If your company is on Bursa's Main Market and is not one of the MYR2 billion-plus names that reported last year, FY2026 is your first cycle under the National Sustainability Reporting Framework. That is closer than it sounds.
Group 1 has already been through it. You have the advantage of watching what went wrong for them, and roughly one reporting year to act on it.
Key points
- Group 2 is the rest of the Main Market. Your first NSRF reporting year is FY2026.
- Assurance is not mandatory for FY2026. Mandatory reasonable assurance starts for Group 1 with periods beginning on or after 1 January 2028, deferred a year from 2027 by the ACSR, as announced by the Securities Commission Malaysia on 17 September 2026; Group 2 follows a year later, from 2029.
- The climate-first transition relief narrows what you disclose. It does not lower the standard of evidence behind it.
- The decisions that cause first-cycle rework, boundary, Scope 2 method, factor vintage, cost a day now and weeks later.
Which issuers are in Group 2
Under the National Sustainability Reporting Framework, large Main Market listed issuers with market capitalisation of MYR2 billion and above began using the ISSB Standards in 2025. That was Group 1. The requirement extends to other Main Market listed issuers in 2026.
If you are on the Main Market and were not in the first cohort, you are Group 2.
What Group 2 must disclose for FY2026
The headline is climate. Main Market listed issuers may apply the standards with transition reliefs focused on a climate-first approach for two full financial years.
That is a real concession and worth using. It means your FY2026 effort concentrates on climate-related disclosure instead of the full sustainability surface.
What it does not do is soften the evidence expected behind the numbers you publish. A Scope 2 figure disclosed under transition relief is still a Scope 2 figure someone may later test.
Assurance: what is decided and what is still open
This is where a lot of secondhand commentary is wrong, so be careful what you plan against.
Reasonable assurance on Scope 1 and Scope 2 GHG emissions is mandatory in phases, starting with Group 1 for annual reporting periods beginning on or after 1 January 2028. The date has already moved once. The Securities Commission Malaysia's media release of 17 September 2026 says the Advisory Committee on Sustainability Reporting (ACSR) deferred it a year, from 1 January 2027, following a review of the first cohort of 91 Group 1 listed issuers that found further improvements to the quality of disclosures are needed. Group 2 follows a year later, from 2029, and Group 3 from 2030. Until then, listed issuers continue to state whether their sustainability disclosures were internally reviewed or independently assured, and any independent assurance must follow ISSA 5000, the only designated standard. The release also says: "The remaining proposals relating to the sustainability assurance framework will be communicated in due course." For the dates before and after and the first assured period for each group, see Malaysia's assurance timeline after the deferral.
Two things follow. First, you are not obliged to obtain assurance on your FY2026 disclosure. Second, you should not build your FY2026 process on the assumption that assurance will never arrive, or that a deferred date is a cancelled one: the requirement is mandated and dated, and the date has already moved once.
The sensible posture is to report FY2026 as though it will be looked at, without paying for an engagement you are not required to have.
A practical sequence for the FY2026 cycle
Fix the boundary first. Which legal entities are in, which are out, and on what basis: operational control, financial control, equity share. Write the answer down before anyone collects a kilowatt-hour. Changing it in month nine invalidates work already done.
Decide the Scope 2 method and say so. Location-based and market-based produce different numbers. IFRS S2 sets out what must be disclosed; your internal record needs to show which you applied and why.
Pin the emission factor vintage. Record the publisher, the release year and the exact value used. This is the single most common reason a figure cannot be reproduced a year later.
Attach documents to figures as you go. Not into a shared folder. Linked to the specific number they support, at the moment you use them.
Minute the governance. If your disclosure says the board oversees climate reporting, there should be minutes where that visibly happened. A paragraph asserting oversight, with no meeting behind it, is the easiest finding an assurer will ever write.
What Group 1 learned the hard way
The most useful thing about going second is that the first cohort has already found the potholes.
Three recur. Site data arriving late and unverified: consumption figures emailed from operations in the final fortnight, typed straight into the model because there is no time to query them. Boundary drift: an entity treated as in scope by the sustainability team and out of scope by group finance, discovered at consolidation. And governance written ahead of reality, where the disclosure describes an oversight process that the minutes do not evidence.
None of these is a data problem. All three are timing problems: decisions made late, by people under pressure, without a record.
The counter is unglamorous. Agree the boundary in writing before data collection starts. Give site contributors a deadline that is four weeks earlier than you think you need. And put climate on a board or committee agenda early enough that the minutes exist before you write the governance section.
What to have in place before year end
Three artefacts, none of them glamorous.
A one-page description of how the data gets from site to disclosure. A record of who reviewed and approved each figure, with dates. And the source documents themselves, retrievable without asking the person who collected them.
Those three carry most of the weight, and the full set of tests they have to survive is covered in The audit trail behind your climate numbers.
The opinion: the FY2026 relief is a scheduling gift, not a standard-lowering one. Group 2 reporters who treat climate-first as permission to be informal will do the work twice: once now, and again when assurance arrives, on data that by then is a year cold and owned by someone who has left.
Common questions
Who is in NSRF Group 2?
Group 2 covers Main Market listed issuers other than the large-cap issuers already in Group 1. Group 1 was Main Market issuers with market capitalisation of MYR2 billion and above, who began reporting under the ISSB Standards for FY2025. Group 2 follows for FY2026.
Is assurance mandatory for Group 2 in FY2026?
No. Mandatory reasonable assurance on Scope 1 and Scope 2 GHG emissions starts for Group 1 with annual reporting periods beginning on or after 1 January 2028, deferred a year from 1 January 2027 by the Advisory Committee on Sustainability Reporting, as announced by the Securities Commission Malaysia on 17 September 2026. Group 2 follows a year later, from 2029. It does not apply to FY2026 reporting. Treat any statement that Group 2 must obtain assurance for FY2026 with caution.
What does the climate-first transition relief allow?
Main Market listed issuers may apply the IFRS Sustainability Disclosure Standards with transition reliefs focused on a climate-first approach for two full financial years. In practice that lets you concentrate on climate-related disclosures before broadening. It reduces the breadth of what you disclose. It does not reduce the evidence expected behind the figures you do disclose.
What should a Group 2 reporter do first?
Fix the boundary and the method before collecting data. Decide which entities are in scope, whether you are reporting location-based or market-based Scope 2, and which emission factor source and vintage you are using. Recording those decisions at the start costs a day and prevents the most common first-cycle rework.
Where do you stand against IFRS S2?
A free 6-minute diagnostic scores your readiness across all four pillars and sends a 12-page gap report naming what is missing.
Run the free diagnostic →