This article first appeared in The Edge Malaysia Weekly on October 11, 2021 - October 17, 2021

CTOS Digital Bhd is hopeful that its access to Bank Negara Malaysia’s Central Credit Reference Information System (CCRIS) will be reinstated in the soonest possible time frame.

Group CEO Dennis Martin tells The Edge in an email reply that the credit reporting agency submitted its initial findings to Bank Negara last Friday after going through rigorous independent assessment.

He says that the assessment undertaken to date, which remains ongoing, shows that no breach has been detected in CTOS.  The group is proactively sharing reports of the various assessments and additional security measures undertaken to Bank Negara on a regular basis.

Martin adds that CTOS will continue to work on its finalised compromise assessment report and associated requirements, which will be provided to the central bank as soon as it is available.

“The upliftment (of the temporary suspension of access to CCRIS) will depend on Bank Negara’s review of our security infrastructure and processes. Based on our extensive internal and external party assessments, we do not see any areas of concern and are hopeful that our CCRIS access would be reinstated in the soonest possible time frame.

“We are in constant update with customers (including banks, large corporations and small- and-medium enterprises), and all parties are eager for the reinstatement so that the necessary processes and checks can resume, especially with the economy reopening,” says Martin.

To recap, on Sept 30, CTOS’s wholly-owned subsidiary CTOS Data System Sdn Bhd received a directive from Bank Negara regarding the temporary suspension of its access to CCRIS effective Oct 1.

The temporary suspension was not restricted to CTOS, but to all credit reporting agencies on the back of alleged data leaks involving several government bodies. Bank Negara stressed that the move was a proactive and pre-emptive one.

CTOS was granted access to CCRIS data in 2015. Other credit reporting agencies that have access to CCRIS include Credit Bureau Malaysia Sdn Bhd and Experian Information Services (Malaysia) Sdn Bhd.According to Nomura Research’s report, it appears to be the first time since then that access has been suspended.

Nomura opines that the suspension will not be dragged on for long given the disruptive nature it has on customers needing credit checks and eKYC checks.

“Note that while banks have the option to directly access CCRIS, in reality this is not so straightforward as banks cannot switch overnight from using CTOS credit checks to using direct CCRIS data without back-testing and verifying their workaround models.

“Furthermore, even though banks might switch to using internal scorecards during the disruption, there remain many customers such as telcos that still cannot access CCRIS, so they will need to wait for access suspension to be lifted soon before they can resume credit checks,” says the research house.

Martin highlights that CTOS places “paramount importance” on cyber security risk and data breach protection, and its system regularly undergoes comprehensive penetration tests, vulnerability assessment and audit by third-party IT security specialist firms to ensure its robustness.

“We constantly ensure that our IT and data security framework, policies, procedures, and systems are benchmarked against Bank Negara’s Risk Management in Technology (RMiT) standards and ISO27001, as well as other stringent global standards.

“We believe we are well-positioned to defend our data assets against any potential cyber security attacks, and will continue to proactively enhance our processes and set the benchmark standards in the industry,” he says.

When the announcement of the temporary suspension of its access to CCRIS was announced on Oct 1, CTOS — which debuted on the stock exchange in July — saw its share price come under selling pressure.

Between the end of the trading day on Sept 30 and Oct 4, CTOS shed a total of 7.4% from RM2.02 to RM1.87.

Nevertheless, it rebounded quickly after that. By Oct 7, it hit RM2.05, putting the group’s market capitalisation at RM4.51 billion. The strong rebound implied that investors were not unnerved by the news of the announcement.

“I don’t think investors’ confidence was affected much by the announcement. We have to remember that there is more to CTOS than CCRIS data. Customers use CTOS for other purposes than just CCRIS,” opines a fund manager who is optimistic about CTOS.

“It was a good time to accumulate the shares when it slipped. It was only a temporary blip in the share price, as we can see how the share price recovered after that. The valuations are steep, but it usually is the case for ‘good’ companies,” he adds.

Analysts’ estimates show CTOS’ FY2021 price earnings ratios ranging between 64.5 times and 90.35 times.

Fund managers also do not think a prolonged suspension of the group’s access to CCRIS data will damage investor confidence.

“The damage from this suspension will be limited as CTOS has such a dominant position in the industry that their clients will probably have no other option but to wait together with CTOS for resumption.

“Meanwhile, all will have to go through a temporary period of inconvenience. Suspension or temporary system down is such a common occurrence that most have learned to tolerate it,” says another fund manager.

It is worth noting that CTOS’ market share dwarfs those of its competitors. As at 2020, CTOS’ market share in Malaysia amounted to 71.2%. Coming in second is its associate company, Experian, with 17.5% in 2020, followed by Credit Bureau Malaysia with 7%.

The fund manager believes that CTOS’ prospects are bright with its market dominance and its ability to introduce new value-added services for users.

CTOS categorises its customers into four segments: key account, made up of some 430 of its highest revenue-generating customers and selected customers where it provides solutions based on its unique business requirements; commercial; direct-to-customer; and international B2B.

According to a third-party report in its listing prospectus, the credit reporting agency market in Malaysia has been growing steadily and will continue to grow at a compound annual growth rate of 13% from 2021 to 2025.

Credit Suisse, in its initiation report, says it believes CTOS can potentially sustain a 46% per annum growth in core net profit over the next five years, driven by rapid revenue growth from its key customer segments.

“There is huge upside potential to grow its customer base as the commercial customer base of 17,000 small medium enterprises is only a fraction of the customer size of 100,000 and the consumer subscriber base of 1.4 million is only a small portion of its database of 15 million consumer credit data.

“We believe our projected growth is achievable, given that new products capture secular growth opportunities, expansion into new verticals, and growth in contribution from newly-acquired entities,” it says.

Credit Suisse has a RM2.50 target price for CTOS, the most bullish among research houses covering the stock.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's AppStore and Androids' Google Play.