Credit intelligence infrastructure for ASEAN's regulated lenders.
Bolehlah. Malay for “sure can.” Built into your credit floor.
Bureau data, AKAD-compliant origination, and decisions in minutes — built for the rails Malaysian lenders already use.
- Pilot program
- Opens at launch · 15 Jun
- Minutes
- Decision time · design target
- ASEAN
- Operating region
- CCRIS + CTOS
- Live bureau integration
The problem
Cooperative and regulated lenders in ASEAN run on paper, WhatsApp, and spreadsheets. Their borrowers wait days for decisions that should take minutes. Their underwriters work nights to clear queues that should clear themselves.
Their regulators, when they ask a question, expect an answer that nobody in the building can produce in real time.
None of this is the operator's fault. The category was built before the tools to do it well existed. We build those tools.
On the floor
What every lender's day actually looks like.
An underwriter clears sixty applications before lunch. By the end of the day she is still on yesterday's queue. The work is not the problem — the tooling is.
A compliance officer is asked for a single decision trail from fourteen months ago. He spends two weeks reconstructing it from paper, email threads, and a spreadsheet that has changed hands four times.
A regulator updates the AKAD form. Twelve lenders push paper updates to their branches. Bolehlah pushes a deployment.
The infrastructure
Three layers. One platform. Zero manual steps.
Underwriting
A decisioning layer that combines bureau-grade credit data with behavioural signal and policy logic specific to each lender. Approval lift you can evaluate in weeks, not months.
Compliance & audit
Every action — every consent, every signed AKAD, every disbursement instruction — written to an evidence trail a regulator can read without our help. PDPA, BNM AMLA, Shariah AKAD posture by default.
Disbursement & servicing
Money moves through the lender's own licensed banking rail — batch or API. Servicing — reminders, restructure, collection — runs on the borrower's preferred channel (Telegram today; WhatsApp coming soon).
Inside the system
How one application moves through the platform.
Underwriting decisions with confidence score, audit timestamp, and a three-tier scorecard written to a regulator-readable evidence trail.
Simulated example · WhatsApp coming soon
Onboarding, approval, disbursement, and servicing — on the channels borrowers already use. Telegram today; WhatsApp coming soon.
Real-time alerts on disbursement, scorecard outcomes, and portfolio drift — directly to the team on Telegram.
Every step explainable. Every output reproducible. Every action regulator-readable.
An AI workforce, priced like staff — tiers sized to your loan book, Officers à la carte.
See the rate card →Where to find B
Three surfaces. One audited environment.
Telegram is convenient (WhatsApp coming soon) — but chat apps only touch the surface. Many procedures need to redirect you to the app. Chatting inside the Bolehlah app is a holistic experience: secured environment, eKYC, statements, approvals — all by talking to B.
Surface · Quick
Quick check-ins
Ask balance, repayment status, or upload one document — directly in Telegram (WhatsApp coming soon). Familiar. Convenient. For everything more involved, B will hand you off.
Full account · Secured
Your full account in one app
Talk to B inside the Bolehlah app and the experience is end-to-end: run eKYC, view statements, approve disbursements, sign AKAD — without leaving the chat. Encrypted environment, biometric unlock.
Live on Google Play · App Store at launch
Full account · Browser
Full account on bolehlah.com
Everything the app does, on any browser. Sign in once with Google or your passkey. Step-up auth on sensitive actions.
The flywheel
The longer this runs, the harder it is to replicate.
Borrowers engage with Bolehlah — Telegram today, WhatsApp coming soon. Their behaviour, repayment cadence, and channel choice become signal. That signal sharpens the underwriting models running inside Bolehlah. Sharper models give lenders better approval precision. Better approval brings more lenders. More lenders mean more borrowers. More borrowers mean more behavioural data. The model improves again. The flywheel was the point.
The flywheel →
- Borrower engagement
- Behavioural signal captured
- Underwriting refinement
- Portfolio optimization · lender
- Better approval precision
- More lender adoption
- More borrower data
- Stronger system intelligence
- Borrower engagement
- Behavioural signal captured
- Underwriting refinement
- Portfolio optimization · lender
- Better approval precision
- More lender adoption
- More borrower data
- Stronger system intelligence
AI is the amplifier in this loop. The loop itself is the moat.
Why this becomes infrastructure
The defensibility is local, regulatory, and patient.
Cooperative & salary-deduction distribution
Bolehlah was designed against the realities of koperasi and Bank Rakyat-anchored lending. Salary-deduction (ANGKASA — integration underway), batch disbursement, and the day-to-day of supervised credit — handled by default, not retro-fitted.
Local underwriting datasets
CCRIS, CTOS, SPeKAR (integration underway) — and the experience of stitching them together for lenders who can't justify a separate integration each. Lenders inherit our work instead of repeating it.
ASEAN regulatory posture
Akta Pemberi Pinjam Wang 1951, BNM AMLA, PDPA 2010, Shariah AKAD. Compliance is written into the platform's spine, not bolted on later when a regulator asks.
Behavioural signal
Chat engagement (Telegram today; WhatsApp coming soon), response cadence, repayment rhythm — the credit signal that paper-based competitors don't capture. Used to widen safe approval, not to widen who borrows.
Hyper-automation
The platform runs itself. You supervise.
Master B and the seven virtual Officers handle the routine operations, compliance and collections work that typically consumes several full-time roles at a lender. Routine actions execute automatically within policy. Edge cases queue for a human review. Every action is signed, reversible, and visible in the audit feed.
Every autonomous action is signed into the audit chain you see at the top of the operator dashboard — same hash-chain primitive that backs Shariah AKAD signatures. Hyper-automation here means hyper-accountability, not hidden behaviour.
Trust & credentials
Built for the regulated environment.
