CTOS Digital Berhad (5301.KL) - Deep Dive Research Report

Financial Services / Credit Reporting | Listed on Bursa Malaysia (Main Market) | Report date: 6 June 2026

Reporting cadence note: CTOS reports quarterly. The five most recent reporting periods used throughout this report are Q1 FY26 (quarter ended 31 Mar 2026, announced 24 Apr 2026), Q4/FY25 (ended 31 Dec 2025, announced 29 Jan 2026), Q3 FY25 (ended 30 Sep 2025, announced 30 Oct 2025), Q2 FY25 (ended 30 Jun 2025, announced 25 Jul 2025), and Q1 FY25 (ended 31 Mar 2025, announced 25 Apr 2025). The most recent sits well within the 90-day window. CTOS does not publish full verbatim concall transcripts; its quarterly analyst briefings are reconstructed here from the results announcements and the media coverage of those briefings (The Star, The Edge, Business Today), which is flagged where it matters.

Section 1: What the company does

CTOS Digital is Malaysia's dominant credit bureau. In plain terms: when a Malaysian bank, a telco, a landlord, an SME, or an ordinary person wants to know whether someone or some business can be trusted to pay back money, they pull a CTOS report. CTOS collects information about how individuals and companies have handled credit and obligations - court judgments, bankruptcies, trade payment behaviour, directorships, company filings - merges it with the central bank's own credit data, scores it, and sells the answer. It is, functionally, the place where a borrower's financial reputation in Malaysia is written down and looked up.

The business began in 1990 as CTOS Data Systems Sdn Bhd in Kuala Lumpur, building a database of litigation and bankruptcy records that lenders could query. The pivotal ownership event came in 2014, when the private-equity firm Creador bought a 70% stake for about RM215 million and professionalised the company - cleaning up data governance, investing in technology, and stitching together acquisitions to turn a records-lookup service into a full-stack credit-intelligence group. CTOS listed on Bursa Malaysia's Main Market in July 2021 at RM1.10 a share; the stock closed its debut up 47% at RM1.62, and the IPO raised roughly RM1.2 billion, most of which (around RM990 million) was an offer-for-sale that let early holders, including Creador, monetise.

The core value proposition is informational asymmetry resolved at low cost. A lender approving a RM200,000 car loan or a RM5,000 credit card needs to know default risk before committing capital. Building that knowledge internally is impossible for any single institution because no one bank sees a borrower's full obligations across the system. CTOS aggregates the whole picture - including data the bank cannot legally see on its own - and delivers a verdict in seconds for a few ringgit. The cost of the report is trivial against the loss avoided on one bad loan, which is why the service is effectively non-discretionary spending for any lender.

What makes this hard to replicate is not the software; it is three things stacked on top of each other. First, regulatory access: under Malaysia's Credit Reporting Agencies Act 2010, only registered CRAs may operate, and only a handful have approval to tap Bank Negara Malaysia's CCRIS (Central Credit Reference Information System), the national bank-loan registry. Second, the proprietary data lake that CTOS has assembled over 35 years - litigation, trade references, directorships, and now alternative "thin-file" data - which a new entrant cannot buy off a shelf. Third, the installed base: nearly every Malaysian financial institution is already wired into CTOS, and over 1.4 million individuals hold a "CTOS ID" account, so the network effect of being the default credit-check rail compounds.

A concrete example. A Malaysian bank receives a personal-loan application. Its loan-origination system, which may itself run on software from JurisTech (a CTOS associate), makes an API call to CTOS. CTOS pulls the applicant's CCRIS bank-repayment record, layers on its own litigation and bankruptcy data, adds trade-payment behaviour from its eTR alternative-data product, runs the bundle through a proprietary CTOS Score, screens the identity against the CTOS IDGuard fraud bureau, and returns a single decision-ready report. The bank approves or declines in near-real-time. CTOS bills per report (Key Accounts), or via subscription and analytics retainers, and the same plumbing serves an SME checking a new customer's creditworthiness or an individual monitoring their own score in the CTOS app.

Management frames the destination as becoming "the Trusted Intelligence Behind Every Transaction" across ASEAN (Q1 FY26 results commentary, Apr 2026) - a tell that the strategy is to move from selling discrete reports toward being embedded in the decision layer of every credit event in the region.

