Can a landlord run a CTOS check on a tenant in Malaysia?
No — a landlord cannot legally pull a tenant's CTOS report without the tenant's consent. CTOS is a self-check tool: the tenant requests their own report (MyCTOS Score, RM27.00 including SST; verify current pricing at ctoscredit.com.my) and shares it voluntarily. Landlords who run consented credit screening do so through a licensed credit-reporting agency — The platform uses Experian — built into the tenancy sign-up flow.
This distinction matters because every competitor in the SERP blurs it. PropCashflow's landlord guide frames the "CTOS workaround" as if a landlord can pull the report by another route; the CTOS vendor itself markets a paid B2B screening product aimed at agencies. Neither clearly states the legal baseline: under the Credit Reporting Agencies Act 2010, accessing a subject's credit file without their consent is not a lawful option for a private landlord.
Screening a tenant well is not the same as running a CTOS check. The two most important decisions are: (1) what can you lawfully verify before you sign, and (2) what can you do with a bad result afterward.
CTOS self-pull vs consented credit screening: what each actually does
CTOS self-pull gives the tenant a report on their own credit standing. Consented credit screening — run by a licensed agency on behalf of the landlord, with the tenant's written consent at sign-up — gives the landlord a payment-risk picture. They are different products serving different moments.
| CTOS self-pull | Consented credit screening (e.g. Experian via SPEEDHOME) | |
|---|---|---|
| Who requests | The tenant, on their own account | The licensed operator, with written tenant consent |
| Legal basis | Tenant accessing their own file | Credit Reporting Agencies Act 2010 — consent from the subject required |
| What it checks | Court judgments, outstanding debt, payment history | Credit score, income verification, identity match |
| Who sees the result | The tenant; they choose whether to share | The platform/landlord, within the consented scope |
| Typical cost | RM27.00 including SST for MyCTOS Score (verify at ctoscredit.com.my) | Absorbed in platform fee or tenancy sign-up |
| Actionable for landlord | Only if the tenant shares the PDF voluntarily | Yes — structured pass/refer/flag output |
| When it fits | Tenant demonstrates financial track record | Landlord needs a structured screening decision |
A landlord asking a tenant to self-pull and share their CTOS report is lawful and reasonable — it is a common request. The critical distinction is that you are asking the tenant to share their own report, not accessing it yourself.
When does screening pass — and when does it fail?
Good screening decisions rest on payment predictors: credit history, income-to-rent ratio and employment stability. Screening that excludes applicants by race, nationality or religion is both an unlawful-risk and a weak predictor of payment behaviour.
A 2023 landlord survey (SPEEDHOME/INVOKE, 34pp) found 79% of Malaysian landlords want background-check or tenant-vetting built into a rental platform. The gap between what landlords want and what they know is lawful is the exact problem a structured screening system resolves.
| Check | Lawful | Worth including | Notes |
|---|---|---|---|
| Identity (IC/passport match) | Yes | Yes | Basis of every downstream check |
| Employment/income proof (payslips, EA form, offer letter) | Yes | Yes | 3× monthly rent rule is a common benchmark |
| Credit report (consented via licensed agency) | Yes | Yes | Use a licensed credit-reporting agency, not DIY |
| Bank statement (12 months, tenant-provided) | Yes | Yes | Pattern check, not just balance |
| Employer reference / previous landlord reference | Yes | Yes | Call the number on the official company directory, not a number the applicant supplies |
| CTOS self-pull report (tenant-shared voluntarily) | Yes | Yes | Lawful when the tenant provides it; never pull without consent |
| Race / ethnicity / religion / nationality | No | No | Unlawful risk and a weak predictor; screen on payment capacity, not identity |
| Marital status / family composition | Caution | Rarely | Not a reliable predictor; exposure if used as a proxy for exclusion |
What to do after screening: lawful results and what reporting requires
A verified rental default can be reported to a licensed credit-reporting agency only where the tenant gave consent in the tenancy agreement. Publishing a tenant's details — on social media, WhatsApp groups or "blacklists" — is not lawful.
An individual landlord cannot furnish a rental default to a credit reporting agency directly; SPEEDHOME can, as the landlord's appointed agent, but only where the tenant gave written consent in the tenancy agreement.
Get SPEEDHOME's free report-ready tenancy agreement. A standard TA won't help you recover from a tenant who defaults — a report-ready one can. It includes the written consent/default clause that lets SPEEDHOME, acting as the landlord's appointed agent, report a verified rental default to a licensed credit reporting agency with the tenant's written consent — something an individual landlord cannot do alone. A documented, lawful report is a far stronger motivator to settle than an informal threat. Contact us →
This is the exact wording of the approved legal anchor (Credit Reporting Agencies Act 2010, consent basis; CEO-authorized 2026-06-20 — HIGHEST-RISK copy; a lawyer must review the final published wording before this page goes LIVE).