- MD Status · MDEC
- Awarded Malaysia Digital (MD) Status by MDEC — Malaysia's recognition for qualifying digital-economy companies.
- Credit bureau · CTOS
- Live CTOSNet integration — CCRIS-linked credit checks and scores, on the same bureau rails Malaysian banks rely on.
- ISO 27001
- Information security management — certification in progress.
- eKYC · Innov8tif EMAS
- Identity verification by our licensed eKYC provider, Innov8tif (EMAS) — MyKad document checks, face match, and liveness detection. The eKYC platform's own certifications are held by the provider.
- Shariah Tawarruq rails
- Integration in final testing (UAT complete) with a licensed commodity-trading partner, for Shariah-compliant Tawarruq AKAD execution on an established commodity-trading platform.
- PDPA 2010
- Data privacy and technology risk management posture built into the platform's core, not retrofitted.
- Shariah AKAD-aware
- Akta Pemberi Pinjam Wang 1951 · BNM AMLA · Akta Koperasi 1993 — compliance by default.
Get the app
The member app — on every platform.
Bolehlah puts each borrower's loan, payments and B — their AI credit concierge — in one calm place, in English, Bahasa Melayu and 中文. Built for iPhone, Android and HUAWEI from day one.
Android is on Google Play today. iPhone arrives with the 15 June 2026 launch; HUAWEI AppGallery is in review.
Security
Institution-grade security, built into the foundation — not bolted on.
Credit data is sacred. Identity, data, device, and network are each defended in depth, recorded on a tamper-evident trail, and aligned with BNM expectations and the PDPA.
Protected Mode step-up
Every privileged action takes a second factor — TOTP or Face ID. Elevated sessions step back down on their own when idle.
Encrypted at rest
Sensitive fields are sealed with AES-256-GCM, with rotatable keys — so a database alone reveals nothing.
Tamper-evident audit
A hash-chained, append-only record — replicated off-site — so what happened can be proven and can't be quietly altered.
Per-institution isolation
Each lender's data is designed to be sealed off from every other at the database layer with row-level security.
Always-on platform shield
A managed firewall, bot defence, rate-limiting, and automatic lockout absorb abuse before it ever reaches your data.
Hardened mobile
Secrets stay in the device's secure enclave, never in the app bundle. Certificate pinning and jailbreak/tamper detection are rolling out to production builds.
Sovereign by design
AI processing runs in-region in Malaysia under contractual no-training terms, tenants are isolated at the database layer, and data retention follows a published policy.
BNM-aligned controls · PDPA-conscious data handling · Shariah trading rails · security-reviewed against its threat model.
Lenders · Borrowers · Investors
Lenders
Cooperatives, licensed money lenders, and supervised credit institutions. The full origination, underwriting, and servicing workflow.
Borrowers
Members who apply, sign AKAD, and manage their loan — via the app, web, or Telegram (WhatsApp coming soon). eKYC-verified, PDPA-protected.
Investors
Capital intelligence for those funding the loan book — portfolio performance, loan-book exposure, distributions, and compliance posture.
Open the CI portal →FAQ
Frequently asked questions.
What's the difference between Bolehlah and other CRM or loan-management systems?
Bolehlah doesn't replace your existing system — it plugs into it. The AI sits as a translation layer between your loan officers, your borrowers, and the data already in your loan-management platform. No migration, no rip-and-replace.
Where does my data live?
Your data is processed under a written data-processing agreement: encrypted at rest, hosted in-region, with per-lender isolation enforced at the database layer and a hash-chained audit trail on every access. AI processing runs in-region under contractual no-training, no-retention terms. We never sell data.
Do I need BNM approval to use Bolehlah?
No. Bolehlah is a SaaS tool, not a regulated lender. The lender remains the regulated entity — BNM, KPDN, SKM, and AKPK reporting obligations flow through the lender's licence as they always have. Bolehlah keeps the audit chain that makes those obligations easier to meet.
How long does it take to get up and running?
Designed to take two to five business days from BD sign-off — most of that window is data-source connection and policy calibration.
How does PDPA work?
Under the PDPA 2010 framework, Lunar Flame Sdn Bhd acts as the data processor; the lender is the data controller. We sign a written Data Processing Agreement and maintain a tamper-evident audit chain on every read and write. Borrowers consent through the lender's standard onboarding flow.
Do you support Shariah-compliant lending?
Yes. The loan-application journey is AKAD-aware: itemised cost disclosure, separation of profit and principal, explicit aqad e-signature step, and Shariah-board-reviewable audit trail. Conventional and Shariah books can run side by side under one tenant.
What channels does Bolehlah B work on?
Telegram, the web portal, and our Android app today; the iOS app arrives 15 June 2026, and WhatsApp is coming soon (pending review). Plus an HTTPS API for custom integrations. Channels share a single conversation history per borrower — the lender's officer always sees the full thread regardless of where the borrower started.
How is pricing set?
Four tiers — Starter, Growth, Scale and Enterprise — sized to your loan book, with Officers also available à la carte. See the rate card on the Pricing page; full amounts are published at launch.
Will there be a Bolehlah mobile app?
Yes — one role-aware Bolehlah app: lender staff, borrowers and investors each see their own portal. It's on Google Play today; the iOS App Store release lands with the 15 June 2026 launch, and HUAWEI AppGallery is in review. Until then, Telegram and the web portal cover the same surface.
What's the difference between chatting on Telegram versus the Bolehlah app?
Telegram chat with B (WhatsApp coming soon) is convenient for quick check-ins — balance, repayment dates, document uploads. Sensitive flows (eKYC, statement review, AKAD signing, approvals) need a more secured environment; the Bolehlah app and bolehlah.com both provide that. B can pivot you mid-conversation: just tap the deep-link B sends you.