Section 2: Business segments

CTOS reports formally along two geographic segments - Malaysia and International - but runs the business along three customer segments that cut across geography. Both lenses matter, so this section covers the customer segments (where the operating story lives) and treats International as its own sub-section because it is a distinct regulatory and economic animal.

Key Accounts (the anchor)

This is the franchise. Key Accounts are the large financial institutions and corporates - banks, insurers, telcos, large lenders - that consume credit reports, scores, analytics, and decisioning at scale. They buy on a per-report and subscription basis and increasingly on high-margin analytics and bespoke scoring retainers. The core capability here is depth of integration: CTOS is wired into the loan-origination and account-monitoring workflows of essentially the entire Malaysian banking system, and switching out a credit-data feed embedded in regulated lending processes is slow, risky, and rarely attempted. This is the segment management points to when it talks about banks adopting "more sophisticated credit analysis solutions" and AI-powered tools. It is the cash engine and the beachhead from which higher-margin analytics are sold.

Commercial (the SME growth lane)

The Commercial segment serves small and medium businesses that need to check customers, suppliers, and counterparties. There are far more SMEs than banks, the relationship is lighter-touch, and the product is more self-serve. The capability that matters here is breadth of the commercial-data file (company reports, directorships, litigation, trade references) plus a frictionless platform. Management has repeatedly described the Commercial playbook as "customer acquisition, activation and retention" (Q3 FY25 and Q1 FY26 commentary) - i.e. it is a funnel business where the job is to get SMEs onto the platform and keep them transacting. It exists separately because the economics (volume, lower ARPU, self-serve) and the buyer (a business owner, not a bank credit committee) are different from Key Accounts.

Direct-to-Consumer / D2C (the brand and the moat-feeder)

Over 1.4 million individuals hold a CTOS ID, checking their own credit scores and reports, monitoring for fraud, and managing their financial reputation. D2C is comparatively small in revenue but strategically outsized: it builds the consumer brand (in Malaysia, "to be CTOS-ed" is vernacular), it generates recurring consumer subscriptions, and it feeds the data flywheel as consumers engage. Management has guided D2C to "healthy growth" via new product launches, embedded partnerships (notably with TNG Digital, operator of the Touch 'n Go eWallet), and a redesigned mobile app launching in H1 2026 (Q1 FY26 commentary, Apr 2026). It exists separately because it is a consumer marketing-and-app business, not a B2B data feed.

International (the margin-scaling bet)

International is the formal second reporting segment and is structurally distinct: different regulators, different (often thinner) credit-data environments, and an economic model centred on alternative-data credit scores rather than CCRIS-backed reports. It runs through direct operations in Indonesia and the Philippines plus equity stakes in regional credit-information businesses (BOL in Thailand, CIBI in the Philippines). International is the highest-growth piece - segment profit rose roughly 48% in FY25 and 24.5% year-on-year in Q1 FY26 - and management's stated capability claim is to be "a leading alternative data provider" across ASEAN, monetising proprietary scoring on thin-file borrowers who have no formal bank record. Indonesia turned profitable in Q1 FY26 (Apr 2026 briefing). It exists separately because the regulatory moat that protects CTOS in Malaysia does not exist abroad, so International must win on data and product rather than on a CCRIS licence.

Section 3: Products and business detail

CTOS's catalogue layers from raw data lookups up to embedded decisioning software. The meaningful products:

