CTOS Digital

Malaysia's dominant credit bureau, a PE owner rolling instead of exiting, and a moat the screens can't see

One more Malaysian stock: CTOS Digital (MarketCap: 1.6B MYR / 407M USD)

This idea came from the always interesting Envision Malaysia 10X.

A Rare Opportunity: The Business Buffett Would Buy While the World Burns | Part 1

Backstory and Ownership

CTOS Digital is Malaysia’s dominant Credit Bureau. It was founded in 1990 in Kuala Lumpur by Chung Tze Keong and Chung Tze Wen as a credit reporting business.

Original business: From establishment in 1990 through 2014, CTOS operated as a privately-held credit reporting agency, building up over 24 years of operating history. They built the eTR trade reference network (CTOS’s proprietary database of business-to-business payment experiences), and established the relationships with Malaysian banks that became the foundation of the current business.

In August 2014, private equity firm Creador acquired a 70% controlling stake in CTOS for 215M MYR through Creador II (the firm’s second fund).

What happened to the founders: The Chung brothers stepped back operationally and substantially exited their economic stake when Creador took over. So it is sadly not a founder-led company any longer.

IPO in 2021: When CTOS Digital listed on Bursa Malaysia in July 2021, Creador held 80% pre-IPO and sold 720 million shares, retaining 40% post-IPO. The IPO was 60× oversubscribed at 1.10 MYR per share. Stock debuted at 1.15 MYR and rose 65% in the first few months.

Creador’s exit pattern: Creador then steadily reduced their stake from the 40% post-IPO level to the current 19.63%, but as Envision Malaysia 10X notes, they rolled their remaining position from Creador II into Creador V at 1.35 MYR rather than fully exiting. This is unusual behaviour for a private equity firm - they could have completed the exit at fund maturity but chose to roll forward.

And even more interestingly, in March 2026, with the stock at MYR 0.64, Creador added another million shares well below that cost basis. The Employees Provident Fund (EPF) - Malaysia’s state pension fund - also accumulated.

So we got the private equity firm that is the largest shareholder accumulating below cost instead of exiting. Good signal!

The Credit Bureau Business

The Credit Bureau business is straightforward:

You, as a bank, want to lend someone money. But you only see how that person has behaved with you - not with every other lender they have used. So you subscribe to a credit bureau. You give them your customer data for free. In return, every time you want to approve a loan, you pay them for a report that shows you the full picture across every lender that person has ever used.

The credit bureau collects from everyone, organises the data, sells it back to the same banks that supplied it. They charge a subscription to be a member, then charge again per report. The data shows up on their balance sheet as nothing - it cost them zero to acquire. But selling each report costs them almost nothing too. That’s the whole business.

Network effects come into play in that every new bank that joins makes the bureau's data more complete, which makes the reports more valuable, which makes more banks want to join. Every report a bank pulls feeds more behavioural data back into the bureau. The scoring algorithm gets better. Subsequent reports get more accurate. The bureau gets stronger every time anyone uses it, and competitors who arrive later face a structural disadvantage - they have to convince banks to give them data for free while offering reports built on a smaller, weaker dataset.

In other words, this is a great business, high margins, capital-light, growing without capex, recession-resistant, strong network-effect moat.

And it’s extra great in frontier/emerging markets.

In developed markets, credit bureaus cover essentially the entire adult population, the listed pure-plays trade at 20-35× trailing P/E (Experian at 24×, Equifax at 31×, Fair Isaac at 32×+) with revenue-per-capita that grows roughly with GDP.

In emerging/frontier markets, both coverage and revenue-per-capita are dramatically lower - Malaysia’s credit reporting revenue per capita sits roughly six times below developed markets and twenty times below Singapore, despite Malaysia having reasonably high banking penetration. CTOS itself has approximately 5 million D2C consumer registrations against 16 million addressable adults, meaning 69% of the consumer-side market is still untapped. This produces a multi-decade runway as the underlying credit market develops alongside Malaysia’s growing GDP.

It also produces a more durable “winner takes most” dynamic: the first mover under a regulatory licence captures the network effect before competitors can establish data depth, and new entrants face a multi-year disadvantage that wouldn’t apply in mature markets.

