Credit reporting agencies (CRA) such as CTOS (in Malaysia) play a critical role in evaluating the credit-worthiness of potential borrowers in Malaysia. However, many borrowers are still clueless as to how CRAs work.
Asian Property Review talks to Dennis Martin, the recently appointed Group CEO of CTOS Data Systems Sdn Bhd, to throw some light on how CTOS works. Dennis is a 35-year veteran in the banking industry and has previously helmed one of the world’s largest credit bureaus – Experian Credit Services – for eight years.
1. APR: Are there other CRAs, apart from CCRIS and CTOS, that Malaysian financial institutions look at?
DM: Yes, there are a number of other CRAs in Malaysia, both local and international. Some are dealing with purely institutional clients, and some also have tools for the public. However, CTOS is the longest-running credit reporting agency in Malaysia, and as far as we are aware, we have the most comprehensive data sources in the country, enabling us to give a much clearer picture of an individual or a company’s credit history.
2. APR: What is CTOS modelled on? It appears to share similarities with the American model.
DM: CTOS was established in 1990 based on the visionary of its founders to close the gap in information asymmetry of the credit industry whereby the lack of information transparency had resulted in delays and even rejections of financing applications by prospective borrowers. With availability of information, we envisage that financiers are able to better assess the credit worthiness of credit applicants and subsequently make sound decisions. Individuals seeking credit are also able to access their own records via CTOS. This will help empower them to better manage their credit profiles, keep them up to date, and help them improve access to credit.
Over the years, CTOS has transformed itself to a data analytics driven credit reporting agency, modelled based on world-class organizations in more mature markets such as US and Europe. Nevertheless, whilst we are committed to delivering best-in-class solutions, these offerings are customized to the Malaysian environment leveraging on our deep expertise of the local requirements.
3. APR: Why is having zero record i.e. no previous borrowings such a bad thing?
DM: A credit history is a record of a borrower’s responsible repayment of debts. The gathered records are then used by lenders to determine an individual’s credit worthiness (an individual’s ability and track record of repaying a debt). By using credit history information, lenders can decide whether to extend credit, and on what terms. Without that information, lenders would be much more hesitant to offer credit or loans, as they would have no idea as to whether the person in question is likely to pay it back.
Of course, income is an important determining factor, however, lenders make credit granting decisions based on both “ability to repay” and “willingness to repay”:
a) Ability to repay a debt (income) – The higher the income, all other things being equal, the more credit the consumer can access.
b) Willingness to repay a debt (the credit report) as indicated by a history of regular, unmissed payments.
4. APR: Are there any instances where records are not fully updated or contain erroneous information hence affecting the accuracy of the report? How does CTOS ensure the accuracy of all its records? Is there any disclaimer as to the accuracy of its report?
DM: As required by the Act, all CRAs have to ensure that their data is relevant, up-to-date and accurate. CRAs are prohibited from displaying certain records older than 24 months. CRAs are also required to have redress mechanisms in place to ensure any disputes are resolved within 21 days.
[ihc-hide-content ihc_mb_type=”show” ihc_mb_who=”1,2,3,4,5,9″ ihc_mb_template=”1″ ]
CTOS regularly updates its database based on the available information from statutory bodies, its subscribers and public sources such as government gazettes, newspapers and court filings. CTOS also accepts requests to update its information, provided that there is sufficient proof and the necessary documentation.
Individuals are highly encouraged to access and verify their own information in CTOS report via our Self-Check service. The public can do so online by registering an account on our website and via our mobile applications or by visiting our service centre. Further details are on our website, www.ctoscredit. com.my
5. APR: Do most employees have access to the records?
DM: CTOS has a stringent principle that access to information is not a right for employees. We have a well-defined access control matrix that governs employees’ access to information based on a functional role. Any exceptions to the approved matrix needs to be reviewed by senior management.
6. APR: How to prevent an employee from divulging information secretly to third parties?
DM: Employment contract with strict requirements on confidentiality and fiduciary duties as an employee. The confidentiality agreement lays out binding terms and conditions that prohibit the employee from disclosing company confidential and proprietary information.
Data security policy training and pledge for all employees.
7. APR: Are the contents of the report sold to subscribers exactly the same as the one provided free to the consumer? If the consumer paid for his report, are the contents the same as the free one given to him, assuming they are issued to him on the same day?
DM: Yes, the reports given are all the same. There are 2 types of credit reports available for consumers:
a) Basic Report – FREE (without CCRIS and credit score)
b) Score Report – RM25 (with CCRIS and credit score information)
Lenders or financial institutions require CCRIS information, so if a consumer buys the Score Report, it will be the same report as what the lenders have.