• CTOS Credit Reports & CTOS Score - the flagship. Consumer and commercial credit reports combining CCRIS bank-loan data, litigation/bankruptcy records, directorships, and a proprietary credit score. Sold per-report to Key Accounts, on subscription to Commercial, and direct to consumers.
• CTOS Credit Manager (CCM) - a portfolio-monitoring and batch-screening tool that lets businesses continuously monitor the credit health of their customer book and trigger alerts on adverse changes (a new lawsuit, a missed payment pattern). Recurring, sticky revenue.
• eTR and eTR Plus - the alternative-data products. eTR ("electronic trade reference") captures non-bank payment behaviour - how a person or firm pays utilities, rent, instalments, trade suppliers - so that "thin-file" borrowers with little formal banking history can still be scored. This is strategically central because it widens the addressable population and deepens the proprietary data the competition cannot copy.
• CTOS IDGuard - a fraud-and-compliance bureau that screens identities for fraud and AML/KYC purposes. It integrates identity-verification and fraud technology from GBG plc, a UK-listed (AIM) identity and fraud specialist, white-labelled into the CTOS stack.
• eKYC / Customer Acquisition & Digital onboarding (CAD) - digital identity verification and onboarding tools that let lenders sign up customers remotely and compliantly.
• Commercial data & bulk data sales - comprehensive company credit reports and bulk commercial datasets sold to corporates and analytics buyers.
• Analytics, scoring and decisioning services - the high-margin layer: bespoke scorecards, model-building, and analytics retainers for Key Accounts. Management repeatedly singles out analytics as the margin-accretive growth driver.

"Manufacturing" - the data and delivery process. There is no factory; the production line is data. CTOS ingests structured feeds (CCRIS via Bank Negara, courts, company registry, its own trade-reference network, partner data), cleans and matches records to the right entity, scores them through proprietary models, and serves results through APIs and web/app interfaces. The hard parts are entity resolution (correctly matching a fragmented identity across many noisy sources), data governance under the CRA Act and personal-data law, and uptime/security for a system that the banking system depends on. A material operational milestone came in Q1 FY26, when CTOS completed its migration to the cloud, which management frames as the foundation for AI-led automation of operations.

Geographies. Malaysia is the mature home market (roughly 85% of revenue and the regulatory fortress). International - direct operations in Indonesia (profitable as of Q1 FY26) and the Philippines, plus equity exposure to Thailand (BOL) - is the expansion frontier, run on the alternative-data model. CTOS targets lifting international from below 13% of revenue toward roughly 20% by 2028.

Associates and strategic stakes (these are economically part of the group's earnings even though not consolidated revenue):

• JurisTech (49%) - a Malaysian enterprise-software firm whose products run lending origination, decisioning, and collections inside banks. CTOS paid RM205.8 million for the stake (its largest-ever acquisition), part-funded by a RM270 million share placement. JurisTech is strategically elegant: it puts CTOS's data inside the bank's own loan-decision software, deepening lock-in. Management has called JurisTech's outlook strong on an expanding order book.
• BOL - Business Online (Thailand), ~22.65% (raising toward 24.9%) - Thailand's leading credit-information and business-risk provider, the International beachhead in Thailand.
• RAM Holdings - the rating-agency group (RAM Ratings), giving CTOS exposure to credit ratings and ESG-rating products.
• CIBI Information (Philippines) - a Philippine credit bureau to which CTOS's data-systems arm provides software, advisory and project services, anchoring the Philippines presence.

Section 4: Customers

CTOS sells to three buyer types whose purchasing logic differs sharply.

Financial institutions and large corporates (Key Accounts). The buyer is a bank's credit-risk function, head of retail lending, or chief risk officer, supported by procurement and compliance. The decision criteria are data completeness, score predictiveness, regulatory standing of the provider, system reliability, and integration depth. Sales cycles for new analytics mandates are long (months, involving model validation and procurement), but once embedded, the relationship is multi-year and renews quietly. They buy CTOS because it is the only provider that combines CCRIS access, the deepest litigation/commercial data, and the analytics layer in one integrated feed - and because every peer bank already uses it, so the data is the de facto industry standard.

SMEs (Commercial). The buyer is a business owner or finance manager who needs to vet a customer before extending trade credit. The criteria are simplicity, price, and speed; the sales cycle is short and self-serve. They buy because a RM30 report can prevent a RM30,000 bad debt, and because CTOS's commercial file is the most comprehensive available.

Individuals (D2C). The buyer is a consumer wanting to know or protect their score before applying for a loan, or monitoring for identity fraud. The cycle is instant and the relationship is a subscription. They buy on brand trust and convenience.

