Who must report to credit bureaus in Southeast Asia, and who may look: the reporting perimeter by country

Implications for lenders

Non-bank lenders can map, for each market, whether they must report, may join voluntarily or sit outside the bureau, because that status shapes both what they must submit and what they may see; in Malaysia reporting must start within 12 months of authorisation. Where a borrower's other lenders sit outside the perimeter, as moneylenders sit in Singapore's separate registry or voluntary members in Vietnam, a clean bureau result may support a smaller starting limit that grows with observed repayment. Consent capture before any enquiry or data share may need to be built into onboarding from the start.

Implications

Facts

Philippines: the Credit Information System Act (Republic Act No. 9510, approved 31 October 2008) defines a submitting entity as any entity that provides credit facilities, such as banks, quasi-banks, trust entities, investment houses, financing companies, cooperatives, non-governmental and micro-financing organisations, credit card companies, insurance companies and government lending institutions. It requires banks, quasi-banks, their subsidiaries and affiliates, life insurance companies, credit card companies and other entities that provide credit facilities to submit basic credit data and updates regularly to the Credit Information Corporation (CIC), and lets the CIC subject other credit providers to compulsory participation. The CIC may release consolidated basic credit data only to accessing entities (submitting entities and others it authorises), accredited private credit bureaus, outsource entities and borrowers, and to others only on a court order.

Indonesia: OJK's regulation on SLIK (POJK 18/POJK.03/2017) lets reporters that have met their reporting obligations request debtor information, alongside debtors themselves, licensed private credit bureaus and other parties acting under the law; reporters may use it only to process financing, apply risk management and identify debtor quality. POJK 11/2024, promulgated and in force on 31 July 2024, added five types of mandatory reporters: insurers and sharia insurers selling credit or suretyship cover, guarantee and sharia guarantee companies, and P2P lending platforms, which had one year from promulgation to comply ¹. It set 31 December 2025 for pawnshops offering fiduciary-secured loans that were not yet reporters. OJK said in July 2026 that SLIK had 2,169 reporting institutions ².

Malaysia: Bank Negara Malaysia's CCRIS FAQ says data come from participating financial institutions: licensed commercial, Islamic and investment banks, development financial institutions, certain insurers, payment instrument issuers and rehabilitation institutions, building societies, credit leasing companies and government agencies. A financial institution may not access the report of someone who is not its customer or potential customer. The central bank's credit bureau page adds that credit reporting agencies registered under the Credit Reporting Agencies Act 2010 may access individual borrowers' CCRIS data subject to the central bank's approval and only with the borrower's prior consent. For lenders licensed under the Consumer Credit Act 2025, the Consumer Credit Commission's FAQ (updated 24 September 2026) says a non-bank credit provider must establish credit reporting capabilities within 12 months of its authorisation date, covering positive and negative data and onboarding with a credit reporting agency of its choice; it also says bureau data and scores should not be relied on in isolation ³.

Vietnam: the State Bank of Vietnam's consolidated text of Circular 15/2023/TT-NHNN, as amended by Circular 46/2026/TT-NHNN (issued 9 September 2026, effective 1 November 2026), requires credit institutions to provide the full credit information indicator system to the National Credit Information Centre (CIC). Other organisations take part voluntarily under an information-exchange contract with the CIC: development, environmental and credit guarantee funds and microfinance programmes, debt trading and debt management companies, and organisations that provide lending, guarantee insurance, leasing, deferred or instalment purchase and pawn services. A voluntary organisation may receive credit information services only in line with the scope of information it provides, and providing a borrower's information to voluntary organisations, foreign credit information bodies and other organisations requires the borrower's consent.

Cambodia: an impact study prepared for IFC (February 2019) says that under the Prakas on Credit Reporting (May 2011), covered entities as defined in the Law on Banking and Financial Institutions must supply positive and negative information on consumers to the credit bureau, while non-regulated entities can also supply data. Data sharing and access operate on reciprocity, covered entities must use the bureau whenever they receive a new loan application, and consumer consent is required for data collection and access.

Singapore: the government's MoneySense guide (updated 28 September 2026) says Credit Bureau Singapore's information comes from members such as banks and credit card companies. Licensed moneylenders use a separate registry: the Ministry of Law's speech on the Moneylenders (Amendment) Bill (22 November 2023) says they must submit borrower information to the Moneylenders Credit Bureau (MLCB), obtain a credit report before granting a loan and update the bureau when borrowers repay, and that they were then unable to share borrowers' application and repayment information with other credit bureaux; the bill provided for disclosure to more third parties, such as a prescribed list of credit bureaux. On 21 October 2026 the ministry said Credit Bureau (Singapore) will continue to operate the MLCB until 27 October 2029.

Analysis

“Positive and negative credit data in Southeast Asia: what published sources describe” (the second part of this series) found that the bureaus described all record repayment conduct, so the practical question is whose repayment record they hold. The rules on who must report and who may enquire show three patterns.

The mandatory core is similar everywhere. Banks and other licensed lenders sit at the core of each system described here: the Philippine law names banks, quasi-banks, life insurers and card companies; Indonesia's list runs from commercial and rural banks to finance companies; Vietnam binds credit institutions; Cambodia binds covered entities under its banking law; Malaysia's CCRIS draws on banks, development financial institutions and other participating institutions.

The perimeter is moving outward into non-banks, by different routes. Indonesia made P2P lending platforms mandatory reporters by regulation. Malaysia requires non-bank consumer credit providers to report to a credit reporting agency of their choice. Vietnam keeps the duty on credit institutions but names lenders, leasing firms and deferred or instalment-purchase providers among organisations that may join by contract. Singapore keeps licensed moneylenders in a separate registry, whose operator was re-designated in October. The Philippine law already defines submitting entities broadly and lets the CIC widen compulsory participation.

Access largely follows contribution. Indonesian reporters may request debtor information once they meet their reporting obligations; Vietnamese voluntary members receive services in line with what they provide; Cambodia's system runs on reciprocity; Philippine accessing entities start from submitting entities. Consent is the second gate: Malaysia's credit reporting agencies need the borrower's prior consent to draw on CCRIS, Vietnam requires it before information goes to voluntary members, and Cambodia requires it for collection and access.

In T&S's view, this links back to “What a credit bureau holds, and how each kind of data shapes a lending decision” (the first part of this series): a clean bureau result is only as informative as the reporting perimeter behind it. For products that mostly sit with non-banks, such as BNPL and embedded finance, small online loans, moneylender credit and some earned wage access models, the borrower's other obligations may sit with lenders that report only voluntarily, report to a different bureau, or have only recently started reporting. Vehicle finance and SME lending are more often booked by finance companies and banks inside the mandatory core, though the same borrower may hold smaller debts outside it.

Counterpoints and uncertainties

The comparison rests on published rules and descriptions from different dates, from a 2008 law to a 2026 amendment; a duty on paper does not show how complete or timely reporting is in practice, and voluntary members may report only part of their portfolios. The Philippine law lets the CIC extend compulsory participation, so the effective perimeter there also depends on CIC circulars. Vietnam's amended circular takes effect on 1 November 2026, and implementation may differ from the text. A counterpoint to the T&S view: access does not always require being a reporter, since private credit bureaus in Malaysia and Indonesia can obtain regulator-held data under their own licences (in Malaysia with the central bank's approval and the borrower's prior consent), so a lender outside the mandatory perimeter may still see part of a borrower's record through them. Wider mandatory reporting also adds compliance cost for small lenders and enlarges the data held, and with it exposure to data-security incidents.

This article is based solely on publicly available sources.