8. APR: How does CTOS assign a score? How do you decide what falls into an excellent or weak score?
DM: CTOS works with FICO, the global standard for credit scores, to determine a person’s credit score. FICO has been providing credit scoring internationally for nearly three decades. Credit scores are calculated using weighted means for:
• Payment history: 35%
• Amounts owed: 30%
• Length of credit history: 15%
• Credit Mix (Types of credit used): 10%
• New credit enquiries and number of recently opened loan accounts (i.e. auto loan, mortgage, credit card, personal loan): 10%
Personal or demographic information such as age, race, address, marital status, income and employment don’t affect the score. The CTOS Score ranges from 300 to 850. The higher the score, the better.
9. APR: Can any company or individual access the CTOS records of anyone or any company as long as they paid the requisite fees?
DM: No. The data protection laws in Malaysia are very clear about this. To access the CTOS records of an individual or company, that individual or company must obtain consent from the person or entity being checked. This is why banks would ask potential customers to sign an authorisation to allow them to check their credit history.
10. APR: How independent would a commercialised credit reporting agency be? Should there be more such agencies in Malaysia?
DM: An independent and impartial credit reporting agency such as CTOS is vital to allow impartial decision making by financial institutions and companies. Being a commercial, independent entity means that we are beholden to no outside factors, and our impartiality is the reason that over 10,000 companies, and numerous financial institutions trust us when making important lending decisions. In terms of regulations, all CRAs are governed by the Credit Reporting Agencies Act 2010.
11. APR: Who reports borrowers’ loans/borrowings and repayment information to CTOS? Are these financial institutions obliged to or is it voluntary?
DM: From Bank Negara’s CCRIS. Financial institutions are obligated to update information to Central Credit Reference Information System (CCRIS) every month.
It is important to note that under CRA Act 2010, CRAs are responsible to ensure that credit information is accurate, up-to-date, complete and relevant. Therefore, CCRIS information is a crucial part of credit report.
12. APR: CTOS collaborates with third party providers in advertising certain services e.g. loans with high interest to borrowers that fall within a certain category. Is this a conflict of interest on the part of CTOS?
DM: CTOS does not provide any loan services, so there is no conflict with our business. In terms of benefit for consumers, being made aware of products and services tailored to their scores is a benefit. For people with lower credit scores, they may not be aware that there are options available for them, and for people with higher scores, there are loans available with lower interest rates that again they may not be aware of.
13. APR: Shouldn’t consumers be given an opt-out option not to receive third party advertisements? Someone with a lower credit score may benefit from not having any loan at all. By taking a loan with higher interest rates, he will be overburdened.
DM: Yes, they can opt-out not to receive third party advertisements. For example, we have the unsubscribe link in the electronic direct mailer. We do not have that function however within the dashboard of the CTOS website.
However, it is important to note that as part of our efforts to empower consumers, education on risk-based pricing has to start somewhere. We are working closely with banks to start providing risk-based pricing offer to consumers, hence the advertisement. Consumers who are aware of their credit scores will ultimately be able to use this data to go in search of better offers when they look for a loan. But this is a process that’s still in its infancy here. Most Malaysians are simply not aware of their credit score.
Normal lending criteria would still apply to any application as a result of an advertised offer. This ensures each application meets that lender’s guidelines on capacity to repay. A score is only one element in a lender’s decision to grant finance, although an important one as it predicts the likelihood of getting into financial difficulty in the next 12 months. Lenders will also look at the applicant’s income and ability to service the debt so as not to overburden a borrower.
14. APR: How many individuals and companies are currently captured in CTOS database?
DM: CTOS maintains one of the most comprehensive databases of credit information with over 10 million individuals and 2 million companies in Malaysia.
15. APR: Where does CTOS obtain its information – from both public and private sources? Examples?
DM: CTOS obtains and collects information from various public sources that include:
• Bank Negara’s CCRIS
• National Registration Department (NRD)
• Registrar of Societies
• Publications of legal proceedings and notices in newspapers and government gazettes
• Companies Commission of Malaysia (CCM)
• Malaysia Insolvency Department
• Subscribers’ contributions of litigation records
16. APR: What does it mean when a ‘trade reference is placed upon you’?
DM: It means that someone (company/lender/ establishment) has shared some information about you. Trade references can potentially have a positive impact (on-time payments) or negative impact (late payments) on your business.
A trade reference is a reference from a company with which a merchant does regular business, used as a means of verifying the creditworthiness of that merchant to a third party considering the extension of credit. The name and contact information of references are provided so that credit grantors can corroborate the account’s status.
Trade references are an essential component for lenders and business-to-business suppliers who must decide whether to extend credit to the applicant. These references are typically in addition to a formal credit report. Companies and banks that lend money and extend credit want to ensure that their customers can pay their debts in full and on time.