Switching costs. For Key Accounts these are high and structural. A bank's credit-decision workflow is wired to CTOS's APIs; ripping it out means re-integrating, re-validating risk models against a new data source, retraining staff, and getting regulators and internal model-risk committees comfortable - all for a service whose cost is immaterial. The data itself is also not fully portable: CTOS's proprietary litigation, trade-reference, and scoring history would not transfer. For consumers, switching is low-cost but there is little reason to, since CTOS is the score lenders actually look at.

Concentration. No single customer dominates disclosed revenue; the Key Accounts base spans essentially all major Malaysian banks. The more relevant concentration is regulatory (dependence on continued CCRIS access) and geographic (Malaysia is the overwhelming majority of revenue), not customer-name concentration.

Contract structure. A healthy mix of recurring and transactional: per-report transactional volume (cyclical with lending activity), subscriptions (Commercial and D2C), and analytics/monitoring retainers (Key Accounts, the highest-margin and most recurring). This blend gives revenue reasonable predictability with upside geared to loan-origination volumes in the economy.

Section 5: Competitive landscape

Malaysia's credit-reporting market is a regulated near-oligopoly. Under the Credit Reporting Agencies Act 2010, only registered CRAs may operate, and only three have approval to access Bank Negara's CCRIS to issue private credit reports: CTOS, Experian, and Credit Bureau Malaysia. CTOS held roughly 71% market share as of 2020 and remains the clear leader. That structure is the heart of the moat - a new entrant cannot simply build a better product, because the gating factor is regulatory access plus 35 years of accumulated data.

Where CTOS wins: the deepest and longest data history, the broadest product stack (reports + alternative data + fraud + analytics + embedded software via JurisTech), the consumer brand, and the installed base across the banking system. Where it is exposed: Experian is a globally resourced parent with superior analytics IP and bureau technology, and could win competitive analytics mandates on sophistication; Credit Bureau Malaysia has quasi-official backing (its owners include Credit Guarantee Corporation) that can matter for certain government-linked or SME-guarantee-related flows. Abroad, CTOS loses the regulatory shield entirely and competes on data and product alone.

Barriers to entry domestically are high and durable: the CRA licence and CCRIS access are the binding constraints, and regulators have no incentive to multiply CRAs. The realistic competitive threat is not a new entrant but margin pressure on the analytics layer from a well-funded incumbent (Experian) and the slow risk that fintech lenders build proprietary alternative-data scoring in-house. There is no evidence of commoditisation at the core report level - that remains a protected, high-margin franchise.

(Market caps are rough peer-size references only, as of June 2026, and move continuously.)

Section 6: Industry

Demand for credit information is a derivative of lending activity and of the formalisation of credit in an economy. Every loan application, credit-card issue, trade-credit decision, tenancy check, and increasingly every "buy now, pay later" transaction generates a credit-check event. The structural drivers are Malaysia's growing consumer-credit penetration, the digitalisation of lending, the rise of non-bank and fintech lenders, and regulation that progressively mandates the use of formal credit data.

Size and growth. Malaysia's credit-scoring/reporting industry grew at roughly a 12.9% CAGR from 2016 to 2020, with industry revenue projected to roughly double to around RM406 million by 2025 (CTOS prospectus / industry-research citations). It is a small but steadily compounding market, expanding faster than nominal GDP because credit usage and the regulatory requirement to check credit are both rising.

Regulation as the defining force. The industry exists inside the CRA Act 2010 and is gated by CCRIS access controlled by Bank Negara. The most important recent regulatory tailwind is the Consumer Credit Act 2025, which brings BNPL providers and non-bank lenders under formal supervision and is expected to require them to use credit-reporting data. Management estimates this could contribute 5-10% of revenue over the next three years - it effectively expands CTOS's mandated customer base. The flip side is regulatory risk: pricing scrutiny, data-protection rules, and consumer-group pressure for more timely and accurate data updates are recurring themes.

Where CTOS sits in the chain. It is the central aggregation-and-scoring layer between the raw data sources (the central bank's CCRIS, courts, registries, trade networks) and the credit decision-makers (lenders). It does not originate loans and takes no credit risk itself; it sells the information that prices that risk.