The correct sequence after a screening pass or fail:
| Screening result | Lawful landlord action |
|---|---|
| Pass | Proceed to Letter of Offer, stamped tenancy agreement, and documented handover |
| Refer / borderline | Ask for a guarantor or larger security deposit (subject to agreement, no statutory cap) |
| Fail | Decline politely; you are not required to give reasons, but do not cite protected characteristics |
| Tenant defaults during tenancy | Written demand → small-claims court (up to RM5,000, no lawyer needed) or Magistrates' Court → report to a licensed CRA only if consent was granted in the TA |
| Attempting self-help eviction | Unlawful — changing locks, cutting utilities or removing belongings without a court order exposes you to civil liability |
CTOS / CCRIS / 3× rent rule — what can a landlord actually see?
Three screening questions come up over and over: "Can I pull their CTOS or CCRIS?" "Can I blacklist them on CTOS if they default?" "Is the 3× rent rule a hard line?" The honest answer to all three is the same — no, with reasons that are not slogans.
The three answers below are the single best summary of what a Malaysian landlord can lawfully do at the screening moment, the default-recovery moment, and the income-check moment. Each one of the three has its own dedicated page in this cluster; this H2 is the umbrella.
Q1 — Can I pull their CTOS or CCRIS?
No. CCRIS is Bank Negara Malaysia's Central Credit Reference Information System. The information is owned by BNM and disclosed only to the consumer themselves and to licensed financial institutions that have a legitimate lending exposure. A private landlord has no standing to ask BNM, a bank, or any lender for a CCRIS print-out on a tenant. Accessing a CCRIS record without the consumer's consent is not a lawful option for you.
CTOS is a different beast. CTOS is a private credit reporting agency that markets a self-check product (MyCTOS Score, RM27.00 including SST; verify current price at ctoscredit.com.my) to consumers. The tenant requests their own report, pays for it, and may share the PDF with you. Asking a tenant to do this is lawful and a common ask. The line you cannot cross is pulling it yourself — whether directly through CTOS, through a "B2B" reseller, or by passing the tenant's IC to a third party who claims to do it for you. All of those routes operate without the consent that the Credit Reporting Agencies Act 2010 requires, and the legal exposure (PDPA + CRA breach) is on the landlord, not on the platform marketing the workaround.
A landlord who wants a structured credit picture can use consented screening through a licensed credit reporting agency (SPEEDHOME uses Experian) at the sign-up stage. The legal basis is the tenant's written consent captured in the tenancy sign-up flow, not the landlord's reach into the tenant's file.
Q2 — Can I blacklist them on CTOS?
No. CTOS is not a landlord default-filing tool. A landlord cannot submit a tenant default to CTOS directly. The lawful default-reporting route is to a licensed credit reporting agency — Experian is the operator SPEEDHOME works with on its managed platform — and only where the tenant gave written consent in the tenancy agreement.
What you cannot lawfully do, and what the PDPA + defamation risk attaches to:
- You cannot publish the tenant's IC, name, or arrears amount on a Facebook group, a WhatsApp community, a TikTok, a landlord forum, or a "blacklist" site. That is a PDPA 2010 breach (processing of personal data without a lawful basis) and a separate defamation exposure; the tenant's actual credit record is unaffected.
- You cannot pass the tenant's IC and arrears to a third party who claims to "list them on CTOS for you" — CTOS does not accept landlord-supplied default data on that basis.
- You cannot threaten any of the above as a collection tactic. A threat of unlawful disclosure is itself actionable in some scenarios and is a counter-productive move in any dispute.
What you can lawfully do after a verified default:
- Recover the money through the civil track — Magistrates' small-claims procedure for amounts up to RM5,000 (no lawyer required), Magistrates' Court for up to RM100,000, Sessions Court above that.
- Report the default to a licensed credit reporting agency (e.g. Experian) only where the tenancy agreement contained an explicit consent clause authorising the report. A landlord acting alone cannot furnish a default to a CRA; an appointed agent of the landlord, with consent captured in the TA, can.
Q3 — Is the 3× rent rule a hard line?
No. The "3× rent rule" (gross monthly income ≥ 3× monthly rent) is a screening convention that originated in US landlord practice. It is not a Malaysian statute, not a SPEEDHOME rule, and not a pass/fail line that the courts or the regulator will enforce. The 30% rent-to-income rule is a separate US HUD convention and is not Malaysian policy either.
