SSM Direct vs Resellers: Which Should Compliance Buyers Use in Malaysia?

Quick verdict

MyDATA SSM is Malaysia’s official company registry portal, and it is the cheapest route to a single corporate extract. Per-document pricing sits at roughly USD 1.20 to USD 7.00 (MYR 5 to MYR 30) depending on the form. There is no recurring subscription, no API at the retail tier, no monitoring, and no enrichment. Workflow is manual.

Resellers such as CTOS, RAM Credit Information, Experian Malaysia, and a small group of boutique providers package the same SSM source data with workflow tooling, monitoring alerts, REST APIs, derived risk views, and cross-referenced enrichment from court records, bankruptcy filings, and credit data. They cost more per query but absorb compliance officer time.

For a one-off extract with audit-trail value, go Direct. For an ongoing KYC, AML, or onboarding program with more than a few dozen entities under review per month, a reseller pays for itself in saved staff hours. Most serious Malaysian buyers run both.

What SSM Direct is

SSM Direct means buying corporate information through the MyDATA SSM portal operated by Suruhanjaya Syarikat Malaysia, the Companies Commission of Malaysia. The service launched in 2016 as the official electronic access point to Malaysia’s corporate registry under the Companies Act 2016.

Account setup follows two paths. Individual users register with NRIC and a verified mobile number. B2B users submit company registration documents, an authorisation letter, and a corporate email domain. Foreign buyers can register using passport details for individual accounts, with payment through DuitNow, FPX, or international cards.

Once registered, the account holder can run free company name searches and pay for extracts on demand. The catalogue covers:

• e-Info Profile (basic company data, status, registered address)
• Section 17 Form (incorporation form / constitution)
• Beneficial Ownership Report under Section 60B of the Companies Act 2016
• Annual Returns
• Audited Financial Statements
• Statutory Forms (changes in directors, shareholders, charges)
• Particulars of Directors and Shareholders

Public reference points place a non-certified Company Profile (ROC) at MYR 15.40, Company Charges at MYR 25.40, and Particulars of Shareholders or Directors at MYR 25.40 each per the DataTracks guide to SSM online services and aggregator 1company.com. Buyers should verify current rates against the live SSM portal before budgeting.

There is no published REST API at the retail tier. Bulk integrations exist for licensed CRAs and selected enterprise customers, but ordinary buyers download PDFs through the web UI.

What resellers add

Resellers do not own the underlying corporate data. They redistribute SSM extracts and layer four things on top.

Workflow tooling. Case files, batch upload, role-based access, audit logs, e-signature on customer due diligence forms, and integration into onboarding pipelines.

Monitoring. Standing watch on a portfolio of entities with email or webhook alerts on changes to directors, shareholders, charges, status, or beneficial ownership.

API access. REST endpoints with rate limits, sandbox keys, OpenAPI specs, and SDKs. This is the dividing line between manual and automated KYC.

Enrichment. Cross-reference against court records, bankruptcy filings, sanctions screens, and the reseller’s proprietary credit history. CTOS, for example, blends SSM corporate data with its credit reporting business under the Credit Reporting Agencies Act 2010. RAM Credit Information layers credit ratings. Experian Malaysia ties global identity tools into its Malaysia file.

The cost is a subscription (often tiered by user seat count and report volume) plus a per-search markup over the SSM source rate. Markups vary by reseller and by deal, but published retail prices on resellers’ B2C portals typically run roughly two to four times the SSM Direct equivalent.

Cost comparison

The arithmetic depends on volume and on how much compliance officer time costs the buyer.

Scenario A: 1 ad-hoc extract. SSM Direct wins outright. A single Company Profile through MyDATA is roughly MYR 15.40 (about USD 3.60). A reseller charges anywhere from MYR 30 to MYR 80 (USD 7 to USD 19) for the equivalent download. No subscription is justified.

Scenario B: 50 extracts per month, ignoring staff time. SSM Direct still costs less in cash terms. Fifty Company Profile extracts run about MYR 770 (USD 180). A small-tier reseller subscription with 50 included reports often clears MYR 1,500 to MYR 3,000 (USD 350 to USD 700) per month.

Scenario C: 50 extracts per month including 8 hours of compliance officer time at MYR 50 per hour. Add MYR 400 to the MyDATA path for the staff cost of manual download, filing, and re-keying into case files. The reseller path eliminates most of that ops overhead because the workflow tooling is the case file. Net cost converges. Once the team values its time honestly, the reseller often wins.