Cyclicality. Moderate and asymmetric. Report volumes track loan-origination activity, so a sharp credit slowdown reduces transactional demand. But the recurring subscription/monitoring/analytics base cushions downturns, and in stress periods lenders actually intensify monitoring of existing books - so demand is more resilient than pure lending volume. The dominant tailwinds are regulation (Consumer Credit Act), digital lending growth, and ASEAN financial deepening; the dominant headwind is a mature domestic core where Malaysian volume growth is structurally limited, which is precisely why management is pushing International and analytics.

Section 7: Growth triggers

All items drawn from the five most recent quarterly results and their analyst briefings.

• Consumer Credit Act 2025 / BNPL mandate. Management expects the new requirement for BNPL and non-bank lenders to use credit-reporting data to contribute 5-10% of revenue over the next three years (Q1 FY26 briefing, Apr 2026).

  "buy now, pay later providers and non-bank lenders [will be required] to utilise credit reporting data ... could contribute 5% to 10% of revenue over the next three years." (Q1 FY26 briefing, Apr 2026)

• International revenue scaling to ~20% by 2028. Lifting international from below 13% of revenue (FY24) toward roughly 20% by 2028, leveraging existing infrastructure to scale margins (Q1 FY26 briefing, Apr 2026). Repeated theme across FY25 and Q1 FY26.

• Indonesia turned profitable in Q1 FY26, with the Philippines expansion underway (Q1 FY26 briefing, Apr 2026). The international profit growth (+48% segment profit in FY25, +24.5% YoY in Q1 FY26) has been a repeated bright spot across all five periods.

• Cloud migration completed in Q1 FY26, shifting focus to AI-led automation to streamline operations and lower the cost base (Q1 FY26 briefing, Apr 2026).

• Redesigned consumer mobile app launching in H1 2026, alongside new D2C product launches and embedded partnerships (Q1 FY26 and Q3 FY25 commentary). The app revamp was first flagged for "end-2025" in Q3 FY25 and re-timed to H1 2026 - a repeated trigger.

• New digital distribution partnerships beyond TNG Digital. Management intends to add embedded-finance partners beyond the existing Touch 'n Go relationship to widen consumer distribution (Q1 FY26 briefing, Apr 2026).

• Selective acquisitions and synergistic partnerships across Malaysia and ASEAN. Management has stated in every recent period it is "actively evaluating" M&A and partnerships (FY25 results Jan 2026; Q1 FY26 Apr 2026) - a repeated, standing trigger.

• Margin and returns targets to 2028. Cost-to-income ratio targeted at 40-43% by 2028 (from ~46%), return on equity targeted at 16-18%, and 10-12% revenue CAGR over 2026-2028 (Q1 FY26 briefing, Apr 2026).

Section 8: Key risks

Regulatory dependence on CCRIS access (low probability, catastrophic). CTOS's core product is only possible because regulators grant it access to Bank Negara's CCRIS. A policy change restricting or repricing that access, or admitting more CRAs to level the field, would strike at the heart of the franchise. This is low-probability - the regulator has shown no such intent and the three-player structure is stable - but it is the single risk that could permanently impair the moat. The same regulatory machinery is also a near-term tailwind (Consumer Credit Act), so CTOS lives and dies by its standing with policymakers.

Mature domestic core with limited volume growth (high probability, moderate drag). Malaysia is roughly 85% of revenue and the market is mature. Malaysia segment profit actually fell in FY25 (-7.3%) and was only marginally up (+0.7%) in Q1 FY26, with management repeatedly blaming "higher operational expenditures." The mechanism: if domestic volume growth stalls while costs rise, group earnings stagnate unless International and analytics carry the load. This is the live, visible risk - it already showed up as flat-to-down Malaysian profit across the last several quarters.

Execution risk on the International pivot (medium probability, moderate-to-high impact). The entire growth narrative leans on lifting International to ~20% by 2028. Abroad there is no regulatory moat, thinner data, and tougher competition; Indonesia only just turned profitable. If the international ramp disappoints, the equity story loses its main engine.

Cost discipline and margin delivery (medium probability, moderate). Management has guided cost-to-income down to 40-43% by 2028 from ~46%, but the recent record is of rising opex eroding Malaysian profit. The cost-optimisation programme launched in early 2025 was promised to deliver "progressively" - delivery here is unproven and is the crux of whether earnings re-accelerate.