Listed pure-play emerging/frontier-market credit bureaus are scarce though. Most credit bureaus across Africa, Latin America, and parts of Asia are either subsidiaries of global majors (TransUnion’s Africa operations, Creditinfo affiliates across 33 countries) or unlisted local operators. Singapore (CBA) and Malaysia (CTOS) are essentially the only Asian markets where you can buy this exposure as a listed equity. India’s CIBIL is owned by TransUnion. The Polish BIK is privately held. The category exists widely but the listed exposure is genuinely rare.

David Katunaric at The Mikro-Kap noticed the greatness of the business model a few years back and bought CBA in Singapore when it was cheap, even if it wasn’t his typical type of stock. He commented it with: Please don't call me a “compounder bro“ and allow me to introduce: CBA

Wherever a regulator establishes the credit reporting framework - licensing bureaus, requiring financial institutions to contribute data - you get the same business across markets. CIBIL in India, BIK in Poland, CRIF in Italy, CBA in Singapore, and CTOS in Malaysia.

Malaysia's Credit Reporting Agencies Act 2010 licenses multiple bureaus on top of the public credit registry that the Malaysian Central Bank operates and all banks are legally required to contribute to. CTOS sits on top of that infrastructure with 71% market share, built through accumulated network effects since 1990.

So one would expect CTOS to be very expensive. But no, it trades at very reasonable 15× forward P/E and 11× P/FCF.

Why is it relatively inexpensive?

The main reason is that CTOS has spent heavily on acquiring adjacent businesses since FY2019 - JurisTech (Malaysian loan origination software), RAM Holdings (corporate credit ratings), BOL (Thailand's dominant commercial credit bureau), and FinScore (Philippine and Indonesian alternative credit scoring). These look like pretty sensible acquisitions to me, but they make a lot of key metrics for CTOS look worse - temporarily I expect.

The reported ROIC fools the screens. Quant strategies and broad-market screens see “Malaysian small-cap with 8% ROIC” and pass.

As Envision Malaysia 10X shows, the 8% ROIC reported figure reflects capital deployed into these adjacent businesses, while the original bureau business still earns 38% on the capital actually deployed in it. The acquired businesses haven't yet generated returns proportional to the capital deployed because they're still scaling toward full utilisation.

As JurisTech, RAM, BOL, and FinScore reach full utilisation, the consolidated ROIC will trend back toward the core 35-43% pre-acquisition range.

Falling Gross Margins. Then you have that blended gross margin has fallen from 87% FY2021 to 68% FY2025. Most of this reflects reversing COVID-era cost waivers and FinScore international expansion at structurally lower margins (improving quarter-over-quarter) - none of which reflects underlying franchise deterioration.

There is also some genuine domestic cost pressure in Malaysia - labour and compliance cost inflation that management expects to stabilise at current levels. This is real, but cost pressure isn't a franchise problem. The franchise gets weaker if banks find alternatives, or if the regulatory mandate weakens. Neither is happening - market share is still 71%, the 2010 Act is unchanged, and no competitor has gone after CTOS on price. The moat is fine, costs just went up.

Small Cap Derating. Finally there has been a broader Malaysian small-cap selloff in 2025 and 2026. This affected most Malaysian listed small caps regardless of fundamentals. CTOS got pulled down with the broader market even though its regulatory-mandate cash flow profile makes it structurally more defensive than typical Malaysian small-caps.

Conclusion

CTOS has as strong a moat as one can get short of being a regulated monopoly, has an amazing runway, not only with the large untapped consumer pool in Malaysia and Malaysia’s economy growth, but also in Thailand, Indonesia and the Philippines. CBA in Singapore as a contrast is constrained by Singapore already being a developed credit market with high penetration, and CBA is also more expensive at forward P/E 22.

Basically CTOS is very cheap for what it is, and possibly a rare opportunity.
I have added it to the FrontierViking portfolio. And this time I did the right thing of buying it first, and writing about it after!

I have now bought Critical Holdings as well, and there I did the complete opposite, write about it first, wait until it goes up 22% and then buy it.