Scenario D: 500 extracts per month. Reseller wins decisively. Five hundred SSM Direct extracts cost about MYR 7,700 (USD 1,800) in document fees, plus the team time to operate them manually. A volume-tier reseller subscription with API access usually lands between MYR 6,000 and MYR 15,000 (USD 1,400 to USD 3,500) per month, all-in, with monitoring and automation included.

The break-even sits somewhere between 50 and 200 extracts per month for most teams. Below that, SSM Direct is the rational pick. Above it, the reseller’s bundled infrastructure justifies the markup.

Data freshness

Both routes ultimately depend on SSM as the source. The difference sits in the propagation lag.

SSM Direct returns the registry’s current state at the moment of payment. If a director resigned this morning and the company filed the change at noon, the 2 p.m. extract reflects that filing. There is no caching layer between the buyer and the registry record.

Resellers refresh their copies of SSM data on schedules. CTOS publicly references daily refresh cycles for its core company data. RAM Credit Information and Experian Malaysia operate similar feeds. Boutique resellers may run weekly refreshes, particularly outside their highest-traffic data sets. For a real-time check on a single entity, SSM Direct returns a fresher document than any reseller copy. For monitoring portfolios where a one-day or one-week lag is operationally acceptable, the reseller’s continuous refresh is the right tool.

The freshness gap matters most in two situations: M&A pre-LOI checks where a director change in the past 24 hours could affect deal structure, and litigation evidence where chain-of-custody requires an extract pulled directly from the registry on the date of the dispute.

UBO access

Section 60B of the Companies Act 2016, as amended by the Companies (Amendment) Act 2024, requires Malaysian companies to maintain a register of beneficial owners and lodge that register with SSM. Division 8A of the Act, fully enforced from 1 April 2024 per Practice Directive 9/2024, defines the framework. SSM holds the official Beneficial Ownership Reports.

For audit-trail purposes (regulator request, BNM examination, internal audit, litigation discovery), the SSM Direct extract of the Section 60B Beneficial Ownership Report is the authoritative document. Resellers reproduce the substantive data, but the chain-of-custody value sits with the official extract bearing SSM identifiers.

For operational KYC, resellers’ derived UBO views are faster. They typically render an ownership graph that combines the Section 60B disclosure with shareholder lists, foreign parent linkages, and (where the reseller licenses cross-border data) parent-of-parent visibility. That graph view is faster to read than reading three or four separate SSM PDFs. The tradeoff is that the reseller graph is a derived presentation, not a registry document.

A pragmatic split: pull the SSM Direct Section 60B report whenever the file is going into a customer due diligence packet that an auditor or regulator may inspect. Use the reseller’s enriched UBO graph for the day-to-day analyst review.

Compliance posture

Going Direct, the buyer is the data controller under the Personal Data Protection Act 2010 for any personal data extracted from SSM. Director NRIC, residential address, and shareholder identifiers are personal data even when sourced from a public registry. The buyer handles consent capture (where applicable), purpose limitation, retention scheduling, and breach notification.

Going Reseller, the controller relationship is more layered. The reseller is itself a data user under the PDPA and, where it operates as a licensed CRA, also under the Credit Reporting Agencies Act 2010. The buyer remains the controller for downstream use of the data inside the buyer’s KYC system. The reseller contract typically allocates obligations: the reseller for source-of-data lawful basis and the buyer for purpose-bound use, retention, and access.

One subtlety. The PDPA carves out credit reporting business carried on by a licensed CRA from the definition of “personal data” for that specific processing. That carve-out applies to the CRA’s credit reporting workflow, not to the buyer’s onward use. A bank pulling a CTOS report still treats the contents as personal data once it lands in the bank’s case file.

Either route requires a privacy notice that names SSM (or the reseller, plus SSM as upstream source) as a data source, a documented retention period, and an access procedure for data subjects who request their record.

When to go Direct

Audit trail or regulator-facing extract needed. Any document that may end up in a regulatory examination file, a court bundle, or a regulator’s data request should come from SSM Direct. The official extract carries the registry’s chain of custody.

One-off check, low volume, no monitoring need. A single M&A pre-LOI check, a one-time vendor onboarding, or a director background scan on a board candidate. The reseller subscription overhead is not justified.

Litigation evidence. When the extract is going into a court bundle or a statutory declaration, the SSM Direct PDF, dated and watermarked at the moment of pull, is the cleanest evidentiary path.