Leadership transition (medium probability, moderate). The long-serving CEO Erick Hamburger stepped down in 2025, with Loh Kok Leong (Kevin Loh) taking the helm on an interim basis from May 2025. A bureau's relationships with regulators and banks are partly personal; a prolonged or unsettled succession can slow large mandates. Management has projected continuity, but the transition coincided with the softest stretch of domestic earnings.

Heavy institutional selling overhang (high probability, share-price not business risk). The EPF, the single-largest shareholder, has been a relentless seller (see Section 11). This is a supply/demand overhang on the stock rather than a statement about the business, but it can depress the price and signals at least one large holder rotating out.

Data-integrity and reputation risk (low probability, high impact). A credit bureau's product is trust. A data breach, a high-profile scoring error, or a defamation-style ruling (CTOS has faced litigation historically over inaccurate records) could damage the brand and invite regulatory penalties. Consumer groups have already pushed for more timely and accurate data updates.

Section 9: Walk the talk

The five periods assessed: Q1 FY25 (Apr 2025), Q2 FY25 (Jul 2025), Q3 FY25 (Oct 2025), Q4/FY25 (Jan 2026), Q1 FY26 (Apr 2026). The most recent is within 90 days. A caveat: CTOS does not publish verbatim transcripts, so the assessment relies on results announcements and analyst-briefing coverage; the promises tracked are the concrete, datable ones.

The story opens in Q1 FY25 on the back foot. Net profit fell ~31% year-on-year, and the company simultaneously announced that CEO Erick Hamburger was leaving, with Loh Kok Leong stepping in as interim CEO from 1 May 2025. Management's pitch was that revenue was still growing (+6.3%) on D2C and Key Accounts, that "growth opportunities remain abundant," and crucially that a cost-optimisation programme would deliver benefits "progressively in the coming quarters." That is the central promise to track.

"expecting benefits [of cost optimisation] to materialise progressively in the coming quarters" (Q1 FY25, Apr 2025)

Through Q2 FY25 the picture was mixed: net profit was RM21.16m and the half-year profit (RM35.6m) was well below the prior year's RM46.32m, with Malaysian segment profit explicitly down on higher opex. The promised cost benefits were not yet visible in the numbers - revenue grew but margins did not. By Q3 FY25, the new CEO struck a more confident tone, framing two consecutive quarters of sequential profit growth and saying "momentum is improving" following cost optimisation. That is partly credible - sequentially profit did improve - but year-on-year, Q3 profit (RM24.69m) was still down versus the prior year, and 9-month profit (RM60.29m) was meaningfully below the prior year's RM73.88m. So the "momentum improving" claim was true sequentially and misleading year-on-year; an honest reading is that they stabilised a deteriorating trend rather than returned to growth.

The turn finally arrived in Q4/FY25 (Jan 2026). Q4 net profit jumped to RM44.57m (from RM32.4m a year earlier), salvaging the full year at RM104.86m - essentially flat versus FY24's RM106.27m on revenue up 7% to RM326m. So the full-year promise of "stabilise and re-accelerate" landed as "stabilise": revenue grew, profit held flat, and the cost programme produced a strong Q4 but did not lift the full year above the prior year. International (+48% segment profit) delivered as repeatedly promised.

Q1 FY26 (Apr 2026) is the strongest evidence for management credibility: net profit +29.9% year-on-year, International +24.5%, Indonesia turned profitable as flagged, cloud migration completed, and - importantly - management put hard, falsifiable medium-term targets on the table (international to ~20% by 2028, cost-to-income to 40-43%, ROE 16-18%, 10-12% revenue CAGR, BNPL 5-10% of revenue). This is a management team that, after a rough transition year, is now willing to be measured against specific numbers.

Assessment. This is management that under-delivered through a leadership-transition year (the cost programme took far longer to show in profit than the "coming quarters" framing implied, and the app timeline slipped) but did not misrepresent the direction, and has since delivered on the concrete operational items (Indonesia profitability, cloud migration, international growth). The tone has shifted from vague optimism to specific, trackable targets. The fair verdict: not chronic overpromisers, but historically a touch optimistic on timing; the Q1 FY26 willingness to commit to hard 2028 targets is the real credibility test now running.