What the 3× shorthand is actually pointing at is the substance behind it — payment capacity. A tenant with stable employment, a payslip history that supports the rent, an employer reference that checks out, and a clean credit picture is a tenant who can pay. A tenant who is short on the 3× shorthand but has six months of payslips showing overtime and a guarantor is a better bet than one who clears 3× on a one-month payslip. The hard line is the substance, not the multiple.
The screening checks that the substance rests on:
- Identity match (IC or passport against the application).
- Income verification (latest payslip, EA form, or a business-owner equivalent).
- Employment verification (employer reference called on a publicly verifiable number).
- Credit history through a licensed credit reporting agency with the tenant's consent.
- Bank statement pattern (12 months is the usual sample, the tenant provides it).
- Previous-landlord reference, called on a number from the building management rather than one the applicant supplies.
If a candidate clears all of the above, the 3× rule is a footnote. If a candidate fails one of them, the right move is to ask for a guarantor or a larger security deposit, not to cite a multiple that has no legal force.
What is the SPEEDHOME path: screening built in, not bolted on?
The platform runs consented Experian credit and income screening at the tenancy sign-up stage — before a tenancy is confirmed. Viewing is always free; no fee is ever charged to view a listing.
Because consent is captured at sign-up and the screening is run by a licensed credit-reporting partner (Experian, not CTOS), landlords on SPEEDHOME get a structured pass/refer/flag result without having to chase documents manually or navigate the "can I pull a CTOS?" confusion.
The platform also holds all deposit and rental payments to a company account — never a personal account — which is the same structural fix that protects against rental-payment scams.
If you want to screen and manage tenants outside a platform, the lawful path is: (1) collect written consent in the tenancy agreement for any future credit reporting, (2) ask the tenant to self-pull their CTOS report and share it voluntarily, (3) verify income with original documents, (4) call employer and previous-landlord references on publicly verifiable numbers. If a default later occurs, you can report it to a licensed CRA — but only where the agreement granted consent.
See how to screen tenants in Malaysia without legal issues for the full lawful sequence, and reporting a tenant default to a credit agency for what post-default reporting actually requires.
FAQ
Can I, as a landlord, pull my tenant's CTOS report myself?
No. A landlord cannot access a tenant's CTOS file without the tenant's consent. CTOS is a self-check service — the tenant requests their own report and may choose to share it with you. Accessing a credit file without the subject's consent is not permitted under the Credit Reporting Agencies Act 2010.
What is the difference between a CTOS self-pull and a platform credit check?
A CTOS self-pull is the tenant checking their own credit history and voluntarily sharing the report. A platform credit check — such as the Experian-based screening SPEEDHOME runs — is a consented check run by a licensed credit-reporting agency on behalf of the landlord, with written consent captured in the sign-up flow. They serve different purposes and have different legal bases.
Can I reject a tenant who fails screening?
Yes. Declining an applicant based on a failed credit or income check is lawful. You are not required to give specific reasons. You may not reject an applicant on grounds of race, religion, nationality or other protected characteristics — that exposes you to unlawful-discrimination risk and is also a weak screening criterion.
Can I report a bad tenant to CTOS after they default?
A verified rental default can only be reported to a licensed credit-reporting agency where the tenant gave consent in the tenancy agreement. Posting the tenant's IC, name, or details to a social media group or "report to a licensed credit agency with consent" is not lawful and exposes you to defamation and PDPA liability. See the guide on reporting a tenant default to a credit agency for the lawful steps.
How much does a tenant's CTOS self-check cost?
The MyCTOS Score self-check costs RM27.00 including SST per report — verify the current price at ctoscredit.com.my before advising a tenant, as pricing can change. The cost is paid by the tenant directly; it is not something a landlord arranges or pays.
Does SPEEDHOME use CTOS to screen tenants?
No. SPEEDHOME's consented credit screening runs through Experian, a separately licensed credit-reporting agency. The confusion arises because CTOS is the most publicly known credit brand in Malaysia; the actual screening engine matters less to tenants than knowing that the check is consent-based, run by a licensed agency, and covers credit history and income — which is what the SPEEDHOME flow delivers.
Is the 3× rent rule a Malaysian legal requirement?
No. The 3× rule is a US-origin screening convention, not a Malaysian statute. The 30% rent-to-income rule is a US HUD convention and is not Malaysian policy. The substance is payment capacity — verified income, employment, credit history, and references — not a single multiple.
How this page stays accurate. Statements rest on verified sources; figures are checked against a dated fact registry at every update. Report an error: [email protected].