When to use a Reseller

Ongoing portfolio monitoring. Fifty entities or more under monthly or quarterly review. The monitoring layer (alerts on director, shareholder, charge, and status changes) does not exist in the SSM Direct workflow.

API integration into a KYC pipeline. Automated onboarding flows where a customer ID flows into the screening engine and a structured response flows back. SSM Direct does not expose a retail-tier API.

Cross-source enrichment. Buyers who need corporate registry data alongside credit history, court records, bankruptcy filings, or sanctions matches in a single report or single API call. Resellers package this; SSM Direct does not.

Hybrid model: how most large buyers actually operate

Banks, insurers, fund administrators, and serious AML platforms in Malaysia rarely choose one route. They run both.

The reseller subscription handles daily operations: customer onboarding, periodic reviews, monitoring alerts, and analyst-facing case work. It absorbs about 80 percent of the entity-level activity, because volume and workflow speed dominate at that layer.

SSM Direct is the official-extract tap. It is reached when the file is going somewhere that demands the registry’s chain of custody: a regulatory exam response, a litigation discovery request, a board pack for an M&A approval, an audit working paper, or a regulator’s ad-hoc inquiry. That accounts for the remaining 20 percent and is almost always low-volume but high-stakes.

The cost shape that emerges: a fixed reseller subscription bill plus a small variable line for SSM Direct extracts. The accounting is clean because the two suppliers serve distinguishable purposes. Compliance teams that try to consolidate to one route either overpay (running everything through a reseller and paying markup on documents that need official sourcing) or under-equip themselves (running everything through SSM Direct and burning analyst hours).

A sensible internal policy reads: “Use [reseller] for operational KYC and monitoring. Pull the SSM Direct extract whenever the document will be cited in a regulator-facing file, a board paper, an audit working paper, or a court submission.”

Comparison matrix

What businessdataguide does

businessdataguide is the editorial layer for Malaysian compliance data buyers. We publish neutral, buyer-side comparisons of suppliers, route options, and pricing tradeoffs. We do not resell SSM data ourselves and we do not compete with CTOS, RAM, Experian, or the boutiques covered above.

businessdataguide is an editorial publication. We are a publisher, not a vendor and not a data redistributor. For corrections, data issues, or editorial feedback, see the contact page.

Frequently asked questions

Can I use SSM Direct for free?

Company name search is free on the MyDATA SSM portal. Paid extracts include B2B forms, annual returns, audited financial statements, and the Section 60B Beneficial Ownership Report. Per-document fees typically run between MYR 5 and MYR 30 (USD 1.20 to USD 7.00). The free name search is useful for confirming entity existence and registration number; it does not return director or shareholder data.

Do I need to set up a MyDATA SSM account?

Yes for any paid extract. The free name search works without an account. Account setup for individuals requires NRIC and a verified mobile number. B2B accounts require company registration documents and an authorisation letter naming the operator. Foreign individual accounts can register with passport details and pay through DuitNow, FPX, or international cards.

Is the data on resellers the same as SSM?

The underlying corporate registry fields are identical because SSM is the source. Director lists, shareholder lists, paid-up capital, registered address, and constitution-level data flow from SSM into resellers’ systems. Resellers add enrichment that SSM Direct does not carry: court records, bankruptcy filings, credit history, monitoring alerts, and derived analytics such as UBO graphs and risk flags. For a strict apples-to-apples view of SSM-sourced fields, the data matches subject only to refresh lag.

Can foreigners use SSM Direct?

Yes. The MyDATA SSM portal accepts foreign individual accounts (passport-based) and foreign B2B accounts (with entity registration documents from the home jurisdiction plus a Malaysian authorised representative for some categories). Payment is supported through international cards in addition to local rails such as DuitNow and FPX. Foreign buyers commonly use SSM Direct for cross-border KYC of Malaysian counterparties, with the official extract attached to their internal customer due diligence files.

Which is faster?

For a single one-off extract, SSM Direct is fastest end-to-end. The download is delivered immediately upon payment, typically within seconds. For a portfolio batch or an automated KYC pipeline, the reseller API is dramatically faster because it returns structured JSON in 1 to 3 seconds and can be looped programmatically. A full enriched reseller report including credit and court overlays generally clears in 30 to 60 seconds. SSM Direct has no batch or API option at the retail tier, so portfolio work through the Direct route is bottlenecked by manual operation.