Section 10: Shareholder friendliness index

Dividends. CTOS operates a payout policy of roughly 60-70% of profit and pays four interim dividends a year. Dividend per share was about 2.19 sen in FY2023, rose to about 3.25 sen in FY2024, and came in at roughly 2.70 sen in FY2025 (FY25 quarterly declarations of 0.44 + 0.65 + 0.75 + 0.86 sen; sources: The Star/The Edge quarterly results, stockanalysis.com dividend history). The pattern is grow-then-trim: the FY24 figure was flattered by a step-up, and the FY25 reduction is not a policy retreat but a direct consequence of flat-to-slightly-lower net profit under a fixed payout ratio (FY25 net profit RM104.86m vs FY24 RM106.27m). With payout running near 70%, dividends track earnings closely - so the FY25 dip reflects the soft earnings year, not reduced shareholder generosity.

Buybacks and dilution. There is no active share-buyback programme; MoatMap's database records zero buybacks for 5301.KL over the trailing three years, consistent with CTOS's high-payout-dividend approach to capital return. On dilution, the share count is broadly stable at roughly 2.28-2.3 billion shares; the only material issuance in recent history was the RM270 million placement used to fund the 2022 JurisTech acquisition, and there has been no ongoing option-driven creep of note since. Shares are neither being retired nor materially created.

Verdict: Returns Capital (via dividends, not buybacks) - CTOS pays out the large majority of earnings as dividends under a ~60-70% payout policy, with the FY25 dip explained entirely by flat earnings rather than reduced commitment.

Section 11: Insider activities

Source: MoatMap cross-market disclosure database (market: MY), current as of 2026-06-06 01:11 UTC. Bursa Malaysia's announcement portal is gated, so per the data-block instruction this is the sole source for this section. Transactions cited as (Bursa Changes in Substantial Shareholder's / Director's Interest, <date>).

Over the last 12 months there were 30 transactions across 6 insiders: 4 buys and 26 sells - net selling, dominated overwhelmingly by one seller.

Buys - read the signal. The standout is Group CFO Tan Ming Yew buying 50,000 shares twice within two weeks (RM32,500 on 22 May and RM29,500 on 3 June 2026, at roughly RM0.59-0.65 per share). The absolute sums are modest, but two open-market purchases by the CFO in close succession, into a stock under heavy institutional selling pressure, is a genuine conviction signal - the finance chief stepping in personally while the EPF dumps stock. On 5 June 2026, Creador V L.P. - the private-equity sponsor that built the company - bought 1,000,000 shares, and Jade Vine bought 1,000,000 shares the same day. Creador buying is notable because its historical posture has been to sell down post-IPO; a fresh purchase by the sponsor, alongside a second substantial holder, in the same session that the CFO is also accumulating, is a small cluster of insider buying at depressed prices. None of the individual purchases is large enough to flag as a "very bullish signal" on its own, but the clustering (CFO twice + sponsor + another substantial holder, all within two weeks at low prices) is the bullish tell here.

Sells - work out the why. The selling is almost entirely one name: the Employees Provident Fund Board, responsible for 20 of the 26 sell transactions, including a single 49.3-million-share block (2.17% of the company) on 15 May 2026 plus a long string of smaller daily disposals through May. The EPF is Malaysia's national pension fund and the largest CTOS shareholder; its selling reads as portfolio rebalancing / position trimming by a large passive-leaning institution, not an insider-information signal about the business - the EPF routinely trims positions across its book and is not involved in management. The reason is not disclosed in the filings beyond the standard substantial-shareholder notices; on the evidence it is best read as strategic rotation, reason not formally disclosed. The secondary seller, Aberdeen/abrdn (the two entities mirror each other because one holds through the other, so the share counts double-count a single economic position), made small disposals - consistent with a fund manager paring an emerging-markets holding, again with no disclosed business-specific reason.

Net assessment. On raw counts insiders are net sellers, but the picture is bifurcated and the nuance matters: the selling is concentrated in non-management institutional holders rebalancing (EPF above all, plus abrdn), while the buying comes from the people closest to the business and the franchise - the Group CFO (twice) and the founding PE sponsor Creador. Management/sponsor accumulation against an institutional-holder exit is, on balance, a mildly bullish insider signal: the EPF overhang is a share-price headwind rather than a verdict on fundamentals, and the CFO-plus-sponsor buying into that weakness is the more information-rich behaviour.