17. APR: How does CTOS protect its database from hacking following the massive cyberattack on Equifax?
DM: CTOS is strongly aware of the critical need to safeguard and protect the security, confidentiality and use of all data entrusted under our care.
To CTOS, being a responsible credit reporting agency means making a dedicated pledge in action to:
• safeguarding the data we’ve been entrusted with by using proven technologies and sophisticated surveillance procedures to protect the security and privacy of all types of data we collect;
• investing in a strong internal governance process that includes dedicated compliance and data governance officers, specialized IT and database security experts, and continued investment in ongoing security enhancements, mandatory company-wide security training for employees and oversight by senior management committees;
• committing to periodic independent, third-party experts’ assessment and audit to continuously enhance related systems, policies and processes to ensure a highly robust environment;
• complying with all laws, regulations and policies as required by regulatory agencies such as Registrar Office of Credit Reporting Agencies, Bank Negara Malaysia and Commissioner of Personal Data Protection.
In summary, CTOS acknowledges its critical role and responsibility for data critical for the good of the country’s economy, consumers, and society as a whole. Hence, we take great pride in our efforts to protect this asset that we are custodian of.
18. APR: “CTOS will soon be releasing details of our new consumer fraud prevention product designed for individuals to help protect against situations such as identity theft”. Will this be a paid service?
DM: Yes, it is a subscription-based service. Details will be provided soon once the product is ready. It is targeted to launch before the end of this year.
19. APR: Why should it be a paid service when it is the responsibility of the CRA under the Act to protect consumers’ credit information from any loss, misuse, modification, unauthorized or accidental access or disclosure? Isn’t this tantamount to shifting the responsibility of protecting the data from the CRA to the consumer?
DM: CTOS takes it responsibilities under the Act very seriously and is audited by the CRA Registrar to ensure compliance. Often, a CRA is not able to identify fraud such as ID fraud until notified by the affected consumer as this fraud is not using data held and protected by the CRA, and therefore not covered by the Act. Often, by that time, the consumer may have incurred loss and or significant inconvenience. This service is designed to enable consumers identify early the fraudulent use of their ID to obtain credit and save them considerable hassle and potential cost. CTOS is also working with banks to introduce a fraud bureau which will also assist in detecting fraud in relation to application for banking facilities.
20. APR: Shouldn’t the consumer be able to switch on and off their credit information as and when needed i.e. at the point when they want to apply for credit?
DM: The Malaysian CRA environment is highly regulated and controlled. Confidential consumer credit information is only available when consent is given by the consumer thus making this facility redundant as control already exists in the hands of the consumer. Additionally, this could also lead to significant inconvenience for consumers who would have to contact the CRA prior to applying for any credit facility.
OBLIGATIONS UNDER CRA ACT
Malaysian government website, www.ppapk. treasury.gov.my/en/ , spells out the parties’ responsibilities as follows:
CRAs
• To give notice to customer on the processing of credit information.
• To obtain consent from customer before the disclosure of the credit information to third party.
• To ensure the credit information is accurate, up-to-date, complete, relevant and not misleading.
• To give customer the right of access to credit information.
• To protect the credit information from any loss, misuse, modification, unauthorized or accidental access or disclosure
• Not to disclose the information in relation to bankruptcy, pecuniary action in court and any default in repayment of credit two years after the final settlement unless the current status of the action has been ascertained and is included in the credit report.
Subscribers
The third party/subscriber is any party who subscribes to the Credit Reporting Agency (CRA) and has access to the credit information. Act 710 has given responsibility to the third party to take appropriate measures to safeguard credit information from any unauthorized access, use, modification or unauthorized disclosure.
Subscribers in Malaysia include banking and financial institutions, insurance companies, large corporations, legal firms, businesses, state and statutory bodies.
Among the measures to be taken by the third parties are as follows:
• Develop, written procedures and controls to be followed by employees, agents and contractors;
• Monitor usage and regularly review its compliance with policies, procedures and controls;
• Provide information and training to ensure compliance with policy procedures and controls and to take appropriate action in respect of any breach of such compliance; and
• Maintain logs of all accesses, amendments and audit trails of the credit information provided by CRA.
PROHIBITED DISCLOSURE IN CREDIT REPORT
Section 25 of Act 710 also prohibits the CRA from disclosing any of the following information in a credit report:
• Any information unless such information includes the name and address of the source of the credit information;
• Any information unless the identity of the customer can be identified;
• Any information in relation to a person’s bankruptcy two years after the date of his discharge from bankruptcy;
• Any information in relation to pecuniary action in court against a person more than two years after the date of commencement of the proceedings, unless the current status of the court action has been ascertained and is included in the credit report; and
• Any information in relation to any default in repayment of credit two years after the date of final settlement of the amount in default, including settlement of the amounts payable pursuant to a scheme of arrangement with the credit provider.
[/ihc-hide-content]