance compliance professional, a small law firm doing one transaction, or an SME credit controller running one supplier check per month can transact on the portal in minutes without a contract. They also serve as a useful redundancy when the larger providers are down or when a buyer wants a quick second view. Best-fit users are occasional buyers who do not justify a CTOS or RAMCI subscription and who do not need monitoring or API access.

Comparison matrix

How to choose

The choice is rarely “best supplier”; it is “best fit for our use case”. Three questions decide it.

First, are you a regulated reporting institution? If yes, CCRIS access through your member relationship is the baseline, and the question becomes which credit reporting agency you wrap around it. Banks and licensed lenders typically run a primary CTOS or RAMCI relationship plus SSM where the official certified document is needed. If you are a non-bank reporting institution (legal practice, accountancy, secretarial firm, real-estate agent, dealer in precious metals), CCRIS is closed to you, so the wrap matters more: CTOS for SME-heavy onboarding, RAMCI/Experian where the buyer profile leans bank-adjacent.

Second, what is the volume? High-volume monitoring and onboarding pulls you to a subscription with a credit reporting agency, because per-search pricing ceases to make sense above roughly 50 reports a month, and because monitoring is only available on subscription tiers. Occasional checks (under ten a month, no monitoring need) push you to MyDATA SSM direct or to a boutique reseller. The break-even point varies by product mix; the practical heuristic is that if you are running CDD on more than one new file per week, a subscription pays for itself.

Third, is the work cross-border? If yes, Experian’s global graph or a buyer’s agent that can stitch national records is more practical than chaining direct lookups. If the work is fully Malaysia-domestic, CTOS or RAMCI plus SSM is sufficient and cheaper.

Three personas illustrate the call. A bank AML team running ongoing monitoring on a corporate book runs CCRIS as a member, plus a CTOS or RAMCI subscription for the wrap, plus SSM direct for any document that has to go into a court file. A fund administrator doing onshore SME work for institutional limited partners runs a CTOS subscription with monitoring, pulls SSM extracts on demand for the official record, and reaches for RAMCI when a corporate borrower has unusual bank-line questions. A foreign acquirer doing M&A on a Malaysian target typically engages an Experian global report (or a buyer’s agent) to get the cross-border picture, plus targeted SSM extracts as backing for the data room.

Compliance posture: PDPA and supplier licensing

Two regulatory tracks shape what is permissible. The first is data protection. The Personal Data Protection Act 2010, as amended by Act A1727 in 2024, regulates processing of personal data on natural persons. SSM register data is public, but personal details of directors and beneficial owners surfaced through resellers carry obligations. The 2024 amendment introduced mandatory data breach notification, a Data Protection Officer requirement, and increased penalties to MYR 1,000,000 (USD 230,000) and up to three years imprisonment for serious breaches. Cross-border transfer rules also changed (the white-list regime was removed in favour of an adequacy test). Buyers should not assume a supplier’s licence covers their downstream use; the controller-processor allocation has to be set out in the contract.

The second track is licensing of the supplier itself. CTOS, RAMCI, and CRIF Malaysia all hold credit reporting agency licences from the Registrar Office of Credit Reporting Agencies (PPK) at the Ministry of Finance, under the Credit Reporting Agencies Act 2010. Boutique resellers that resell SSM extracts but do not produce credit reports do not need a CRA licence; they typically operate under e-Info or MyDATA authorisation rather than under the CRA Act. CCRIS operates under BNM’s central-bank powers, not under the CRA Act. Buyers procuring data should check the supplier’s specific licensing against the use case.

Editorial note. businessdataguide is an editorial publication. It does not resell registry data and does not act as a vendor. Where a use case fits a self-serve route, this guide points there directly. Where it does not, the guide names the licensed Malaysia suppliers and the cross-border options buyers commonly evaluate.

What businessdataguide does

businessdataguide is editorial. We compare. We do not sell registry data and we are not a vendor. The role of this site is to keep the buyer-side picture honest: which supplier fits which use case, what the licensing actually covers, where the freshness gaps are, and what the realistic per-report economics look like at small, medium, and high volume. For the registry walkthrough that sits behind these reports, see the Malaysia company search guide.

Frequently asked questions

Is SSM data free?

Company name search is free. Statutory extracts (B2B forms, financial filings, beneficial-ownership reports) are paid: typically MYR 10 (USD 2.30) for the SSM fee plus around MYR 5 (USD 1.15) service fee on MyDATA, with higher rates for richer products. Form D digitally certified true copies and financial-history comparisons run higher.

Can foreigners access SSM directly?

Yes. The MyDATA SSM portal accepts registration with a passport-based ID. Payment is currently FPX (online bank transfer through Malaysian banks). Foreigners without a Malaysian bank account often go through a reseller (CTOS, RAMCI, a boutique) or a buyer’s agent for convenience.

What is the difference between CTOS and RAM Credit Information?

Both are credit reporting agencies licensed under the Credit Reporting Agencies Act 2010. CTOS is larger, more SME-focused, and Bursa-listed. RAMCI is bank-focused and has been majority-owned by Experian since 2019, sitting alongside Experian’s global products. Pick CTOS for SME-heavy ongoing KYC and monitoring at scale. Pick RAMCI/Experian for bank-grade lending decisions and where cross-border or Experian-group integrations matter.

Does CCRIS data include companies?

Yes. CCRIS captures both consumer and corporate credit obligations across the Malaysian banking system, including outstanding facilities, repayment patterns, and legal-action records. But CCRIS access is restricted to BNM-approved members. External buyers cannot subscribe directly; CCRIS-derived sections appear inside CTOS and RAMCI reports because those agencies have BNM authorisation.

Which supplier is cheapest?

For one-off extracts, MyDATA SSM is cheapest at around MYR 10-30 (USD 2.30-7). Boutique resellers sit MYR 10-50 (USD 2.30-11.50). CTOS, RAMCI, and Experian have higher per-search list prices but lower effective per-search cost at volume through subscriptions. The break-even depends on monthly volume, but as a rule, anything above 50 reports a month tilts toward subscription pricing.

Can I get a UBO graph in Malaysia?

Section 60B of the Companies Act 2016 (with the April 2024 amendments) requires every incorporated entity to maintain a register of beneficial owners and notify SSM of changes within 14 days. SSM holds the data. CTOS, RAMCI, and Experian build derived UBO views on top of the filings plus their own enrichment. For multi-hop UBO across borders (Malaysia parent with foreign holding companies), Experian’s global graph or a buyer’s agent stitching national records is more practical than direct SSM lookups.