Section 12: Scenarios

Bull case. The Consumer Credit Act 2025 lands as a genuine demand shock in CTOS's favour: every BNPL operator and non-bank lender in Malaysia is compelled to plug into credit-reporting data, and because CTOS is the default rail, the new volume flows disproportionately its way, adding the upper end of the 5-10% revenue contribution and arriving faster than guided. The cost-optimisation programme and completed cloud migration convert into visible operating leverage, dragging the cost-to-income ratio toward the 40-43% target so that revenue growth drops through to profit at a higher rate. International compounds: Indonesia, now profitable, scales; the Philippines through CIBI reaches breakeven; BOL in Thailand contributes more, and international crosses 20% of revenue ahead of 2028. The analytics layer - bespoke scorecards and decisioning sold into banks - grows faster than the report base, lifting group margins. JurisTech wins larger bank-software mandates that pull more CTOS data into lending workflows. The new CEO settles in, the EPF overhang clears, and the stock re-rates as a regional credit-intelligence compounder rather than a mature Malaysian bureau.

Base case. CTOS does roughly what it has guided. Malaysia grows low-to-mid single digits - a mature, defended franchise that throws off cash but does not surprise to the upside - while costs stay a swing factor that management contains but does not dramatically improve. The Consumer Credit Act provides a real but gradual tailwind, contributing toward the lower end of the 5-10% range over three years. International keeps delivering double-digit growth and creeps toward the high-teens share of revenue, with Indonesia profitable and the Philippines and Thailand contributing modestly. Revenue grows around the guided 10-12% CAGR, net profit re-accelerates off the flat FY25 base, dividends rise with earnings under the ~70% payout policy, and the equity story is steady compounding rather than fireworks. The EPF finishes its selling, removing the overhang over time.

Bear case. The Malaysian core stalls: a credit slowdown cuts report volumes, opex keeps rising faster than revenue, and the cost programme's benefits prove one-off rather than structural - so group profit flatlines or slips again, as it effectively did in FY25. The international pivot disappoints: without a regulatory moat abroad, CTOS finds Indonesia and the Philippines more competitive and lower-margin than hoped, and the 20%-by-2028 ambition quietly slips. The Consumer Credit Act, instead of a windfall, comes with pricing scrutiny or data-update obligations that raise compliance costs without commensurate revenue. A data-integrity incident or an adverse court ruling dents the brand and invites regulatory penalty. The leadership transition unsettles key regulator and bank relationships at the wrong moment, and the persistent EPF selling caps the share price. In the worst version, a regulatory reshaping of CCRIS access or CRA licensing erodes the very moat the whole thesis rests on.

Sources:

• Business Today - CTOS Q1 FY26 results
• The Star - CTOS cautiously optimistic on 2026
• The Star - CTOS to ramp up overseas revenue (Q1 FY26 briefing)
• The Star - CTOS Digital wraps FY25 with RM104.86m net profit
• The Star - CTOS posts RM24.69m in 3Q FY25
• The Star - CTOS posts 2Q FY25 net profit of RM21.16m
• The Star - CTOS posts lower 1Q FY25 profit, announces interim CEO
• The Star - CTOS eyes ASEAN growth (Q1 FY25 briefing)
• JurisTech - 49% stake sale to CTOS
• The Edge - CTOS to buy 49% of JurisTech for RM205.8m
• Ringgit Oh Ringgit - Experian vs CTOS vs Credit Bureau Malaysia
• stockanalysis.com - CTOS dividend history
• Business Today - EPF trims stake in CTOS
• The Star - CTOS, the pride and legacy of Creador (IPO)
• CTOS Digital Investor Relations
• Insider & buyback data: MoatMap cross-market disclosure database (market: MY), as of 2026-06-06.

Note: Section 13 (Further Reading) is omitted - SemiAnalysis, Stratechery, and MBI Deep Dives have no qualifying coverage of CTOS Digital.

Would you like me to write this out to a .md file in the working directory?